Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 14:22:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed crash due to blind-cast of frame to rowFrame by checking the frame type first. r=karnaze sr=waterson b=88849

Browse Source
This commit is contained in:
attinasi%netscape.com 2001-07-17 20:27:01 +00:00
parent f06c5ddf67
commit 0db13043db
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
layout/html/table/src/nsTableRowGroupFrame.cpp
View File

@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame,
NS_ENSURE_ARG_POINTER(aFrame);
NS_ENSURE_ARG_POINTER(aLineNumberResult);
// make sure it is a rowFrame in the RowGroup
// - it should be, but we do not validate in every case (see bug 88849)
nsCOMPtr<nsIAtom> frameType;
aFrame->GetFrameType(getter_AddRefs(frameType));
if (frameType.get() != nsLayoutAtoms::tableRowFrame) {
NS_WARNING("RowGroup contains a frame that is not a row");
*aLineNumberResult = 0;
return NS_ERROR_FAILURE;
}
nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame;
*aLineNumberResult = rowFrame->GetRowIndex();

10
layout/tables/nsTableRowGroupFrame.cpp
View File

@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame,
NS_ENSURE_ARG_POINTER(aFrame);
NS_ENSURE_ARG_POINTER(aLineNumberResult);
// make sure it is a rowFrame in the RowGroup
// - it should be, but we do not validate in every case (see bug 88849)
nsCOMPtr<nsIAtom> frameType;
aFrame->GetFrameType(getter_AddRefs(frameType));
if (frameType.get() != nsLayoutAtoms::tableRowFrame) {
NS_WARNING("RowGroup contains a frame that is not a row");
*aLineNumberResult = 0;
return NS_ERROR_FAILURE;
}
nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame;
*aLineNumberResult = rowFrame->GetRowIndex();