From 45460da542fa7989c128a56820f10f1175d1b9f8 Mon Sep 17 00:00:00 2001 From: "attinasi%netscape.com" Date: Tue, 17 Jul 2001 20:27:01 +0000 Subject: [PATCH] Fixed crash due to blind-cast of frame to rowFrame by checking the frame type first. r=karnaze sr=waterson b=88849 git-svn-id: svn://10.0.0.236/trunk@99431 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp | 10 ++++++++++ mozilla/layout/tables/nsTableRowGroupFrame.cpp | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp b/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp index a0a797a32a5..d23233681c8 100644 --- a/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp +++ b/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp @@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame, NS_ENSURE_ARG_POINTER(aFrame); NS_ENSURE_ARG_POINTER(aLineNumberResult); + // make sure it is a rowFrame in the RowGroup + // - it should be, but we do not validate in every case (see bug 88849) + nsCOMPtr frameType; + aFrame->GetFrameType(getter_AddRefs(frameType)); + if (frameType.get() != nsLayoutAtoms::tableRowFrame) { + NS_WARNING("RowGroup contains a frame that is not a row"); + *aLineNumberResult = 0; + return NS_ERROR_FAILURE; + } + nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame; *aLineNumberResult = rowFrame->GetRowIndex(); diff --git a/mozilla/layout/tables/nsTableRowGroupFrame.cpp b/mozilla/layout/tables/nsTableRowGroupFrame.cpp index a0a797a32a5..d23233681c8 100644 --- a/mozilla/layout/tables/nsTableRowGroupFrame.cpp +++ b/mozilla/layout/tables/nsTableRowGroupFrame.cpp @@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame, NS_ENSURE_ARG_POINTER(aFrame); NS_ENSURE_ARG_POINTER(aLineNumberResult); + // make sure it is a rowFrame in the RowGroup + // - it should be, but we do not validate in every case (see bug 88849) + nsCOMPtr frameType; + aFrame->GetFrameType(getter_AddRefs(frameType)); + if (frameType.get() != nsLayoutAtoms::tableRowFrame) { + NS_WARNING("RowGroup contains a frame that is not a row"); + *aLineNumberResult = 0; + return NS_ERROR_FAILURE; + } + nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame; *aLineNumberResult = rowFrame->GetRowIndex();