children.item(-1) causes "ASSERTION: PopulateSelf left the list in a dirty (useless) state!"

RESOLVED FIXED in mozilla8

Status

()

Core
DOM
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: bz)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla8
x86
Mac OS X
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
###!!! ASSERTION: PopulateSelf left the list in a dirty (useless) state!: '!mRootNode || mState != LIST_DIRTY', file content/base/src/nsContentList.cpp, line 534

>nsContentList::Item [content/base/src/nsContentList.cpp:536]
>nsContentList::GetNodeAt [content/base/src/nsContentList.cpp:632]
>nsIDOMNodeList_Item [dom_quickstubs.cpp:7869]

I think the problem is the "PopulateSelf(aIndex+1);" in nsContentList::Item. aIndex is PRUInt32(-1), so the call becomes PopulateSelf(0), which does nothing.

http://hg.mozilla.org/mozilla-central/annotate/38f69296b20c/content/base/src/nsContentList.cpp#l517
(Reporter)

Comment 1

6 years ago
Created attachment 542050 [details]
testcase
(Reporter)

Updated

6 years ago
Blocks: 326633
Keywords: assertion, testcase
Created attachment 543271 [details] [diff] [review]
Make sure we don't overflow unsigned int on item().
Attachment #543271 - Flags: review?(peterv)
Assignee: nobody → bzbarsky
Whiteboard: [need review]
Comment on attachment 543271 [details] [diff] [review]
Make sure we don't overflow unsigned int on item().

Review of attachment 543271 [details] [diff] [review]:
-----------------------------------------------------------------

::: content/base/src/nsContentList.cpp
@@ +526,5 @@
>      }
>    }
>  
>    if (mState != LIST_UP_TO_DATE)
> +    PopulateSelf(NS_MIN(aIndex, PR_UINT32_MAX-1)+1);

Maybe add some spaces around operators?
Attachment #543271 - Flags: review?(peterv) → review+
> Maybe add some spaces around operators?

Done.
Whiteboard: [need review] → [need landing]
http://hg.mozilla.org/mozilla-central/rev/55cb2f116089
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Whiteboard: [need landing]
Target Milestone: --- → mozilla8
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.