[Bug 39028] Built-in iexplore crashes when opening forum/blog entries on hup.hu (crash in get_frame_by_name("yterr")

https://bugs.winehq.org/show_bug.cgi?id=39028

Indrek  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Indrek  ---
After some digging, it seems that the issue/feature lies withing Gecko
codebase.

Wine code on line 380 in mshtml/htmlwindow.c is:
    nsres = nsIDOMWindow_GetFrames(This->nswindow, &nsframes);
    if(NS_FAILED(nsres)) {
        FIXME("nsIDOMWindow_GetFrames failed: 0x%08x\n", nsres);
        return E_FAIL;
    }

When viewing Gecko source code from
https://github.com/mozilla/gecko-dev/blob/b6ea902b969546b6ae6c2d43e68b193bfb...
on line 4129 the source of that function is:
NS_IMETHODIMP
nsGlobalWindow::GetFrames(nsIDOMWindowCollection** aFrames)
{
  FORWARD_TO_OUTER(GetFrames, (aFrames), NS_ERROR_NOT_INITIALIZED);

*aFrames = GetWindowList();
  NS_IF_ADDREF(*aFrames);
  return NS_OK;
}

The definition of GetWindowList is in the same file (right before GetFrames):
nsDOMWindowList*
nsGlobalWindow::GetWindowList()
{
  MOZ_ASSERT(IsOuterWindow());

if (!mFrames && mDocShell) {
    mFrames = new nsDOMWindowList(mDocShell);
  }

return mFrames;
}

So as seen, there exists a chance that when mDocShell is NULL the GetWindowList
will return also NULL (will not return any error codes).

When viewing the same file for usage of GetWindowList() there seem to be NULL
checks for it in Gecko source:
void
nsGlobalWindow::GetSupportedNames(nsTArray<nsString>& aNames)
{
  FORWARD_TO_OUTER_VOID(GetSupportedNames, (aNames));

nsDOMWindowList* windows = GetWindowList();
  if (windows) {
...

nsDOMWindowList* windows = GetWindowList();
  NS_ENSURE_TRUE(windows, nullptr);
...

So all of it put together, to behave more like Gecko in this manner, Wine
should also check for NULL nsframes.