536438 - Buggy switch statement in mathml/nsMathMLChar.cpp

Status: RESOLVED FIXED

(Core :: MathML, defect)

Description

[Ehren Metcalfe]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091221 Minefield/3.7a1pre
Build Identifier: 

static PRBool GetFontExtensionPref(nsIPrefBranch* aPrefBranch, PRUnichar aChar, nsMathfontPrefExtension aExtension, nsString& aValue) contains a switch statement that is most likely missing break statements for every case:

http://hg.mozilla.org/mozilla-central/file/5803dc30baea/layout/mathml/nsMathMLChar.cpp#l698

This was discovered using a Treehydra analysis (see blocked bug)

Reproducible: Always

Comment 1

[Ehren Metcalfe]

Attachment: add break statements

I don't really know this code but this seems to make sense.

Comment 2

[Frédéric Wang (:fredw)]

    Yes, I think you are entirely right. Without the break keywords, GetFontExtensionPref is just going to assign different values to the extension string and then go out with a PR_FALSE return value (and that's what I've just checked in debugging mode). Apparently, this function allows to specify font families for a given character but I don't think this preference option is very used. That's probably why no bug has been detected until now. By the way, it seems that the dead code in the second part is also wrong, since the keys are not built correctly (the end of alternateKey is appended to key). I'm going to attach a patch that fix this problem.

Comment 3

[Frédéric Wang (:fredw)]

Attachment: Fix creation of keys in GetFontExtensionPref

Comment 4

[Karl Tomlinson (:karlt)]

http://hg.mozilla.org/mozilla-central/rev/b56dd52130ab
http://hg.mozilla.org/mozilla-central/rev/5c82af652408