234331 - [FIXr]Mozilla crashes if document.getBoxObjectFor() is called with an undefined parameter

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Wladimir Palant]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040211

There is some problem with the parameter check in document.getBoxObjectFor(),
Mozilla crashes when getBoxObjectFor() is called with an undefined value as a
parameter. That's what Windows XP shows about the crash: 

AppName: mozilla.exe	 AppVer: 1.7.20040.21109	 ModName: gklayout.dll
ModVer: 1.7.20040.21109	 Offset: 00118b23

The Incident ID is TB30286417Y (produced with Mozilla 1.4 Build 2003062408 -
somehow I can't make the feedback agent work with the newer releases).

Reproducible: Always
Steps to Reproduce:
1. Open the JavaScript URL
Actual Results:  
The browser crashes

Comment 1

[Wladimir Palant]

Ok, it doesn't have to be undefined, can be null as well (I suppose it is both
converted into NULL in C++ code). The following two function calls produce a
crash as well:

document.addBinding(null,'')
document.removeBinding(null,'')

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Null-checks

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 141408 [details] [diff] [review]
Null-checks

r+sr=jst

Comment 4

[Boris Zbarsky [:bzbarsky]]

Fix checked in for 1.7b