33570 - UMR: CNavDTD::GetTokenizer()

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[Bruce Mitchener]

This happened twice with a build from last night, loading
http://www.slashdot.org/ in viewer.

      UMR: Uninitialized memory read
      This is occurring while in:
            CNavDTD::GetTokenizer(nsITokenizer*&) [CNavDTD.cpp:3497]
               nsresult CNavDTD::GetTokenizer(nsITokenizer*& aTokenizer) {
                 nsresult result=NS_OK;
                 if(!mTokenizer) {
            =>    
result=NS_NewHTMLTokenizer(&mTokenizer,mParseMode,mDocType,mParserCommand);
                 }
                 aTokenizer=mTokenizer;
                 return result;
            nsParser::Tokenize(int) [nsParser.cpp:1713]
            nsParser::ResumeParse(int,int) [nsParser.cpp:1180]
            nsParser::Parse(const nsString&,void*,const
nsString&,int,int,eParseMode) [nsParser.cpp:992]
            nsHTMLDocument::ScriptWriteCommon(JSContext*,long*,unsigned int,int)
[nsHTMLDocument.cpp:2068]
            nsHTMLDocument::Write(JSContext*,long*,unsigned int)
[nsHTMLDocument.cpp:2081]
            NSHTMLDocumentWrite(JSContext*,JSObject*,unsigned int,long*,long*)
[nsJSHTMLDocument.cpp:911]
            js_Invoke      [jsinterp.c:679]
            js_Interpret   [jsinterp.c:2457]
            js_Execute     [jsinterp.c:850]
            JS_EvaluateUCScriptForPrincipals [jsapi.c:2744]
            nsJSContext::EvaluateString(const
nsString&,void*,nsIPrincipal*,const char*,unsigned int,const
char*,nsString&,int*) [nsJSEnvironment.cpp:287]
            HTMLContentSink::EvaluateScript(nsString&,nsIURI*,int,const char*)
[nsHTMLContentSink.cpp:4154]
            HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode&)
[nsHTMLContentSink.cpp:4403]
            HTMLContentSink::AddLeaf(const nsIParserNode&)
[nsHTMLContentSink.cpp:2963]
            CNavDTD::AddLeaf(const nsIParserNode*) [CNavDTD.cpp:3297]
            CNavDTD::HandleScriptToken(const nsIParserNode*) [CNavDTD.cpp:1884]
            CNavDTD::OpenContainer(const
nsIParserNode*,nsHTMLTag,int,nsEntryStack*) [CNavDTD.cpp:2953]
            CNavDTD::HandleDefaultStartToken(CToken*,nsHTMLTag,nsIParserNode*)
[CNavDTD.cpp:1091]
            CNavDTD::HandleStartToken(CToken*) [CNavDTD.cpp:1423]
            CNavDTD::HandleToken(CToken*,nsIParser*) [CNavDTD.cpp:776]
           
CNavDTD::BuildModel(nsIParser*,nsITokenizer*,nsITokenObserver*,nsIContentSink*)
[CNavDTD.cpp:514]
            nsParser::BuildModel() [nsParser.cpp:1297]
            nsParser::ResumeParse(int,int) [nsParser.cpp:1181]
           
nsParser::OnDataAvailable(nsIChannel*,nsISupports*,nsIInputStream*,unsigned
int,unsigned int) [nsParser.cpp:1613]
           
nsDocumentOpenInfo::OnDataAvailable(nsIChannel*,nsISupports*,nsIInputStream*,unsigned
int,unsigned int) [nsURILoader.cpp:267]
           
InterceptStreamListener::OnDataAvailable(nsIChannel*,nsISupports*,nsIInputStream*,unsigned
int,unsigned int) [nsCachedNetData.cpp:1129]
           
