Merge the last PGO-green inbound changeset to mozilla-central
authorGregory Szorc <gps@mozilla.com>
Mon, 18 Feb 2013 21:18:15 -0800
changeset 132147 e8f8a3f6f1f67c07b9f62dab068ebb97c5f508d0
parent 132146 29181e9515ec6502c76e221b81a3bab370dab8e2 (current diff)
parent 132095 148ea95584b4e1b4c610732e7c1e3e4a69dd7a6f (diff)
child 132157 3f0f2fc4bd0f4c9df2061a1ce9fd462a1a86fa4c
child 132173 e219bbd25e3eb96207fde1479303cecba44336e5
push id2323
push userbbajaj@mozilla.com
push dateMon, 01 Apr 2013 19:47:02 +0000
treeherdermozilla-beta@7712be144d91 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone21.0a1
first release with
nightly linux32
e8f8a3f6f1f6 / 21.0a1 / 20130219031055 / files
nightly linux64
e8f8a3f6f1f6 / 21.0a1 / 20130219031055 / files
nightly mac
e8f8a3f6f1f6 / 21.0a1 / 20130219031055 / files
nightly win32
e8f8a3f6f1f6 / 21.0a1 / 20130219031055 / files
nightly win64
e8f8a3f6f1f6 / 21.0a1 / 20130219031055 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge the last PGO-green inbound changeset to mozilla-central
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -4561,18 +4561,17 @@ nsEditor::CreateTxnForDeleteSelection(ED
   // Check whether the selection is collapsed and we should do nothing:
   if (selection->Collapsed() && aAction == eNone) {
     return NS_OK;
   }
 
   // allocate the out-param transaction
   nsRefPtr<EditAggregateTxn> aggTxn = new EditAggregateTxn();
 
-  uint32_t rangeCount = selection->GetRangeCount();
-  for (uint32_t rangeIdx = 0; rangeIdx < rangeCount; ++rangeIdx) {
+  for (int32_t rangeIdx = 0; rangeIdx < selection->GetRangeCount(); ++rangeIdx) {
     nsRefPtr<nsRange> range = selection->GetRangeAt(rangeIdx);
     NS_ENSURE_STATE(range);
 
     // Same with range as with selection; if it is collapsed and action
     // is eNone, do nothing.
     if (!range->Collapsed()) {
       nsRefPtr<DeleteRangeTxn> txn = new DeleteRangeTxn();
       txn->Init(this, range, &mRangeUpdater);
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/842132-1.html
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var e = document.body;
+  var sel = window.getSelection();
+
+  window.getSelection().removeAllRanges();
+  var r0 = document.createRange();
+  r0.setStart(e, 0);
+  r0.setEnd(e, 1);
+  window.getSelection().addRange(r0);
+  var r1 = document.createRange();
+  r1.setStart(e, 1);
+  r1.setEnd(e, 1);
+  window.getSelection().addRange(r1);
+
+  window.getSelection().deleteFromDocument();
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true">x</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -423,8 +423,9 @@ test-pref(layout.css.flexbox.enabled,tru
 test-pref(layout.css.flexbox.enabled,true) load 737313-3.html
 load 762764-1.html
 load 786740-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 798020-1.html
 test-pref(layout.css.flexbox.enabled,true) load 798235-1.html
 test-pref(layout.css.flexbox.enabled,true) load 799207-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 799207-2.html
 test-pref(layout.css.flexbox.enabled,true) load 804089-1.xhtml
+load 842132-1.html
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -2925,19 +2925,19 @@ nsFrameSelection::DeleteFromDocument()
     return NS_ERROR_NULL_POINTER;
 
   mDomSelections[index]->GetIsCollapsed( &isCollapsed);
   if (isCollapsed)
   {
     return NS_OK;
   }
 
-  uint32_t rangeCount = mDomSelections[index]->GetRangeCount();
-  for (uint32_t rangeIdx = 0; rangeIdx < rangeCount; ++rangeIdx) {
-    nsRefPtr<nsRange> range = mDomSelections[index]->GetRangeAt(rangeIdx);
+  nsRefPtr<mozilla::Selection> selection = mDomSelections[index];
+  for (int32_t rangeIdx = 0; rangeIdx < selection->GetRangeCount(); ++rangeIdx) {
+    nsRefPtr<nsRange> range = selection->GetRangeAt(rangeIdx);
     res = range->DeleteContents();
     if (NS_FAILED(res))
       return res;
   }
 
   // Collapse to the new location.
   // If we deleted one character, then we move back one element.
   // FIXME  We don't know how to do this past frame boundaries yet.