Bug 620242 - [@ JetpackActorCommon::RecList::remove] mishandles node, r+a=jst
authorBen Newman <mozilla+ben@benjamn.com>
Wed, 22 Dec 2010 14:20:00 -0800
changeset 59755 804aa1c428d2ecc51472618bf6d6afe434bee596
parent 59754 3cd71040a01f9776ffeb20d88270b0518d091e6a
child 59756 bbb7cd978802863fba71108ed4773db0261f24eb
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
bugs620242
milestone2.0b9pre
Bug 620242 - [@ JetpackActorCommon::RecList::remove] mishandles node, r+a=jst
js/jetpack/JetpackActorCommon.cpp
--- a/js/jetpack/JetpackActorCommon.cpp
+++ b/js/jetpack/JetpackActorCommon.cpp
@@ -510,18 +510,19 @@ JetpackActorCommon::RecList::remove(jsva
   }
   if (!mHead)
     return;
   RecNode* prev = mHead, *node = prev->down;
   while (node) {
     if (node->value() == v) {
       prev->down = node->down;
       delete node;
-    }
-    node = (prev = node)->down;
+    } else
+      prev = node;
+    node = prev->down;
   }
 }
 
 void
 JetpackActorCommon::RecList::copyTo(nsTArray<jsval>& dst) const
 {
   dst.Clear();
   for (RecNode* node = mHead; node; node = node->down)