1230918 - [Static Analysis][Dereference before null check] Function PresShell::ContentRemoved from nsPresShell.cpp

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Andi [:andi]]

The Static Analysis tool Coverity added a null pointer dereference can occur if aChild is null on the path:

mPresContext->EventStateManager()->ContentRemoved(aDocument, aChild)->

5EventStateManager::ContentRemoved(nsIDocument* aDocument, nsIContent* aContent)
inline bool IsAnyOfHTMLElements(First aFirst, Args... aArgs) const
inline bool IsHTMLElement() const
inline bool IsInNamespace(int32_t aNamespace) const
operator->() const MOZ_NO_ADDREF_RELEASE_ON_RETURN

Comment 1

[Andi [:andi]]

Attachment: Bug 1230918.diff

Hello David,

Could you please take a look other this patch?

THX

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 8696449 [details] [diff] [review]
Bug 1230918.diff

This is silly.  Why does coverity want us to add the assertion for this pointer in particular, but not others?

"valid pointer" is also the wrong expression; you should say "non-null"

Comment 3

[Andi [:andi]]

Attachment: MozReview Request: Bug 1230918 - remove useless null-pointer check on aChild that only caused a Coverity - Dereference before null check. r?dbaron

Review commit: https://reviewboard.mozilla.org/r/34335/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/34335/

Comment 4

[Andi [:andi]]

The checker is trigger since the null check is done after the dereference but in our case aChild is already null checked in function doRemoveChildAt:

>>  NS_PRECONDITION(aKid && aKid->GetParentNode() == this &&
>>                  aKid == GetChildAt(aIndex) &&
>>                  IndexOf(aKid) == (int32_t)aIndex, "Bogus aKid");

The callstack would be doRemoveChildAt->nsNodeUtils::ContentRemoved->PresShell::ContentRemoved

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 8717816 [details]
MozReview Request: Bug 1230918 - remove useless null-pointer check on aChild that only caused a Coverity - Dereference before null check. r?dbaron

https://reviewboard.mozilla.org/r/34335/#review32347

r=dbaron

Thanks for revising this.

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/27751e488cb8