summary refs log tree commit diff
path: root/gnu/packages/patches/icecat-CVE-2016-1961.patch
blob: 10162be24b2b92593bc7e10d02e654fe0a646a3c (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/e93aeb25e2a4

# HG changeset patch
# User Andrew McCreight <continuation@gmail.com>
# Date 1455891967 28800
# Node ID e93aeb25e2a44df8d22f5a065b4410620e2c8730
# Parent  221de852fda32714a9e484774ceafafb450ea73c
Bug 1249377 - Hold a strong reference to |root| in nsHTMLDocument::SetBody. r=bz, a=sylvestre

diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -1044,17 +1044,17 @@ nsHTMLDocument::SetBody(nsIDOMHTMLElemen
   ErrorResult rv;
   SetBody(static_cast<nsGenericHTMLElement*>(newBody.get()), rv);
   return rv.ErrorCode();
 }
 
 void
 nsHTMLDocument::SetBody(nsGenericHTMLElement* newBody, ErrorResult& rv)
 {
-  Element* root = GetRootElement();
+  nsCOMPtr<Element> root = GetRootElement();
 
   // The body element must be either a body tag or a frameset tag. And we must
   // have a html root tag, otherwise GetBody will not return the newly set
   // body.
   if (!newBody || !(newBody->Tag() == nsGkAtoms::body ||
                     newBody->Tag() == nsGkAtoms::frameset) ||
       !root || !root->IsHTML() ||
       root->Tag() != nsGkAtoms::html) {