Johnny Stenback (:jst) Assignee
	Description • 23 years ago

If a positive number is passed as the start of the substring and -1 (or MAX_INT)
is passed as the length mozilla crahses when trying to allocate close to MAX_INT
bytes of storage for the new string. Patch coming up.

	Johnny Stenback (:jst) Assignee
	Comment 1 • 23 years ago

Btw, this bug causes mozilla to crash when loading the official (soon to be
released) W3C DOM test suite.

	Ray Whitmer
	Comment 4 • 23 years ago

r=rayw

	vidur (gone)
	Comment 5 • 23 years ago

Comment on attachment 57987 [details] [diff] [review]
Same as above, but a bit cleaner...

sr=vidur

	Christopher Blizzard (:blizzard)
	Comment 6 • 23 years ago

This has been checked into the 0.9.6 branch.

	Jaime Rodriguez, Jr.
	Comment 7 • 23 years ago

Adding PDT for tracking and 6.2 branch review purposes.

	Johnny Stenback (:jst) Assignee
	Comment 8 • 23 years ago

This was checked in on the trunk as well, leaving open for possibly landing on
the 6.2 branch...

	Jaime Rodriguez, Jr.
	Comment 9 • 23 years ago

Pls check this one into the 6.2 branch before 9 am PST = PDT+

	Jaime Rodriguez, Jr.
	Comment 10 • 23 years ago

In johnny's absence, who feels comfortable checking this into the 6.2 branch?

	Johnny Stenback (:jst) Assignee
	Comment 11 • 23 years ago

I just got back, I'll land this on the branch ASAP.

	Johnny Stenback (:jst) Assignee
	Comment 12 • 23 years ago

Fixed on the 6.2 branch. Marking FIXED.

	Jaime Rodriguez, Jr.
	Comment 13 • 23 years ago

Thanks Johnny.

	Sivakiran Tummala
	Comment 14 • 23 years ago

Does not crash on both linux and win2k (2001-11-21-10). 
Should we throw the "INDEX_SIZE_ERR" exception instead of returning till the end 
of the string, like how we are doing if the offset is -1.
Adding the keyword vbranch

	Johnny Stenback (:jst) Assignee
	Comment 15 • 23 years ago

XPConnect should throw an error when a negative value is passed to a method that
takes unsigned values, and there's a bug on that, but no, we should not throw an
error if the numbers of characters requested is higher than the number of
characters available. That's how the DOM spec defines this method.

	Sivakiran Tummala
	Comment 17 • 23 years ago

verified on the four platforms  build 2001-11-26-6.2.1

	Sivakiran Tummala
	Comment 18 • 23 years ago

reopening bug, Does not crash anymore. Returns the substring from the offset to 
the end of the string for negative data. comment # 16 has testcase.
Should throw INDEX_SIZE_ERR. This bug is a regression.

	Johnny Stenback (:jst) Assignee
	Comment 19 • 23 years ago

See comment #15. This bug is FIXED.

	Sivakiran Tummala
	Comment 20 • 23 years ago

agree, INDEX_SIZE_ERR is another bug. Marking Verified