620973 - ReflowInput::InitConstraints uses fType unintialized if !cbrs->parentReflowState && eCompatibility_NavQuirks

Status: RESOLVED DUPLICATE of bug 458473

(Core :: Layout, defect)

Description

[timeless]

1646 nsHTMLReflowState::InitConstraints(nsPresContext* aPresContext,
1647                                    nscoord         aContainingBlockWidth,
1648                                    nscoord         aContainingBlockHeight,
1649                                    const nsMargin* aBorder,
1650                                    const nsMargin* aPadding)
1651 {
1658   if (nsnull == parentReflowState) {
1679   } else {
1681     const nsHTMLReflowState* cbrs = mCBReflowState;
true:
1686     if (aContainingBlockWidth == -1) {
1687       ComputeContainingBlockRectangle(aPresContext, cbrs, aContainingBlockWidth, 
1688                                       aContainingBlockHeight);
1689     }

not initialized:
1693     nsIAtom* fType;

true:
1694     if (NS_AUTOHEIGHT == aContainingBlockHeight) {

false, skip:
1698       if (cbrs->parentReflowState) {
1704       }
1705     }

true:
1716     if (height.HasPercent()) {

true:
1717       if (NS_AUTOHEIGHT == aContainingBlockHeight) {

true:
1721         if (NS_FRAME_REPLACED(NS_CSS_FRAME_TYPE_INLINE) == mFrameType ||
1722             NS_FRAME_REPLACED_CONTAINS_BLOCK(
1723                 NS_CSS_FRAME_TYPE_INLINE) == mFrameType) {

true:
1727           if (eCompatibility_NavQuirks == aPresContext->CompatibilityMode()) {

using fType uninitialized:
1728             if (!IS_TABLE_CELL(fType)) {

Comment 1

[timeless]

Attachment: proposal

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 499412 [details] [diff] [review]
proposal

If we need fType, having it incorrect doesn't do much good.

Is it actually possible to reflow a table cell without a parent reflow state?

Comment 3

[Bernd]

the code expects at multiple places that the cell is wrapped in row frame

Comment 4

[Boris Zbarsky [:bzbarsky]]

> Is it actually possible to reflow a table cell without a parent reflow state?

No.

Comment 5

[Daniel Veditz [:dveditz]]

IS_TABLE_CELL() just does pointer comparisons. This is a bug, but doesn't seem exploitable in any way.

Comment 6

[Eric Rahm [:erahm]]

Should be just add:
        fType = cbrs->frame->GetType();
before calling IS_TABLE_CELL?

Comment 7

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 9

[jbonnafo]

nsHTMLReflowState file does not seem to be here anymore, should this bug be closed?

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It's been renamed.