Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed crash due to blind-cast of frame to rowFrame by checking the frame type first. r=karnaze sr=waterson b=88849

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@99431 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
attinasi%netscape.com
2001-07-17 20:27:01 +00:00
parent 5991d829e0
commit 45460da542
2 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp
View File

@@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame,
NS_ENSURE_ARG_POINTER(aFrame);
NS_ENSURE_ARG_POINTER(aLineNumberResult);
// make sure it is a rowFrame in the RowGroup
// - it should be, but we do not validate in every case (see bug 88849)
nsCOMPtr<nsIAtom> frameType;
aFrame->GetFrameType(getter_AddRefs(frameType));
if (frameType.get() != nsLayoutAtoms::tableRowFrame) {
NS_WARNING("RowGroup contains a frame that is not a row");
*aLineNumberResult = 0;
return NS_ERROR_FAILURE;
}
nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame;
*aLineNumberResult = rowFrame->GetRowIndex();

10
mozilla/layout/tables/nsTableRowGroupFrame.cpp
View File

@@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame,
NS_ENSURE_ARG_POINTER(aFrame);
NS_ENSURE_ARG_POINTER(aLineNumberResult);
// make sure it is a rowFrame in the RowGroup
// - it should be, but we do not validate in every case (see bug 88849)
nsCOMPtr<nsIAtom> frameType;
aFrame->GetFrameType(getter_AddRefs(frameType));
if (frameType.get() != nsLayoutAtoms::tableRowFrame) {
NS_WARNING("RowGroup contains a frame that is not a row");
*aLineNumberResult = 0;
return NS_ERROR_FAILURE;
}
nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame;
*aLineNumberResult = rowFrame->GetRowIndex();