Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-12 04:45:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Flatten before ever reaching CheckCycle, since the way things currently are, it could receive lists of arbitrary length. bug 328769, r=brendan

Browse Source
This commit is contained in:
mrbkap%gmail.com 2006-02-27 20:33:56 +00:00
parent 4500ca30ad
commit 09b149ed2f
1 changed files with 3 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/src/jsxml.c
View File

@ -3592,11 +3592,7 @@ Replace(JSContext *cx, JSXML *xml, jsval id, jsval v);
static JSBool
CheckCycle(JSContext *cx, JSXML *xml, JSXML *kid)
{
if (kid->xml_class == JSXML_CLASS_LIST) {
JS_ASSERT(kid->xml_kids.length <= 1);
if (kid->xml_kids.length != 0)
kid = XMLARRAY_MEMBER(&kid->xml_kids, 0, JSXML);
}
JS_ASSERT(kid->xml_class != JSXML_CLASS_LIST);
do {
if (xml == kid) {
@ -3631,8 +3627,6 @@ Insert(JSContext *cx, JSXML *xml, jsval id, jsval v)
vobj = JSVAL_TO_OBJECT(v);
if (OBJECT_IS_XML(cx, vobj)) {
vxml = (JSXML *) JS_GetPrivate(cx, vobj);
if (!CheckCycle(cx, xml, vxml))
return JS_FALSE;
if (vxml->xml_class == JSXML_CLASS_LIST)
n = vxml->xml_kids.length;
}
@ -3647,6 +3641,8 @@ Insert(JSContext *cx, JSXML *xml, jsval id, jsval v)
if (vxml && vxml->xml_class == JSXML_CLASS_LIST) {
for (j = 0; j < n; j++) {
kid = XMLARRAY_MEMBER(&vxml->xml_kids, j, JSXML);
if (!CheckCycle(cx, xml, kid))
return JS_FALSE;
kid->parent = xml;
XMLARRAY_SET_MEMBER(&xml->xml_kids, i + j, kid);