Problem report #53

Problem report #53

[Dan Nicolaescu]

CID: 53
Checker: UNINIT (help)
File: emacs/src/textprop.c
Function: text_property_stickiness
Description: Using uninitialized value "prev_pos" in call to function "Fget_text_property"


Is it right to assume that XINT (pos) is always >= BUF_BEGV (XBUFFER (buffer)) ?
If yes, then this problem report is FALSE.

Event var_decl: Declared variable "prev_pos" without initializer
Also see events: [uninit_use_in_call]

1730 	  Lisp_Object prev_pos, front_sticky;
1731 	  int is_rear_sticky = 1, is_front_sticky = 0; /* defaults */
1732 	

At conditional (1): "buffer == Qnil" taking true path

1733 	  if (NILP (buffer))
1734 	    XSETBUFFER (buffer, current_buffer);
1735 	

At conditional (2): "pos >> 3 > ((0), (buffer & -8))->begv" taking false path

1736 	  if (XINT (pos) > BUF_BEGV (XBUFFER (buffer)))
1737 	    /* Consider previous character.  */
1738 	    {
1739 	      Lisp_Object rear_non_sticky;
1740 	
1741 	      prev_pos = make_number (XINT (pos) - 1);
1742 	      rear_non_sticky = Fget_text_property (prev_pos, Qrear_nonsticky, buffer);
1743 	
1744 	      if (!NILP (CONSP (rear_non_sticky)
1745 			 ? Fmemq (prop, rear_non_sticky)
1746 			 : rear_non_sticky))
1747 		/* PROP is rear-non-sticky.  */
1748 		is_rear_sticky = 0;
1749 	    }
1750 	
1751 	  /* Consider following character.  */
1752 	  front_sticky = Fget_text_property (pos, Qfront_sticky, buffer);
1753 	

At conditional (3): "front_sticky == Qt" taking true path

1754 	  if (EQ (front_sticky, Qt)
1755 	      || (CONSP (front_sticky)
1756 		  && !NILP (Fmemq (prop, front_sticky))))
1757 	    /* PROP is inherited from after.  */
1758 	    is_front_sticky = 1;
1759 	
1760 	  /* Simple cases, where the properties are consistent.  */

At conditional (4): "is_rear_sticky != 0" taking true path
At conditional (5): "is_front_sticky == 0" taking false path

1761 	  if (is_rear_sticky && !is_front_sticky)
1762 	    return -1;

At conditional (6): "is_rear_sticky == 0" taking false path

1763 	  else if (!is_rear_sticky && is_front_sticky)
1764 	    return 1;

At conditional (7): "is_rear_sticky == 0" taking false path

1765 	  else if (!is_rear_sticky && !is_front_sticky)
1766 	    return 0;
1767 	
1768 	  /* The stickiness properties are inconsistent, so we have to
1769 	     disambiguate.  Basically, rear-sticky wins, _except_ if the
1770 	     property that would be inherited has a value of nil, in which case
1771 	     front-sticky wins.  */

Event uninit_use_in_call: Using uninitialized value "prev_pos" in call to function "Fget_text_property" [model]
Also see events: [var_decl]
At conditional (8): "pos >> 3 == ((0), (buffer & -8))->begv" taking false path

1772 	  if (XINT (pos) == BUF_BEGV (XBUFFER (buffer))
1773 	      || NILP (Fget_text_property (prev_pos, prop, buffer)))
1774 	    return 1;
1775 	  else
1776 	    return -1;

Re: Problem report #53

[Dan Nicolaescu]

Anybody familiar with this code? 

Is it right to assume that XINT (pos) is always >= BUF_BEGV (XBUFFER (buffer)) ?
If yes, then this problem report is FALSE.

