294599 - Rebinding a nsScannerSubstring using a substring made out of its own iterators fails

Status: NEW

(Core :: DOM: HTML Parser, defect, P5)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Over in bug 208869, I needed to remove the first couple of characters from a
nsScannerSubstring. To do so I had:

nsSubstring::const_iterator start, end;
theString.BeginReading(start);
theString.EndReading(end);

// manipulate start to point to other places in the string.

theString.Rebind(Substring(start, end));

However, this resulted in a corrupted theString, because the memory pointed to
by the substring was free'd by the time the assignment happened.

(The obvious workaround was to have: nsAutoString chopped(Substring(start,
end)); theString.Rebind(chopped); Note that I was calling through
CTextToken::Bind(), so I couldn't use the other version of Rebind, which seems
to handle this case).

Comment 1

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, >=5 years untouched DOM/Storage bugs' priority and severity.

If you have reason to believe this is wrong, please write a comment and ni :jstutte.