From 81228c3a440f477ecbda53587cfc51552c2e1b3a Mon Sep 17 00:00:00 2001 From: janekptacijarabaci Date: Fri, 13 Apr 2018 20:57:00 +0200 Subject: [PATCH] moebius#76: JS - DOM - Selection API - crashes https://github.com/MoonchildProductions/moebius/pull/76 --- dom/base/nsRange.cpp | 2 +- dom/html/crashtests/1350972.html | 22 ++++++++++++++++++++++ dom/html/crashtests/crashtests.list | 1 + 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 dom/html/crashtests/1350972.html diff --git a/dom/base/nsRange.cpp b/dom/base/nsRange.cpp index 37ba147afc..4b4ce78857 100644 --- a/dom/base/nsRange.cpp +++ b/dom/base/nsRange.cpp @@ -3194,7 +3194,7 @@ nsRange::AutoInvalidateSelection::~AutoInvalidateSelection() mIsNested = false; ::InvalidateAllFrames(mCommonAncestor); nsINode* commonAncestor = mRange->GetRegisteredCommonAncestor(); - if (commonAncestor != mCommonAncestor) { + if (commonAncestor && commonAncestor != mCommonAncestor) { ::InvalidateAllFrames(commonAncestor); } } diff --git a/dom/html/crashtests/1350972.html b/dom/html/crashtests/1350972.html new file mode 100644 index 0000000000..7af7f9e174 --- /dev/null +++ b/dom/html/crashtests/1350972.html @@ -0,0 +1,22 @@ + + + + + + \ No newline at end of file diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list index e55a0a3503..a2068ea4ed 100644 --- a/dom/html/crashtests/crashtests.list +++ b/dom/html/crashtests/crashtests.list @@ -78,4 +78,5 @@ load 1237633.html load 1281972-1.html load 1282894.html load 1290904.html +asserts(0-3) load 1350972.html load 1386905.html