Bug 743404: In nsHtml5TreeOperation::Perform, store the return-value of nsINode::IndexOf in a PRInt32 instead of a PRUint32, so we can range-check it. r=hsivonen
authorDaniel Holbert <dholbert@cs.stanford.edu>
Tue, 10 Apr 2012 10:44:49 -0700
changeset 94639 c5a10dbe276b95165d58ee9a760da76464c392f5
parent 94638 38f159e04083e31be9dd967b66898854c9946f6b
child 94640 c2ab1b9cb101ac8be36e48f52d54e7a6a26ae163
push id886
push userlsblakk@mozilla.com
push dateMon, 04 Jun 2012 19:57:52 +0000
treeherdermozilla-beta@bbd8d5efd6d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewershsivonen
bugs743404
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 743404: In nsHtml5TreeOperation::Perform, store the return-value of nsINode::IndexOf in a PRInt32 instead of a PRUint32, so we can range-check it. r=hsivonen
parser/html/nsHtml5TreeOperation.cpp
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -267,17 +267,17 @@ nsHtml5TreeOperation::Perform(nsHtml5Tre
     }
     case eTreeOpDetach: {
       nsIContent* node = *(mOne.node);
       aBuilder->FlushPendingAppendNotifications();
       nsCOMPtr<nsIContent> parent = node->GetParent();
       if (parent) {
         nsHtml5OtherDocUpdate update(parent->OwnerDoc(),
                                      aBuilder->GetDocument());
-        PRUint32 pos = parent->IndexOf(node);
+        PRInt32 pos = parent->IndexOf(node);
         NS_ASSERTION((pos >= 0), "Element not found as child of its parent");
         parent->RemoveChildAt(pos, true);
       }
       return NS_OK;
     }
     case eTreeOpAppendChildrenToNewParent: {
       nsCOMPtr<nsIContent> node = *(mOne.node);
       nsIContent* parent = *(mTwo.node);