Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use of uninitialized memory when unsetting flex property #12245

Closed

Commits on Feb 11, 2017

  1. Fix use of uninitialized memory when unsetting flex property

    When a property on a node is set for the first time, we read and store
    the property's initial value before updating it. Later, if the property
    is nullified in JavaScript, we'll write the earlier-obtained initial
    value to the native representation.
    
    In order to obtain the initial value, there must be a property getter
    that corresponds to the setter. If no getter exists, the slot to store
    the initial value will remain silently uninitialized. If the property is
    nullified from JavaScript, we'll write the garbage value of that
    uninitialized variable into the native representation, and chaos will
    ensue.
    
    This commit makes four changes to resolve this issue:
    
    1. It adds an assertion that a getter exists every time a property is
       written. It would be better to enforce this statically, but I'm not
       aware of a means to accomplish this.
    
    2. It adds a getter for the `flex` property, which previously lacked
       one. Prior to this change, setting then removing the `flex` property
       on a view would result in layout glitches and redboxes about `NaN`
       and `Infinity` in the bound and offset of a view.
    
    3. It adds a getter for the `on` property for RCTSwitch, which can never
       be undefined, but is triggering the newly-added assertion.
    
    4. It adds an `unselectedItemTintColor` property for RCTTabBar, which
       appears to have been an oversight.
    
    There have been a number of complaints about transient redboxes with
    messages about illegal `NaN`s and `Infinity`s. Because this bug pertains
    to uninitialized memory which non-deterministic by nature, it's possible
    that a number of these difficult-to-repro issues will be resolved by
    this bugfix.
    jamesreggio committed Feb 11, 2017
    Configuration menu
    Copy the full SHA
    6fd9fe7 View commit details
    Browse the repository at this point in the history