diff options
| author | asargent@chromium.org <asargent@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-01-12 18:06:44 +0000 |
|---|---|---|
| committer | asargent@chromium.org <asargent@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-01-12 18:06:44 +0000 |
| commit | 3fbc8276f724079cb0e0ddd3899c3b49a40e11d9 (patch) | |
| tree | f81694a88b135db0c63f76a9b93b94493f10c377 /chrome | |
| parent | ff54b86b3c876c421f4143814a3f4e27dcaae5c1 (diff) | |
| download | chromium_src-3fbc8276f724079cb0e0ddd3899c3b49a40e11d9.zip chromium_src-3fbc8276f724079cb0e0ddd3899c3b49a40e11d9.tar.gz chromium_src-3fbc8276f724079cb0e0ddd3899c3b49a40e11d9.tar.bz2 | |
Fix a crash with application mode windows and extensions tab API.
From an application mode window, if you call chrome.tabs.create and specify a
index for the new tab (and had no other windows open), chrome will crash.
BUG=29810
TEST=Crash should no longer happen when following steps in the bug report.
Review URL: http://codereview.chromium.org/542018
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@36019 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome')
| -rw-r--r-- | chrome/browser/tabs/tab_strip_model.cc | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/chrome/browser/tabs/tab_strip_model.cc b/chrome/browser/tabs/tab_strip_model.cc index c8920aa..d143c55 100644 --- a/chrome/browser/tabs/tab_strip_model.cc +++ b/chrome/browser/tabs/tab_strip_model.cc @@ -414,8 +414,9 @@ void TabStripModel::AddTabContents(TabContents* contents, contents, transition, foreground); inherit_group = true; } else { - // For all other types, respect what was passed to us, normalizing -1s. - if (index < 0) + // For all other types, respect what was passed to us, normalizing -1s and + // values that are too large. + if (index < 0 || index > count()) index = count(); } |