Be consistent in what text nodes we look at in the #ifdef DEBUG pre-loop and the actual loop. Bug 822723
authorSimon Montagu <smontagu@smontagu.org>
Sun, 23 Dec 2012 00:13:29 -0800
changeset 122512 4f30345471b0fbe40f534aa7a592f0cf78c379cf
parent 122511 b81ccb796b727ef291d3999cfec56872b08f7419
child 122513 4aee8b87bea8950b1b05438736df699017e383e5
push idunknown
push userunknown
push dateunknown
bugs822723
milestone20.0a1
Be consistent in what text nodes we look at in the #ifdef DEBUG pre-loop and the actual loop. Bug 822723
content/base/crashtests/822723.html
content/base/crashtests/crashtests.list
content/base/src/DirectionalityUtils.cpp
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/822723.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  outer.setAttribute("dir", "auto");
+  var inner = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  inner.appendChild(document.createTextNode("A"));
+  inner.appendChild(document.createTextNode("B"));
+  outer.appendChild(inner);
+  inner.setAttribute("dir", "ltr");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -114,8 +114,9 @@ load 771639.html
 load 752226-1.html
 load 752226-2.html
 HTTP(..) load xhr_abortinprogress.html
 load 786854.html
 load xhr_empty_datauri.html
 load 815477.html
 load 815500.html
 load 816253.html
+load 822723.html
--- a/content/base/src/DirectionalityUtils.cpp
+++ b/content/base/src/DirectionalityUtils.cpp
@@ -362,27 +362,43 @@ static nsINode*
 WalkDescendantsSetDirectionFromText(Element* aElement, bool aNotify = true,
                                        nsINode* aStartAfterNode = nullptr)
 {
   MOZ_ASSERT(aElement, "aElement is null");
 
   nsIContent* child;
   if (aStartAfterNode &&
       nsContentUtils::ContentIsDescendantOf(aStartAfterNode, aElement)) {
+    nsIContent* firstNode = aStartAfterNode->GetNextNode(aElement);
+
 #ifdef DEBUG
+    // In debug builds, assert that aStartAfterNode is correctly set by checking
+    // that text node descendants of elements up to aStartAfterNode don't have
+    // any strong directional characters
     child = aElement->GetFirstChild();
-    while (child && child != aStartAfterNode) {
+    while (child && child != firstNode) {
+      // Skip over nodes whose text node descendants don't affect directionality
+      // of their ancestors
+      if (child->IsElement() &&
+          (DoesNotParticipateInAutoDirection(child->AsElement()) ||
+           child->NodeInfo()->Equals(nsGkAtoms::bdi) ||
+           child->HasFixedDir())) {
+        child = child->GetNextNonChildNode(aElement);
+        continue;
+      }
+
       if (child->NodeType() == nsIDOMNode::TEXT_NODE) {
         MOZ_ASSERT(GetDirectionFromText(child->GetText()) == eDir_NotSet,
                    "Strong directional characters before aStartAfterNode");
       }
       child = child->GetNextNode(aElement);
     }
+#else
+    child = firstNode;
 #endif
-    child = aStartAfterNode->GetNextNode(aElement);
   } else {
     child = aElement->GetFirstChild();
   }
 
   while (child) {
     if (child->IsElement() &&
         (DoesNotParticipateInAutoDirection(child->AsElement()) ||
          child->NodeInfo()->Equals(nsGkAtoms::bdi) ||