fixed mail/news crash and bug 4606

base/src/nsDeque.cpp

@@ -164,13 +164,14 @@ nsDeque& nsDeque::PushFront(void* anItem) {
     GrowCapacity();
   }
   if(0==mOrigin){  //case1: [xxx..]
-    mOrigin=mCapacity-1-mSize++;
+    //mOrigin=mCapacity-1-mSize++;
+    mOrigin=mCapacity-1;
     mData[mOrigin]=anItem;
   }
   else {// if(mCapacity==(mOrigin+mSize-1)){ //case2: [..xxx] and case3: [.xxx.]
     mData[--mOrigin]=anItem;
-    mSize++;
   }
+  mSize++;
   return *this;
 }
 

htmlparser/src/CNavDTD.cpp

@@ -25,7 +25,6 @@
 #include "nsIParser.h"
 #include "nsIHTMLContentSink.h" 
 #include "nsScanner.h"
-//#include "nsVoidArray.h"
 #include "nsTokenHandler.h"
 #include "nsIDTDDebug.h"
 #include "prenv.h"  //this is here for debug reasons...
@@ -44,6 +43,11 @@
 #endif
 #include "prmem.h"
 
+#define RICKG_DEBUG 0
+#ifdef  RICKG_DEBUG
+#include  <fstream.h>  
+#endif
+
 
 static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);                 
 static NS_DEFINE_IID(kIDTDIID,      NS_IDTD_IID);
@@ -477,6 +481,7 @@ nsresult CNavDTD::WillBuildModel(nsString& aFilename,PRBool aNotifySink,nsString
   return result;
 }
 
+
 /**
   * This is called when it's time to read as many tokens from the tokenizer
   * as you can. Not all tokens may make sense, so you may not be able to
@@ -614,12 +619,6 @@ nsresult CNavDTD::HandleToken(CToken* aToken,nsIParser* aParser){
       PRBool isHeadChild=gHTMLElements[eHTMLTag_head].IsChildOfHead(theTag);
       if((!isHeadChild) && (mHasOpenScript || (!FindTagInSet(theTag,docElements,sizeof(docElements)/sizeof(eHTMLTag_unknown))))){
           //really we want to push the token and all its skipped content and attributes...
-        if(0==mMisplacedContent.GetSize()){
-
-          CTokenRecycler* theRecycler=(CTokenRecycler*)mTokenizer->GetTokenRecycler();
-          CToken* theBodyToken=theRecycler->CreateTokenOfType(eToken_start,eHTMLTag_body);
-          mMisplacedContent.Push(theBodyToken);
-        }
         mMisplacedContent.Push(theToken);
         theToken=0; //force us to fall to bottom of this method...
         result=NS_ERROR_HTMLPARSER_MISPLACED;
@@ -627,6 +626,7 @@ nsresult CNavDTD::HandleToken(CToken* aToken,nsIParser* aParser){
     } 
     
     if(theToken){
+
       CITokenHandler* theHandler=GetTokenHandler(theType);
       if(theHandler) {
         mParser=(nsParser*)aParser;
@@ -988,6 +988,15 @@ nsresult CNavDTD::HandleDefaultStartToken(CToken* aToken,eHTMLTags aChildTag,nsI
   return result;
 }
 
+
+#ifdef  RICKG_DEBUG
+void WriteTokenToLog(CToken* aToken) {
+
+  static fstream outputStream("c:/temp/tokenlog.html",ios::out);
+  aToken->DebugDumpSource(outputStream); //write token without close bracket...
+}
+#endif
+
 /**
  * This gets called before we've handled a given start tag.
  * It's a generic hook to let us do pre processing.
@@ -1104,7 +1113,6 @@ nsresult CNavDTD::HandleOmittedTag(CToken* aToken,eHTMLTags aChildTag,eHTMLTags
   return result;
 }
 
