null-dereference
Default severity: error · Identifier: weavec::null-dereference
What it means
Section titled “What it means”A pointer that is null, or may be null, on some path reaching here is dereferenced (RFC 0008): dereference of '<p>', which may be null / dereference of '<p>', which is null; or passed to a callee that dereferences its parameter without testing it (a requires fact in the callee’s summary, or WEAVEC_NONNULL on its declaration): '<p>', which may be null, is passed to '<f>', which dereferences it (also which is null, a null pointer is passed to '<f>' ...). The note says why: '<p>' may be null: it is the result of '<f>' here (every allocator in the shipped table, every searching function and every function the program defines whose body can return null), '<p>' may be null: it is set by '<f>' here (a callee’s store), '<p>' is assigned NULL here, '<p>' may be null: it is compared with NULL here (tested, and the null edge merged back), '<p>' is declared WEAVEC_NULLABLE here / the result of '<f>' is declared WEAVEC_NULLABLE here; for a call, also '<f>' is declared here. Not reported: pointers with no fact (parameters, loaded fields, results of unchecked code), dereferences inside an unsafe region, and a second dereference of the same pointer.
How to resolve it
Section titled “How to resolve it”Check nullable results before their first use and keep that condition on every path reaching the dereference. Propagate allocation or lookup failure to callers when appropriate. Use WEAVEC_NONNULL only for an interface whose callers can establish the requirement.