Bug 27453 - Uninitialized variable in WebCore::CSSFunctionValue::parserValue
Summary: Uninitialized variable in WebCore::CSSFunctionValue::parserValue
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P2 Normal
Assignee: David Levin
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-20 11:59 PDT by James Hawkins
Modified: 2009-07-21 12:20 PDT (History)
2 users (show)

See Also:


Attachments
Patch which initializes a variable (1.09 KB, patch)
2009-07-20 12:02 PDT, James Hawkins
no flags Details | Formatted Diff | Diff
removed tabs from Changelog (1.11 KB, patch)
2009-07-20 12:16 PDT, James Hawkins
hyatt: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description James Hawkins 2009-07-20 11:59:41 PDT
WebCore::CSSFunctionValue::parserValue creates a CSSParserValue for a function, but doesn't initialize isInt (which obviously should be false).  I will attach a patch shortly.
Comment 1 James Hawkins 2009-07-20 12:02:40 PDT
Created attachment 33097 [details]
Patch which initializes a variable
Comment 2 James Hawkins 2009-07-20 12:16:03 PDT
Created attachment 33099 [details]
removed tabs from Changelog
Comment 3 Dave Hyatt 2009-07-20 13:53:49 PDT
Comment on attachment 33099 [details]
removed tabs from Changelog

Test case?
Comment 4 James Hawkins 2009-07-20 14:31:39 PDT
Currently the only code that checks isInt will short-circuit on a check for CSSPrimitiveValue::CSS_NUMBER or (unitFlags & FInteger).

CSSParser.cpp
419:        if (!b && (unitflags & FInteger) && value->isInt)

CSSParserValues.cpp
64:    else if (unit == CSSPrimitiveValue::CSS_NUMBER && isInt)

With that being said, I don't think I can write a test case that will fail before the change and succeed with the patch applied.  Regardless, code added in the future could depend on the value of isInt alone, which could be set to garbage if left uninitialized.
Comment 5 Dave Hyatt 2009-07-20 15:30:09 PDT
Comment on attachment 33099 [details]
removed tabs from Changelog

Ok, sounds fine.
Comment 6 David Levin 2009-07-21 11:23:48 PDT
Assigned to levin for landing
Comment 7 David Levin 2009-07-21 12:20:36 PDT
Committed as http://trac.webkit.org/changeset/46186