Bug 216085 - WebCore::DOMTimerFireState constructor fails to initialize m_initialDOMTreeVersion, m_previous on worker threads
Summary: WebCore::DOMTimerFireState constructor fails to initialize m_initialDOMTreeVe...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Kilzer (:ddkilzer)
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-09-02 11:27 PDT by David Kilzer (:ddkilzer)
Modified: 2020-09-04 08:04 PDT (History)
5 users (show)

See Also:

Attachments
Patch v1 (1.38 KB, patch)
2020-09-02 11:32 PDT, David Kilzer (:ddkilzer) 		darin: review+
Details | Formatted Diff | Diff
Patch for landing (2.30 KB, patch)
2020-09-03 11:12 PDT, David Kilzer (:ddkilzer) 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Kilzer (:ddkilzer) 2020-09-02 11:27:24 PDT 
WebCore::DOMTimerFireState fails to initialize m_initialDOMTreeVersion, m_previous on worker threads.

Found by clang static analyzer using the optin.cplusplus.UninitializedObject checker.
Comment 1 David Kilzer (:ddkilzer) 2020-09-02 11:32:14 PDT 
Created attachment 407780 [details]
Patch v1
Comment 2 Darin Adler 2020-09-02 21:34:01 PDT 
Comment on attachment 407780 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=407780&action=review

> Source/WebCore/page/DOMTimer.cpp:100
>      bool m_contextIsDocument;

Why not initialize this to false, too? I know it’s not necessary, but seems worth doing.

Keep in mind that those other two are never used when m_contextIsDocument is false, so all of this is just "defensive programming".
Comment 3 Darin Adler 2020-09-02 21:35:37 PDT 
Another way to do this is to write the constructor differently, like this:

    , m_initialDOMTreeVersion(m_contextIsDocument ? downcast<Document>(context).domTreeVersion() : 0)
    , m_previous(m_contextIsDocument ? std::exchange(current, this) : nullptr)

And reorder the members so m_contextIsDocument comes first.
Comment 4 David Kilzer (:ddkilzer) 2020-09-03 11:12:44 PDT 
Created attachment 407894 [details]
Patch for landing
Comment 5 David Kilzer (:ddkilzer) 2020-09-04 08:00:22 PDT 
Comment on attachment 407894 [details]
Patch for landing

Adding cq+ since all bubbles passed.
Comment 6 EWS 2020-09-04 08:03:27 PDT 
Committed r266608: <https://trac.webkit.org/changeset/266608>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 407894 [details].
Comment 7 Radar WebKit Bug Importer 2020-09-04 08:04:13 PDT 
<rdar://problem/68346261>