Closed Bug 2051123 Opened 3 months ago Closed 3 months ago

Guard aValue in nsGenericHTMLElement::AfterSetAttr id branch (Coverity)

Categories

(Core :: DOM: Core & HTML, task)

task

Tracking

()

RESOLVED FIXED
154 Branch
Tracking Status
firefox154 --- fixed

People

(Reporter: Sylvestre, Assigned: Sylvestre)

References

(Blocks 1 open bug)

Details

Attachments

(1 external file)

Coverity reports 22 "Dereference after null check" defects, one per dom/html element subclass, all attributed to nsGenericHTMLElement::AfterSetAttr. Each subclass override tail-calls the base method, whose id branch dereferences aValue->GetAtomValue() without the aValue null check that every sibling branch in the method performs.

The deref is unreachable with a null aValue in practice: the attribute-removal path clears HasID (via PostIdMaybeChange) before AfterSetAttr runs, so ShouldExposeIdAsHTMLDocumentProperty() returns false. Adding an explicit aValue && guard makes that invariant local and self-evident, matches the sibling branches, and resolves all 22 reports at the source.

Coverity CID 1644886, 1644898, 1644900, 1644924, 1644937, 1644951, 1644956, 1644957, 1644959, 1644967, 1644972, 1644980, 1644993, 1645000, 1645002, 1645008, 1645010, 1645012, 1645028, 1645043, 1645057, 1645073.

The id branch dereferenced aValue->GetAtomValue() without the aValue null
check that every sibling branch in this method already performs. The deref
was unreachable with null in practice (the attribute-removal path clears
HasID before AfterSetAttr, so ShouldExposeIdAsHTMLDocumentProperty is false),
but the guard makes that explicit and resolves the cluster of Coverity
'Dereference after null check' reports attributed to each subclass override.

Coverity CID 1644886, 1644898, 1644900, 1644924, 1644937, 1644951, 1644956,
1644957, 1644959, 1644967, 1644972, 1644980, 1644993, 1645000, 1645002,
1645008, 1645010, 1645012, 1645028, 1645043, 1645057, 1645073

Pushed by sledru@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/62a462341835 https://hg.mozilla.org/integration/autoland/rev/463abf7e85e8 Guard aValue in nsGenericHTMLElement::AfterSetAttr id branch r=dom-core-reviewers,smaug
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → 154 Branch
QA Whiteboard: [qa-triage-done-c155/b154]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: