Bug 646184 - Crash [@ nsGlobalWindow::GetLocalStorage] getting localStorage from removed frame; r=bz

This commit is contained in:
Ms2ger 2011-04-22 10:38:33 +02:00
parent ce2f8b6028
commit 4491925359
3 changed files with 25 additions and 3 deletions

View File

@ -0,0 +1,17 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var f = document.getElementById("f");
var w = f.contentWindow;
f.parentNode.removeChild(f);
w.localStorage;
}
</script>
</head>
<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body>
</html>

View File

@ -86,6 +86,7 @@ load 593302-2.html
load 610571-1.html load 610571-1.html
load 604262-1.html load 604262-1.html
load 628599-1.html load 628599-1.html
load 642022-1.html
load 637214-1.svg load 637214-1.svg
load 637214-2.svg load 637214-2.svg
load 642022-1.html
asserts(1) load 646184.html # Bug 651842

View File

@ -8044,7 +8044,9 @@ nsGlobalWindow::GetSessionStorage(nsIDOMStorage ** aSessionStorage)
*aSessionStorage = nsnull; *aSessionStorage = nsnull;
nsString documentURI; nsString documentURI;
mDocument->GetDocumentURI(documentURI); if (mDocument) {
mDocument->GetDocumentURI(documentURI);
}
nsresult rv = docShell->GetSessionStorageForPrincipal(principal, nsresult rv = docShell->GetSessionStorageForPrincipal(principal,
documentURI, documentURI,
@ -8128,7 +8130,9 @@ nsGlobalWindow::GetLocalStorage(nsIDOMStorage ** aLocalStorage)
NS_ENSURE_SUCCESS(rv, rv); NS_ENSURE_SUCCESS(rv, rv);
nsString documentURI; nsString documentURI;
mDocument->GetDocumentURI(documentURI); if (mDocument) {
mDocument->GetDocumentURI(documentURI);
}
rv = storageManager->GetLocalStorageForPrincipal(principal, rv = storageManager->GetLocalStorageForPrincipal(principal,
documentURI, documentURI,