From 90bc12cbe001c7fe34f3a55209c277ea4e323542 Mon Sep 17 00:00:00 2001
From: Heather Arthur <fayearthur@gmail.com>
Date: Wed, 9 May 2012 17:23:57 +0100
Subject: [PATCH] Bug 750556 - crash in
 mozilla::dom::Element::ClearStyleStateLocks; r=bz

---
 layout/inspector/src/inDOMUtils.cpp           | 28 +++++++++----------
 .../inspector/tests/chrome/test_bug708874.xul | 17 +++++++++--
 2 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/layout/inspector/src/inDOMUtils.cpp b/layout/inspector/src/inDOMUtils.cpp
index 46028b01c2cd..d0533937bd12 100644
--- a/layout/inspector/src/inDOMUtils.cpp
+++ b/layout/inspector/src/inDOMUtils.cpp
@@ -138,11 +138,11 @@ inDOMUtils::GetParentForNode(nsIDOMNode* aNode,
       if (bindingManager) {
         bparent = bindingManager->GetInsertionParent(content);
       }
-    
+
       parent = do_QueryInterface(bparent);
     }
   }
-  
+
   if (!parent) {
     // Ok, just get the normal DOM parent node
     aNode->GetParentNode(getter_AddRefs(parent));
@@ -262,7 +262,7 @@ inDOMUtils::IsInheritedProperty(const nsAString &aPropertyName, bool *_retval)
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 inDOMUtils::GetBindingURLs(nsIDOMElement *aElement, nsIArray **_retval)
 {
   NS_ENSURE_ARG_POINTER(aElement);
@@ -292,15 +292,15 @@ NS_IMETHODIMP
 inDOMUtils::SetContentState(nsIDOMElement *aElement, nsEventStates::InternalType aState)
 {
   NS_ENSURE_ARG_POINTER(aElement);
-  
+
   nsRefPtr<nsEventStateManager> esm = inLayoutUtils::GetEventStateManagerFor(aElement);
   if (esm) {
     nsCOMPtr<nsIContent> content;
     content = do_QueryInterface(aElement);
-  
+
     return esm->SetContentState(content, nsEventStates(aState));
   }
-  
+
   return NS_ERROR_FAILURE;
 }
 
@@ -398,14 +398,14 @@ NS_IMETHODIMP
 inDOMUtils::AddPseudoClassLock(nsIDOMElement *aElement,
                                const nsAString &aPseudoClass)
 {
-  NS_ENSURE_ARG_POINTER(aElement);
-
   nsEventStates state = GetStatesForPseudoClass(aPseudoClass);
   if (state.IsEmpty()) {
     return NS_OK;
   }
 
   nsCOMPtr<mozilla::dom::Element> element = do_QueryInterface(aElement);
+  NS_ENSURE_ARG_POINTER(element);
+
   element->LockStyleStates(state);
 
   return NS_OK;
@@ -415,14 +415,14 @@ NS_IMETHODIMP
 inDOMUtils::RemovePseudoClassLock(nsIDOMElement *aElement,
                                   const nsAString &aPseudoClass)
 {
-  NS_ENSURE_ARG_POINTER(aElement);
-
   nsEventStates state = GetStatesForPseudoClass(aPseudoClass);
   if (state.IsEmpty()) {
     return NS_OK;
   }
 
   nsCOMPtr<mozilla::dom::Element> element = do_QueryInterface(aElement);
+  NS_ENSURE_ARG_POINTER(element);
+
   element->UnlockStyleStates(state);
 
   return NS_OK;
@@ -433,8 +433,6 @@ inDOMUtils::HasPseudoClassLock(nsIDOMElement *aElement,
                                const nsAString &aPseudoClass,
                                bool *_retval)
 {
-  NS_ENSURE_ARG_POINTER(aElement);
-
   nsEventStates state = GetStatesForPseudoClass(aPseudoClass);
   if (state.IsEmpty()) {
     *_retval = false;
@@ -442,6 +440,8 @@ inDOMUtils::HasPseudoClassLock(nsIDOMElement *aElement,
   }
 
   nsCOMPtr<mozilla::dom::Element> element = do_QueryInterface(aElement);
+  NS_ENSURE_ARG_POINTER(element);
+
   nsEventStates locks = element->LockedStyleStates();
 
   *_retval = locks.HasAllStates(state);
@@ -451,9 +451,9 @@ inDOMUtils::HasPseudoClassLock(nsIDOMElement *aElement,
 NS_IMETHODIMP
 inDOMUtils::ClearPseudoClassLocks(nsIDOMElement *aElement)
 {
-  NS_ENSURE_ARG_POINTER(aElement);
-
   nsCOMPtr<mozilla::dom::Element> element = do_QueryInterface(aElement);
+  NS_ENSURE_ARG_POINTER(element);
+
   element->ClearStyleStateLocks();
 
   return NS_OK;
diff --git a/layout/inspector/tests/chrome/test_bug708874.xul b/layout/inspector/tests/chrome/test_bug708874.xul
index faac9b6d480b..331b8d1872d7 100644
--- a/layout/inspector/tests/chrome/test_bug708874.xul
+++ b/layout/inspector/tests/chrome/test_bug708874.xul
@@ -28,6 +28,7 @@ function RunTests() {
   testVisited();
   testMultiple();
   testInvalid();
+  testNotElement();
 }
 
 function testLockEnabled() {
@@ -118,7 +119,7 @@ function testLockDisabled() {
 
   /* change state to enabled */
   button.removeAttribute("disabled");
-  
+
   is(window.getComputedStyle(button).color, disabledColor,
      ":disabled style applied after enabling");
 
@@ -256,7 +257,19 @@ function testInvalid() {
   }
 }
 
-
+function testNotElement() {
+  var values = [null, undefined, {}];
+  try {
+    for each (value in values); {
+      DOMUtils.hasPseudoClassLock(value, ":hover");
+      DOMUtils.addPseudoClassLock(value, ":hover");
+      DOMUtils.removePseudoClassLock(value, ":hover");
+      DOMUtils.clearPseudoClassLocks(value);
+    }
+  } catch(e) {
+    // just make sure we don't crash on non-elements
+  }
+}
   ]]>
   </script>