Bug 1089049 - crash in nsContentUtils::CanCallerAccess(nsINode*), Browser crashes if contextNode is null of document.evaluate. r=bz.

--HG--
extra : rebase_source : 00d2454f8de660a6432d30324529df02b52dd618

dom/base/nsDocument.cpp

@@ -12401,7 +12401,7 @@ nsIDocument::CreateNSResolver(nsINode& aNodeResolver)
 
 already_AddRefed<XPathResult>
 nsIDocument::Evaluate(JSContext* aCx, const nsAString& aExpression,
-                      nsINode* aContextNode, XPathNSResolver* aResolver,
+                      nsINode& aContextNode, XPathNSResolver* aResolver,
                       uint16_t aType, JS::Handle<JSObject*> aResult,
                       ErrorResult& rv)
 {

dom/base/nsIDocument.h

@@ -2344,7 +2344,7 @@ public:
                      mozilla::ErrorResult& rv);
   nsINode* CreateNSResolver(nsINode& aNodeResolver);
   already_AddRefed<mozilla::dom::XPathResult>
-    Evaluate(JSContext* aCx, const nsAString& aExpression, nsINode* aContextNode,
+    Evaluate(JSContext* aCx, const nsAString& aExpression, nsINode& aContextNode,
              mozilla::dom::XPathNSResolver* aResolver, uint16_t aType,
              JS::Handle<JSObject*> aResult, mozilla::ErrorResult& rv);
   // Touch event handlers already on nsINode

dom/media/MediaManager.cpp

@@ -2487,4 +2487,66 @@ GetUserMediaNotificationEvent::Run()
   return MediaManager::NotifyRecordingStatusChange(window, msg, mIsAudio, mIsVideo);
 }
 
+NS_IMETHODIMP
+MediaManager::GetDecoderVersions(uint32_t* aCount, char*** aDecoders)
+{
+  nsTArray<nsCString> decorders;
+#ifdef MOZ_RAW
+  if (MediaDecoder::IsRawEnabled()) {
+    decorders.AppendElement()->AppendLiteral("Raw");
+  }
+#endif
+#ifdef MOZ_WAVE
+  if (MediaDecoder::IsWaveEnabled()) {
+    decorders.AppendElement()->AppendLiteral("Wave");
+  }
+#endif
+#if defined(MOZ_WEBM) && !defined(MOZ_OMX_WEBM_DECODER)
+#endif
+#if defined(MOZ_FMP4) && !defined(MOZ_OMX_DECODER)
+  if (Preferences::GetBool("media.fragmented-mp4.exposed", false)) {
+    decorders.AppendElement()->AppendLiteral("Fragmented MP4");
+  }
+#endif
+#ifdef MOZ_GSTREAMER
+  if (MediaDecoder::IsGStreamerEnabled()) {
+    guint major, minor, micro, nano;
+    gst_version(major, minor, micro, nano);
+    decorders.AppendElement()->AppendPrintf("Fragmented MP4 %i.%i.%i.%i", major, minor, micro, nano);
+  }
+#endif
+#ifdef MOZ_OMX_DECODER
+#endif
+#ifdef MOZ_OMX_WEBM_DECODER
+#endif
+#ifdef MOZ_DIRECTSHOW
+#endif
+#ifdef MOZ_WMF
+#endif
+#ifdef MOZ_APPLEMEDIA
+  if (MediaDecoder::IsAppleMP3Enabled()) {
+    decorders.AppendElement()->AppendLiteral("Apple MP3");
+  }
+#endif
+#ifdef MOZ_ANDROID_OMX
+#endif
+#ifdef NECKO_PROTOCOL_rtsp
+#endif
+
+  *aCount = decorders.Length();
+  char** ret =
+    static_cast<char**>(NS_Alloc(*aCount * sizeof(char*)));
+  if (!ret) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  for (uint32_t i = 0; i < *aCount; ++i) {
+    ret[i] = NS_strdup(decorders[i].get());
+  }
+
+  *aDecoders = ret;
+
+  return NS_OK;
+}
+
 } // namespace mozilla

dom/media/gstreamer/GStreamerFunctionList.h

@@ -73,6 +73,7 @@ GST_FUNC(LIBGSTREAMER, gst_structure_get_int)
 GST_FUNC(LIBGSTREAMER, gst_structure_get_value)
 GST_FUNC(LIBGSTREAMER, gst_structure_new)
 GST_FUNC(LIBGSTREAMER, gst_util_uint64_scale)
+GST_FUNC(LIBGSTREAMER, gst_version)
 
