218639 - [FIX]after purging the session history the index and count properties may become negative, which breaks history

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P1)

Description

[David Siegel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030827
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030827

sessionHistory.PurgeHistory(num) decrements both the current count and the
current index by num, which can cause sessionHistory.index to become negative. A
furthur click to a link then causes count also to become negative, breaking the
history stack beyond repair.

Reproducible: Always

Steps to Reproduce:
1. Install and run the attached XUL demo.
2. Click on five links. Pressing "history-size" shows that six items are on the
stack and the current index is at 5.
3. Hit the back button two times. "history-size" shows that six items are on the
stack and the current index is at 3
4. Purge the history
5. "history-size" shows that the index got negative (-3) and the stack is empty
6. Click another link.
7. "history-size" now shows that the index is -2 and the size is -1, which seems
bad.

Comment 1

[David Siegel]

Attachment: Session History Bug Demonstrator

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

David, your attachment yields:

XML Parsing Error: not well-formed
Location: http://bugzilla.mozilla.org/attachment.cgi?id=131072&action=view
Line Number 8, Column 51:<script type="application/x-javascript"/><[CDATA[
--------------------------------------------------^

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

I believe you've closed the <script> tag twice.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This should be a faily simple fix -- if mIndex is less than -1 after the purge,
set it to -1 in nsSHistory::PurgeHistory.

Also, this code should crash if aEntries is too big (derefs a null mRootList, as
far as I can see).

I can't fix this at the moment, but if there is no one willing to work on it who
takes the bug in the next week or so, please reassign it to me and I'll fix when
 get back.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Taking.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 133592 [details] [diff] [review]
Patch

timeless, could you review?  jag, could you sr?

Comment 8

[jag (Peter Annema)]

Comment on attachment 133592 [details] [diff] [review]
Patch

sr=jag

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 133592 [details] [diff] [review]
Patch

r=timeless on irc.

Comment 10

[Boris Zbarsky [:bzbarsky]]

fixed.