Fix for 14386. Prevent memory corruption when opening and closing an account.

Approved = leaf. Reviewed -= karnaze.

layout/html/table/src/nsCellMap.cpp

@@ -21,6 +21,7 @@
 #include "nsTableFrame.h"
 #include "nsTableCellFrame.h"
 
+#define kIsCollapsedRowsGrowSize 5
 // CellData 
 
 CellData::CellData()
@@ -38,6 +39,7 @@ CellData::~CellData()
 nsCellMap::nsCellMap(int aRowCount, int aColCount)
   : mNumCollapsedRows(0),
     mNumCollapsedCols(0),
+    mIsCollapsedRowsSize(0),
     mRowCount(0),
     mNextAvailRowIndex(0)
 {
@@ -148,6 +150,8 @@ void nsCellMap::InsertRowIntoMap(PRInt32 aRowIndex)
   
   if (row) {
     mRows.InsertElementAt(row, aRowIndex);
+    if(mIsCollapsedRows)
+      InsertIntoCollapsedRows(aRowIndex);
   }
     
   PRInt32* val = new PRInt32(0);
@@ -193,6 +197,8 @@ void nsCellMap::RemoveRowFromMap(PRInt32 aRowIndex)
   } 
   mRows.RemoveElementAt(aRowIndex);
   delete row;
+  if(mIsCollapsedRows)
+    RemoveFromCollapsedRows(aRowIndex);
 
   // Decrement our row and next available index counts.
   mRowCount--;
@@ -525,6 +531,7 @@ void nsCellMap::SetRowCollapsedAt(PRInt32 aRow, PRBool aValue)
   if ((aRow >= 0) && (aRow < mRowCount)) {
     if (nsnull == mIsCollapsedRows) {
       mIsCollapsedRows = new PRPackedBool[mRowCount];
+      mIsCollapsedRowsSize = mRowCount;
       for (PRInt32 i = 0; i < mRowCount; i++) {
         mIsCollapsedRows[i] = PR_FALSE;
       }
@@ -540,6 +547,46 @@ void nsCellMap::SetRowCollapsedAt(PRInt32 aRow, PRBool aValue)
   }
 }
 
+void nsCellMap::InsertIntoCollapsedRows(PRInt32 aRow)
+{
+  if(mIsCollapsedRows) {
+    if((mRowCount + 1) > mIsCollapsedRowsSize){
+      PRInt32 newSize = mRowCount + kIsCollapsedRowsGrowSize;
+      PRPackedBool * newIsCollapsedRows = new PRPackedBool[newSize];
+	  if(!newIsCollapsedRows)
+		  return;
+      if(aRow != 0)
+        nsCRT::memcpy(newIsCollapsedRows, mIsCollapsedRows, aRow * sizeof (PRPackedBool));
+      if(aRow != mRowCount)
+        nsCRT::memcpy(newIsCollapsedRows + aRow + 1, mIsCollapsedRows + aRow, 
+                     (mRowCount - aRow) * sizeof(PRPackedBool));
+
+      delete[] mIsCollapsedRows;
+      mIsCollapsedRows = newIsCollapsedRows;
+      mIsCollapsedRowsSize = newSize;
+	}
+    else {
+      if(aRow != mRowCount)
+        nsCRT::memmove(mIsCollapsedRows + aRow + 1, mIsCollapsedRows + aRow, 
+		              (mRowCount - aRow) * sizeof(PRPackedBool));
+	}
+    mIsCollapsedRows[aRow] = PR_FALSE;
+  }
+}
+
+void nsCellMap::RemoveFromCollapsedRows(PRInt32 aRow)
+{
+  //If the row we're removing was collapsed, decrement mNumCollapsedRows
+  if(mIsCollapsedRows[aRow])
+    mNumCollapsedRows--;
+
+  //Don't need to move if last element in array
+  if(aRow < (mRowCount - 1))
+    nsCRT::memmove(mIsCollapsedRows + aRow, mIsCollapsedRows + aRow + 1, 
+	              (mRowCount - 1 - aRow) * sizeof(PRPackedBool));
+
+}
+
 PRInt32 nsCellMap::GetNumCollapsedCols() const
 {
   return mNumCollapsedCols;

layout/html/table/src/nsCellMap.h

@@ -135,6 +135,11 @@ protected:
   void Grow(PRInt32 aNumMapRows, 
             PRInt32 aNumCols);
 
+	/**  insert a new entry into the mIsCollapsedRows */
+	void InsertIntoCollapsedRows(PRInt32 aRow);
+	/** remove an entry from mIsCollapsedRows */
+  void RemoveFromCollapsedRows(PRInt32 aRow);
+
   /** assign aCellData to the cell at (aRow,aColumn) */
   void SetMapCellAt(CellData& aCellData, 
                     PRInt32   aMapRowIndex, 
@@ -163,8 +168,10 @@ protected:
 
   // an array of booleans where the ith element indicates if the ith row is collapsed
   PRPackedBool* mIsCollapsedRows;
+	PRInt32				mIsCollapsedRowsSize;
   PRInt32       mNumCollapsedRows;
 
