285394 - [FIX]Random 25-frame limit imposed on the length of a frameset spec

Status: RESOLVED FIXED

(Core :: Layout: Images, Video, and HTML Frames, defect, P2)

Description

[Boris Zbarsky [:bzbarsky]]

We impose this random 25-frame limit on the length of a frameset spec (which
makes a 625-frame limit on kids of a frameset, since you can specify both rows
and cols, 25 of each; Michael, the WebSphere team may be interested in this
tidbit to boost their frame counts by a factor of 25).

The only reason we have this is that we're preallocating the array for these
suckers.  There's really no reason we have to do it that way.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

Patch to fix.  The change to nsAutoArrayPtr is not strictly needed; I can take
that out.  The rest is just using the counting we _already_ do to size the
array of specs appropriately.  Most of the changes are just s/aSpec/spec/ and
s/aSpecs/specs/.

There is a possible danger here of a page making us allocate a large array by
having a specful of commas.  Then again, it could also just dump oodles of HTML
at us, so....

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Same, but remove gMaxNumRowColSpecs too.

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 176843 [details] [diff] [review]
Same, but remove gMaxNumRowColSpecs too.

r+sr=jst, but it looks like this code could use less string copying and more
string iterators. Wanna file a new bug on that, or squeeze it in here?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Looked through the code, but there's really no way to avoid the copying -- we
need to copy to be able to use ToInteger() here...

Therefore marking fixed (patch is in).