corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 531106 - Crash in [@ nsHtml5Parser::DropStreamParser] triggered by Softpedia framebreaker. r=bnewman.

Browse Source
This commit is contained in:
Henri Sivonen
2009-11-30 17:34:51 +02:00
parent 32f9911ea1
commit 4ef7383445
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
parser/html/nsHtml5TreeOpExecutor.cpp
View File

@@ -113,13 +113,19 @@ nsHtml5TreeOpExecutor::DidBuildModel(PRBool aTerminated)
return NS_OK;
}
static_cast<nsHtml5Parser*> (mParser.get())->DropStreamParser();
// This is comes from nsXMLContentSink
DidBuildModelImpl(aTerminated);
mDocument->ScriptLoader()->RemoveObserver(this);
ScrollToRef();
mDocument->RemoveObserver(this);
if (!mParser) {
// DidBuildModelImpl may cause mParser to be nulled out
// Return early to avoid unblocking the onload event too many times.
return NS_OK;
}
mDocument->EndLoad();
static_cast<nsHtml5Parser*> (mParser.get())->DropStreamParser();
DropParserAndPerfHint();
#ifdef GATHER_DOCWRITE_STATISTICS
printf("UNSAFE SCRIPTS: %d\n", sUnsafeDocWrites);