Bug 1423776 - Return error when splitted node might be orphan. r?masayuki
This crash occurs when start container of range for range updater is nullptr
in GetNodesForOperation.
Splitted node by SplitNodeDeepWithTransaction can return orphan node, so we
should return error when splitted node is orphan node.
MozReview-Commit-ID: 3ySdzc9FAzL
--- a/editor/libeditor/HTMLEditRules.cpp
+++ b/editor/libeditor/HTMLEditRules.cpp
@@ -7819,16 +7819,19 @@ HTMLEditRules::BustUpInlinesAtRangeEndpo
SplitAtEdges::eDoNotCreateEmptyContainer);
if (NS_WARN_IF(!CanHandleEditAction())) {
return NS_ERROR_EDITOR_DESTROYED;
}
if (NS_WARN_IF(splitEndInlineResult.Failed())) {
return splitEndInlineResult.Rv();
}
EditorRawDOMPoint splitPointAtEnd(splitEndInlineResult.SplitPoint());
+ if (NS_WARN_IF(!splitPointAtEnd.IsSet())) {
+ return NS_ERROR_FAILURE;
+ }
aRangeItem.mEndContainer = splitPointAtEnd.GetContainer();
aRangeItem.mEndOffset = splitPointAtEnd.Offset();
}
nsCOMPtr<nsIContent> startInline =
GetHighestInlineParent(*aRangeItem.mStartContainer);
if (startInline) {
@@ -7843,16 +7846,19 @@ HTMLEditRules::BustUpInlinesAtRangeEndpo
}
if (NS_WARN_IF(splitStartInlineResult.Failed())) {
return splitStartInlineResult.Rv();
}
// XXX If we split only here because of collapsed range, we're modifying
// only start point of aRangeItem. Shouldn't we modify end point here
// if it's collapsed?
EditorRawDOMPoint splitPointAtStart(splitStartInlineResult.SplitPoint());
+ if (NS_WARN_IF(!splitPointAtStart.IsSet())) {
+ return NS_ERROR_FAILURE;
+ }
aRangeItem.mStartContainer = splitPointAtStart.GetContainer();
aRangeItem.mStartOffset = splitPointAtStart.Offset();
}
return NS_OK;
}
nsresult
new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1423776.html
@@ -0,0 +1,15 @@
+<script>
+function go() {
+ svgvar00002.addEventListener("DOMNodeInserted", () => {
+ svg.appendChild(svgvar00008);
+ document.execCommand("insertOrderedList", false);
+ });
+ svgvar00002.insertAdjacentHTML("afterBegin", table.outerHTML);
+}
+</script>
+<body onload=go()>
+<table id="table"></table>
+<b contenteditable="true">
+<svg id="svg">
+<feConvolveMatrix id="svgvar00002"/>
+<feConvolveMatrix id="svgvar00008"/>
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -92,13 +92,14 @@ needs-focus load 1402196.html
load 1402469.html
load 1402526.html
load 1402904.html
load 1405747.html
load 1408170.html
load 1414581.html
load 1415231.html
load 1423767.html
+needs-focus load 1423776.html
needs-focus load 1424450.html
load 1425091.html
load 1443664.html
skip-if(Android) needs-focus load 1444630.html
load 1446451.html
