mesa-25.1.0~rc2-2.fc43

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:309:25: warning[-Wanalyzer-null-argument]: use of NULL ‘wave_dump’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:293:10: enter_function: entry to ‘ac_get_wave_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:301:7: branch_true: following ‘true’ branch (when ‘wave_dump’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:302:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:302:14: call_function: calling ‘ac_get_umr_waves’ from ‘ac_get_wave_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:302:14: return_function: returning to ‘ac_get_wave_info’ from ‘ac_get_umr_waves’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_debug.c:309:25: danger: argument 1 (‘wave_dump’) NULL where non-null expected
#argument 1 of ‘__builtin_strchr’ must be non-null
#  307|   
#  308|      while (true) {
#  309|->       const char *end = strchr(wave_dump, '\n');
#  310|         if (!end)
#  311|            break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def2]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:68:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:55:13: enter_function: entry to ‘ac_roll_context’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:67:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:68:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:68:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘ac_roll_context’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:68:7: return_function: returning to ‘ac_roll_context’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:68:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*ctx.rolls, 1, 8)’
#   66|      /* Ignore the first context at the beginning or after waiting for idle. */
#   67|      if (ctx->num_busy_contexts > 1) {
#   68|->       util_dynarray_append(&ctx->rolls, struct ac_context_reg_state *, last);
#   69|      } else {
#   70|         FREE(last);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def3]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:109:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ctx.cur’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:307:6: enter_function: entry to ‘ac_gather_context_rolls’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:315:14: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:319:25: branch_true: following ‘true’ branch (when ‘i < num_ibs’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:320:59: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_gather_context_rolls.c:320:7: call_function: calling ‘ac_ib_gather_context_rolls’ from ‘ac_gather_context_rolls’
#  107|            struct hash_entry *marker = _mesa_hash_table_search(annotations, ib + cur_dw);
#  108|            if (marker)
#  109|->             ctx->cur->annotation = marker->data;
#  110|         }
#  111|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:323:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rgp_shader_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:289:1: enter_function: entry to ‘ac_rgp_file_write_elf_text’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:293:28: release_memory: ‘rgp_shader_data’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:299:10: call_function: calling ‘get_lowest_shader’ from ‘ac_rgp_file_write_elf_text’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:299:10: return_function: returning to ‘ac_rgp_file_write_elf_text’ from ‘get_lowest_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:299:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:323:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:323:36: release_memory: ‘rgp_shader_data’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rgp_elf_object_pack.c:323:21: danger: dereference of NULL ‘rgp_shader_data’
#  321|      }
#  322|   
#  323|->    symbol_offset += rgp_shader_data->code_size;
#  324|      uint32_t aligned = ALIGN(symbol_offset, 256) - symbol_offset;
#  325|      fseek(output, aligned, SEEK_CUR);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def5]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:217:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:232:6: enter_function: entry to ‘ac_rtld_open’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:246:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:270:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:284:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:287:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:287:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:292:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:301:32: branch_true: following ‘true’ branch (when ‘part_idx < <unknown>’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:302:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:307:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:309:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:310:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:311:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:311:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:315:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:315:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:316:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:316:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:318:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:320:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:324:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:325:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:328:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:331:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:331:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:334:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:334:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:335:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:367:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:368:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/ac_rtld.c:368:18: call_function: calling ‘read_private_lds_symbols’ from ‘ac_rtld_open’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  215|         }
#  216|   
#  217|->       util_dynarray_append(&binary->lds_symbols, struct ac_rtld_symbol, s);
#  218|      }
#  219|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def6]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/llvm/ac_llvm_build.c:527:20: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/llvm/ac_llvm_build.c:3284:14: enter_function: entry to ‘ac_build_reduce’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/llvm/ac_llvm_build.c:3287:7: branch_false: following ‘false’ branch (when ‘cluster_size != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/llvm/ac_llvm_build.c:3289:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/llvm/ac_llvm_build.c:3289:4: call_function: calling ‘ac_build_optimization_barrier’ from ‘ac_build_reduce’
#  525|   
#  526|      for (i = 0; i < value_count; i++) {
#  527|->       LLVMValueRef value = values[i * value_stride];
#  528|   
#  529|         if (!i)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:157:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pipe_ctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:86:24: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:148:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:148:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:155:5: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:156:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:157:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:157:9: danger: dereference of NULL ‘pipe_ctx’
#  155|       config_vector = output_ctx->configs[0];
#  156|       if (!config_vector->num_elements) {
#  157|->         vpe_priv->resource.program_backend(vpe_priv, pipe_ctx->pipe_idx, cmd_idx, false);
#  158|       } else {
#  159|           bool reuse = !vpe_priv->init.debug.disable_reuse_bit;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def8]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:169:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pipe_ctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:86:24: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:148:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:148:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:155:5: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:156:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:159:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vpelib/src/chip/vpe10/vpe10_cmd_builder.c:169:9: danger: dereference of NULL ‘pipe_ctx’
#  167|           }
#  168|   
#  169|->         vpe_priv->resource.program_backend(vpe_priv, pipe_ctx->pipe_idx, cmd_idx, true);
#  170|       }
#  171|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def9]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:78:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:173:1: enter_function: entry to ‘handle_accel_struct_write’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:210:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:211:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:213:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:214:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:217:25: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_rra_layer.c:218:14: call_function: calling ‘rra_init_accel_struct_data_buffer’ from ‘handle_accel_struct_write’
#   76|      VK_FROM_HANDLE(radv_device, device, vk_device);
#   77|   
#   78|->    buffer->ref_cnt = 1;
#   79|   
#   80|      VkBufferCreateInfo buffer_create_info = {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def10]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:193:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘submission’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1681:1: enter_function: entry to ‘sqtt_CreateGraphicsPipelines’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1690:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1693:25: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1694:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1696:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1699:101: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1699:54: call_function: calling ‘vk_graphics_pipeline_create_flags’ from ‘sqtt_CreateGraphicsPipelines’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1699:54: return_function: returning to ‘sqtt_CreateGraphicsPipelines’ from ‘vk_graphics_pipeline_create_flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1700:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1703:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/layers/radv_sqtt_layer.c:1703:16: call_function: calling ‘radv_sqtt_reloc_graphics_shaders’ from ‘sqtt_CreateGraphicsPipelines’
#  191|   
#  192|         if (device->shader_use_invisible_vram)
#  193|->          dest_ptr = submission->ptr + offset;
#  194|         else
#  195|            dest_ptr = slab_ptr + offset;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def11]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:262:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:553:1: enter_function: entry to ‘radv_nir_apply_pipeline_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:570:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_apply_pipeline_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:570:4: return_function: returning to ‘radv_nir_apply_pipeline_layout’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:570:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:10: call_function: inlined call to ‘exec_node_is_head_sentinel’ from ‘radv_nir_apply_pipeline_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:580:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:580:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:581:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:581:33: call_function: calling ‘apply_layout_to_tex’ from ‘radv_nir_apply_pipeline_layout’
#  260|         nir_def *tmp = nir_imul_imm(b, deref->arr.index.ssa, array_size);
#  261|         if (tmp != deref->arr.index.ssa)
#  262|->          nir_instr_as_alu(tmp->parent_instr)->no_unsigned_wrap = true;
#  263|   
#  264|         if (index) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def12]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:146:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fields’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:113:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:118:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:118:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:126:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:126:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:127:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:140:10: branch_true: following ‘true’ branch (when ‘change != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:143:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:143:42: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:145:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:146:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_cooperative_matrix.c:146:10: danger: ‘fields + (long unsigned int)i * 48’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8)
#  144|   
#  145|         for (unsigned i = 0; i < num_fields; ++i) {
#  146|->          fields[i] = *glsl_get_struct_field_data(orig_type, i);
#  147|   
#  148|            fields[i].type = radv_nir_translate_matrix_type(fields[i].type, type_map, params);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def13]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:29:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:16:1: enter_function: entry to ‘pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:23:21: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:27:35: call_function: inlined call to ‘nir_src_as_deref’ from ‘pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:28:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:29:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:29:7: danger: ‘args + (long unsigned int)i * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#   27|      nir_deref_instr *packed_args = nir_src_as_deref(instr->src[0]);
#   28|      for (uint32_t i = 0; i < info->num_args; i++)
#   29|->       args[i] = nir_load_deref(b, nir_build_deref_struct(b, packed_args, i));
#   30|   
#   31|      radv_build_printf_args(b, NULL, info->strings, info->num_args, args);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def14]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:261:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:629:16: call_function: calling ‘lower_rq_initialize’ from ‘radv_nir_lower_ray_queries’
#  259|   
#  260|      isec_store(b, closest, t, instr->src[7].ssa);
#  261|->    isec_store(b, closest, intersection_type, nir_imm_int(b, intersection_type_none));
#  262|   
#  263|      nir_def *accel_struct = instr->src[1].ssa;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def15]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:284:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:629:16: call_function: calling ‘lower_rq_initialize’ from ‘radv_nir_lower_ray_queries’
#  282|         rq_store(b, rq, trav_stack_low_watermark, base_offset);
#  283|      } else {
#  284|->       rq_store(b, rq, trav_stack, nir_imm_int(b, 0));
#  285|         rq_store(b, rq, trav_stack_low_watermark, nir_imm_int(b, 0));
#  286|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def16]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:285:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:629:16: call_function: calling ‘lower_rq_initialize’ from ‘radv_nir_lower_ray_queries’
#  283|      } else {
#  284|         rq_store(b, rq, trav_stack, nir_imm_int(b, 0));
#  285|->       rq_store(b, rq, trav_stack_low_watermark, nir_imm_int(b, 0));
#  286|      }
#  287|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def17]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:563:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘opaque_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:617:35: call_function: calling ‘radv_lower_opaque_ray_query_deref’ from ‘radv_nir_lower_ray_queries’
#  561|   radv_lower_opaque_ray_query_deref(nir_builder *b, nir_deref_instr *opaque_deref, nir_variable *var)
#  562|   {
#  563|->    if (opaque_deref->deref_type != nir_deref_type_array)
#  564|         return nir_build_deref_var(b, var);
#  565|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def18]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:404:13: warning[-Wanalyzer-null-argument]: use of NULL ‘last_inst’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:390:41: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:392:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:394:11: branch_true: following ‘true’ branch (when ‘next’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:395:53: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:398:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:400:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:402:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:403:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:404:13: danger: argument 2 (‘last_inst’) NULL where non-null expected
#argument 2 of ‘__builtin_memcpy’ must be non-null
#  402|            for (uint32_t i = 0; i < repeat_count; i++) {
#  403|               inst = &instructions[*num];
#  404|->             memcpy(inst, last_inst, sizeof(struct radv_shader_inst));
#  405|               inst->offset = last_inst->offset + last_inst->size * (i + 1);
#  406|               (*num)++;

