Merge pull request #554 from MoonchildProductions/issue12

Resolve potential null deref crashes in the editor

2 files changed, 46 insertions, 0 deletions

diff --git a/widget/BasicEvents.h b/widget/BasicEvents.h
index a6228f179..960cb67c6 100644
--- a/widget/BasicEvents.h
+++ b/widget/BasicEvents.h
@@ -161,6 +161,9 @@ public:
   }
   inline void PreventDefault(bool aCalledByDefaultHandler = true)
   {
+    if (!mCancelable) {
+      return;
+    }
     mDefaultPrevented = true;
     // Note that even if preventDefault() has already been called by chrome,
     // a call of preventDefault() by content needs to overwrite
@@ -175,6 +178,9 @@ public:
   // This should be used only before dispatching events into the DOM tree.
   inline void PreventDefaultBeforeDispatch()
   {
+    if (!mCancelable) {
+      return;
+    }
     mDefaultPrevented = true;
   }
   inline bool DefaultPrevented() const
@@ -407,10 +413,16 @@ public:
   nsString mSpecifiedEventTypeString;
 
   // Event targets, needed by DOM Events
+  // Note that when you need event target for DOM event, you should use
+  // Get*DOMEventTarget() instead of accessing these members directly.
   nsCOMPtr<dom::EventTarget> mTarget;
   nsCOMPtr<dom::EventTarget> mCurrentTarget;
   nsCOMPtr<dom::EventTarget> mOriginalTarget;
 
+  dom::EventTarget* GetDOMEventTarget() const;
+  dom::EventTarget* GetCurrentDOMEventTarget() const;
+  dom::EventTarget* GetOriginalDOMEventTarget() const;
+
   void AssignEventData(const WidgetEvent& aEvent, bool aCopyTargets)
   {
     // mClass should be initialized with the constructor.
diff --git a/widget/WidgetEventImpl.cpp b/widget/WidgetEventImpl.cpp
index 7dd292cb0..59c80672b 100644
--- a/widget/WidgetEventImpl.cpp
+++ b/widget/WidgetEventImpl.cpp
@@ -12,6 +12,7 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/TextEvents.h"
 #include "mozilla/TouchEvents.h"
+#include "nsIDOMEventTarget.h"
 #include "nsPrintfCString.h"
 
 namespace mozilla {
@@ -411,6 +412,39 @@ WidgetEvent::IsAllowedToDispatchDOMEvent() const
 }
 
 /******************************************************************************
+ * mozilla::WidgetEvent
+ *
+ * Misc methods.
+ ******************************************************************************/
+
+static dom::EventTarget*
+GetTargetForDOMEvent(nsIDOMEventTarget* aTarget)
+{
+  return aTarget ? aTarget->GetTargetForDOMEvent() : nullptr;
+}
+
+dom::EventTarget*
+WidgetEvent::GetDOMEventTarget() const
+{
+  return GetTargetForDOMEvent(mTarget);
+}
+
+dom::EventTarget*
+WidgetEvent::GetCurrentDOMEventTarget() const
+{
+  return GetTargetForDOMEvent(mCurrentTarget);
+}
+
+dom::EventTarget*
+WidgetEvent::GetOriginalDOMEventTarget() const
+{
+  if (mOriginalTarget) {
+    return GetTargetForDOMEvent(mOriginalTarget);
+  }
+  return GetDOMEventTarget();
+}
+
+/******************************************************************************
  * mozilla::WidgetInputEvent
  ******************************************************************************/