Problem report #19

[Dan Nicolaescu <dann@ics.uci.edu>]

CID: 19
Checker: FORWARD_NULL (help)
File: emacs/src/xmenu.c
Function: digest_single_submenu
Description: Variable "save_wv" tracked as NULL was dereferenced.


Event assign_zero: Variable "save_wv" assigned value 0.
Also see events: [var_deref_op]

1741 	  save_wv = 0;
1742 	  prev_wv = 0;
1743 	
1744 	  /* Loop over all panes and items made by the preceding call
1745 	     to parse_single_submenu and construct a tree of widget_value objects.
1746 	     Ignore the panes and items used by previous calls to
1747 	     digest_single_submenu, even though those are also in menu_items.  */
1748 	  i = start;

At conditional (1): "i < end" taking true path
At conditional (7): "i < end" taking true path

1749 	  while (i < end)
1750 	    {

At conditional (2): "((0), (menu_items & -8))->contents[i] == Qnil" taking false path
At conditional (8): "((0), (menu_items & -8))->contents[i] == Qnil" taking false path

1751 	      if (EQ (XVECTOR (menu_items)->contents[i], Qnil))
1752 		{
1753 		  submenu_stack[submenu_depth++] = save_wv;
1754 		  save_wv = prev_wv;
1755 		  prev_wv = 0;
1756 		  i++;
1757 		}

At conditional (3): "((0), (menu_items & -8))->contents[i] == Qlambda" taking false path
At conditional (9): "((0), (menu_items & -8))->contents[i] == Qlambda" taking false path

1758 	      else if (EQ (XVECTOR (menu_items)->contents[i], Qlambda))
1759 		{
1760 		  prev_wv = save_wv;
1761 		  save_wv = submenu_stack[--submenu_depth];
1762 		  i++;
1763 		}

At conditional (4): "((0), (menu_items & -8))->contents[i] == Qt" taking true path
At conditional (5): "submenu_depth != 0" taking false path
At conditional (10): "((0), (menu_items & -8))->contents[i] == Qt" taking false path

1764 	      else if (EQ (XVECTOR (menu_items)->contents[i], Qt)
1765 		       && submenu_depth != 0)
1766 		i += MENU_ITEMS_PANE_LENGTH;
1767 	      /* Ignore a nil in the item list.
1768 		 It's meaningful only for dialog boxes.  */

At conditional (6): "((0), (menu_items & -8))->contents[i] == Qquote" taking true path
At conditional (11): "((0), (menu_items & -8))->contents[i] == Qquote" taking false path

1769 	      else if (EQ (XVECTOR (menu_items)->contents[i], Qquote))
1770 		i += 1;

At conditional (12): "((0), (menu_items & -8))->contents[i] == Qt" taking false path

1771 	      else if (EQ (XVECTOR (menu_items)->contents[i], Qt))
1772 		{
1773 		  /* Create a new pane.  */
1774 		  Lisp_Object pane_name, prefix;
1775 		  char *pane_string;
1776 	
1777 		  pane_name = XVECTOR (menu_items)->contents[i + MENU_ITEMS_PANE_NAME];
1778 		  prefix = XVECTOR (menu_items)->contents[i + MENU_ITEMS_PANE_PREFIX];
1779 	
1780 	#ifndef HAVE_MULTILINGUAL_MENU
1781 		  if (STRINGP (pane_name) && STRING_MULTIBYTE (pane_name))
1782 		    {
1783 		      pane_name = ENCODE_MENU_STRING (pane_name);
1784 		      AREF (menu_items, i + MENU_ITEMS_PANE_NAME) = pane_name;
1785 		    }
1786 	#endif
1787 		  pane_string = (NILP (pane_name)
1788 				 ? "" : (char *) SDATA (pane_name));
1789 		  /* If there is just one top-level pane, put all its items directly
1790 		     under the top-level menu.  */
1791 		  if (menu_items_n_panes == 1)
1792 		    pane_string = "";
1793 	
1794 		  /* If the pane has a meaningful name,
1795 		     make the pane a top-level menu item
1796 		     with its items as a submenu beneath it.  */
1797 		  if (strcmp (pane_string, ""))
1798 		    {
1799 		      wv = xmalloc_widget_value ();
1800 		      if (save_wv)
1801 			save_wv->next = wv;
1802 		      else
1803 			first_wv->contents = wv;
1804 		      wv->lname = pane_name;
1805 	              /* Set value to 1 so update_submenu_strings can handle '@'  */
1806 		      wv->value = (char *)1;
1807 		      wv->enabled = 1;
1808 		      wv->button_type = BUTTON_TYPE_NONE;
1809 		      wv->help = Qnil;
1810 		      save_wv = wv;
1811 		    }
1812 		  else
1813 		    save_wv = first_wv;
1814 	
1815 		  prev_wv = 0;
1816 		  i += MENU_ITEMS_PANE_LENGTH;
1817 		}
1818 	      else
1819 		{
1820 		  /* Create a new item within current pane.  */
1821 		  Lisp_Object item_name, enable, descrip, def, type, selected;
1822 		  Lisp_Object help;
1823 	
1824 		  item_name = AREF (menu_items, i + MENU_ITEMS_ITEM_NAME);
1825 		  enable = AREF (menu_items, i + MENU_ITEMS_ITEM_ENABLE);
1826 		  descrip = AREF (menu_items, i + MENU_ITEMS_ITEM_EQUIV_KEY);
1827 		  def = AREF (menu_items, i + MENU_ITEMS_ITEM_DEFINITION);
1828 		  type = AREF (menu_items, i + MENU_ITEMS_ITEM_TYPE);
1829 		  selected = AREF (menu_items, i + MENU_ITEMS_ITEM_SELECTED);
1830 		  help = AREF (menu_items, i + MENU_ITEMS_ITEM_HELP);
1831 	
1832 	#ifndef HAVE_MULTILINGUAL_MENU

At conditional (13): "((0), (item_name & -8))->size_byte >= 0" taking true path

1833 	          if (STRING_MULTIBYTE (item_name))
1834 		    {

At conditional (14): "Vlocale_coding_system != Qnil" taking true path
At conditional (15): "Vlocale_coding_system != 0" taking true path

1835 		      item_name = ENCODE_MENU_STRING (item_name);
1836 		      AREF (menu_items, i + MENU_ITEMS_ITEM_NAME) = item_name;
1837 		    }
1838 	

At conditional (16): "descrip & 7 == 3" taking true path
At conditional (17): "((0), (descrip & -8))->size_byte >= 0" taking true path

1839 	          if (STRINGP (descrip) && STRING_MULTIBYTE (descrip))
1840 		    {

At conditional (18): "Vlocale_coding_system != Qnil" taking true path
At conditional (19): "Vlocale_coding_system != 0" taking true path

1841 		      descrip = ENCODE_MENU_STRING (descrip);
1842 		      AREF (menu_items, i + MENU_ITEMS_ITEM_EQUIV_KEY) = descrip;
1843 		    }
1844 	#endif /* not HAVE_MULTILINGUAL_MENU */
1845 	
1846 		  wv = xmalloc_widget_value ();

At conditional (20): "prev_wv != 0" taking false path

1847 		  if (prev_wv)
1848 		    prev_wv->next = wv;
1849 		  else

Event var_deref_op: Variable "save_wv" tracked as NULL was dereferenced.
Also see events: [assign_zero]

1850 		    save_wv->contents = wv;
1851 	
1852 		  wv->lname = item_name;
1853 		  if (!NILP (descrip))
1854 		    wv->lkey = descrip;