Bug 865147 - Fix crash in nsContentUtils::ContentIsDescendantOf by checking parent of 'before' node, r=bz, feedback=Ms2ger

gijsk · gijsk · commit e73272c17f7f · 2013-04-24T13:05:59.000+02:00
diff --git a/content/html/content/crashtests/865147.html b/content/html/content/crashtests/865147.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select")[0];
+var newOpt = document.createElement("option");
+select.add(newOpt, newOpt);
+</script>
diff --git a/content/html/content/crashtests/crashtests.list b/content/html/content/crashtests/crashtests.list
@@ -51,3 +51,4 @@ load 832011.html
 load 837033.html
 pref(dom.experimental_forms_range,true) load 838256-1.html
 load 862084.html
+load 865147.html
diff --git a/content/html/content/src/HTMLSelectElement.cpp b/content/html/content/src/HTMLSelectElement.cpp
@@ -630,7 +630,7 @@ HTMLSelectElement::Add(nsGenericHTMLElement& aElement,
   // Just in case we're not the parent, get the parent of the reference
   // element
   nsINode* parent = aBefore->GetParentNode();
-  if (!nsContentUtils::ContentIsDescendantOf(parent, this)) {
+  if (!parent || !nsContentUtils::ContentIsDescendantOf(parent, this)) {
     // NOT_FOUND_ERR: Raised if before is not a descendant of the SELECT
     // element.
     aError.Throw(NS_ERROR_DOM_NOT_FOUND_ERR);
