Bug 780908 - Fix crash in editor when head after body. r=ehsan, a=Sta…

…ndard8 for checkin to Thunderbird specific relbranch CLOSED TREE --HG-- branch : COMM1501_2012090708_RELBRANCH extra : transplant_source : %C8%92Rq5%CDl%ED%5B%E7%5E%FB%3E%E1G%40W%F6m%91
mozilla · Sep 1, 2012 · 3558783 · 3558783
1 parent cf366b2
commit 3558783
Show file tree

Hide file tree

Showing 3 changed files with 123 additions and 0 deletions.
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -1500,6 +1500,9 @@ nsHTMLEditor::RebuildDocumentFromSource(const nsAString& aSourceString)
   aSourceString.EndReading(endhead);
   bool foundhead = CaseInsensitiveFindInReadable(NS_LITERAL_STRING("<head"),
                                                    beginhead, endhead);
+  // a valid head appears before the body
+  if (foundbody && beginhead.get() > beginbody.get())
+    foundhead = false;
 
   nsReadingIterator<PRUnichar> beginclosehead;
   nsReadingIterator<PRUnichar> endclosehead;
@@ -1509,6 +1512,12 @@ nsHTMLEditor::RebuildDocumentFromSource(const nsAString& aSourceString)
   // Find the index after "<head>"
   bool foundclosehead = CaseInsensitiveFindInReadable(
            NS_LITERAL_STRING("</head>"), beginclosehead, endclosehead);
+  // a valid close head appears after a found head
+  if (foundhead && beginhead.get() > beginclosehead.get())
+    foundclosehead = false;
+  // a valid close head appears before a found body
+  if (foundbody && beginclosehead.get() > beginbody.get())
+    foundclosehead = false;
 
   // Time to change the document
   nsAutoEditBatch beginBatching(this);

diff --git a/editor/libeditor/html/tests/Makefile.in b/editor/libeditor/html/tests/Makefile.in
@@ -103,6 +103,7 @@ _CHROME_TEST_FILES = \
 		test_bug607584.xul \
 		test_bug616590.xul \
 		test_bug635636.html \
+		test_bug780908.xul \
 		green.png \
 		$(NULL)
 

diff --git a/editor/libeditor/html/tests/test_bug780908.xul b/editor/libeditor/html/tests/test_bug780908.xul
@@ -0,0 +1,113 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin"
+                 type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=780908
+
+adapted from test_bug607584.xul by Kent James <kent@caspia.com>
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="Mozilla Bug 780908" onload="runTest();">
+  <script type="application/javascript"
+    src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"/>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=780908"
+     target="_blank">Mozilla Bug 780908</a>
+  <p/>
+  <editor xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+          id="editor"
+          type="content-primary"
+          editortype="html"
+          style="width: 400px; height: 100px; border: thin solid black"/>
+  <p/>
+  <pre id="test">
+  </pre>
+  </body>
+  <script class="testbody" type="application/javascript">
+  <![CDATA[
+
+  SimpleTest.waitForExplicitFinish();
+
+  function EditorContentListener(aEditor)
+  {
+    this.init(aEditor);
+  }
+  
+  EditorContentListener.prototype = {
+    init : function(aEditor)
+      {
+        this.mEditor = aEditor;
+      },
+  
+    QueryInterface : function(aIID)
+      {
+        if (aIID.equals(Components.interfaces.nsIWebProgressListener) ||
+            aIID.equals(Components.interfaces.nsISupportsWeakReference) ||
+            aIID.equals(Components.interfaces.nsISupports))
+          return this;
+        throw Components.results.NS_NOINTERFACE;
+      },
+  
+    onStateChange : function(aWebProgress, aRequest, aStateFlags, aStatus)
+    {
+        if (aStateFlags & Components.interfaces.nsIWebProgressListener.STATE_STOP)
+        {
+          var editor = this.mEditor.getEditor(this.mEditor.contentWindow);
+          if (editor) {
+              this.mEditor.focus();
+              editor instanceof Components.interfaces.nsIHTMLEditor;
+              editor.returnInParagraphCreatesNewParagraph = true;
+              source = "<html><body><table><head></table></body></html>";
+              editor.rebuildDocumentFromSource(source);
+              ok(true, "Don't crash when head appears after body");
+              source = "<html></head><head><body></body></html>";
+              editor.rebuildDocumentFromSource(source);
+              ok(true, "Don't crash when /head appears before head");
+              SimpleTest.finish();
+              progress.removeProgressListener(this);
+          }
+        }
+  
+    },
+  
+  
+    onProgressChange : function(aWebProgress, aRequest,
+                                aCurSelfProgress, aMaxSelfProgress,
+                                aCurTotalProgress, aMaxTotalProgress)
+      {
+      },
+  
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags)
+      {
+      },
+  
+    onStatusChange : function(aWebProgress, aRequest, aStatus, aMessage)
+      {
+      },
+  
+    onSecurityChange : function(aWebProgress, aRequest, aState)
+      {
+      },
+  
+      mEditor: null
+  };
+
+  var progress, progressListener;
+
+  function runTest() {
+    var newEditorElement = document.getElementById("editor");
+    newEditorElement.makeEditable("html", true);
+    var docShell = newEditorElement.boxObject.QueryInterface(Components.interfaces.nsIEditorBoxObject).docShell;
+    progress = docShell.QueryInterface(Components.interfaces.nsIInterfaceRequestor).getInterface(Components.interfaces.nsIWebProgress);
+    progressListener = new EditorContentListener(newEditorElement);
+    progress.addProgressListener(progressListener, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
+    newEditorElement.setAttribute("src", "data:text/html,");
+  }
+]]>
+</script>
+</window>