Closed
Bug 766181
Opened 12 years ago
Closed 12 years ago
Need an extra null check for aOutIndex in Selection::AddItem
Categories
(Core :: DOM: Selection, defect)
Core
DOM: Selection
Tracking
()
RESOLVED
FIXED
mozilla18
People
(Reporter: Ms2ger, Assigned: graememcc)
References
Details
Attachments
(1 file, 2 obsolete files)
2.47 KB,
patch
|
roc
:
review+
|
Details | Diff | Splinter Review |
Need a null-check at <http://hg.mozilla.org/mozilla-central/annotate/d29af708ec3c/layout/generic/nsSelection.cpp#l3559>.
Assignee | ||
Updated•12 years ago
|
Assignee: nobody → graememcc_firefox
Status: NEW → ASSIGNED
Assignee | ||
Comment 1•12 years ago
|
||
Trivial fix. I fear this wasn't the cause of the crashes Boris was hitting. I tried to work backwards with the aim of creating a crashtest. To hit this line requires the existing selection to be non-empty, and the given range to overlap it in some way. However, the only caller of AddItem without an initialised aOutIndex is Selection::Collapse, which explicitly empties the selection before calling AddItem.
Attachment #635827 -
Flags: review?(roc)
How about just making all callers pass something for aOutIndex? I think that's the way to go here.
Assignee | ||
Comment 3•12 years ago
|
||
Attachment #635827 -
Attachment is obsolete: true
Attachment #635827 -
Flags: review?(roc)
Attachment #639349 -
Flags: review?(roc)
Comment on attachment 639349 [details] [diff] [review] v2 Review of attachment 639349 [details] [diff] [review]: ----------------------------------------------------------------- ::: layout/generic/nsSelection.cpp @@ +3459,1 @@ > return NS_ERROR_NULL_POINTER; Don't check aOutIndex here. Just add NS_ASSERTION(aOutIndex, "aOutIndex can't be null").
Assignee | ||
Comment 5•12 years ago
|
||
I forgot I still owed you a patch here.
Attachment #639349 -
Attachment is obsolete: true
Attachment #639349 -
Flags: review?(roc)
Attachment #661320 -
Flags: review?(roc)
Attachment #661320 -
Flags: review?(roc) → review+
Assignee | ||
Comment 6•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/8bf7fa20ea33
Comment 7•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/8bf7fa20ea33
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in
before you can comment on or make changes to this bug.
Description
•