mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-13 05:15:45 +00:00
f1f7ad791c
AddOrAccumulate in nsSMILCSSValueType.cpp sets initializes |valueToAdd| to either &valueToAddWrapper->mGeckoValue or nullptr. It then asks FinalizeStyleAnimationValues to fill it in. FinalizeStyleAnimationValues will return false if it could not fill it in, in which case AddOrAccumulate returns early. As a result, after the early return we can be assured that |valueToAdd| is not null. However, valueToAddWrapper may still be null. Changeset 4d87f2bf4b10369af0dd83a2ef962a23299ee8d9 from bug 1358966 changed this code such that we pass a member of valueToAddWrapper to StyleAnimationValue::Add where we used to pass a member of valueToAdd. As a result, we can end up passing 0x20 (since valueToAddWrapper is nullptr) to Add() and then trying to read from it. This patch makes us pass, instead, |valueToAdd| since we know that is guaranteed to be non-null here. MozReview-Commit-ID: 1YwT1lBHnUe --HG-- extra : rebase_source : abec6995af68de13eacaccf7eca7b2d121eaedf3 |
||
|---|---|---|
| .. | ||
| crashtests | ||
| test | ||
| moz.build | ||
| nsISMILAttr.h | ||
| nsISMILType.h | ||
| nsSMILAnimationController.cpp | ||
| nsSMILAnimationController.h | ||
| nsSMILAnimationFunction.cpp | ||
| nsSMILAnimationFunction.h | ||
| nsSMILCompositor.cpp | ||
| nsSMILCompositor.h | ||
| nsSMILCompositorTable.h | ||
| nsSMILCSSProperty.cpp | ||
| nsSMILCSSProperty.h | ||
| nsSMILCSSValueType.cpp | ||
| nsSMILCSSValueType.h | ||
| nsSMILFloatType.cpp | ||
| nsSMILFloatType.h | ||
| nsSMILInstanceTime.cpp | ||
| nsSMILInstanceTime.h | ||
| nsSMILInterval.cpp | ||
| nsSMILInterval.h | ||
| nsSMILKeySpline.cpp | ||
| nsSMILKeySpline.h | ||
| nsSMILMilestone.h | ||
| nsSMILNullType.cpp | ||
| nsSMILNullType.h | ||
| nsSMILParserUtils.cpp | ||
| nsSMILParserUtils.h | ||
| nsSMILRepeatCount.cpp | ||
| nsSMILRepeatCount.h | ||
| nsSMILSetAnimationFunction.cpp | ||
| nsSMILSetAnimationFunction.h | ||
| nsSMILTargetIdentifier.h | ||
| nsSMILTimeContainer.cpp | ||
| nsSMILTimeContainer.h | ||
| nsSMILTimedElement.cpp | ||
| nsSMILTimedElement.h | ||
| nsSMILTimeValue.cpp | ||
| nsSMILTimeValue.h | ||
| nsSMILTimeValueSpec.cpp | ||
| nsSMILTimeValueSpec.h | ||
| nsSMILTimeValueSpecParams.h | ||
| nsSMILTypes.h | ||
| nsSMILValue.cpp | ||
| nsSMILValue.h | ||
| SMILBoolType.cpp | ||
| SMILBoolType.h | ||
| SMILEnumType.cpp | ||
| SMILEnumType.h | ||
| SMILIntegerType.cpp | ||
| SMILIntegerType.h | ||
| SMILStringType.cpp | ||
| SMILStringType.h | ||
| TimeEvent.cpp | ||
| TimeEvent.h | ||