32794 - UMR: nsContainerFrame::ReflowChild()

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect, P3)

Description

[Bruce Mitchener]

Today's build.  Loading sample #4 in viewer.  I did some scrolling and selection
and stuff as well.

      UMR: Uninitialized memory read
      This is occurring while in:
           
nsContainerFrame::ReflowChild(nsIFrame*,nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,int,int,unsigned int,unsigned int&)
[nsContainerFrame.cpp:669]
               
                 // If the reflow was successful and the child frame is
complete, delete any
                 // next-in-flows
            =>   if (NS_SUCCEEDED(result) && NS_FRAME_IS_COMPLETE(aStatus)) {
                   nsIFrame* kidNextInFlow;
                   aKidFrame->GetNextInFlow(&kidNextInFlow);
                   if (nsnull != kidNextInFlow) {
           
nsTableRowFrame::ResizeReflow(nsIPresContext*,nsHTMLReflowMetrics&,RowReflowState&,unsigned
int&,int) [nsTableRowFrame.cpp:895]
                                                        nsSize(0,0),
eReflowReason_Resize);
                       nsHTMLReflowMetrics desiredSize(nsnull);
                       nsReflowStatus  status;
            =>         ReflowChild(kidFrame, aPresContext, desiredSize,
kidReflowState, 0, 0, 0, status);
                       kidFrame->DidReflow(aPresContext,
NS_FRAME_REFLOW_FINISHED);
                     }
                   }
           
nsTableRowFrame::IR_TargetIsMe(nsIPresContext*,nsHTMLReflowMetrics&,RowReflowState&,unsigned
int&) [nsTableRowFrame.cpp:1155]
           
nsTableRowFrame::IncrementalReflow(nsIPresContext*,nsHTMLReflowMetrics&,RowReflowState&,unsigned
int&) [nsTableRowFrame.cpp:1120]
            nsTableRowFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsTableRowFrame.cpp:1378]
           
nsContainerFrame::ReflowChild(nsIFrame*,nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,int,int,unsigned int,unsigned int&)
[nsContainerFrame.cpp:646]
           
nsTableRowGroupFrame::IR_TargetIsChild(nsIPresContext*,nsHTMLReflowMetrics&,RowGroupReflowState&,unsigned
int&,nsIFrame*) [nsTableRowGroupFrame.cpp:1525]
           
nsTableRowGroupFrame::IncrementalReflow(nsIPresContext*,nsHTMLReflowMetrics&,RowGroupReflowState&,unsigned
int&) [nsTableRowGroupFrame.cpp:1173]
           
nsTableRowGroupFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsTableRowGroupFrame.cpp:1074]
           
nsContainerFrame::ReflowChild(nsIFrame*,nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,int,int,unsigned int,unsigned int&)
[nsContainerFrame.cpp:646]
           
nsTableFrame::IR_TargetIsChild(nsIPresContext*,nsHTMLReflowMetrics&,InnerTableReflowState&,unsigned
int&,nsIFrame*) [nsTableFrame.cpp:2697]
           
nsTableFrame::IncrementalReflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsTableFrame.cpp:2490]
            nsTableFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsTableFrame.cpp:1531]
           
nsContainerFrame::ReflowChild(nsIFrame*,nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,int,int,unsigned int,unsigned int&)
[nsContainerFrame.cpp:646]
           
nsTableOuterFrame::IR_InnerTableReflow(nsIPresContext*,nsHTMLReflowMetrics&,OuterTableReflowState&,unsigned
int&) [nsTableOuterFrame.cpp:724]
           
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsIPresContext*,nsHTMLReflowMetrics&,OuterTableReflowState&,unsigned
int&) [nsTableOuterFrame.cpp:498]
           
nsTableOuterFrame::IR_TargetIsChild(nsIPresContext*,nsHTMLReflowMetrics&,OuterTableReflowState&,unsigned
int&,nsIFrame*) [nsTableOuterFrame.cpp:465]
           
nsTableOuterFrame::IncrementalReflow(nsIPresContext*,nsHTMLReflowMetrics&,OuterTableReflowState&,unsigned
int&) [nsTableOuterFrame.cpp:445]
            nsTableOuterFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsTableOuterFrame.cpp:957]
            nsBlockReflowContext::ReflowBlock(nsIFrame*,const
nsRect&,int,int,int,nsMargin&,unsigned int&) [nsBlockReflowContext.cpp:449]
            nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,nsLineBox*,int*)
[nsBlockFrame.cpp:3538]
            nsBlockFrame::ReflowLine(nsBlockReflowState&,nsLineBox*,int*,int)
[nsBlockFrame.cpp:2851]
            nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
[nsBlockFrame.cpp:2658]
            nsBlockFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsBlockFrame.cpp:1577]
            nsBlockReflowContext::ReflowBlock(nsIFrame*,const
nsRect&,int,int,int,nsMargin&,unsigned int&) [nsBlockReflowContext.cpp:449]
            nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,nsLineBox*,int*)
[nsBlockFrame.cpp:3538]
            nsBlockFrame::ReflowLine(nsBlockReflowState&,nsLineBox*,int*,int)
[nsBlockFrame.cpp:2851]
            nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
[nsBlockFrame.cpp:2658]
            nsBlockFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsBlockFrame.cpp:1577]
            nsAreaFrame::Reflow(nsIPresContext*,nsHTMLReflowMetrics&,const
nsHTMLReflowState&,unsigned int&) [nsAreaFrame.cpp:272]
      Reading 4 bytes from 0xefffab00 on the stack.
      Address 0xefffab00 is 344 bytes below frame pointer in function
nsTableRowFrame::ResizeReflow(nsIPresContext*,nsHTMLReflowMetrics&,RowReflowState&,unsigned
int&,int).

Comment 1

[karnaze (gone)]

Moving to M17.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I think bruce's arrows are misleading.  When nsContainerFrame::ReflowChild gets
to the point where it hits the UMR, it has already called

result = aKidFrame->Reflow(aPresContext, aDesiredSize, aReflowState,
                           aStatus);

nsIFrame.h says Reflow should set the aStatus out param.  So the bug here is
probably that some child reflow method didn't set aStatus.

Since the parent reflow method was nsTableRowFrame, I'd have to guess the bug
might be in nsTableCellFrame...

Comment 3

[Bruce Mitchener]

(Just for the record, those arrows are from Purify .. not me.)

Comment 4

[karnaze (gone)]

moving to m0.9.1

Comment 5

[Amarendra Hanumanula]

QA contact update

Comment 6

[karnaze (gone)]

Moving to m0.9

Comment 7

[karnaze (gone)]

Attachment: patch to set aStatus in nsTableRowGroupFrame.cpp

Comment 8

[Marc Attinasi]

sr=attinasi

Comment 9

[karnaze (gone)]

The patch is in.

Comment 10

[Amarendra Hanumanula]

 Marking verifed