Bug 201596 nsScrollPortView::ScrollTo could trigger a crash if new PRInt32[SMOOTH_SCROLL_FRAMES*2]; failed

r=roc+moz sr=roc+moz

view/src/nsScrollPortView.cpp

@@ -66,6 +66,20 @@ static NS_DEFINE_IID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
 
 #define SMOOTH_SCROLL_PREF_NAME "general.smoothScroll"
 
+class SmoothScroll {
+public:
+  SmoothScroll() {}
+  ~SmoothScroll() {
+    if (mScrollAnimationTimer) mScrollAnimationTimer->Cancel();
+  }
+
+  nsCOMPtr<nsITimer> mScrollAnimationTimer;
+  PRInt32 mVelocities[SMOOTH_SCROLL_FRAMES*2];
+  PRInt32 mFrameIndex;
+  nscoord mDestinationX;
+  nscoord mDestinationY;
+};
+
 nsScrollPortView::nsScrollPortView()
 {
   mOffsetX = mOffsetY = 0;
@@ -321,20 +335,17 @@ NS_IMETHODIMP nsScrollPortView::ScrollTo(nscoord aDestinationX, nscoord aDestina
       if (!mSmoothScroll->mScrollAnimationTimer) {
         delete mSmoothScroll;
         mSmoothScroll = nsnull;
-      } else {
-        mSmoothScroll->mScrollAnimationTimer->InitWithFuncCallback(
-          SmoothScrollAnimationCallback, this, SMOOTH_SCROLL_MSECS_PER_FRAME,
-          nsITimer::TYPE_REPEATING_PRECISE);
       }
     }
     if (!mSmoothScroll) {
       // some allocation failed. Scroll the normal way.
       return ScrollToImpl(aDestinationX, aDestinationY, aUpdateFlags);
     }
-  
+    mSmoothScroll->mScrollAnimationTimer->InitWithFuncCallback(
+      SmoothScrollAnimationCallback, this, SMOOTH_SCROLL_MSECS_PER_FRAME,
+      nsITimer::TYPE_REPEATING_PRECISE);
     mSmoothScroll->mDestinationX = mOffsetX;
     mSmoothScroll->mDestinationY = mOffsetY;
-    mSmoothScroll->mVelocities = new PRInt32[SMOOTH_SCROLL_FRAMES*2];
   }
 
   // need to store these so we know when to stop scrolling

view/src/nsScrollPortView.h

@@ -44,6 +44,7 @@
 #include "nsITimer.h"
 
 class nsISupportsArray;
+class SmoothScroll;
 
 //this is a class that acts as a container for other views and provides
 //automatic management of scrolling of the views it contains.
@@ -103,28 +104,13 @@ private:
   NS_IMETHOD_(nsrefcnt) Release(void);
   NS_IMETHOD  ScrollToImpl(nscoord aX, nscoord aY, PRUint32 aUpdateFlags);
 
-  class SmoothScroll {
-  public:
-    SmoothScroll() { mVelocities = nsnull; }
-    ~SmoothScroll() {
-      if (mScrollAnimationTimer) mScrollAnimationTimer->Cancel();
-       delete[] mVelocities;
-     }
+  // data members
+  SmoothScroll* mSmoothScroll;
 
-     nsCOMPtr<nsITimer> mScrollAnimationTimer;
-     PRInt32            mFrameIndex;
-     PRInt32*           mVelocities;
-     nscoord            mDestinationX;
-     nscoord            mDestinationY;
-   };
-
-   // data members
-   SmoothScroll*        mSmoothScroll;
-
-   // methods
-   void        IncrementalScroll();
-   PRBool      IsSmoothScrollingEnabled();
-   static void SmoothScrollAnimationCallback(nsITimer *aTimer, void* aESM);
+  // methods
+  void        IncrementalScroll();
+  PRBool      IsSmoothScrollingEnabled();
+  static void SmoothScrollAnimationCallback(nsITimer *aTimer, void* aESM);
 
 protected:
   virtual ~nsScrollPortView();