commit e5f40f033b0ffb2fef0b8edcb83b927484f70423
parent 85b95f98e59c2bbeeb9452f045d87e162b601f10
Author: Masayuki Nakano <masayuki@d-toybox.com>
Date: Fri, 14 Nov 2025 10:45:28 +0000
Bug 1998838 - Fix the order to refer `leafContent` in `TextFragmentData::GetInclusiveNextCharPoint` and `TextFragmentData::GetPreviousCharPoint` r=m_kato
The null-check should be done before using `IsBlockElement`.
Differential Revision: https://phabricator.services.mozilla.com/D271740
Diffstat:
2 files changed, 31 insertions(+), 6 deletions(-)
diff --git a/editor/libeditor/WSRunScannerNestedClasses.cpp b/editor/libeditor/WSRunScannerNestedClasses.cpp
@@ -900,15 +900,15 @@ EditorDOMPointType WSRunScanner::TextFragmentData::GetInclusiveNextCharPoint(
// following block boundary.
nsIContent* const leafContent = HTMLEditUtils::GetFirstLeafContent(
*child, {LeafNodeType::LeafNodeOrChildBlock}, blockInlineCheck);
+ if (!leafContent) {
+ return EditorRawDOMPoint(child, 0);
+ }
if (HTMLEditUtils::IsBlockElement(
*leafContent,
UseComputedDisplayOutsideStyleIfAuto(blockInlineCheck)) ||
HTMLEditUtils::IsVisibleElementEvenIfLeafNode(*leafContent)) {
return EditorRawDOMPoint();
}
- if (!leafContent) {
- return EditorRawDOMPoint(child, 0);
- }
return EditorRawDOMPoint(leafContent, 0);
}();
if (!point.IsSet()) {
@@ -1028,15 +1028,15 @@ EditorDOMPointType WSRunScanner::TextFragmentData::GetPreviousCharPoint(
// following block boundary.
nsIContent* const leafContent = HTMLEditUtils::GetLastLeafContent(
*previousChild, {LeafNodeType::LeafNodeOrChildBlock}, blockInlineCheck);
+ if (!leafContent) {
+ return EditorRawDOMPoint::AtEndOf(*previousChild);
+ }
if (HTMLEditUtils::IsBlockElement(
*leafContent,
UseComputedDisplayOutsideStyleIfAuto(blockInlineCheck)) ||
HTMLEditUtils::IsVisibleElementEvenIfLeafNode(*leafContent)) {
return EditorRawDOMPoint();
}
- if (!leafContent) {
- return EditorRawDOMPoint::AtEndOf(*previousChild);
- }
return EditorRawDOMPoint::AtEndOf(*leafContent);
}();
if (!point.IsSet()) {
diff --git a/testing/web-platform/tests/editing/crashtests/insertHTML-after-subscript-canvas-containing-textarea.html b/testing/web-platform/tests/editing/crashtests/insertHTML-after-subscript-canvas-containing-textarea.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+"use strict";
+
+document.addEventListener("DOMContentLoaded", () => {
+ document.designMode = "on";
+ document.execCommand("selectAll");
+ document.execCommand("subscript");
+ document.execCommand("insertHTML");
+}, {once: true});
+</script>
+</head>
+<body>
+ <time dir="auto">
+ A
+ <canvas>
+ <textarea dir="rtl">
+ </textarea>
+ </canvas>
+ </time>
+</body>
+</html>
