Bug 346083, Crash [@ nsBoxObject::SetProperty], r+sr=bz

layout/base/nsPresState.cpp

@@ -76,6 +76,7 @@ nsPresState::GetStateProperty(const nsAString& aName, nsAString& aResult)
     supportsStr->GetData(data);
 
     CopyUTF8toUTF16(data, aResult);
+    aResult.SetIsVoid(data.IsVoid());
     rv = NS_STATE_PROPERTY_EXISTS;
   }
 
@@ -88,8 +89,9 @@ nsPresState::SetStateProperty(const nsAString& aName, const nsAString& aValue)
   // Add to hashtable
   nsCOMPtr<nsISupportsCString> supportsStr(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
   NS_ENSURE_TRUE(supportsStr, NS_ERROR_OUT_OF_MEMORY);
-
-  supportsStr->SetData(NS_ConvertUTF16toUTF8(aValue));
+  NS_ConvertUTF16toUTF8 data(aValue);
+  data.SetIsVoid(aValue.IsVoid());
+  supportsStr->SetData(data);
 
   mPropertyTable.Put(aName, supportsStr);
   return NS_OK;

layout/xul/base/src/nsBoxObject.cpp

@@ -395,18 +395,25 @@ nsBoxObject::GetProperty(const PRUnichar* aPropertyName, PRUnichar** aResult)
   nsresult rv = mPresState->GetStateProperty(propertyName, result);
   if (NS_FAILED(rv))
     return rv;
-  *aResult = ToNewUnicode(result);
+  *aResult = result.IsVoid() ? nsnull : ToNewUnicode(result);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsBoxObject::SetProperty(const PRUnichar* aPropertyName, const PRUnichar* aPropertyValue)
 {
-  if (!mPresState)
+  NS_ENSURE_ARG(aPropertyName && *aPropertyName);
+  if (!mPresState) {
     NS_NewPresState(getter_Transfers(mPresState));
-
+    NS_ENSURE_TRUE(mPresState, NS_ERROR_OUT_OF_MEMORY);
+  }
   nsDependentString propertyName(aPropertyName);
-  nsDependentString propertyValue(aPropertyValue);
+  nsDependentString propertyValue;
+  if (aPropertyValue) {
+    propertyValue.Rebind(aPropertyValue);
+  } else {
+    propertyValue.SetIsVoid(PR_TRUE);
+  }
   return mPresState->SetStateProperty(propertyName, propertyValue);
 }