720758 - Uninitialised value use in gfx/layers/basic/BasicLayers.cpp

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Julian Seward [:jseward]]

trunk; x86_64-linux; X server is 16 bit VNC server (yeah yeah, I know),
the valgrind complaint below appears when displaying more or less any
page.  Test case is the admin page on my router, so adding the URL here
is pointless.

Comparing BasicLayerManager::BasicLayerManager() against 
BasicLayerManager::BasicLayerManager(nsIWidget* aWidget) it appears
the former fails to give any initial value for mCachedSurfaceInUse
(the cause of this complaint) and also for mTransactionIncomplete
(although that seems unrelated).

Conditional jump or move depends on uninitialised value(s)
   at 0x6D0BFDA: mozilla::layers::BasicLayerManager::PushGroupWithCachedSurface(gfxContext*, gfxASurface::gfxContentType) (BasicLayers.cpp:1347)
   by 0x6D0C4CE: mozilla::layers::BasicLayerManager::PushGroupForLayer(gfxContext*, mozilla::layers::Layer*, nsIntRegion const&, bool*) (BasicLayers.cpp:648)
   by 0x6D10D65: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:704)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D10951: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1619)
   by 0x6D109F4: mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1570)
   by 0x61D8A14: mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) (FrameLayerBuilder.cpp:1336)
   by 0x6D0F3F7: mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) (BasicLayers.cpp:562)
   by 0x6D1117C: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:752)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)

 Uninitialised value was created by a heap allocation
   at 0x4029B9A: malloc (vg_replace_malloc.c:263)
   by 0x403E055: moz_xmalloc (mozalloc.cpp:103)
   by 0x61D8857: mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*) (mozalloc.h:229)
   by 0x6D0F3F7: mozilla::layers::BasicShadowableThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*) (BasicLayers.cpp:562)
   by 0x6D1117C: mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:752)
   by 0x6D0FCE4: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1910)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D0FDC2: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) (BasicLayers.cpp:1925)
   by 0x6D10951: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1619)
   by 0x6D109F4: mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:1570)
   by 0x6D11AEC: mozilla::layers::BasicShadowLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (BasicLayers.cpp:3341)
   by 0x6209B61: nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const (nsDisplayList.cpp:637)

Comment 1

[Julian Seward [:jseward]]

Attachment: proposed fix

This just does the obvious thing of changing
BasicLayerManager::BasicLayerManager() to initialise the
same fields that
BasicLayerManager::BasicLayerManager(nsIWidget* aWidget).
Note that that means it also adds an initialisation for 
mTransactionIncomplete, which is unrelated to this problem.
I don't know if that is good/bad/otherwise, but at least
the two constructors are now consistent.

Comment 2

[Dão Gottwald [:dao]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/2fd4890ba80d

Comment 3

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/2fd4890ba80d