Closed Bug 1070764 Opened 6 years ago Closed 6 years ago

Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value when default-constructing a dictionary with a required member

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla35
Tracking Flags:
Tracking Status
firefox32 --- unaffected
firefox33 --- unaffected
firefox34 --- fixed
firefox35 --- fixed

People

(Reporter: rbarnes, Assigned: bzbarsky)

References

Details

Attachments

(2 files)

Example generated ctor and Init() method
1.79 KB, text/plain
Details
Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member
2.12 KB, patch
khuey
: review+
lmandel
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
The Init() method generated for WebIDL dictionaries creates a variable 'temp' of type 'Maybe<JS::Rooted<JS::Value> >'.  If Init() is called with arguments 'cx' and 'val' both null (in their respective senses), then temp is never initialized before it is used, in a call to ConvertJSValueToString().  This results in hitting a MOZ_ASSERT in Maybe<T>::ref().

An example of a generated ctor and Init() method is attached.  The 'temp' variable is created on line 29, and used in the 'temp.ref()' call in line 44.
Blocks: 1037892
Blocks: 1057541
QA Contact: bzbarsky
Summary: Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value → Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value when default-constructing a dictionary with a required member
Assignee: nobody → bzbarsky
QA Contact: bzbarsky
https://hg.mozilla.org/mozilla-central/rev/30468ed119a3
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Comment on attachment 8492793 [details] [diff] [review]
Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member

Approval Request Comment

[Feature/regressing bug #]: Required for Bug 1037892; fixes a bug introduced in Bug 1057541
     
[User impact if declined]: Blocks uplift of Bug 1037892 (see uplift request there for more detail)

[Describe test coverage new/current, TBPL]: N/A

[Risks and why]: Low risk, fixing a minor bug in WebIDL

[String/UUID change made/needed]: none
Attachment #8492793 - Flags: approval-mozilla-aurora?
Comment on attachment 8492793 [details] [diff] [review]
Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member

Aurora+
Attachment #8492793 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Depends on: 1080770
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.