Fix crash when element is being inserted "after itself"
diff --git a/tinyxml2.cpp b/tinyxml2.cpp
index a8a4a20..dcf2a43 100755
--- a/tinyxml2.cpp
+++ b/tinyxml2.cpp
@@ -911,6 +911,13 @@
TIXMLASSERT( false );
return 0;
}
+ if ( afterThis == addThis ) {
+ // Current state: BeforeThis -> AddThis -> OneAfterAddThis
+ // Now AddThis must disappear from it's location and then
+ // reappear between BeforeThis and OneAfterAddThis.
+ // So just leave it where it is.
+ return addThis;
+ }
if ( afterThis->_next == 0 ) {
// The last node or the only node.
diff --git a/xmltest.cpp b/xmltest.cpp
index 18e2491..75c28e5 100644
--- a/xmltest.cpp
+++ b/xmltest.cpp
@@ -386,6 +386,34 @@
}
{
+ // This test is pre-test for the next one
+ // (where Element1 is inserted "after itself".
+ // This code didn't use to crash.
+ XMLDocument doc;
+ XMLElement* element1 = doc.NewElement("Element1");
+ XMLElement* element2 = doc.NewElement("Element2");
+ doc.InsertEndChild(element1);
+ doc.InsertEndChild(element2);
+ doc.InsertAfterChild(element2, element2);
+ doc.InsertAfterChild(element2, element2);
+ }
+
+ {
+ XMLDocument doc;
+ XMLElement* element1 = doc.NewElement("Element1");
+ XMLElement* element2 = doc.NewElement("Element2");
+ doc.InsertEndChild(element1);
+ doc.InsertEndChild(element2);
+
+ // This insertion "after itself"
+ // used to cause invalid memory access and crash
+ doc.InsertAfterChild(element1, element1);
+ doc.InsertAfterChild(element1, element1);
+ doc.InsertAfterChild(element2, element2);
+ doc.InsertAfterChild(element2, element2);
+ }
+
+ {
static const char* test = "<element>Text before.</element>";
XMLDocument doc;
doc.Parse( test );