problem report #95

[Dan Nicolaescu]

CID: 95
Checker: FORWARD_NULL (help)
File: base/src/emacs/src/gtkutil.c
Function: update_frame_tool_bar
Description: Variable "img" tracked as NULL was passed to a function that 
dereferences it.

Event assign_zero: Variable "img" assigned value 0.
Also see events: [var_deref_model]

3863          struct image *img = NULL;
3864          Lisp_Object image;
3865          Lisp_Object stock;
3866          GtkStockItem stock_item;
3867          char *stock_name = NULL;
3868          char *icon_name = NULL;
3869          Lisp_Object rtl;
3870          GtkWidget *wbutton = NULL;
3871          GtkWidget *weventbox;
3872          Lisp_Object func = intern ("x-gtk-map-stock");
3873          Lisp_Object specified_file;
3874    
3875          ti = gtk_toolbar_get_nth_item (GTK_TOOLBAR (x->toolbar_widget), 
i);
3876    

At conditional (1): "ti != 0" taking true path

3877          if (ti)
3878            {
3879              weventbox = gtk_bin_get_child (GTK_BIN (ti));
3880              wbutton = gtk_bin_get_child (GTK_BIN (weventbox));
3881            }
3882    
3883          image = PROP (TOOL_BAR_ITEM_IMAGES);
3884    
3885          /* Ignore invalid image specifications.  */

At conditional (2): "valid_image_p == 0" taking false path

3886          if (!valid_image_p (image))
3887            {
3888              if (wbutton) gtk_widget_hide (wbutton);
3889              continue;
3890            }
3891    
3892          specified_file = file_for_image (image);

At conditional (3): "specified_file != Qnil" taking true path
At conditional (4): "Qt == Ffboundp" taking true path

3893          if (!NILP (specified_file) && EQ (Qt, Ffboundp (func)))
3894            stock = call1 (func, specified_file);
3895    

At conditional (5): "stock != Qnil" taking true path
At conditional (6): "stock & 7 == 3" taking true path

3896          if (! NILP (stock) && STRINGP (stock))
3897            {
3898              stock_name = SSDATA (stock);

At conditional (7): "*(stock_name + 0) == 110" taking true path
At conditional (8): "*(stock_name + 1) == 58" taking true path

3899              if (stock_name[0] == 'n' && stock_name[1] == ':')
3900                {
3901                  GdkScreen *screen = gtk_widget_get_screen (GTK_WIDGET 
(wtoolbar));
3902                  GtkIconTheme *icon_theme = gtk_icon_theme_get_for_screen 
(screen);
3903    
3904                  icon_name = stock_name + 2;
3905                  stock_name = NULL;
3906                  stock = Qnil;
3907    

At conditional (9): "gtk_icon_theme_has_icon == 0" taking true path

3908                  if (! gtk_icon_theme_has_icon (icon_theme, icon_name))
3909                    icon_name = NULL;
3910                  else
3911                    icon_size = gtk_toolbar_get_icon_size (wtoolbar);
3912                }
3913              else if (gtk_stock_lookup (SSDATA (stock), &stock_item))
3914                  icon_size = gtk_toolbar_get_icon_size (wtoolbar);
3915              else 
3916                {
3917                  stock = Qnil;
3918                  stock_name = NULL;
3919                }
3920            }
3921    

At conditional (10): "stock_name == 0" taking true path
At conditional (11): "icon_name == 0" taking true path

3922          if (stock_name == NULL && icon_name == NULL)
3923            {
3924              /* No stock image, or stock item not known.  Try regular 
image.  */
3925    
3926              /* If image is a vector, choose the image according to the
3927                 button state.  */

At conditional (12): "dir == 2" taking true path
At conditional (13): "rtl = ((0), ((f)->tool_bar_items & -8))->contents[((i * 
9) + 8)] != Qnil" taking true path
At conditional (14): "rtl & 7 == 3" taking true path

3928              if (dir == GTK_TEXT_DIR_RTL
3929                  && !NILP (rtl = PROP (TOOL_BAR_ITEM_RTL_IMAGE))
3930                  && STRINGP (rtl))
3931                {
3932                  image = find_rtl_image (f, image, rtl);
3933                }
3934    

At conditional (15): "image & 7 == 4" taking true path
At conditional (16): "((0), (image & -8))->size & 4611686018427387904 == 0" 
taking true path

3935              if (VECTORP (image))
3936                {

At conditional (17): "enabled_p != 0" taking true path

3937                  if (enabled_p)

At conditional (18): "selected_p != 0" taking false path

3938                    idx = (selected_p
3939                           ? TOOL_BAR_IMAGE_ENABLED_SELECTED
3940                           : TOOL_BAR_IMAGE_ENABLED_DESELECTED);
3941                  else
3942                    idx = (selected_p
3943                           ? TOOL_BAR_IMAGE_DISABLED_SELECTED
3944                           : TOOL_BAR_IMAGE_DISABLED_DESELECTED);
3945    
3946                  xassert (ASIZE (image) >= idx);
3947                  image = AREF (image, idx);
3948                }
3949              else
3950                idx = -1;
3951    
3952              img_id = lookup_image (f, image);

At conditional (19): "img_id >= 0" taking true path
At conditional (20): "img_id < (((f)->terminal)->image_cache)->used" taking 
false path

3953              img = IMAGE_FROM_ID (f, img_id);

Event var_deref_model: Variable "img" tracked as NULL was passed to a function 
that dereferences it. [model]