diff options
| author | tschmelcher@chromium.org <tschmelcher@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-11-17 22:06:48 +0000 |
|---|---|---|
| committer | tschmelcher@chromium.org <tschmelcher@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-11-17 22:06:48 +0000 |
| commit | 760512fc317763908b2b23dbcd46b935d3c4d175 (patch) | |
| tree | 837f6e4ab2cf9524a32310e0a55324e86a0b770a /o3d/build | |
| parent | 4c8801901348be205d70c3559b7b92b1a7ccda3f (diff) | |
| download | chromium_src-760512fc317763908b2b23dbcd46b935d3c4d175.zip chromium_src-760512fc317763908b2b23dbcd46b935d3c4d175.tar.gz chromium_src-760512fc317763908b2b23dbcd46b935d3c4d175.tar.bz2 | |
Fix a crash in Chrome where the value of location.href is sometimes a "void" NPVariant instead of a string, causing us to construct a std::string from an invalid pointer and length. This may have previously been "hidden" by a coincidence of stack layout that made the uninitialized length be 0, but it is now very reproducible.
Also fix a leaked ref count on the location object.
TEST=repro'ed the void location.href issue in Chrome 8.0.552.200 on Windows and verified no crash
BUG=none
Review URL: http://codereview.chromium.org/5092005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@66522 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'o3d/build')
0 files changed, 0 insertions, 0 deletions