Bug 12510 – Uninitialized member being used before set

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[David Carson]

In the function:
void Marquee::updateMarqueeStyle()
the value m_totalLoops is being tested before it has been set for the first time.

The test case that can be used to see this is:
LayoutTests/fast/css/MarqueeLayoutTest.html

[David Carson]

Call stack:
==14403== Conditional jump or move depends on uninitialised value(s)
==14403==    at 0x7ADCDD4: WebCore::Marquee::updateMarqueeStyle() (RenderLayer.cpp:2115)
==14403==    by 0x7AE0071: WebCore::RenderLayer::styleChanged() (RenderLayer.cpp:1928)
==14403==    by 0x7AB8804: WebCore::RenderBox::setStyle(WebCore::RenderStyle*) (RenderBox.cpp:148)
==14403==    by 0x7AA8A5E: WebCore::RenderBlock::setStyle(WebCore::RenderStyle*) (RenderBlock.cpp:111)
==14403==    by 0x7953F12: WebCore::Node::createRendererIfNeeded() (Node.cpp:912)
==14403==    by 0x7945644: WebCore::Element::attach() (Element.cpp:558)
==14403==    by 0x79F8827: WebCore::HTMLParser::insertNode(WebCore::Node*, bool) (HTMLParser.cpp:288)
==14403==    by 0x79FA3BC: WebCore::HTMLParser::parseToken(WebCore::Token*) (HTMLParser.cpp:220)

[David Carson]

Line numbers in call stack out of sync with ToT, but error still exists.

[David Carson]

Created attachment 12831 [details]
patch

[Darin Adler]

Comment on attachment 12831 [details]
patch

r=me

[Sam Weinig]

Landed in r19323.