Bug 766795 - Fix asserts when placing cursor in editable detached content; r=roc,ehsan

2012-06-24 09:54:43 +03:00 · 2012-06-24 09:54:43 +03:00 · e39ea69f36
--- a/editor/libeditor/html/crashtests/766795.html
+++ b/editor/libeditor/html/crashtests/766795.html
@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var fragEl = document.createElement("span");
+  fragEl.setAttribute("contenteditable", "true");
+  fragEl.setAttribute("style", "position: absolute;");
+
+  var frag = document.createDocumentFragment();
+  frag.appendChild(fragEl);
+
+  window.getSelection().selectAllChildren(fragEl);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@ -28,5 +28,6 @@ load 682650-1.html
 load 716456-1.html
 load 759748.html
 load 761861.html
+load 766795.html
 load 766305.html
 load 766387.html
--- a/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
+++ b/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
@ -254,6 +254,13 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
  NS_ENSURE_TRUE(focusElement, NS_OK);
  NS_ENSURE_SUCCESS(res, res);

+  // If we're not in a document, don't try to add resizers
+  nsCOMPtr<dom::Element> focusElementNode = do_QueryInterface(focusElement);
+  NS_ENSURE_STATE(focusElementNode);
+  if (!focusElementNode->IsInDoc()) {
+    return NS_OK;
+  }
+
  // what's its tag?
  nsAutoString focusTagName;
  res = focusElement->GetTagName(focusTagName);
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@ -4080,9 +4080,10 @@ PresShell::ContentRemoved(nsIDocument *aDocument,
    oldNextSibling = nsnull;
  }
  
-  if (aContainer)
+  if (aContainer && aContainer->IsElement()) {
    mFrameConstructor->RestyleForRemove(aContainer->AsElement(), aChild,
                                        oldNextSibling);
+  }

  bool didReconstruct;
  mFrameConstructor->ContentRemoved(aContainer, aChild, oldNextSibling,