Closed
Bug 1070764
Opened 8 years ago
Closed 8 years ago
Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value when default-constructing a dictionary with a required member
Categories
(Core :: DOM: Core & HTML, defect)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
FIXED
mozilla35
Tracking | Status | |
---|---|---|
firefox32 | --- | unaffected |
firefox33 | --- | unaffected |
firefox34 | --- | fixed |
firefox35 | --- | fixed |
People
(Reporter: rbarnes, Assigned: bzbarsky)
References
Details
Attachments
(2 files)
1.79 KB,
text/plain
|
Details | |
2.12 KB,
patch
|
khuey
:
review+
lmandel
:
approval-mozilla-aurora+
|
Details | Diff | Splinter Review |
The Init() method generated for WebIDL dictionaries creates a variable 'temp' of type 'Maybe<JS::Rooted<JS::Value> >'. If Init() is called with arguments 'cx' and 'val' both null (in their respective senses), then temp is never initialized before it is used, in a call to ConvertJSValueToString(). This results in hitting a MOZ_ASSERT in Maybe<T>::ref(). An example of a generated ctor and Init() method is attached. The 'temp' variable is created on line 29, and used in the 'temp.ref()' call in line 44.
![]() |
Assignee | |
Updated•8 years ago
|
Blocks: 1057541
QA Contact: bzbarsky
Summary: Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value → Generated WebIDL code uses Maybe<JS::Rooted<JS::Value> > before setting a value when default-constructing a dictionary with a required member
![]() |
Assignee | |
Updated•8 years ago
|
Assignee: nobody → bzbarsky
QA Contact: bzbarsky
![]() |
Assignee | |
Comment 1•8 years ago
|
||
Attachment #8492793 -
Flags: review?(khuey)
Attachment #8492793 -
Flags: review?(khuey) → review+
![]() |
Assignee | |
Comment 2•8 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/30468ed119a3
Target Milestone: --- → mozilla35
Comment 3•8 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/30468ed119a3
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 4•8 years ago
|
||
Comment on attachment 8492793 [details] [diff] [review] Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member Approval Request Comment [Feature/regressing bug #]: Required for Bug 1037892; fixes a bug introduced in Bug 1057541 [User impact if declined]: Blocks uplift of Bug 1037892 (see uplift request there for more detail) [Describe test coverage new/current, TBPL]: N/A [Risks and why]: Low risk, fixing a minor bug in WebIDL [String/UUID change made/needed]: none
Attachment #8492793 -
Flags: approval-mozilla-aurora?
Comment 5•8 years ago
|
||
Comment on attachment 8492793 [details] [diff] [review] Don't try to use the uninitialized temp value while default-constructing a dictionary with a required member Aurora+
Attachment #8492793 -
Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Updated•8 years ago
|
status-firefox32:
--- → unaffected
status-firefox33:
--- → unaffected
status-firefox34:
--- → affected
status-firefox35:
--- → fixed
Updated•3 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•