463640 - Potential crash in nsTreeRows::Subtree::~Subtree()

Status: NEW

(Core :: XUL, defect)

Description

[Mats Palmgren (inactive)]

I suspect this would blow the stack when deleting deep trees...

http://mxr.mozilla.org/mozilla-central/source/content/xul/templates/src/nsTreeRows.cpp?mark=248,255#246

246 nsTreeRows::Subtree::~Subtree()
247 {
248     Clear();
249 }
250 
251 void
252 nsTreeRows::Subtree::Clear()
253 {
254     for (PRInt32 i = mCount - 1; i >= 0; --i)
255         delete mRows[i].mSubtree;
256

Comment 1

[Wayne Mery (:wsmwk)]

Mats, code now reads...

218 void
219 nsTreeRows::Subtree::Clear()
220 {
221     for (int32_t i = mCount - 1; i >= 0; --i)
222         delete mRows[i].mSubtree;


No crashes found on crash-stats.

nsXULTreeBuilder::RemoveMatchesFor(nsTreeRows::Subtree&)