nsHTTPServerListener::OnDataAvailable(nsIChannel*,nsISupports*,nsIInputStream*,unsigned
int,unsigned int) [nsHTTPResponseListener.cpp:410]
            nsOnDataAvailableEvent::HandleEvent()
[nsAsyncStreamListener.cpp:384]
            nsStreamListenerEvent::HandlePLEvent(PLEvent*)
[nsAsyncStreamListener.cpp:97]
      Reading 4 bytes from 0xc63218 in the heap.
      Address 0xc63218 is 280 bytes into a malloc'd block at 0xc63100 of 620
bytes.
      This block was allocated from:
            malloc         [rtlib.o]
            __bUiLtIn_nEw  [libxpcom.so]
            __builtin_new  [rtlib.o]
            CNavDTDConstructor(nsISupports*,const nsID&,void**)
[nsParserModule.cpp:128]
               NS_GENERIC_FACTORY_CONSTRUCTOR(nsCParserNode)
               NS_GENERIC_FACTORY_CONSTRUCTOR(nsLoggingSink)
               NS_GENERIC_FACTORY_CONSTRUCTOR(CWellFormedDTD)
            => NS_GENERIC_FACTORY_CONSTRUCTOR(CNavDTD)
               NS_GENERIC_FACTORY_CONSTRUCTOR(nsXIFDTD)
               NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLContentSinkStream)
               NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLToTXTSinkStream)
            nsGenericFactory::CreateInstance(nsISupports*,const nsID&,void**)
[nsGenericFactory.cpp:47]
            nsComponentManagerImpl::CreateInstance(const
nsID&,nsISupports*,const nsID&,void**) [nsComponentManager.cpp:1156]
            nsComponentManager::CreateInstance(const nsID&,nsISupports*,const
nsID&,void**) [nsRepository.cpp:81]
            NS_NewNavHTMLDTD(nsIDTD**) [CNavDTD.h:542]
            CNavDTD::CreateNewInstance(nsIDTD**) [CNavDTD.cpp:330]
            nsParser::Parse(const nsString&,void*,const
nsString&,int,int,eParseMode) [nsParser.cpp:969]
            nsHTMLDocument::ScriptWriteCommon(JSContext*,long*,unsigned int,int)
[nsHTMLDocument.cpp:2068]
            nsHTMLDocument::Write(JSContext*,long*,unsigned int)
[nsHTMLDocument.cpp:2081]
            NSHTMLDocumentWrite(JSContext*,JSObject*,unsigned int,long*,long*)
[nsJSHTMLDocument.cpp:911]
            js_Invoke      [jsinterp.c:679]
            js_Interpret   [jsinterp.c:2457]
            js_Execute     [jsinterp.c:850]
            JS_EvaluateUCScriptForPrincipals [jsapi.c:2744]
            nsJSContext::EvaluateString(const
nsString&,void*,nsIPrincipal*,const char*,unsigned int,const
char*,nsString&,int*) [nsJSEnvironment.cpp:287]
            HTMLContentSink::EvaluateScript(nsString&,nsIURI*,int,const char*)
[nsHTMLContentSink.cpp:4154]
            HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode&)
[nsHTMLContentSink.cpp:4403]
            HTMLContentSink::AddLeaf(const nsIParserNode&)
[nsHTMLContentSink.cpp:2963]
            CNavDTD::AddLeaf(const nsIParserNode*) [CNavDTD.cpp:3297]
            CNavDTD::HandleScriptToken(const nsIParserNode*) [CNavDTD.cpp:1884]
            CNavDTD::OpenContainer(const
nsIParserNode*,nsHTMLTag,int,nsEntryStack*) [CNavDTD.cpp:2953]
            CNavDTD::HandleDefaultStartToken(CToken*,nsHTMLTag,nsIParserNode*)
[CNavDTD.cpp:1091]
            CNavDTD::HandleStartToken(CToken*) [CNavDTD.cpp:1423]
            CNavDTD::HandleToken(CToken*,nsIParser*) [CNavDTD.cpp:776]
           
CNavDTD::BuildModel(nsIParser*,nsITokenizer*,nsITokenObserver*,nsIContentSink*)
[CNavDTD.cpp:514]
            nsParser::BuildModel() [nsParser.cpp:1297]
            nsParser::ResumeParse(int,int) [nsParser.cpp:1181]

Comment 1

[rickg]

An easy one for you.

Comment 2

[harishd]

This is FIXED in my tree. Will check it in after the the code has been reviewed.

Comment 3

[Bruce Mitchener]

I'd be happy to review it if you attach it as a patch to this bug.

Comment 4

[Bruce Mitchener]

Any ETA on this?  This causes a good bit of UMR noise when loading some sites
under Purify.

Comment 5

[harishd]

ETA: On or before Friday. Couldn't attach the diffs due to other changes in my 
tree. Appreciate your offer.

Comment 6

[harishd]

Attachment: One liner to fix the UMR... [ Much simpler than what I'd,in my tree, before ]

Comment 7

[harishd]

Calling WillBuildModel() after creating an instance of the DTD in Parse(String).
.FIXED.

Comment 8

[Jan Carpenter]

Verified:
2000-09-28-09-MN6 : Windows
2000-09-26-04-M18 : Mac
2000-09-28-10-MN6 : Linux