Backed out changeset 4427e7f72c8e (bug 1414233) for crashing in mochitest dom/base/test/test_bug1375050.html. r=backout on a CLOSED TREE

dom/base/nsRange.cpp

@@ -3823,21 +3823,36 @@ IsLastNonemptyRowGroupOfTable(nsIFrame* aFrame)
 
 void
 nsRange::GetInnerTextNoFlush(DOMString& aValue, ErrorResult& aError,
-                             nsIContent* aNode)
+                             nsIContent* aStartContainer, uint32_t aStartOffset,
+                             nsIContent* aEndContainer, uint32_t aEndOffset)
 {
   InnerTextAccumulator result(aValue);
-
-  if (aNode->IsNodeOfType(nsINode::eTEXT)) {
-    auto t = static_cast<nsGenericDOMDataNode*>(aNode);
-    AppendTransformedText(result, t, 0, t->Length());
-    return;
+  nsIContent* currentNode = aStartContainer;
+  TreeTraversalState currentState = AFTER_NODE;
+  if (aStartContainer->IsNodeOfType(nsINode::eTEXT)) {
+    auto t = static_cast<nsGenericDOMDataNode*>(aStartContainer);
+    if (aStartContainer == aEndContainer) {
+      AppendTransformedText(result, t, aStartOffset, aEndOffset);
+      return;
+    }
+    AppendTransformedText(result, t, aStartOffset, t->TextLength());
+  } else {
+    if (uint32_t(aStartOffset) < aStartContainer->GetChildCount()) {
+      currentNode = aStartContainer->GetChildAt(aStartOffset);
+      currentState = AT_NODE;
+    }
   }
 
-  nsIContent* currentNode = aNode->GetFirstChild();
-  TreeTraversalState currentState = AT_NODE;
-
-  nsIContent* endNode = aNode->GetLastChild();
+  nsIContent* endNode = aEndContainer;
   TreeTraversalState endState = AFTER_NODE;
+  if (aEndContainer->IsNodeOfType(nsINode::eTEXT)) {
+    endState = AT_NODE;
+  } else {
+    if (aEndOffset < aEndContainer->GetChildCount()) {
+      endNode = aEndContainer->GetChildAt(aEndOffset);
+      endState = AT_NODE;
+    }
+  }
 
   while (currentNode != endNode || currentState != endState) {
     nsIFrame* f = currentNode->GetPrimaryFrame();
@@ -3896,6 +3911,10 @@ nsRange::GetInnerTextNoFlush(DOMString& aValue, ErrorResult& aError,
     }
   }
 
+  if (aEndContainer->IsNodeOfType(nsINode::eTEXT)) {
+    nsGenericDOMDataNode* t = static_cast<nsGenericDOMDataNode*>(aEndContainer);
+    AppendTransformedText(result, t, 0, aEndOffset);
+  }
   // Do not flush trailing line breaks! Required breaks at the end of the text
   // are suppressed.
 }

dom/base/nsRange.h

@@ -333,7 +333,10 @@ public:
 
   static void GetInnerTextNoFlush(mozilla::dom::DOMString& aValue,
                                   mozilla::ErrorResult& aError,
-                                  nsIContent* aNode);
+                                  nsIContent* aStartContainer,
+                                  uint32_t aStartOffset,
+                                  nsIContent* aEndContainer,
+                                  uint32_t aEndOffset);
 
   nsINode* GetParentObject() const { return mOwner; }
   virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto) override final;

dom/html/nsGenericHTMLElement.cpp

@@ -3081,7 +3081,7 @@ nsGenericHTMLElement::GetInnerText(mozilla::dom::DOMString& aValue,
     }
   }
 
-  nsRange::GetInnerTextNoFlush(aValue, aError, this);
+  nsRange::GetInnerTextNoFlush(aValue, aError, this, 0, this, GetChildCount());
 }
 
 void