Guard aValue in nsGenericHTMLElement::AfterSetAttr id branch (Coverity)
Categories
(Core :: DOM: Core & HTML, task)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox154 | --- | fixed |
People
(Reporter: Sylvestre, Assigned: Sylvestre)
References
(Blocks 1 open bug)
Details
Attachments
(1 external file)
Coverity reports 22 "Dereference after null check" defects, one per dom/html element subclass, all attributed to nsGenericHTMLElement::AfterSetAttr. Each subclass override tail-calls the base method, whose id branch dereferences aValue->GetAtomValue() without the aValue null check that every sibling branch in the method performs.
The deref is unreachable with a null aValue in practice: the attribute-removal path clears HasID (via PostIdMaybeChange) before AfterSetAttr runs, so ShouldExposeIdAsHTMLDocumentProperty() returns false. Adding an explicit aValue && guard makes that invariant local and self-evident, matches the sibling branches, and resolves all 22 reports at the source.
Coverity CID 1644886, 1644898, 1644900, 1644924, 1644937, 1644951, 1644956, 1644957, 1644959, 1644967, 1644972, 1644980, 1644993, 1645000, 1645002, 1645008, 1645010, 1645012, 1645028, 1645043, 1645057, 1645073.
| Assignee | ||
Comment 1•3 months ago
|
||
The id branch dereferenced aValue->GetAtomValue() without the aValue null
check that every sibling branch in this method already performs. The deref
was unreachable with null in practice (the attribute-removal path clears
HasID before AfterSetAttr, so ShouldExposeIdAsHTMLDocumentProperty is false),
but the guard makes that explicit and resolves the cluster of Coverity
'Dereference after null check' reports attributed to each subclass override.
Coverity CID 1644886, 1644898, 1644900, 1644924, 1644937, 1644951, 1644956,
1644957, 1644959, 1644967, 1644972, 1644980, 1644993, 1645000, 1645002,
1645008, 1645010, 1645012, 1645028, 1645043, 1645057, 1645073
Comment 3•3 months ago
|
||
| bugherder | ||
Updated•3 months ago
|
Description
•