Status: Assigned Owner: [email protected] Labels: Type-Bug Pri-2 OS-All Area-WebKit Size-Medium Valgrind
New issue 20778 by [email protected]: Conditional uses uninitialised value in WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL() http://code.google.com/p/chromium/issues/detail?id=20778 Looks like somebody forgot to initialize the members of CachingURLCanonicalizer? This happened a lot in the last two runs: http://build.chromium.org/buildbot/waterfall/builders/Webkit%20Linux%20(valgrind%20layout)/builds/1539/steps/valgrind%20test:%20layout/logs/stdio http://build.chromium.org/buildbot/waterfall/builders/Webkit%20Linux%20(valgrind%20layout)/builds/1538/steps/valgrind%20test:%20layout/logs/stdio in the tests LayoutTests/http/tests/security/xssAuditor/*.html Conditional jump or move depends on uninitialised value(s) WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(WebCore::String const&, WebCore::TextEncoding const&, bool) (third_party/WebKit/WebCore/page/XSSAuditor.cpp:61) WebCore::XSSAuditor::findInRequest(WebCore::Frame*, WebCore::String const&, bool) const (third_party/WebKit/WebCore/page/XSSAuditor.cpp:273) WebCore::XSSAuditor::findInRequest(WebCore::String const&, bool) const (third_party/WebKit/WebCore/page/XSSAuditor.cpp:230) WebCore::XSSAuditor::canCreateInlineEventListener(WebCore::String const&, WebCore::String const&) const (third_party/WebKit/WebCore/page/XSSAuditor.cpp:117) WebCore::createAttributeEventListener(WebCore::Frame*, WebCore::Attribute*) (third_party/WebKit/WebCore/bindings/v8/ScriptEventListener.cpp:63) WebCore::HTMLBodyElement::parseMappedAttribute(WebCore::MappedAttribute*) (third_party/WebKit/WebCore/html/HTMLBodyElement.cpp:133) WebCore::StyledElement::attributeChanged(WebCore::Attribute*, bool) (third_party/WebKit/WebCore/dom/StyledElement.cpp:190) WebCore::Element::setAttributeMap(WTF::PassRefPtr<WebCore::NamedNodeMap>) (third_party/WebKit/WebCore/dom/Element.cpp:645) WebCore::HTMLParser::parseToken(WebCore::Token*) (third_party/WebKit/WebCore/html/HTMLParser.cpp:258) WebCore::HTMLTokenizer::processToken() (third_party/WebKit/WebCore/html/HTMLTokenizer.cpp:1917) WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&, WebCore::HTMLTokenizer::State) (third_party/WebKit/WebCore/html/HTMLTokenizer.cpp:1502) WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&, bool) (third_party/WebKit/WebCore/html/HTMLTokenizer.cpp:1748) WebCore::FrameLoader::write(char const*, int, bool) (third_party/WebKit/WebCore/loader/FrameLoader.cpp:1026) WebCore::FrameLoader::addData(char const*, int) (third_party/WebKit/WebCore/loader/FrameLoader.cpp:1793) WebFrameImpl::commitDocumentData(char const*, unsigned int) (webkit/glue/webframe_impl.cc:894) -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ Automated mail from issue updates at http://crbug.com/ Subscription options: http://groups.google.com/group/chromium-bugs -~----------~----~----~----~------~----~------~--~---
