Reviewed by NOBODY (OOPS!).

	- fixed <rdar://problem/3567047>: REGRESSION: repro crash inside KJS (dispatchToBoolean) at www.thedonnas.com
	- fixed <rdar://problem/3550461>: REGRESSION: repro crash in JavaScript at www.alaska.com

	* khtml/ecma/kjs_window.cpp:
        (Window::getListener): Return Null() when the listener object is
	null, indicating the code failed to parse. Otherwise we return a
	bad value which can later crash the JS interpreter.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@6140 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 6e14e382c7512c821c4a12abb147d64c9166a42e..47193a06cefdbb7fbf89d98a45fb6ee10c90584c 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,15 @@
+2004-03-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+       - fixed <rdar://problem/3567047>: REGRESSION: repro crash inside KJS (dispatchToBoolean) at www.thedonnas.com
+       - fixed <rdar://problem/3550461>: REGRESSION: repro crash in JavaScript at www.alaska.com
+        
+       * khtml/ecma/kjs_window.cpp:
+        (Window::getListener): Return Null() when the listener object is
+       null, indicating the code failed to parse. Otherwise we return a
+       bad value which can later crash the JS interpreter.
+
 2004-03-01  Darin Adler  <darin@apple.com>
 
         Reviewed by Vicki.

diff --git a/WebCore/khtml/ecma/kjs_window.cpp b/WebCore/khtml/ecma/kjs_window.cpp
index dad8e886cd0ff5b8b2883fbde8e81f78f9a63676..b06bc3c7d4e724844721862b65ad08beae3f023c 100644 (file)
--- a/WebCore/khtml/ecma/kjs_window.cpp
+++ b/WebCore/khtml/ecma/kjs_window.cpp
@@ -1046,7 +1046,7 @@ Value Window::getListener(ExecState *exec, int eventId) const
     return Undefined();
 
   DOM::EventListener *listener = doc->getHTMLWindowEventListener(eventId);
-  if (listener)
+  if (listener && static_cast<JSEventListener*>(listener)->listenerObjImp())
     return static_cast<JSEventListener*>(listener)->listenerObj();
   else
     return Null();