Bug 536931. Check whether we found a content node before trying to get its primary frame. r=dbaron

2009-12-28 14:47:27 -05:00 · 2009-12-28 14:47:27 -05:00 · c4cf269ebe
--- a/layout/xul/base/src/crashtests/536931-1.xhtml
+++ b/layout/xul/base/src/crashtests/536931-1.xhtml
@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<listbox id="listbox" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><tab/></listbox>
+<script>window.addEventListener("load", function() { document.documentElement.appendChild(document.getElementById("listbox")); }, false);</script>
+</html>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@ -67,3 +67,4 @@ load 488210-1.xhtml
 load 495728-1.xul
 load 508927-1.xul
 load 508927-2.xul
+load 536931-1.xhtml
--- a/layout/xul/base/src/nsListBoxObject.cpp
+++ b/layout/xul/base/src/nsListBoxObject.cpp
@ -202,6 +202,9 @@ nsListBoxObject::GetListBoxBody(PRBool aFlush)
  nsCOMPtr<nsIContent> content;
  FindBodyContent(frame->GetContent(), getter_AddRefs(content));

+  if (!content)
+    return nsnull;
+
  // this frame will be a nsGFXScrollFrame
  frame = content->GetPrimaryFrame();
  if (!frame)