-
 /**
  *  This method gets called when a start token has been 
  *  encountered in the parse process. If the current container
@@ -1122,6 +1130,10 @@ nsresult CNavDTD::HandleOmittedTag(CToken* aToken,eHTMLTags aChildTag,eHTMLTags
 nsresult CNavDTD::HandleStartToken(CToken* aToken) {
   NS_PRECONDITION(0!=aToken,kNullToken);
 
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   //Begin by gathering up attributes...
   eHTMLTags     theChildTag=(eHTMLTags)aToken->GetTypeID();
   nsCParserNode attrNode((CHTMLToken*)aToken,mLineNumber,GetTokenRecycler()); 
@@ -1304,8 +1316,12 @@ nsresult CNavDTD::HandleEndToken(CToken* aToken) {
 
   nsresult    result=NS_OK;
   eHTMLTags   theChildTag=(eHTMLTags)aToken->GetTypeID();
-
   nsCParserNode theNode((CHTMLToken*)aToken,mLineNumber);
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   switch(theChildTag) {
 
     case eHTMLTag_script:
@@ -1358,6 +1374,11 @@ nsresult CNavDTD::HandleEntityToken(CToken* aToken) {
 
   if(PR_FALSE==CanOmit(mBodyContext->Last(),eHTMLTag_entity)) {
     nsCParserNode aNode((CHTMLToken*)aToken,mLineNumber);
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
     result=AddLeaf(aNode);
   }
   return result;
@@ -1377,6 +1398,10 @@ nsresult CNavDTD::HandleCommentToken(CToken* aToken) {
   NS_PRECONDITION(0!=aToken,kNullToken);
   nsCParserNode aNode((CHTMLToken*)aToken,mLineNumber);
 
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   // You may find this hard to beleive, but this has to be here
   // so that the TBODY doesnt die when it sees a comment.
   // This case occurs on WWW.CREAF.COM
@@ -1480,6 +1505,11 @@ nsresult CNavDTD::HandleStyleToken(CToken* aToken){
 nsresult CNavDTD::HandleProcessingInstructionToken(CToken* aToken){
   NS_PRECONDITION(0!=aToken,kNullToken);
   nsCParserNode aNode((CHTMLToken*)aToken,mLineNumber);
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   nsresult result=(mSink) ? mSink->AddProcessingInstruction(aNode) : NS_OK; 
   return result;
 }
@@ -1501,6 +1531,11 @@ nsresult CNavDTD::CollectAttributes(nsCParserNode& aNode,PRInt32 aCount){
     for(attr=0;attr<aCount;attr++){
       CToken* theToken=mTokenizer->PopToken();
       if(theToken)  {
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(theToken);
+  #endif
+
         aNode.AddAttribute(theToken);
       }
     }
@@ -1529,6 +1564,11 @@ nsresult CNavDTD::CollectSkippedContent(nsCParserNode& aNode,PRInt32& aCount) {
   if(theToken) {
     theType=eHTMLTokenTypes(theToken->GetTokenType());
     if(eToken_skippedcontent==theType) {
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(theToken);
+  #endif
+
       aNode.SetSkippedContent(theToken);
       aCount++;
     } 
@@ -1566,6 +1606,29 @@ CITokenHandler* CNavDTD::GetTokenHandler(eHTMLTokenTypes aType) const {
  */
 void CNavDTD::EmitMisplacedContent(nsITokenizer* aTokenizer){
   if(aTokenizer){
+    if(!mHadBodyOrFrameset){
+      int index=0;
+      int max=mMisplacedContent.GetSize();
+      PRBool isBodyContent=PR_TRUE;
+      for(index=0;index<max;index++){
+        CToken* theToken=(CToken*)mMisplacedContent.ObjectAt(index);
+        if(theToken){
+          eHTMLTags theTag=(eHTMLTags)theToken->GetTypeID();
+        
+          static eHTMLTags frameTags[]={eHTMLTag_frame,eHTMLTag_noframes,eHTMLTag_frameset};
+          if(FindTagInSet(theTag,frameTags,sizeof(frameTags)/sizeof(eHTMLTag_unknown))) {
+            isBodyContent=PR_FALSE;
+            break;
+          }
+        }
+      } //for
+      if(isBodyContent){
+        CTokenRecycler* theRecycler=(CTokenRecycler*)aTokenizer->GetTokenRecycler();
+        CToken* theBodyToken=theRecycler->CreateTokenOfType(eToken_start,eHTMLTag_body);
+        mMisplacedContent.PushFront(theBodyToken);
+        //mMisplacedContent.PushFront(theBodyToken);
+      }
+    }
     aTokenizer->PrependTokens(mMisplacedContent);
   }
 }

