Bug 586713: Null check to fix crash in Mac OS X native menu code. r=bz
authorJosh Aas <joshmoz@gmail.com>
Fri, 13 Aug 2010 02:33:09 -0400
changeset 50385 1887d4c886876f3a60000f34d9da5e9f6d5d1204
parent 50384 53bf594b6fb6c0691e445c880bc515b7ac59f80b
child 50386 33f8c2bb77ca11f13bf368a193cfe51b569263cd
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs586713
milestone2.0b4pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 586713: Null check to fix crash in Mac OS X native menu code. r=bz
widget/src/cocoa/nsMenuGroupOwnerX.mm
widget/tests/Makefile.in
widget/tests/bug586713_window.xul
widget/tests/test_bug586713.xul
--- a/widget/src/cocoa/nsMenuGroupOwnerX.mm
+++ b/widget/src/cocoa/nsMenuGroupOwnerX.mm
@@ -159,21 +159,25 @@ void nsMenuGroupOwnerX::AttributeChanged
 
 
 void nsMenuGroupOwnerX::ContentRemoved(nsIDocument * aDocument,
                                        nsIContent * aContainer,
                                        nsIContent * aChild,
                                        PRInt32 aIndexInContainer,
                                        nsIContent * aPreviousSibling)
 {
+  if (!aContainer) {
+    return;
+  }
+
   nsCOMPtr<nsIMutationObserver> kungFuDeathGrip(this);
   nsChangeObserver* obs = LookupContentChangeObserver(aContainer);
   if (obs)
     obs->ObserveContentRemoved(aDocument, aChild, aIndexInContainer);
-  else if (aContainer && (aContainer != mContent)) {
+  else if (aContainer != mContent) {
     // We do a lookup on the parent container in case things were removed
     // under a "menupopup" item. That is basically a wrapper for the contents
     // of a "menu" node.
     nsCOMPtr<nsIContent> parent = aContainer->GetParent();
     if (parent) {
       obs = LookupContentChangeObserver(parent);
       if (obs)
         obs->ObserveContentRemoved(aDocument, aChild, aIndexInContainer);
@@ -182,16 +186,20 @@ void nsMenuGroupOwnerX::ContentRemoved(n
 }
 
 
 void nsMenuGroupOwnerX::ContentInserted(nsIDocument * aDocument,
                                         nsIContent * aContainer,
                                         nsIContent * aChild,
                                         PRInt32 aIndexInContainer)
 {
+  if (!aContainer) {
+    return;
+  }
+
   nsCOMPtr<nsIMutationObserver> kungFuDeathGrip(this);
   nsChangeObserver* obs = LookupContentChangeObserver(aContainer);
   if (obs)
     obs->ObserveContentInserted(aDocument, aChild, aIndexInContainer);
   else if (aContainer != mContent) {
     // We do a lookup on the parent container in case things were removed
     // under a "menupopup" item. That is basically a wrapper for the contents
     // of a "menu" node.
--- a/widget/tests/Makefile.in
+++ b/widget/tests/Makefile.in
@@ -87,16 +87,18 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
                test_bug428405.xul \
                test_bug466599.xul \
                test_bug485118.xul \
                test_bug522217.xul \
                window_bug522217.xul \
                test_platform_colors.xul \
                test_standalone_native_menu.xul \
                standalone_native_menu_window.xul \
+               test_bug586713.xul \
+               bug586713_window.xul \
                $(NULL)
 endif
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
 ifneq ($(OS_ARCH), WINCE)
 _CHROME_FILES  += taskbar_previews.xul \
 		window_state_windows.xul \
 		taskbar_progress.xul \
new file mode 100644
--- /dev/null
+++ b/widget/tests/bug586713_window.xul
@@ -0,0 +1,83 @@
+<?xml version="1.0"?>
+
+<!-- ***** BEGIN LICENSE BLOCK *****
+   - Version: MPL 1.1/GPL 2.0/LGPL 2.1
+   -
+   - The contents of this file are subject to the Mozilla Public License Version
+   - 1.1 (the "License"); you may not use this file except in compliance with
+   - the License. You may obtain a copy of the License at
+   - http://www.mozilla.org/MPL/
+   -
+   - Software distributed under the License is distributed on an "AS IS" basis,
+   - WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+   - for the specific language governing rights and limitations under the
+   - License.
+   -
+   - The Original Code is Native Menus Test code
+   -
+   - The Initial Developer of the Original Code is
+   - Mozilla Corporation.
+   - Portions created by the Initial Developer are Copyright (C) 2010
+   - the Initial Developer. All Rights Reserved.
+   -
+   - Contributor(s):
+   -   Josh Aas <josh@mozilla.com>
+   -
+   - Alternatively, the contents of this file may be used under the terms of
+   - either the GNU General Public License Version 2 or later (the "GPL"), or
+   - the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+   - in which case the provisions of the GPL or the LGPL are applicable instead
+   - of those above. If you wish to allow use of your version of this file only
+   - under the terms of either the GPL or the LGPL, and not to allow others to
+   - use your version of this file under the terms of the MPL, indicate your
+   - decision by deleting the provisions above and replace them with the notice
+   - and other provisions required by the GPL or the LGPL. If you do not delete
+   - the provisions above, a recipient may use your version of this file under
+   - the terms of any one of the MPL, the GPL or the LGPL.
+   -
+   - ***** END LICENSE BLOCK ***** -->
+
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window id="bug586713_window"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        width="300"
+        height="300"
+        onload="onLoad();"
+        title="Bug 586713 Test">
+
+  <menubar id="nativemenubar">
+    <menu id="foo" label="Foo">
+      <menupopup>
+        <menuitem label="FooItem0"/>
+      </menupopup>
+    </menu>
+  </menubar>
+
+  <script type="application/javascript"><![CDATA[
+    function ok(condition, message) {
+      window.opener.wrappedJSObject.SimpleTest.ok(condition, message);
+    }
+
+    function onTestsFinished() {
+      window.close();
+      window.opener.wrappedJSObject.SimpleTest.finish();
+    }
+
+    var fooCallCount = 0;
+    function foo() {
+      fooCallCount++;
+      let instruction = document.createProcessingInstruction("xml-stylesheet", 'href="chrome://foo.css" type="text/css"');
+      document.insertBefore(instruction, document.documentElement);
+      if (fooCallCount == 2) {
+        ok(true, "If we got here we didn't crash, excellent.");
+        onTestsFinished();
+      }
+    }
+
+    function onLoad() {
+      foo();
+      setTimeout(function() foo(), 0);
+    }
+  ]]></script>
+</window>
new file mode 100644
--- /dev/null
+++ b/widget/tests/test_bug586713.xul
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<window title="Native menu system tests"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <title>Native menu system tests</title>
+  <script type="application/javascript" 
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
+
+<body  xmlns="http://www.w3.org/1999/xhtml">
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+</pre>
+</body>
+
+<script class="testbody" type="application/javascript">
+<![CDATA[
+
+SimpleTest.waitForExplicitFinish();
+window.open("bug586713_window.xul", "bug586713_window", 
+            "chrome,width=600,height=600");
+
+]]>
+</script>
+
+</window>