ice
ice copied to clipboard
crash if blockEl appears at a higher level in the DOM
Assume that you have set
blockEl: 'div' (standard in Webkit)
with a document structure such as this:
A paragraph of the contents...
Another content paragraph...
Now in the function _deleteFromLeft, the parentBlock will potentially be assigned to an element outside of this.element in this line:
var parentBlock = ice.dom.parents(range.startContainer, this.blockEl)[0]
If the user now hits backspace at the start of a line, the container div will be deleted.
I think this is/was handled. It appears to be broken now. deleteFromLeft should detect if we go out of bounds and should do nothing in that case.
Filing this as a bug.