534162 - Fix "nsXMLFragmentContentSink.cpp:612: warning: ‘rv’ may be used uninitialized in this function"

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Daniel Holbert [:dholbert]]

Attachment: fix: initialize rv to NS_OK

GCC 4.3.3 on Linux gives us this warning, when building mozilla-central:
> /content/xml/document/src/nsXMLFragmentContentSink.cpp: In member function ‘virtual nsresult nsXHTMLParanoidFragmentSink::AddAttributes(const PRUnichar**, nsIContent*)’:
> /content/xml/document/src/nsXMLFragmentContentSink.cpp:612: warning: ‘rv’ may be used uninitialized in this function

This looks like a real bug.  Snippet of code:

612   nsresult rv;
[...]
627   while (*aAtts) {
[...]
633     if (IsAttrURI(nodeInfo->NameAtom())) {
[...]      // Code that sets |rv|
645     }
646 
647     if (NS_SUCCEEDED(rv)) {

So, if the IsAttrURI check fails, we'll end up reading |rv|'s uninitialized value at line 647.

Looks like this bug was introduced in the top chunk of the change linked below -- it removes a line that used to initialize |rv| before we even get to the IsAttrURI check:

http://hg.mozilla.org/mozilla-central/diff/ec4733eb1bd8/content/xml/document/src/nsXMLFragmentContentSink.cpp

Anyway, this is easily fixable by initializing |rv| to NS_OK in the first place. (which is what it would be when we hit all this code, prior to the change linked above, due to an NS_ENSURE_SUCCESS call that was also removed in that change)

Comment 1

[Daniel Holbert [:dholbert]]

Taras -- from glancing at bug 450777, it sounds like that bug's patch (which introduced this bug) was generated using an automated tool of some sort.

It scares me a bit that our code-generation tools can introduce problems like this one[1] in their generated patches -- is this something we can fix them to detect & avoid?

[1] "problems like this one" = deletions of a line that potentially initialized a variable for the first time.

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 417069 [details] [diff] [review]
fix: initialize rv to NS_OK

Good catch!

Comment 3

[Daniel Holbert [:dholbert]]

http://hg.mozilla.org/mozilla-central/rev/7c82e36c120c