- tbb-commits - lists.torproject.org

[tor-browser/esr24] Bug 944353. If we've had a decoder error then the image is not usable. r=seth a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 92a295290dd3e45c8df0749372db1891f04e5034 Author: Timothy Nikkel <tnikkel(a)gmail.com> Date: Wed Feb 26 21:48:51 2014 -0600 Bug 944353. If we've had a decoder error then the image is not usable. r=seth a=sledru This matches what RasterImage will do. --- image/src/Decoder.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/src/Decoder.cpp b/image/src/Decoder.cpp index 85845f6..2e3b36f 100644 --- a/image/src/Decoder.cpp +++ b/image/src/Decoder.cpp @@ -154,7 +154,7 @@ Decoder::Finish(RasterImage::eShutdownIntent aShutdownIntent) } } - bool usable = true; + bool usable = !HasDecoderError(); if (aShutdownIntent != RasterImage::eShutdownIntent_NotNeeded && !HasDecoderError()) { // If we only have a data error, we're usable if we have at least one complete frame. if (GetCompleteFrameCount() == 0) {

1 0

[tor-browser/esr24] Bug 966843 - Fix intermittent browser_615394-SSWindowState_events.js hangs. r=smacleod, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 467f9d81557f5f1222ca451340be61547b07c9ef Author: Tim Taubert <ttaubert(a)mozilla.com> Date: Mon Apr 14 12:03:18 2014 +0200 Bug 966843 - Fix intermittent browser_615394-SSWindowState_events.js hangs. r=smacleod, a=test-only --- .../sessionstore/test/browser_615394-SSWindowState_events.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/browser/components/sessionstore/test/browser_615394-SSWindowState_events.js b/browser/components/sessionstore/test/browser_615394-SSWindowState_events.js index f699083..26064be 100644 --- a/browser/components/sessionstore/test/browser_615394-SSWindowState_events.js +++ b/browser/components/sessionstore/test/browser_615394-SSWindowState_events.js @@ -2,7 +2,7 @@ * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ -const stateBackup = ss.getBrowserState(); +const stateBackup = JSON.parse(ss.getBrowserState()); const testState = { windows: [{ tabs: [ @@ -73,8 +73,7 @@ function runNextTest() { waitForBrowserState(testState, currentTest); } else { - ss.setBrowserState(stateBackup); - finish(); + waitForBrowserState(stateBackup, finish); } }

1 0

[tor-browser/esr24] Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 5977bbe71d2afc1b836080515fb9503db4a14bfa Author: Jeff Muizelaar <jmuizelaar(a)mozilla.com> Date: Fri Apr 11 10:25:01 2014 -0400 Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=abillings --- gfx/qcms/iccread.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gfx/qcms/iccread.c b/gfx/qcms/iccread.c index 5c72cf3..63bd090 100644 --- a/gfx/qcms/iccread.c +++ b/gfx/qcms/iccread.c @@ -1007,6 +1007,9 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size) source.size = size; source.valid = true; + if (size < 4) + return INVALID_PROFILE; + length = read_u32(src, 0); if (length <= size) { // shrink the area that we can read if appropriate

