Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-10 03:45:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1158540 - Don't repeat the mRefCnt member of URLValue in ImageValue; r=dbaron

Browse Source 
Even after this patch, it's not OK to AddRef an ImageValue and then call
Release on its base pointer (URLValue) since URLValue refcounting methods
are not virtual, so it would confuse the leak checker, but at least it
wouldn't cause UAF issues since we'd still be looking at the same mRefCnt
member.
This commit is contained in:
Ehsan Akhgari 2015-04-25 09:23:19 -04:00
parent 00b78c0497
commit c7febd7a07
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
layout/style/nsCSSValue.cpp
View File

@ -2464,6 +2464,9 @@ css::ImageValue::~ImageValue()
mRequests.Enumerate(&ClearRequestHashtable, this);
}
NS_IMPL_ADDREF(css::ImageValue)
NS_IMPL_RELEASE(css::ImageValue)
nsCSSValueGradientStop::nsCSSValueGradientStop()
: mLocation(eCSSUnit_None),
mColor(eCSSUnit_Null),

6
layout/style/nsCSSValue.h
View File

@ -137,9 +137,9 @@ public:
nsRefPtrHashtable<nsPtrHashKey<nsISupports>, imgRequestProxy> mRequests;
// Override AddRef and Release to not only log ourselves correctly, but
// also so that we delete correctly without a virtual destructor
NS_INLINE_DECL_REFCOUNTING(ImageValue)
// Override AddRef and Release to log ourselves correctly.
NS_METHOD_(MozExternalRefCountType) AddRef();
NS_METHOD_(MozExternalRefCountType) Release();
};
struct GridNamedArea {