roytam1/UXP
1
0
Fork 0
mirror of https://github.com/roytam1/UXP.git synced 2026-05-26 13:58:49 +00:00
Code Issues Projects Releases Wiki Activity

moebius#76: JS - DOM - Selection API - crashes

Browse Source 
https://github.com/MoonchildProductions/moebius/pull/76
This commit is contained in:
janekptacijarabaci
2018-04-13 20:57:00 +02:00
committed by Roy Tam
parent acfa05e886
commit 81228c3a44
3 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dom/base/nsRange.cpp
+1 -1
View File
@@ -3194,7 +3194,7 @@ nsRange::AutoInvalidateSelection::~AutoInvalidateSelection()
mIsNested = false;
::InvalidateAllFrames(mCommonAncestor);
nsINode* commonAncestor = mRange->GetRegisteredCommonAncestor();
if (commonAncestor != mCommonAncestor) {
if (commonAncestor && commonAncestor != mCommonAncestor) {
::InvalidateAllFrames(commonAncestor);
}
}
dom/html/crashtests/1350972.html
+22
View File
@@ -0,0 +1,22 @@
<!DOCTYPE html>
<html>
<head>
<script>
try { o1 = document.createElement('tr'); } catch(e) {};
try { o2 = document.createElement('div'); } catch(e) {};
try { o3 = document.createElement('hr'); } catch(e) {};
try { o4 = document.createElement('textarea'); } catch(e) {};
try { o5 = document.getSelection(); } catch(e) {};
try { o6 = document.createRange(); } catch(e) {};
try { document.documentElement.appendChild(o2); } catch(e) {};
try { document.documentElement.appendChild(o3); } catch(e) {};
try { o2.appendChild(o4); } catch(e) {};
try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {};
try { o4.select(); } catch(e) {};
try { o5.addRange(o6); } catch(e) {};
try { document.documentElement.appendChild(o1); } catch(e) {};
try { o5.selectAllChildren(o1); } catch(e) {};
try { o6.selectNode(o1); } catch(e) {};
</script>
</head>
</html>
dom/html/crashtests/crashtests.list
+1
View File
@@ -78,4 +78,5 @@ load 1237633.html
load 1281972-1.html
load 1282894.html
load 1290904.html
asserts(0-3) load 1350972.html
load 1386905.html