Bug 72675, document.load() can cause crash if loading HTML document. r=harishd,sr=vidur.

content/xml/document/src/nsXMLContentSink.cpp

@@ -90,15 +90,13 @@ nsINameSpaceManager* nsXMLContentSink::gNameSpaceManager = nsnull;
 PRUint32 nsXMLContentSink::gRefCnt = 0;
 
 // XXX Open Issues:
-// 1) html:style - Should we allow inline style? If so, the content
-//    sink needs to process the tag and invoke the CSS parser.
-// 2) html:base - Should we allow a base tag? If so, the content
+// 1) html:base - Should we allow a base tag? If so, the content
 //    sink needs to maintain the base when resolving URLs for
 //    loaded scripts and style sheets. Should it be allowed anywhere?
-// 3) what's not allowed - We need to figure out which HTML tags
+// 2) what's not allowed - We need to figure out which HTML tags
 //    (prefixed with a HTML namespace qualifier) are explicitly not
 //    allowed (if any).
-// 4) factoring code with nsHTMLContentSink - There's some amount of
+// 3) factoring code with nsHTMLContentSink - There's some amount of
 //    common code between this and the HTML content sink. This will
 //    increase as we support more and more HTML elements. How can code
 //    from the code be factored?

content/xml/document/src/nsXMLDocument.cpp

@@ -1026,9 +1026,15 @@ nsXMLDocument::GetElementById(const nsAReadableString& aElementId,
   if (aElementId.IsEmpty())
     return NS_OK;
 
+  // If we tried to load a document and something went wrong, we might not have
+  // root content. This can happen when you do document.load() and the document
+  // to load is not XML, for example.
+  if (!mRootContent)
+    return NS_OK;
+
   // XXX For now, we do a brute force search of the content tree.
   // We should come up with a more efficient solution.
-  nsCOMPtr<nsIContent> content = do_QueryInterface(MatchName(mRootContent,aElementId));
+  nsCOMPtr<nsIContent> content(do_QueryInterface(MatchName(mRootContent,aElementId)));
 
   nsresult rv = NS_OK;
   if (content) {