New issue
Advanced search Search tips

Issue 593907 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug
Team-Accessibility



Sign in to add a comment

Conditional jump in content::BrowserAccessibilityManager::FireFocusEventsIfNeeded

Project Member Reported by thestig@chromium.org, Mar 10 2016

Issue description

https://chromium.googlesource.com/chromium/src/+/f27bf8991392753e2a53d9869bffaeb827b5a4eb is causing uninit memory errors:

https://build.chromium.org/p/chromium.memory.fyi/builders/Chromium%20OS%20%28valgrind%29%284%29/builds/37396

Conditional jump or move depends on uninitialised value(s)
content::BrowserAccessibilityManager::FireFocusEventsIfNeeded() (content/browser/accessibility/browser_accessibility_manager.cc:197)
content::BrowserAccessibilityManager::OnAccessibilityEvents(std::vector<content::AXEventNotificationDetails, std::allocator<content::AXEventNotificationDetails> > const&) (content/browser/accessibility/browser_accessibility_manager.cc:337)
content::BrowserAccessibilityManagerTest_TestReuseBrowserAccessibilityObjects_Test::TestBody() (content/browser/accessibility/browser_accessibility_manager_unittest.cc:281)


https://build.chromium.org/p/chromium.memory.fyi/builders/Linux%20ChromeOS%20MSan%20Tests/builds/7921

MemorySanitizer: use-of-uninitialized-value
    #0 0x100a8996 in FireFocusEventsIfNeeded content/browser/accessibility/browser_accessibility_manager.cc:197:7
    #1 0x100ab550 in OnAccessibilityEvents content/browser/accessibility/browser_accessibility_manager.cc:337:3
    #2 0x102e70b7 in OnAccessibilityEvents content/browser/frame_host/render_frame_host_impl.cc:1647:9
...

  Uninitialized value was created by a heap allocation
    #0 0x554b12 in operator new(unsigned long) ??:0
    #1 0x100a6baa in Create content/browser/accessibility/browser_accessibility_manager.cc:108:10
    #2 0x106962a7 in CreateBrowserAccessibilityManager content/browser/renderer_host/render_widget_host_view_aura.cc:1428:13
    #3 0x102f293c in GetOrCreateBrowserAccessibilityManager content/browser/frame_host/render_frame_host_impl.cc:2384:9
    #4 0x102e655c in OnAccessibilityEvents content/browser/frame_host/render_frame_host_impl.cc:1621:7

 
Project Member

Comment 1 by bugdroid1@chromium.org, Mar 10 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0958a444aefc5b2847e46dff8bc6f82fb27ec6f1

commit 0958a444aefc5b2847e46dff8bc6f82fb27ec6f1
Author: dmazzoni <dmazzoni@chromium.org>
Date: Thu Mar 10 23:18:33 2016

Initialize member variables from all constructors

A recent change added last_focused_node_ and last_focused_manager_ to
BrowserAccessibilityManager but accidentally didn't initialize them from
both constructors.

BUG= 593907 
TBR=dtseng@chromium.org
TBR=thestig@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1776713005

Cr-Commit-Position: refs/heads/master@{#380487}

[modify] https://crrev.com/0958a444aefc5b2847e46dff8bc6f82fb27ec6f1/content/browser/accessibility/browser_accessibility_manager.cc

Status: Fixed (was: Untriaged)

Sign in to add a comment