Re: [cocci] Checking data structure member accesses after function return value assignments?

>>>> Another SmPL script example:
>> …
>>>> @display@
>>>> expression action, pointer;
>>>> identifier member;
>>>> @@
>>>> *pointer = action(...);
>>>> *<+... (pointer)->member ...+>
>>>>  ;
> 
> I think I was right in the first place.

You got another view.


>                                          This is as initialization of pointer,

Just an assignment for a variable eventually?


>          followed by a sequence of statements containing
> (pointer)->member, followed by an empty statement.

I dared to indicate that selected source code should be terminated with a semicolon finally.


>                                                     The third doesn't
> exist in your code, so the pattern doesn't match.

Can the handling of “empty statements” be better documented anyhow?


I can try another SmPL script example out:
@display_without_extra_semicolon@
expression action, pointer;
identifier member;
@@
*pointer = action(...);
*<+... pointer->member ...+>


Test result:
Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> time /usr/bin/spatch --no-loops …/Projekte/Coccinelle/janitor/show_questionable_statement_combination4.cocci drivers/regulator/fp9931.c
…
@@ -438,91 +438,7 @@ static int fp9931_probe(struct i2c_clien
…
-       data = devm_kzalloc(&client->dev, sizeof(*data), GFP_KERNEL);
-       data->regmap = devm_regmap_init_i2c(client, &regmap_config);
…
 
-       return 0;
-}
 
 static const struct dev_pm_ops fp9931_pm_ops = {
        SET_RUNTIME_PM_OPS(fp9931_runtime_suspend, fp9931_runtime_resume, NULL)
Note: processing took    28.3s: drivers/regulator/fp9931.c

real    0m28,332s
user    0m28,267s
sys     0m0,050s



Do you imagine any further data processing refinements?


See also:
https://wiki.sei.cmu.edu/confluence/spaces/c/pages/87152449/EXP34-C.+Do+not+dereference+null+pointers

Regards,
Markus