Closed Bug 1076587 Opened 10 years ago Closed 10 years ago

Null deref unsetting img sizes attribute

Categories

(Core :: DOM: Core & HTML, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla36

People

(Reporter: johns, Assigned: johns)

References

Details

Attachments

(2 files)

removeAttribute("sizes") explodes (covered in picture mutation tests)
Enhances this helper to also let us avoid this dance: aValue ? aValue->GetStringValue() : EmptyString()
Attachment #8498593 - Flags: review?(bzbarsky)
Blocks: 1037643
Use enhanced nsAttrValueOrString helper to avoid this dance. (I'm not sure how I managed to get this right three-of-four times in this function)
Attachment #8498594 - Flags: review?(bzbarsky)
Comment on attachment 8498593 [details] [diff] [review] Allow nsAttrValueOrString helper to accept potentially-null pointers r=me, though it seems like a ctor overload explicitly taking nullptr and setting mStringPtr to &mCheapString would work just as well and not need the extra runtime check in String().
Attachment #8498593 - Flags: review?(bzbarsky) → review+
Comment on attachment 8498594 [details] [diff] [review] Avoid null deref in HTMLImageElement::AfterSetAttr with <picture> enabled r=me
Attachment #8498594 - Flags: review?(bzbarsky) → review+
(In reply to Boris Zbarsky [:bz] from comment #3) > Comment on attachment 8498593 [details] [diff] [review] > Allow nsAttrValueOrString helper to accept potentially-null pointers > > r=me, though it seems like a ctor overload explicitly taking nullptr and > setting mStringPtr to &mCheapString would work just as well and not need the > extra runtime check in String(). Not sure I understand -- If we had an |explicit nsAttrValueOrString(std::nullptr_t)| constructor we'd still need a runtime null check at the declaration site to select it, vs a lazy-null check only when .String() is called
> we'd still need a runtime null check at the declaration site to select it Ah, because you're not actually constructing with nullptr, just with a might-be-null pointer? Right, never mind then!
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: