| author | Gregory Szorc <gps@mozilla.com> |
| Mon, 18 Feb 2013 21:18:15 -0800 | |
| changeset 122273 | e8f8a3f6f1f67c07b9f62dab068ebb97c5f508d0 |
| parent 122272 | 29181e9515ec6502c76e221b81a3bab370dab8e2 (current diff) |
| parent 122221 | 148ea95584b4e1b4c610732e7c1e3e4a69dd7a6f (diff) |
| child 122283 | 3f0f2fc4bd0f4c9df2061a1ce9fd462a1a86fa4c |
| child 122299 | e219bbd25e3eb96207fde1479303cecba44336e5 |
| push id | 24327 |
| push user | gszorc@mozilla.com |
| push date | Tue, 19 Feb 2013 05:22:32 +0000 |
| treeherder | mozilla-central@e8f8a3f6f1f6 [default view] [failures only] |
| perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
| milestone | 21.0a1 |
| first release with | nightly linux32
e8f8a3f6f1f6
/
21.0a1
/
20130219031055
/
files
nightly linux64
e8f8a3f6f1f6
/
21.0a1
/
20130219031055
/
files
nightly mac
e8f8a3f6f1f6
/
21.0a1
/
20130219031055
/
files
nightly win32
e8f8a3f6f1f6
/
21.0a1
/
20130219031055
/
files
nightly win64
e8f8a3f6f1f6
/
21.0a1
/
20130219031055
/
files
|
| last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
| releases | nightly linux32
21.0a1
/
20130219031055
/
pushlog to previous
nightly linux64
21.0a1
/
20130219031055
/
pushlog to previous
nightly mac
21.0a1
/
20130219031055
/
pushlog to previous
nightly win32
21.0a1
/
20130219031055
/
pushlog to previous
nightly win64
21.0a1
/
20130219031055
/
pushlog to previous
|
--- a/editor/libeditor/base/nsEditor.cpp +++ b/editor/libeditor/base/nsEditor.cpp @@ -4561,18 +4561,17 @@ nsEditor::CreateTxnForDeleteSelection(ED // Check whether the selection is collapsed and we should do nothing: if (selection->Collapsed() && aAction == eNone) { return NS_OK; } // allocate the out-param transaction nsRefPtr<EditAggregateTxn> aggTxn = new EditAggregateTxn(); - uint32_t rangeCount = selection->GetRangeCount(); - for (uint32_t rangeIdx = 0; rangeIdx < rangeCount; ++rangeIdx) { + for (int32_t rangeIdx = 0; rangeIdx < selection->GetRangeCount(); ++rangeIdx) { nsRefPtr<nsRange> range = selection->GetRangeAt(rangeIdx); NS_ENSURE_STATE(range); // Same with range as with selection; if it is collapsed and action // is eNone, do nothing. if (!range->Collapsed()) { nsRefPtr<DeleteRangeTxn> txn = new DeleteRangeTxn(); txn->Init(this, range, &mRangeUpdater);
new file mode 100644 --- /dev/null +++ b/layout/generic/crashtests/842132-1.html @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + var e = document.body; + var sel = window.getSelection(); + + window.getSelection().removeAllRanges(); + var r0 = document.createRange(); + r0.setStart(e, 0); + r0.setEnd(e, 1); + window.getSelection().addRange(r0); + var r1 = document.createRange(); + r1.setStart(e, 1); + r1.setEnd(e, 1); + window.getSelection().addRange(r1); + + window.getSelection().deleteFromDocument(); +} + +</script> +</head> + +<body onload="boom();" contenteditable="true">x</body> +</html>
--- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -423,8 +423,9 @@ test-pref(layout.css.flexbox.enabled,tru test-pref(layout.css.flexbox.enabled,true) load 737313-3.html load 762764-1.html load 786740-1.html asserts(12) test-pref(layout.css.flexbox.enabled,true) load 798020-1.html test-pref(layout.css.flexbox.enabled,true) load 798235-1.html test-pref(layout.css.flexbox.enabled,true) load 799207-1.html asserts(12) test-pref(layout.css.flexbox.enabled,true) load 799207-2.html test-pref(layout.css.flexbox.enabled,true) load 804089-1.xhtml +load 842132-1.html
--- a/layout/generic/nsSelection.cpp +++ b/layout/generic/nsSelection.cpp @@ -2925,19 +2925,19 @@ nsFrameSelection::DeleteFromDocument() return NS_ERROR_NULL_POINTER; mDomSelections[index]->GetIsCollapsed( &isCollapsed); if (isCollapsed) { return NS_OK; } - uint32_t rangeCount = mDomSelections[index]->GetRangeCount(); - for (uint32_t rangeIdx = 0; rangeIdx < rangeCount; ++rangeIdx) { - nsRefPtr<nsRange> range = mDomSelections[index]->GetRangeAt(rangeIdx); + nsRefPtr<mozilla::Selection> selection = mDomSelections[index]; + for (int32_t rangeIdx = 0; rangeIdx < selection->GetRangeCount(); ++rangeIdx) { + nsRefPtr<nsRange> range = selection->GetRangeAt(rangeIdx); res = range->DeleteContents(); if (NS_FAILED(res)) return res; } // Collapse to the new location. // If we deleted one character, then we move back one element. // FIXME We don't know how to do this past frame boundaries yet.