Fixes for bug #10231 (crash making list after select all)

and bug #10815 (Crash deleting selected text and table)

mozilla/editor/base/nsHTMLEditRules.cpp
  - Added check, in WillDeleteSelection(),  to see if
    endpoints of the range are in the body before calling
    GetBlockNodeParent(). (Bug #10231)
  - Modified GetPromotedPoint() to check for NULL in the
    case where aWhere == kEnd and GetChildAt() returns NULL.
    (Bug #10815)

mozilla/layout/base/src/nsGenericElement.cpp
  - Modified RangeAdd() so that it doesn't add
    a range if it's already in the list.  (Bug #10231)

mozilla/layout/base/src/nsRangeList.cpp
  - Modified GetPrimaryFrameForFocusNode() to
    initialize aReturnFrame and to return a failure
    if ChildAt() returns NULL. (Bug #10231)

content/base/src/nsGenericElement.cpp

@@ -821,6 +821,16 @@ nsGenericElement::RangeAdd(nsIDOMRange& aRange)
   if (nsnull == mDOMSlots->mRangeList) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
+
+  // Make sure we don't add a range that is already
+  // in the list!
+  PRInt32 i = mDOMSlots->mRangeList->IndexOf(&aRange);
+  if (i >= 0) {
+    // Range is already in the list, so there
+    // is nothing to do!
+    return NS_OK;
+  }
+
   // dont need to addref - this call is made by the range object itself
   PRBool rv = mDOMSlots->mRangeList->AppendElement(&aRange);
   if (rv)  return NS_OK;

editor/base/nsHTMLEditRules.cpp

@@ -440,8 +440,25 @@ nsHTMLEditRules::WillDeleteSelection(nsIDOMSelection *aSelection, nsIEditor::ECo
     
     // deleting across blocks
     // are the blocks of same type?
-    nsCOMPtr<nsIDOMNode> leftParent = mEditor->GetBlockNodeParent(node);
-    nsCOMPtr<nsIDOMNode> rightParent = mEditor->GetBlockNodeParent(endNode);
+    nsCOMPtr<nsIDOMNode> leftParent;
+    nsCOMPtr<nsIDOMNode> rightParent;
+
+    // XXX: Fix for bug #10815: Crash deleting selected text and table.
+    //      Make sure leftParent and rightParent are never NULL. This
+    //      can happen if we call GetBlockNodeParent() and the node we
+    //      pass in is a body node.
+    //
+    //      Should we be calling IsBlockNode() instead of IsBody() here?
+
+    if (IsBody(node))
+      leftParent = node;
+    else
+      leftParent = mEditor->GetBlockNodeParent(node);
+
+    if (IsBody(endNode))
+      rightParent = endNode;
+    else
+      rightParent = mEditor->GetBlockNodeParent(endNode);
     
     // are the blocks siblings?
     nsCOMPtr<nsIDOMNode> leftBlockParent;
@@ -1265,7 +1282,11 @@ nsHTMLEditRules::GetPromotedPoint(RulesEndpoint aWhere, nsIDOMNode *aNode, PRInt
     {
       node = nsEditor::GetChildAt(parent,offset);
     }
-    offset++;  // since this is going to be used for a range _endpoint_, we want to be after the node
+
+    if (node)
+      offset++;  // since this is going to be used for a range _endpoint_, we want to be after the node
+    else
+      node = parent;
     
     // finding the real end for this point.  look up the tree for as long as we are the 
     // last node in the container, and as long as we haven't hit the body node.

editor/libeditor/html/nsHTMLEditRules.cpp

@@ -440,8 +440,25 @@ nsHTMLEditRules::WillDeleteSelection(nsIDOMSelection *aSelection, nsIEditor::ECo
     
     // deleting across blocks
     // are the blocks of same type?
-    nsCOMPtr<nsIDOMNode> leftParent = mEditor->GetBlockNodeParent(node);
-    nsCOMPtr<nsIDOMNode> rightParent = mEditor->GetBlockNodeParent(endNode);
+    nsCOMPtr<nsIDOMNode> leftParent;
+    nsCOMPtr<nsIDOMNode> rightParent;
+
+    // XXX: Fix for bug #10815: Crash deleting selected text and table.
+    //      Make sure leftParent and rightParent are never NULL. This
+    //      can happen if we call GetBlockNodeParent() and the node we
+    //      pass in is a body node.
+    //
+    //      Should we be calling IsBlockNode() instead of IsBody() here?
+
+    if (IsBody(node))
+      leftParent = node;
+    else
+      leftParent = mEditor->GetBlockNodeParent(node);
+
+    if (IsBody(endNode))
+      rightParent = endNode;
+    else
+      rightParent = mEditor->GetBlockNodeParent(endNode);
     
     // are the blocks siblings?
     nsCOMPtr<nsIDOMNode> leftBlockParent;
@@ -1265,7 +1282,11 @@ nsHTMLEditRules::GetPromotedPoint(RulesEndpoint aWhere, nsIDOMNode *aNode, PRInt
     {
       node = nsEditor::GetChildAt(parent,offset);
     }
-    offset++;  // since this is going to be used for a range _endpoint_, we want to be after the node
+
+    if (node)
+      offset++;  // since this is going to be used for a range _endpoint_, we want to be after the node
+    else
+      node = parent;
     
     // finding the real end for this point.  look up the tree for as long as we are the 
     // last node in the container, and as long as we haven't hit the body node.

layout/base/src/nsGenericElement.cpp

@@ -821,6 +821,16 @@ nsGenericElement::RangeAdd(nsIDOMRange& aRange)
   if (nsnull == mDOMSlots->mRangeList) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
+
+  // Make sure we don't add a range that is already
+  // in the list!
+  PRInt32 i = mDOMSlots->mRangeList->IndexOf(&aRange);
+  if (i >= 0) {
+    // Range is already in the list, so there
+    // is nothing to do!
+    return NS_OK;
+  }
+
   // dont need to addref - this call is made by the range object itself
   PRBool rv = mDOMSlots->mRangeList->AppendElement(&aRange);
   if (rv)  return NS_OK;

layout/base/src/nsRangeList.cpp

@@ -1505,6 +1505,8 @@ nsDOMSelection::GetPrimaryFrameForFocusNode(nsIFrame **aReturnFrame)
   if (!aReturnFrame)
     return NS_ERROR_NULL_POINTER;
   
+  *aReturnFrame = 0;
+  
   nsresult	result = NS_OK;
   
   nsCOMPtr<nsIDOMNode> node = dont_QueryInterface(FetchFocusNode());
@@ -1525,8 +1527,10 @@ nsDOMSelection::GetPrimaryFrameForFocusNode(nsIFrame **aReturnFrame)
     {
       nsCOMPtr<nsIContent> child;
       result = content->ChildAt(offset, *getter_AddRefs(child));
-      if (NS_FAILED(result) || !child) //out of bounds?
+      if (NS_FAILED(result))
         return result;
+      if (!child) //out of bounds?
+        return NS_ERROR_FAILURE;
       content = child;//releases the focusnode
     }
   }