Bug 865147 - Fix crash in nsContentUtils::ContentIsDescendantOf by checking parent of 'before' node, r=bz, feedback=Ms2ger

2013-04-24 13:05:59 +02:00 · 2013-04-24 13:05:59 +02:00 · e73272c17f
--- a/content/html/content/crashtests/865147.html
+++ b/content/html/content/crashtests/865147.html
@ -0,0 +1,7 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select")[0];
+var newOpt = document.createElement("option");
+select.add(newOpt, newOpt);
+</script>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@ -51,3 +51,4 @@ load 832011.html
 load 837033.html
 pref(dom.experimental_forms_range,true) load 838256-1.html
 load 862084.html
+load 865147.html
--- a/content/html/content/src/HTMLSelectElement.cpp
+++ b/content/html/content/src/HTMLSelectElement.cpp
@ -630,7 +630,7 @@ HTMLSelectElement::Add(nsGenericHTMLElement& aElement,
  // Just in case we're not the parent, get the parent of the reference
  // element
  nsINode* parent = aBefore->GetParentNode();
-  if (!nsContentUtils::ContentIsDescendantOf(parent, this)) {
+  if (!parent || !nsContentUtils::ContentIsDescendantOf(parent, this)) {
    // NOT_FOUND_ERR: Raised if before is not a descendant of the SELECT
    // element.
    aError.Throw(NS_ERROR_DOM_NOT_FOUND_ERR);