378704 - valgrind warning: uninitialized memory in nsSVGElement.cpp

Status: RESOLVED DUPLICATE of bug 547964

(Core :: SVG, defect)

Description

[Robert Sayre]

Conditional jump or move depends on uninitialised value(s)
 at 0x1439835D: nsSVGElement::GetAnimatedLengthValues(float*, ...) (nsSVGElement.cpp:858)
 by 0x143F2F25: nsSVGRectElement::ConstructPath(gfxContext*) (nsSVGRectElement.cpp:176)
 by 0x14374711: nsSVGPathGeometryFrame::GeneratePath(gfxContext*) (nsSVGPathGeometryFrame.cpp:682)
 by 0x1437480F: nsSVGPathGeometryFrame::Render(nsSVGRenderState*) (nsSVGPathGeometryFrame.cpp:618)
 by 0x1437578E: nsSVGPathGeometryFrame::PaintSVG(nsSVGRenderState*, nsRect*) (nsSVGPathGeometryFrame.cpp:346)
 by 0x14383539: nsSVGUtils::PaintChildWithEffects(nsSVGRenderState*, nsRect*, nsIFrame*) (nsSVGUtils.cpp:965)
 by 0x143723F8: nsSVGOuterSVGFrame::Paint(nsIRenderingContext&, nsRect const&, nsPoint) (nsSVGOuterSVGFrame.cpp:485)
 by 0x1437247E: nsDisplaySVG::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) (nsSVGOuterSVGFrame.cpp:376)
 by 0x13D3D6DE: nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) const (nsDisplayList.cpp:299)
 by 0x13D3D99C: nsDisplayWrapList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) (nsDisplayList.cpp:707)
 by 0x13D3E721: nsDisplayClip::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) (nsDisplayList.cpp:939)
 by 0x13D3D6DE: nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) const (nsDisplayList.cpp:299) 

---------------------------------------------------------------

843 nsSVGElement::GetAnimatedLengthValues(float *aFirst, ...)
844 {
845   LengthAttributesInfo info = GetLengthInfo();
846 
847   NS_ASSERTION(info.mLengthCount > 0,
848                "GetAnimatedLengthValues on element with no length attribs");
849 
850   nsSVGSVGElement *ctx = nsnull;
851 
852   float *f = aFirst;
853   PRUint32 i = 0;
854 
855   va_list args;
856   va_start(args, aFirst);
857 
858   while (f && i < info.mLengthCount) {
859     if (!ctx) {
860       PRUint8 type = info.mLengths[i].GetSpecifiedUnitType();
861       if (type != nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER &&
862           type != nsIDOMSVGLength::SVG_LENGTHTYPE_PX)
863         ctx = GetCtx();
864     }
865     *f = info.mLengths[i++].GetAnimValue(ctx);
866     f = va_arg(args, float*);
867   }
868 
869   va_end(args);
870 }

Comment 1

[Jesse Ruderman]

Do you have a testcase, or can you tell what's wrong with the code by looking at the code?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Robert, did you see this on a 64-bit system?  If so, see bug 547964.

Comment 4

[Jesse Ruderman]

The valgrind complaint is on exactly the same line as in that bug, fwiw.

Comment 5

[Robert Longson [:longsonr]]

Can you cc me on bug 547964 please?

Comment 6

[Boris Zbarsky [:bzbarsky]]

> The valgrind complaint is on exactly the same line as in that bug, fwiw.

Yes, exactly.

Comment 7

[Robert Sayre]

(In reply to comment #3)
> Robert, did you see this on a 64-bit system?  If so, see bug 547964.

yeah, it was 64-bit linux.