Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value when default-constructing a dictionary with a required member

RESOLVED FIXED in Firefox 34

Status

()

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Status:
RESOLVED FIXED
Opened:
5 years ago
Updated:
3 months ago

People

(Reporter: rbarnes, Assigned: bzbarsky)

Tracking

Version:
unspecified
Target:
mozilla35
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox32 unaffected, firefox33 unaffected, firefox34 fixed, firefox35 fixed)

Details

Attachments

(2 attachments)

Example generated ctor and Init() method
1.79 KB, text/plain
Details
Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member
2.12 KB, patch
khuey
: review+
lmandel
: approval-mozilla-aurora+
Details | Diff | Splinter Review
Reporter

Description

•
5 years ago 
The Init() method generated for WebIDL dictionaries creates a variable 'temp' of type 'Maybe<JS::Rooted<JS::Value> >'.  If Init() is called with arguments 'cx' and 'val' both null (in their respective senses), then temp is never initialized before it is used, in a call to ConvertJSValueToString().  This results in hitting a MOZ_ASSERT in Maybe<T>::ref().

An example of a generated ctor and Init() method is attached.  The 'temp' variable is created on line 29, and used in the 'temp.ref()' call in line 44.
 Reporter

Updated

•
5 years ago
Blocks: 1037892
Blocks: 1057541
QA Contact: bzbarsky
Summary: Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value → Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value when default-constructing a dictionary with a required member
Assignee: nobody → bzbarsky
QA Contact: bzbarsky

Comment 3

•
5 years ago 
https://hg.mozilla.org/mozilla-central/rev/30468ed119a3
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
 Reporter

Comment 4

•
5 years ago 
Comment on attachment 8492793 [details] [diff] [review]
Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member

Approval Request Comment

[Feature/regressing bug #]: Required for Bug 1037892; fixes a bug introduced in Bug 1057541
     
[User impact if declined]: Blocks uplift of Bug 1037892 (see uplift request there for more detail)

[Describe test coverage new/current, TBPL]: N/A

[Risks and why]: Low risk, fixing a minor bug in WebIDL

[String/UUID change made/needed]: none
Attachment #8492793 - Flags: approval-mozilla-aurora?

Comment 5

•
5 years ago 
Comment on attachment 8492793 [details] [diff] [review]
Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member

Aurora+
Attachment #8492793 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.