author Nicholas Nethercote <>
Thu, 22 Oct 2015 22:48:40 -0700
changeset 269446 588e410c0ddb76ce261c9c0bd344b1ad634fcb32
parent 158784 20ba1c3ccad8d5f6f0d38885cc47187b81cb5c37
permissions -rw-r--r--
Bug 1187784 (part 8) - Replace nsBaseHashtable::EnumerateRead() calls in layout/ with iterators. r=heycam. This fixes a type bug in CSSVariableDeclarations::MapRuleInfoInto(). The existing code passes aRuleData->mVariables.get(), which has type |CSSVariableDeclarations*|, into the |void*| parameter to EnumerateRead(). It then extracts that in EnumerateVariableForMapRuleInfoInto() via a cast to a different type, |nsDataHashtable<nsStringHashKey, nsString>*|. It's missing an intermediate access of CSSVariableDeclarations::mVariables. It's likely that this hasn't (seemingly) caused problems prior to now because mVariables is the only field in CSSVariableDeclarations, so mVariables->mVariables is at the same address as mVariables.

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at */

#include "nsISupports.idl"

interface nsIDOMFontFace;

[scriptable, uuid(2538579c-9472-4fd9-8dc1-d44ce4c1b7ba)]
interface nsIDOMFontFaceList : nsISupports
  nsIDOMFontFace                    item(in unsigned long index);
  readonly attribute unsigned long  length;