Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ed517e412084a29ec14c7952131f6d3462ca381c
https://github.com/WebKit/WebKit/commit/ed517e412084a29ec14c7952131f6d3462ca381c
Author: Nikolas Zimmermann <[email protected]>
Date: 2026-07-06 (Mon, 06 Jul 2026)
Changed paths:
M Source/WebCore/css/parser/CSSParserToken.cpp
M Source/WebCore/css/parser/CSSParserToken.h
Log Message:
-----------
Zero-initialize CSSParserToken union to fix valgrind uninitialised value error
https://bugs.webkit.org/show_bug.cgi?id=311013
Reviewed by Michael Catanzaro.
The CSSParserToken union (8 bytes) was left partially or fully uninitialized
by several constructors. When tokens were copied into a CSSVariableData Vector
buffer, the uninitialized bytes propagated. During style resolution, inlined
substitution resolution code in resolveSubstitutionFunctions() read from these
token bytes, triggering a valgrind "Conditional jump or move depends on
uninitialised value(s)" error.
Valgrind trace:
==1187609== Conditional jump or move depends on uninitialised value(s)
==1187609== at 0x9B8181E:
WebCore::Style::Builder::resolveSubstitutionFunctions(...)
==1187609== by 0x9B80CDF: WebCore::Style::Builder::applyProperty(...)
==1187609== by 0x9B7F63B:
WebCore::Style::Builder::applyCascadeProperty(...)
==1187609== by 0x9B7F0FC:
WebCore::Style::Builder::applyHighPriorityProperties()
==1187609== Uninitialised value was created by a heap allocation
==1187609== at 0x4846828: malloc
==1187609== at ...: bmalloc_allocate_auxiliary_impl_casual_case(...)
==1187609== at 0x8841600: WebCore::CSSVariableReferenceValue::create(...)
==1187609== at 0x88D6DE7: WebCore::consumeStyleProperty(...)
To fix, add a { 0 } default initializer to double m_numericValue (the largest
union member, 8 bytes), ensuring all union bytes are zero-initialized for
constructors that don't explicitly set a different member.
Covered by existing tests.
* Source/WebCore/css/parser/CSSParserToken.cpp:
(WebCore::CSSParserToken::CSSParserToken):
* Source/WebCore/css/parser/CSSParserToken.h:
Canonical link: https://commits.webkit.org/316573@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
