279939 - The plaintext serializer asserts and relies on unsigned integer overflow when dealing with raw <li>s

Status: RESOLVED FIXED

(Core :: DOM: Serializers, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Steps to reproduce:
* Load the testcase in the URL (in a debug build)
* Click on the bullet to select that list item
* Right click on the selection to bring up a context menu (or just hit ctrl+c to
copy it)
* Notice that we assert "mULCount should be greater than 0 here".

This code still works becuase mULCount is a PRUint32 so (mULCount - 1) % 4 is
greater than 0 and less than 4. I have a patch that removes this assertion and
removes this dependance on mULCount being unsigned.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: patch v1

Note that the magical "3" value is there to preserve our behavior (use the same
letter for such cases).

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 172474 [details] [diff] [review]
patch v1

sr=jst

Comment 3

[Akkana Peck]

Comment on attachment 172474 [details] [diff] [review]
patch v1

I wonder why that assumption was there? I suspect the intent was that the
serializer was supposed to see the context that included the ul, and increment
mULCount.  Maybe that was from before we had content iterators.  Anyway,
evidently it's not doing that now, and the new code is certainly better than
the crufty old code. r=akkana

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in.