1361612 - Coverity report: nsPlaceholderFrame::mOutOfFlowFrame isn't initialized in the ctor

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Mats Palmgren (inactive)]

Coverity CID 1221326 Uninitialized pointer field

The pointer field will point to an arbitrary memory location, any attempt to write may cause corruption.

In nsPlaceholderFrame::​nsPlaceholderFrame(nsStyleContext *, nsFrameState): A pointer field is not initialized in the constructor


 70  nsPlaceholderFrame(nsStyleContext* aContext, nsFrameState aTypeBit)
 71    : nsFrame(aContext, mozilla::FrameType::Placeholder)
 72  {
   1. Condition aTypeBit == PLACEHOLDER_FOR_FLOAT, taking false branch.
   2. Condition aTypeBit == PLACEHOLDER_FOR_ABSPOS, taking false branch.
   3. Condition aTypeBit == PLACEHOLDER_FOR_FIXEDPOS, taking false branch.
   4. Condition aTypeBit == PLACEHOLDER_FOR_POPUP, taking false branch.
   5. Condition aTypeBit == PLACEHOLDER_FOR_TOPLAYER, taking false branch.
 73    NS_PRECONDITION(aTypeBit == PLACEHOLDER_FOR_FLOAT ||
 74                    aTypeBit == PLACEHOLDER_FOR_ABSPOS ||
 75                    aTypeBit == PLACEHOLDER_FOR_FIXEDPOS ||
 76                    aTypeBit == PLACEHOLDER_FOR_POPUP ||
 77                    aTypeBit == PLACEHOLDER_FOR_TOPLAYER,
 78                    "Unexpected type bit");
 79    AddStateBits(aTypeBit);
   CID 1221326 (#1 of 1): Uninitialized pointer field (UNINIT_CTOR)7. uninit_member: Non-static class member mOutOfFlowFrame is not initialized in this constructor nor in any functions that it calls.
 80  }

Comment 1

[Mats Palmgren (inactive)]

We only create an nsPlaceholderFrame in one place currently:
http://searchfox.org/mozilla-central/rev/abe68d5dad139e376d5521ca1d4b7892e1e7f1ba/layout/base/nsCSSFrameConstructor.cpp#3051,3057
and it unconditionally calls SetOutOfFlowFrame() which sets this member.

Still seems worth fixing by adding "mOutOfFlowFrame(nullptr)" to the ctor...

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/120285c6daa0
Initialize nsPlaceholderFrame::mOutOfFlowFrame. r=mats

Comment 3

[Iris Hsiao [:ihsiao]]

https://hg.mozilla.org/mozilla-central/rev/120285c6daa0