Closed Bug 1473804 Opened 6 years ago Closed 6 years ago

AutoTArray::SwapElements is unsound.

Categories

(Core :: XPCOM, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla63
Tracking Status
firefox63 --- fixed

People

(Reporter: emilio, Assigned: emilio)

References

Details

Attachments

(2 files)

Attached file Testcase
The attached testcase crashes.

This hit me in bug 1455891, with the test-case from bug 1473694.
Comment on attachment 8990205 [details]
Don't lie to AutoTArray::EnsureCapacity.

Review ping Eric?
Attachment #8990205 - Flags: review?(erahm)
(In reply to Emilio Cobos Álvarez (:emilio) from comment #2)
> Comment on attachment 8990205 [details]
> Don't lie to AutoTArray::EnsureCapacity.
> 
> Review ping Eric?

Apologies, for some reason this wasn't showing up in my dashboard.
Comment on attachment 8990205 [details]
Don't lie to AutoTArray::EnsureCapacity.

Eric Rahm [:erahm] (please no mozreview requests) has approved the revision.

https://phabricator.services.mozilla.com/D1995
Attachment #8990205 - Flags: review+
Comment on attachment 8990205 [details]
Don't lie to AutoTArray::EnsureCapacity.

Thanks!
Attachment #8990205 - Flags: review?(erahm)
Pushed by emilio@crisal.io:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a699694bd202
Don't lie to AutoTArray::EnsureCapacity. r=erahm
Pushed by emilio@crisal.io:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e0d9ee9dc6c0
Add doc comments to specified `float` and `clear` CSS property. r=emilio
https://hg.mozilla.org/mozilla-central/rev/a699694bd202
https://hg.mozilla.org/mozilla-central/rev/e0d9ee9dc6c0
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla63
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: