From 86a9bda1976a64583945ff5593f28426a4cf730e Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 17 Feb 2009 12:23:35 +0200
Subject: [PATCH]  Bug 473284 -  Crash when calling
 advanceFocusIntoSubtree({}), r+sr=mats

---
 dom/src/base/crashtests/473284.xul      | 93 +++++++++++++++++++++++++
 dom/src/base/crashtests/crashtests.list |  1 +
 dom/src/base/nsFocusController.cpp      |  9 +++
 3 files changed, 103 insertions(+)
 create mode 100644 dom/src/base/crashtests/473284.xul

diff --git a/dom/src/base/crashtests/473284.xul b/dom/src/base/crashtests/473284.xul
new file mode 100644
index 000000000000..233e51a25814
--- /dev/null
+++ b/dom/src/base/crashtests/473284.xul
@@ -0,0 +1,93 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+         class="reftest-wait"
+onload="
+var result = '';
+try {
+  document.commandDispatcher.advanceFocusIntoSubtree({});
+  result += '1';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.advanceFocusIntoSubtree(document.documentElement);
+  result += '2';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.advanceFocusIntoSubtree(null);
+  result += '3';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedElement = {};
+  result += '4';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedElement = document.documentElement;
+  result += '5';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedElement = null;
+  result += '6';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.popupNode = {};
+  result += '7';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.popupNode = document.documentElement;
+  result += '8';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.popupNode = null;
+  result += '9';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedWindow = {};
+  result += 'a';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedWindow = null;
+  result += 'b';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedWindow = window;
+  result += 'c';
+} catch (ex) {
+  result += '.';
+}
+
+document.documentElement.textContent = result == '.23.56.89abc' ? 'PASSED' : 'FAILED';
+if (document.documentElement.textContent == 'PASSED') {
+  document.documentElement.removeAttribute('class');
+}
+"/>
diff --git a/dom/src/base/crashtests/crashtests.list b/dom/src/base/crashtests/crashtests.list
index 945b3b500751..d753f18d7fee 100644
--- a/dom/src/base/crashtests/crashtests.list
+++ b/dom/src/base/crashtests/crashtests.list
@@ -12,3 +12,4 @@ load 372554-1.html
 load 404869-1.xul
 load 462947.html
 load 439206-1.html
+load 473284.xul
diff --git a/dom/src/base/nsFocusController.cpp b/dom/src/base/nsFocusController.cpp
index 4535e8fa0afc..19c3c77e5ea0 100644
--- a/dom/src/base/nsFocusController.cpp
+++ b/dom/src/base/nsFocusController.cpp
@@ -143,6 +143,10 @@ nsFocusController::GetFocusedWindow(nsIDOMWindowInternal** aWindow)
 NS_IMETHODIMP
 nsFocusController::SetFocusedElement(nsIDOMElement* aElement)
 {
+  if (aElement) {
+    nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
+    NS_ENSURE_ARG(content);
+  }
   if (mCurrentElement) 
     mPreviousElement = mCurrentElement;
   else if (aElement) 
@@ -294,6 +298,7 @@ nsFocusController::MoveFocus(PRBool aForward, nsIDOMElement* aElt)
   nsCOMPtr<nsIContent> content;
   if (aElt) {
     content = do_QueryInterface(aElt);
+    NS_ENSURE_ARG(content);
     doc = content->GetDocument();
   }
   else {
@@ -613,6 +618,10 @@ nsFocusController::SetPopupNode(nsIDOMNode* aNode)
   printf("dr :: nsFocusController::SetPopupNode\n");
 #endif
 
+  if (aNode) {
+    nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+    NS_ENSURE_ARG(node);
+  }
   mPopupNode = aNode;
   return NS_OK;
 }