Bug 57656 – Valgrind error in _ZN7WebCore8Document11updateTitleERKNS_19StringWithDirectionE

• Component: DOM
• Status: RESOLVED FIXED

[Adam Barth]

Suppression (error hash=#000000002B0B6257#):
{
   <insert_a_suppression_name_here>
   Memcheck:Cond
   fun:_ZN7WebCore8Document11updateTitleERKNS_19StringWithDirectionE
   fun:_ZN7WebCore8Document15setTitleElementERKNS_19StringWithDirectionEPNS_7ElementE
   fun:_ZN7WebCore16HTMLTitleElement20insertedIntoDocumentEv
   fun:_ZN7WebCore13ContainerNode14parserAddChildEN3WTF10PassRefPtrINS_4NodeEEE
   fun:_ZN7WebCore20HTMLConstructionSite6attachINS_7ElementEEEN3WTF10PassRefPtrIT_EEPNS_13ContainerNodeES6_
   fun:_ZN7WebCore20HTMLConstructionSite15attachToCurrentEN3WTF10PassRefPtrINS_7ElementEEE
   fun:_ZN7WebCore20HTMLConstructionSite17insertHTMLElementERNS_15AtomicHTMLTokenE
   fun:_ZN7WebCore15HTMLTreeBuilder28processGenericRCDATAStartTagERNS_15AtomicHTMLTokenE
   fun:_ZN7WebCore15HTMLTreeBuilder24processStartTagForInHeadERNS_15AtomicHTMLTokenE
   fun:_ZN7WebCore15HTMLTreeBuilder15processStartTagERNS_15AtomicHTMLTokenE
   fun:_ZN7WebCore15HTMLTreeBuilder12processTokenERNS_15AtomicHTMLTokenE
   fun:_ZN7WebCore15HTMLTreeBuilder28constructTreeFromAtomicTokenERNS_15AtomicHTMLTokenE
   fun:_ZN7WebCore15HTMLTreeBuilder22constructTreeFromTokenERNS_9HTMLTokenE
   fun:_ZN7WebCore18HTMLDocumentParser13pumpTokenizerENS0_15SynchronousModeE
   fun:_ZN7WebCore18HTMLDocumentParser23pumpTokenizerIfPossibleENS0_15SynchronousModeE
   fun:_ZN7WebCore18HTMLDocumentParser6appendERKNS_15SegmentedStringE
   fun:_ZN7WebCore25DecodedDataDocumentParser11appendBytesEPNS_14DocumentWriterEPKcib
   fun:_ZN7WebCore14DocumentWriter7addDataEPKcib
   fun:_ZN7WebCore14DocumentWriter27endIfNotLoadingMainResourceEv
   fun:_ZN7WebCore14DocumentWriter3endEv
   fun:_ZN7WebCore14DocumentLoader15finishedLoadingEv
   fun:_ZN7WebCore11FrameLoader15finishedLoadingEv
}

[Adam Barth]

The following WebKit roll is on the blamelist:

WebKit DEPS: 82579 => 82603

[Adam Barth]

More information from valgrind:

