From 6b1dec4b784ffc3a5f5b2225cf041d9c93323995 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Mon, 16 Jul 2018 21:45:17 +0200
Subject: [PATCH] Bug 1473804: Don't lie to AutoTArray::EnsureCapacity. r=erahm

Differential Revision: https://phabricator.services.mozilla.com/D1995

MozReview-Commit-ID: 350uWaD49tS
---
 xpcom/ds/nsTArray-inl.h           |  5 ++---
 xpcom/tests/gtest/TestTArray2.cpp | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/xpcom/ds/nsTArray-inl.h b/xpcom/ds/nsTArray-inl.h
index 95bd99ffcf7a..e2790af90c65 100644
--- a/xpcom/ds/nsTArray-inl.h
+++ b/xpcom/ds/nsTArray-inl.h
@@ -461,9 +461,8 @@ nsTArray_base<Alloc, Copy>::SwapArrayElements(nsTArray_base<Allocator,
   // job for AutoTArray!  (One of the two arrays we're swapping is using an
   // auto buffer, so we're likely not allocating a lot of space here.  But one
   // could, in theory, allocate a huge AutoTArray on the heap.)
-  AutoTArray<nsTArray_Impl<uint8_t, ActualAlloc>, 64> temp;
-  if (!ActualAlloc::Successful(temp.template EnsureCapacity<ActualAlloc>(smallerLength,
-                                                                         aElemSize))) {
+  AutoTArray<uint8_t, 64 * sizeof(void*)> temp;
+  if (!ActualAlloc::Successful(temp.template EnsureCapacity<ActualAlloc>(smallerLength * aElemSize, sizeof(uint8_t)))) {
     return ActualAlloc::FailureResult();
   }
 
diff --git a/xpcom/tests/gtest/TestTArray2.cpp b/xpcom/tests/gtest/TestTArray2.cpp
index 91804ba05b22..ac00a9336c78 100644
--- a/xpcom/tests/gtest/TestTArray2.cpp
+++ b/xpcom/tests/gtest/TestTArray2.cpp
@@ -1086,4 +1086,29 @@ TEST(TArray, test_comparator_objects) {
   ASSERT_TRUE(TestCompareMethods([] (int aLeft, int aRight) { return aLeft - aRight; }));
 }
 
+struct Big
+{
+  uint64_t size[40] = {};
+};
+
+TEST(TArray, test_AutoTArray_SwapElements) {
+  AutoTArray<Big, 40> oneArray;
+  AutoTArray<Big, 40> another;
+
+  for (size_t i = 0; i < 8; ++i) {
+    oneArray.AppendElement(Big());
+  }
+  oneArray[0].size[10] = 1;
+  for (size_t i = 0; i < 9; ++i) {
+    another.AppendElement(Big());
+  }
+  oneArray.SwapElements(another);
+
+  ASSERT_EQ(oneArray.Length(), 9u);
+  ASSERT_EQ(another.Length(), 8u);
+
+  ASSERT_EQ(oneArray[0].size[10], 0u);
+  ASSERT_EQ(another[0].size[10], 1u);
+}
+
 } // namespace TestTArray