Bug 166058

Summary:

[Cairo] Conditional jump or move depends on uninitialised value(s)

Product:

WebKit

Reporter:

Carlos Garcia Campos <cgarcia>

Component:

Platform

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bugs-noreply, commit-queue, mcatanzaro, mmaxfield

Priority:

Keywords:

Gtk

Version:

WebKit Local Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Carlos Garcia Campos 2016-12-20 06:20:45 PST

==25564== Conditional jump or move depends on uninitialised value(s)
==25564==    at 0x9A72001: _cairo_gstate_transform_glyphs_to_backend (cairo-gstate.c:2198)
==25564==    by 0x9A757BC: _cairo_gstate_glyph_path (cairo-gstate.c:2085)
==25564==    by 0x9A678A1: cairo_glyph_path (cairo.c:3555)
==25564==    by 0x71DA2EE: WebCore::CairoGlyphToPathTranslator::path() (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x71DB01A: WebCore::FontCascade::dashesForIntersectionsWithRect(WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatRect const&) const (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6F19C58: WebCore::drawSkipInkUnderline(WebCore::GraphicsContext&, WebCore::FontCascade const&, WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatPoint const&, float, float, bool, bool, WebCore::StrokeStyle) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6F1B01A: WebCore::TextDecorationPainter::paintTextDecoration(WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatPoint const&) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D4BE6B: WebCore::InlineTextBox::paintDecoration(WebCore::GraphicsContext&, WebCore::FontCascade const&, WebCore::RenderCombineText*, WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatRect const&, WebCore::TextDecoration, WebCore::TextPaintStyle, WebCore::ShadowData const*) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D509CC: WebCore::InlineTextBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==  Uninitialised value was created by a stack allocation
==25564==    at 0x5E3C720: ??? (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)

Comment 1 Carlos Garcia Campos 2016-12-20 06:22:52 PST

Created attachment 297518 [details]
Patch

Comment 2 Michael Catanzaro 2016-12-20 06:49:17 PST

It reminds me of https://bugs.freedesktop.org/show_bug.cgi?id=91271, which is very annoying when valgrinding as it happens every time when loading any page. But clearly this is a separate issue.

Comment 3 WebKit Commit Bot 2016-12-20 23:49:18 PST

Comment on attachment 297518 [details]
Patch

Clearing flags on attachment: 297518

Committed r210056: <http://trac.webkit.org/changeset/210056>

Comment 4 WebKit Commit Bot 2016-12-20 23:49:23 PST

All reviewed patches have been landed.  Closing bug.

Comment 5 Said Abou-Hallawa 2017-01-04 10:24:18 PST

Comment on attachment 297518 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=297518&action=review

> Source/WebCore/platform/graphics/cairo/FontCairo.cpp:246
>      cairo_glyph_t cairoGlyph;
>      cairoGlyph.index = m_glyphBuffer.glyphAt(m_index);
> +    cairoGlyph.x = cairoGlyph.y = 0;

These could have been written like this:

cairo_glyph_t cairoGlyph = { m_glyphBuffer.glyphAt(m_index), 0, 0 };

Comment 6 Carlos Garcia Campos 2017-01-04 23:29:02 PST

(In reply to comment #5)
> Comment on attachment 297518 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=297518&action=review
> 
> > Source/WebCore/platform/graphics/cairo/FontCairo.cpp:246
> >      cairo_glyph_t cairoGlyph;
> >      cairoGlyph.index = m_glyphBuffer.glyphAt(m_index);
> > +    cairoGlyph.x = cairoGlyph.y = 0;
> 
> These could have been written like this:
> 
> cairo_glyph_t cairoGlyph = { m_glyphBuffer.glyphAt(m_index), 0, 0 };

Indeed! Done in r210321, thanks.