1261744 - Some missing nsStringBuffer::Alloc() null checks

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Nicholas Nethercote [inactive]]

nsStringBuffer::Alloc() is fallible, but two callsites (nsHtml5Atom's constructor and DynamicAtom's constructor) fail to check for null.

Comment 1

[Nicholas Nethercote [inactive]]

Attachment: Add two missing null checks for nsStringBuffer::Alloc()

Comment 2

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Comment on attachment 8737693 [details] [diff] [review]
Add two missing null checks for nsStringBuffer::Alloc()

Review of attachment 8737693 [details] [diff] [review]:
-----------------------------------------------------------------

::: parser/html/nsHtml5Atom.cpp
@@ +13,5 @@
>    RefPtr<nsStringBuffer> buf = nsStringBuffer::FromString(aString);
>    if (buf) {
>      mString = static_cast<char16_t*>(buf->Data());
>    } else {
>      buf = nsStringBuffer::Alloc((mLength + 1) * sizeof(char16_t));

Uh, remove this?

Comment 3

[Nicholas Nethercote [inactive]]

> Uh, remove this?

Whoops, yes!

Comment 4

[Eric Rahm [:erahm]]

Comment on attachment 8737693 [details] [diff] [review]
Add two missing null checks for nsStringBuffer::Alloc()

Review of attachment 8737693 [details] [diff] [review]:
-----------------------------------------------------------------

r=me, minor nit (and of course fix :Ms2ger's comment).

::: parser/html/nsHtml5Atom.cpp
@@ +14,5 @@
>    if (buf) {
>      mString = static_cast<char16_t*>(buf->Data());
>    } else {
>      buf = nsStringBuffer::Alloc((mLength + 1) * sizeof(char16_t));
> +    size_t size = (mLength + 1) * sizeof(char16_t);

Nit: The calculated sizes could be |const|.

Comment 5

[Nicholas Nethercote [inactive]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/68ae46f52b62844de2152e6694b2ea150848e3e0
Bug 1261744 - Add two missing null checks for nsStringBuffer::Alloc(). r=erahm.

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/68ae46f52b62