Bug 166058 - [Cairo] Conditional jump or move depends on uninitialised value(s)
Summary: [Cairo] Conditional jump or move depends on uninitialised value(s)
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Platform (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: Gtk
Depends on:
Blocks:
 
Reported: 2016-12-20 06:20 PST by Carlos Garcia Campos
Modified: 2017-01-04 23:29 PST (History)
4 users (show)

See Also:


Attachments
Patch (1.33 KB, patch)
2016-12-20 06:22 PST, Carlos Garcia Campos
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos Garcia Campos 2016-12-20 06:20:45 PST
==25564== Conditional jump or move depends on uninitialised value(s)
==25564==    at 0x9A72001: _cairo_gstate_transform_glyphs_to_backend (cairo-gstate.c:2198)
==25564==    by 0x9A757BC: _cairo_gstate_glyph_path (cairo-gstate.c:2085)
==25564==    by 0x9A678A1: cairo_glyph_path (cairo.c:3555)
==25564==    by 0x71DA2EE: WebCore::CairoGlyphToPathTranslator::path() (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x71DB01A: WebCore::FontCascade::dashesForIntersectionsWithRect(WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatRect const&) const (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6F19C58: WebCore::drawSkipInkUnderline(WebCore::GraphicsContext&, WebCore::FontCascade const&, WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatPoint const&, float, float, bool, bool, WebCore::StrokeStyle) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6F1B01A: WebCore::TextDecorationPainter::paintTextDecoration(WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatPoint const&) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D4BE6B: WebCore::InlineTextBox::paintDecoration(WebCore::GraphicsContext&, WebCore::FontCascade const&, WebCore::RenderCombineText*, WebCore::TextRun const&, WebCore::FloatPoint const&, WebCore::FloatRect const&, WebCore::TextDecoration, WebCore::TextPaintStyle, WebCore::ShadowData const*) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D509CC: WebCore::InlineTextBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==    by 0x6D495B7: WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
==25564==  Uninitialised value was created by a stack allocation
==25564==    at 0x5E3C720: ??? (in /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37.16.0)
Comment 1 Carlos Garcia Campos 2016-12-20 06:22:52 PST
Created attachment 297518 [details]
Patch
Comment 2 Michael Catanzaro 2016-12-20 06:49:17 PST
It reminds me of https://bugs.freedesktop.org/show_bug.cgi?id=91271, which is very annoying when valgrinding as it happens every time when loading any page. But clearly this is a separate issue.
Comment 3 WebKit Commit Bot 2016-12-20 23:49:18 PST
Comment on attachment 297518 [details]
Patch

Clearing flags on attachment: 297518

Committed r210056: <http://trac.webkit.org/changeset/210056>
Comment 4 WebKit Commit Bot 2016-12-20 23:49:23 PST
All reviewed patches have been landed.  Closing bug.
Comment 5 Said Abou-Hallawa 2017-01-04 10:24:18 PST
Comment on attachment 297518 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=297518&action=review

> Source/WebCore/platform/graphics/cairo/FontCairo.cpp:246
>      cairo_glyph_t cairoGlyph;
>      cairoGlyph.index = m_glyphBuffer.glyphAt(m_index);
> +    cairoGlyph.x = cairoGlyph.y = 0;

These could have been written like this:

cairo_glyph_t cairoGlyph = { m_glyphBuffer.glyphAt(m_index), 0, 0 };
Comment 6 Carlos Garcia Campos 2017-01-04 23:29:02 PST
(In reply to comment #5)
> Comment on attachment 297518 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=297518&action=review
> 
> > Source/WebCore/platform/graphics/cairo/FontCairo.cpp:246
> >      cairo_glyph_t cairoGlyph;
> >      cairoGlyph.index = m_glyphBuffer.glyphAt(m_index);
> > +    cairoGlyph.x = cairoGlyph.y = 0;
> 
> These could have been written like this:
> 
> cairo_glyph_t cairoGlyph = { m_glyphBuffer.glyphAt(m_index), 0, 0 };

Indeed! Done in r210321, thanks.