problem report #95

problem report #95

[Dan Nicolaescu]

CID: 95
Checker: FORWARD_NULL (help)
File: base/src/emacs/src/gtkutil.c
Function: update_frame_tool_bar
Description: Variable "img" tracked as NULL was passed to a function that dereferences it.

Event assign_zero: Variable "img" assigned value 0.
Also see events: [var_deref_model]

3863 	      struct image *img = NULL;
3864 	      Lisp_Object image;
3865 	      Lisp_Object stock;
3866 	      GtkStockItem stock_item;
3867 	      char *stock_name = NULL;
3868 	      char *icon_name = NULL;
3869 	      Lisp_Object rtl;
3870 	      GtkWidget *wbutton = NULL;
3871 	      GtkWidget *weventbox;
3872 	      Lisp_Object func = intern ("x-gtk-map-stock");
3873 	      Lisp_Object specified_file;
3874 	
3875 	      ti = gtk_toolbar_get_nth_item (GTK_TOOLBAR (x->toolbar_widget), i);
3876 	

At conditional (1): "ti != 0" taking true path

3877 	      if (ti)
3878 	        {
3879 	          weventbox = gtk_bin_get_child (GTK_BIN (ti));
3880 	          wbutton = gtk_bin_get_child (GTK_BIN (weventbox));
3881 	        }
3882 	
3883 	      image = PROP (TOOL_BAR_ITEM_IMAGES);
3884 	
3885 	      /* Ignore invalid image specifications.  */

At conditional (2): "valid_image_p == 0" taking false path

3886 	      if (!valid_image_p (image))
3887 	        {
3888 	          if (wbutton) gtk_widget_hide (wbutton);
3889 	          continue;
3890 	        }
3891 	
3892 	      specified_file = file_for_image (image);

At conditional (3): "specified_file != Qnil" taking true path
At conditional (4): "Qt == Ffboundp" taking true path

3893 	      if (!NILP (specified_file) && EQ (Qt, Ffboundp (func)))
3894 	        stock = call1 (func, specified_file);
3895 	

At conditional (5): "stock != Qnil" taking true path
At conditional (6): "stock & 7 == 3" taking true path

3896 	      if (! NILP (stock) && STRINGP (stock))
3897 	        {
3898 	          stock_name = SSDATA (stock);

At conditional (7): "*(stock_name + 0) == 110" taking true path
At conditional (8): "*(stock_name + 1) == 58" taking true path

3899 	          if (stock_name[0] == 'n' && stock_name[1] == ':')
3900 	            {
3901 	              GdkScreen *screen = gtk_widget_get_screen (GTK_WIDGET (wtoolbar));
3902 	              GtkIconTheme *icon_theme = gtk_icon_theme_get_for_screen (screen);
3903 	
3904 	              icon_name = stock_name + 2;
3905 	              stock_name = NULL;
3906 	              stock = Qnil;
3907 	

At conditional (9): "gtk_icon_theme_has_icon == 0" taking true path

3908 	              if (! gtk_icon_theme_has_icon (icon_theme, icon_name))
3909 	                icon_name = NULL;
3910 	              else
3911 	                icon_size = gtk_toolbar_get_icon_size (wtoolbar);
3912 	            }
3913 	          else if (gtk_stock_lookup (SSDATA (stock), &stock_item))
3914 	              icon_size = gtk_toolbar_get_icon_size (wtoolbar);
3915 	          else 
3916 	            {
3917 	              stock = Qnil;
3918 	              stock_name = NULL;
3919 	            }
3920 	        }
3921 	

At conditional (10): "stock_name == 0" taking true path
At conditional (11): "icon_name == 0" taking true path

3922 	      if (stock_name == NULL && icon_name == NULL)
3923 	        {
3924 	          /* No stock image, or stock item not known.  Try regular image.  */
3925 	
3926 	          /* If image is a vector, choose the image according to the
3927 	             button state.  */

At conditional (12): "dir == 2" taking true path
At conditional (13): "rtl = ((0), ((f)->tool_bar_items & -8))->contents[((i * 9) + 8)] != Qnil" taking true path
At conditional (14): "rtl & 7 == 3" taking true path

3928 	          if (dir == GTK_TEXT_DIR_RTL
3929 	              && !NILP (rtl = PROP (TOOL_BAR_ITEM_RTL_IMAGE))
3930 	              && STRINGP (rtl))
3931 	            {
3932 	              image = find_rtl_image (f, image, rtl);
3933 	            }
3934 	

At conditional (15): "image & 7 == 4" taking true path
At conditional (16): "((0), (image & -8))->size & 4611686018427387904 == 0" taking true path

3935 	          if (VECTORP (image))
3936 	            {

At conditional (17): "enabled_p != 0" taking true path

3937 	              if (enabled_p)

At conditional (18): "selected_p != 0" taking false path

3938 	                idx = (selected_p
3939 	                       ? TOOL_BAR_IMAGE_ENABLED_SELECTED
3940 	                       : TOOL_BAR_IMAGE_ENABLED_DESELECTED);
3941 	              else
3942 	                idx = (selected_p
3943 	                       ? TOOL_BAR_IMAGE_DISABLED_SELECTED
3944 	                       : TOOL_BAR_IMAGE_DISABLED_DESELECTED);
3945 	
3946 	              xassert (ASIZE (image) >= idx);
3947 	              image = AREF (image, idx);
3948 	            }
3949 	          else
3950 	            idx = -1;
3951 	
3952 	          img_id = lookup_image (f, image);

At conditional (19): "img_id >= 0" taking true path
At conditional (20): "img_id < (((f)->terminal)->image_cache)->used" taking false path

3953 	          img = IMAGE_FROM_ID (f, img_id);

Event var_deref_model: Variable "img" tracked as NULL was passed to a function that dereferences it. [model]

Re: problem report #95

[Andreas Schwab]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> 3952 	          img_id = lookup_image (f, image);
>
> At conditional (19): "img_id >= 0" taking true path
> At conditional (20): "img_id < (((f)->terminal)->image_cache)->used" taking false path
>
> 3953 	          img = IMAGE_FROM_ID (f, img_id);
>
> Event var_deref_model: Variable "img" tracked as NULL was passed to a function that dereferences it. [model]

lookup_image always returns the id of a cached image, so this is bogus.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: problem report #95

[Davis Herring]

> 3952 	          img_id = lookup_image (f, image);
>
> At conditional (19): "img_id >= 0" taking true path
> At conditional (20): "img_id < (((f)->terminal)->image_cache)->used"
> taking false path
>
> 3953 	          img = IMAGE_FROM_ID (f, img_id);
>
> Event var_deref_model: Variable "img" tracked as NULL was passed to a
> function that dereferences it. [model]

I don't understand how `img' is getting passed to any function here.  It
seems like, even with the assumptions being made, it would just get
assigned NULL (again) here.

Davis

-- 
This product is sold by volume, not by mass.  If it appears too dense or
too sparse, it is because mass-energy conversion has occurred during
shipping.