Bug 202162 – Address static analyzer warning in FTLLowerDFGToB3.cpp: Called C++ object pointer is null

• Status: RESOLVED
• Resolution: LATER
• Component: JavaScriptCore

[Keith Rollin]

Xcode's static analyzer warns:

    .../OpenSource/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:12964:75: warning: Called C++ object pointer is null
            RELEASE_ASSERT((!littleEndianValue && !bigEndianValue) || type == littleEndianValue->type());
                                                                              ^~~~~~~~~~~~~~~~~~~~~~~~~

In the two lines preceding the RELEASE_ASSERT, littleEndianValue is allocated and then used in a way that conveys to the static analyzer that the allocator could return NULL. The RELEASE_ASSERT above will check if both littleEndianValue and bigEndianValue are NULL, but not just one or the other. Therefore, the subsequent access of littleEndianValue could be executed if littleEndianValue is NULL and bigEndianValue is not NULL. Perhaps the nature of the code is such that both littleEndianValue and bigEndianValue are in sync -- that both are either NULL or not NULL -- but, if so, that's not apparent to the static analyzer. Address this by adding an explicit littleEndianValue check before its use in the RELEASE_ASSERT.

[Radar WebKit Bug Importer]

<rdar://problem/55674000>

[Keith Rollin]

Created attachment 379476 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 379476 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=379476&action=review

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:12972
> +        RELEASE_ASSERT((!littleEndianValue && !bigEndianValue) || (littleEndianValue && type == littleEndianValue->type()));

Can you get a type of littleEndianValue like for bigEndianValue? Like, `bigEndianValue ? bigEndianValue->type() : Void`

[Keith Rollin]

I don't know if that question is for me. If so, I don't understand it. I'm just trying to protect against littleEndianValue being NULL.

[Alexey Proskuryakov]

Closing this 5+ years later, as it's an abandoned patch.