Bug 1286911. r=wchen.

MozReview-Commit-ID: hzAu0jKAxt
2016-09-27 13:47:53 +03:00
parent 8f7fd3f8a5
commit 4eb7f7145d
5 changed files with 39 additions and 24 deletions
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -158,6 +158,7 @@ class nsHtml5Tokenizer
  private:
    inline void appendCharRefBuf(char16_t c)
    {
+      MOZ_RELEASE_ASSERT(charRefBufLen < charRefBuf.length, "Attempted to overrun charRefBuf!");
      charRefBuf[charRefBufLen++] = c;
    }

@@ -179,7 +180,17 @@ class nsHtml5Tokenizer
      strBufLen = 0;
    }

-    void appendStrBuf(char16_t c);
+    inline void appendStrBuf(char16_t c)
+    {
+      MOZ_ASSERT(strBufLen < strBuf.length, "Previous buffer length insufficient.");
+      if (MOZ_UNLIKELY(strBufLen == strBuf.length)) {
+        if (MOZ_UNLIKELY(!EnsureBufferSpace(1))) {
+          MOZ_CRASH("Unable to recover from buffer reallocation failure");
+        }
+      }
+      strBuf[strBufLen++] = c;
+    }
+
  protected:
    nsString* strBufToString();
  private: