Bug 1512758. r=smaug
authorHenri Sivonen <hsivonen@hsivonen.fi>
Thu, 20 Dec 2018 09:15:58 +0000
changeset 509369 e0d35b7a804edaaa29c339e3e1971c410fd6437d
parent 509368 11580728adf0ca32a5bdf0b276385979c535ec0c
child 509370 21df4d7e3350aae0b836b6833d38ea4640fbcb8f
push id10547
push userffxbld-merge
push dateMon, 21 Jan 2019 13:03:58 +0000
treeherdermozilla-beta@24ec1916bffe [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug
bugs1512758
milestone66.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1512758. r=smaug Differential Revision: https://phabricator.services.mozilla.com/D14141
dom/base/nsContentUtils.cpp
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -8584,18 +8584,21 @@ class StringBuilder {
     Unit* u = AddUnit();
     u->mTextFragment = aTextFragment;
     u->mType = Unit::eTextFragmentWithEncode;
     u->mLength = aLen;
     mLength += aLen;
   }
 
   bool ToString(nsAString& aOut) {
+    if (!mLength.isValid()) {
+      return false;
+    }
     nsresult rv;
-    BulkAppender appender(aOut.BulkWrite(mLength, 0, true, rv));
+    BulkAppender appender(aOut.BulkWrite(mLength.value(), 0, true, rv));
     if (NS_FAILED(rv)) {
       return false;
     }
 
     for (StringBuilder* current = this; current; current = current->mNext) {
       uint32_t len = current->mUnits.Length();
       for (uint32_t i = 0; i < len; ++i) {
         Unit& u = current->mUnits[i];
@@ -8720,17 +8723,17 @@ class StringBuilder {
       aAppender.Append(aStr.FromTo(flushedUntil, currentPosition));
     }
   }
 
   AutoTArray<Unit, STRING_BUFFER_UNITS> mUnits;
   nsAutoPtr<StringBuilder> mNext;
   StringBuilder* mLast;
   // mLength is used only in the first StringBuilder object in the linked list.
-  uint32_t mLength;
+  CheckedInt<uint32_t> mLength;
 };
 
 }  // namespace
 
 static void AppendEncodedCharacters(const nsTextFragment* aText,
                                     StringBuilder& aBuilder) {
   uint32_t extraSpaceNeeded = 0;
   uint32_t len = aText->GetLength();