nsTArray crash in RemoveElement

RESOLVED FIXED in mozilla1.9alpha1

Status

()

Core
XPCOM
--
critical
RESOLVED FIXED
12 years ago
12 years ago

People

(Reporter: Brett Wilson, Assigned: Darin Fisher)

Tracking

({fixed1.8.1})

Trunk
mozilla1.9alpha1
x86
Linux
fixed1.8.1
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

2.08 KB, patch
Benjamin Smedberg
: review+
Benjamin Smedberg
: approval1.8.1+
Details | Diff | Splinter Review
(Reporter)

Description

12 years ago
RemoveElement will crash when the element is not found. It compares the result of IndexOf with >= 0, but the type is UInt, so it will always be true. You want to compare it to NoIndex to test for failure.

Testcase:
  nsTArray<int> foo;
  foo.RemoveElement(5);

I'd fix this myself but I'm unsure what branches this would need to be checked into, etc.
(Assignee)

Comment 1

12 years ago
No worries.  I've got it.
Severity: normal → critical
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla1.9alpha
(Assignee)

Comment 2

12 years ago
Created attachment 209921 [details] [diff] [review]
v1 patch
Attachment #209921 - Flags: review?(benjamin)

Updated

12 years ago
Attachment #209921 - Flags: review?(benjamin)
Attachment #209921 - Flags: review+
Attachment #209921 - Flags: approval1.8.1+
(Assignee)

Comment 3

12 years ago
fixed-on-trunk
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
(Assignee)

Comment 4

12 years ago
fixed1.8.1
Keywords: fixed1.8.1
You need to log in before you can comment on or make changes to this bug.