Bug 880925 - Flush layout when caretPositionFromPoint is called. r=bz
authorCameron McCormack <cam@mcc.id.au>
Wed, 12 Jun 2013 13:20:19 +1000
changeset 146229 e856b38719c196bdbd73c00e6c7e804df4e86c06
parent 146228 7c414b4ad952392b6f9e842726b079ea540a9af2
child 146230 c9f80387acd7948c4419d4854be6320e4f24ba50
push id2697
push userbbajaj@mozilla.com
push dateMon, 05 Aug 2013 18:49:53 +0000
treeherdermozilla-beta@dfec938c7b63 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs880925
milestone24.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 880925 - Flush layout when caretPositionFromPoint is called. r=bz
content/base/src/nsDocument.cpp
layout/svg/crashtests/880925-1.svg
layout/svg/crashtests/881031-1.svg
layout/svg/crashtests/crashtests.list
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -9358,16 +9358,18 @@ nsIDocument::CreateTouchList(const Seque
 
 already_AddRefed<nsDOMCaretPosition>
 nsIDocument::CaretPositionFromPoint(float aX, float aY)
 {
   nscoord x = nsPresContext::CSSPixelsToAppUnits(aX);
   nscoord y = nsPresContext::CSSPixelsToAppUnits(aY);
   nsPoint pt(x, y);
 
+  FlushPendingNotifications(Flush_Layout);
+
   nsIPresShell *ps = GetShell();
   if (!ps) {
     return nullptr;
   }
 
   nsIFrame *rootFrame = ps->GetRootFrame();
 
   // XUL docs, unlike HTML, have no frame tree until everything's done loading
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/880925-1.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function boom()
+{
+    var svgText = document.createElementNS("http://www.w3.org/2000/svg", "text");
+    document.documentElement.appendChild(svgText);
+    var text1 = document.createTextNode("A");
+    svgText.appendChild(text1);
+    var text2 = document.createTextNode("");
+    svgText.appendChild(text2);
+    document.caretPositionFromPoint(0, 0);
+    setTimeout(function() {
+        text2.data = "B";
+        document.caretPositionFromPoint(0, 0);
+    }, 0);
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/881031-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+function boom()
+{
+    var svgText = document.getElementById("t");
+    svgText.firstChild.data = "C";
+    svgText.appendChild(document.createTextNode("D"));
+    document.caretPositionFromPoint(0, 0);
+}
+window.addEventListener("load", boom, false);
+
+</script>
+<text id="t">A</text>
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -161,8 +161,10 @@ load 843917-1.svg
 load 847139-1.svg
 load 849688-1.svg
 load 849688-2.svg
 load 860378-1.svg
 load 868904-1.svg
 load 873806-1.svg
 load 876831-1.svg
 load 877029-1.svg
+load 880925-1.svg
+load 881031-1.svg