Avoid possible double-delete of CSS declaration. Bug 196271, r+sr=dbaron

git-svn-id: svn://10.0.0.236/trunk@139590 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzbarsky%mit.edu
2003-03-17 03:46:17 +00:00
parent f0eaf3702e
commit 56379f8173
4 changed files with 34 additions and 16 deletions

View File

@@ -82,7 +82,7 @@ nsDOMCSSAttributeDeclaration::RemoveProperty(const nsAString& aPropertyName,
rv = decl->RemoveProperty(prop, val);
if (NS_SUCCEEDED(rv)) {
rv = SetCSSDeclaration(decl, PR_TRUE);
rv = SetCSSDeclaration(decl, PR_TRUE, PR_TRUE);
} else {
// RemoveProperty will throw in all sorts of situations -- eg if
// the property is a shorthand one. Do not propagate its return
@@ -102,13 +102,20 @@ nsDOMCSSAttributeDeclaration::DropReference()
nsresult
nsDOMCSSAttributeDeclaration::SetCSSDeclaration(nsCSSDeclaration* aDecl,
PRBool aNotify)
PRBool aNotify,
PRBool aDeclOwnedByRule)
{
NS_ASSERTION(mContent, "Must have content node to set the decl!");
NS_PRECONDITION(aDecl, "Null decl!");
nsCOMPtr<nsICSSStyleRule> cssRule;
nsresult rv = NS_NewCSSStyleRule(getter_AddRefs(cssRule), nsCSSSelector());
NS_ENSURE_SUCCESS(rv, rv);
if (NS_FAILED(rv)) {
if (!aDeclOwnedByRule) {
aDecl->RuleAbort();
}
return rv;
}
cssRule->SetDeclaration(aDecl);
cssRule->SetWeight(PR_INT32_MAX);
@@ -138,9 +145,8 @@ nsDOMCSSAttributeDeclaration::GetCSSDeclaration(nsCSSDeclaration **aDecl,
else if (aAllocate) {
result = NS_NewCSSDeclaration(aDecl);
if (NS_SUCCEEDED(result)) {
result = SetCSSDeclaration(*aDecl, PR_FALSE);
result = SetCSSDeclaration(*aDecl, PR_FALSE, PR_FALSE);
if (NS_FAILED(result)) {
(*aDecl)->RuleAbort();
*aDecl = nsnull;
}
}
@@ -229,7 +235,7 @@ nsDOMCSSAttributeDeclaration::ParsePropertyValue(const nsAString& aPropName,
result = cssParser->ParseProperty(aPropName, aPropValue, baseURI, decl,
&uselessHint);
if (NS_SUCCEEDED(result)) {
result = SetCSSDeclaration(decl, PR_TRUE);
result = SetCSSDeclaration(decl, PR_TRUE, PR_TRUE);
}
if (cssLoader) {
@@ -287,7 +293,7 @@ nsDOMCSSAttributeDeclaration::ParseDeclaration(const nsAString& aDecl,
&uselessHint);
if (NS_SUCCEEDED(result)) {
result = SetCSSDeclaration(decl, PR_TRUE);
result = SetCSSDeclaration(decl, PR_TRUE, PR_TRUE);
}
if (cssLoader) {

View File

@@ -59,6 +59,8 @@ public:
nsAString& aReturn);
virtual void DropReference();
// If GetCSSDeclaration returns non-null, then the decl it returns
// is owned by our current style rule.
virtual nsresult GetCSSDeclaration(nsCSSDeclaration **aDecl,
PRBool aAllocate);
virtual nsresult GetCSSParsingEnvironment(nsIContent* aContent,
@@ -73,7 +75,8 @@ public:
virtual nsresult GetParent(nsISupports **aParent);
protected:
nsresult SetCSSDeclaration(nsCSSDeclaration* aDecl, PRBool aNotify);
nsresult SetCSSDeclaration(nsCSSDeclaration* aDecl, PRBool aNotify,
PRBool aDeclOwnedByRule);
nsIHTMLContent *mContent;
};

View File

@@ -82,7 +82,7 @@ nsDOMCSSAttributeDeclaration::RemoveProperty(const nsAString& aPropertyName,
rv = decl->RemoveProperty(prop, val);
if (NS_SUCCEEDED(rv)) {
rv = SetCSSDeclaration(decl, PR_TRUE);
rv = SetCSSDeclaration(decl, PR_TRUE, PR_TRUE);
} else {
// RemoveProperty will throw in all sorts of situations -- eg if
// the property is a shorthand one. Do not propagate its return
@@ -102,13 +102,20 @@ nsDOMCSSAttributeDeclaration::DropReference()
nsresult
nsDOMCSSAttributeDeclaration::SetCSSDeclaration(nsCSSDeclaration* aDecl,
PRBool aNotify)
PRBool aNotify,
PRBool aDeclOwnedByRule)
{
NS_ASSERTION(mContent, "Must have content node to set the decl!");
NS_PRECONDITION(aDecl, "Null decl!");
nsCOMPtr<nsICSSStyleRule> cssRule;
nsresult rv = NS_NewCSSStyleRule(getter_AddRefs(cssRule), nsCSSSelector());
NS_ENSURE_SUCCESS(rv, rv);
if (NS_FAILED(rv)) {
if (!aDeclOwnedByRule) {
aDecl->RuleAbort();
}
return rv;
}
cssRule->SetDeclaration(aDecl);
cssRule->SetWeight(PR_INT32_MAX);
@@ -138,9 +145,8 @@ nsDOMCSSAttributeDeclaration::GetCSSDeclaration(nsCSSDeclaration **aDecl,
else if (aAllocate) {
result = NS_NewCSSDeclaration(aDecl);
if (NS_SUCCEEDED(result)) {
result = SetCSSDeclaration(*aDecl, PR_FALSE);
result = SetCSSDeclaration(*aDecl, PR_FALSE, PR_FALSE);
if (NS_FAILED(result)) {
(*aDecl)->RuleAbort();
*aDecl = nsnull;
}
}
@@ -229,7 +235,7 @@ nsDOMCSSAttributeDeclaration::ParsePropertyValue(const nsAString& aPropName,
result = cssParser->ParseProperty(aPropName, aPropValue, baseURI, decl,
&uselessHint);
if (NS_SUCCEEDED(result)) {
result = SetCSSDeclaration(decl, PR_TRUE);
result = SetCSSDeclaration(decl, PR_TRUE, PR_TRUE);
}
if (cssLoader) {
@@ -287,7 +293,7 @@ nsDOMCSSAttributeDeclaration::ParseDeclaration(const nsAString& aDecl,
&uselessHint);
if (NS_SUCCEEDED(result)) {
result = SetCSSDeclaration(decl, PR_TRUE);
result = SetCSSDeclaration(decl, PR_TRUE, PR_TRUE);
}
if (cssLoader) {

View File

@@ -59,6 +59,8 @@ public:
nsAString& aReturn);
virtual void DropReference();
// If GetCSSDeclaration returns non-null, then the decl it returns
// is owned by our current style rule.
virtual nsresult GetCSSDeclaration(nsCSSDeclaration **aDecl,
PRBool aAllocate);
virtual nsresult GetCSSParsingEnvironment(nsIContent* aContent,
@@ -73,7 +75,8 @@ public:
virtual nsresult GetParent(nsISupports **aParent);
protected:
nsresult SetCSSDeclaration(nsCSSDeclaration* aDecl, PRBool aNotify);
nsresult SetCSSDeclaration(nsCSSDeclaration* aDecl, PRBool aNotify,
PRBool aDeclOwnedByRule);
nsIHTMLContent *mContent;
};