Bug 216085 – WebCore::DOMTimerFireState constructor fails to initialize m_initialDOMTreeVersion, m_previous on worker threads

• Component: DOM
• Status: RESOLVED FIXED

[David Kilzer (:ddkilzer)]

WebCore::DOMTimerFireState fails to initialize m_initialDOMTreeVersion, m_previous on worker threads.

Found by clang static analyzer using the optin.cplusplus.UninitializedObject checker.

[David Kilzer (:ddkilzer)]

Created attachment 407780 [details]
Patch v1

[Darin Adler]

Comment on attachment 407780 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=407780&action=review

> Source/WebCore/page/DOMTimer.cpp:100
>      bool m_contextIsDocument;

Why not initialize this to false, too? I know it’s not necessary, but seems worth doing.

Keep in mind that those other two are never used when m_contextIsDocument is false, so all of this is just "defensive programming".

[Darin Adler]

Another way to do this is to write the constructor differently, like this:

    , m_initialDOMTreeVersion(m_contextIsDocument ? downcast<Document>(context).domTreeVersion() : 0)
    , m_previous(m_contextIsDocument ? std::exchange(current, this) : nullptr)

And reorder the members so m_contextIsDocument comes first.

[David Kilzer (:ddkilzer)]

Created attachment 407894 [details]
Patch for landing

[David Kilzer (:ddkilzer)]

Comment on attachment 407894 [details]
Patch for landing

Adding cq+ since all bubbles passed.

[EWS]

Committed r266608: <https://trac.webkit.org/changeset/266608>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 407894 [details].

[Radar WebKit Bug Importer]

<rdar://problem/68346261>