+
   // an array of booleans where the ith element indicates if the ith col is collapsed
   PRPackedBool* mIsCollapsedCols;
   PRInt32       mNumCollapsedCols;

layout/tables/nsCellMap.cpp

@@ -21,6 +21,7 @@
 #include "nsTableFrame.h"
 #include "nsTableCellFrame.h"
 
+#define kIsCollapsedRowsGrowSize 5
 // CellData 
 
 CellData::CellData()
@@ -38,6 +39,7 @@ CellData::~CellData()
 nsCellMap::nsCellMap(int aRowCount, int aColCount)
   : mNumCollapsedRows(0),
     mNumCollapsedCols(0),
+    mIsCollapsedRowsSize(0),
     mRowCount(0),
     mNextAvailRowIndex(0)
 {
@@ -148,6 +150,8 @@ void nsCellMap::InsertRowIntoMap(PRInt32 aRowIndex)
   
   if (row) {
     mRows.InsertElementAt(row, aRowIndex);
+    if(mIsCollapsedRows)
+      InsertIntoCollapsedRows(aRowIndex);
   }
     
   PRInt32* val = new PRInt32(0);
@@ -193,6 +197,8 @@ void nsCellMap::RemoveRowFromMap(PRInt32 aRowIndex)
   } 
   mRows.RemoveElementAt(aRowIndex);
   delete row;
+  if(mIsCollapsedRows)
+    RemoveFromCollapsedRows(aRowIndex);
 
   // Decrement our row and next available index counts.
   mRowCount--;
@@ -525,6 +531,7 @@ void nsCellMap::SetRowCollapsedAt(PRInt32 aRow, PRBool aValue)
   if ((aRow >= 0) && (aRow < mRowCount)) {
     if (nsnull == mIsCollapsedRows) {
       mIsCollapsedRows = new PRPackedBool[mRowCount];
+      mIsCollapsedRowsSize = mRowCount;
       for (PRInt32 i = 0; i < mRowCount; i++) {
         mIsCollapsedRows[i] = PR_FALSE;
       }
@@ -540,6 +547,46 @@ void nsCellMap::SetRowCollapsedAt(PRInt32 aRow, PRBool aValue)
   }
 }
 
+void nsCellMap::InsertIntoCollapsedRows(PRInt32 aRow)
+{
+  if(mIsCollapsedRows) {
+    if((mRowCount + 1) > mIsCollapsedRowsSize){
+      PRInt32 newSize = mRowCount + kIsCollapsedRowsGrowSize;
+      PRPackedBool * newIsCollapsedRows = new PRPackedBool[newSize];
+	  if(!newIsCollapsedRows)
+		  return;
+      if(aRow != 0)
+        nsCRT::memcpy(newIsCollapsedRows, mIsCollapsedRows, aRow * sizeof (PRPackedBool));
+      if(aRow != mRowCount)
+        nsCRT::memcpy(newIsCollapsedRows + aRow + 1, mIsCollapsedRows + aRow, 
+                     (mRowCount - aRow) * sizeof(PRPackedBool));
+
+      delete[] mIsCollapsedRows;
+      mIsCollapsedRows = newIsCollapsedRows;
+      mIsCollapsedRowsSize = newSize;
+	}
+    else {
+      if(aRow != mRowCount)
+        nsCRT::memmove(mIsCollapsedRows + aRow + 1, mIsCollapsedRows + aRow, 
+		              (mRowCount - aRow) * sizeof(PRPackedBool));
+	}
+    mIsCollapsedRows[aRow] = PR_FALSE;
+  }
+}
+
+void nsCellMap::RemoveFromCollapsedRows(PRInt32 aRow)
+{
+  //If the row we're removing was collapsed, decrement mNumCollapsedRows
+  if(mIsCollapsedRows[aRow])
+    mNumCollapsedRows--;
+
+  //Don't need to move if last element in array
+  if(aRow < (mRowCount - 1))
+    nsCRT::memmove(mIsCollapsedRows + aRow, mIsCollapsedRows + aRow + 1, 
+	              (mRowCount - 1 - aRow) * sizeof(PRPackedBool));
+
+}
+
 PRInt32 nsCellMap::GetNumCollapsedCols() const
 {
   return mNumCollapsedCols;

layout/tables/nsCellMap.h

@@ -135,6 +135,11 @@ protected:
   void Grow(PRInt32 aNumMapRows, 
             PRInt32 aNumCols);
 
+	/**  insert a new entry into the mIsCollapsedRows */
+	void InsertIntoCollapsedRows(PRInt32 aRow);
+	/** remove an entry from mIsCollapsedRows */
+  void RemoveFromCollapsedRows(PRInt32 aRow);
+
   /** assign aCellData to the cell at (aRow,aColumn) */
   void SetMapCellAt(CellData& aCellData, 
                     PRInt32   aMapRowIndex, 
@@ -163,8 +168,10 @@ protected:
 
   // an array of booleans where the ith element indicates if the ith row is collapsed
   PRPackedBool* mIsCollapsedRows;
+	PRInt32				mIsCollapsedRowsSize;
   PRInt32       mNumCollapsedRows;
 
+
   // an array of booleans where the ith element indicates if the ith col is collapsed
   PRPackedBool* mIsCollapsedCols;
   PRInt32       mNumCollapsedCols;