From 838be2614562ab8532b864cb1b55fcc06afad5c5 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 30 Jul 2025 09:29:26 +0200
Subject: [PATCH] [DOM] Fix crash in `<object>` scheme checking code.

If a website would nor supply a URI for object loading code, the browser
would crash on a null deref.
This reintroduces the nestedURI check to make sure we have a valid URI.
---
 dom/base/nsObjectLoadingContent.cpp | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index 80d923c142..aa179eba88 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -2326,16 +2326,19 @@ nsObjectLoadingContent::LoadObject(bool aNotify,
   // if the scheme of `mURI` is one that would return a network error. The
   // following schemes are allowed through in scheme fetch:
   // "about", "blob", "data", "file", "http", "https".
-  // XXXMC: Should we include "ftp" as well?
   //
   // Some accessibility tests use our internal "chrome" scheme.
   if (mType != eType_Null) {
+    nsCOMPtr<nsIURI> tempURI = mURI;
+    nsCOMPtr<nsINestedURI> nestedURI = do_QueryInterface(tempURI);
     bool isCandidate = false;
-    for (const auto& candidate :
-         {"about", "blob", "chrome", "data", "file", "http", "https"}) {
-      rv = mURI->SchemeIs(candidate, &isCandidate);
-      if (NS_SUCCEEDED(rv) && isCandidate) {
-        break;
+    if (nestedURI) {
+      for (const auto& candidate :
+           {"about", "blob", "chrome", "data", "file", "http", "https"}) {
+        rv = tempURI->SchemeIs(candidate, &isCandidate);
+        if (NS_SUCCEEDED(rv) && isCandidate) {
+          break;
+        }
       }
     }
     if (!isCandidate) {