Error: GCC_ANALYZER_WARNING: [#def19]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:404:13: warning[-Wanalyzer-overlapping-buffers]: overlapping buffers passed as arguments to ‘memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1129:1: enter_function: entry to ‘radv_dump_faulty_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1151:4: call_function: calling ‘radv_add_split_disasm’ from ‘radv_dump_faulty_shader’
#  402|            for (uint32_t i = 0; i < repeat_count; i++) {
#  403|               inst = &instructions[*num];
#  404|->             memcpy(inst, last_inst, sizeof(struct radv_shader_inst));
#  405|               inst->offset = last_inst->offset + last_inst->size * (i + 1);
#  406|               (*num)++;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def20]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:404:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘inst’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1129:1: enter_function: entry to ‘radv_dump_faulty_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1148:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1151:4: call_function: calling ‘radv_add_split_disasm’ from ‘radv_dump_faulty_shader’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  402|            for (uint32_t i = 0; i < repeat_count; i++) {
#  403|               inst = &instructions[*num];
#  404|->             memcpy(inst, last_inst, sizeof(struct radv_shader_inst));
#  405|               inst->offset = last_inst->offset + last_inst->size * (i + 1);
#  406|               (*num)++;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def21]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:404:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘last_inst’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1129:1: enter_function: entry to ‘radv_dump_faulty_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1148:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1151:4: call_function: calling ‘radv_add_split_disasm’ from ‘radv_dump_faulty_shader’
#argument 2 of ‘__builtin_memcpy’ must be non-null
#  402|            for (uint32_t i = 0; i < repeat_count; i++) {
#  403|               inst = &instructions[*num];
#  404|->             memcpy(inst, last_inst, sizeof(struct radv_shader_inst));
#  405|               inst->offset = last_inst->offset + last_inst->size * (i + 1);
#  406|               (*num)++;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def22]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:425:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1129:1: enter_function: entry to ‘radv_dump_faulty_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1148:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1151:4: call_function: calling ‘radv_add_split_disasm’ from ‘radv_dump_faulty_shader’
#  423|         memcpy(inst->text, disasm, len);
#  424|         inst->text[len] = 0;
#  425|->       inst->offset = last_inst ? last_inst->offset + last_inst->size : 0;
#  426|   
#  427|         const char *semicolon = strchr(disasm, ';');

Error: GCC_ANALYZER_WARNING (CWE-476): [#def23]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:425:34: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘last_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1129:1: enter_function: entry to ‘radv_dump_faulty_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1148:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_debug.c:1151:4: call_function: calling ‘radv_add_split_disasm’ from ‘radv_dump_faulty_shader’
#  423|         memcpy(inst->text, disasm, len);
#  424|         inst->text[len] = 0;
#  425|->       inst->offset = last_inst ? last_inst->offset + last_inst->size : 0;
#  426|   
#  427|         const char *semicolon = strchr(disasm, ';');

Error: GCC_ANALYZER_WARNING (CWE-476): [#def24]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1123:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1424:1: enter_function: entry to ‘radv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1430:4: call_function: inlined call to ‘radv_update_descriptor_sets_impl’ from ‘radv_UpdateDescriptorSets’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1430:4: call_function: inlined call to ‘radv_update_descriptor_sets_impl’ from ‘radv_UpdateDescriptorSets’
# 1121|         vk_find_struct_const(writeset->pNext, WRITE_DESCRIPTOR_SET_INLINE_UNIFORM_BLOCK);
# 1122|   
# 1123|->    memcpy(dst, inline_ub->pData, inline_ub->dataSize);
# 1124|   }
# 1125|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def25]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1341:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘accel_structs’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1424:1: enter_function: entry to ‘radv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1430:4: call_function: inlined call to ‘radv_update_descriptor_sets_impl’ from ‘radv_UpdateDescriptorSets’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_descriptor_set.c:1430:4: call_function: inlined call to ‘radv_update_descriptor_sets_impl’ from ‘radv_UpdateDescriptorSets’
# 1339|               break;
# 1340|            case VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR: {
# 1341|->             VK_FROM_HANDLE(vk_acceleration_structure, accel_struct, accel_structs->pAccelerationStructures[j]);
# 1342|   
# 1343|               write_accel_struct(device, ptr, accel_struct ? vk_acceleration_structure_get_va(accel_struct) : 0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def26]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_formats.c:882:68: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_formats.c:1320:1: enter_function: entry to ‘radv_GetPhysicalDeviceSparseImageFormatProperties2’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_formats.c:1328:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_formats.c:1333:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_formats.c:1342:13: call_function: calling ‘radv_get_image_format_properties’ from ‘radv_GetPhysicalDeviceSparseImageFormatProperties2’
#  880|         format_feature_flags = format_props.optimalTilingFeatures;
#  881|      } else if (tiling == VK_IMAGE_TILING_DRM_FORMAT_MODIFIER_EXT) {
#  882|->       format_feature_flags = radv_get_modifier_flags(pdev, format, mod_info->drmFormatModifier, &format_props);
#  883|      } else {
#  884|         unreachable("bad VkImageTiling");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def27]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1796:44: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1764:1: enter_function: entry to ‘radv_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1768:25: branch_true: following ‘true’ branch (when ‘i < bindInfoCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1769:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1771:36: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1771:36: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1779:10: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1779:10: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1781:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1781:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1794:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1794:10: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1795:23: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1795:23: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1796:44: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_image.c:1796:44: danger: dereference of NULL ‘<unknown>’
# 1794|         if (image->disjoint) {
# 1795|            plane_info = vk_find_struct_const(pBindInfos[i].pNext, BIND_IMAGE_PLANE_MEMORY_INFO);
# 1796|->          bind_idx = radv_plane_from_aspect(plane_info->planeAspect);
# 1797|         }
# 1798|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def28]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_nir_to_llvm.c:446:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘rbin’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_nir_to_llvm.c:469:1: enter_function: entry to ‘llvm_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_nir_to_llvm.c:482:4: call_function: calling ‘radv_compile_nir_shader’ from ‘llvm_compile_shader’
#  444|      rbin->base.type = RADV_BINARY_TYPE_RTLD;
#  445|      rbin->base.total_size = alloc_size;
#  446|->    rbin->elf_size = elf_size;
#  447|      rbin->llvm_ir_size = llvm_ir_size;
#  448|      *rbinary = &rbin->base;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def29]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_nir_to_llvm.c:452:1: warning[-Wanalyzer-malloc-leak]: leak of ‘rbin’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_nir_to_llvm.c:469:1: enter_function: entry to ‘llvm_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_nir_to_llvm.c:482:4: call_function: calling ‘radv_compile_nir_shader’ from ‘llvm_compile_shader’
#  450|      free(llvm_ir_string);
#  451|      free(elf_buffer);
#  452|-> }
#  453|   
#  454|   static void

Error: GCC_ANALYZER_WARNING (CWE-476): [#def30]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:418:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ac_block’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:909:1: enter_function: entry to ‘radv_GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:915:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:920:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:920:9: call_function: calling ‘radv_init_perfcounter_descs’ from ‘radv_GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:920:9: return_function: returning to ‘radv_GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR’ from ‘radv_init_perfcounter_descs’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:920:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:929:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:931:22: call_function: calling ‘radv_get_counter_registers’ from ‘radv_GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:931:22: return_function: returning to ‘radv_GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR’ from ‘radv_get_counter_registers’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:933:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:938:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_perfcounter.c:938:18: call_function: calling ‘radv_get_num_counter_passes’ from ‘radv_GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR’
#  416|         ++block_reg_count;
#  417|   
#  418|->       passes_needed = MAX2(passes_needed, DIV_ROUND_UP(block_reg_count, ac_block->b->b->num_counters));
#  419|      }
#  420|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def31]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:863:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:800:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:807:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:807:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:816:46: branch_true: following ‘true’ branch (when ‘pStatistics’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:816:63: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:819:7: branch_false: following ‘false’ branch (when ‘pStatistics >= end’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:827:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:833:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:835:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:841:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:843:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:849:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:851:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:857:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:859:7: branch_true: following ‘true’ branch (when ‘s < end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:860:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:863:22: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
#  861|         VK_COPY_STR(s->description, "Code size in bytes");
#  862|         s->format = VK_PIPELINE_EXECUTABLE_STATISTIC_FORMAT_UINT64_KHR;
#  863|->       s->value.u64 = shader->exec_size;
#  864|      }
#  865|      ++s;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def32]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:887:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:800:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:807:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:807:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:816:46: branch_true: following ‘true’ branch (when ‘pStatistics’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:816:63: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:819:7: branch_false: following ‘false’ branch (when ‘pStatistics >= end’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:827:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:833:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:835:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:841:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:843:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:849:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:851:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:857:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:859:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:865:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:867:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:873:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:875:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:881:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:883:7: branch_true: following ‘true’ branch (when ‘s < end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:884:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:887:22: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
#  885|         VK_COPY_STR(s->description, "The maximum number of subgroups in flight on a SIMD unit");
#  886|         s->format = VK_PIPELINE_EXECUTABLE_STATISTIC_FORMAT_UINT64_KHR;
#  887|->       s->value.u64 = shader->max_waves;
#  888|      }
#  889|      ++s;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def33]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1035:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:800:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:807:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:807:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:816:46: branch_false: following ‘false’ branch (when ‘pStatistics’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:825:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:827:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:833:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:835:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:841:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:843:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:849:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:851:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:857:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:859:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:865:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:867:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:873:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:875:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:881:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:883:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:889:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:891:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:950:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:952:7: branch_false: following ‘false’ branch (when ‘s >= end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1033:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1035:8: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 1033|      ++s;
# 1034|   
# 1035|->    if (shader->statistics) {
# 1036|         for (unsigned i = 0; i < aco_num_statistics; i++) {
# 1037|            const struct aco_compiler_statistic_info *info = &aco_statistic_infos[i];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def34]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1099:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1079:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1088:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1088:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1092:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1092:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1095:7: branch_true: following ‘true’ branch (when ‘pInternalRepresentations < end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1096:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1099:60: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 1097|         VK_COPY_STR(p->name, "NIR Shader(s)");
# 1098|         VK_COPY_STR(p->description, "The optimized NIR shader(s)");
# 1099|->       if (radv_copy_representation(p->pData, &p->dataSize, shader->nir_string) != VK_SUCCESS)
# 1100|            result = VK_INCOMPLETE;
# 1101|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def35]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1114:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1079:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1088:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1088:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1092:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1092:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1095:7: branch_false: following ‘false’ branch (when ‘pInternalRepresentations >= end’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1105:7: branch_true: following ‘true’ branch (when ‘end > p’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1106:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1107:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1108:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1114:60: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 1112|            VK_COPY_STR(p->description, "The ACO IR after some optimizations");
# 1113|         }
# 1114|->       if (radv_copy_representation(p->pData, &p->dataSize, shader->ir_string) != VK_SUCCESS)
# 1115|            result = VK_INCOMPLETE;
# 1116|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def36]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1120:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1079:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1088:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1088:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1092:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1092:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1095:7: branch_false: following ‘false’ branch (when ‘pInternalRepresentations >= end’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1105:7: branch_false: following ‘false’ branch (when ‘end <= p’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1120:7: branch_true: following ‘true’ branch (when ‘end > p’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1120:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:1120:19: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 1118|   
# 1119|      /* Disassembler */
# 1120|->    if (p < end && shader->disasm_string) {
# 1121|         p->isText = true;
# 1122|         VK_COPY_STR(p->name, "Assembly");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def37]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:156:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:364:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:371:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:379:4: call_function: inlined call to ‘util_dynarray_init’ from ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:382:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’
#  154|      }
#  155|   
#  156|->    util_dynarray_append(pipeline_binaries, struct radv_pipeline_binary *, pipeline_binary);
#  157|      return result;
#  158|   }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def38]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:156:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘pipeline_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:364:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:371:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:382:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’
#  154|      }
#  155|   
#  156|->    util_dynarray_append(pipeline_binaries, struct radv_pipeline_binary *, pipeline_binary);
#  157|      return result;
#  158|   }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def39]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:186:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘pipeline_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:364:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:371:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:382:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’
#  184|      }
#  185|   
#  186|->    util_dynarray_append(pipeline_binaries, struct radv_pipeline_binary *, pipeline_binary);
#  187|      return result;
#  188|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def40]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:242:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:364:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:371:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:379:4: call_function: inlined call to ‘util_dynarray_init’ from ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:382:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’
#  240|      }
#  241|   
#  242|->    util_dynarray_append(pipeline_binaries, struct radv_pipeline_binary *, pipeline_binary);
#  243|      return result;
#  244|   }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def41]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:242:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘pipeline_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:364:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:371:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:382:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’
#  240|      }
#  241|   
#  242|->    util_dynarray_append(pipeline_binaries, struct radv_pipeline_binary *, pipeline_binary);
#  243|      return result;
#  244|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def42]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:144:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:217:1: enter_function: entry to ‘radv_build_printf’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:237:4: call_function: calling ‘radv_build_printf_args’ from ‘radv_build_printf’
#  142|            arg = nir_b2i32(b, arg);
#  143|   
#  144|->       args[i] = arg;
#  145|   
#  146|         uint32_t arg_size = arg->bit_size == 1 ? 32 : arg->bit_size / 8;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def43]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:150:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘strides’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:217:1: enter_function: entry to ‘radv_build_printf’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:237:4: call_function: calling ‘radv_build_printf_args’ from ‘radv_build_printf’
#  148|   
#  149|         if (divergent) {
#  150|->          strides[i] = nir_imul_imm(b, active_invocation_count, arg_size);
#  151|            format.divergence_mask |= BITFIELD_BIT(i);
#  152|         } else {