htmlparser/src/nsHTMLTags.h

@@ -61,7 +61,10 @@ enum nsHTMLTag {
 
   /* The remaining enums are not for tags */
   eHTMLTag_text=113, eHTMLTag_whitespace=114, eHTMLTag_newline=115, 
-  eHTMLTag_comment=116, eHTMLTag_entity=117, eHTMLTag_userdefined=118
+  eHTMLTag_comment=116, eHTMLTag_entity=117, eHTMLTag_userdefined=118, 
+  eHTMLTag_secret_h1style=119, eHTMLTag_secret_h2style=120, 
+  eHTMLTag_secret_h3style=121, eHTMLTag_secret_h4style=122, 
+  eHTMLTag_secret_h5style=123, eHTMLTag_secret_h6style=124
 };
 #define NS_HTML_TAG_MAX 112
 

htmlparser/src/nsHTMLTokens.cpp

@@ -1356,7 +1356,7 @@ static PRUint16 PA_HackTable[] = {
 	0x2039,  /* SINGLE LEFT-POINTING ANGLE QUOTATION MARK */
 	0x0152,  /* LATIN CAPITAL LIGATURE OE */
 	NOT_USED,
-	NOT_USED,
+	0x017D,  /* CAPITAL Z HACEK */
 	NOT_USED,
 	NOT_USED,
 	0x2018,  /* LEFT SINGLE QUOTATION MARK */

parser/htmlparser/src/CNavDTD.cpp

@@ -25,7 +25,6 @@
 #include "nsIParser.h"
 #include "nsIHTMLContentSink.h" 
 #include "nsScanner.h"
-//#include "nsVoidArray.h"
 #include "nsTokenHandler.h"
 #include "nsIDTDDebug.h"
 #include "prenv.h"  //this is here for debug reasons...
@@ -44,6 +43,11 @@
 #endif
 #include "prmem.h"
 
+#define RICKG_DEBUG 0
+#ifdef  RICKG_DEBUG
+#include  <fstream.h>  
+#endif
+
 
 static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);                 
 static NS_DEFINE_IID(kIDTDIID,      NS_IDTD_IID);
@@ -477,6 +481,7 @@ nsresult CNavDTD::WillBuildModel(nsString& aFilename,PRBool aNotifySink,nsString
   return result;
 }
 
+
 /**
   * This is called when it's time to read as many tokens from the tokenizer
   * as you can. Not all tokens may make sense, so you may not be able to
@@ -614,12 +619,6 @@ nsresult CNavDTD::HandleToken(CToken* aToken,nsIParser* aParser){
       PRBool isHeadChild=gHTMLElements[eHTMLTag_head].IsChildOfHead(theTag);
       if((!isHeadChild) && (mHasOpenScript || (!FindTagInSet(theTag,docElements,sizeof(docElements)/sizeof(eHTMLTag_unknown))))){
           //really we want to push the token and all its skipped content and attributes...
-        if(0==mMisplacedContent.GetSize()){
-
-          CTokenRecycler* theRecycler=(CTokenRecycler*)mTokenizer->GetTokenRecycler();
-          CToken* theBodyToken=theRecycler->CreateTokenOfType(eToken_start,eHTMLTag_body);
-          mMisplacedContent.Push(theBodyToken);
-        }
         mMisplacedContent.Push(theToken);
         theToken=0; //force us to fall to bottom of this method...
         result=NS_ERROR_HTMLPARSER_MISPLACED;
@@ -627,6 +626,7 @@ nsresult CNavDTD::HandleToken(CToken* aToken,nsIParser* aParser){
     } 
     
     if(theToken){
+
       CITokenHandler* theHandler=GetTokenHandler(theType);
       if(theHandler) {
         mParser=(nsParser*)aParser;
@@ -988,6 +988,15 @@ nsresult CNavDTD::HandleDefaultStartToken(CToken* aToken,eHTMLTags aChildTag,nsI
   return result;
 }
 
