Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-22 01:35:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1373371 - Properly convert index in RemoveElementsAt. r=froydnj

Browse Source 
MozReview-Commit-ID: 2CRrUmOxA9B

--HG--
extra : rebase_source : 6071d63fa45d391b6c0fc8ce6a89bb7d0ef8eb11
This commit is contained in:
Eric Rahm 2017-06-19 17:09:54 -07:00
parent 7aa828ae26
commit 79b2a97ced
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
xpcom/ds/nsTArray.h
View File

@ -13,6 +13,7 @@
#include "mozilla/Assertions.h"
#include "mozilla/Attributes.h"
#include "mozilla/BinarySearch.h"
#include "mozilla/CheckedInt.h"
#include "mozilla/fallible.h"
#include "mozilla/MathAlgorithms.h"
#include "mozilla/MemoryReporting.h"
@ -2053,9 +2054,14 @@ void
nsTArray_Impl<E, Alloc>::RemoveElementsAt(index_type aStart, size_type aCount)
{
MOZ_ASSERT(aCount == 0 || aStart < Length(), "Invalid aStart index");
MOZ_ASSERT(aStart + aCount <= Length(), "Invalid length");
// Check that the previous assert didn't overflow
MOZ_ASSERT(aStart <= aStart + aCount, "Start index plus length overflows");
mozilla::CheckedInt<index_type> rangeEnd = aStart;
rangeEnd += aCount;
if (MOZ_UNLIKELY(!rangeEnd.isValid() || rangeEnd.value() > Length())) {
InvalidArrayIndex_CRASH(aStart, Length());
}
DestructRange(aStart, aCount);
this->template ShiftData<InfallibleAlloc>(aStart, aCount, 0,
sizeof(elem_type),