1236920 - [Static Analysis][Dereference before null check] In function nsAbsoluteContainingBlock::ReflowAbsoluteFrame from nsAbsoluteContainingBlock.cpp

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Andi-Bogdan Postelnicu [:andi]]

The Static Analysis tool Coverity added that variable aKidFrame is dereferenced before it's null checked:

dereference:

>>  WritingMode wm = aKidFrame->GetWritingMode();
>>  LogicalSize logicalCBSize(wm, aContainingBlock.Size());

null check:

>>    if (aKidFrame) {
>>      nsAutoString name;
>>      aKidFrame->GetFrameName(name);
>>      printf("%s ", NS_LossyConvertUTF16toASCII(name).get());
>>    }

As we can see from the calling of function ReflowAbsoluteFrame, variable aKidFrame is always passed a valid pointer:

>>  for (kidFrame = mAbsoluteFrames.FirstChild(); kidFrame; kidFrame = kidFrame->GetNextSibling()) {
>>    bool kidNeedsReflow = reflowAll || NS_SUBTREE_DIRTY(kidFrame) ||
>>      FrameDependsOnContainer(kidFrame,
>>                              !!(aFlags & AbsPosReflowFlags::eCBWidthChanged),
>>                              !!(aFlags & AbsPosReflowFlags::eCBHeightChanged));
>>    if (kidNeedsReflow && !aPresContext->HasPendingInterrupt()) {
>>      // Reflow the frame
>>      nsReflowStatus  kidStatus = NS_FRAME_COMPLETE;
>>      const nsRect& cb = isGrid ? nsGridContainerFrame::GridItemCB(kidFrame)
>>                                : aContainingBlock;
>>      ReflowAbsoluteFrame(aDelegatingFrame, aPresContext, aReflowState, cb,
>>                          aFlags, kidFrame, kidStatus, aOverflowAreas); 

From the above context kidFrame is passed as aKidFrame in ReflowAbsoluteFrame and we can see that function gets called while kidFrame is valid, thus making useless the null check for on aKidFrame. The checks are done only on Debug but in this way we silence Coverity.

Comment 1

[Andi-Bogdan Postelnicu [:andi]]

Attachment: Bug 1236920.diff

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e74d457b8b11

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e74d457b8b11