From 9f868d3f52042a76060661b61a95cc92a206c06e Mon Sep 17 00:00:00 2001 From: "brendan%mozilla.org" Date: Sat, 20 Nov 2004 02:34:09 +0000 Subject: [PATCH] In the Replace-calls-Insert case, where V is an XMLList, avoid creating holes and botching x.[[Length]] (246441 followup, rs=shaver). git-svn-id: svn://10.0.0.236/trunk@165538 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsxml.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/mozilla/js/src/jsxml.c b/mozilla/js/src/jsxml.c index c64642a8f7f..223d4fac80a 100644 --- a/mozilla/js/src/jsxml.c +++ b/mozilla/js/src/jsxml.c @@ -3394,8 +3394,6 @@ Replace(JSContext *cx, JSXML *xml, jsval id, jsval v) if (i >= n) { if (!IndexToIdVal(cx, n, &id)) return JS_FALSE; - if (!XMLARRAY_INSERT(cx, &xml->xml_kids, n, NULL)) - return JS_FALSE; i = n; } @@ -3408,14 +3406,14 @@ Replace(JSContext *cx, JSXML *xml, jsval id, jsval v) switch (vxml ? vxml->xml_class : JSXML_CLASS_LIMIT) { case JSXML_CLASS_ELEMENT: + /* OPTION: enforce that descendants have superset namespaces. */ case JSXML_CLASS_COMMENT: case JSXML_CLASS_PROCESSING_INSTRUCTION: case JSXML_CLASS_TEXT: - /* OPTION: enforce that descendants have superset namespaces. */ goto do_replace; case JSXML_CLASS_LIST: - if (xml->xml_kids.vector[i] && !DeleteByIndex(cx, xml, id, &junk)) + if (i < n && !DeleteByIndex(cx, xml, id, &junk)) return JS_FALSE; if (!Insert(cx, xml, id, v)) return JS_FALSE; @@ -3440,7 +3438,8 @@ Replace(JSContext *cx, JSXML *xml, jsval id, jsval v) js_DestroyXML(cx, kid); } } - XMLARRAY_SET_MEMBER(&xml->xml_kids, i, vxml); + if (!XMLARRAY_INSERT(cx, &xml->xml_kids, i, vxml)) + return JS_FALSE; break; }