Error: GCC_ANALYZER_WARNING (CWE-688): [#def44]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:213:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:217:1: enter_function: entry to ‘radv_build_printf’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_false: following ‘false’ branch (when ‘num_args <= i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:235:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:237:4: call_function: calling ‘radv_build_printf_args’ from ‘radv_build_printf’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  211|      free(strides);
#  212|   
#  213|->    util_dynarray_append(&device->printf.formats, struct radv_printf_format, format);
#  214|   }
#  215|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def45]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:214:1: warning[-Wanalyzer-malloc-leak]: leak of ‘format.string’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:217:1: enter_function: entry to ‘radv_build_printf’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_false: following ‘false’ branch (when ‘num_args <= i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:235:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:237:4: call_function: calling ‘radv_build_printf_args’ from ‘radv_build_printf’
#  212|   
#  213|      util_dynarray_append(&device->printf.formats, struct radv_printf_format, format);
#  214|-> }
#  215|   
#  216|   void

Error: GCC_ANALYZER_WARNING (CWE-476): [#def46]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:230:21: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:7: danger: ‘args + (long unsigned int)i * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
#  231|   
#  232|      for (uint32_t i = 0; i < num_args; i++)
#  233|->       args[i] = va_arg(arg_list, nir_def *);
#  234|   
#  235|      va_end(arg_list);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def47]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:290:26: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘print_str’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:245:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:248:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:253:69: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:254:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:270:28: branch_true: following ‘true’ branch (when ‘num_args >= i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:271:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:273:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:278:51: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:285:28: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:290:26: danger: argument 1 (‘print_str’) from [(9)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/8) could be NULL where non-null expected
#  288|   
#  289|            size_t element_size = printf_format->element_sizes[i];
#  290|->          bool is_float = strpbrk(print_str, "fFeEgGaA") != NULL;
#  291|   
#  292|            uint32_t lane_count = (printf_format->divergence_mask & BITFIELD_BIT(i)) ? invocation_count : 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def48]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_radeon_winsys.h:324:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_probs_bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2624:1: enter_function: entry to ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2639:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2644:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2648:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2648:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘ruvd_dec_message_decode’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2653:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2653:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2666:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2666:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2671:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2671:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2672:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2672:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2673:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2675:16: call_function: inlined call to ‘radv_buffer_get_va’ from ‘radv_uvd_decode_video’
#  322|   radv_buffer_get_va(const struct radeon_winsys_bo *bo)
#  323|   {
#  324|->    return bo->va;
#  325|   }
#  326|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def49]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_rmv.c:160:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_rmv.c:729:1: enter_function: entry to ‘radv_rmv_log_sparse_remove_residency’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_rmv.c:731:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_rmv.c:734:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_rmv.c:740:4: call_function: calling ‘radv_rmv_collect_trace_events’ from ‘radv_rmv_log_sparse_remove_residency’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  158|   
#  159|      token.data.page_table_update.is_unmap = !(event->flags & (AMDGPU_PTE_VALID | AMDGPU_PTE_PRT));
#  160|->    util_dynarray_append(&data->tokens, struct vk_rmv_token, token);
#  161|   }
#  162|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def50]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:2527:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘submission’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3359:1: enter_function: entry to ‘radv_create_ps_epilog’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3367:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_create_ps_epilog’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3367:4: return_function: returning to ‘radv_create_ps_epilog’ from ‘radv_fill_nir_compiler_options’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3396:13: call_function: calling ‘radv_shader_part_create’ from ‘radv_create_ps_epilog’
# 2525|                          uint64_t *upload_seq_out)
# 2526|   {
# 2527|->    struct radeon_cmdbuf *cs = submission->cs;
# 2528|      struct radeon_winsys *ws = device->ws;
# 2529|      VkResult result;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def51]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3217:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘part_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3215:84: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader.c:3217:4: danger: ‘part_binary’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 3215|      struct radv_shader_part_binary *part_binary = (struct radv_shader_part_binary *)calloc(size, 1);
# 3216|   
# 3217|->    part_binary->num_sgprs = num_sgprs;
# 3218|      part_binary->num_vgprs = num_vgprs;
# 3219|      part_binary->total_size = size;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def52]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader_info.c:1209:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader_info.c:1196:1: enter_function: entry to ‘radv_nir_shader_info_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader_info.c:1202:55: call_function: inlined call to ‘exec_list_get_head_const’ from ‘radv_nir_shader_info_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader_info.c:1204:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_shader_info.c:1209:4: danger: dereference of NULL ‘<unknown>’
# 1207|      }
# 1208|   
# 1209|->    nir_foreach_block (block, func->impl) {
# 1210|         gather_info_block(nir, block, info, gfx_state, stage_key, consider_force_vrs);
# 1211|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def53]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1230:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1228|      vk_video_get_h264_parameters(&vid->vk, params ? &params->vk : NULL, frame_info, h264_pic_info, &sps, &pps);
# 1229|   
# 1230|->    *slice_offset = h264_pic_info->pSliceOffsets[0];
# 1231|   
# 1232|      memset(&result, 0, sizeof(result));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def54]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1373:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1371|         result.sps_info_flags |= 1 << 9;
# 1372|   
# 1373|->    if (!h265_pic_info->pStdPictureInfo->flags.short_term_ref_pic_set_sps_flag) {
# 1374|         result.sps_info_flags |= 1 << 11;
# 1375|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def55]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1518:40: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1516|      const struct VkVideoDecodeAV1PictureInfoKHR *av1_pic_info =
# 1517|         vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_AV1_PICTURE_INFO_KHR);
# 1518|->    const StdVideoDecodeAV1PictureInfo *pi = av1_pic_info->pStdPictureInfo;
# 1519|   
# 1520|      const StdVideoAV1SequenceHeader *seq_hdr = NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def56]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1518:40: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘probs_ptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2717:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2720:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2720:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2725:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2728:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1516|      const struct VkVideoDecodeAV1PictureInfoKHR *av1_pic_info =
# 1517|         vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_AV1_PICTURE_INFO_KHR);
# 1518|->    const StdVideoDecodeAV1PictureInfo *pi = av1_pic_info->pStdPictureInfo;
# 1519|   
# 1520|      const StdVideoAV1SequenceHeader *seq_hdr = NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def57]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1955:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1953|   
# 1954|      if (vid->dpb_type == DPB_DYNAMIC_TIER_2) {
# 1955|->       index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB;
# 1956|         index_dynamic_dpb->offset = offset_dynamic_dpb;
# 1957|         index_dynamic_dpb->filled = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def58]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2138:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2393:1: enter_function: entry to ‘ruvd_dec_message_decode’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2429:10: call_function: calling ‘get_uvd_h264_msg’ from ‘ruvd_dec_message_decode’
# 2136|      vk_video_get_h264_parameters(&vid->vk, params ? &params->vk : NULL, frame_info, h264_pic_info, &sps, &pps);
# 2137|   
# 2138|->    *slice_offset = h264_pic_info->pSliceOffsets[0];
# 2139|   
# 2140|      memset(&result, 0, sizeof(result));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def59]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2138:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_ptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2624:1: enter_function: entry to ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2632:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2632:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2639:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2644:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2648:4: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2648:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’
# 2136|      vk_video_get_h264_parameters(&vid->vk, params ? &params->vk : NULL, frame_info, h264_pic_info, &sps, &pps);
# 2137|   
# 2138|->    *slice_offset = h264_pic_info->pSliceOffsets[0];
# 2139|   
# 2140|      memset(&result, 0, sizeof(result));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def60]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2750:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘slice_offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2717:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2720:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2720:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2725:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘rvcn_dec_message_decode’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2734:4: call_function: calling ‘send_cmd’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2734:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2736:4: call_function: calling ‘send_cmd’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2736:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2750:13: danger: use of uninitialized value ‘slice_offset’ here
# 2748|   
# 2749|      send_cmd(cmd_buffer, RDECODE_CMD_BITSTREAM_BUFFER, src_buffer->bo,
# 2750|->             vk_buffer_address(&src_buffer->vk, frame_info->srcBufferOffset + slice_offset));
# 2751|   
# 2752|      struct radv_image_view *dst_iv = radv_image_view_from_handle(frame_info->dstPictureResource.imageViewBinding);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def61]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2794:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2783:1: enter_function: entry to ‘radv_video_get_profile_alignments’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2789:7: branch_true: following ‘true’ branch (when ‘profile_list’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2790:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2791:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2791:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2793:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2793:16: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_video_get_profile_alignments’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2793:16: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_video_get_profile_alignments’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2794:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2794:17: