Bug 428844: Crash [@ nsEditingSession::TearDownEditorOnWindow] on reload with contenteditable and xslt, patch by Chris Pearce <chris@pearce.org.nz>, r+sr=peterv, a=beltzner

git-svn-id: svn://10.0.0.236/trunk@250420 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
gavin%gavinsharp.com 2008-04-18 02:07:06 +00:00
parent eaec453dd3
commit d311a2c030
5 changed files with 21 additions and 1 deletions

View File

@ -0,0 +1,4 @@
<?xml-stylesheet type="text/xsl" href="#a"?>
<html xmlns="http://www.w3.org/1999/xhtml" onload="window.location.reload()" contenteditable="true">
<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/>
</html>

View File

@ -0,0 +1,13 @@
<html>
<head>
<script>
function boom() {
var iframe = document.getElementById('inner');
iframe.src = iframe.src;
}
</script>
</head>
<body onload="boom()">
<iframe src="428844-1-inner.xhtml" id="inner">
</body>
</html>

View File

@ -0,0 +1 @@
load 428844-1.html

View File

@ -573,7 +573,8 @@ nsEditingSession::TearDownEditorOnWindow(nsIDOMWindow *aWindow)
rv = editorDocShell->GetEditor(getter_AddRefs(editor));
NS_ENSURE_SUCCESS(rv, rv);
htmlDoc->TearingDownEditor(editor);
if (stopEditing)
htmlDoc->TearingDownEditor(editor);
// null out the editor on the controllers first to prevent their weak
// references from pointing to a destroyed editor

View File

@ -25,6 +25,7 @@ include ../../dom/src/jsurl/crashtests/crashtests.list
include ../../editor/libeditor/html/crashtests/crashtests.list
include ../../editor/libeditor/base/crashtests/crashtests.list
include ../../editor/composer/src/crashtests/crashtests.list
include ../../intl/lwbrk/src/crashtests/crashtests.list