Bug 166058 – [Cairo] Conditional jump or move depends on uninitialised value(s)

• Component: Platform
• Status: RESOLVED FIXED

[Carlos Garcia Campos]

==25564== Conditional jump or move depends on uninitialised value(s)
==25564==    at 0x9A72001: _cairo_gstate_transform_glyphs_to_backend (cairo-gstate.c:2198)
==25564==    by 0x9A757BC: _cairo_gstate_glyph_path (cairo-gstate.c:2085)
==25564==    by 0x9A678A1: cairo_glyph_path (cairo.c:3555)
==25564==    by 0x71DA2EE: WebCore::CairoGlyphToPathTranslator::path() (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x71DB01A: WebCore::FontCascade::dashesForIntersectionsWithRect(WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatRect const&) const (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6F19C58: WebCore::drawSkipInkUnderline(WebCore::GraphicsContext&, WebCore::FontCascade const&, WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatPoint const&, float, float, bool, bool, WebCore::StrokeStyle) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6F1B01A: WebCore::TextDecorationPainter::paintTextDecoration(WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatPoint const&) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D4BE6B: WebCore::InlineTextBox::paintDecoration(WebCore::GraphicsContext&, WebCore::FontCascade const&, WebCore::RenderCombineText*, WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatRect const&, WebCore::TextDecoration, WebCore::TextPaintStyle, WebCore::ShadowData const*) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D509CC: WebCore::InlineTextBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==  Uninitialised value was created by a stack allocation
==25564==    at 0x5E3C720: ??? (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)

[Carlos Garcia Campos]

Created attachment 297518 [details]
Patch

[Michael Catanzaro]

It reminds me of https://bugs.freedesktop.org/show_bug.cgi?id=91271, which is very annoying when valgrinding as it happens every time when loading any page. But clearly this is a separate issue.

[WebKit Commit Bot]

Comment on attachment 297518 [details]
Patch

Clearing flags on attachment: 297518

Committed r210056: <http://trac.webkit.org/changeset/210056>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Said Abou-Hallawa]

Comment on attachment 297518 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=297518&action=review

> Source/WebCore/platform/graphics/cairo/FontCairo.cpp:246
>      cairo_glyph_t cairoGlyph;
>      cairoGlyph.index = m_glyphBuffer.glyphAt(m_index);
> +    cairoGlyph.x = cairoGlyph.y = 0;

These could have been written like this:

cairo_glyph_t cairoGlyph = { m_glyphBuffer.glyphAt(m_index), 0, 0 };

[Carlos Garcia Campos]

(In reply to comment #5)
> Comment on attachment 297518 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=297518&action=review
> 
> > Source/WebCore/platform/graphics/cairo/FontCairo.cpp:246
> >      cairo_glyph_t cairoGlyph;
> >      cairoGlyph.index = m_glyphBuffer.glyphAt(m_index);
> > +    cairoGlyph.x = cairoGlyph.y = 0;
> 
> These could have been written like this:
> 
> cairo_glyph_t cairoGlyph = { m_glyphBuffer.glyphAt(m_index), 0, 0 };

Indeed! Done in r210321, thanks.