Closed
Bug 1076587
Opened 10 years ago
Closed 10 years ago
Null deref unsetting img sizes attribute
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
RESOLVED
FIXED
mozilla36
People
(Reporter: johns, Assigned: johns)
References
Details
Attachments
(2 files)
(deleted),
patch
|
bzbarsky
:
review+
|
Details | Diff | Splinter Review |
(deleted),
patch
|
bzbarsky
:
review+
|
Details | Diff | Splinter Review |
removeAttribute("sizes") explodes (covered in picture mutation tests)
Assignee | ||
Comment 1•10 years ago
|
||
Enhances this helper to also let us avoid this dance: aValue ? aValue->GetStringValue() : EmptyString()
Attachment #8498593 -
Flags: review?(bzbarsky)
Assignee | ||
Comment 2•10 years ago
|
||
Use enhanced nsAttrValueOrString helper to avoid this dance.
(I'm not sure how I managed to get this right three-of-four times in this function)
Attachment #8498594 -
Flags: review?(bzbarsky)
Comment 3•10 years ago
|
||
Comment on attachment 8498593 [details] [diff] [review]
Allow nsAttrValueOrString helper to accept potentially-null pointers
r=me, though it seems like a ctor overload explicitly taking nullptr and setting mStringPtr to &mCheapString would work just as well and not need the extra runtime check in String().
Attachment #8498593 -
Flags: review?(bzbarsky) → review+
Comment 4•10 years ago
|
||
Comment on attachment 8498594 [details] [diff] [review]
Avoid null deref in HTMLImageElement::AfterSetAttr with <picture> enabled
r=me
Attachment #8498594 -
Flags: review?(bzbarsky) → review+
Assignee | ||
Comment 5•10 years ago
|
||
(In reply to Boris Zbarsky [:bz] from comment #3)
> Comment on attachment 8498593 [details] [diff] [review]
> Allow nsAttrValueOrString helper to accept potentially-null pointers
>
> r=me, though it seems like a ctor overload explicitly taking nullptr and
> setting mStringPtr to &mCheapString would work just as well and not need the
> extra runtime check in String().
Not sure I understand -- If we had an |explicit nsAttrValueOrString(std::nullptr_t)| constructor we'd still need a runtime null check at the declaration site to select it, vs a lazy-null check only when .String() is called
Comment 6•10 years ago
|
||
> we'd still need a runtime null check at the declaration site to select it
Ah, because you're not actually constructing with nullptr, just with a might-be-null pointer?
Right, never mind then!
Assignee | ||
Comment 7•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/03b6a747eac1
https://hg.mozilla.org/mozilla-central/rev/6345f1767ed7
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•