Bug 734548 - Fix crash when StorageEvent.storageArea is null. r=smaug

2012-03-10 12:00:13 -05:00 · 2012-03-10 12:00:13 -05:00 · 57efec8a03
--- a/content/events/crashtests/crashtests.list
+++ b/content/events/crashtests/crashtests.list
@ -6,5 +6,6 @@ load 457776-1.html
 load 496308-1.html
 load 682637-1.html
 load eventctor-nulldictionary.html
+load eventctor-nullstorage.html
 load recursive-onload.html
 load recursive-DOMNodeInserted.html
--- a/content/events/crashtests/eventctor-nullstorage.html
+++ b/content/events/crashtests/eventctor-nullstorage.html
@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+new StorageEvent("").storageArea;
+</script>
--- a/dom/src/storage/nsDOMStorage.cpp
+++ b/dom/src/storage/nsDOMStorage.cpp
@ -2363,7 +2363,7 @@ NS_IMETHODIMP nsDOMStorageEvent::GetStorageArea(nsIDOMStorage * *aStorageArea)
 {
  NS_ENSURE_ARG_POINTER(aStorageArea);

-  NS_ADDREF(*aStorageArea = mStorageArea);
+  NS_IF_ADDREF(*aStorageArea = mStorageArea);
  return NS_OK;
 }