Bug 1401726 - Fix crash in nsLabelsNodeList::PopulateSelf. r=smaug

2017-09-21 02:06:00 -04:00 · 2017-09-21 02:06:00 -04:00 · c891a377df
--- a/dom/base/nsContentList.cpp
+++ b/dom/base/nsContentList.cpp
@ -1266,7 +1266,9 @@ nsLabelsNodeList::MaybeResetRoot(nsINode* aRootNode)
 void
 nsLabelsNodeList::PopulateSelf(uint32_t aNeededLength)
 {
-  MOZ_ASSERT(mRootNode, "Must have root");
+  if (!mRootNode) {
+    return;
+  }

  // Start searching at the root.
  nsINode* cur = mRootNode;
--- a/dom/html/crashtests/1401726.html
+++ b/dom/html/crashtests/1401726.html
@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script>
+    try { o1 = document.createElement('button') } catch(e) { }
+    try { o2 = document.createElement('p') } catch(e) { }
+    try { o3 = o1.labels } catch(e) { }
+    try { o4 = document.createNSResolver(document.documentElement) } catch(e) { }
+    try { o5 = document.createRange(); } catch(e) { }
+    try { document.documentElement.appendChild(o1) } catch(e) { }
+    try { o5.selectNode(o4); } catch(e) { }
+    try { o5.surroundContents(o2) } catch(e) { }
+    try { o5.surroundContents(o2) } catch(e) { }
+    try { o1.labels.length } catch(e) { }
+</script>
+</head>
+</html>
--- a/dom/html/crashtests/crashtests.list
+++ b/dom/html/crashtests/crashtests.list
@ -83,3 +83,4 @@ load 1343886-2.xml
 load 1343886-3.xml
 load 1350972.html
 load 1386905.html
+asserts(0-4) load 1401726.html