Bug 682637: Restore null-check that got lost in the event handler IDLification. r=bz

2011-08-28 05:58:43 -04:00 · 2011-08-28 05:58:43 -04:00 · eb6771d0fd
--- a/content/events/crashtests/682637-1.html
+++ b/content/events/crashtests/682637-1.html
@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("f");
+  var frameWin = frame.contentWindow;
+  frame.parentNode.removeChild(frame);
+  frameWin.onmouseover = function(){};
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:text/html,1"></iframe>
+</body>
+
+</html>
--- a/content/events/crashtests/crashtests.list
+++ b/content/events/crashtests/crashtests.list
@ -4,5 +4,6 @@ load 135345-1.html
 load 422009-1.xhtml
 load 457776-1.html
 load 496308-1.html
+load 682637-1.html
 load recursive-onload.html
 load recursive-DOMNodeInserted.html
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@ -943,7 +943,11 @@ nsEventListenerManager::SetJSEventListenerToJsval(nsIAtom *aEventName,
    return NS_OK;
  }

+  // We might not have a script context, e.g. if we're setting a listener
+  // on a dead Window.
  nsIScriptContext *context = nsJSUtils::GetStaticScriptContext(cx, aScope);
+  NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
+
  JSObject *scope = ::JS_GetGlobalForObject(cx, aScope);
  // Untrusted events are always permitted for non-chrome script
  // handlers.