зеркало из https://github.com/mozilla/gecko-dev.git
Bug 466576 - Null deref [@ nsSVGTransformList::GetValueString] after failed appendItem; r+sr=roc
This commit is contained in:
Родитель
9d047df9a0
Коммит
6ddfbd9bd8
|
@ -49,6 +49,15 @@
|
|||
#include "nsContentUtils.h"
|
||||
#include "nsIDOMClassInfo.h"
|
||||
|
||||
#define NS_ENSURE_NATIVE_TRANSFORM(obj, retval) \
|
||||
{ \
|
||||
nsresult rv; \
|
||||
if (retval) \
|
||||
*retval = nsnull; \
|
||||
nsCOMPtr<nsISVGValue> transform = do_QueryInterface(obj, &rv); \
|
||||
NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_SVG_WRONG_TYPE_ERR); \
|
||||
}
|
||||
|
||||
nsresult
|
||||
nsSVGTransformList::Create(nsIDOMSVGTransformList** aResult)
|
||||
{
|
||||
|
@ -75,8 +84,7 @@ nsSVGTransformList::ReleaseTransforms()
|
|||
for (PRInt32 i = 0; i < count; ++i) {
|
||||
nsIDOMSVGTransform* transform = ElementAt(i);
|
||||
nsCOMPtr<nsISVGValue> val = do_QueryInterface(transform);
|
||||
if (val)
|
||||
val->RemoveObserver(this);
|
||||
val->RemoveObserver(this);
|
||||
NS_RELEASE(transform);
|
||||
}
|
||||
mTransforms.Clear();
|
||||
|
@ -95,8 +103,7 @@ nsSVGTransformList::AppendElement(nsIDOMSVGTransform* aElement)
|
|||
if (rv) {
|
||||
NS_ADDREF(aElement);
|
||||
nsCOMPtr<nsISVGValue> val = do_QueryInterface(aElement);
|
||||
if (val)
|
||||
val->AddObserver(this);
|
||||
val->AddObserver(this);
|
||||
}
|
||||
|
||||
return rv;
|
||||
|
@ -244,18 +251,16 @@ NS_IMETHODIMP nsSVGTransformList::Clear()
|
|||
NS_IMETHODIMP nsSVGTransformList::Initialize(nsIDOMSVGTransform *newItem,
|
||||
nsIDOMSVGTransform **_retval)
|
||||
{
|
||||
*_retval = newItem;
|
||||
if (!newItem)
|
||||
return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
|
||||
NS_ENSURE_NATIVE_TRANSFORM(newItem, _retval);
|
||||
|
||||
nsSVGValueAutoNotifier autonotifier(this);
|
||||
|
||||
ReleaseTransforms();
|
||||
if (!AppendElement(newItem)) {
|
||||
*_retval = nsnull;
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
*_retval = newItem;
|
||||
NS_ADDREF(*_retval);
|
||||
return NS_OK;
|
||||
}
|
||||
|
@ -278,24 +283,21 @@ NS_IMETHODIMP nsSVGTransformList::InsertItemBefore(nsIDOMSVGTransform *newItem,
|
|||
PRUint32 index,
|
||||
nsIDOMSVGTransform **_retval)
|
||||
{
|
||||
*_retval = newItem;
|
||||
if (!newItem)
|
||||
return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
|
||||
NS_ENSURE_NATIVE_TRANSFORM(newItem, _retval);
|
||||
|
||||
nsSVGValueAutoNotifier autonotifier(this);
|
||||
|
||||
PRUint32 count = mTransforms.Count();
|
||||
|
||||
if (!mTransforms.InsertElementAt((void*)newItem, (index < count)? index: count)) {
|
||||
*_retval = nsnull;
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
NS_ADDREF(newItem);
|
||||
nsCOMPtr<nsISVGValue> val = do_QueryInterface(newItem);
|
||||
if (val)
|
||||
val->AddObserver(this);
|
||||
val->AddObserver(this);
|
||||
|
||||
*_retval = newItem;
|
||||
NS_ADDREF(*_retval);
|
||||
return NS_OK;
|
||||
}
|
||||
|
@ -305,10 +307,7 @@ NS_IMETHODIMP nsSVGTransformList::ReplaceItem(nsIDOMSVGTransform *newItem,
|
|||
PRUint32 index,
|
||||
nsIDOMSVGTransform **_retval)
|
||||
{
|
||||
if (!newItem)
|
||||
return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
|
||||
|
||||
*_retval = nsnull;
|
||||
NS_ENSURE_NATIVE_TRANSFORM(newItem, _retval);
|
||||
|
||||
nsSVGValueAutoNotifier autonotifier(this);
|
||||
|
||||
|
@ -323,12 +322,10 @@ NS_IMETHODIMP nsSVGTransformList::ReplaceItem(nsIDOMSVGTransform *newItem,
|
|||
}
|
||||
|
||||
nsCOMPtr<nsISVGValue> val = do_QueryInterface(oldItem);
|
||||
if (val)
|
||||
val->RemoveObserver(this);
|
||||
val->RemoveObserver(this);
|
||||
NS_RELEASE(oldItem);
|
||||
val = do_QueryInterface(newItem);
|
||||
if (val)
|
||||
val->AddObserver(this);
|
||||
val->AddObserver(this);
|
||||
NS_ADDREF(newItem);
|
||||
|
||||
*_retval = newItem;
|
||||
|
@ -355,8 +352,7 @@ NS_IMETHODIMP nsSVGTransformList::RemoveItem(PRUint32 index, nsIDOMSVGTransform
|
|||
}
|
||||
|
||||
nsCOMPtr<nsISVGValue> val = do_QueryInterface(*_retval);
|
||||
if (val)
|
||||
val->RemoveObserver(this);
|
||||
val->RemoveObserver(this);
|
||||
|
||||
// don't NS_ADDREF(*_retval)
|
||||
return NS_OK;
|
||||
|
@ -366,17 +362,15 @@ NS_IMETHODIMP nsSVGTransformList::RemoveItem(PRUint32 index, nsIDOMSVGTransform
|
|||
NS_IMETHODIMP nsSVGTransformList::AppendItem(nsIDOMSVGTransform *newItem,
|
||||
nsIDOMSVGTransform **_retval)
|
||||
{
|
||||
*_retval = newItem;
|
||||
if (!newItem)
|
||||
return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
|
||||
NS_ENSURE_NATIVE_TRANSFORM(newItem, _retval);
|
||||
|
||||
nsSVGValueAutoNotifier autonotifier(this);
|
||||
|
||||
if (!AppendElement(newItem)) {
|
||||
*_retval = nsnull;
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
*_retval = newItem;
|
||||
NS_ADDREF(*_retval);
|
||||
return NS_OK;
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче