Bug 769008 - Don't pass a null node to GetBlockNodeParent; r=roc

2012-06-29 18:43:08 -04:00 · 2012-06-29 18:43:08 -04:00 · 8fce806592
--- a/editor/libeditor/html/crashtests/769008-1.html
+++ b/editor/libeditor/html/crashtests/769008-1.html
@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var x = document.getElementById("x");
+
+  window.getSelection().removeAllRanges();
+
+  var range = document.createRange();
+  range.setStart(x, 0);
+  range.setEnd(x, 0);
+  window.getSelection().addRange(range);
+
+  document.execCommand("delete", false, "null");
+}
+
+</script>
+</head>
+<body contenteditable="true" onload="boom();"><div></div><span id="x"></span></body>
+</html>
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@ -28,6 +28,7 @@ load 682650-1.html
 asserts(0-1) load 716456-1.html
 load 759748.html
 load 761861.html
+load 769008-1.html
 load 766305.html
 load 766387.html
 load 766795.html
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@ -2123,7 +2123,7 @@ nsHTMLEditRules::WillDeleteSelection(Selection* aSelection,
      // find the relavent blocks
      if (IsBlockNode(leftNode))
        leftParent = leftNode;
-      else
+      else if (leftNode)
        leftParent = mHTMLEditor->GetBlockNodeParent(leftNode);
      if (IsBlockNode(rightNode))
        rightParent = rightNode;