Bug 496308 - Crash [@ nsDOMPopupBlockedEvent::GetRequestingWindow], r+sr=jonas

content/events/crashtests/496308-1.html

@@ -0,0 +1,3 @@
+<script>
+  document.createEvent("popupblockedevents").requestingWindow;
+</script>

content/events/crashtests/crashtests.list

@@ -3,3 +3,4 @@ load 116206-1.html
 load 135345-1.html
 load 422009-1.xhtml
 load 457776-1.html
+load 496308-1.html

content/events/src/nsDOMPopupBlockedEvent.cpp

@@ -111,11 +111,12 @@ nsDOMPopupBlockedEvent::InitPopupBlockedEvent(const nsAString & aTypeArg,
 NS_IMETHODIMP
 nsDOMPopupBlockedEvent::GetRequestingWindow(nsIDOMWindow **aRequestingWindow)
 {
+  *aRequestingWindow = nsnull;
   if (mEvent->eventStructType == NS_POPUPBLOCKED_EVENT) {
     nsPopupBlockedEvent* event = static_cast<nsPopupBlockedEvent*>(mEvent);
-    CallQueryReferent(event->mRequestingWindow.get(), aRequestingWindow);
-  } else {
-    *aRequestingWindow = 0;
+    if (event->mRequestingWindow) {
+      CallQueryReferent(event->mRequestingWindow.get(), aRequestingWindow);
+    }
   }
 
   return NS_OK;  // Don't throw an exception