author Nicholas Nethercote <>
Thu, 22 Oct 2015 22:48:40 -0700
changeset 269446 588e410c0ddb76ce261c9c0bd344b1ad634fcb32
parent 268184 e8c7dfe727cd970e2c3294934e2927b14143c205
permissions -rw-r--r--
Bug 1187784 (part 8) - Replace nsBaseHashtable::EnumerateRead() calls in layout/ with iterators. r=heycam. This fixes a type bug in CSSVariableDeclarations::MapRuleInfoInto(). The existing code passes aRuleData->mVariables.get(), which has type |CSSVariableDeclarations*|, into the |void*| parameter to EnumerateRead(). It then extracts that in EnumerateVariableForMapRuleInfoInto() via a cast to a different type, |nsDataHashtable<nsStringHashKey, nsString>*|. It's missing an intermediate access of CSSVariableDeclarations::mVariables. It's likely that this hasn't (seemingly) caused problems prior to now because mVariables is the only field in CSSVariableDeclarations, so mVariables->mVariables is at the same address as mVariables.

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at */

#ifndef __nsFontFace_h__
#define __nsFontFace_h__

#include "nsIDOMFontFace.h"
#include "nsAutoPtr.h"

class gfxFontEntry;
class gfxFontGroup;

class nsFontFace : public nsIDOMFontFace

  nsFontFace(gfxFontEntry*      aFontEntry,
             gfxFontGroup*      aFontGroup,
             uint8_t            aMatchInfo);

  gfxFontEntry* GetFontEntry() const { return mFontEntry.get(); }

  void AddMatchType(uint8_t aMatchType) {
    mMatchType |= aMatchType;

  virtual ~nsFontFace();

  RefPtr<gfxFontEntry> mFontEntry;
  RefPtr<gfxFontGroup> mFontGroup;
  uint8_t mMatchType;

#endif // __nsFontFace_h__