  > CID: 53
  > Checker: UNINIT (help)
  > File: emacs/src/textprop.c
  > Function: text_property_stickiness
  > Description: Using uninitialized value "prev_pos" in call to function "Fget_text_property"
>
>
  > Event var_decl: Declared variable "prev_pos" without initializer
  > Also see events: [uninit_use_in_call]
>
  > 1730 	  Lisp_Object prev_pos, front_sticky;
  > 1731 	  int is_rear_sticky = 1, is_front_sticky = 0; /* defaults */
  > 1732 	
>
  > At conditional (1): "buffer == Qnil" taking true path
>
  > 1733 	  if (NILP (buffer))
  > 1734 	    XSETBUFFER (buffer, current_buffer);
  > 1735 	
>
  > At conditional (2): "pos >> 3 > ((0), (buffer & -8))->begv" taking false path
>
  > 1736 	  if (XINT (pos) > BUF_BEGV (XBUFFER (buffer)))
  > 1737 	    /* Consider previous character.  */
  > 1738 	    {
  > 1739 	      Lisp_Object rear_non_sticky;
  > 1740 	
  > 1741 	      prev_pos = make_number (XINT (pos) - 1);
  > 1742 	      rear_non_sticky = Fget_text_property (prev_pos, Qrear_nonsticky, buffer);
  > 1743 	
  > 1744 	      if (!NILP (CONSP (rear_non_sticky)
  > 1745 			 ? Fmemq (prop, rear_non_sticky)
  > 1746 			 : rear_non_sticky))
  > 1747 		/* PROP is rear-non-sticky.  */
  > 1748 		is_rear_sticky = 0;
  > 1749 	    }
  > 1750 	
  > 1751 	  /* Consider following character.  */
  > 1752 	  front_sticky = Fget_text_property (pos, Qfront_sticky, buffer);
  > 1753 	
>
  > At conditional (3): "front_sticky == Qt" taking true path
>
  > 1754 	  if (EQ (front_sticky, Qt)
  > 1755 	      || (CONSP (front_sticky)
  > 1756 		  && !NILP (Fmemq (prop, front_sticky))))
  > 1757 	    /* PROP is inherited from after.  */
  > 1758 	    is_front_sticky = 1;
  > 1759 	
  > 1760 	  /* Simple cases, where the properties are consistent.  */
>
  > At conditional (4): "is_rear_sticky != 0" taking true path
  > At conditional (5): "is_front_sticky == 0" taking false path
>
  > 1761 	  if (is_rear_sticky && !is_front_sticky)
  > 1762 	    return -1;
>
  > At conditional (6): "is_rear_sticky == 0" taking false path
>
  > 1763 	  else if (!is_rear_sticky && is_front_sticky)
  > 1764 	    return 1;
>
  > At conditional (7): "is_rear_sticky == 0" taking false path
>
  > 1765 	  else if (!is_rear_sticky && !is_front_sticky)
  > 1766 	    return 0;
  > 1767 	
  > 1768 	  /* The stickiness properties are inconsistent, so we have to
  > 1769 	     disambiguate.  Basically, rear-sticky wins, _except_ if the
  > 1770 	     property that would be inherited has a value of nil, in which case
  > 1771 	     front-sticky wins.  */
>
  > Event uninit_use_in_call: Using uninitialized value "prev_pos" in call to function "Fget_text_property" [model]
  > Also see events: [var_decl]
  > At conditional (8): "pos >> 3 == ((0), (buffer & -8))->begv" taking false path
>
  > 1772 	  if (XINT (pos) == BUF_BEGV (XBUFFER (buffer))
  > 1773 	      || NILP (Fget_text_property (prev_pos, prop, buffer)))
  > 1774 	    return 1;
  > 1775 	  else
  > 1776 	    return -1;

Problem report #53 -- real problem

[Richard Stallman]

    Is it right to assume that XINT (pos) is always >= BUF_BEGV (XBUFFER (buffer)) ?
    If yes, then this problem report is FALSE.

This is a real problem.
Currently it IS possible to call text_property_stickiness
with a POS value that is before BEGV.

text_property_stickiness is called from get_pos_property,
which is called from find_field, which is called from
various user-level functions in editfns.c.

I made sure the other callers can't call it with a POS value before BEGV.
But this one case is hard, and I am not sure what is right to do here.
Miles, can you help?

Re: Problem report #53 -- real problem

[Richard Stallman]

Can people please try to help with this?

    Is it right to assume that XINT (pos) is always >= BUF_BEGV (XBUFFER (buffer)) ?
    If yes, then this problem report is FALSE.

This is a real problem.
Currently it IS possible to call text_property_stickiness
with a POS value that is before BEGV.

text_property_stickiness is called from get_pos_property,
which is called from find_field, which is called from
various user-level functions in editfns.c.

I made sure the other callers can't call it with a POS value before BEGV.
But this one case is hard, and I am not sure what is right to do here.

Re: Problem report #53 -- real problem

[Miles Bader]

On 5/22/06, Richard Stallman <rms@gnu.org> wrote:
> This is a real problem.
> Currently it IS possible to call text_property_stickiness
> with a POS value that is before BEGV.
>
> text_property_stickiness is called from get_pos_property,
> which is called from find_field, which is called from
> various user-level functions in editfns.c.
>
> I made sure the other callers can't call it with a POS value before BEGV.
> But this one case is hard, and I am not sure what is right to do here.

It seems like the field functions could just force POS to be >= BEGV
(if the user calls with a value outside of that, it should act like it
hit the edge of the narrowed region).  [Also <= ZV]

I'll try to add some code that does that.

-Miles
-- 
Do not taunt Happy Fun Ball.