Bug 931794 - startup crash in mozilla::dom::WindowBinding::get_content with Twitter Disconnect, Facebook Disconnect, or Google Disconnect on 2013-10-28 nightly. r=bz, a=bajaj.
authorPeter Van der Beken <peterv@propagandism.org>
Mon, 28 Oct 2013 22:03:07 +0100
changeset 166334 f31ef270c830c8a7e001adeac5ba8099ebd0f4db
parent 166333 d70b80fb400d5f71a256e878f0d29d5aa999f934
child 166335 3f97ca730409047852ac36f51b76ddf621d9e282
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz, bajaj
bugs931794
milestone27.0a2
Bug 931794 - startup crash in mozilla::dom::WindowBinding::get_content with Twitter Disconnect, Facebook Disconnect, or Google Disconnect on 2013-10-28 nightly. r=bz, a=bajaj.
dom/base/nsGlobalWindow.cpp
dom/webidl/Window.webidl
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -3683,23 +3683,23 @@ nsGlobalWindow::GetContent(JSContext* aC
 
   // Something tries to get .content on a ChromeWindow, try to fetch the CPOW.
   nsCOMPtr<nsIDocShellTreeOwner> treeOwner = GetTreeOwner();
   if (!treeOwner) {
     aError.Throw(NS_ERROR_FAILURE);
     return nullptr;
   }
 
-  JS::Rooted<JS::Value> val(aCx);
+  JS::Rooted<JS::Value> val(aCx, JS::NullValue());
   aError = treeOwner->GetContentWindow(aCx, val.address());
   if (aError.Failed()) {
     return nullptr;
   }
 
-  return &val.toObject();
+  return val.toObjectOrNull();
 }
 
 already_AddRefed<nsIDOMWindow>
 nsGlobalWindow::GetContentInternal(ErrorResult& aError)
 {
   // First check for a named frame named "content"
   nsCOMPtr<nsIDOMWindow> domWindow =
     GetChildWindow(NS_LITERAL_STRING("content"));
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -327,14 +327,14 @@ partial interface Window {
    * arguments, plus any additional arguments are passed on as
    * arguments on the dialog's window object (window.arguments).
    */
   [Throws] WindowProxy? openDialog(optional DOMString url = "",
                                    optional DOMString name = "",
                                    optional DOMString options = "",
                                    any... extraArguments);
 
-  [Replaceable, Throws] readonly attribute object content;
+  [Replaceable, Throws] readonly attribute object? content;
 };
 
 Window implements TouchEventHandlers;
 
 Window implements OnErrorEventHandlerForWindow;