Bug 762764 - Prevent selection from descending into text boxes when extending it for things like caret navigation and extension for deletion; r=roc

2012-06-19 19:31:03 -04:00 · 2012-06-19 19:31:03 -04:00 · b7d9e7c878
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@ -1439,3 +1439,10 @@ nsTextControlFrame::RestoreState(nsPresState* aState)
  Properties().Set(ContentScrollPos(), new nsPoint(aState->GetScrollState()));
  return NS_OK;
 }
+
+NS_IMETHODIMP
+nsTextControlFrame::PeekOffset(nsPeekOffsetStruct *aPos)
+{
+  return NS_ERROR_FAILURE;
+}
+
--- a/layout/forms/nsTextControlFrame.h
+++ b/layout/forms/nsTextControlFrame.h
@ -155,6 +155,8 @@ public:

  nsresult GetText(nsString& aText);

+  NS_IMETHOD PeekOffset(nsPeekOffsetStruct *aPos);
+
  NS_DECL_QUERYFRAME

  // Temp reference to scriptrunner
--- a/layout/generic/crashtests/762764-1.html
+++ b/layout/generic/crashtests/762764-1.html
@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  document.documentElement.removeChild(document.body);
+  var newBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  document.documentElement.appendChild(newBody);
+  newBody.contentEditable = "true";
+  document.execCommand("inserthtml", false, "<textarea>a</textarea>");
+  document.execCommand("insertimage", false, "1.jpg");
+  try { document.execCommand("forwardDelete", false, null); } catch(e) { }
+  document.execCommand("inserthtml", false, "x<span><\/span>y");
+}
+
+</script>
+
+<body onload="boom();"></body>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -390,3 +390,4 @@ load first-letter-638937-2.html
 load 737313-1.html
 load 737313-2.html
 load 737313-3.html
+load 762764-1.html