Closed Bug 478725 Opened 16 years ago Closed 16 years ago

hang if I paste content from Wikipedia into an IFrame with designMode on

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9.2a1

People

(Reporter: fabian, Assigned: MatsPalmgren_bugz)

References

Details

(Keywords: hang)

Attachments

(2 files)

Patch rev. 1
4.02 KB, patch
peterv
: review+
peterv
: superreview+
Details | Diff | Splinter Review
mochitest.diff
5.84 KB, patch
Details | Diff | Splinter Review
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6 Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6 Freeze when pasting or dropping content with some IMG-elements into LI-element in Iframe with designMode on. Note that it Reproducible: Always Steps to Reproduce: 1. Do a fresh install of Firefox 3 (or 3.1 or 2) on Windows or Ubuntu 2. Open a midas-editor (such as http://www.fckeditor.net/demo) 3. Open a Wikipedia article that contains a block equation (such as http://en.wikipedia.org/wiki/Luminosity) 4. Create an enumeration and place the cursor inside a LI-element 5. Select some text including a block img (see screenshot) 6. Drag and drop selection or copy and paste it into the LI-element 7. Firefox freezes Actual Results: Firefox Freezes, has to be killed Expected Results: The selection should just be pasted as in IE or Safari.
Component: General → Editor
Product: Firefox → Core
QA Contact: general → editor
Can you try in Safe Mode?
Keywords: hang
Summary: crash if I paste content from Wikipedia into an IFrame with designMode on → hang if I paste content from Wikipedia into an IFrame with designMode on
Version: unspecified → 1.9.0 Branch
shows no difference
http://hg.mozilla.org/mozilla-central/file/3cd8df7964b1/editor/libeditor/html/nsHTMLDataTransfer.cpp#l553 curNode is <dl> and IsList(curNode) is true. parentNode is <li> and IsListItem(parentNode) is true. (start while loop on line 558) child is <dd> and IsListItem(child) is true. parentNode is not an empty node. (call InsertNodeAtPoint on line 581) http://hg.mozilla.org/mozilla-central/file/3cd8df7964b1/editor/libeditor/html/nsHTMLEditor.cpp#l2049 <li> cannot contain <dd> <ol> cannot contain <dd> <body> cannot contain <dd> return NS_ERROR_FAILURE on line 2074 skip the if-clause on line 582 and fall through to line 593... child is still the same <dd> node ==> loop forever. It looks like the other while-loops in this method have the same problem if InsertNodeAtPoint fails.
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Linux → All
Hardware: x86_64 → All
Version: 1.9.0 Branch → unspecified
Attached patch Patch rev. 1 — — Splinter Review
Break out of the loop if InsertNodeAtPoint() fails and try the generic insertion code at the end (will insert the <dl> into <li> in this case).
Assignee: nobody → mats.palmgren
Attachment #363033 - Flags: superreview?(peterv)
Attachment #363033 - Flags: review?(peterv)
Attached patch mochitest.diff — — Splinter Review
Attachment #363033 - Flags: superreview?(peterv)
Attachment #363033 - Flags: superreview+
Attachment #363033 - Flags: review?(peterv)
Attachment #363033 - Flags: review+
http://hg.mozilla.org/mozilla-central/rev/20c271778810 -> FIXED
Status: NEW → RESOLVED
Closed: 16 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.2a1
Depends on: 480360
Depends on: 480972
No longer depends on: 480360
Version: unspecified → Trunk
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: