Bug 688996 - "ASSERTION: Wrong root". r=smaug

2011-10-12 18:20:45 +02:00 · 2011-10-12 18:20:45 +02:00 · a5eec1b2b6
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@ -357,7 +357,7 @@ nsRange::CharacterDataChanged(nsIDocument* aDocument,
    DoSetRange(newStartNode, newStartOffset, newEndNode, newEndOffset,
               newRoot ? newRoot : mRoot.get()
 #ifdef DEBUG
-               , !newEndNode->GetParent()
+               , !newEndNode->GetParent() || !newStartNode->GetParent()
 #endif
               );
  }
--- a/layout/generic/crashtests/688996-1.html
+++ b/layout/generic/crashtests/688996-1.html
@ -0,0 +1,18 @@
+<!DOCTYPE html><html><head><script>
+function boom()
+{
+  var a = document.getElementsByTagName('div')[0];
+  var b = a.firstChild;
+
+  var r = document.createRange();
+  r.setStart(b, 1);
+  r.setEnd(a, 1);
+
+  var s = document.createRange();
+  s.setStart(b, 0);
+  s.setEnd(a, 1);
+  s.deleteContents();
+}
+</script></head><body onload="boom();">
+<div>b</div>
+</body></html>
--- a/layout/generic/crashtests/688996-2.html
+++ b/layout/generic/crashtests/688996-2.html
@ -0,0 +1,15 @@
+<!DOCTYPE html><html><head><script>
+function boom()
+{
+  var a = document.getElementsByTagName('div')[0];
+  var b = a.firstChild;
+
+  var r = document.createRange();
+  r.setStart(b, 1);
+  r.setEnd(a, 1);
+
+  b.splitText(0);
+}
+</script></head><body onload="boom();">
+<div>b</div>
+</body></html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -379,3 +379,5 @@ asserts(14) asserts-if(Android,8) load 673770.html # bug 569193 and bug 459597
 load 679933-1.html
 load 682649-1.html
 load 683702-1.xhtml
+load 688996-1.html
+load 688996-2.html
--- a/layout/reftests/selection/splitText-normalize.js
+++ b/layout/reftests/selection/splitText-normalize.js
@ -16,6 +16,7 @@ var tests = [
 [ {endNode:1}, [0,4], "012345678", "" ],
 [ {endNode:1}, [0,4], "01234567", "8" ],
 [ {endNode:1}, [1,4], "0", "12345678" ],
+ [ {startOffset:1,endNode:1}, [0,0], "0", "12345678" ],
 [ {endNode:2}, [1,4], "0", "12345", "678" ],
 ]