1308877 - [Static Analysis][Explicit null dereferenced] In function PresShell::HandleEvent

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Andi [:andi]]

The Static Analysis tool Coverity detected that after |frame| is nullptr assigned, it could be null dereferenced.

>>        if (!frameKeeper.IsAlive()) {
>>          frame = nullptr;
>>        }
>>        // Implicit pointer capture for touch
>>        if (sPointerEventImplicitCapture &&
>>            pointerEvent->mMessage == ePointerDown &&
>>            pointerEvent->inputSource == nsIDOMMouseEvent::MOZ_SOURCE_TOUCH) {
>>          nsCOMPtr<nsIContent> targetContent;
>>          frame->GetContentForEvent(aEvent, getter_AddRefs(targetContent));
>>          while (targetContent && !targetContent->IsElement()) {
>>            targetContent = targetContent->GetParent();
>>          }
>>          if (targetContent) {
>>            SetPointerCapturingContent(pointerEvent->pointerId, targetContent);
>>          }
>>        }

Comment 1

[Andi [:andi]]

Attachment: Bug 1308877 - prevent null pointer dereference in PresShell::HandleEvent.

Review commit: https://reviewboard.mozilla.org/r/84552/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/84552/

Comment 2

[Daniel Holbert [:dholbert]]

This looks probably-good.  Slight nit: this could be simplified slightly to use "else if", instead of adding "frame" to the if-condition.  But maybe not a big deal.

In any case, I'm redirecting review to smaug, since this is in event-handling code (which he knows better than I) & since he reviewed the "frame = nullptr" assignment there (over in bug 1153130) and hence may be more likely to be aware of any subtleties here.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8799354 [details]
Bug 1308877 - prevent null pointer dereference in PresShell::HandleEvent.

https://reviewboard.mozilla.org/r/84552/#review83192

Thanks

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2c3e14c84991
prevent null pointer dereference in PresShell::HandleEvent. r=smaug

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/2c3e14c84991