danger: dereference of NULL ‘<unknown>’
# 2792|               const struct VkVideoDecodeH265ProfileInfoKHR *h265_profile =
# 2793|                  vk_find_struct_const(profile_list->pProfiles[i].pNext, VIDEO_DECODE_H265_PROFILE_INFO_KHR);
# 2794|->             if (h265_profile->stdProfileIdc == STD_VIDEO_H265_PROFILE_IDC_MAIN_10)
# 2795|                  is_h265_main_10 = true;
# 2796|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def62]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:448:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  446|      const struct VkVideoEncodeH264PictureInfoKHR *h264_picture_info =
#  447|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
#  448|->    const StdVideoEncodeH264PictureInfo *pic = h264_picture_info->pStdPictureInfo;
#  449|      const StdVideoH264SequenceParameterSet *sps =
#  450|         vk_video_find_h264_enc_std_sps(&cmd_buffer->video.params->vk, pic->seq_parameter_set_id);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def63]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:478:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  476|      const struct VkVideoEncodeH265PictureInfoKHR *h265_picture_info =
#  477|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H265_PICTURE_INFO_KHR);
#  478|->    const StdVideoEncodeH265PictureInfo *pic = h265_picture_info->pStdPictureInfo;
#  479|      const VkVideoEncodeH265NaluSliceSegmentInfoKHR *h265_slice = &h265_picture_info->pNaluSliceSegmentEntries[0];
#  480|      const StdVideoEncodeH265SliceSegmentHeader *slice = h265_slice->pStdSliceSegmentHeader;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def64]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:558:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  556|      const struct VkVideoEncodeH264PictureInfoKHR *h264_picture_info =
#  557|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
#  558|->    const VkVideoEncodeH264NaluSliceInfoKHR *h264_slice = &h264_picture_info->pNaluSliceEntries[0];
#  559|      const StdVideoEncodeH264SliceHeader *slice = h264_slice->pStdSliceHeader;
#  560|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def65]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:577:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  575|      const struct VkVideoEncodeH265PictureInfoKHR *h265_picture_info =
#  576|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H265_PICTURE_INFO_KHR);
#  577|->    const StdVideoEncodeH265PictureInfo *pic = h265_picture_info->pStdPictureInfo;
#  578|      const VkVideoEncodeH265NaluSliceSegmentInfoKHR *h265_slice = &h265_picture_info->pNaluSliceSegmentEntries[0];
#  579|      const StdVideoEncodeH265SliceSegmentHeader *slice = h265_slice->pStdSliceSegmentHeader;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def66]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:634:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  632|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
#  633|      int slice_count = h264_picture_info->naluSliceEntryCount;
#  634|->    const StdVideoEncodeH264PictureInfo *pic = h264_picture_info->pStdPictureInfo;
#  635|      const StdVideoH264SequenceParameterSet *sps =
#  636|         vk_video_find_h264_enc_std_sps(&cmd_buffer->video.params->vk, pic->seq_parameter_set_id);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def67]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1251:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
# 1249|            const struct VkVideoEncodeH264PictureInfoKHR *h264_picture_info =
# 1250|               vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
# 1251|->          const VkVideoEncodeH264NaluSliceInfoKHR *h264_slice = &h264_picture_info->pNaluSliceEntries[0];
# 1252|            qp = h264_slice->constantQp;
# 1253|            break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def68]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1258:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1851:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1854:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
# 1256|            const struct VkVideoEncodeH265PictureInfoKHR *h265_picture_info =
# 1257|               vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H265_PICTURE_INFO_KHR);
# 1258|->          const VkVideoEncodeH265NaluSliceSegmentInfoKHR *h265_slice = &h265_picture_info->pNaluSliceSegmentEntries[0];
# 1259|            qp = h265_slice->constantQp;
# 1260|            break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def69]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1910:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1893:1: enter_function: entry to ‘radv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1908:10: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_GetEncodedVideoSessionParametersKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1908:10: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1909:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1910:11: danger: dereference of NULL ‘<unknown>’
# 1908|            vk_find_struct_const(pVideoSessionParametersInfo->pNext, VIDEO_ENCODE_H264_SESSION_PARAMETERS_GET_INFO_KHR);
# 1909|         size_t sps_size = 0, pps_size = 0;
# 1910|->       if (h264_get_info->writeStdSPS) {
# 1911|            const StdVideoH264SequenceParameterSet *sps =
# 1912|               vk_video_find_h264_enc_std_sps(&templ->vk, h264_get_info->stdSPSId);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def70]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1938:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1893:1: enter_function: entry to ‘radv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1936:10: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_GetEncodedVideoSessionParametersKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1936:10: call_function: inlined call to ‘__vk_find_struct’ from ‘radv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1937:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video_enc.c:1938:11: danger: dereference of NULL ‘<unknown>’
# 1936|            vk_find_struct_const(pVideoSessionParametersInfo->pNext, VIDEO_ENCODE_H265_SESSION_PARAMETERS_GET_INFO_KHR);
# 1937|         size_t sps_size = 0, pps_size = 0, vps_size = 0;
# 1938|->       if (h265_get_info->writeStdVPS) {
# 1939|            const StdVideoH265VideoParameterSet *vps = vk_video_find_h265_enc_std_vps(&templ->vk, h265_get_info->stdVPSId);
# 1940|            assert(vps);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def71]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ibs’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:24: branch_false: following ‘false’ branch (when ‘type != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1497:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1497:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1498:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1503:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1506:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1512:13: branch_false: following ‘false’ branch (when ‘type != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:16: release_memory: ‘ibs’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:13: danger: dereference of NULL ‘ibs + (long unsigned int)i * 8’
# 1528|               ac_parse_ib(&ib_parser, name);
# 1529|            } else {
# 1530|->             ibs[i] = mapped;
# 1531|               ib_dw_sizes[i] = ib->cdw;
# 1532|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def72]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ibs’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:24: branch_true: following ‘true’ branch (when ‘type == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:69: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:62: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1497:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1498:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1503:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1506:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1512:13: branch_false: following ‘false’ branch (when ‘type != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:13: danger: ‘ibs + (long unsigned int)i * 8’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
# 1528|               ac_parse_ib(&ib_parser, name);
# 1529|            } else {
# 1530|->             ibs[i] = mapped;
# 1531|               ib_dw_sizes[i] = ib->cdw;
# 1532|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def73]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1531:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ib_dw_sizes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:24: branch_true: following ‘true’ branch (when ‘type == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1493:69: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1495:48: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1497:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1498:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1503:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1506:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1512:13: branch_false: following ‘false’ branch (when ‘type != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1530:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1531:13: danger: ‘ib_dw_sizes + (long unsigned int)i * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/4)
# 1529|            } else {
# 1530|               ibs[i] = mapped;
# 1531|->             ib_dw_sizes[i] = ib->cdw;
# 1532|            }
# 1533|         }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def74]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1559:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘new_annotation’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1556:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1557:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1558:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1559:7: danger: argument 1 (‘new_annotation’) from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2) could be NULL where non-null expected
#argument 1 of ‘__builtin_sprintf’ must be non-null
# 1557|         char *old_annotation = entry->data;
# 1558|         char *new_annotation = calloc(strlen(old_annotation) + strlen(annotation) + 5, 1);
# 1559|->       sprintf(new_annotation, "%s -> %s", old_annotation, annotation);
# 1560|         free(old_annotation);
# 1561|         _mesa_hash_table_insert(cs->annotations, _cs->buf + _cs->cdw, new_annotation);

Error: GCC_ANALYZER_WARNING (CWE-122): [#def75]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1767:7: warning[-Wanalyzer-out-of-bounds]: heap-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1787:1: enter_function: entry to ‘radv_amdgpu_cs_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1803:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1806:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1809:7: branch_false: following ‘false’ branch (when ‘chunks’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1812:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1815:7: branch_false: following ‘false’ branch (when ‘chunk_data’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1820:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1842:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1843:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1878:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1879:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1879:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1881:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1880:27: call_function: calling ‘radv_amdgpu_cs_alloc_timeline_syncobj_chunk’ from ‘radv_amdgpu_cs_submit’
# 1765|   
# 1766|      if (queue_syncobj) {
# 1767|->       syncobj[count - 1].handle = queue_syncobj;
# 1768|         syncobj[count - 1].flags = 0;
# 1769|         syncobj[count - 1].point = 0;

Error: GCC_ANALYZER_WARNING (CWE-122): [#def76]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1768:7: warning[-Wanalyzer-out-of-bounds]: heap-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1787:1: enter_function: entry to ‘radv_amdgpu_cs_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1803:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1806:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1809:7: branch_false: following ‘false’ branch (when ‘chunks’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1812:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1815:7: branch_false: following ‘false’ branch (when ‘chunk_data’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1820:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1842:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1843:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1878:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1879:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1879:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1881:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1880:27: call_function: calling ‘radv_amdgpu_cs_alloc_timeline_syncobj_chunk’ from ‘radv_amdgpu_cs_submit’
# 1766|      if (queue_syncobj) {
# 1767|         syncobj[count - 1].handle = queue_syncobj;
# 1768|->       syncobj[count - 1].flags = 0;
# 1769|         syncobj[count - 1].point = 0;
# 1770|      }

