10572 - UMR: HTMLAttributesImpl::UnsetAttributesFor()

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[Bruce Mitchener]

****  Purify instrumented ./apprunner.pure (pid 29452)  ****
UMR: Uninitialized memory read:
  * This is occurring while in:

HTMLAttributesImpl::UnsetAttributeFor(nsIAtom*,nsIHTMLContent*,nsIHTMLStyleSheet
*,int&) [nsHTMLAttributes.cpp:1269]

HTMLStyleSheetImpl::UnsetAttributeFor(nsIAtom*,nsIHTMLContent*,nsIHTMLAttributes
*&) [nsHTMLStyleSheet.cpp:1078]
        nsGenericHTMLElement::UnsetAttribute(int,nsIAtom*,int)
[nsGenericHTMLElement.cpp:744]
        nsHTMLInputElement::UnsetAttribute(int,nsIAtom*,int)
[nsHTMLInputElement.cpp:119]
        nsGenericElement::RemoveAttribute(const nsString&)
[nsGenericElement.cpp:438]
        nsHTMLInputElement::RemoveAttribute(const nsString&)
[nsHTMLInputElement.cpp:67]
        nsWebShellWindow::ShowAppropriateChrome() [nsWebShellWindow.cpp:2255]

nsWebShellWindow::OnEndDocumentLoad(nsIDocumentLoader*,nsIChannel*,int,nsIDocume
ntLoaderObserver*) [nsWebShellWindow.cpp:1811]

nsWebShell::OnEndDocumentLoad(nsIDocumentLoader*,nsIChannel*,int,nsIDocumentLoad
erObserver*) [nsWebShell.cpp:3017]
        nsDocLoaderImpl::FireOnEndDocumentLoad(nsIDocumentLoader*,int)
[nsDocLoader.cpp:1099]
        nsDocLoaderImpl::OnStopRequest(nsIChannel*,nsISupports*,unsigned
int,const unsigned short*) [nsDocLoader.cpp:1024]
        nsOnStopRequestEvent::HandleEvent() [nsAsyncStreamListener.cpp:283]
        nsStreamListenerEvent::HandlePLEvent(PLEvent*)
[nsAsyncStreamListener.cpp:149]
        PL_HandleEvent [plevent.c:509]
        PL_ProcessPendingEvents [plevent.c:470]
        nsEventQueueImpl::ProcessPendingEvents() [nsEventQueue.cpp:118]
        event_processor_callback(void*,int,GdkInputCondition)
[nsAppShell.cpp:78]
        gdk_io_invoke  [gdkevents.c:868]
        g_io_unix_dispatch [giounix.c:131]
        g_main_dispatch [gmain.c:647]
        g_main_iterate [gmain.c:854]
        g_main_run     [gmain.c:912]
        gtk_main       [gtkmain.c:475]
        nsAppShell::Run() [nsAppShell.cpp:241]
        nsAppShellService::Run() [nsAppShellService.cpp:468]
        main           [nsAppRunner.cpp:720]
        _start         [crt1.o]
  * Reading 4 bytes from 0xefffe780 on the stack.
  * Address 0xefffe780 is local variable "haveAttr" in function
HTMLAttributesImpl::UnsetAttributeFor(nsIAtom*,nsIHTMLContent*,nsIHTMLStyleSheet
*,int&).

Comment 1

[troy]

Peter, the CVS log indicates you were the last one to modify that section of
code.

The problem looks obvious (it seems that UnsetAttributeName() needs a "aFound =
PR_FALSE" right down there at the bottom before the return NS_OK), but I'm
assigning to you because you know the code better

      NS_RELEASE(aAttrName);
      aFound = PR_TRUE;
      return NS_OK;
    }
  }
  aFound = PR_FALSE;  // XXX Add this?
  ~~~~~~~~~~~~~~~~~~
  return NS_OK;

Comment 2

[Chris Petersen]

Based on troy's comments, marking as verified fixed.