Bug 473284 - Crash when calling advanceFocusIntoSubtree({}), r+sr=mats

dom/src/base/crashtests/473284.xul

@@ -0,0 +1,93 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+         class="reftest-wait"
+onload="
+var result = '';
+try {
+  document.commandDispatcher.advanceFocusIntoSubtree({});
+  result += '1';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.advanceFocusIntoSubtree(document.documentElement);
+  result += '2';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.advanceFocusIntoSubtree(null);
+  result += '3';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedElement = {};
+  result += '4';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedElement = document.documentElement;
+  result += '5';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedElement = null;
+  result += '6';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.popupNode = {};
+  result += '7';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.popupNode = document.documentElement;
+  result += '8';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.popupNode = null;
+  result += '9';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedWindow = {};
+  result += 'a';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedWindow = null;
+  result += 'b';
+} catch (ex) {
+  result += '.';
+}
+
+try {
+  document.commandDispatcher.focusedWindow = window;
+  result += 'c';
+} catch (ex) {
+  result += '.';
+}
+
+document.documentElement.textContent = result == '.23.56.89abc' ? 'PASSED' : 'FAILED';
+if (document.documentElement.textContent == 'PASSED') {
+  document.documentElement.removeAttribute('class');
+}
+"/>

dom/src/base/crashtests/crashtests.list

@@ -12,3 +12,4 @@ load 372554-1.html
 load 404869-1.xul
 load 462947.html
 load 439206-1.html
+load 473284.xul

dom/src/base/nsFocusController.cpp

@@ -143,6 +143,10 @@ nsFocusController::GetFocusedWindow(nsIDOMWindowInternal** aWindow)
 NS_IMETHODIMP
 nsFocusController::SetFocusedElement(nsIDOMElement* aElement)
 {
+  if (aElement) {
+    nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
+    NS_ENSURE_ARG(content);
+  }
   if (mCurrentElement) 
     mPreviousElement = mCurrentElement;
   else if (aElement) 
@@ -294,6 +298,7 @@ nsFocusController::MoveFocus(PRBool aForward, nsIDOMElement* aElt)
   nsCOMPtr<nsIContent> content;
   if (aElt) {
     content = do_QueryInterface(aElt);
+    NS_ENSURE_ARG(content);
     doc = content->GetDocument();
   }
   else {
@@ -613,6 +618,10 @@ nsFocusController::SetPopupNode(nsIDOMNode* aNode)
   printf("dr :: nsFocusController::SetPopupNode\n");
 #endif
 
+  if (aNode) {
+    nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+    NS_ENSURE_ARG(node);
+  }
   mPopupNode = aNode;
   return NS_OK;
 }