Bug 675492 - Null-check base URI in nsScriptableUnescapeHTML::ParseFragment in the HTML case. r=bzbarsky.

toolkit/components/feeds/Makefile.in

@@ -42,6 +42,10 @@ VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
+ifdef ENABLE_TESTS
+TOOL_DIRS += test
+endif
+
 MODULE = feeds
 LIBRARY_NAME = feed_s
 MOZILLA_INTERNAL_API = 1

toolkit/components/feeds/nsScriptableUnescapeHTML.cpp

@@ -188,19 +188,21 @@ nsScriptableUnescapeHTML::ParseFragment(const nsAString &aFragment,
                                         PR_FALSE,
                                         PR_TRUE);
       // Now, set the base URI on all subtree roots.
-      aBaseURI->GetSpec(spec);
+      if (aBaseURI) {
-      nsAutoString spec16;
+        aBaseURI->GetSpec(spec);
-      CopyUTF8toUTF16(spec, spec16);
+        nsAutoString spec16;
-      nsIContent* node = fragment->GetFirstChild();
+        CopyUTF8toUTF16(spec, spec16);
-      while (node) {
+        nsIContent* node = fragment->GetFirstChild();
-        if (node->IsElement()) {
+        while (node) {
-          node->SetAttr(kNameSpaceID_XML,
+          if (node->IsElement()) {
-                        nsGkAtoms::base,
+            node->SetAttr(kNameSpaceID_XML,
-                        nsGkAtoms::xml,
+                          nsGkAtoms::base,
-                        spec16,
+                          nsGkAtoms::xml,
-                        PR_FALSE);
+                          spec16,
+                          PR_FALSE);
+          }
+          node = node->GetNextSibling();
         }
-        node = node->GetNextSibling();
       }
     }
     if (fragment) {

toolkit/components/feeds/test/Makefile.in

@@ -0,0 +1,52 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Mozilla Foundation.
+# Portions created by the Initial Developer are Copyright (C) 2009
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = toolkit/components/feeds/test
+
+include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES = \
+		test_bug675492.xul    \
+		$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)

toolkit/components/feeds/test/test_bug675492.xul

@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=675492
+-->
+<window title="Mozilla Bug 675492"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/chrome-harness.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=675492"
+     target="_blank">Mozilla Bug 675492</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for Bug 675492 **/
+
+  Components
+    .classes["@mozilla.org/feed-unescapehtml;1"]
+    .getService(Components.interfaces.nsIScriptableUnescapeHTML)
+    .parseFragment("<p>test</p>", false, null, document.createElementNS("http://www.w3.org/1999/xhtml", "body"));
+  ok(true, "No crash!");
+  ]]>
+  </script>
+</window>