201596 - nsScrollPortView::ScrollTo could trigger a crash if new PRInt32[SMOOTH_SCROLL_FRAMES*2]; failed

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[timeless]

Comment 1

[timeless]

Attachment: minor changes to handle oom

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

+      if (!mSmoothScroll->mScrollAnimationTimer || !mSmoothScroll->mVelocities) {

If allocation of mScrollAnimationTimer failed, but mVelocities suceeded, then
you'll leak mVelocities here.

Can we just convert mVelocities to an array member of the SmoothScroll class so
we don't have to allocate it?

Comment 3

[timeless]

it doesn't leak because the desctructor cleans up :)
as for changing it to be a member instead of dynamically allocated,
i'm not sure.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yeah, let's just make it a member. You can move the definition of "class
SmoothScroll" into nsScrollingView.cpp (replace it with a toplevel "class
SmoothScroll;" in nsScrollingView.h) then change the definition of "mVelocities"
to "PRInt32 mVelocities[2*SMOOTH_SCROLL_FRAMES];" and remove the dynamic
allocation/deallocation.

Comment 5

[timeless]

Attachment: don't dynamically allocate mVelocities

Comment 6

[timeless]

checked in