| author | Aryeh Gregor <ayg@aryeh.name> |
| Tue, 26 Aug 2014 16:13:22 +0300 | |
| changeset 201578 | a6832b6e110dd36c579d277835be5c6f9f5dddad |
| parent 201577 | 57a02fe884d961f66524ef7e03239d66b53eed0b |
| child 201579 | 6dd877592b3569d9dda4d58630d6ee4eb9cbca35 |
| push id | 48217 |
| push user | ayg@aryeh.name |
| push date | Tue, 26 Aug 2014 13:13:36 +0000 |
| treeherder | mozilla-inbound@a6832b6e110d [default view] [failures only] |
| perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
| reviewers | ehsan |
| bugs | 1057677 |
| milestone | 34.0a1 |
| first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
| last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
new file mode 100644 --- /dev/null +++ b/editor/libeditor/crashtests/1057677.html @@ -0,0 +1,9 @@ +<html><body></body><script> +document.designMode = "on"; +var hrElem = document.createElement("HR"); +var select = window.getSelection(); +document.body.appendChild(hrElem); +select.collapse(hrElem,0); +document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>"); +</script> +</html>
--- a/editor/libeditor/crashtests/crashtests.list +++ b/editor/libeditor/crashtests/crashtests.list @@ -53,8 +53,9 @@ load 766795.html load 767169.html load 769967.xhtml load 768748.html load 768765.html needs-focus load 771749.html load 772282.html load 776323.html needs-focus load 793866.html +load 1057677.html
--- a/editor/libeditor/nsHTMLDataTransfer.cpp +++ b/editor/libeditor/nsHTMLDataTransfer.cpp @@ -406,19 +406,19 @@ nsHTMLEditor::DoInsertHTMLWithContext(co // Adjust position based on the first node we are going to insert. NormalizeEOLInsertPosition(nodeList[0], address_of(parentNode), &offsetOfNewNode); // if there are any invisible br's after our insertion point, remove them. // this is because if there is a br at end of what we paste, it will make // the invisible br visible. nsWSRunObject wsObj(this, parentNode, offsetOfNewNode); - if (nsTextEditUtils::IsBreak(wsObj.mEndReasonNode) && - !IsVisBreak(wsObj.mEndReasonNode) ) - { + if (wsObj.mEndReasonNode && + nsTextEditUtils::IsBreak(wsObj.mEndReasonNode) && + !IsVisBreak(wsObj.mEndReasonNode)) { rv = DeleteNode(wsObj.mEndReasonNode); NS_ENSURE_SUCCESS(rv, rv); } // Remember if we are in a link. bool bStartedInLink = IsInLink(parentNode); // Are we in a text node? If so, split it.