Error: GCC_ANALYZER_WARNING (CWE-122): [#def77]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1769:7: warning[-Wanalyzer-out-of-bounds]: heap-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1787:1: enter_function: entry to ‘radv_amdgpu_cs_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1803:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1806:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1809:7: branch_false: following ‘false’ branch (when ‘chunks’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1812:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1815:7: branch_false: following ‘false’ branch (when ‘chunk_data’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1820:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1842:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1843:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1878:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1879:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1879:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1881:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/amdgpu/radv_amdgpu_cs.c:1880:27: call_function: calling ‘radv_amdgpu_cs_alloc_timeline_syncobj_chunk’ from ‘radv_amdgpu_cs_submit’
# 1767|         syncobj[count - 1].handle = queue_syncobj;
# 1768|         syncobj[count - 1].flags = 0;
# 1769|->       syncobj[count - 1].point = 0;
# 1770|      }
# 1771|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def78]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:66:11: warning[-Wanalyzer-malloc-leak]: leak of ‘cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:53:30: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:54:7: branch_false: following ‘false’ branch (when ‘cs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:57:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:61:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:66:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/winsys/null/radv_null_cs.c:66:11: danger: ‘cs’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   64|      }
#   65|   
#   66|->    return &cs->base;
#   67|   }
#   68|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def79]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:193:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:243:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:245:7: branch_false: following ‘false’ branch (when ‘argc == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:251:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:258:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:264:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:267:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:274:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:278:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:278:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:286:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:286:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:294:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:295:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:333:10: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:333:10: return_function: returning to ‘main’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:335:13: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:339:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:342:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:342:16: branch_false: following ‘false’ branch (when the strings are equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:346:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:353:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:358:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:360:13: call_function: calling ‘print_shader’ from ‘main’
#  191|      uint32_t *mem = calloc(sz_el, 4);
#  192|   
#  193|->    memcpy(mem, &info, sizeof(info));
#  194|      memcpy((uint8_t *)mem + sizeof(info), p->binary, p->info.binary_size);
#  195|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def80]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:446:1: enter_function: entry to ‘agx_block_add_successor’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:454:25: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:455:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_block_add_successor’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: return_function: returning to ‘agx_block_add_successor’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*successor.predecessors, 1, 8)’
#  461|   
#  462|         block->successors[i] = successor;
#  463|->       util_dynarray_append(&successor->predecessors, agx_block *, block);
#  464|         return;
#  465|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def81]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:590:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3762:1: enter_function: entry to ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3823:4: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3823:4: return_function: returning to ‘agx_compile_shader_nir’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:4: call_function: calling ‘agx_optimize_nir’ from ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:4: return_function: returning to ‘agx_compile_shader_nir’ from ‘agx_optimize_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3840:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3840:4: return_function: returning to ‘agx_compile_shader_nir’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3840:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3842:10: call_function: calling ‘agx_compile_function_nir’ from ‘agx_compile_shader_nir’
#  588|   agx_interp_for_bary(nir_intrinsic_instr *bary, agx_index *sample_index)
#  589|   {
#  590|->    switch (bary->intrinsic) {
#  591|      case nir_intrinsic_load_barycentric_pixel:
#  592|         return AGX_INTERPOLATION_CENTER;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def82]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:170:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘copies2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:394:1: enter_function: entry to ‘agx_emit_parallel_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:400:4: call_function: calling ‘agx_emit_parallel_copies_for_class’ from ‘agx_emit_parallel_copies’
#  168|         if (copy.src.size == AGX_SIZE_64) {
#  169|            copy.src.size = AGX_SIZE_32;
#  170|->          copies2[num_copies2++] = copy;
#  171|   
#  172|            if (copy.src.type == AGX_INDEX_IMMEDIATE) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def83]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:185:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘copies2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:394:1: enter_function: entry to ‘agx_emit_parallel_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:400:4: call_function: calling ‘agx_emit_parallel_copies_for_class’ from ‘agx_emit_parallel_copies’
#  183|            copies2[num_copies2++] = copy;
#  184|         } else {
#  185|->          copies2[num_copies2++] = copy;
#  186|         }
#  187|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def84]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:105:1: enter_function: entry to ‘needs_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘needs_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: danger: dereference of NULL ‘<unknown>’
#  112|      /* at_offset barycentrics need to be lowered */
#  113|      if (load->intrinsic == nir_intrinsic_load_interpolated_input) {
#  114|->       return (nir_src_as_intrinsic(load->src[0])->intrinsic ==
#  115|                 nir_intrinsic_load_barycentric_at_offset);
#  116|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def85]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:551:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  549|         unsigned hi = ((uint64_t)extend) << extend_offset;
#  550|   
#  551|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  552|         memcpy(util_dynarray_grow_bytes(emission, 1, length - 8), &hi,
#  553|                length - 8);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def86]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:595:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  593|   
#  594|         unsigned size = 8;
#  595|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  596|         break;
#  597|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def87]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:609:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  607|   
#  608|         unsigned size = 4;
#  609|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  610|         break;
#  611|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def88]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:618:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  616|   
#  617|         unsigned size = 2;
#  618|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  619|         break;
#  620|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def89]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:674:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  672|   
#  673|         unsigned size = 8;
#  674|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  675|         break;
#  676|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def90]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:696:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  694|   
#  695|         unsigned size = 4;
#  696|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  697|         break;
#  698|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def91]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:762:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  760|   
#  761|         unsigned size = L ? 8 : 6;
#  762|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  763|         break;
#  764|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def92]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:788:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  786|   
#  787|         unsigned size = L ? 8 : 6;
#  788|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  789|         break;
#  790|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def93]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:822:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  820|            (((uint64_t)(O >> 8)) << 56);
#  821|   
#  822|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  823|         break;
#  824|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def94]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:849:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  847|         uint64_t raw2 = S;
#  848|   
#  849|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  850|         memcpy(util_dynarray_grow_bytes(emission, 1, 2), &raw2, 2);
#  851|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def95]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:850:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  848|   
#  849|         memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  850|->       memcpy(util_dynarray_grow_bytes(emission, 1, 2), &raw2, 2);
#  851|         break;
#  852|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def96]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:917:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  915|            (((uint64_t)I->scoreboard) << 63);
#  916|   
#  917|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  918|         if (L)
#  919|            memcpy(util_dynarray_grow_bytes(emission, 1, 4), &extend, 4);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def97]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:919:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  917|         memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  918|         if (L)
#  919|->          memcpy(util_dynarray_grow_bytes(emission, 1, 4), &extend, 4);
#  920|   
#  921|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def98]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:959:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  957|         if (raw >> 48) {
#  958|            raw |= BITFIELD_BIT(15);
#  959|->          memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  960|         } else {
#  961|            memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def99]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:961:10: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  959|            memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  960|         } else {
#  961|->          memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);
#  962|         }
#  963|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def100]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1010:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1008|         uint32_t word2 = (F >> 1) | (unk3 ? (1 << 3) : 0) | ((T >> 6) << 14);
# 1009|   
# 1010|->       memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1011|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word1, 4);
# 1012|         memcpy(util_dynarray_grow_bytes(emission, 1, 2), &word2, 2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def101]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1011:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1009|   
# 1010|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1011|->       memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word1, 4);
# 1012|         memcpy(util_dynarray_grow_bytes(emission, 1, 2), &word2, 2);
# 1013|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def102]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1012:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1010|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1011|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word1, 4);
# 1012|->       memcpy(util_dynarray_grow_bytes(emission, 1, 2), &word2, 2);
# 1013|         break;
# 1014|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def103]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1035:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1033|                          (I->zs << 29);
# 1034|   
# 1035|->       memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1036|         break;
# 1037|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def104]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1052:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1050|         };
# 1051|   
# 1052|->       util_dynarray_append(fixups, struct agx_branch_fixup, fixup);
# 1053|   
# 1054|         /* The rest of the instruction is fixed */

Error: GCC_ANALYZER_WARNING (CWE-688): [#def105]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1057:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1055|         struct agx_opcode_info info = agx_opcodes_info[I->op];
# 1056|         uint64_t raw = info.encoding.exact;
# 1057|->       memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);
# 1058|         break;
# 1059|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def106]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1065:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1063|         struct agx_opcode_info info = agx_opcodes_info[I->op];
# 1064|         uint64_t raw = info.encoding.exact | (I->imm << 40);
# 1065|->       memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);
# 1066|         break;
# 1067|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def107]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1093:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1091|            ((uint64_t)q5 << 48) | ((uint64_t)(I->imm >> 8) << 56);
# 1092|   
# 1093|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
# 1094|         break;
# 1095|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def108]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1131:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1129|   
# 1130|         unsigned size = L ? 8 : 6;
# 1131|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
# 1132|         break;
# 1133|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def109]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1150:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1148|            ((uint64_t)(I->stack_size >> 8) << 56);
# 1149|   
# 1150|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
# 1151|         break;
# 1152|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def110]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:125:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘req’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:123:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:125:4: danger: ‘req’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  123|      struct asahi_ccmd_vm_bind_req *req = calloc(1, req_len);
#  124|   
#  125|->    *req = (struct asahi_ccmd_vm_bind_req){
#  126|         .hdr.cmd = ASAHI_CCMD_VM_BIND,
#  127|         .hdr.len = sizeof(struct asahi_ccmd_vm_bind_req),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def111]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:244:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘req’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:242:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:244:4: danger: ‘req’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  242|         (struct asahi_ccmd_submit_req *)calloc(1, req_len);
#  243|   
#  244|->    req->queue_id = submit->queue_id;
#  245|      req->extres_count = virt->extres_count;
#  246|      req->cmdbuf_size = submit->cmdbuf_size;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def112]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:263:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vdrm_syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:261:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:262:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:263:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:263:7: danger: ‘vdrm_syncs + (long unsigned int)i * 16’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  261|         calloc(total_syncs, sizeof(struct drm_virtgpu_execbuffer_syncobj));
#  262|      for (int i = 0; i < total_syncs; i++) {
#  263|->       vdrm_syncs[i].handle = syncs[i].handle;
#  264|         vdrm_syncs[i].point = syncs[i].timeline_value;
#  265|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def113]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:67:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘xy[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:204:1: enter_function: entry to ‘agx_nir_lower_sample_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:207:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_sample_intrinsics’
#   65|   
#   66|         /* Collect and rewrite */
#   67|->       nir_def_replace(&intr->def, nir_vec2(b, xy[0], xy[1]));
#   68|         return true;
#   69|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def114]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_prolog_epilog.c:120:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘data’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_prolog_epilog.c:691:1: enter_function: entry to ‘agx_nir_fs_prolog’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_prolog_epilog.c:720:4: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_fs_prolog’
#  118|      if (b->shader->info.stage == MESA_SHADER_VERTEX) {
#  119|         unsigned *nr_attribs = data;
#  120|->       unif = map_vs_part_uniform(intr, *nr_attribs);
#  121|      } else {
#  122|         unif = map_fs_part_uniform(intr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def115]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:44:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘va’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:16:1: enter_function: entry to ‘agx_va_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:38:4: call_function: calling ‘simple_mtx_unlock’ from ‘agx_va_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:38:4: return_function: returning to ‘agx_va_alloc’ from ‘simple_mtx_unlock’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:40:7: branch_false: following ‘false’ branch (when ‘addr != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:43:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:43:24: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:44:4: danger: ‘va’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8)
#   42|   
#   43|      struct agx_va *va = malloc(sizeof(struct agx_va));
#   44|->    *va = (struct agx_va){
#   45|         .flags = flags,
#   46|         .size_B = size_B,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def116]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:100:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:88:7: branch_true: following ‘true’ branch (when ‘mem’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:89:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:91:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:92:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:100:25: danger: dereference of NULL ‘mem’
#   98|      assert(mem);
#   99|   
#  100|->    if (size + (gpu_va - mem->va->addr) > mem->size) {
#  101|         fprintf(stderr,
#  102|                 "Overflowing to unknown memory %" PRIx64

