Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-12 10:40:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 745495 - Fix crash when using screen object from removed iframe. r=smaug

Browse Source
This commit is contained in:
Mounir Lamouri 2012-04-16 11:33:35 +02:00
parent 69fa524c1a
commit e9d72e0353
3 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
dom/base/crashtests/745495.html Normal file
View File

@ -0,0 +1,19 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
document.body.appendChild(frame);
var frameScreen = frame.contentWindow.screen;
document.body.removeChild(frame);
frameScreen.top;
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
dom/base/crashtests/crashtests.list
View File

@ -37,3 +37,4 @@ load 695867.html
load 697643.html
load 706283-1.html
load 708405-1.html
load 745495.html

4
layout/base/nsLayoutUtils.cpp
View File

@ -3991,6 +3991,10 @@ nsLayoutUtils::GetRectDifferenceStrips(const nsRect& aR1, const nsRect& aR2,
nsDeviceContext*
nsLayoutUtils::GetDeviceContextForScreenInfo(nsPIDOMWindow* aWindow)
{
if (!aWindow) {
return nsnull;
}
nsCOMPtr<nsIDocShell> docShell = aWindow->GetDocShell();
while (docShell) {
// Now make sure our size is up to date. That will mean that the device