Bug 1408170 - Set child correctly in HTMLEditRules::GetPromotedPoint(); r=masayuki

2017-10-12 23:29:51 -04:00 · 2017-10-12 23:29:51 -04:00 · 1349bede70
--- a/editor/libeditor/HTMLEditRules.cpp
+++ b/editor/libeditor/HTMLEditRules.cpp
@ -5572,7 +5572,7 @@ HTMLEditRules::GetPromotedPoint(RulesEndpoint aWhere,
           !htmlEditor->IsVisibleBRElement(priorNode) &&
           !IsBlockNode(*priorNode)) {
      offset = priorNode->GetParentNode()->IndexOf(priorNode);
-      child = node;
+      child = priorNode;
      node = priorNode->GetParentNode();
      priorNode = htmlEditor->GetPriorHTMLNode(node, offset, child, true);
    }
--- a/editor/libeditor/crashtests/1408170.html
+++ b/editor/libeditor/crashtests/1408170.html
@ -0,0 +1,20 @@
+<script>
+function jsfuzzer() {
+  try { document.execCommand("insertUnorderedList", false); } catch(e) { }
+  try { document.execCommand("delete", false); } catch(e) { }
+}
+function eventhandler1() {
+  try { window.getSelection().collapse(htmlvar00001,1); } catch(e) { }
+}
+function eventhandler2() {
+  try { htmlvar00002.appendChild(htmlvar00001); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<label id="htmlvar00002" contenteditable="true">
+<details ontoggle="eventhandler2()" open="true">
+</details>
+</label>
+<details ontoggle="eventhandler1()" open="true">
+<font id="htmlvar00001" dir="rtl">
+<summary>
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@ -90,3 +90,4 @@ load 1393171.html
 load 1402469.html
 load 1402904.html
 load 1405747.html
+load 1408170.html