Problem report #120: base/src/emacs/src/indent.c (Fvertical_motion); UNINIT

Problem report #120: base/src/emacs/src/indent.c (Fvertical_motion); UNINIT

[Dan Nicolaescu]

CID: 120
Checker: UNINIT (help)
File: base/src/emacs/src/indent.c
Function: Fvertical_motion
Description: Using uninitialized value "cols"


Event var_decl: Declared variable "cols" without initializer
Also see events: [uninit_use]

2032 	  double cols;
2033 	
2034 	  /* Allow LINES to be of the form (HPOS . VPOS) aka (COLUMNS . LINES).  */

At conditional (1): "lines & 7 == 5" taking true path
At conditional (2): "(0 + ((0), (lines & -8))->car) & 7 == 0" taking false path
At conditional (3): "(0 + ((0), (lines & -8))->car) & 7 == 6" taking false path

2035 	  if (CONSP (lines) && (NUMBERP (XCAR (lines))))
2036 	    {
2037 	      lcols = XCAR (lines);
2038 	      cols = INTEGERP (lcols) ? (double) XINT (lcols) : XFLOAT_DATA (lcols);
2039 	      lines = XCDR (lines);
2040 	    }
2041 	

At conditional (4): "lines & 7 != 0" taking false path
At conditional (5): "0" taking false path

2042 	  CHECK_NUMBER (lines);

At conditional (6): "window != Qnil" taking true path

2043 	  if (! NILP (window))

At conditional (7): "window & 7 != 4" taking false path
At conditional (8): "((0), (window & -8))->size & 4611686018427392000 != 4611686018427392000" taking false path
At conditional (9): "0" taking false path

2044 	    CHECK_WINDOW (window);
2045 	  else
2046 	    window = selected_window;
2047 	  w = XWINDOW (window);
2048 	
2049 	  old_buffer = Qnil;
2050 	  GCPRO1 (old_buffer);

At conditional (10): "(0), ((w)->buffer & -8 != current_buffer)" taking true path

2051 	  if (XBUFFER (w->buffer) != current_buffer)
2052 	    {
2053 	      /* Set the window's buffer temporarily to the current buffer.  */
2054 	      old_buffer = w->buffer;
2055 	      XSETBUFFER (w->buffer, current_buffer);
2056 	    }
2057 	

At conditional (11): "noninteractive != 0" taking false path

2058 	  if (noninteractive)
2059 	    {
2060 	      struct position pos;
2061 	      pos = *vmotion (PT, XINT (lines), w);
2062 	      SET_PT_BOTH (pos.bufpos, pos.bytepos);
2063 	    }
2064 	  else
2065 	    {
2066 	      int it_start, oselective, first_x, it_overshoot_expected;
2067 	
2068 	      SET_TEXT_POS (pt, PT, PT_BYTE);
2069 	      start_display (&it, w, pt);
2070 	      first_x = it.first_visible_x;
2071 	      it_start = IT_CHARPOS (it);
2072 	
2073 	      /* See comments below for why we calculate this.  */

At conditional (12): "lines >> 3 > 0" taking true path

2074 	      if (XINT (lines) > 0)
2075 		{

At conditional (13): "((it).cmp_it).id >= 0" taking true path

2076 		  if (it.cmp_it.id >= 0)
2077 		    it_overshoot_expected = 1;
2078 		  else if (it.method == GET_FROM_STRING)
2079 		    {
2080 		      const char *s = SDATA (it.string);
2081 		      const char *e = s + SBYTES (it.string);
2082 		      while (s < e && *s != '\n')
2083 			++s;
2084 		      it_overshoot_expected = (s == e) ? -1 : 0;
2085 		    }
2086 		  else
2087 		    it_overshoot_expected = (it.method == GET_FROM_IMAGE
2088 					     || it.method == GET_FROM_STRETCH);
2089 		}
2090 	
2091 	      /* Scan from the start of the line containing PT.  If we don't
2092 		 do this, we start moving with IT->current_x == 0, while PT is
2093 		 really at some x > 0.  */
2094 	      reseat_at_previous_visible_line_start (&it);
2095 	      it.current_x = it.hpos = 0;
2096 	      /* Temporarily disable selective display so we don't move too far */
2097 	      oselective = it.selective;
2098 	      it.selective = 0;
2099 	      move_it_to (&it, PT, -1, -1, -1, MOVE_TO_POS);
2100 	      it.selective = oselective;
2101 	

