pisa-engine / pisa

PISA: Performant Indexes and Search for Academia
https://pisa-engine.github.io/pisa/book
Apache License 2.0
921 stars 64 forks source link

Array access (via field 'm_data') results in a null pointer dereference [clang-analyzer-core.NullDereference] #258

Closed elshize closed 11 months ago

elshize commented 5 years ago

Describe the bug clang-tidy found a potential null pointer dereference in bit_vector code.

To Reproduce Steps to reproduce the behavior:

  1. From build directory, run cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=ON ..
  2. Run clang-tidy -p build/compile_commands.json src/queries.cpp

Error message

/home/elshize/dev/pisa/include/pisa/bit_vector.hpp:410:23: warning: Array access (via field 'm_data') results in a null pointer dereference [clang-analyzer-core.NullDereference]
                buf = m_data[m_position / 64];
                      ^
/home/elshize/dev/pisa/src/queries.cpp:119:17: note: Assuming the condition is true
            if (!warmed_up.count(t)) {
                ^
/home/elshize/dev/pisa/src/queries.cpp:119:13: note: Taking true branch
            if (!warmed_up.count(t)) {
            ^
/home/elshize/dev/pisa/src/queries.cpp:120:17: note: Calling 'block_freq_index::warmup'
                index.warmup(t);
                ^
/home/elshize/dev/pisa/include/pisa/block_freq_index.hpp:98:20: note: Assuming the condition is true
            assert(i < size());
                   ^
/usr/include/assert.h:90:27: note: expanded from macro 'assert'
     (static_cast <bool> (expr)                                         \
                          ^
/home/elshize/dev/pisa/include/pisa/block_freq_index.hpp:98:13: note: '?' condition is true
            assert(i < size());
            ^
/usr/include/assert.h:90:7: note: expanded from macro 'assert'
     (static_cast <bool> (expr)                                         \
      ^
/home/elshize/dev/pisa/include/pisa/block_freq_index.hpp:103:26: note: Calling 'enumerator::move'
            auto begin = endpoints.move(i).second;
                         ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:161:24: note: Assuming the condition is true
                assert(position <= m_of.n);
                       ^
/usr/include/assert.h:90:27: note: expanded from macro 'assert'
     (static_cast <bool> (expr)                                         \
                          ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:161:17: note: '?' condition is true
                assert(position <= m_of.n);
                ^
/usr/include/assert.h:90:7: note: expanded from macro 'assert'
     (static_cast <bool> (expr)                                         \
      ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:163:21: note: Assuming the condition is false
                if (position == m_position) {
                    ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:163:17: note: Taking false branch
                if (position == m_position) {
                ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:169:33: note: Assuming the condition is true
                if (PISA_LIKELY(position > m_position && skip <= linear_scan_threshold)) {
                                ^
/home/elshize/dev/pisa/include/pisa/util/likely.hpp:5:45: note: expanded from macro 'PISA_LIKELY'
#define PISA_LIKELY(x) (__builtin_expect(!!(x), 1))
                                            ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:169:33: note: Left side of '&&' is true
                if (PISA_LIKELY(position > m_position && skip <= linear_scan_threshold)) {
                                ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:169:58: note: Assuming 'skip' is <= 'linear_scan_threshold'
                if (PISA_LIKELY(position > m_position && skip <= linear_scan_threshold)) {
                                                         ^
/home/elshize/dev/pisa/include/pisa/util/likely.hpp:5:45: note: expanded from macro 'PISA_LIKELY'
#define PISA_LIKELY(x) (__builtin_expect(!!(x), 1))
                                            ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:169:17: note: Taking true branch
                if (PISA_LIKELY(position > m_position && skip <= linear_scan_threshold)) {
                ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:171:21: note: Taking false branch
                    if (PISA_UNLIKELY(m_position == size())) {
                    ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:174:59: note: Null pointer value stored to 'he.m_data'
                        bit_vector::unary_enumerator he = m_high_enumerator;
                                                          ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:175:44: note: Assuming 'i' is < 'skip'
                        for (size_t i = 0; i < skip; ++i) {
                                           ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:175:25: note: Loop condition is true.  Entering loop body
                        for (size_t i = 0; i < skip; ++i) {
                        ^
/home/elshize/dev/pisa/include/pisa/codec/compact_elias_fano.hpp:176:29: note: Calling 'unary_enumerator::next'
                            he.next();
                            ^
/home/elshize/dev/pisa/include/pisa/bit_vector.hpp:408:13: note: Loop condition is true.  Entering loop body
            while (!broadword::lsb(buf, pos_in_word)) {
            ^
/home/elshize/dev/pisa/include/pisa/bit_vector.hpp:410:23: note: Array access (via field 'm_data') results in a null pointer dereference
                buf = m_data[m_position / 64];
                      ^
elshize commented 5 years ago

Most likely related to #12

amallia commented 4 years ago

Thank you. I will prioritize this fix.

elshize commented 11 months ago

This doesn't seem to show up anymore.