667336 - children.item(-1) causes "ASSERTION: PopulateSelf left the list in a dirty (useless) state!"

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

###!!! ASSERTION: PopulateSelf left the list in a dirty (useless) state!: '!mRootNode || mState != LIST_DIRTY', file content/base/src/nsContentList.cpp, line 534

>nsContentList::Item [content/base/src/nsContentList.cpp:536]
>nsContentList::GetNodeAt [content/base/src/nsContentList.cpp:632]
>nsIDOMNodeList_Item [dom_quickstubs.cpp:7869]

I think the problem is the "PopulateSelf(aIndex+1);" in nsContentList::Item. aIndex is PRUInt32(-1), so the call becomes PopulateSelf(0), which does nothing.

http://hg.mozilla.org/mozilla-central/annotate/38f69296b20c/content/base/src/nsContentList.cpp#l517

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Make sure we don't overflow unsigned int on item().

Comment 3

[Peter Van der Beken [:peterv]]

Comment on attachment 543271 [details] [diff] [review]
Make sure we don't overflow unsigned int on item().

Review of attachment 543271 [details] [diff] [review]:
-----------------------------------------------------------------

::: content/base/src/nsContentList.cpp
@@ +526,5 @@
>      }
>    }
>  
>    if (mState != LIST_UP_TO_DATE)
> +    PopulateSelf(NS_MIN(aIndex, PR_UINT32_MAX-1)+1);

Maybe add some spaces around operators?

Comment 4

[Boris Zbarsky [:bzbarsky]]

> Maybe add some spaces around operators?

Done.

Comment 5

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/55cb2f116089