The Static Analysis tool Coverity detected that a null pointer dereference may happen in the following context for |parentFrame|: >> if (IsFrameForFieldSet(parentFrame, parentType)) { >> // Legends can be sibling of legends but not of other content in the fieldset >> if (nsContainerFrame* cif = aSibling->GetContentInsertionFrame()) { >> aSibling = cif; >> } |parentFrame| is null checked but dereference occurs outside of the null check scope: >> if (parentFrame) { >> parentType = parentFrame->GetType(); >> }

Comment on attachment 8788144 [details] Bug 1300518 - removed nullcheck for parentFrame in nsCSSFrameConstructor::IsValidSibling. https://reviewboard.mozilla.org/r/76740/#review74844 Viewing the only callsite of this function, I believe parentFrame would never be nullptr... The code checking parentFrame was introduced in bug 403733, while parentFrame->GetType() preexists that check, and the check was added there without any justification. I guess we can try removing the check of parentFrame directly rather than adding more check.

Comment on attachment 8788144 [details] Bug 1300518 - removed nullcheck for parentFrame in nsCSSFrameConstructor::IsValidSibling. https://reviewboard.mozilla.org/r/76740/#review74848

Pushed by xquan@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/6e805e28151d removed nullcheck for parentFrame in nsCSSFrameConstructor::IsValidSibling. r=xidorn