From b2fbbfc30647121a695a51b877cf7584ad0c1d3a Mon Sep 17 00:00:00 2001 From: Mats Palmgren Date: Fri, 15 Oct 2010 06:03:33 +0200 Subject: [PATCH] Bug 601422 - Crash [@ nsImageDocument::ShrinkToFit] in removed frame. r=Olli.Pettay a=jst --- content/html/document/crashtests/601422.html | 23 +++++++++++++++++++ .../html/document/crashtests/crashtests.list | 1 + content/html/document/src/nsImageDocument.cpp | 6 +++++ 3 files changed, 30 insertions(+) create mode 100644 content/html/document/crashtests/601422.html diff --git a/content/html/document/crashtests/601422.html b/content/html/document/crashtests/601422.html new file mode 100644 index 000000000000..d3468a306371 --- /dev/null +++ b/content/html/document/crashtests/601422.html @@ -0,0 +1,23 @@ + + + + + + + + + + diff --git a/content/html/document/crashtests/crashtests.list b/content/html/document/crashtests/crashtests.list index ccc5590bdb7b..e7b5c4684dda 100644 --- a/content/html/document/crashtests/crashtests.list +++ b/content/html/document/crashtests/crashtests.list @@ -11,3 +11,4 @@ load 468562-2.html load 494225.html load 495543.svg load 564461.xhtml +load 601422.html diff --git a/content/html/document/src/nsImageDocument.cpp b/content/html/document/src/nsImageDocument.cpp index d9c69edfbcb2..50afc47f1e57 100644 --- a/content/html/document/src/nsImageDocument.cpp +++ b/content/html/document/src/nsImageDocument.cpp @@ -436,6 +436,9 @@ nsImageDocument::GetImageRequest(imgIRequest** aImageRequest) NS_IMETHODIMP nsImageDocument::ShrinkToFit() { + if (!mImageContent) { + return NS_OK; + } if (GetZoomLevel() != mOriginalZoomLevel && mImageIsResized && !nsContentUtils::IsChildOfSameType(this)) { return NS_OK; @@ -495,6 +498,9 @@ nsImageDocument::ScrollImageTo(PRInt32 aX, PRInt32 aY, PRBool restoreImage) NS_IMETHODIMP nsImageDocument::RestoreImage() { + if (!mImageContent) { + return NS_OK; + } // Keep image content alive while changing the attributes. nsCOMPtr imageContent = mImageContent; imageContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::width, PR_TRUE);