1157135 - Uninitialised value use in TabParent::AddInitialDnDDataTo

Status: NEW

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Julian Seward [:jseward]]

For editor/libeditor/tests/test_bug417418.html, Valgrind reports that
item.mType is uninitialised in
TabParent::AddInitialDnDDataTo(DataTransfer* aDataTransfer).

dom/ipc/TabParent.cpp
3207  // Special case kFilePromiseMime so that we get the right
      // nsIFlavorDataProvider for it.
      if (item.mFlavor.EqualsLiteral(kFilePromiseMime)) {
        nsRefPtr<nsISupports> flavorDataProvider =
          new nsContentAreaDragDropDataProvider();
        variant->SetAsISupports(flavorDataProvider);
3213  } else if (item.mType == DataTransferItem::DataType::eString) { <---HERE
        variant->SetAsAString(item.mStringData);
      } else if (item.mType == DataTransferItem::DataType::eBlob) {
        variant->SetAsISupports(item.mBlobData);
      }

From some poking around, I think that |item| was allocated just above
in TabParent::RecvInvokeDragSession, here:

3150  DataTransferItem* localItem = itemArray->AppendElement();

It seems to me that the if-else if that immediately follows, can fail
to write any value to localItem->mType.  And mType is just an enum so
there is no automatic initialisation of it via a constructor, inside
AppendElement.  So if neither the if .. nor the else if .. are taken,
then localItem->mType is uninitialised.

Comment 1

[Julian Seward [:jseward]]

Attachment: Valgrind complainage

Comment 2

[Julian Seward [:jseward]]

Possibly related to bug 936092.