mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-12 04:45:45 +00:00
Flatten before ever reaching CheckCycle, since the way things currently are, it could receive lists of arbitrary length. bug 328769, r=brendan
This commit is contained in:
parent
4500ca30ad
commit
09b149ed2f
@ -3592,11 +3592,7 @@ Replace(JSContext *cx, JSXML *xml, jsval id, jsval v);
|
|||||||
static JSBool
|
static JSBool
|
||||||
CheckCycle(JSContext *cx, JSXML *xml, JSXML *kid)
|
CheckCycle(JSContext *cx, JSXML *xml, JSXML *kid)
|
||||||
{
|
{
|
||||||
if (kid->xml_class == JSXML_CLASS_LIST) {
|
JS_ASSERT(kid->xml_class != JSXML_CLASS_LIST);
|
||||||
JS_ASSERT(kid->xml_kids.length <= 1);
|
|
||||||
if (kid->xml_kids.length != 0)
|
|
||||||
kid = XMLARRAY_MEMBER(&kid->xml_kids, 0, JSXML);
|
|
||||||
}
|
|
||||||
|
|
||||||
do {
|
do {
|
||||||
if (xml == kid) {
|
if (xml == kid) {
|
||||||
@ -3631,8 +3627,6 @@ Insert(JSContext *cx, JSXML *xml, jsval id, jsval v)
|
|||||||
vobj = JSVAL_TO_OBJECT(v);
|
vobj = JSVAL_TO_OBJECT(v);
|
||||||
if (OBJECT_IS_XML(cx, vobj)) {
|
if (OBJECT_IS_XML(cx, vobj)) {
|
||||||
vxml = (JSXML *) JS_GetPrivate(cx, vobj);
|
vxml = (JSXML *) JS_GetPrivate(cx, vobj);
|
||||||
if (!CheckCycle(cx, xml, vxml))
|
|
||||||
return JS_FALSE;
|
|
||||||
if (vxml->xml_class == JSXML_CLASS_LIST)
|
if (vxml->xml_class == JSXML_CLASS_LIST)
|
||||||
n = vxml->xml_kids.length;
|
n = vxml->xml_kids.length;
|
||||||
}
|
}
|
||||||
@ -3647,6 +3641,8 @@ Insert(JSContext *cx, JSXML *xml, jsval id, jsval v)
|
|||||||
if (vxml && vxml->xml_class == JSXML_CLASS_LIST) {
|
if (vxml && vxml->xml_class == JSXML_CLASS_LIST) {
|
||||||
for (j = 0; j < n; j++) {
|
for (j = 0; j < n; j++) {
|
||||||
kid = XMLARRAY_MEMBER(&vxml->xml_kids, j, JSXML);
|
kid = XMLARRAY_MEMBER(&vxml->xml_kids, j, JSXML);
|
||||||
|
if (!CheckCycle(cx, xml, kid))
|
||||||
|
return JS_FALSE;
|
||||||
kid->parent = xml;
|
kid->parent = xml;
|
||||||
XMLARRAY_SET_MEMBER(&xml->xml_kids, i + j, kid);
|
XMLARRAY_SET_MEMBER(&xml->xml_kids, i + j, kid);
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user