Bug 216085

Summary: WebCore::DOMTimerFireState constructor fails to initialize m_initialDOMTreeVersion, m_previous on worker threads
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: DOMAssignee: David Kilzer (:ddkilzer) <ddkilzer>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, darin, rniwa, webkit-bug-importer, youennf
Priority: P2 Keywords: InRadar
Version: Other   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch v1
darin: review+
Patch for landing none

Description David Kilzer (:ddkilzer) 2020-09-02 11:27:24 PDT 
WebCore::DOMTimerFireState fails to initialize m_initialDOMTreeVersion, m_previous on worker threads.

Found by clang static analyzer using the optin.cplusplus.UninitializedObject checker.
Comment 1 David Kilzer (:ddkilzer) 2020-09-02 11:32:14 PDT 
Created attachment 407780 [details]
Patch v1
Comment 2 Darin Adler 2020-09-02 21:34:01 PDT 
Comment on attachment 407780 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=407780&action=review

> Source/WebCore/page/DOMTimer.cpp:100
>      bool m_contextIsDocument;

Why not initialize this to false, too? I know it’s not necessary, but seems worth doing.

Keep in mind that those other two are never used when m_contextIsDocument is false, so all of this is just "defensive programming".
Comment 3 Darin Adler 2020-09-02 21:35:37 PDT 
Another way to do this is to write the constructor differently, like this:

    , m_initialDOMTreeVersion(m_contextIsDocument ? downcast<Document>(context).domTreeVersion() : 0)
    , m_previous(m_contextIsDocument ? std::exchange(current, this) : nullptr)

And reorder the members so m_contextIsDocument comes first.
Comment 4 David Kilzer (:ddkilzer) 2020-09-03 11:12:44 PDT 
Created attachment 407894 [details]
Patch for landing
Comment 5 David Kilzer (:ddkilzer) 2020-09-04 08:00:22 PDT 
Comment on attachment 407894 [details]
Patch for landing

Adding cq+ since all bubbles passed.
Comment 6 EWS 2020-09-04 08:03:27 PDT 
Committed r266608: <https://trac.webkit.org/changeset/266608>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 407894 [details].
Comment 7 Radar WebKit Bug Importer 2020-09-04 08:04:13 PDT 
<rdar://problem/68346261>