Bug 1076587 - Avoid null deref in HTMLImageElement::AfterSetAttr with…

… <picture> enabled r=bz
Brli · Oct 24, 2014 · 7304a2a · 7304a2a
1 parent 974bf9c
commit 7304a2a
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/content/html/content/src/HTMLImageElement.cpp b/content/html/content/src/HTMLImageElement.cpp
@@ -25,6 +25,7 @@
 #include "nsIDOMWindow.h"
 #include "nsFocusManager.h"
 #include "mozilla/dom/HTMLFormElement.h"
+#include "nsAttrValueOrString.h"
 
 // Responsive images!
 #include "mozilla/dom/HTMLSourceElement.h"
@@ -367,15 +368,16 @@ HTMLImageElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
   // attributes have been set, so we'll do the image load from BindToTree.
 
   nsCOMPtr<nsIContent> thisContent = AsContent();
+  nsAttrValueOrString attrVal(aValue);
+
   if (aName == nsGkAtoms::src &&
       aNameSpaceID == kNameSpaceID_None) {
     // SetAttr handles setting src in the non-responsive case, so only handle it
     // for responsive mode or unsetting
     if (!aValue) {
       CancelImageRequests(aNotify);
     } else if (mResponsiveSelector) {
-      mResponsiveSelector->SetDefaultSource(aValue ? aValue->GetStringValue()
-                                                   : EmptyString());
+      mResponsiveSelector->SetDefaultSource(attrVal.String());
       LoadSelectedImage(false, aNotify);
     }
   } else if (aName == nsGkAtoms::srcset &&
@@ -384,14 +386,12 @@ HTMLImageElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
              AsContent()->IsInDoc() &&
              IsSrcsetEnabled()) {
     // We currently don't handle responsive mode until BindToTree
-    PictureSourceSrcsetChanged(thisContent,
-                               aValue ? aValue->GetStringValue() : EmptyString(),
-                               aNotify);
+    PictureSourceSrcsetChanged(thisContent, attrVal.String(), aNotify);
   } else if (aName == nsGkAtoms::sizes &&
              aNameSpaceID == kNameSpaceID_None &&
              thisContent->IsInDoc() &&
              HTMLPictureElement::IsPictureEnabled()) {
-    PictureSourceSizesChanged(thisContent, aValue->GetStringValue(), aNotify);
+    PictureSourceSizesChanged(thisContent, attrVal.String(), aNotify);
   } else if (aName == nsGkAtoms::crossorigin &&
              aNameSpaceID == kNameSpaceID_None &&
              aNotify) {