Need an extra null check for aOutIndex in Selection::AddItem

RESOLVED FIXED in mozilla18

Status

()

Core
Selection
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Ms2ger, Assigned: graememcc)

Tracking

Trunk
mozilla18
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

5 years ago
Need a null-check at <http://hg.mozilla.org/mozilla-central/annotate/d29af708ec3c/layout/generic/nsSelection.cpp#l3559>.
(Assignee)

Updated

5 years ago
Assignee: nobody → graememcc_firefox
Status: NEW → ASSIGNED
(Assignee)

Comment 1

5 years ago
Created attachment 635827 [details] [diff] [review]
Trivial fix

Trivial fix.

I fear this wasn't the cause of the crashes Boris was hitting. I tried to work backwards with the aim of creating a crashtest. To hit this line requires the existing selection to be non-empty, and the given range to overlap it in some way. However, the only caller of AddItem without an initialised aOutIndex is Selection::Collapse, which explicitly empties the selection before calling AddItem.
Attachment #635827 - Flags: review?(roc)
How about just making all callers pass something for aOutIndex? I think that's the way to go here.
(Assignee)

Comment 3

5 years ago
Created attachment 639349 [details] [diff] [review]
v2
Attachment #635827 - Attachment is obsolete: true
Attachment #635827 - Flags: review?(roc)
Attachment #639349 - Flags: review?(roc)
Comment on attachment 639349 [details] [diff] [review]
v2

Review of attachment 639349 [details] [diff] [review]:
-----------------------------------------------------------------

::: layout/generic/nsSelection.cpp
@@ +3459,1 @@
>      return NS_ERROR_NULL_POINTER;

Don't check aOutIndex here. Just add NS_ASSERTION(aOutIndex, "aOutIndex can't be null").
(Assignee)

Comment 5

5 years ago
Created attachment 661320 [details] [diff] [review]
v3

I forgot I still owed you a patch here.
Attachment #639349 - Attachment is obsolete: true
Attachment #639349 - Flags: review?(roc)
Attachment #661320 - Flags: review?(roc)
Attachment #661320 - Flags: review?(roc) → review+
(Assignee)

Comment 6

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/8bf7fa20ea33

Comment 7

5 years ago
https://hg.mozilla.org/mozilla-central/rev/8bf7fa20ea33
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in before you can comment on or make changes to this bug.