From c42a4e97459e04abf50c269755eabbf328f466ec Mon Sep 17 00:00:00 2001
From: "timeless%mozdev.org" <timeless%mozdev.org>
Date: Wed, 16 Apr 2003 21:32:31 +0000
Subject: [PATCH] Bug 201596 nsScrollPortView::ScrollTo could trigger a crash
 if new PRInt32[SMOOTH_SCROLL_FRAMES*2]; failed r=roc+moz sr=roc+moz

---
 view/src/nsScrollPortView.cpp | 23 +++++++++++++++++------
 view/src/nsScrollPortView.h   | 28 +++++++---------------------
 2 files changed, 24 insertions(+), 27 deletions(-)

diff --git a/view/src/nsScrollPortView.cpp b/view/src/nsScrollPortView.cpp
index de7200da8258..45131ea12f8c 100644
--- a/view/src/nsScrollPortView.cpp
+++ b/view/src/nsScrollPortView.cpp
@@ -66,6 +66,20 @@ static NS_DEFINE_IID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
 
 #define SMOOTH_SCROLL_PREF_NAME "general.smoothScroll"
 
+class SmoothScroll {
+public:
+  SmoothScroll() {}
+  ~SmoothScroll() {
+    if (mScrollAnimationTimer) mScrollAnimationTimer->Cancel();
+  }
+
+  nsCOMPtr<nsITimer> mScrollAnimationTimer;
+  PRInt32 mVelocities[SMOOTH_SCROLL_FRAMES*2];
+  PRInt32 mFrameIndex;
+  nscoord mDestinationX;
+  nscoord mDestinationY;
+};
+
 nsScrollPortView::nsScrollPortView()
 {
   mOffsetX = mOffsetY = 0;
@@ -321,20 +335,17 @@ NS_IMETHODIMP nsScrollPortView::ScrollTo(nscoord aDestinationX, nscoord aDestina
       if (!mSmoothScroll->mScrollAnimationTimer) {
         delete mSmoothScroll;
         mSmoothScroll = nsnull;
-      } else {
-        mSmoothScroll->mScrollAnimationTimer->InitWithFuncCallback(
-          SmoothScrollAnimationCallback, this, SMOOTH_SCROLL_MSECS_PER_FRAME,
-          nsITimer::TYPE_REPEATING_PRECISE);
       }
     }
     if (!mSmoothScroll) {
       // some allocation failed. Scroll the normal way.
       return ScrollToImpl(aDestinationX, aDestinationY, aUpdateFlags);
     }
-  
+    mSmoothScroll->mScrollAnimationTimer->InitWithFuncCallback(
+      SmoothScrollAnimationCallback, this, SMOOTH_SCROLL_MSECS_PER_FRAME,
+      nsITimer::TYPE_REPEATING_PRECISE);
     mSmoothScroll->mDestinationX = mOffsetX;
     mSmoothScroll->mDestinationY = mOffsetY;
-    mSmoothScroll->mVelocities = new PRInt32[SMOOTH_SCROLL_FRAMES*2];
   }
 
   // need to store these so we know when to stop scrolling
diff --git a/view/src/nsScrollPortView.h b/view/src/nsScrollPortView.h
index 69672547542d..c82251adaddf 100644
--- a/view/src/nsScrollPortView.h
+++ b/view/src/nsScrollPortView.h
@@ -44,6 +44,7 @@
 #include "nsITimer.h"
 
 class nsISupportsArray;
+class SmoothScroll;
 
 //this is a class that acts as a container for other views and provides
 //automatic management of scrolling of the views it contains.
@@ -103,28 +104,13 @@ private:
   NS_IMETHOD_(nsrefcnt) Release(void);
   NS_IMETHOD  ScrollToImpl(nscoord aX, nscoord aY, PRUint32 aUpdateFlags);
 
-  class SmoothScroll {
-  public:
-    SmoothScroll() { mVelocities = nsnull; }
-    ~SmoothScroll() {
-      if (mScrollAnimationTimer) mScrollAnimationTimer->Cancel();
-       delete[] mVelocities;
-     }
+  // data members
+  SmoothScroll* mSmoothScroll;
 
-     nsCOMPtr<nsITimer> mScrollAnimationTimer;
-     PRInt32            mFrameIndex;
-     PRInt32*           mVelocities;
-     nscoord            mDestinationX;
-     nscoord            mDestinationY;
-   };
-
-   // data members
-   SmoothScroll*        mSmoothScroll;
-
-   // methods
-   void        IncrementalScroll();
-   PRBool      IsSmoothScrollingEnabled();
-   static void SmoothScrollAnimationCallback(nsITimer *aTimer, void* aESM);
+  // methods
+  void        IncrementalScroll();
+  PRBool      IsSmoothScrollingEnabled();
+  static void SmoothScrollAnimationCallback(nsITimer *aTimer, void* aESM);
 
 protected:
   virtual ~nsScrollPortView();