Closed
Bug 408431
Opened 17 years ago
Closed 17 years ago
"ASSERTION: nsVoidArray::FastElementAt: index out of range" with navigator.pendingOfflineLoads[0]
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: jruderman)
References
Details
(Keywords: assertion, crash, testcase)
Attachments
(2 files)
|
140 bytes,
text/html
|
Details | |
|
3.59 KB,
patch
|
dcamp
:
review+
jst
:
superreview+
jst
:
approval1.9+
|
Details | Diff | Splinter Review |
Loading the testcase triggers:
###!!! ASSERTION: nsVoidArray::FastElementAt: index out of range: '0 <= aIndex && aIndex < Count()', file ../../dist/include/xpcom/nsVoidArray.h, line 72
It then crashes, but only because the array is empty and therefore based at 0x0. If the array were not empty, I think it would go past the end of the array.
Looks like a simple off-by-one error in nsDOMOfflineLoadStatusList::Item. I'll attach a patch in a few minutes.
Flags: blocking1.9?
|
Assignee | |
Comment 1•17 years ago
|
||
|
|
Assignee | |
Updated•17 years ago
|
Attachment #293229 -
Flags: superreview?(jst)
Attachment #293229 -
Flags: review?(dcamp)
|
||
Updated•17 years ago
|
Attachment #293229 -
Flags: review?(dcamp) → review+
|
||
Updated•17 years ago
|
Attachment #293229 -
Flags: superreview?(jst)
Attachment #293229 -
Flags: superreview+
Attachment #293229 -
Flags: approval1.9+
|
|
Assignee | |
Comment 2•17 years ago
|
||
Fix checked in.
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Flags: blocking1.9? → in-testsuite+
Resolution: --- → FIXED
|
|
Assignee | |
Comment 3•17 years ago
|
||
No assertions on the 1.8 branch.
Group: security
Flags: wanted1.8.1.x-
|
||
Updated•12 years ago
|
Component: DOM: Mozilla Extensions → DOM
|
|
||
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•