Error: GCC_ANALYZER_WARNING (CWE-476): [#def117]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:168:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:1104:1: enter_function: entry to ‘libagxdecode_usc’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:1107:4: call_function: calling ‘agxdecode_stateful’ from ‘libagxdecode_usc’
#  166|         struct agx_bo *alloc = agxdecode_find_mapped_gpu_mem_containing(ctx, va);
#  167|         assert(alloc != NULL && "nonexistent object");
#  168|->       fprintf(agxdecode_dump_stream, "%s (%" PRIx64 ", handle %u)\n", label, va,
#  169|                 alloc->handle);
#  170|         size = MIN2(size, alloc->size - (va - alloc->va->addr));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def118]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/pool.c:24:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/pool.c:56:1: enter_function: entry to ‘agx_pool_alloc_aligned_with_bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/pool.c:67:12: call_function: calling ‘agx_pool_alloc_backing’ from ‘agx_pool_alloc_aligned_with_bo’
#   22|         agx_bo_create(pool->dev, bo_sz, 0, pool->create_flags, pool->label);
#   23|   
#   24|->    util_dynarray_append(&pool->bos, struct agx_bo *, bo);
#   25|      pool->transient_bo = bo;
#   26|      pool->transient_offset = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def119]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.c:187:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.c:631:1: enter_function: entry to ‘hk_upload_usc_words’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.c:644:23: call_function: inlined call to ‘hk_pool_usc_alloc’ from ‘hk_upload_usc_words’
#  185|            agx_bo_create(&dev->dev, size, flags, 0, "Large pool allocation");
#  186|   
#  187|->       util_dynarray_append(&cmd->large_bos, struct agx_bo *, bo);
#  188|         return (struct agx_ptr){
#  189|            .gpu = bo->va->addr,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def120]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.h:559:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_draw.c:3785:1: enter_function: entry to ‘hk_CmdDrawIndexedIndirectCount’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_draw.c:3790:4: call_function: calling ‘hk_draw_indirect_count’ from ‘hk_CmdDrawIndexedIndirectCount’
#  557|         /* Allocate hk_cs for the new stream */
#  558|         struct hk_cs *cs = malloc(sizeof(*cs));
#  559|->       *cs = (struct hk_cs){
#  560|            .cmd = cmd,
#  561|            .type = compute ? HK_CS_CDM : HK_CS_VDM,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def121]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.h:797:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:87:1: enter_function: entry to ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:89:26: call_function: inlined call to ‘hk_only_variant’ from ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:90:23: call_function: inlined call to ‘hk_cmd_buffer_get_cs’ from ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:90:23: call_function: inlined call to ‘hk_cmd_buffer_get_cs’ from ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:91:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:96:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:115:4: call_function: calling ‘hk_dispatch_with_local_size’ from ‘dispatch’
#  795|   {
#  796|      struct hk_device *dev = hk_cmd_buffer_device(cmd);
#  797|->    uint32_t usc = hk_upload_usc_words(cmd, s, s->only_linked);
#  798|   
#  799|      hk_reserve_scratch(cmd, cs, s);

Error: GCC_ANALYZER_WARNING (CWE-121): [#def122]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:113:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:707:1: enter_function: entry to ‘hk_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:711:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:714:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:719:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:721:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:723:13: call_function: calling ‘write_sampled_image_view_desc’ from ‘hk_descriptor_set_write_template’
#  111|             * we don't have to care in the shader.
#  112|             */
#  113|->          desc[plane].sampler_index =
#  114|               sampler->planes[sampler_plane].hw->index + 28;
#  115|            desc[plane].lod_bias_fp16 = sampler->lod_bias_fp16;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def123]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:115:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:707:1: enter_function: entry to ‘hk_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:711:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:714:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:719:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:721:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:723:13: call_function: calling ‘write_sampled_image_view_desc’ from ‘hk_descriptor_set_write_template’
#  113|            desc[plane].sampler_index =
#  114|               sampler->planes[sampler_plane].hw->index + 28;
#  115|->          desc[plane].lod_bias_fp16 = sampler->lod_bias_fp16;
#  116|            desc[plane].clamp_0_sampler_index_or_negative = -1;
#  117|         }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def124]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:116:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:707:1: enter_function: entry to ‘hk_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:711:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:714:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:719:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:721:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:723:13: call_function: calling ‘write_sampled_image_view_desc’ from ‘hk_descriptor_set_write_template’
#  114|               sampler->planes[sampler_plane].hw->index + 28;
#  115|            desc[plane].lod_bias_fp16 = sampler->lod_bias_fp16;
#  116|->          desc[plane].clamp_0_sampler_index_or_negative = -1;
#  117|         }
#  118|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def125]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:104:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:302:1: enter_function: entry to ‘hk_GetDescriptorSetLayoutSupport’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:310:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:310:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:313:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:313:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:321:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:321:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:322:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:324:10: call_function: inlined call to ‘hk_descriptor_get_type_list’ from ‘hk_GetDescriptorSetLayoutSupport’
#  102|         assert(info != NULL);
#  103|         assert(info_idx < info->mutableDescriptorTypeListCount);
#  104|->       type_list = &info->pMutableDescriptorTypeLists[info_idx];
#  105|      }
#  106|      return type_list;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def126]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:110:1: enter_function: entry to ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:140:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:141:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:143:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:146:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:10: release_memory: ‘layout’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:4: danger: dereference of NULL ‘layout’
#  147|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);
#  148|   
#  149|->    layout->binding_count = num_bindings;
#  150|   
#  151|      for (uint32_t j = 0; j < pCreateInfo->bindingCount; j++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def127]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:53:1: enter_function: entry to ‘hk_add_ext_bo_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_add_ext_bo_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: return_function: returning to ‘hk_add_ext_bo_locked’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*dev.external_bos.list, 1, 8)’
#   72|         .flags = ASAHI_EXTRES_READ | ASAHI_EXTRES_WRITE,
#   73|      };
#   74|->    util_dynarray_append(&dev->external_bos.list, struct asahi_ccmd_submit_res,
#   75|                           res);
#   76|      util_dynarray_append(&dev->external_bos.counts, unsigned, 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def128]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:76:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:80:1: enter_function: entry to ‘hk_add_ext_bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:82:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:83:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:84:7: call_function: calling ‘hk_add_ext_bo_locked’ from ‘hk_add_ext_bo’
#   74|      util_dynarray_append(&dev->external_bos.list, struct asahi_ccmd_submit_res,
#   75|                           res);
#   76|->    util_dynarray_append(&dev->external_bos.counts, unsigned, 1);
#   77|   }
#   78|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def129]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:881:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1336:1: enter_function: entry to ‘hk_GetDeviceImageSubresourceLayoutKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1344:13: call_function: calling ‘hk_image_init’ from ‘hk_GetDeviceImageSubresourceLayoutKHR’
#  879|            modifier = choose_drm_format_mod(dev, image->plane_count, pCreateInfo,
#  880|                                             mod_list_info->drmFormatModifierCount,
#  881|->                                           mod_list_info->pDrmFormatModifiers);
#  882|         }
#  883|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def130]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1416:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1378:1: enter_function: entry to ‘hk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1382:25: branch_true: following ‘true’ branch (when ‘i < bindInfoCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1383:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1390:10: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1390:10: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1393:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1393:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1411:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1412:10: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1413:57: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1413:57: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1416:46: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1416:46: danger: dereference of NULL ‘<unknown>’
# 1414|               pBindInfos[i].pNext, BIND_IMAGE_PLANE_MEMORY_INFO);
# 1415|            uint8_t plane =
# 1416|->             hk_image_aspects_to_plane(image, plane_info->planeAspect);
# 1417|            hk_image_plane_bind(dev, &image->planes[plane], mem, &offset_B);
# 1418|         } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def131]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_query_pool.c:282:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_query_pool.c:519:1: enter_function: entry to ‘hk_CmdEndQueryIndexedEXT’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_query_pool.c:525:4: call_function: calling ‘hk_cmd_begin_end_query’ from ‘hk_CmdEndQueryIndexedEXT’
#  280|         }
#  281|   
#  282|->       util_dynarray_append(&cs->imm_writes, struct libagx_imm_write, imm);
#  283|         return;
#  284|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def132]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:404:1: enter_function: entry to ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: return_function: returning to ‘hk_flush_bind’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*b.binds, 1, 32)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  480|      }
#  481|   
#  482|->    util_dynarray_append(&b->binds, struct drm_asahi_gem_bind_op, op);
#  483|   
#  484|      /* Shadow a read-only mapping to the upper half */

Error: GCC_ANALYZER_WARNING (CWE-688): [#def133]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:404:1: enter_function: entry to ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: return_function: returning to ‘hk_flush_bind’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: return_function: returning to ‘hk_flush_bind’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*b.binds, 1, 32)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  490|      }
#  491|   
#  492|->    util_dynarray_append(&b->binds, struct drm_asahi_gem_bind_op, op);
#  493|   
#  494|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def134]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1346:23: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc((long unsigned int)blob_read_uint32(blob))’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1361:1: enter_function: entry to ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1373:45: call_function: inlined call to ‘hk_num_variants’ from ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1378:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1384:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: call_function: calling ‘hk_deserialize_shader’ from ‘hk_deserialize_api_shader’
# 1344|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);
# 1345|   
# 1346|->    shader->data_ptr = malloc(data_size);
# 1347|      if (shader->data_ptr == NULL)
# 1348|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def135]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1347:7: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc((long unsigned int)blob_read_uint32(blob))’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1361:1: enter_function: entry to ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1373:45: call_function: inlined call to ‘hk_num_variants’ from ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1378:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1384:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: call_function: calling ‘hk_deserialize_shader’ from ‘hk_deserialize_api_shader’
# 1345|   
# 1346|      shader->data_ptr = malloc(data_size);
# 1347|->    if (shader->data_ptr == NULL)
# 1348|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);
# 1349|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def136]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:48:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘name’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:43:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:46:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:47:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:47:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:48:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:48:25: danger: ‘name + (sizetype)j’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   46|           for (int i = 0; i < strlen(xml_name); i++) {
#   47|                   if (xml_name[i] == ' ') {
#   48|->                         name[j++] = '_';
#   49|                   } else if (xml_name[i] == '(' || xml_name[i] == ')') {
#   50|                           /* skip */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def137]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:52:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘name’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:43:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:46:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:47:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:47:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:49:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:49:27: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:52:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:52:25: danger: ‘name + (sizetype)j’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#   50|                           /* skip */
#   51|                   } else {
#   52|->                         name[j++] = toupper(xml_name[i]);
#   53|                   }
#   54|           }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def138]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:55:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘name’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:43:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/clif/v3dx_dump.c:55:9: danger: ‘name + (sizetype)j’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#   53|                   }
#   54|           }
#   55|->         name[j++] = 0;
#   56|   
#   57|           return name;

Error: GCC_ANALYZER_WARNING (CWE-126): [#def139]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:162:52: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:2993:1: enter_function: entry to ‘v3d_qpu_schedule_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3037:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3038:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3042:27: call_function: calling ‘qpu_schedule_instructions_block’ from ‘v3d_qpu_schedule_instructions’
#  160|           switch (mux) {
#  161|           case V3D_QPU_MUX_A:
#  162|->                 add_read_dep(state, state->last_rf[n->inst->qpu.raddr_a], n);
#  163|                   break;
#  164|           case V3D_QPU_MUX_B:

Error: GCC_ANALYZER_WARNING (CWE-126): [#def140]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:165:22: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:2993:1: enter_function: entry to ‘v3d_qpu_schedule_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3037:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3038:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3042:27: call_function: calling ‘qpu_schedule_instructions_block’ from ‘v3d_qpu_schedule_instructions’
#  163|                   break;
#  164|           case V3D_QPU_MUX_B:
#  165|->                 if (!n->inst->qpu.sig.small_imm_b) {
#  166|                           add_read_dep(state,
#  167|                                        state->last_rf[n->inst->qpu.raddr_b], n);

Error: GCC_ANALYZER_WARNING (CWE-126): [#def141]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:313:23: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:2993:1: enter_function: entry to ‘v3d_qpu_schedule_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3037:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3038:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/qpu_schedule.c:3042:27: call_function: calling ‘qpu_schedule_instructions_block’ from ‘v3d_qpu_schedule_instructions’
#  311|   {
#  312|           const struct v3d_device_info *devinfo = state->devinfo;
#  313|->         struct qinst *qinst = n->inst;
#  314|           struct v3d_qpu_instr *inst = &qinst->qpu;
#  315|           /* If the input and output segments are shared, then all VPM reads to

Error: GCC_ANALYZER_WARNING (CWE-476): [#def142]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir.c:343:21: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir.c:2310:1: enter_function: entry to ‘vir_uniform’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir.c:2327:30: call_function: calling ‘vir_NOP’ from ‘vir_uniform’
#  341|           struct qinst *inst = calloc(1, sizeof(*inst));
#  342|   
#  343|->         inst->qpu = v3d_qpu_nop();
#  344|           inst->qpu.alu.add.op = op;
#  345|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def143]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:336:51: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned char *)((char *)&dst + offsetof(struct qpu_reg, magic))’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:468:1: enter_function: entry to ‘v3d_vir_to_qpu’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:475:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: call_function: calling ‘v3d_generate_code_block’ from ‘v3d_vir_to_qpu’
#  334|                                   bool use_rf;
#  335|                                   if (c->devinfo->has_accumulators) {
#  336|->                                         use_rf = !dst.magic ||
#  337|                                                    dst.index != V3D_QPU_WADDR_R5;
#  338|                                   } else {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def144]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:339:50: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned char *)((char *)&dst + offsetof(struct qpu_reg, magic))’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:468:1: enter_function: entry to ‘v3d_vir_to_qpu’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:475:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: call_function: calling ‘v3d_generate_code_block’ from ‘v3d_vir_to_qpu’
#  337|                                                    dst.index != V3D_QPU_WADDR_R5;
#  338|                                   } else {
#  339|->                                         use_rf = dst.magic || dst.index != 0;
#  340|                                   }
#  341|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def145]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:358:33: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘dst.index’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:468:1: enter_function: entry to ‘v3d_vir_to_qpu’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:475:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: call_function: calling ‘v3d_generate_code_block’ from ‘v3d_vir_to_qpu’
#  356|                                   assert(qinst->qpu.alu.mul.op == V3D_QPU_M_NOP);
#  357|   
#  358|->                                 qinst->qpu.sig_addr = dst.index;
#  359|                                   qinst->qpu.sig_magic = dst.magic;
#  360|                           } else if (qinst->qpu.alu.add.op != V3D_QPU_A_NOP) {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def146]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:376:33: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘dst.index’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:468:1: enter_function: entry to ‘v3d_vir_to_qpu’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:475:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: call_function: calling ‘v3d_generate_code_block’ from ‘v3d_vir_to_qpu’
#  374|                                   }
#  375|   
#  376|->                                 qinst->qpu.alu.add.waddr = dst.index;
#  377|                                   qinst->qpu.alu.add.magic_write = dst.magic;
#  378|                           } else {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def147]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:392:33: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘dst.index’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:468:1: enter_function: entry to ‘v3d_vir_to_qpu’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:475:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/vir_to_qpu.c:476:17: call_function: calling ‘v3d_generate_code_block’ from ‘v3d_vir_to_qpu’
#  390|                                   }
#  391|   
#  392|->                                 qinst->qpu.alu.mul.waddr = dst.index;
#  393|                                   qinst->qpu.alu.mul.magic_write = dst.magic;
#  394|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def148]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cl.h:105:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dvx_meta_common.c:1437:1: enter_function: entry to ‘v3d42_meta_fill_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dvx_meta_common.c:1450:11: branch_true: following ‘true’ branch (when ‘num_items != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dvx_meta_common.c:1452:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dvx_meta_common.c:1453:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dvx_meta_common.c:1457:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dvx_meta_common.c:1469:7: call_function: calling ‘v3d42_meta_emit_fill_buffer_rcl’ from ‘v3d42_meta_fill_buffer’
#  103|   cl_start(struct v3dv_cl *cl)
#  104|   {
#  105|->    return cl->next;
#  106|   }
#  107|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def149]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:1253:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4483:1: enter_function: entry to ‘v3dv_CmdBeginRenderingKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4496:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4498:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4499:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4502:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4514:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4525:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4554:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4555:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4555:4: call_function: calling ‘cmd_buffer_init_render_pass_attachment_state’ from ‘v3dv_CmdBeginRenderingKHR’
# 1251|   
# 1252|      if (clear_depth)
# 1253|->       attachment_state->clear_value.z = ds->depth;
# 1254|   
# 1255|      if (clear_stencil)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def150]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:1256:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4483:1: enter_function: entry to ‘v3dv_CmdBeginRenderingKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4496:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4498:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4499:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4502:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4514:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4525:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4554:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4555:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4555:4: call_function: calling ‘cmd_buffer_init_render_pass_attachment_state’ from ‘v3dv_CmdBeginRenderingKHR’
# 1254|   
# 1255|      if (clear_stencil)
# 1256|->       attachment_state->clear_value.s = ds->stencil;
# 1257|   
# 1258|      attachment_state->vk_clear_value.depthStencil = *ds;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def151]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:1258:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4483:1: enter_function: entry to ‘v3dv_CmdBeginRenderingKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4496:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4498:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4499:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4502:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4514:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4525:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4554:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4555:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:4555:4: call_function: calling ‘cmd_buffer_init_render_pass_attachment_state’ from ‘v3dv_CmdBeginRenderingKHR’
# 1256|         attachment_state->clear_value.s = ds->stencil;
# 1257|   
# 1258|->    attachment_state->vk_clear_value.depthStencil = *ds;
# 1259|   }
# 1260|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def152]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1079:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘sampler’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1161:1: enter_function: entry to ‘v3dv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1168:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1169:64: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1191:28: branch_true: following ‘true’ branch (when ‘descriptor_count > j’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1192:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1221:13: call_function: calling ‘write_image_descriptor’ from ‘v3dv_UpdateDescriptorSets’
# 1077|   
# 1078|      assert(iview || sampler);
# 1079|->    uint8_t plane_count = iview ? iview->plane_count : sampler->plane_count;
# 1080|   
# 1081|      void *desc_map = descriptor_bo_map(device, set,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def153]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1265:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1161:1: enter_function: entry to ‘v3dv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1168:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1169:64: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1191:28: branch_true: following ‘true’ branch (when ‘descriptor_count > j’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1192:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1258:16: call_function: inlined call to ‘__vk_find_struct’ from ‘v3dv_UpdateDescriptorSets’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1258:16: call_function: inlined call to ‘__vk_find_struct’ from ‘v3dv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1265:45: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_descriptor_set.c:1265:45: danger: dereference of NULL ‘<unknown>’
# 1263|                                               inline_write->pData,
# 1264|                                               writeset->dstArrayElement, /* offset */
# 1265|->                                             inline_write->dataSize);
# 1266|               break;
# 1267|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def154]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2155:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2199:1: enter_function: entry to ‘v3dv_AllocateMemory’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2219:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2222:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2223:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2226:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2228:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2232:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2238:4: branch_false: following ‘false’ branch (when ‘<unknown> == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2238:4: branch_true: following ‘true’ branch (when ‘ext’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2239:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2238:4: branch_false: following ‘false’ branch (when ‘ext’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2238:4: branch_true: following ‘true’ branch (when ‘<unknown> != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2271:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2271:7: branch_false: following ‘false’ branch (when ‘wsi_info’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2273:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2273:14: branch_false: following ‘false’ branch (when ‘fd_info’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2280:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2280:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2291:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2294:7: branch_false: following ‘false’ branch (when ‘result == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2299:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2300:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2313:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2313:7: branch_true: following ‘true’ branch (when ‘flags_info’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2314:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2313:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2315:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2316:7: call_function: inlined call to ‘device_add_device_address_bo’ from ‘v3dv_AllocateMemory’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2316:7: call_function: inlined call to ‘device_add_device_address_bo’ from ‘v3dv_AllocateMemory’
# 2153|                                     struct v3dv_bo *bo)
# 2154|   {
# 2155|->    util_dynarray_append(&device->device_address_bo_list,
# 2156|                           struct v3dv_bo *,
# 2157|                           bo);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def155]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2526:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2483:1: enter_function: entry to ‘bind_image_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2497:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2508:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2508:10: call_function: inlined call to ‘__vk_find_struct’ from ‘bind_image_memory’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2508:10: call_function: inlined call to ‘__vk_find_struct’ from ‘bind_image_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2526:46: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_device.c:2526:46: danger: dereference of NULL ‘<unknown>’
# 2524|          * So planeAspect should only refer to one plane.
# 2525|          */
# 2526|->       uint8_t plane = v3dv_plane_from_aspect(plane_mem_info->planeAspect);
# 2527|         assert(offset % image->planes[plane].alignment == 0);
# 2528|         image->planes[plane].mem = mem;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def156]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_image.c:450:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_image.c:690:1: enter_function: entry to ‘v3dv_GetDeviceImageSubresourceLayoutKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_image.c:699:22: call_function: calling ‘create_image’ from ‘v3dv_GetDeviceImageSubresourceLayoutKHR’
#  448|            }
#  449|         } else {
#  450|->          modifier = explicit_mod_info->drmFormatModifier;
#  451|         }
#  452|         assert(modifier == DRM_FORMAT_MOD_LINEAR ||

Error: GCC_ANALYZER_WARNING (CWE-476): [#def157]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:230:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘p’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:184:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:187:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:202:7: branch_false: following ‘false’ branch (when ‘subpass_attachment_count == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:213:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:213:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:216:36: release_memory: ‘p’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:217:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:218:44: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:225:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:226:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:229:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:230:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:230:39: release_memory: ‘p’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:230:13: danger: dereference of NULL ‘p + (long unsigned int)j * 8’
#  228|   
#  229|            for (uint32_t j = 0; j < desc->inputAttachmentCount; j++) {
#  230|->             subpass->input_attachments[j] = (struct v3dv_subpass_attachment) {
#  231|                  .attachment = desc->pInputAttachments[j].attachment,
#  232|                  .layout = desc->pInputAttachments[j].layout,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def158]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:242:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘p’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:184:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:187:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:202:7: branch_false: following ‘false’ branch (when ‘subpass_attachment_count == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:213:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:213:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:216:36: release_memory: ‘p’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:217:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:218:44: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:225:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:237:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:237:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:238:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:241:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:242:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:242:39: release_memory: ‘p’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pass.c:242:13: danger: dereference of NULL ‘p + (long unsigned int)j * 8’
#  240|   
#  241|            for (uint32_t j = 0; j < desc->colorAttachmentCount; j++) {
#  242|->             subpass->color_attachments[j] = (struct v3dv_subpass_attachment) {
#  243|                  .attachment = desc->pColorAttachments[j].attachment,
#  244|                  .layout = desc->pColorAttachments[j].layout,

