wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-07 16:28:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#76: JS - DOM - Selection API - crashes

Browse source 
https://github.com/MoonchildProductions/moebius/pull/76
This commit is contained in:
janekptacijarabaci 2018-04-13 20:57:00 +02:00 • committed by Roy Tam
commit 81228c3a44
3 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
dom/base/nsRange.cpp
View file

@ -3194,7 +3194,7 @@ nsRange::AutoInvalidateSelection::~AutoInvalidateSelection()
mIsNested = false;
::InvalidateAllFrames(mCommonAncestor);
nsINode* commonAncestor = mRange->GetRegisteredCommonAncestor();
if (commonAncestor != mCommonAncestor) {
if (commonAncestor && commonAncestor != mCommonAncestor) {
::InvalidateAllFrames(commonAncestor);
}
}

22
dom/html/crashtests/1350972.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE html>
<html>
<head>
<script>
try { o1 = document.createElement('tr'); } catch(e) {};
try { o2 = document.createElement('div'); } catch(e) {};
try { o3 = document.createElement('hr'); } catch(e) {};
try { o4 = document.createElement('textarea'); } catch(e) {};
try { o5 = document.getSelection(); } catch(e) {};
try { o6 = document.createRange(); } catch(e) {};
try { document.documentElement.appendChild(o2); } catch(e) {};
try { document.documentElement.appendChild(o3); } catch(e) {};
try { o2.appendChild(o4); } catch(e) {};
try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {};
try { o4.select(); } catch(e) {};
try { o5.addRange(o6); } catch(e) {};
try { document.documentElement.appendChild(o1); } catch(e) {};
try { o5.selectAllChildren(o1); } catch(e) {};
try { o6.selectNode(o1); } catch(e) {};
</script>
</head>
</html>

1
dom/html/crashtests/crashtests.list
View file

@ -78,4 +78,5 @@ load 1237633.html
load 1281972-1.html
load 1282894.html
load 1290904.html
asserts(0-3) load 1350972.html
load 1386905.html