Bug 1320423 - Null check cursor images to handled failed loads. r=dbaron
authorCameron McCormack <cam@mcc.id.au>
Sat, 26 Nov 2016 15:00:53 +0800
changeset 324387 ce2b35bf0048555354a5684c1c2b7c8d27b06b65
parent 324386 788b9b276f6590d3160b75d91c7ebba7854e748d
child 324388 b435f6479aa02a089d664b4800c6eff77c08ac46
push id24
push usermaklebus@msu.edu
push dateTue, 20 Dec 2016 03:11:33 +0000
reviewersdbaron
bugs1320423
milestone53.0a1
Bug 1320423 - Null check cursor images to handled failed loads. r=dbaron
layout/generic/nsFrame.cpp
layout/style/crashtests/1320423-1.html
layout/style/crashtests/crashtests.list
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -9284,30 +9284,31 @@ void nsFrame::FillCursorInformationFromS
 {
   aCursor.mCursor = ui->mCursor;
   aCursor.mHaveHotspot = false;
   aCursor.mLoading = false;
   aCursor.mHotspotX = aCursor.mHotspotY = 0.0f;
 
   for (const nsCursorImage& item : ui->mCursorImages) {
     uint32_t status;
-    nsresult rv = item.GetImage()->GetImageStatus(&status);
-    if (NS_SUCCEEDED(rv)) {
-      if (!(status & imgIRequest::STATUS_LOAD_COMPLETE)) {
-        // If we are falling back because any cursor before is loading,
-        // let the consumer know.
-        aCursor.mLoading = true;
-      } else if (!(status & imgIRequest::STATUS_ERROR)) {
-        // This is the one we want
-        item.GetImage()->GetImage(getter_AddRefs(aCursor.mContainer));
-        aCursor.mHaveHotspot = item.mHaveHotspot;
-        aCursor.mHotspotX = item.mHotspotX;
-        aCursor.mHotspotY = item.mHotspotY;
-        break;
-      }
+    imgRequestProxy* req = item.GetImage();
+    if (!req || NS_FAILED(req->GetImageStatus(&status))) {
+      continue;
+    }
+    if (!(status & imgIRequest::STATUS_LOAD_COMPLETE)) {
+      // If we are falling back because any cursor before is loading,
+      // let the consumer know.
+      aCursor.mLoading = true;
+    } else if (!(status & imgIRequest::STATUS_ERROR)) {
+      // This is the one we want
+      req->GetImage(getter_AddRefs(aCursor.mContainer));
+      aCursor.mHaveHotspot = item.mHaveHotspot;
+      aCursor.mHotspotX = item.mHotspotX;
+      aCursor.mHotspotY = item.mHotspotY;
+      break;
     }
   }
 }
 
 NS_IMETHODIMP
 nsFrame::RefreshSizeCache(nsBoxLayoutState& aState)
 {
   // XXXbz this comment needs some rewriting to make sense in the
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1320423-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<style>
+#target {
+  cursor: url(file:///somewhere/cursor.png), pointer;
+  position: absolute;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  background: yellow;
+}
+#target:hover {
+  background: green;
+}
+</style>
+<div id=target></div>
+<script>
+var target = document.getElementById("target");
+var x = window.outerWidth / 2, y = window.outerHeight / 2;
+SpecialPowers.DOMWindowUtils.sendMouseEvent("mouseover", x, y, 0, 0, 0);
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -158,8 +158,9 @@ pref(dom.animations-api.core.enabled,tru
 pref(dom.animations-api.core.enabled,true) load 1290994-1.html
 pref(dom.animations-api.core.enabled,true) load 1290994-2.html
 pref(dom.animations-api.core.enabled,true) load 1290994-3.html
 load 1290994-4.html
 load 1314531.html
 load 1315889-1.html
 load 1315894-1.html
 load 1319072-1.html
+HTTP load 1320423-1.html