Bug 1024428 - don't crash when using input type='range' in shadow dom. r=wchen

2014-07-30 23:15:44 +03:00 · 2014-07-30 23:15:44 +03:00 · 99e8a32fe4
--- a/content/base/crashtests/1024428-1.html
+++ b/content/base/crashtests/1024428-1.html
@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div id="host"></div>
+<script>
+var s = host.createShadowRoot();
+s.innerHTML = '<input type="range" />';
+</script>
+</body>
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -151,3 +151,4 @@ load 942979.html
 load 978646.html
 load 1026714.html
 pref(dom.webcomponents.enabled,true) load 1027461-1.html
+pref(dom.webcomponents.enabled,true) load 1024428-1.html
--- a/layout/forms/nsRangeFrame.cpp
+++ b/layout/forms/nsRangeFrame.cpp
@ -111,7 +111,7 @@ nsRangeFrame::MakeAnonymousDiv(Element** aResult,
                               nsCSSPseudoElements::Type aPseudoType,
                               nsTArray<ContentInfo>& aElements)
 {
-  nsCOMPtr<nsIDocument> doc = mContent->GetDocument();
+  nsCOMPtr<nsIDocument> doc = mContent->GetComposedDoc();
  nsRefPtr<Element> resultElement = doc->CreateHTMLElement(nsGkAtoms::div);

  // Associate the pseudo-element with the anonymous child.