UninitCondition
Conditional jump or move depends on uninitialised value(s)
  WebCore::Document::updateTitle(WebCore::StringWithDirection const&) (third_party/WebKit/Source/WebCore/dom/Document.cpp:1327)
  WebCore::Document::setTitleElement(WebCore::StringWithDirection const&, WebCore::Element*) (third_party/WebKit/Source/WebCore/dom/Document.cpp:1370)
  WebCore::HTMLTitleElement::insertedIntoDocument() (third_party/WebKit/Source/WebCore/html/HTMLTitleElement.cpp:49)
  WebCore::ContainerNode::parserAddChild(WTF::PassRefPtr<WebCore::Node>) (third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:655)
  WTF::PassRefPtr<WebCore::Element> WebCore::HTMLConstructionSite::attach<WebCore::Element>(WebCore::ContainerNode*, WTF::PassRefPtr<WebCore::Element>) (third_party/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:99)
  WebCore::HTMLConstructionSite::attachToCurrent(WTF::PassRefPtr<WebCore::Element>) (third_party/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:264)
  WebCore::HTMLConstructionSite::insertHTMLElement(WebCore::AtomicHTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:294)
  WebCore::HTMLTreeBuilder::processGenericRCDATAStartTag(WebCore::AtomicHTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2764)
  WebCore::HTMLTreeBuilder::processStartTagForInHead(WebCore::AtomicHTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2732)
  WebCore::HTMLTreeBuilder::processStartTag(WebCore::AtomicHTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:1165)
  WebCore::HTMLTreeBuilder::processToken(WebCore::AtomicHTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:461)
  WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken(WebCore::AtomicHTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:442)
  WebCore::HTMLTreeBuilder::constructTreeFromToken(WebCore::HTMLToken&) (third_party/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:437)
  WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:277)
  WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) (third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:176)
  WebCore::HTMLDocumentParser::append(WebCore::SegmentedString const&) (third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:350)
  WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter*, char const*, int, bool) (third_party/WebKit/Source/WebCore/dom/DecodedDataDocumentParser.cpp:54)
  WebCore::DocumentWriter::addData(char const*, int, bool) (third_party/WebKit/Source/WebCore/loader/DocumentWriter.cpp:201)
  WebCore::DocumentWriter::endIfNotLoadingMainResource() (third_party/WebKit/Source/WebCore/loader/DocumentWriter.cpp:221)
  WebCore::DocumentWriter::end() (third_party/WebKit/Source/WebCore/loader/DocumentWriter.cpp:207)
  WebCore::DocumentLoader::finishedLoading() (third_party/WebKit/Source/WebCore/loader/DocumentLoader.cpp:288)
  WebCore::FrameLoader::finishedLoading() (third_party/WebKit/Source/WebCore/loader/FrameLoader.cpp:2230)
  WebCore::MainResourceLoader::didFinishLoading(double) (third_party/WebKit/Source/WebCore/loader/MainResourceLoader.cpp:467)
  WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double) (third_party/WebKit/Source/WebCore/loader/ResourceLoader.cpp:436)
  WebCore::ResourceHandleInternal::didFinishLoading(WebKit::WebURLLoader*, double) (third_party/WebKit/Source/WebKit/chromium/src/ResourceHandle.cpp:197)
  webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest(net::URLRequestStatus const&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, base::Time const&) (webkit/glue/weburlloader_impl.cc:653)
  (anonymous namespace)::RequestProxy::NotifyCompletedRequest(net::URLRequestStatus const&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, base::Time const&) (webkit/tools/test_shell/simple_resource_loader_bridge.cc:326)
  void DispatchToMethod<(anonymous namespace)::RequestProxy, void ((anonymous namespace)::RequestProxy::*)(net::URLRequestStatus const&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, base::Time const&), net::URLRequestStatus, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, base::Time>((anonymous namespace)::RequestProxy*, void ((anonymous namespace)::RequestProxy::*)(net::URLRequestStatus const&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, base::Time const&), Tuple3<net::URLRequestStatus, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, base::Time> const&) (./base/tuple.h:564)
  RunnableMethod<(anonymous namespace)::RequestProxy, void ((anonymous namespace)::RequestProxy::*)(net::URLRequestStatus const&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, base::Time const&), Tuple3<net::URLRequestStatus, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, base::Time> >::Run() (./base/task.h:332)
  MessageLoop::RunTask(Task*) (base/message_loop.cc:370)

[Adam Barth]

Seemly related changes in that range:

http://trac.webkit.org/changeset/82596/
http://trac.webkit.org/changeset/82580/

My money is on Evan's change: "<title> should support dir attribute" because it's a larger change.

[Adam Barth]

The bug is that the default constructor of StringWithDirection doesn't initialize m_direction.  Patch shortly.

[Adam Barth]

Created attachment 87913 [details]
Patch

[Adam Barth]

http://code.google.com/p/chromium/issues/detail?id=78197

[WebKit Commit Bot]

Comment on attachment 87913 [details]
Patch

Clearing flags on attachment: 87913

Committed r82741: <http://trac.webkit.org/changeset/82741>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.