Problem report #76

Problem report #76

[Dan Nicolaescu]

CID: 76
Checker: FORWARD_NULL (help)
File: base/src/emacs/src/xdisp.c
Function: x_produce_glyphs
Description: Variable "font_info" tracked as NULL was dereferenced.

20490		  /* Draw the first glyph at the normal position.  It may be
20491		     shifted to right later if some other glyphs are drawn at
20492		     the left.  */
20493		  cmp->offsets[0] = 0;
20494		  cmp->offsets[1] = boff;
20495	
20496		  /* Set cmp->offsets for the remaining glyphs.  */

At conditional (13): "i < (cmp)->glyph_len" taking true path

20497		  for (i = 1; i < cmp->glyph_len; i++)
20498		    {
20499		      int left, right, btm, top;

At conditional (14): "(cmp)->method == 5" taking true path

20500		      int ch = COMPOSITION_GLYPH (cmp, i);

At conditional (15): "ch & 255 == ch" taking true path

20501		      int face_id = FACE_FOR_CHAR (it->f, face, ch);
20502	

At conditional (16): "face_id < (((it)->f)->face_cache)->used" taking true path

20503		      face = FACE_FROM_ID (it->f, face_id);
20504		      get_char_face_and_encoding (it->f, ch, face->id,
20505						  &char2b, it->multibyte_p, 0);
20506		      font = face->font;

At conditional (17): "font == 0" taking false path

20507		      if (font == NULL)
20508			{
20509			  font = FRAME_FONT (it->f);
20510			  boff = FRAME_BASELINE_OFFSET (it->f);

Event assign_zero: Variable "font_info" assigned value 0.
Also see events: [var_deref_op]

20511			  font_info = NULL;
20512			}
20513		      else
20514			{

At conditional (18): "(face)->font_info_id >= 0" taking true path
At conditional (19): "(face)->font_info_id < (((((it)->f)->output_data).x)->display_info)->font_table_size" taking false path

20515			  font_info
20516			    = FONT_INFO_FROM_ID (it->f, face->font_info_id);

Event var_deref_op: Variable "font_info" tracked as NULL was dereferenced.
Also see events: [assign_zero]

20517			  boff = font_info->baseline_offset;
20518			  if (font_info->vertical_centering)
20519			    boff = VCENTER_BASELINE_OFFSET (font, it->f) - boff;
20520			}
20521	

At conditional (1): "font_info != 0" taking false path

20522		      if (font_info
20523			  && (pcm = rif->per_char_metric (font, &char2b,
20524							  FONT_TYPE_FOR_MULTIBYTE (font, ch))))
20525			{
20526			  width = pcm->width;
20527			  ascent = pcm->ascent;
20528			  descent = pcm->descent;
20529			}
20530		      else
20531			{
20532			  width = FONT_WIDTH (font);
20533			  ascent = 1;
20534			  descent = 0;
20535			}
20536	

At conditional (2): "(cmp)->method != 5" taking false path

20537		      if (cmp->method != COMPOSITION_WITH_RULE_ALTCHARS)
20538			{
20539			  /* Relative composition with or without
20540			     alternate chars.  */
20541			  left = (leftmost + rightmost - width) / 2;
20542			  btm = - descent + boff;
20543			  if (font_info && font_info->relative_compose
20544			      && (! CHAR_TABLE_P (Vignore_relative_composition)
20545				  || NILP (Faref (Vignore_relative_composition,
20546						  make_number (ch)))))
20547			    {
20548	
20549			      if (- descent >= font_info->relative_compose)
20550				/* One extra pixel between two glyphs.  */
20551				btm = highest + 1;
20552			      else if (ascent <= 0)
20553				/* One extra pixel between two glyphs.  */
20554				btm = lowest - 1 - ascent - descent;
20555			    }
20556			}
20557		      else
20558			{
20559			  /* A composition rule is specified by an integer
20560			     value that encodes global and new reference
20561			     points (GREF and NREF).  GREF and NREF are
20562			     specified by numbers as below:
20563	
20564				0---1---2 -- ascent
20565				|       |
20566				|       |
20567				|       |
20568				9--10--11 -- center
20569				|       |
20570			     ---3---4---5--- baseline
20571				|       |
20572				6---7---8 -- descent
20573			  */
20574			  int rule = COMPOSITION_RULE (cmp, i);
20575			  int gref, nref, grefx, grefy, nrefx, nrefy;
20576	

