Last Comment Bug 767370 - Uninitialised value use in nsIDOMKeyEvent_GetCharCode
: Uninitialised value use in nsIDOMKeyEvent_GetCharCode
Product: Core
Classification: Components
Component: DOM: Events (show other bugs)
: Trunk
: x86_64 Linux
-- normal (vote)
: mozilla16
Assigned To: Julian Seward [:jseward]
: Andrew Overholt [:overholt]
Depends on:
  Show dependency treegraph
Reported: 2012-06-22 07:15 PDT by Julian Seward [:jseward]
Modified: 2012-06-23 05:46 PDT (History)
2 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (556 bytes, patch)
2012-06-22 07:18 PDT, Julian Seward [:jseward]
peterv: review+
Details | Diff | Splinter Review
as previous patch, with proper hg admin stuff (820 bytes, patch)
2012-06-22 08:59 PDT, Julian Seward [:jseward]
no flags Details | Diff | Splinter Review

Description User image Julian Seward [:jseward] 2012-06-22 07:15:17 PDT

nsIDOMKeyEvent_GetCharCode(JSContext*, JS::Handle<JSObject*>,
JS::Handle<long>, JS::Value*) has this

    PRUint32 result;
    rv = self->GetCharCode(&result);
    if (NS_FAILED(rv))
        return xpc_qsThrowGetterSetterFailed(cx, rv, JSVAL_TO_OBJECT(*vp), id);

GetCharCode can return a non-NS_FAILED |rv| without assigning anything
to |result|.  The resulting uninitialised values get copied far and
wide throughout the system and result in dozens of error reports from
Valgrind.  The first one is shown below.

Conditional jump or move depends on uninitialised value(s)
   at 0x6BF5B74: nsIDOMKeyEvent_GetCharCode(JSContext*, JS::Handle<JSObject*>, JS::Handle<long>, JS::Value*) (jsapi.h:1849)
   by 0x7489207: js::baseops::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<long>, JS::Value*) (jscntxtinlines.h:444)
   by 0x7471E9B: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsobjinlines.h:162)
   by 0x7473BCE: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:267)
   by 0x74741A8: js::InvokeKernel(JSContext*, js::CallArgs, js::MaybeConstruct) (jsinterp.cpp:322)
   by 0x74746FA: js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) (jsinterp.h:100)
   by 0x7403EFD: JS_CallFunctionValue (jsapi.cpp:5489)
   by 0x689F2C9: nsJSContext::CallEventHandler(nsISupports*, JSObject*, JSObject*, nsIArray*, nsIVariant**) [clone .part.80] (nsJSEnvironment.cpp:1910)
   by 0x68BF291: nsGlobalWindow::RunTimeoutHandler(nsTimeout*, nsIScriptContext*) (nsGlobalWindow.cpp:9066)
   by 0x68BFF7F: nsGlobalWindow::RunTimeout(nsTimeout*) (nsGlobalWindow.cpp:9320)
   by 0x68C0088: nsGlobalWindow::TimerCallback(nsITimer*, void*) (nsGlobalWindow.cpp:9591)
   by 0x70BB351: nsTimerImpl::Fire() (nsTimerImpl.cpp:473)
 Uninitialised value was created by a stack allocation
   at 0x6BF5AC0: nsIDOMKeyEvent_GetCharCode(JSContext*, JS::Handle<JSObject*>, JS::Handle<long>, JS::Value*) (dom_quickstubs.cpp:10965)
Comment 1 User image Julian Seward [:jseward] 2012-06-22 07:18:12 PDT
Created attachment 635733 [details] [diff] [review]
Comment 2 User image Nathan Froyd [:froydnj] 2012-06-22 07:42:56 PDT
I'll check the patch in for you, but could you please export a proper hg patch with attribution, comment message, etc.?
Comment 3 User image Nathan Froyd [:froydnj] 2012-06-22 07:48:18 PDT
Clearing c-n while the patch gets tidied.
Comment 4 User image Julian Seward [:jseward] 2012-06-22 08:59:28 PDT
Created attachment 635771 [details] [diff] [review]
as previous patch, with proper hg admin stuff
Comment 6 User image Ryan VanderMeulen [:RyanVM] 2012-06-23 05:46:59 PDT

Note You need to log in before you can comment on or make changes to this bug.