1 0

[tor-browser/esr24] Backed out changeset 42531d5e6ca2 (Bug 986843) for test failures
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit a79c2bfce5b8d2416d01250dbbaa7e6cf0dc1ae1 Author: Jon Coppeard <jcoppeard(a)mozilla.com> Date: Wed Apr 2 17:19:28 2014 +0100 Backed out changeset 42531d5e6ca2 (Bug 986843) for test failures --- js/src/gc/RootMarking.cpp | 2 +- js/src/gc/Zone.cpp | 1 + js/src/gc/Zone.h | 2 ++ js/src/jsapi.cpp | 29 +++++++++++------------------ js/src/jscompartment.cpp | 2 +- js/src/jscompartment.h | 2 +- js/src/jsgc.cpp | 4 ++-- 7 files changed, 19 insertions(+), 23 deletions(-) diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp index 88574f3..861c2d6 100644 --- a/js/src/gc/RootMarking.cpp +++ b/js/src/gc/RootMarking.cpp @@ -744,7 +744,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots) #endif for (CompartmentsIter c(rt); !c.done(); c.next()) - c->markRoots(trc); + c->mark(trc); /* The embedding can register additional roots here. */ for (size_t i = 0; i < rt->gcBlackRootTracers.length(); i++) { diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp index 0b6161c..5625b99 100644 --- a/js/src/gc/Zone.cpp +++ b/js/src/gc/Zone.cpp @@ -23,6 +23,7 @@ using namespace js::gc; JS::Zone::Zone(JSRuntime *rt) : rt(rt), allocator(this), + hold(false), ionUsingBarriers_(false), active(false), gcScheduled(false), diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h index 39e867d..73e7043 100644 --- a/js/src/gc/Zone.h +++ b/js/src/gc/Zone.h @@ -108,6 +108,8 @@ struct Zone : private JS::shadow::Zone, js::CompartmentVector compartments; + bool hold; + private: bool ionUsingBarriers_; diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp index 68b6afa..3632a74 100644 --- a/js/src/jsapi.cpp +++ b/js/src/jsapi.cpp @@ -3171,32 +3171,23 @@ JS_GetObjectId(JSContext *cx, JSObject *obj, jsid *idp) return JS_TRUE; } -class AutoCompartmentRooter : private JS::CustomAutoRooter +class AutoHoldZone { public: - explicit AutoCompartmentRooter(JSContext *cx, JSCompartment *comp - MOZ_GUARD_OBJECT_NOTIFIER_PARAM) - : CustomAutoRooter(cx), compartment(comp) + explicit AutoHoldZone(Zone *zone + MOZ_GUARD_OBJECT_NOTIFIER_PARAM) + : holdp(&zone->hold) { MOZ_GUARD_OBJECT_NOTIFIER_INIT; + *holdp = true; } - operator JSCompartment *() { - return compartment; - } - - JSCompartment *operator->() { - return compartment; - } - - protected: - virtual void trace(JSTracer *trc) - { - compartment->mark(); + ~AutoHoldZone() { + *holdp = false; } private: - JSCompartment *compartment; + bool *holdp; MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER }; @@ -3218,7 +3209,7 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, else zone = ((JSObject *)options.zoneSpec)->zone(); - AutoCompartmentRooter compartment(cx, NewCompartment(cx, zone, principals, options)); + JSCompartment *compartment = NewCompartment(cx, zone, principals, options); if (!compartment) return NULL; @@ -3227,6 +3218,8 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, rt->systemZone->isSystem = true; } + AutoHoldZone hold(compartment->zone()); + Rooted<GlobalObject *> global(cx); { AutoCompartment ac(cx, compartment); diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp index 2e66253..c448e10 100644 --- a/js/src/jscompartment.cpp +++ b/js/src/jscompartment.cpp @@ -488,7 +488,7 @@ JSCompartment::markAllCrossCompartmentWrappers(JSTracer *trc) } void -JSCompartment::markRoots(JSTracer *trc) +JSCompartment::mark(JSTracer *trc) { #ifdef JS_ION if (ionCompartment_) diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h index 1ef2ed8..6cc1bc8 100644 --- a/js/src/jscompartment.h +++ b/js/src/jscompartment.h @@ -293,7 +293,7 @@ struct JSCompartment WrapperEnum(JSCompartment *c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {} }; - void markRoots(JSTracer *trc); + void mark(JSTracer *trc); bool isDiscardingJitCode(JSTracer *trc); void sweep(js::FreeOp *fop, bool releaseTypes); void sweepCrossCompartmentWrappers(); diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp index 3157861..53a636e 100644 --- a/js/src/jsgc.cpp +++ b/js/src/jsgc.cpp @@ -2541,7 +2541,7 @@ SweepZones(FreeOp *fop, bool lastGC) while (read < end) { Zone *zone = *read++; - if (zone->wasGCStarted()) { + if (!zone->hold && zone->wasGCStarted()) { if (zone->allocator.arenas.arenaListsAreEmpty() || lastGC) { zone->allocator.arenas.checkEmptyFreeLists(); if (callback) @@ -2723,7 +2723,7 @@ BeginMarkPhase(JSRuntime *rt) } zone->scheduledForDestruction = false; - zone->maybeAlive = false; + zone->maybeAlive = zone->hold; zone->setPreservingCode(false); }