At conditional (3): "gref > 12" taking false path
At conditional (4): "0" taking false path

20577			  COMPOSITION_DECODE_RULE (rule, gref, nref);
20578			  grefx = gref % 3, nrefx = nref % 3;
20579			  grefy = gref / 3, nrefy = nref / 3;
20580	
20581			  left = (leftmost
20582				  + grefx * (rightmost - leftmost) / 2
20583				  - nrefx * width / 2);

At conditional (5): "grefy == 0" taking true path
At conditional (6): "nrefy == 0" taking false path
At conditional (7): "nrefy == 1" taking false path
At conditional (8): "nrefy == 2" taking false path

20584			  btm = ((grefy == 0 ? highest
20585				  : grefy == 1 ? 0
20586				  : grefy == 2 ? lowest
20587				  : (highest + lowest) / 2)
20588				 - (nrefy == 0 ? ascent + descent
20589				    : nrefy == 1 ? descent - boff
20590				    : nrefy == 2 ? 0
20591				    : (ascent + descent) / 2));
20592			}
20593	
20594		      cmp->offsets[i * 2] = left;
20595		      cmp->offsets[i * 2 + 1] = btm + descent;
20596	
20597		      /* Update the bounding box of the overall glyphs. */
20598		      right = left + width;
20599		      top = btm + descent + ascent;

At conditional (9): "left < leftmost" taking true path

20600		      if (left < leftmost)
20601			leftmost = left;

At conditional (10): "right > rightmost" taking true path

20602		      if (right > rightmost)
20603			rightmost = right;

At conditional (11): "top > highest" taking true path

20604		      if (top > highest)
20605			highest = top;

At conditional (12): "btm < lowest" taking true path

20606		      if (btm < lowest)
20607			lowest = btm;
20608		    }
20609	
20610		  /* If there are glyphs whose x-offsets are negative,
20611		     shift all glyphs to the right and make all x-offsets
20612		     non-negative.  */

Re: Problem report #76 FALSE

[Kenichi Handa]

In article <200605110120.k4B1KdgO011061@scanner2.ics.uci.edu>, Dan Nicolaescu <dann@ics.uci.edu> writes:

> CID: 76
> Checker: FORWARD_NULL (help)
> File: base/src/emacs/src/xdisp.c
> Function: x_produce_glyphs
> Description: Variable "font_info" tracked as NULL was dereferenced.

I see no bug here.  font_info is dereferenced only when it's
not NULL, and...

> 20515			  font_info
> 20516			    = FONT_INFO_FROM_ID (it->f, face->font_info_id);

here, as it is assured that face->font_info_id is valid,
font_info never becomes NULL.

---
Kenichi Handa
handa@m17n.org

Re: Problem report #76

[Stuart D. Herring]

> CID: 76
> Checker: FORWARD_NULL (help)
> File: base/src/emacs/src/xdisp.c
> Function: x_produce_glyphs
> Description: Variable "font_info" tracked as NULL was dereferenced.

This appears to be a real bug (see ChangeLog.8:7259; the macro can return
NULL realistically), and there are several similar lines in xdisp.c:
19988, 20088, 20430, and the reported 20517 in revision 1.1096.

It might be the case that those lines cannot be executed without the font
being known valid from previous branches (including returns), but the last
one -- the one that was actually reported -- looks pretty "bare" in that
sense.  I don't know nearly enough about fonts to say how to fix it,
though.

Davis

-- 
This product is sold by volume, not by mass.  If it appears too dense or
too sparse, it is because mass-energy conversion has occurred during
shipping.