Bug 570624 - "ASSERTION: called nsGenericElement::SetText"; r=roc
authorEhsan Akhgari <ehsan@mozilla.com>
Wed, 09 Jun 2010 14:14:42 -0400
changeset 43412 3869cf687c267fbfa19be529ed54b36540498c0b
parent 43411 961e152b8b7bb57082da89fe20e07b8f0e1a48e8
child 43413 769defc70de5334923e2c11e94459dbe8c57fcab
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs570624
milestone1.9.3a5pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 570624 - "ASSERTION: called nsGenericElement::SetText"; r=roc
layout/forms/crashtests/570624-1.html
layout/forms/crashtests/crashtests.list
layout/forms/nsTextControlFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/forms/crashtests/570624-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var xt = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'textbox');
+  document.body.appendChild(xt);
+  xt.setAttribute('disabled', "true");
+  xt.setAttribute('value', "foo");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@@ -33,9 +33,10 @@ load 393656-2.xhtml
 load 402852-1.html
 load 403148-1.html
 load 404118-1.html
 load 404123-1.html
 load 455451-1.html
 load 457537-1.html
 load 457537-2.html
 load 478219-1.xhtml
+load 570624-1.html
 load 498698-1.html
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -817,19 +817,18 @@ nsTextControlFrame::SetSelectionInternal
                                          PR_FALSE);
 }
 
 nsresult
 nsTextControlFrame::GetRootNodeAndInitializeEditor(nsIDOMElement **aRootElement)
 {
   NS_ENSURE_ARG_POINTER(aRootElement);
 
-  nsCOMPtr<nsITextControlElement> txtCtrl = do_QueryInterface(GetContent());
-  NS_ASSERTION(txtCtrl, "Content not a text control element");
-  nsIEditor* editor = txtCtrl->GetTextEditor();
+  nsCOMPtr<nsIEditor> editor;
+  GetEditor(getter_AddRefs(editor));
   if (!editor)
     return NS_OK;
 
   return editor->GetRootElement(aRootElement);
 }
 
 nsresult
 nsTextControlFrame::SelectAllOrCollapseToEndOfText(PRBool aSelect)
@@ -1211,19 +1210,19 @@ nsTextControlFrame::AttributeChanged(PRI
   }
 
   nsCOMPtr<nsITextControlElement> txtCtrl = do_QueryInterface(GetContent());
   NS_ASSERTION(txtCtrl, "Content not a text control element");
   nsISelectionController* selCon = txtCtrl->GetSelectionController();
   const PRBool needEditor = nsGkAtoms::maxlength == aAttribute ||
                             nsGkAtoms::readonly == aAttribute ||
                             nsGkAtoms::disabled == aAttribute;
-  nsIEditor *editor = nsnull;
+  nsCOMPtr<nsIEditor> editor;
   if (needEditor) {
-    editor = txtCtrl->GetTextEditor();
+    GetEditor(getter_AddRefs(editor));
   }
   if ((needEditor && !editor) || !selCon)
     return nsBoxFrame::AttributeChanged(aNameSpaceID, aAttribute, aModType);;
 
   nsresult rv = NS_OK;
 
   if (nsGkAtoms::maxlength == aAttribute) 
   {