Bug 535632 Crash [@ nsEditor::GetIndexOf] r=Olli

2009-12-30 17:17:44 +09:00 · 2009-12-30 17:17:44 +09:00 · e065767a94
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@ -4025,12 +4025,16 @@ nsEditor::IsTextNode(nsIDOMNode *aNode)
 PRInt32 
 nsEditor::GetIndexOf(nsIDOMNode *parent, nsIDOMNode *child)
 {
-  nsCOMPtr<nsIContent> content = do_QueryInterface(parent);
+  nsCOMPtr<nsINode> parentNode = do_QueryInterface(parent);
+  NS_PRECONDITION(parentNode, "null parentNode in nsEditor::GetIndexOf");
+  NS_PRECONDITION(parentNode->IsNodeOfType(nsINode::eCONTENT) ||
+                    parentNode->IsNodeOfType(nsINode::eDOCUMENT),
+                  "The parent node must be an element node or a document node");
+
  nsCOMPtr<nsIContent> cChild = do_QueryInterface(child);
-  NS_PRECONDITION(content, "null content in nsEditor::GetIndexOf");
  NS_PRECONDITION(cChild, "null content in nsEditor::GetIndexOf");

-  return content->IndexOf(cChild);
+  return parentNode->IndexOf(cChild);
 }
  

--- a/editor/libeditor/html/crashtests/535632-1.xhtml
+++ b/editor/libeditor/html/crashtests/535632-1.xhtml
@ -0,0 +1 @@
+<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" />
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@ -12,3 +12,4 @@ load 448329-3.html
 load 456727-1.html
 load 456727-2.html
 load 467647-1.html
+load 535632-1.xhtml
				`@ -0,0 +1 @@`
				`<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" />`