+
+#ifdef  RICKG_DEBUG
+void WriteTokenToLog(CToken* aToken) {
+
+  static fstream outputStream("c:/temp/tokenlog.html",ios::out);
+  aToken->DebugDumpSource(outputStream); //write token without close bracket...
+}
+#endif
+
 /**
  * This gets called before we've handled a given start tag.
  * It's a generic hook to let us do pre processing.
@@ -1104,7 +1113,6 @@ nsresult CNavDTD::HandleOmittedTag(CToken* aToken,eHTMLTags aChildTag,eHTMLTags
   return result;
 }
 
-
 /**
  *  This method gets called when a start token has been 
  *  encountered in the parse process. If the current container
@@ -1122,6 +1130,10 @@ nsresult CNavDTD::HandleOmittedTag(CToken* aToken,eHTMLTags aChildTag,eHTMLTags
 nsresult CNavDTD::HandleStartToken(CToken* aToken) {
   NS_PRECONDITION(0!=aToken,kNullToken);
 
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   //Begin by gathering up attributes...
   eHTMLTags     theChildTag=(eHTMLTags)aToken->GetTypeID();
   nsCParserNode attrNode((CHTMLToken*)aToken,mLineNumber,GetTokenRecycler()); 
@@ -1304,8 +1316,12 @@ nsresult CNavDTD::HandleEndToken(CToken* aToken) {
 
   nsresult    result=NS_OK;
   eHTMLTags   theChildTag=(eHTMLTags)aToken->GetTypeID();
-
   nsCParserNode theNode((CHTMLToken*)aToken,mLineNumber);
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   switch(theChildTag) {
 
     case eHTMLTag_script:
@@ -1358,6 +1374,11 @@ nsresult CNavDTD::HandleEntityToken(CToken* aToken) {
 
   if(PR_FALSE==CanOmit(mBodyContext->Last(),eHTMLTag_entity)) {
     nsCParserNode aNode((CHTMLToken*)aToken,mLineNumber);
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
     result=AddLeaf(aNode);
   }
   return result;
@@ -1377,6 +1398,10 @@ nsresult CNavDTD::HandleCommentToken(CToken* aToken) {
   NS_PRECONDITION(0!=aToken,kNullToken);
   nsCParserNode aNode((CHTMLToken*)aToken,mLineNumber);
 
