diff --git a/editor/libeditor/HTMLEditRules.cpp b/editor/libeditor/HTMLEditRules.cpp
index 545e22f701..fcbb75ee6f 100644
--- a/editor/libeditor/HTMLEditRules.cpp
+++ b/editor/libeditor/HTMLEditRules.cpp
@@ -7179,15 +7179,18 @@ HTMLEditRules::PinSelectionToNewBlock(Selection* aSelection)
return NS_OK;
}
+ if (NS_WARN_IF(!mNewBlock)) {
+ return NS_ERROR_NULL_POINTER;
+ }
+
// get the (collapsed) selection location
- nsCOMPtr selNode, temp;
+ nsCOMPtr selNode;
int32_t selOffset;
NS_ENSURE_STATE(mHTMLEditor);
nsresult rv =
mHTMLEditor->GetStartNodeAndOffset(aSelection,
getter_AddRefs(selNode), &selOffset);
NS_ENSURE_SUCCESS(rv, rv);
- temp = selNode;
// use ranges and sRangeHelper to compare sel point to new block
nsCOMPtr node = do_QueryInterface(selNode);
@@ -7197,24 +7200,23 @@ HTMLEditRules::PinSelectionToNewBlock(Selection* aSelection)
NS_ENSURE_SUCCESS(rv, rv);
rv = range->SetEnd(selNode, selOffset);
NS_ENSURE_SUCCESS(rv, rv);
- nsCOMPtr block = mNewBlock.get();
- NS_ENSURE_TRUE(block, NS_ERROR_NO_INTERFACE);
bool nodeBefore, nodeAfter;
- rv = nsRange::CompareNodeToRange(block, range, &nodeBefore, &nodeAfter);
+ rv = nsRange::CompareNodeToRange(mNewBlock, range, &nodeBefore, &nodeAfter);
NS_ENSURE_SUCCESS(rv, rv);
if (nodeBefore && nodeAfter) {
return NS_OK; // selection is inside block
} else if (nodeBefore) {
// selection is after block. put at end of block.
- nsCOMPtr tmp = GetAsDOMNode(mNewBlock);
NS_ENSURE_STATE(mHTMLEditor);
- tmp = GetAsDOMNode(mHTMLEditor->GetLastEditableChild(*block));
+ nsCOMPtr tmp = mHTMLEditor->GetLastEditableChild(*mNewBlock);
+ if (!tmp) {
+ tmp = mNewBlock;
+ }
uint32_t endPoint;
if (mHTMLEditor->IsTextNode(tmp) ||
mHTMLEditor->IsContainer(tmp)) {
- rv = EditorBase::GetLengthOfDOMNode(tmp, endPoint);
- NS_ENSURE_SUCCESS(rv, rv);
+ endPoint = tmp->Length();
} else {
tmp = EditorBase::GetNodeLocation(tmp, (int32_t*)&endPoint);
endPoint++; // want to be after this node
@@ -7222,9 +7224,11 @@ HTMLEditRules::PinSelectionToNewBlock(Selection* aSelection)
return aSelection->Collapse(tmp, (int32_t)endPoint);
} else {
// selection is before block. put at start of block.
- nsCOMPtr tmp = GetAsDOMNode(mNewBlock);
NS_ENSURE_STATE(mHTMLEditor);
- tmp = GetAsDOMNode(mHTMLEditor->GetFirstEditableChild(*block));
+ nsCOMPtr tmp = mHTMLEditor->GetFirstEditableChild(*mNewBlock);
+ if (!tmp) {
+ tmp = mNewBlock;
+ }
int32_t offset;
if (mHTMLEditor->IsTextNode(tmp) ||
mHTMLEditor->IsContainer(tmp)) {
diff --git a/editor/libeditor/crashtests/1348851.html b/editor/libeditor/crashtests/1348851.html
new file mode 100644
index 0000000000..d618f049ee
--- /dev/null
+++ b/editor/libeditor/crashtests/1348851.html
@@ -0,0 +1,19 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list
index 3fbc6b196d..7b1c57dbf3 100644
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -68,4 +68,5 @@ load 1158452.html
load 1158651.html
load 1244894.xhtml
load 1272490.html
+load 1348851.html
load 1317704.html