From 517741de813e07ea92bd4bea1f311e6b9cb15ddd Mon Sep 17 00:00:00 2001 From: "bzbarsky%mit.edu" Date: Sat, 9 Nov 2002 17:43:33 +0000 Subject: [PATCH] Fix assertion from out-of-bounds array access. Bug 175440, r=timeless, sr=alecf git-svn-id: svn://10.0.0.236/trunk@133492 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/xpcom/threads/nsThread.cpp | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/mozilla/xpcom/threads/nsThread.cpp b/mozilla/xpcom/threads/nsThread.cpp index 70c72fb6edf..ed2e07cb501 100644 --- a/mozilla/xpcom/threads/nsThread.cpp +++ b/mozilla/xpcom/threads/nsThread.cpp @@ -577,21 +577,20 @@ nsThreadPool::GetRequest(nsIThread* currentThread) nsCOMPtr request; nsAutoLock lock(mLock); - PRUint32 requestCnt; + PRInt32 requestCnt; while (PR_TRUE) { requestCnt = mPendingRequests.Count(); if (requestCnt > 0) { - PRInt32 pendingThread = 0; + PRInt32 pendingThread; PRInt32 runningPos; - while (PR_TRUE) { + for (pendingThread = 0; pendingThread < requestCnt; ++pendingThread) { request = mPendingRequests.ObjectAt(pendingThread); - // if we are breaking here, it means that either we have a bad - // request in our list, or all pending requests are being run on - // another worker thread. - if (request == nsnull) { - pendingThread = -1; + if (!request) { + NS_ERROR("Bad request in pending request list"); + // Make it look like we just found no runnable requests + pendingThread = requestCnt; break; } @@ -600,10 +599,10 @@ nsThreadPool::GetRequest(nsIThread* currentThread) if (runningPos == -1) break; - pendingThread++; } - if (pendingThread != -1) { + if (pendingThread < requestCnt) { + // Found something to run PRBool removed = mPendingRequests.RemoveObjectAt(pendingThread); NS_ASSERTION(removed, "nsCOMArray broken"); PR_LOG(nsIThreadLog, PR_LOG_DEBUG,