Bug 1361052 - DeleteSelectionAndPrepareToCreateNode should be more safety. r=masayuki

Bug 768765 isn't enough for fix.  Since Selection::GetAnchorFocusRange can
return nullptr, we should consider this condition.

And I cannot reproduce this using crash test, so I add mochitest for this.

MozReview-Commit-ID: 8Ei5YBIBuWv

--HG--
extra : rebase_source : cd11517f73179d949479716a83baec0e1f492eca
This commit is contained in:
Makoto Kato 2018-04-13 16:58:06 +09:00
Родитель 441a45aca4
Коммит 2b953ae3f5
3 изменённых файлов: 54 добавлений и 1 удалений

Просмотреть файл

@ -4397,7 +4397,9 @@ EditorBase::DeleteSelectionAndPrepareToCreateNode()
{
RefPtr<Selection> selection = GetSelection();
NS_ENSURE_TRUE(selection, NS_ERROR_NULL_POINTER);
MOZ_ASSERT(selection->GetAnchorFocusRange());
if (NS_WARN_IF(!selection->GetAnchorFocusRange())) {
return NS_OK;
}
if (!selection->GetAnchorFocusRange()->Collapsed()) {
nsresult rv = DeleteSelection(nsIEditor::eNone, nsIEditor::eStrip);

Просмотреть файл

@ -250,6 +250,7 @@ skip-if = toolkit == 'android' # bug 1315898
[test_bug1355792.html]
[test_bug1358025.html]
[test_bug1361008.html]
[test_bug1361052.html]
[test_bug1368544.html]
[test_bug1385905.html]
[test_bug1390562.html]

Просмотреть файл

@ -0,0 +1,50 @@
<!DOCTYPE html>
<html>
<head>
<title>Test for Bug 1361052</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1361052">Mozilla Bug 1361052</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script class="testbody" type="application/javascript">
SimpleTest.waitForExplicitFinish();
SimpleTest.waitForFocus(() => {
var strike = document.createElement('strike');
strike.contentEditable = true;
document.documentElement.appendChild(strike);
var textarea = document.createElement('textarea');
document.documentElement.appendChild(textarea);
var h5 = document.createElement('h5');
strike.appendChild(h5);
textarea.setCustomValidity("A");
document.documentElement.dir = "rtl";
document.designMode = "on";
document.execCommand("styleWithCSS", false, true);
document.designMode = "off";
textarea.reportValidity();
document.documentElement.dir = "ltr";
var range = document.createRange();
range.selectNode(h5);
window.getSelection().addRange(range);
document.execCommand("inserthorizontalrule", false, null);
ok(true, "No crash");
SimpleTest.finish();
});
</script>
</pre>
</body>
</html>