Bug 27453

Summary: Uninitialized variable in WebCore::CSSFunctionValue::parserValue
Product: WebKit Reporter: James Hawkins <jhawkins>
Component: CSSAssignee: David Levin <levin>
Status: RESOLVED FIXED    
Severity: Normal CC: hyatt, levin
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: All   
Attachments:
Description Flags
Patch which initializes a variable
none
removed tabs from Changelog hyatt: review+

Description James Hawkins 2009-07-20 11:59:41 PDT
WebCore::CSSFunctionValue::parserValue creates a CSSParserValue for a function, but doesn't initialize isInt (which obviously should be false).  I will attach a patch shortly.
Comment 1 James Hawkins 2009-07-20 12:02:40 PDT
Created attachment 33097 [details]
Patch which initializes a variable
Comment 2 James Hawkins 2009-07-20 12:16:03 PDT
Created attachment 33099 [details]
removed tabs from Changelog
Comment 3 Dave Hyatt 2009-07-20 13:53:49 PDT
Comment on attachment 33099 [details]
removed tabs from Changelog

Test case?
Comment 4 James Hawkins 2009-07-20 14:31:39 PDT
Currently the only code that checks isInt will short-circuit on a check for CSSPrimitiveValue::CSS_NUMBER or (unitFlags & FInteger).

CSSParser.cpp
419:        if (!b && (unitflags & FInteger) && value->isInt)

CSSParserValues.cpp
64:    else if (unit == CSSPrimitiveValue::CSS_NUMBER && isInt)

With that being said, I don't think I can write a test case that will fail before the change and succeed with the patch applied.  Regardless, code added in the future could depend on the value of isInt alone, which could be set to garbage if left uninitialized.
Comment 5 Dave Hyatt 2009-07-20 15:30:09 PDT
Comment on attachment 33099 [details]
removed tabs from Changelog

Ok, sounds fine.
Comment 6 David Levin 2009-07-21 11:23:48 PDT
Assigned to levin for landing
Comment 7 David Levin 2009-07-21 12:20:36 PDT
Committed as http://trac.webkit.org/changeset/46186