Uninitialised value use in gfx/layers/basic/BasicLayers.cpp

RESOLVED FIXED in mozilla12

Status

()

Core
Graphics
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jseward, Assigned: jseward)

Tracking

({valgrind})

Trunk
mozilla12
x86_64
Linux
valgrind
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
trunk; x86_64-linux; X server is 16 bit VNC server (yeah yeah, I know),
the valgrind complaint below appears when displaying more or less any
page.  Test case is the admin page on my router, so adding the URL here
is pointless.

Comparing BasicLayerManager::BasicLayerManager() against 
BasicLayerManager::BasicLayerManager(nsIWidget* aWidget) it appears
the former fails to give any initial value for mCachedSurfaceInUse
(the cause of this complaint) and also for mTransactionIncomplete
(although that seems unrelated).

Conditional jump or move depends on uninitialised value(s)
   at 0x6D0BFDA: mozilla::layers::BasicLayerManager::PushGroupWithCachedSurface(gfxContext*, gfxASurface::gfxContentType) (BasicLayers.cpp:1347)
   by 0x6D0C4CE: mozilla::layers::BasicLayerManager::PushGroupForLayer(gfxContext*, mozilla::layers::Layer*, nsIntRegion const&, bool*) (BasicLayers.cpp:648)
   by 0x6D10D65: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:704)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D10951: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1619)
   by 0x6D109F4: mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1570)
   by 0x61D8A14: mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) (FrameLayerBuilder.cpp:1336)
   by 0x6D0F3F7: mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) (BasicLayers.cpp:562)
   by 0x6D1117C: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:752)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)

 Uninitialised value was created by a heap allocation
   at 0x4029B9A: malloc (vg_replace_malloc.c:263)
   by 0x403E055: moz_xmalloc (mozalloc.cpp:103)
   by 0x61D8857: mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) (mozalloc.h:229)
   by 0x6D0F3F7: mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) (BasicLayers.cpp:562)
   by 0x6D1117C: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:752)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D10951: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1619)
   by 0x6D109F4: mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1570)
   by 0x6D11AEC: mozilla::layers::BasicShadowLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:3341)
   by 0x6209B61: nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const (nsDisplayList.cpp:637)
(Assignee)

Comment 1

6 years ago
Created attachment 591175 [details] [diff] [review]
proposed fix

This just does the obvious thing of changing
BasicLayerManager::BasicLayerManager() to initialise the
same fields that
BasicLayerManager::BasicLayerManager(nsIWidget* aWidget).
Note that that means it also adds an initialisation for 
mTransactionIncomplete, which is unrelated to this problem.
I don't know if that is good/bad/otherwise, but at least
the two constructors are now consistent.
Attachment #591175 - Flags: review+
(Assignee)

Updated

6 years ago
Keywords: checkin-needed, valgrind

Updated

6 years ago
Assignee: nobody → jseward
http://hg.mozilla.org/integration/mozilla-inbound/rev/2fd4890ba80d
Keywords: checkin-needed
Target Milestone: --- → mozilla12
https://hg.mozilla.org/mozilla-central/rev/2fd4890ba80d
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.