Last Comment Bug 720758 - Uninitialised value use in gfx/layers/basic/BasicLayers.cpp
: Uninitialised value use in gfx/layers/basic/BasicLayers.cpp
Status: RESOLVED FIXED
: valgrind
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: Trunk
: x86_64 Linux
: -- normal (vote)
: mozilla12
Assigned To: Julian Seward [:jseward]
:
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-24 10:37 PST by Julian Seward [:jseward]
Modified: 2012-01-26 15:58 PST (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
proposed fix (620 bytes, patch)
2012-01-24 10:43 PST, Julian Seward [:jseward]
bas: review+
Details | Diff | Splinter Review

Description Julian Seward [:jseward] 2012-01-24 10:37:43 PST
trunk; x86_64-linux; X server is 16 bit VNC server (yeah yeah, I know),
the valgrind complaint below appears when displaying more or less any
page.  Test case is the admin page on my router, so adding the URL here
is pointless.

Comparing BasicLayerManager::BasicLayerManager() against 
BasicLayerManager::BasicLayerManager(nsIWidget* aWidget) it appears
the former fails to give any initial value for mCachedSurfaceInUse
(the cause of this complaint) and also for mTransactionIncomplete
(although that seems unrelated).

Conditional jump or move depends on uninitialised value(s)
   at 0x6D0BFDA: mozilla::layers::BasicLayerManager::PushGroupWithCachedSurface(gfxContext*, gfxASurface::gfxContentType) (BasicLayers.cpp:1347)
   by 0x6D0C4CE: mozilla::layers::BasicLayerManager::PushGroupForLayer(gfxContext*, mozilla::layers::Layer*, nsIntRegion const&, bool*) (BasicLayers.cpp:648)
   by 0x6D10D65: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:704)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D10951: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1619)
   by 0x6D109F4: mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1570)
   by 0x61D8A14: mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) (FrameLayerBuilder.cpp:1336)
   by 0x6D0F3F7: mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) (BasicLayers.cpp:562)
   by 0x6D1117C: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:752)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)

 Uninitialised value was created by a heap allocation
   at 0x4029B9A: malloc (vg_replace_malloc.c:263)
   by 0x403E055: moz_xmalloc (mozalloc.cpp:103)
   by 0x61D8857: mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) (mozalloc.h:229)
   by 0x6D0F3F7: mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) (BasicLayers.cpp:562)
   by 0x6D1117C: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:752)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D10951: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1619)
   by 0x6D109F4: mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1570)
   by 0x6D11AEC: mozilla::layers::BasicShadowLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:3341)
   by 0x6209B61: nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const (nsDisplayList.cpp:637)
Comment 1 Julian Seward [:jseward] 2012-01-24 10:43:19 PST
Created attachment 591175 [details] [diff] [review]
proposed fix

This just does the obvious thing of changing
BasicLayerManager::BasicLayerManager() to initialise the
same fields that
BasicLayerManager::BasicLayerManager(nsIWidget* aWidget).
Note that that means it also adds an initialisation for 
mTransactionIncomplete, which is unrelated to this problem.
I don't know if that is good/bad/otherwise, but at least
the two constructors are now consistent.
Comment 3 Marco Bonardo [::mak] 2012-01-26 15:58:23 PST
https://hg.mozilla.org/mozilla-central/rev/2fd4890ba80d

Note You need to log in before you can comment on or make changes to this bug.