Bug 828180 - Fix crash in nsIContent::IsHTML. r=bz, a=akeybl
authorPeter Van der Beken <peterv@propagandism.org>
Thu, 10 Jan 2013 10:57:19 +0100
changeset 127110 a3ed3feed8f43a76e62e021aba1ea35fbabc5c30
parent 127109 a61bee78cb468c96925549026136de4b83431a5d
child 127111 2a6bf87c333e851ec485f298a5cbf28ae90c84b9
push id2151
push userlsblakk@mozilla.com
push dateTue, 19 Feb 2013 18:06:57 +0000
treeherdermozilla-beta@4952e88741ec [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz, akeybl
bugs828180
milestone20.0a2
Bug 828180 - Fix crash in nsIContent::IsHTML. r=bz, a=akeybl
content/html/content/crashtests/828180.html
content/html/content/crashtests/crashtests.list
content/html/content/src/HTMLTableElement.h
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/828180.html
@@ -0,0 +1,5 @@
+<script>
+var table = document.createElement("table");
+table.tHead = null;
+table.tFoot = null;
+</script>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -39,8 +39,9 @@ load 741250.xhtml
 load 795221-1.html
 load 795221-2.html
 load 795221-3.html
 load 795221-4.html
 load 795221-5.xml
 load 798802-1.html
 load 811226.html
 load 819745.html
+load 828180.html
--- a/content/html/content/src/HTMLTableElement.h
+++ b/content/html/content/src/HTMLTableElement.h
@@ -57,17 +57,17 @@ public:
   already_AddRefed<nsGenericHTMLElement> CreateCaption();
 
   HTMLTableSectionElement* GetTHead() const
   {
     return static_cast<HTMLTableSectionElement*>(GetChild(nsGkAtoms::thead));
   }
   void SetTHead(HTMLTableSectionElement* aTHead, ErrorResult& aError)
   {
-    if (!aTHead->IsHTML(nsGkAtoms::thead)) {
+    if (aTHead && !aTHead->IsHTML(nsGkAtoms::thead)) {
       aError.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
       return;
     }
 
     DeleteTHead();
     if (aTHead) {
       nsINode::InsertBefore(*aTHead, nsINode::GetFirstChild(), aError);
     }
@@ -75,17 +75,17 @@ public:
   already_AddRefed<nsGenericHTMLElement> CreateTHead();
 
   HTMLTableSectionElement* GetTFoot() const
   {
     return static_cast<HTMLTableSectionElement*>(GetChild(nsGkAtoms::tfoot));
   }
   void SetTFoot(HTMLTableSectionElement* aTFoot, ErrorResult& aError)
   {
-    if (!aTFoot->IsHTML(nsGkAtoms::tfoot)) {
+    if (aTFoot && !aTFoot->IsHTML(nsGkAtoms::tfoot)) {
       aError.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
       return;
     }
 
     DeleteTFoot();
     if (aTFoot) {
       nsINode::AppendChild(*aTFoot, aError);
     }