Bug 667336. Make sure we don't overflow unsigned int on item(). r=peterv

2011-07-26 10:01:31 -04:00 · 2011-07-26 10:01:31 -04:00 · 52643f3c51
--- a/content/base/crashtests/667336-1.html
+++ b/content/base/crashtests/667336-1.html
@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("div").children.item(-1);
+</script>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -92,3 +92,4 @@ load 637214-2.svg
 load 642022-1.html
 load 646184.html
 load 658845-1.svg
+load 667336-1.html
--- a/content/base/src/nsContentList.cpp
+++ b/content/base/src/nsContentList.cpp
@ -527,7 +527,7 @@ nsContentList::Item(PRUint32 aIndex, PRBool aDoFlush)
  }

  if (mState != LIST_UP_TO_DATE)
-    PopulateSelf(aIndex+1);
+    PopulateSelf(NS_MIN(aIndex, PR_UINT32_MAX - 1) + 1);

  ASSERT_IN_SYNC;
  NS_ASSERTION(!mRootNode || mState != LIST_DIRTY,