GCC 4.3.3 on Linux gives us this warning, when building mozilla-central: > /content/xml/document/src/nsXMLFragmentContentSink.cpp: In member function ‘virtual nsresult nsXHTMLParanoidFragmentSink::AddAttributes(const PRUnichar**, nsIContent*)’: > /content/xml/document/src/nsXMLFragmentContentSink.cpp:612: warning: ‘rv’ may be used uninitialized in this function This looks like a real bug. Snippet of code: 612 nsresult rv; [...] 627 while (*aAtts) { [...] 633 if (IsAttrURI(nodeInfo->NameAtom())) { [...] // Code that sets |rv| 645 } 646 647 if (NS_SUCCEEDED(rv)) { So, if the IsAttrURI check fails, we'll end up reading |rv|'s uninitialized value at line 647. Looks like this bug was introduced in the top chunk of the change linked below -- it removes a line that used to initialize |rv| before we even get to the IsAttrURI check: http://hg.mozilla.org/mozilla-central/diff/ec4733eb1bd8/content/xml/document/src/nsXMLFragmentContentSink.cpp Anyway, this is easily fixable by initializing |rv| to NS_OK in the first place. (which is what it would be when we hit all this code, prior to the change linked above, due to an NS_ENSURE_SUCCESS call that was also removed in that change)

Taras -- from glancing at bug 450777, it sounds like that bug's patch (which introduced this bug) was generated using an automated tool of some sort. It scares me a bit that our code-generation tools can introduce problems like this one[1] in their generated patches -- is this something we can fix them to detect & avoid? [1] "problems like this one" = deletions of a line that potentially initialized a variable for the first time.

Comment on attachment 417069 [details] [diff] [review] fix: initialize rv to NS_OK Good catch!