1025170 - Selection::Modify fails to return with unimplemented cases

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Andrew McCreight [:mccr8]]

This method does an aRv.Throw(NS_ERROR_NOT_IMPLEMENTED), but then does not return.  Coverity points out that this means that |amount| and |keycode| are used uninitialized, but presumably all sorts of other badness might be in play here.

regression from bug 949445:
  1.1702 -    return NS_ERROR_NOT_IMPLEMENTED;
  1.1703 +    aRv.Throw(NS_ERROR_NOT_IMPLEMENTED);
  1.1704    }

Comment 1

[Andrew McCreight [:mccr8]]

Well, I can just fix this silly thing.  But if you have an opinion of what sec rating this should get, it would be appreciated.

Comment 2

[Andrew McCreight [:mccr8]]

Attachment: Selection::Modify should return on failure.

try run: https://tbpl.mozilla.org/?tree=Try&rev=9958f982be3e

Comment 3

[(no longer active)]

Looking at nsFrameSelection::MoveCaret, it seems like an uninitialized aKeycode should cause us to return here <http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsSelection.cpp#895> and aAmount is used after this point, so I don't think this is security sensitive at all.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8440146 [details] [diff] [review]
Selection::Modify should return on failure.

r=me, fwiw

Comment 5

[Andrew McCreight [:mccr8]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/82418d47c497

Comment 6

[Andrew McCreight [:mccr8]]

It sounds like this isn't really worth backporting then.

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/82418d47c497