43877 - nsStringArray operator= crashes

Status: VERIFIED FIXED

(Core :: XPCOM, defect, P3)

Description

[Thomas Lendacky]

From Bugzilla Helper:
User-Agent: Mozilla/4.72 [en] (WinNT; U)
BuildID:    2000061408

The operator= of nsStringArray and nsCStringArray causes an exception when used.  
The problem lies in the copying of the old strings.  When setting the pointer to 
the old string, the operator= function is not using the "setting from" array, 
but rather the "setting to" or new array.  To fix:
  nsString* oldString = NS_STATIC_CAST(nsString*, ElementAt(i));
    to
  nsString* oldString = NS_STATIC_CAST(nsString*, other.ElementAt(i));

and

  nsCString* oldString = NS_STATIC_CAST(nsCString*, ElementAt(i));

    to

  nsCString* oldString = NS_STATIC_CAST(nsCString*, other.ElementAt(i));

Diff follows:

Index: nsVoidArray.cpp
===================================================================
RCS file: /cvsroot/mozilla/xpcom/ds/nsVoidArray.cpp,v
retrieving revision 3.17
diff -r3.17 nsVoidArray.cpp
365c365
<     nsString* oldString = NS_STATIC_CAST(nsString*, ElementAt(i));
---
>     nsString* oldString = NS_STATIC_CAST(nsString*, other.ElementAt(i));
555c555
<     nsCString* oldString = NS_STATIC_CAST(nsCString*, ElementAt(i));
---
>     nsCString* oldString = NS_STATIC_CAST(nsCString*, other.ElementAt(i));


Reproducible: Always
Steps to Reproduce:
1. Create a string array with at least one element
2. Try to copy using "="
3.

Comment 1

[Blake Ross]

Add crash keyword to open crashers.

Comment 2

[Mike Kaply [:mkaply]]

dougt reviewed the fix and I checked it in.

Comment 3

[leger]

rayw, is there a testcase I can use to verify?  or get you blessing on the fix 
works with 6/29 builds when they come out.

Comment 4

[Tracy Walker [:tracy]]

- Per last comments, age of bug, and no reopen - Marking Verified/Fixed.  Please 
reopen if still a problem.