Problem report #32

Problem report #32

[Dan Nicolaescu]

CID: 32
Checker: NULL_RETURNS (help)
File: emacs/src/xterm.c
Function: handle_one_xevent
Description: Dereferencing NULL value "f"

Event returned_null: Function "x_top_window_to_frame" returned NULL value (checked 5 out of 6 times) [model]
Event var_assigned: Variable "f" assigned to NULL return value from "x_top_window_to_frame"
Also see events: [var_assigned][dereference]

5746 	                    f = x_top_window_to_frame (dpyinfo,
5747 	                                               event.xclient.window);
5748 	                    /* This is just so we only give real data once
5749 	                       for a single Emacs process.  */

At conditional (1): "selected_frame & 7 == 4" taking true path
At conditional (2): "((0), (selected_frame & -8))->size & 1073742848 == 1073742848" taking true path
At conditional (3): "(((0), (selected_frame & -8))->output_data).nothing != 0" taking true path
At conditional (4): "f == ((selected_frame & 7 == 4 && ((0), (selected_frame & -8))->size & 1073742848 == 1073742848 && (((0), (selected_frame & -8))->output_data).nothing != 0) ? (0), (selected_frame & -8) : ((abort), (0)))" taking true path

5750 	                    if (f == SELECTED_FRAME ())

Event dereference: Dereferencing NULL value "f"
Also see events: [returned_null][var_assigned]

5751 	                      XSetCommand (FRAME_X_DISPLAY (f),
5752 	                                   event.xclient.window,
5753 	                                   initial_argv, initial_argc);
5754 	                    else if (f)
5755 	                      XSetCommand (FRAME_X_DISPLAY (f),
5756 	                                   event.xclient.window,
5757 	                                   0, 0);
5758 	                  }

Re: Problem report #32

[Stuart D. Herring]

> At conditional (1): "selected_frame & 7 == 4" taking true path
> At conditional (2): "((0), (selected_frame & -8))->size & 1073742848 ==
> 1073742848" taking true path
> At conditional (3): "(((0), (selected_frame & -8))->output_data).nothing
> != 0" taking true path
> At conditional (4): "f == ((selected_frame & 7 == 4 && ((0),
> (selected_frame & -8))->size & 1073742848 == 1073742848 && (((0),
> (selected_frame & -8))->output_data).nothing != 0) ? (0), (selected_frame
> & -8) : ((abort), (0)))" taking true path
>
> 5750 	                    if (f == SELECTED_FRAME ())
>
> Event dereference: Dereferencing NULL value "f"
> Also see events: [returned_null][var_assigned]

(I'm not an expert, but I think this is obvious:)
f can't be NULL here: SELECTED_FRAME() (which eventually decays to
selected_frame & -8) is not going to be 0 (right?), so if f compares equal
to it it's a real pointer.

Davis

-- 
This product is sold by volume, not by mass.  If it appears too dense or
too sparse, it is because mass-energy conversion has occurred during
shipping.

Re: Problem report #32

[Jan D.]

Stuart D. Herring wrote:
>> At conditional (1): "selected_frame & 7 == 4" taking true path
>> At conditional (2): "((0), (selected_frame & -8))->size & 1073742848 ==
>> 1073742848" taking true path
>> At conditional (3): "(((0), (selected_frame & -8))->output_data).nothing
>> != 0" taking true path
>> At conditional (4): "f == ((selected_frame & 7 == 4 && ((0),
>> (selected_frame & -8))->size & 1073742848 == 1073742848 && (((0),
>> (selected_frame & -8))->output_data).nothing != 0) ? (0), (selected_frame
>> & -8) : ((abort), (0)))" taking true path
>>
>> 5750 	                    if (f == SELECTED_FRAME ())
>>
>> Event dereference: Dereferencing NULL value "f"
>> Also see events: [returned_null][var_assigned]
> 
> (I'm not an expert, but I think this is obvious:)
> f can't be NULL here: SELECTED_FRAME() (which eventually decays to
> selected_frame & -8) is not going to be 0 (right?), so if f compares equal
> to it it's a real pointer.
> 

I think you are correct.

	Jan D.