Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-13 15:34:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix crash that happens when Mac OS X sends a bad value for a menu item index. do a bounds check. no bug. r=mento

Browse Source
This commit is contained in:
joshmoz%gmail.com 2006-03-30 01:45:47 +00:00
parent 132f675aaf
commit 6fdc3acecd
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
widget/src/cocoa/nsMenuX.mm
View File

@ -114,10 +114,10 @@ nsMenuX::~nsMenuX()
if (mMacMenu) {
if (mHandler)
::RemoveEventHandler(mHandler);
[mMacMenu release];
[mMacMenu autorelease];
}
[mMenuDelegate release];
[mMenuDelegate autorelease];
// alert the change notifier we don't care no more
mManager->Unregister(mMenuContent);
@ -1132,11 +1132,18 @@ static pascal OSStatus MyMenuEventHandler(EventHandlerCallRef myHandler, EventRe
UInt32 kind = ::GetEventKind(event);
if (kind == kEventMenuTargetItem) {
// get the position of the menu item we want
nsIMenu* targetMenu = reinterpret_cast<nsIMenu*>(userData);
PRUint16 aPos;
::GetEventParameter(event, kEventParamMenuItemIndex, typeMenuItemIndex, NULL, sizeof(MenuItemIndex), NULL, &aPos);
aPos--; // subtract 1 from aPos because Carbon menu positions start at 1 not 0
// don't request a menu item that doesn't exist or we crash
// this might happen just due to some random quirks in the event system
PRUint32 itemCount;
nsIMenu* targetMenu = NS_REINTERPRET_CAST(nsIMenu*, userData);
targetMenu->GetItemCount(itemCount);
if (aPos >= itemCount)
return result;
nsISupports* aTargetMenuItem;
targetMenu->GetItemAt((PRUint32)aPos, aTargetMenuItem);