Bug 771639 - Handle null current node in nsRange.cpp's ValidateCurrentNode; r=smaug

2012-07-09 11:41:47 +03:00 · 2012-07-09 11:41:47 +03:00 · f4113550e3
--- a/content/base/crashtests/771639.html
+++ b/content/base/crashtests/771639.html
@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+var root = document.documentElement;
+while(root.firstChild) { root.removeChild(root.firstChild); }
+var div = document.createElement("div");
+root.appendChild(div);
+
+document.addEventListener("DOMNodeRemoved", function() {
+  root.appendChild(document.createTextNode("some mutation"));
+}, false);
+
+var range = document.createRange();
+range.setStart(root, 0);
+range.setEnd(root, root.childNodes.length);
+range.deleteContents();
+</script>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -109,6 +109,7 @@ load 713417-2.html
 load 715056.html
 load 741163-1.html
 load 766426.html
+load 771639.html
 asserts(0-1) load 752226-1.html
 asserts(0-1) load 752226-2.html
 HTTP(..) load xhr_abortinprogress.html
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@ -1453,6 +1453,11 @@ ValidateCurrentNode(nsRange* aRange, RangeSubtreeIterator& aIter)
 {
  bool before, after;
  nsCOMPtr<nsIDOMNode> domNode = aIter.GetCurrentNode();
+  if (!domNode) {
+    // We don't have to worry that the node was removed if it doesn't exist,
+    // e.g., the iterator is done.
+    return true;
+  }
  nsCOMPtr<nsINode> node = do_QueryInterface(domNode);
  MOZ_ASSERT(node);