mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1579934 - Make `WhiteSpaceVisibilityKeeper::MergeFirstLineOf*()` stop handling their job if calling `DeleteInvisibleASCIIWhiteSpace()` makes the descendant block position changed r=m_kato 

They join first line of a descendant block element into the line at the other
block contains the descendant block.  First of all of their jobs, they call
`DeleteInvisibleASCIIWhiteSpace()` to clean up unnecessary whitespaces at
the other block.  At this time, the point which tells whether the descendant
element is contained in the other block may become invalid if script runs
and it causes changing the DOM tree.  Therefore, they should check the
given point is still valid after calling `DeleteInvisibleASCIIWhiteSpace()`
because `AutoTrackDOMPoint` requires valid point.

Differential Revision: https://phabricator.services.mozilla.com/D95987
This commit is contained in:
Masayuki Nakano 2020-11-06 06:38:49 +00:00
Родитель e2223e1b92
Коммит 6109e35d9e
3 изменённых файлов: 32 добавлений и 0 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

12
editor/libeditor/WSRunObject.cpp
Просмотреть файл

@ -122,6 +122,12 @@ EditActionResult WhiteSpaceVisibilityKeeper::
"failed at left block");
return EditActionResult(rv);
}
if (!afterRightBlockChild.IsSetAndValid()) {
NS_WARNING(
"WhiteSpaceVisibilityKeeper::DeleteInvisibleASCIIWhiteSpaces() caused "
"running script and the point to be modified was changed");
return EditActionResult(NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE);
}
OwningNonNull<Element> rightBlockElement = aRightBlockElement;
{
@ -264,6 +270,12 @@ EditActionResult WhiteSpaceVisibilityKeeper::
"at right block");
return EditActionResult(rv);
}
if (!aAtLeftBlockChild.IsSetAndValid()) {
NS_WARNING(
"WhiteSpaceVisibilityKeeper::DeleteInvisibleASCIIWhiteSpaces() caused "
"running script and the point to be modified was changed");
return EditActionResult(NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE);
}
OwningNonNull<Element> originalLeftBlockElement = aLeftBlockElement;
OwningNonNull<Element> leftBlockElement = aLeftBlockElement;

19
editor/libeditor/crashtests/1579934.html Normal file
Просмотреть файл

@ -0,0 +1,19 @@
<html id="a"><script type="text/javascript" id="__gaOptOutExtension">window["_gaUserPrefs"] = { ioo : function() { return true; } }</script><head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252"><script>
function go() {
b.addEventListener("DOMCharacterDataModified", () => {
a.appendChild(b)
})
document.execCommand("delete", false)
}
function eh() {
b.reset()
}
</script>
</head><body onload="go()">
<details ontoggle="eh()" open="">
<dt contenteditable="">
</dt>
</details><aside style="position: fixed; top: 0px; right: 0px; font-family: &quot;Lucida Console&quot;, monospace; background-color: rgb(242, 230, 217); padding: 3px; z-index: 10000; text-align: center; max-width: 120px; opacity: 0; transition: opacity 0.5s linear 0s;">1194 x 73</aside></body><form id="b"><keygen>
<button autofocus="">
</button></form></html>

1
editor/libeditor/crashtests/crashtests.list
Просмотреть файл

@ -117,6 +117,7 @@ asserts(3) load 1534394.html # assertion in WSRunScanner::GetEditableBlockParent
load 1547897.html
load 1547898.html
load 1556799.html
load 1579934.html
load 1574544.html
load 1578916.html
load 1581246.html