1 0

[tor-browser/esr24] Bug 919482 - Replace mozilla-banner.gif with a plain blue image in 163504-1*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 502d1968c2f842ae66b17de3865c9f19f0e6a909 Author: Ryan VanderMeulen <ryanvm(a)gmail.com> Date: Thu Mar 27 11:02:27 2014 -0400 Bug 919482 - Replace mozilla-banner.gif with a plain blue image in 163504-1*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only --- layout/reftests/bugs/163504-1-inner.html | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/layout/reftests/bugs/163504-1-inner.html b/layout/reftests/bugs/163504-1-inner.html index 85f9e15..602ce84 100644 --- a/layout/reftests/bugs/163504-1-inner.html +++ b/layout/reftests/bugs/163504-1-inner.html @@ -5,13 +5,14 @@ <style type="text/css"> html, body { height: 100%; } div { height: 3%; } +img { image-rendering: -moz-crisp-edges; } </style> </head> <body> -<div><img src="mozilla-banner.gif" width="100" style="height: 50%"></div> -<div><img src="mozilla-banner.gif" width="2" style="min-height: 50%"></div> -<div><img src="mozilla-banner.gif" width="100" style="max-height: 50%"></div> +<div><img src="blue-600x58.png" width="100" style="height: 50%"></div> +<div><img src="blue-600x58.png" width="2" style="min-height: 50%"></div> +<div><img src="blue-600x58.png" width="100" style="max-height: 50%"></div> <div><span style="position:relative; top: 30%">text</span></div> <div><span style="position:relative; bottom: 30%">text</span></div>

1 0

[tor-browser/esr24] Bug 987003 - Be more careful sandboxing javascript: URLs. r=bholley, a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 3f9092acb0075896fa3178c95601ffaa7f985779 Author: Boris Zbarsky <bzbarsky(a)mit.edu> Date: Wed Mar 26 21:44:25 2014 -0400 Bug 987003 - Be more careful sandboxing javascript: URLs. r=bholley, a=sledru --- dom/src/jsurl/nsJSProtocolHandler.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dom/src/jsurl/nsJSProtocolHandler.cpp b/dom/src/jsurl/nsJSProtocolHandler.cpp index de5ff3b..27b8ddb 100644 --- a/dom/src/jsurl/nsJSProtocolHandler.cpp +++ b/dom/src/jsurl/nsJSProtocolHandler.cpp @@ -282,7 +282,8 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel, nsIXPConnect *xpc = nsContentUtils::XPConnect(); nsCOMPtr<nsIXPConnectJSObjectHolder> sandbox; - rv = xpc->CreateSandbox(cx, principal, getter_AddRefs(sandbox)); + // Important: Use a null principal here + rv = xpc->CreateSandbox(cx, nullptr, getter_AddRefs(sandbox)); NS_ENSURE_SUCCESS(rv, rv); // The nsXPConnect sandbox API gives us a wrapper to the sandbox for

1 0

[tor-browser/esr24] Bug 909305 - Replace mozilla-banner.gif with a plain blue image in 163504-2*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit e8cf00433ffac6ed0c6294fe64f97910ba7710ee Author: Ryan VanderMeulen <ryanvm(a)gmail.com> Date: Thu Mar 27 11:02:26 2014 -0400 Bug 909305 - Replace mozilla-banner.gif with a plain blue image in 163504-2*.html since we aren't trying to test individual pixel differences in resized image painting there. r=tn, a=test-only --- layout/reftests/bugs/163504-2-inner.html | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/layout/reftests/bugs/163504-2-inner.html b/layout/reftests/bugs/163504-2-inner.html index 991b70c..e77cb44 100644 --- a/layout/reftests/bugs/163504-2-inner.html +++ b/layout/reftests/bugs/163504-2-inner.html @@ -5,13 +5,14 @@ <style type="text/css"> html, body { height: 100%; } div { height: 3%; } +img { image-rendering: -moz-crisp-edges; } </style> </head> <body> -<div><span><img src="mozilla-banner.gif" width="100" style="height: 50%"></span></div> -<div><span><img src="mozilla-banner.gif" width="2" style="min-height: 50%"></span></div> -<div><span><img src="mozilla-banner.gif" width="100" style="max-height: 50%"></span></div> +<div><span><img src="blue-600x58.png" width="100" style="height: 50%"></span></div> +<div><span><img src="blue-600x58.png" width="2" style="min-height: 50%"></span></div> +<div><span><img src="blue-600x58.png" width="100" style="max-height: 50%"></span></div> <div><span><span style="position:relative; top: 30%">text</span></span></div> <div><span><span style="position:relative; bottom: 30%">text</span></span></div>

