1405692 - Make sure mAnimatedGeometryRoot is initialized to nullptr in the rarely used nsDisplayItem that takes an nsIFrame*

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Jonathan Watt [:jwatt]]

Seems like the pointer mAnimatedGeometryRoot is not initialized in the rarely used nsDisplayItem that takes an nsIFrame*.

Comment 1

[Jonathan Watt [:jwatt]]

Attachment: patch

Comment 2

[Jonathan Watt [:jwatt]]

I'm guessing we could possibly end up dereferencing an uninitialized pointer here, so maybe not a bad idea to uplift since it should be completely safe.

Comment 3

[Jet Villegas (inactive)]

[Tracking Requested - why for this release]: see comment 2

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c45a9377bfb7
Make sure mAnimatedGeometryRoot is initialized to nullptr in the rarely used nsDisplayItem ctor that takes an nsIFrame*. r=mattwoodrow

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/c45a9377bfb7

Comment 6

[Julien Cristau [:jcristau]]

please request uplift to beta when you get a chance.

Comment 7

[Jonathan Watt [:jwatt]]

Comment on attachment 8915149 [details] [diff] [review]
patch

Approval Request Comment
[Feature/Bug causing the regression]: been around a while
[User impact if declined]: potential dereference of uninitialized memory
[Is this code covered by automated tests?]: how we'd trigger a derefernce is unexplored
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: simply initializing a pointer to null - crashing would be better than a security issue
[String changes made/needed]: none

Comment 8

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8915149 [details] [diff] [review]
patch

makes sense, beta57+

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/465b880a2af9

Comment 10

[Cornel Ionce [:noni] [Hubs QA]]

(In reply to Jonathan Watt [:jwatt] (needinfo? me) from comment #7)
> [Needs manual test from QE? If yes, steps to reproduce]: no

Marking this issue as qe-, per Jonathan's assessment on manual testing needs