Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-01 05:48:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Work around crashes at ChildIterator::get using bounds check on ChildIterator::seek. sr=waterson r=kin a=asa b=133219

Browse Source
This commit is contained in:
dbaron%fas.harvard.edu 2002-07-16 14:53:43 +00:00
parent 17bc6e66e4
commit 020c118cfd
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
layout/base/nsChildIterator.h
View File

@ -125,8 +125,9 @@ public:
}
void seek(PRUint32 aIndex) {
#ifdef DEBUG
// Make sure that aIndex is reasonable
// Make sure that aIndex is reasonable. This should be |#ifdef
// DEBUG|, but we need these numbers for the temporary workaround
// for bug 133219.
PRUint32 length;
if (mNodes)
mNodes->GetLength(&length);
@ -134,7 +135,10 @@ public:
mContent->ChildCount(NS_REINTERPRET_CAST(PRInt32&, length));
NS_ASSERTION(PRInt32(aIndex) >= 0 && aIndex <= length, "out of bounds");
#endif
// Temporary workaround for bug 133219.
if (aIndex > length)
aIndex = length;
mIndex = aIndex;
}

10
layout/html/style/src/nsChildIterator.h
View File

@ -125,8 +125,9 @@ public:
}
void seek(PRUint32 aIndex) {
#ifdef DEBUG
// Make sure that aIndex is reasonable
// Make sure that aIndex is reasonable. This should be |#ifdef
// DEBUG|, but we need these numbers for the temporary workaround
// for bug 133219.
PRUint32 length;
if (mNodes)
mNodes->GetLength(&length);
@ -134,7 +135,10 @@ public:
mContent->ChildCount(NS_REINTERPRET_CAST(PRInt32&, length));
NS_ASSERTION(PRInt32(aIndex) >= 0 && aIndex <= length, "out of bounds");
#endif
// Temporary workaround for bug 133219.
if (aIndex > length)
aIndex = length;
mIndex = aIndex;
}