1 0

[tor-browser/esr24] No bug, Automated HSTS preload list update from host bld-linux64-spot-445 - a=hsts-update
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 6d7f5993be49aef2dea38ef64a3188ff3c7e9a63 Author: ffxbld <none@none> Date: Sat Mar 29 03:15:06 2014 -0700 No bug, Automated HSTS preload list update from host bld-linux64-spot-445 - a=hsts-update --- security/manager/boot/src/nsSTSPreloadList.errors | 11 ++++++++++- security/manager/boot/src/nsSTSPreloadList.inc | 11 ++++++++--- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/security/manager/boot/src/nsSTSPreloadList.errors b/security/manager/boot/src/nsSTSPreloadList.errors index 83719ac..ec727af 100644 --- a/security/manager/boot/src/nsSTSPreloadList.errors +++ b/security/manager/boot/src/nsSTSPreloadList.errors @@ -1,3 +1,4 @@ +admin.google.com: did not receive HSTS header alpha.irccloud.com: could not connect to host api.mega.co.nz: could not connect to host api.recurly.com: did not receive HSTS header @@ -62,7 +63,11 @@ market.android.com: did not receive HSTS header medium.com: max-age too low: 2592000 my.alfresco.com: did not receive HSTS header mydigipass.com: did not receive HSTS header +mykolab.com: did not receive HSTS header neonisi.com: could not connect to host +nexth.de: could not connect to host +nexth.net: could not connect to host +nexth.us: could not connect to host openshift.redhat.com: did not receive HSTS header ottospora.nl: could not connect to host passport.yandex.by: did not receive HSTS header @@ -88,6 +93,9 @@ silentcircle.org: could not connect to host simon.butcher.name: max-age too low: 2629743 sites.google.com: did not receive HSTS header sol.io: could not connect to host +souyar.de: could not connect to host +souyar.net: could not connect to host +souyar.us: could not connect to host spreadsheets.google.com: did not receive HSTS header square.com: did not receive HSTS header ssl.google-analytics.com: did not receive HSTS header @@ -116,6 +124,7 @@ www.moneybookers.com: did not receive HSTS header www.neonisi.com: could not connect to host www.paycheckrecords.com: max-age too low: 86400 www.paypal.com: max-age too low: 14400 +www.roddis.net: did not receive HSTS header www.sandbox.mydigipass.com: could not connect to host www.surfeasy.com: did not receive HSTS header -zoo24.de: did not receive HSTS header +zoo24.de: max-age too low: 2592000 diff --git a/security/manager/boot/src/nsSTSPreloadList.inc b/security/manager/boot/src/nsSTSPreloadList.inc index 7269072..b0d59de9 100644 --- a/security/manager/boot/src/nsSTSPreloadList.inc +++ b/security/manager/boot/src/nsSTSPreloadList.inc @@ -8,7 +8,7 @@ /*****************************************************************************/ #include "mozilla/StandardInteger.h" -const PRTime gPreloadListExpirationTime = INT64_C(1405764355403000); +const PRTime gPreloadListExpirationTime = INT64_C(1406973929143000); class nsSTSPreload { @@ -69,7 +69,10 @@ static const nsSTSPreload kSTSPreloadList[] = { { "espra.com", true }, { "f-droid.org", true }, { "factor.cc", false }, + { "fairbill.com", true }, { "faq.lookout.com", false }, + { "feedbin.com", false }, + { "fiken.no", true }, { "forum.linode.com", false }, { "forum.quantifiedself.com", true }, { "gernert-server.de", true }, @@ -80,6 +83,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "grc.com", false }, { "grepular.com", true }, { "haste.ch", true }, + { "heha.co", true }, { "howrandom.org", true }, { "id.mayfirst.org", false }, { "inertianetworks.com", true }, @@ -109,6 +113,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "manager.linode.com", false }, { "matteomarescotti.name", true }, { "mattmccutchen.net", true }, + { "mbp.banking.co.at", false }, { "mediacru.sh", true }, { "mega.co.nz", false }, { "members.mayfirst.org", false }, @@ -117,7 +122,6 @@ static const nsSTSPreload kSTSPreloadList[] = { { "mudcrab.us", true }, { "my.onlime.ch", false }, { "my.xero.com", false }, - { "mykolab.com", true }, { "mylookout.com", false }, { "neg9.org", false }, { "neilwynne.com", false }, @@ -142,6 +146,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "roundcube.mayfirst.org", false }, { "sandbox.mydigipass.com", false }, { "securityheaders.com", true }, + { "semenkovich.com", true }, { "shodan.io", true }, { "silentcircle.com", false }, { "simbolo.co.uk", false }, @@ -165,6 +170,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "writeapp.me", false }, { "www.aclu.org", false }, { "www.apollo-auto.com", true }, + { "www.banking.co.at", false }, { "www.braintreepayments.com", false }, { "www.calyxinstitute.org", false }, { "www.cyveillance.com", true }, @@ -183,7 +189,6 @@ static const nsSTSPreload kSTSPreloadList[] = { { "www.mylookout.com", false }, { "www.noisebridge.net", false }, { "www.opsmate.com", true }, - { "www.roddis.net", false }, { "www.simbolo.co.uk", false }, { "www.simple.com", false }, { "www.therapynotes.com", false },

