13598 - nsAutoString ucs2(CBufDescriptor("ucs2", PR_TRUE, strlen("ucs2"))) crashes

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P1)

Description

[Simon Fraser [no longer active]]

Recently, some changes were made like this in HTML parser:

<   nsString ucs2("ucs2");
 ---
>   nsAutoString ucs2(CBufDescriptor("ucs2", PR_TRUE, strlen("ucs2")));

These cause problems; somewhere, we write off the of the buffer, and bad shit
happens. This may have something to do with this line in
CBufDescriptor::CBufDescriptor(char* aString,PRBool aStackBased,PRUint32
aCapacity,PRInt32 aLength) {

    mCapacity=aCapacity-1;

Comment 1

[Simon Fraser [no longer active]]

Adjust summary to be more accurate.

Comment 2

[Chris McAfee]

linux, viewer, test8, type in a text field, crash.
blocker.

Comment 3

[Mike Pinkerton (not reading bugmail)]

maybe this is another good argument for why we need a simpler mechanism for
strings that don't copy. ;) ;) ;)

Comment 4

[rickg]

The call is being used wrong. Here's the correct call in this case:

nsAutoString ucs2(CBufDescriptor("ucs2", PR_TRUE, strlen("ucs2")+1));

Comment 5

[Mike Pinkerton (not reading bugmail)]

that's what i thought, but no one would try that fix for me ;)

Thanks rick.

Comment 6

[Mike Pinkerton (not reading bugmail)]

closing out bug. it seems to have been fixed by hook or by crook.

Comment 7

[Jan Carpenter]

fixed per reporter