At conditional (14): "lines >> 3 <= 0" taking false path

2102 	      if (XINT (lines) <= 0)
2103 		{
2104 		  it.vpos = 0;
2105 		  /* Do this even if LINES is 0, so that we move back to the
2106 		     beginning of the current line as we ought.  */
2107 		  if (XINT (lines) == 0 || IT_CHARPOS (it) > 0)
2108 		    move_it_by_lines (&it, XINT (lines), 0);
2109 		}
2110 	      else
2111 		{

At conditional (15): "(((it).current).pos).charpos > it_start" taking true path

2112 		  if (IT_CHARPOS (it) > it_start)
2113 		    {
2114 		      /* IT may move too far if truncate-lines is on and PT
2115 			 lies beyond the right margin.  In that case,
2116 			 backtrack unless the starting point is on an image,
2117 			 stretch glyph, composition, or Lisp string.  */

At conditional (16): "it_overshoot_expected == 0" taking false path
At conditional (17): "it_overshoot_expected < 0" taking false path

2118 		      if (!it_overshoot_expected
2119 			  /* Also, backtrack if the Lisp string contains no
2120 			     newline, but there is a newline right after it.
2121 			     In this case, IT overshoots if there is an
2122 			     after-string just before the newline.  */
2123 			  || (it_overshoot_expected < 0
2124 			      && it.method == GET_FROM_BUFFER
2125 			      && it.c == '\n'))
2126 			move_it_by_lines (&it, -1, 0);
2127 		      it.vpos = 0;
2128 		      move_it_by_lines (&it, XINT (lines), 0);
2129 		    }
2130 		  else
2131 		    {
2132 		      /* Otherwise, we are at the first row occupied by PT,
2133 			 which might span multiple screen lines (e.g., if it's
2134 			 on a multi-line display string).  We want to start
2135 			 from the last line that it occupies.  */
2136 		      if (it_start < ZV)
2137 			{
2138 			  while (IT_CHARPOS (it) <= it_start)
2139 			    {
2140 			      it.vpos = 0;
2141 			      move_it_by_lines (&it, 1, 0);
2142 			    }
2143 			  if (XINT (lines) > 1)
2144 			    move_it_by_lines (&it, XINT (lines) - 1, 0);
2145 			}
2146 		      else
2147 			{
2148 			  it.vpos = 0;
2149 			  move_it_by_lines (&it, XINT (lines), 0);
2150 			}
2151 		    }
2152 		}
2153 	
2154 	      /* Move to the goal column, if one was specified.  */

At conditional (18): "lcols != Qnil" taking true path

2155 	      if (!NILP (lcols))
2156 		{
2157 		  /* If the window was originally hscrolled, move forward by
2158 		     the hscrolled amount first.  */

At conditional (19): "first_x > 0" taking true path

2159 		  if (first_x > 0)
2160 		    {
2161 		      move_it_in_display_line (&it, ZV, first_x, MOVE_TO_X);
2162 		      it.current_x = 0;
2163 		    }

Event uninit_use: Using uninitialized value "cols"
Also see events: [var_decl]

2164 		  move_it_in_display_line
2165 		    (&it, ZV,
2166 		     (int)(cols * FRAME_COLUMN_WIDTH (XFRAME (w->frame)) + 0.5),
2167 		     MOVE_TO_X);
2168 		}

Re: Problem report #120: base/src/emacs/src/indent.c (Fvertical_motion); UNINIT

[Chong Yidong]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> CID: 120
> Checker: UNINIT (help)
> File: base/src/emacs/src/indent.c
> Function: Fvertical_motion
> Description: Using uninitialized value "cols"
>
> 2155 	      if (!NILP (lcols))
> 2156 		{
...
>
> Event uninit_use: Using uninitialized value "cols"
> Also see events: [var_decl]
>
> 2164 		  move_it_in_display_line
> 2165 		    (&it, ZV,
> 2166 		     (int)(cols * FRAME_COLUMN_WIDTH (XFRAME (w->frame))

This is bogus.  The variable "cols" always has an assigned value if the
associated Lisp variable "lcols" is non-nil, as is the case here.