Bug 805749, validate the view parameter of initUIEvent, r=jst

content/events/src/nsDOMUIEvent.cpp

@@ -158,6 +158,10 @@ nsDOMUIEvent::InitUIEvent(const nsAString& typeArg,
                           nsIDOMWindow* viewArg,
                           int32_t detailArg)
 {
+  if (viewArg) {
+    nsCOMPtr<nsPIDOMWindow> view = do_QueryInterface(viewArg);
+    NS_ENSURE_TRUE(view, NS_ERROR_INVALID_ARG);
+  }
   nsresult rv = nsDOMEvent::InitEvent(typeArg, canBubbleArg, cancelableArg);
   NS_ENSURE_SUCCESS(rv, rv);
   

content/events/test/test_eventctors.html

@@ -337,6 +337,24 @@ try {
 ok(ex, "First parameter is required!");
 ex = false;
 
+try {
+  e = new UIEvent("foo", { view: {} });
+  e.view.onunload;
+} catch(exp) {
+  ex = true;
+}
+ok(ex, "{} isn't a valid value.");
+ex = false;
+
+try {
+  e = new UIEvent("foo", { view: null });
+} catch(exp) {
+  ex = true;
+}
+ok(!ex, "null is a valid value.");
+is(e.view, null);
+ex = false;
+
 e = new UIEvent("hello");
 ok(e.type, "hello", "Wrong event type!");
 ok(!e.isTrusted, "Event shouldn't be trusted!");