Closed Bug 1361612 Opened 3 years ago Closed 3 years ago

Coverity report: nsPlaceholderFrame::mOutOfFlowFrame isn't initialized in the ctor

Categories

(Core :: Layout, defect, P3, minor)

53 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla55
Tracking Status
firefox-esr52 --- unaffected
firefox53 --- wontfix
firefox54 --- wontfix
firefox55 --- fixed

People

(Reporter: mats, Assigned: emilio)

References

(Blocks 1 open bug, )

Details

(Keywords: coverity, good-first-bug, regression, Whiteboard: [CID 1221326])

Coverity CID 1221326 Uninitialized pointer field

The pointer field will point to an arbitrary memory location, any attempt to write may cause corruption.

In nsPlaceholderFrame::​nsPlaceholderFrame(nsStyleContext *, nsFrameState): A pointer field is not initialized in the constructor


 70  nsPlaceholderFrame(nsStyleContext* aContext, nsFrameState aTypeBit)
 71    : nsFrame(aContext, mozilla::FrameType::Placeholder)
 72  {
   1. Condition aTypeBit == PLACEHOLDER_FOR_FLOAT, taking false branch.
   2. Condition aTypeBit == PLACEHOLDER_FOR_ABSPOS, taking false branch.
   3. Condition aTypeBit == PLACEHOLDER_FOR_FIXEDPOS, taking false branch.
   4. Condition aTypeBit == PLACEHOLDER_FOR_POPUP, taking false branch.
   5. Condition aTypeBit == PLACEHOLDER_FOR_TOPLAYER, taking false branch.
 73    NS_PRECONDITION(aTypeBit == PLACEHOLDER_FOR_FLOAT ||
 74                    aTypeBit == PLACEHOLDER_FOR_ABSPOS ||
 75                    aTypeBit == PLACEHOLDER_FOR_FIXEDPOS ||
 76                    aTypeBit == PLACEHOLDER_FOR_POPUP ||
 77                    aTypeBit == PLACEHOLDER_FOR_TOPLAYER,
 78                    "Unexpected type bit");
 79    AddStateBits(aTypeBit);
   CID 1221326 (#1 of 1): Uninitialized pointer field (UNINIT_CTOR)7. uninit_member: Non-static class member mOutOfFlowFrame is not initialized in this constructor nor in any functions that it calls.
 80  }
We only create an nsPlaceholderFrame in one place currently:
http://searchfox.org/mozilla-central/rev/abe68d5dad139e376d5521ca1d4b7892e1e7f1ba/layout/base/nsCSSFrameConstructor.cpp#3051,3057
and it unconditionally calls SetOutOfFlowFrame() which sets this member.

Still seems worth fixing by adding "mOutOfFlowFrame(nullptr)" to the ctor...
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/120285c6daa0
Initialize nsPlaceholderFrame::mOutOfFlowFrame. r=mats
https://hg.mozilla.org/mozilla-central/rev/120285c6daa0
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Assignee: nobody → emilio+bugs
Whiteboard: [CID 1221326]
You need to log in before you can comment on or make changes to this bug.