Problem report #133: base/src/emacs/src/font.c (font_range); FORWARD_NULL

Problem report #133: base/src/emacs/src/font.c (font_range); FORWARD_NULL

[Dan Nicolaescu]

CID: 133
Checker: FORWARD_NULL (help)
File: base/src/emacs/src/font.c
Function: font_range
Description: Variable "face" tracked as NULL was passed to a function
that dereferences it.

Event var_compare_op: Added "face" due to comparison "face == 0"
Also see events: [var_deref_model][var_deref_model]
At conditional (1): "face == 0" taking true path

3684 	      if (! face)
3685 		{
3686 		  int face_id;
3687 	
3688 		  face_id = face_at_buffer_position (w, pos, 0, 0, &ignore, *limit, 0);

At conditional (2): "face_id < (((0), ((w)->frame & -8))->face_cache)->used" taking false path

3689 		  face = FACE_FROM_ID (XFRAME (w->frame), face_id);
3690 		}
3691 	    }
3692 	  else
3693 	    {
3694 	      font_assert (face);
3695 	      pos_byte = string_char_to_byte (string, pos);
3696 	    }
3697 	
3698 	  start = pos, start_byte = pos_byte;

At conditional (3): "pos < *limit" taking true path

3699 	  while (pos < *limit)
3700 	    {
3701 	      Lisp_Object category;
3702 	

At conditional (4): "string == Qnil" taking true path

3703 	      if (NILP (string))

At conditional (5): "pos_byte >= ((current_buffer)->text)->gpt_byte" taking true path
At conditional (6): "*(ptr + 0) & 128 == 0" taking true path
At conditional (7): "0" taking false path

3704 		FETCH_CHAR_ADVANCE_NO_CHECK (c, pos, pos_byte);
3705 	      else
3706 		FETCH_STRING_CHAR_ADVANCE_NO_CHECK (c, string, pos, pos_byte);

At conditional (8): "font_object == Qnil" taking true path

3707 	      if (NILP (font_object))
3708 		{

Event var_deref_model: Variable "face" tracked as NULL was passed to a function that dereferences it. [model]
Also see events: [var_compare_op][var_deref_model]

3709 		  font_object = font_for_char (face, c, pos - 1, string);
3710 		  if (NILP (font_object))
3711 		    return Qnil;
3712 		  continue;
3713 		}
3714 	
3715 	      category = CHAR_TABLE_REF (Vunicode_category_table, c);
3716 	      if (! EQ (category, QCf)
3717 		  && font_encode_char (font_object, c) == FONT_INVALID_CODE)
3718 		{

Event var_deref_model: Variable "face" tracked as NULL was passed to a function that dereferences it. [model]
Also see events: [var_compare_op][var_deref_model]

3719 		  Lisp_Object f = font_for_char (face, c, pos - 1, string);
3720 		  EMACS_INT i, i_byte;
3721 	

Re: Problem report #133: base/src/emacs/src/font.c (font_range); FORWARD_NULL

[Kenichi Handa]

In article <200812030131.mB31V9EQ022834@mothra.ics.uci.edu>, Dan Nicolaescu <dann@ics.uci.edu> writes:

> CID: 133
> Checker: FORWARD_NULL (help)
> File: base/src/emacs/src/font.c
> Function: font_range
> Description: Variable "face" tracked as NULL was passed to a function
> that dereferences it.

That should never happen.

> 3689 		  face = FACE_FROM_ID (XFRAME (w->frame), face_id);

Perhaps that FACE_FROM_ID is the culprit.  Here it is
assured that it never return NULL.

---
Kenichi Handa
handa@ni.aist.go.jp