Bug 1341137 part 1 - Make Selection::addRange silently reject ranges that have a different root. r=smaug a=jcristau
☠☠ backed out by cbd562b2b0b3 ☠ ☠
authorMats Palmgren <mats@mozilla.com>
Sat, 25 Feb 2017 11:33:34 +0100
changeset 378725 ba0e8ae48b470aa661a2f3ec769cd0b88f9a8139
parent 378724 09f5aa6b8913a6ba39d23f02a3016396024e1c64
child 378726 020e7124b44abdaac16d43cd2fabc0ed5af7f435
push id1419
push userjlund@mozilla.com
push dateMon, 10 Apr 2017 20:44:07 +0000
treeherdermozilla-release@5e6801b73ef6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug, jcristau
bugs1341137
milestone53.0a2
Bug 1341137 part 1 - Make Selection::addRange silently reject ranges that have a different root. r=smaug a=jcristau
layout/generic/nsSelection.cpp
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -4952,16 +4952,26 @@ Selection::AddRange(nsIDOMRange* aDOMRan
   ErrorResult result;
   AddRange(*range, result);
   return result.StealNSResult();
 }
 
 void
 Selection::AddRange(nsRange& aRange, ErrorResult& aRv)
 {
+  nsINode* rangeRoot = aRange.GetRoot();
+  nsIDocument* doc = GetParentObject();
+  if (doc != rangeRoot && (!rangeRoot ||
+                           doc != rangeRoot->GetComposedDoc())) {
+    // http://w3c.github.io/selection-api/#dom-selection-addrange
+    // "...  if the root of the range's boundary points are the document
+    // associated with context object. Otherwise, this method must do nothing."
+    return;
+  }
+
   // This inserts a table cell range in proper document order
   // and returns NS_OK if range doesn't contain just one table cell
   bool didAddRange;
   int32_t rangeIndex;
   nsresult result = addTableCellRange(&aRange, &didAddRange, &rangeIndex);
   if (NS_FAILED(result)) {
     aRv.Throw(result);
     return;