Bug 1090616 - Don't assume that the nodes we just pasted are still in the DOM, because mutation listeners suck like that. r=smaug, a=lmandel
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 10 Nov 2014 17:52:24 -0500
changeset 226039 609915862295
parent 226038 49f10dbc7d69
child 226040 4bdf71e69d10
push id4119
push userryanvm@gmail.com
push date2014-11-12 22:22 +0000
treeherdermozilla-beta@f2dd9f2a084a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug, lmandel
bugs1090616
milestone34.0
Bug 1090616 - Don't assume that the nodes we just pasted are still in the DOM, because mutation listeners suck like that. r=smaug, a=lmandel
editor/libeditor/nsHTMLDataTransfer.cpp
--- a/editor/libeditor/nsHTMLDataTransfer.cpp
+++ b/editor/libeditor/nsHTMLDataTransfer.cpp
@@ -652,16 +652,19 @@ nsHTMLEditor::DoInsertHTMLWithContext(co
       {
         rv = GetLengthOfDOMNode(selNode, (uint32_t&)selOffset);
         NS_ENSURE_SUCCESS(rv, rv);
       }
       else // we need to find a container for selection.  Look up.
       {
         tmp = selNode;
         selNode = GetNodeLocation(tmp, &selOffset);
+        // selNode might be null in case a mutation listener removed
+        // the stuff we just inserted from the DOM.
+        NS_ENSURE_STATE(selNode);
         ++selOffset;  // want to be *after* last leaf node in paste
       }
 
       // make sure we don't end up with selection collapsed after an invisible break node
       nsWSRunObject wsRunObj(this, selNode, selOffset);
       nsCOMPtr<nsINode> visNode;
       int32_t outVisOffset=0;
       WSType visType;