1 0

[tor-browser/esr24] Bug 895557 - Follow the spec when doing fragment navigation during page loads. r=bz, a=lsblakk
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 2018a919c20f8f2123a93853bc447fa3788f39cb Author: Olli Pettay <Olli.Pettay(a)helsinki.fi> Date: Sat Mar 1 21:07:42 2014 +0200 Bug 895557 - Follow the spec when doing fragment navigation during page loads. r=bz, a=lsblakk --- docshell/base/nsDocShell.cpp | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index 59cf956..1e602fd 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -8977,19 +8977,6 @@ nsDocShell::InternalLoad(nsIURI * aURI, sameExceptHashes && !newHash.IsEmpty()); if (doShortCircuitedLoad) { - // Cancel an outstanding new-document load if this is a history - // load. - // - // We can't cancel the oustanding load unconditionally, because if a - // page does - // - load a.html - // - start loading b.html - // - load a.html#h - // we break the web if we cancel the load of b.html. - if (aSHEntry && mDocumentRequest) { - mDocumentRequest->Cancel(NS_BINDING_ABORTED); - } - // Save the current URI; we need it if we fire a hashchange later. nsCOMPtr<nsIURI> oldURI = mCurrentURI; @@ -9024,6 +9011,8 @@ nsDocShell::InternalLoad(nsIURI * aURI, mURIResultedInDocument = true; + nsCOMPtr<nsISHEntry> oldLSHE = mLSHE; + /* we need to assign mLSHE to aSHEntry right here, so that on History loads, * SetCurrentURI() called from OnNewURI() will send proper * onLocationChange() notifications to the browser to update @@ -9101,10 +9090,10 @@ nsDocShell::InternalLoad(nsIURI * aURI, SetCurScrollPosEx(bx, by); } - /* Clear out mLSHE so that further anchor visits get - * recorded in SH and SH won't misbehave. + /* Restore the original LSHE if we were loading something + * while short-circuited load was initiated. */ - SetHistoryEntry(&mLSHE, nullptr); + SetHistoryEntry(&mLSHE, oldLSHE); /* Set the title for the SH entry for this target url. so that * SH menus in go/back/forward buttons won't be empty for this. */

1 0

[tor-browser/esr24] Bug 987140 - Return width/height from the most recent image request. r=bz, a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit a183688e06b0a2674b28003370ea0e3314050e68 Author: Olli Pettay <Olli.Pettay(a)helsinki.fi> Date: Wed Mar 26 14:43:27 2014 -0400 Bug 987140 - Return width/height from the most recent image request. r=bz, a=sledru --- content/html/content/src/nsGenericHTMLElement.cpp | 2 +- content/html/content/src/nsGenericHTMLElement.h | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp index 47e79f8..080294a 100644 --- a/content/html/content/src/nsGenericHTMLElement.cpp +++ b/content/html/content/src/nsGenericHTMLElement.cpp @@ -3293,7 +3293,7 @@ nsGenericHTMLElement::GetProperties(nsISupports** aProperties) } nsSize -nsGenericHTMLElement::GetWidthHeightForImage(imgIRequest *aImageRequest) +nsGenericHTMLElement::GetWidthHeightForImage(nsRefPtr<imgRequestProxy>& aImageRequest) { nsSize size(0,0); diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h index 955d4ea..cdf3f36 100644 --- a/content/html/content/src/nsGenericHTMLElement.h +++ b/content/html/content/src/nsGenericHTMLElement.h @@ -328,8 +328,10 @@ public: /** * Get width and height, using given image request if attributes are unset. + * Pass a reference to the image request, since the method may change the + * value and we want to use the updated value. */ - nsSize GetWidthHeightForImage(imgIRequest *aImageRequest); + nsSize GetWidthHeightForImage(nsRefPtr<imgRequestProxy>& aImageRequest); public: // Implementation for nsIContent

1 0