25092 - UMR in nsEventStateManager::BeginTrackingDragGesture()

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[kinmoz]

In purify, I'm seeing an Uninitialized Memory Read warning in
nsEventStateManager::BeginTrackingDragGesture().

To reproduce the problem, all you have to do is start the browser and click in
the URL bar.

Here are the purify warnings with the stack traces:

[W] UMR: Uninitialized memory read in
nsEventStateManager::BeginTrackingDragGesture(nsGUIEvent *,nsIFrame *) {1
occurrence}
        Reading 4 bytes from 0x0013f128 (4 bytes at 0x0013f128 uninitialized)
        Address 0x0013f128 points into a thread's stack
        Address 0x0013f128 is 8 bytes past the start of local variable 'event'
in nsEnderEventListener::DispatchMouseEvent(nsIDOMMouseEvent *,int)
        Thread ID: 0x111
        Error location
            nsEventStateManager::BeginTrackingDragGesture(nsGUIEvent *,nsIFrame
*) [nsEventStateManager.cpp:591]
            nsEventStateManager::PreHandleEvent(nsIPresContext *,nsGUIEvent
*,nsIFrame *,nsEventStatus *,nsIView *) [nsEventStateManager.cpp:398]
            nsEnderEventListener::DispatchMouseEvent(nsIDOMMouseEvent *,int)
[nsGfxTextControlFrame.cpp:3608]
            nsEnderEventListener::MouseDown(nsIDOMEvent *)
[nsGfxTextControlFrame.cpp:3690]
            nsEventListenerManager::HandleEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsEventListenerManager.cpp:740]
            nsDocument::HandleDOMEvent(nsIPresContext *,nsEvent *,nsIDOMEvent *
*,UINT,nsEventStatus *) [nsDocument.cpp:2419]
            nsHTMLHtmlElement::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsHTMLHtmlElement.cpp:192]
            nsGenericElement::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsGenericElement.cpp:811]
            nsHTMLBodyElement::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsHTMLBodyElement.cpp:714]
            nsGenericDOMDataNode::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsGenericDOMDataNode.cpp:799]
[W] UMR: Uninitialized memory read in
nsEventStateManager::BeginTrackingDragGesture(nsGUIEvent *,nsIFrame *) {1
occurrence}
        Reading 4 bytes from 0x0013f12c (4 bytes at 0x0013f12c uninitialized)
        Address 0x0013f12c points into a thread's stack
        Address 0x0013f12c is 12 bytes past the start of local variable 'event'
in nsEnderEventListener::DispatchMouseEvent(nsIDOMMouseEvent *,int)
        Thread ID: 0x111
        Error location
            nsEventStateManager::BeginTrackingDragGesture(nsGUIEvent *,nsIFrame
*) [nsEventStateManager.cpp:591]
            nsEventStateManager::PreHandleEvent(nsIPresContext *,nsGUIEvent
*,nsIFrame *,nsEventStatus *,nsIView *) [nsEventStateManager.cpp:398]
            nsEnderEventListener::DispatchMouseEvent(nsIDOMMouseEvent *,int)
[nsGfxTextControlFrame.cpp:3608]
            nsEnderEventListener::MouseDown(nsIDOMEvent *)
[nsGfxTextControlFrame.cpp:3690]
            nsEventListenerManager::HandleEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsEventListenerManager.cpp:740]
            nsDocument::HandleDOMEvent(nsIPresContext *,nsEvent *,nsIDOMEvent *
*,UINT,nsEventStatus *) [nsDocument.cpp:2419]
            nsHTMLHtmlElement::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsHTMLHtmlElement.cpp:192]
            nsGenericElement::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsGenericElement.cpp:811]
            nsHTMLBodyElement::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsHTMLBodyElement.cpp:714]
            nsGenericDOMDataNode::HandleDOMEvent(nsIPresContext *,nsEvent
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsGenericDOMDataNode.cpp:799]

Comment 1

[Mike Pinkerton (not reading bugmail)]

accepting for M14. This is a lot like 25026, i think, where the ender text widget 
isn't setting all the fields correctly before it redispatches the event. Should 
be easy to fix.

Accepting for M14.

Comment 2

[Mike Pinkerton (not reading bugmail)]

fix checked into nsGFXTextControlFrame.cpp. can someone with purify verify this? 
kin?

Comment 3

[kinmoz]

I updated to pick up the changes. I don't see the UMR anymore. Thanks!

Marking VERIFIED.