 #if GST_VERSION_MAJOR == 0
 GST_FUNC(LIBGSTAPP, gst_app_sink_pull_buffer)

dom/media/nsIMediaManager.idl

@@ -22,4 +22,7 @@ interface nsIMediaManagerService : nsISupports
   void mediaCaptureWindowState(in nsIDOMWindow aWindow, out boolean aVideo, out boolean aAudio,
                                [optional] out boolean aScreenShare, [optional] out boolean aWindowShare,
                                [optional] out boolean aAppShare);
+
+  void getDecoderVersions([optional] out unsigned long aCount,
+                          [retval, array, size_is(aCount)] out string aDecoders);
 };

dom/webidl/XPathEvaluator.webidl

@@ -13,7 +13,7 @@ interface XPathEvaluator {
   [Pure]
   Node createNSResolver(Node nodeResolver);
   [Throws]
-  XPathResult evaluate(DOMString expression, Node? contextNode,
+  XPathResult evaluate(DOMString expression, Node contextNode,
                        XPathNSResolver? resolver, unsigned short type,
                        object? result);
 };

dom/xslt/crashtests/1089049.html

@@ -0,0 +1,3 @@
+<script>
+var xpathResult = document.evaluate('', null, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+</script>

dom/xslt/crashtests/crashtests.list

@@ -14,3 +14,4 @@ load 601543.html
 load 603844.html
 load 602115.html
 load 667315.xml
+load 1089049.html

dom/xslt/xpath/XPathEvaluator.cpp

@@ -175,16 +175,16 @@ XPathEvaluator::Constructor(const GlobalObject& aGlobal,
 
 already_AddRefed<XPathResult>
 XPathEvaluator::Evaluate(JSContext* aCx, const nsAString& aExpression,
-                         nsINode* aContextNode,
-                         XPathNSResolver* aResolver, uint16_t aType,
-                         JS::Handle<JSObject*> aResult, ErrorResult& rv)
+                         nsINode& aContextNode, XPathNSResolver* aResolver,
+                         uint16_t aType, JS::Handle<JSObject*> aResult,
+                         ErrorResult& rv)
 {
     nsAutoPtr<XPathExpression> expression(CreateExpression(aExpression,
                                                            aResolver, rv));
     if (rv.Failed()) {
         return nullptr;
     }
-    return expression->Evaluate(aCx, *aContextNode, aType, aResult, rv);
+    return expression->Evaluate(aCx, aContextNode, aType, aResult, rv);
 }
 
 

dom/xslt/xpath/XPathEvaluator.h

@@ -64,7 +64,7 @@ public:
     }
     already_AddRefed<XPathResult>
         Evaluate(JSContext* aCx, const nsAString& aExpression,
-                 nsINode* aContextNode, XPathNSResolver* aResolver,
+                 nsINode& aContextNode, XPathNSResolver* aResolver,
                  uint16_t aType, JS::Handle<JSObject*> aResult,
                  ErrorResult& rv);
 private:

toolkit/content/aboutSupport.js

@@ -271,6 +271,18 @@ let snapshotFormatters = {
     $.append($("graphics-tbody"), trs);
   },
 
+
+  media: function media(data) {
+    // media-tbody tbody
+dump("BAAAAAR\n" + data.toSource() + "\n");
+    let trs = data["decoderVersions"].map(function (val) {
+      return $.new("tr", [
+        $.new("td", val),
+      ]);
+    });
+    $.append($("media-tbody"), trs);
+  },
+
   javaScript: function javaScript(data) {
     $("javascript-incremental-gc").textContent = data.incrementalGCEnabled;
   },

toolkit/content/aboutSupport.xhtml

@@ -247,6 +247,23 @@
 
       <!-- - - - - - - - - - - - - - - - - - - - - -->
 
+      <h2 class="major-section">
+        &aboutSupport.mediaTitle;
+      </h2>
+
+      <table>
+        <thead class="no-copy">
+          <th>
+            &aboutSupport.decoderVersions;
+          </th>
+        </thead>
+
+        <tbody id="media-tbody">
+        </tbody>
+      </table>
+
+      <!-- - - - - - - - - - - - - - - - - - - - - -->
+
       <h2 class="major-section">
         &aboutSupport.modifiedKeyPrefsTitle;
       </h2>

toolkit/locales/en-US/chrome/global/aboutSupport.dtd

@@ -93,3 +93,6 @@ variant of aboutSupport.showDir.label. -->
 
 <!ENTITY aboutSupport.copyTextToClipboard.label "Copy text to clipboard">
 <!ENTITY aboutSupport.copyRawDataToClipboard.label "Copy raw data to clipboard">
+
+<!ENTITY aboutSupport.mediaTitle "Media">
+<!ENTITY aboutSupport.decoderVersions "Decoder versions">

toolkit/modules/Troubleshoot.jsm

@@ -417,6 +417,14 @@ let dataProviders = {
     done(data);
   },
 
+  media: function media(done) {
+    let data = {};
+    let mediaMgr = Cc["@mozilla.org/mediaManagerService;1"].getService(Ci.nsIMediaManagerService);
+    data.decoderVersions = mediaMgr.getDecoderVersions();
+dump("FOOOOOOO\n" + data.toSource() + "\n");
+    done(data);
+  },
+
   javaScript: function javaScript(done) {
     let data = {};
     let winEnumer = Services.ww.getWindowEnumerator();