1891656 - `HTMLEditUtils::GetMostDistantAncestorEditableEmptyInlineElement` may return `Text`

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

It may use AsElement() for Text, but it's wrong. This may cause crash bugs, but fortunately, all callers use it as nsIContent*, so, this may cause only removing text node instead of nothing to do.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1891656 - Make `HTMLEditUtils::GetMostDistantAncestorEditableEmptyInlineElement()` use `Element::FromNode()` r=m_kato!

It uses AsElement() which always casts itself to Element*, however, the
instance may be non-element node if there is no empty parent of aEmptyContent.

Fortunately, all callers of this method uses the result as nsIContent* to
call DeleteNodeWithTransaction(). Therefore, we don't have crash bugs caused
by this.

Depends on D207687

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/53e1d98592d7
Make `HTMLEditUtils::GetMostDistantAncestorEditableEmptyInlineElement()` use `Element::FromNode()` r=m_kato

Comment 3

[Aron Cseh [:acseh]]

https://hg.mozilla.org/mozilla-central/rev/53e1d98592d7