Commit 0d414910 authored by Boris Zbarsky's avatar Boris Zbarsky
Browse files

Bug 515829. Don't assume that mDefaultSubmitElement is non-null just because... 

Bug 515829.  Don't assume that mDefaultSubmitElement is non-null just because our firstSubmitSlot contains non-null.  r=jst
parent b21d3906

content/html/content/crashtests/515829-1.html

0 → 100644
+7 −0
Original line number Diff line number Diff line 
<!DOCTYPE html>

<html>

<head></head>

<body onload="document.getElementById('x').innerHTML = '<button></button>';">

<form><div id="x"><button></button></div><button></button></form>

</body>

</html>

content/html/content/crashtests/515829-2.html

0 → 100644
+7 −0
Original line number Diff line number Diff line 
<!DOCTYPE html>

<html>

<head></head>

<body onload="document.getElementById('x').innerHTML = '<button></button>';">

<form><div id="x"><button></button></div><button></button><input type="image"></form>

</body>

</html>

content/html/content/crashtests/crashtests.list

+2 −0
Original line number Diff line number Diff line
@@ -10,3 +10,5 @@ load 423371-1.html 
load 451123-1.html

load 453406-1.html

load 504183-1.html

load 515829-1.html

load 515829-2.html

content/html/content/src/nsHTMLFormElement.cpp

+10 −8
Original line number Diff line number Diff line
@@ -1433,19 +1433,21 @@ nsHTMLFormElement::AddElement(nsIFormControl* aChild, 
    if (!*firstSubmitSlot ||

        (!lastElement &&

         CompareFormControlPosition(aChild, *firstSubmitSlot, this) < 0)) {

      NS_ASSERTION(*firstSubmitSlot == mDefaultSubmitElement ||

                   mDefaultSubmitElement,

                   "How can we have a null mDefaultSubmitElement but a "

                   "first-submit slot in one of the lists?");

      if (*firstSubmitSlot == mDefaultSubmitElement ||

      // Update mDefaultSubmitElement if it's currently in a valid state.

      // Valid state means either non-null or null because there are in fact

      // no submit elements around.

      if ((mDefaultSubmitElement ||

           (!mFirstSubmitInElements && !mFirstSubmitNotInElements)) &&

          (*firstSubmitSlot == mDefaultSubmitElement ||

           CompareFormControlPosition(aChild,

                                     mDefaultSubmitElement, this) < 0) {

                                      mDefaultSubmitElement, this) < 0)) {

        mDefaultSubmitElement = aChild;

      }

      *firstSubmitSlot = aChild;

    }

    NS_POSTCONDITION(mDefaultSubmitElement == mFirstSubmitInElements ||

                     mDefaultSubmitElement == mFirstSubmitNotInElements,

                     mDefaultSubmitElement == mFirstSubmitNotInElements ||

                     !mDefaultSubmitElement,

                     "What happened here?");



    // Notify that the state of the previous default submit element has changed