Closed
Bug 18622
Opened 25 years ago
Closed 25 years ago
UMR in nsLineLayout::CanPlaceFrame
Categories
(Core :: Layout, defect, P3)
Tracking
()
VERIFIED
FIXED
M12
People
(Reporter: norrisboyd, Assigned: kinmoz)
References
Details
Saw this in Purify:
[W] UMR: Uninitialized memory read in
nsLineLayout::CanPlaceFrame(PerFrameData::nsLineLayout *,nsHTMLReflowState
const&,int,nsHTMLReflowMetrics&,UINT&) {18 occurrences}
Reading 4 bytes from 0x08f2dfc4 (4 bytes at 0x08f2dfc4 uninitialized)
Address 0x08f2dfc4 is 420 bytes into a 1964 byte block at 0x08f2de20
Address 0x08f2dfc4 points to a C++ new block in heap 0x03c10000
Thread ID: 0xf0
Error location
nsLineLayout::CanPlaceFrame(PerFrameData::nsLineLayout
*,nsHTMLReflowState const&,int,nsHTMLReflowMetrics&,UINT&)
[nsLineLayout.cpp:1330]
// If this is a piece of text inside a letter frame...
if (pfd->mIsNonEmptyTextFrame) {
=> if (psd->mFrame && psd->mFrame->mIsLetterFrame) {
nsIFrame* prevInFlow;
psd->mFrame->mFrame->GetPrevInFlow(&prevInFlow);
if (prevInFlow) {
nsLineLayout::ReflowFrame(nsIFrame *,nsIFrame *
*,UINT&,nsHTMLReflowMetrics *) [nsLineLayout.cpp:1107]
nsInlineFrame::ReflowInlineFrame(nsIPresContext *,nsHTMLReflowState
const&,InlineReflowState::nsInlineFrame&,nsIFrame *,UINT&)
[nsInlineFrame.cpp:489]
nsInlineFrame::ReflowFrames(nsIPresContext *,nsHTMLReflowState
const&,InlineReflowState::nsInlineFrame&,nsHTMLReflowMetrics&,UINT&)
[nsInlineFrame.cpp:347]
nsInlineFrame::Reflow(nsIPresContext&,nsHTMLReflowMetrics&,nsHTMLReflowState
const&,UINT&) [nsInlineFrame.cpp:274]
nsLineLayout::ReflowFrame(nsIFrame *,nsIFrame *
*,UINT&,nsHTMLReflowMetrics *) [nsLineLayout.cpp:951]
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&,nsLineLayout&,nsLineBox
*,nsIFrame *,BYTE *) [nsBlockFrame.cpp:3654]
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&,nsLineLayout&,nsLineBox
*,int *,BYTE *) [nsBlockFrame.cpp:3578]
nsBlockFrame::DoReflowInlineFramesMalloc(nsBlockReflowState&,nsLineBox
*,int *,BYTE *) [nsBlockFrame.cpp:3471]
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,nsLineBox *,int *)
[nsBlockFrame.cpp:3434]
Allocation location
new(UINT) [new.cpp:23]
nsBlockFrame::DoReflowInlineFramesMalloc(nsBlockReflowState&,nsLineBox
*,int *,BYTE *) [nsBlockFrame.cpp:3464]
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,nsLineBox *,int *)
[nsBlockFrame.cpp:3434]
nsBlockFrame::ReflowLine(nsBlockReflowState&,nsLineBox *,int *,int)
[nsBlockFrame.cpp:2665]
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
[nsBlockFrame.cpp:2425]
nsBlockFrame::Reflow(nsIPresContext&,nsHTMLReflowMetrics&,nsHTMLReflowState
const&,UINT&) [nsBlockFrame.cpp:1489]
nsContainerFrame::ReflowChild(nsIFrame
*,nsIPresContext&,nsHTMLReflowMetrics&,nsHTMLReflowState const&,UINT&)
[nsContainerFrame.cpp:405]
nsTableCellFrame::Reflow(nsIPresContext&,nsHTMLReflowMetrics&,nsHTMLReflowState
const&,UINT&) [nsTableCellFrame.cpp:653]
nsContainerFrame::ReflowChild(nsIFrame
*,nsIPresContext&,nsHTMLReflowMetrics&,nsHTMLReflowState const&,UINT&)
[nsContainerFrame.cpp:405]
nsTableRowFrame::ResizeReflow(nsIPresContext&,nsHTMLReflowMetrics&,RowReflowStat
e&,UINT&,int) [nsTableRowFrame.cpp:890]
The problem is that psd->mFrame (PerFrameData) is allocated in
nsLineLayout::ReflowFrame(), but it's mIsLetterFrame, and other flags, are not
initialized till after aFrame->Reflow() is called. aFrame->Reflow() ends up
calling CanPlaceFrame() which triggers the UMR.
Here's a patch that seems to fix the problem. I can check it in if someone code
reviews it.
Index: nsLineLayout.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/html/base/src/nsLineLayout.cpp,v
retrieving revision 3.57
diff -c -r3.57 nsLineLayout.cpp
*** nsLineLayout.cpp 1999/12/06 15:49:49 3.57
--- nsLineLayout.cpp 1999/12/10 18:01:38
***************
*** 952,967 ****
nscoord tx = x - psd->mReflowState->mComputedBorderPadding.left;
nscoord ty = y - psd->mReflowState->mComputedBorderPadding.top;
mSpaceManager->Translate(tx, ty);
aFrame->Reflow(mPresContext, metrics, reflowState, aReflowStatus);
// XXX See if the frame is a placeholderFrame and if it is process
// the floater.
nsIAtom* frameType;
aFrame->GetFrameType(&frameType);
- pfd->mIsTextFrame = PR_FALSE;
- pfd->mIsLetterFrame = PR_FALSE;
- pfd->mIsNonEmptyTextFrame = PR_FALSE;
- pfd->mIsSticky = PR_FALSE;
if (frameType) {
if (frameType == nsLayoutAtoms::placeholderFrame) {
nsIFrame* outOfFlowFrame =
((nsPlaceholderFrame*)aFrame)->GetOutOfFlowFrame();
--- 952,969 ----
nscoord tx = x - psd->mReflowState->mComputedBorderPadding.left;
nscoord ty = y - psd->mReflowState->mComputedBorderPadding.top;
mSpaceManager->Translate(tx, ty);
+
+ pfd->mIsTextFrame = PR_FALSE;
+ pfd->mIsLetterFrame = PR_FALSE;
+ pfd->mIsNonEmptyTextFrame = PR_FALSE;
+ pfd->mIsSticky = PR_FALSE;
+
aFrame->Reflow(mPresContext, metrics, reflowState, aReflowStatus);
// XXX See if the frame is a placeholderFrame and if it is process
// the floater.
nsIAtom* frameType;
aFrame->GetFrameType(&frameType);
if (frameType) {
if (frameType == nsLayoutAtoms::placeholderFrame) {
nsIFrame* outOfFlowFrame =
((nsPlaceholderFrame*)aFrame)->GetOutOfFlowFrame();
Accepting bug. Marking M13, should this fix go in for M12 if someone code
reviews it?
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
Target Milestone: M13 → M12
Fix checked in:
mozilla/layout/html/base/src/nsLineLayout.cpp revision 3.58
r=troy@netscape.com,norris@netscape.com a=chofmann@netscape.com
*** Bug 20105 has been marked as a duplicate of this bug. ***
You need to log in
before you can comment on or make changes to this bug.
Description
•