715023 - Clang Static Analysis: Function call argument is an uninitialized value in layout/tables/nsTableFrame.cpp

Status: RESOLVED WORKSFORME

(Core :: Layout: Tables, defect)

Description

[Christian Holler (:decoder)]

The following report (in the URL field) has been generated by static analysis using Clang.

It would be good if someone familiar with the particular code could check if

- this is really a bug or a false positive
- and/or if it makes sense to adjust the code (even if there is not a real bug present, e.g. by adding a missing initialization).


In this particular report, the analysis seems to assume | pseudoFrame == NULL | can happen which leaves the | content | pointer uninitialized when it is used in line 2174.

Comment 1

[Mats Palmgren (inactive)]

> the analysis seems to assume | pseudoFrame == NULL |

'pseudoFrame' is always non-null when entering the while-loop
at line 2168, because we would have already crashed at line 2146
if 'aFrameList.FirstChild()' were null, which means 'content' is
always assigned.

Comment 2

[Christian Holler (:decoder)]

(In reply to Mats Palmgren [:mats] from comment #1)
> 'pseudoFrame' is always non-null when entering the while-loop
> at line 2168, because we would have already crashed at line 2146
> if 'aFrameList.FirstChild()' were null, which means 'content' is
> always assigned.

Thanks for looking into this. This is probably the same analysis bug we've been hitting before: Clang doesn't realize that | aFrameList.FirstChild() | returns the same value when called twice in this method (the inlining implementation in Clang analyzer is not working yet afaik).