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   // You may find this hard to beleive, but this has to be here
   // so that the TBODY doesnt die when it sees a comment.
   // This case occurs on WWW.CREAF.COM
@@ -1480,6 +1505,11 @@ nsresult CNavDTD::HandleStyleToken(CToken* aToken){
 nsresult CNavDTD::HandleProcessingInstructionToken(CToken* aToken){
   NS_PRECONDITION(0!=aToken,kNullToken);
   nsCParserNode aNode((CHTMLToken*)aToken,mLineNumber);
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(aToken);
+  #endif
+
   nsresult result=(mSink) ? mSink->AddProcessingInstruction(aNode) : NS_OK; 
   return result;
 }
@@ -1501,6 +1531,11 @@ nsresult CNavDTD::CollectAttributes(nsCParserNode& aNode,PRInt32 aCount){
     for(attr=0;attr<aCount;attr++){
       CToken* theToken=mTokenizer->PopToken();
       if(theToken)  {
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(theToken);
+  #endif
+
         aNode.AddAttribute(theToken);
       }
     }
@@ -1529,6 +1564,11 @@ nsresult CNavDTD::CollectSkippedContent(nsCParserNode& aNode,PRInt32& aCount) {
   if(theToken) {
     theType=eHTMLTokenTypes(theToken->GetTokenType());
     if(eToken_skippedcontent==theType) {
+
+  #ifdef  RICKG_DEBUG
+    WriteTokenToLog(theToken);
+  #endif
+
       aNode.SetSkippedContent(theToken);
       aCount++;
     } 
@@ -1566,6 +1606,29 @@ CITokenHandler* CNavDTD::GetTokenHandler(eHTMLTokenTypes aType) const {
  */
 void CNavDTD::EmitMisplacedContent(nsITokenizer* aTokenizer){
   if(aTokenizer){
+    if(!mHadBodyOrFrameset){
+      int index=0;
+      int max=mMisplacedContent.GetSize();
+      PRBool isBodyContent=PR_TRUE;
+      for(index=0;index<max;index++){
+        CToken* theToken=(CToken*)mMisplacedContent.ObjectAt(index);
+        if(theToken){
+          eHTMLTags theTag=(eHTMLTags)theToken->GetTypeID();
+        
+          static eHTMLTags frameTags[]={eHTMLTag_frame,eHTMLTag_noframes,eHTMLTag_frameset};
+          if(FindTagInSet(theTag,frameTags,sizeof(frameTags)/sizeof(eHTMLTag_unknown))) {
+            isBodyContent=PR_FALSE;
+            break;
+          }
+        }
+      } //for
+      if(isBodyContent){
+        CTokenRecycler* theRecycler=(CTokenRecycler*)aTokenizer->GetTokenRecycler();
+        CToken* theBodyToken=theRecycler->CreateTokenOfType(eToken_start,eHTMLTag_body);
+        mMisplacedContent.PushFront(theBodyToken);
+        //mMisplacedContent.PushFront(theBodyToken);
+      }
+    }
     aTokenizer->PrependTokens(mMisplacedContent);
   }
 }

parser/htmlparser/src/nsHTMLTags.h

@@ -61,7 +61,10 @@ enum nsHTMLTag {
 
   /* The remaining enums are not for tags */
   eHTMLTag_text=113, eHTMLTag_whitespace=114, eHTMLTag_newline=115, 
-  eHTMLTag_comment=116, eHTMLTag_entity=117, eHTMLTag_userdefined=118
+  eHTMLTag_comment=116, eHTMLTag_entity=117, eHTMLTag_userdefined=118, 
+  eHTMLTag_secret_h1style=119, eHTMLTag_secret_h2style=120, 
+  eHTMLTag_secret_h3style=121, eHTMLTag_secret_h4style=122, 
+  eHTMLTag_secret_h5style=123, eHTMLTag_secret_h6style=124
 };
 #define NS_HTML_TAG_MAX 112
 

parser/htmlparser/src/nsHTMLTokens.cpp

@@ -1356,7 +1356,7 @@ static PRUint16 PA_HackTable[] = {
 	0x2039,  /* SINGLE LEFT-POINTING ANGLE QUOTATION MARK */
 	0x0152,  /* LATIN CAPITAL LIGATURE OE */
 	NOT_USED,
-	NOT_USED,
+	0x017D,  /* CAPITAL Z HACEK */
 	NOT_USED,
 	NOT_USED,
 	0x2018,  /* LEFT SINGLE QUOTATION MARK */

xpcom/ds/nsDeque.cpp

@@ -164,13 +164,14 @@ nsDeque& nsDeque::PushFront(void* anItem) {
     GrowCapacity();
   }
   if(0==mOrigin){  //case1: [xxx..]
-    mOrigin=mCapacity-1-mSize++;
+    //mOrigin=mCapacity-1-mSize++;
+    mOrigin=mCapacity-1;
     mData[mOrigin]=anItem;
   }
   else {// if(mCapacity==(mOrigin+mSize-1)){ //case2: [..xxx] and case3: [.xxx.]
     mData[--mOrigin]=anItem;
-    mSize++;
   }
+  mSize++;
   return *this;
 }