Bug 798065 - Fix integer underflow in nsTArray::LastIndexOf. r=cjones
authorWilliam Chen <wchen@mozilla.com>
Thu, 04 Oct 2012 15:23:41 -0700
changeset 109544 8c53914f34b03f0ebaf985e7578b14b25c752532
parent 109543 9c483486bf39341a159698a54a5a0081020fdc8d
child 109545 5364c43651c13fc8f90c1ab3d1d80c4d7631017c
push id23632
push userphilringnalda@gmail.com
push dateSun, 07 Oct 2012 19:14:37 +0000
treeherdermozilla-central@83d38854c21e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerscjones
bugs798065
milestone18.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 798065 - Fix integer underflow in nsTArray::LastIndexOf. r=cjones
xpcom/glue/nsTArray.h
xpcom/tests/TestTArray.cpp
--- a/xpcom/glue/nsTArray.h
+++ b/xpcom/glue/nsTArray.h
@@ -652,19 +652,18 @@ public:
   // @param item   The item to search for.
   // @param start  The index to start from.  If greater than or equal to the
   //               length of the array, then the entire array is searched.
   // @param comp   The Comparator used to determine element equality.
   // @return       The index of the found element or NoIndex if not found.
   template<class Item, class Comparator>
   index_type LastIndexOf(const Item& item, index_type start,
                          const Comparator& comp) const {
-    if (start >= Length())
-      start = Length() - 1;
-    const elem_type* end = Elements() - 1, *iter = end + start + 1;
+    size_type endOffset = start >= Length() ? Length() : start + 1;
+    const elem_type* end = Elements() - 1, *iter = end + endOffset;
     for (; iter != end; --iter) {
       if (comp.Equals(*iter, item))
         return index_type(iter - Elements());
     }
     return NoIndex;
   }
 
   // This method searches for the offset of the last element in this
--- a/xpcom/tests/TestTArray.cpp
+++ b/xpcom/tests/TestTArray.cpp
@@ -116,16 +116,22 @@ static bool test_basic_array(ElementType
     return false;
   uint32_t cap = ary.Capacity();
   ary.RemoveElementsAt(copy.Length(), copy.Length());
   ary.Compact();
   if (ary.Capacity() == cap)
     return false;
 
   ary.Clear();
+  if (ary.IndexOf(extra) != UINT32_MAX)
+    return false;
+  if (ary.LastIndexOf(extra) != UINT32_MAX)
+    return false;
+
+  ary.Clear();
   if (!ary.IsEmpty() || ary.Elements() == nullptr)
     return false;
   if (!(ary == nsTArray<ElementType>()))
     return false;
   if (ary == copy)
     return false;
   if (ary.SafeElementAt(0, extra) != extra ||
       ary.SafeElementAt(10, extra) != extra)