Error: GCC_ANALYZER_WARNING (CWE-688): [#def159]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3456:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3409:1: enter_function: entry to ‘pipeline_collect_executable_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3422:41: branch_true: following ‘true’ branch (when ‘s != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3424:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3425:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3429:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3456:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘pipeline_collect_executable_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3456:7: return_function: returning to ‘pipeline_collect_executable_data’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3456:7: danger: argument 1 (‘util_dynarray_grow_bytes(&*pipeline.executables.data, 1, 24)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 3454|            .qpu_str = qpu_str,
# 3455|         };
# 3456|->       util_dynarray_append(&pipeline->executables.data,
# 3457|                              struct v3dv_pipeline_executable_data, data);
# 3458|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def160]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3459:1: warning[-Wanalyzer-malloc-leak]: leak of ‘util_dynarray_grow_bytes(&*pipeline.executables.data, 1, 24)’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3548:1: enter_function: entry to ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3556:4: call_function: calling ‘pipeline_collect_executable_data’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
# 3457|                              struct v3dv_pipeline_executable_data, data);
# 3458|      }
# 3459|-> }
# 3460|   
# 3461|   static const struct v3dv_pipeline_executable_data *

Error: GCC_ANALYZER_WARNING (CWE-476): [#def161]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3548:1: enter_function: entry to ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3562:7: call_function: inlined call to ‘pipeline_get_prog_data’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3566:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3571:7: branch_true: following ‘true’ branch (when ‘qpu_inst_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: call_function: calling ‘__vk_outarray_next’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: return_function: returning to ‘v3dv_GetPipelineExecutableStatisticsKHR’ from ‘__vk_outarray_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: danger: dereference of NULL ‘<unknown>’
# 3570|   
# 3571|      if (qpu_inst_count > 0) {
# 3572|->       vk_add_exec_statistic_u64(out, "Compile Strategy",
# 3573|                                   "Chosen compile strategy index",
# 3574|                                   prog_data->compile_strategy_idx);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def162]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3578:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3548:1: enter_function: entry to ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3562:7: call_function: inlined call to ‘pipeline_get_prog_data’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3566:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3571:7: branch_true: following ‘true’ branch (when ‘qpu_inst_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: call_function: calling ‘__vk_outarray_next’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: return_function: returning to ‘v3dv_GetPipelineExecutableStatisticsKHR’ from ‘__vk_outarray_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3578:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3578:26: danger: dereference of NULL ‘<unknown>’
# 3576|         struct videocore_vi_stats stats = {
# 3577|            .instrs = qpu_inst_count,
# 3578|->          .thread_count = prog_data->threads,
# 3579|            .spill_size = prog_data->spill_size,
# 3580|            .spills = prog_data->spill_size,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def163]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_private.h:2576:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘job’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:1993:1: enter_function: entry to ‘v3dv_job_clone_in_cmd_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:1998:7: call_function: inlined call to ‘v3dv_flag_oom’ from ‘v3dv_job_clone_in_cmd_buffer’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_cmd_buffer.c:1998:7: call_function: inlined call to ‘v3dv_flag_oom’ from ‘v3dv_job_clone_in_cmd_buffer’
# 2574|      } else {
# 2575|         assert(job);
# 2576|->       if (job->cmd_buffer)
# 2577|            job->cmd_buffer->state.oom = true;
# 2578|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def164]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:174:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  172|      for (int i = 0; i < n_syncs; i++) {
#  173|         syncs[i].handle =
#  174|->          vk_sync_as_drm_syncobj(sync_info->waits[i].sync)->syncobj;
#  175|      }
#  176|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def165]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:179:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  177|      for (int i = 0; i < wait_count; i++) {
#  178|         syncs[n_syncs++].handle =
#  179|->          vk_sync_as_drm_syncobj(waits[i].sync)->syncobj;
#  180|      }
#  181|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def166]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:331:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  329|            for (uint32_t i = 0; i < info->count; i++) {
#  330|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  331|->             syncs[i] = vk_sync_as_drm_syncobj(query->timestamp.sync)->syncobj;
#  332|            }
#  333|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def167]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:331:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  329|            for (uint32_t i = 0; i < info->count; i++) {
#  330|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  331|->             syncs[i] = vk_sync_as_drm_syncobj(query->timestamp.sync)->syncobj;
#  332|            }
#  333|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def168]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:525:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  523|   
#  524|         if (info->pool->query_type == VK_QUERY_TYPE_PERFORMANCE_QUERY_KHR) {
#  525|->          uint32_t syncobj = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  526|            err = drmSyncobjImportSyncFile(job->device->pdevice->render_fd,
#  527|                                           syncobj, fd);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def169]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:581:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo_handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  579|               malloc(sizeof(uint32_t) * submit.bo_handle_count);
#  580|   
#  581|->          bo_handles[0] = bo->handle;
#  582|            bo_handles[1] = info->pool->timestamp.bo->handle;
#  583|            submit.bo_handles = (uintptr_t)(void *)bo_handles;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def170]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:601:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘offsets’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  599|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  600|   
#  601|->             offsets[i] = query->timestamp.offset;
#  602|               syncs[i] = vk_sync_as_drm_syncobj(query->timestamp.sync)->syncobj;
#  603|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def171]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:602:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  600|   
#  601|               offsets[i] = query->timestamp.offset;
#  602|->             syncs[i] = vk_sync_as_drm_syncobj(query->timestamp.sync)->syncobj;
#  603|            }
#  604|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def172]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:602:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  600|   
#  601|               offsets[i] = query->timestamp.offset;
#  602|->             syncs[i] = vk_sync_as_drm_syncobj(query->timestamp.sync)->syncobj;
#  603|            }
#  604|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def173]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:651:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  649|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  650|   
#  651|->             syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  652|               kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
#  653|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def174]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:651:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  649|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  650|   
#  651|->             syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  652|               kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
#  653|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def175]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:652:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘kperfmon_ids’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  650|   
#  651|               syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  652|->             kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
#  653|   
#  654|               if (info->flags & VK_QUERY_RESULT_WAIT_BIT) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def176]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:976:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo_handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  974|      set_foreach(job->bos, entry) {
#  975|         struct v3dv_bo *bo = (struct v3dv_bo *)entry->key;
#  976|->       bo_handles[bo_idx++] = bo->handle;
#  977|      }
#  978|      assert(bo_idx == submit.bo_handle_count);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def177]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1128:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo_handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
# 1126|      set_foreach(job->bos, entry) {
# 1127|         struct v3dv_bo *bo = (struct v3dv_bo *)entry->key;
# 1128|->       bo_handles[bo_idx++] = bo->handle;
# 1129|      }
# 1130|      assert(bo_idx == submit->bo_handle_count);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def178]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_uniforms.c:274:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘*cmd_buffer.push_constants_resource.bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_uniforms.c:459:1: enter_function: entry to ‘v3dv_write_uniforms_wg_offsets’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_uniforms.c:490:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_uniforms.c:491:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_uniforms.c:543:10: call_function: calling ‘write_ubo_ssbo_uniforms’ from ‘v3dv_write_uniforms_wg_offsets’
#  272|         assert(resource->bo);
#  273|   
#  274|->       cl_aligned_u32(uniforms, resource->bo->offset +
#  275|                                  resource->offset +
#  276|                                  offset + dynamic_offset);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def179]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:37:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:65:11: branch_false: following ‘false’ branch (when ‘ch == -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:84:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:84:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:85:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: return_function: returning to ‘main’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(<unknown>, 1, 8)’
#   86|         bool option = arg[0] == '-';
#   87|   
#   88|->       util_dynarray_append(option ? &clang_args : &input_files, char *, arg);
#   89|      }
#   90|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def180]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(*infile, "rb")’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:37:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:65:11: branch_true: following ‘true’ branch (when ‘ch != -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:67:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:84:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:85:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: return_function: returning to ‘main’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:91:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: following ‘false’ branch (when ‘outfile’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:103:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:108:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: acquire_resource: opened here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:110:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:116:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: danger: ‘fopen(*infile, "rb")’ leaks here; was opened at [(26)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/25)
#  119|   
#  120|         char *map = ralloc_array_size(mem_ctx, 1, len + 1);
#  121|->       if (!map) {
#  122|            fprintf(stderr, "Failed to allocate");
#  123|            ralloc_free(mem_ctx);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def181]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(*infile, "rb")’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:37:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:65:11: branch_true: following ‘true’ branch (when ‘ch != -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:67:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:84:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:85:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: return_function: returning to ‘main’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:91:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: following ‘false’ branch (when ‘outfile’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:103:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:108:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:110:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:116:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: danger: ‘fopen(*infile, "rb")’ leaks here; was allocated at [(26)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/25)
#  119|   
#  120|         char *map = ralloc_array_size(mem_ctx, 1, len + 1);
#  121|->       if (!map) {
#  122|            fprintf(stderr, "Failed to allocate");
#  123|            ralloc_free(mem_ctx);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def182]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:760:44: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ub_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1248:1: enter_function: entry to ‘gl_nir_link_uniform_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1253:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1254:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1260:10: branch_false: following ‘false’ branch (when ‘linked’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: call_function: calling ‘link_linked_shader_uniform_blocks’ from ‘gl_nir_link_uniform_blocks’
#  758|   {
#  759|      if (glsl_type_is_array(type)) {
#  760|->       struct uniform_block_array_elements *child_array =
#  761|            glsl_type_is_array(glsl_get_array_element(type)) ? ub_array->array : NULL;
#  762|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def183]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:766:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ub_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1248:1: enter_function: entry to ‘gl_nir_link_uniform_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1253:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1254:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1260:10: branch_false: following ‘false’ branch (when ‘linked’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: call_function: calling ‘link_linked_shader_uniform_blocks’ from ‘gl_nir_link_uniform_blocks’
#  764|            resize_block_array(glsl_get_array_element(type), child_array);
#  765|         const struct glsl_type *new_type =
#  766|->          glsl_array_type(new_child_type, ub_array->num_array_elements, 0);
#  767|   
#  768|         return new_type;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def184]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:498:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ainfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1534:1: enter_function: entry to ‘gl_nir_link_uniforms’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1546:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1548:32: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1549:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1550:13: branch_false: following ‘false’ branch (when ‘sh’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1554:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1558:10: call_function: calling ‘add_var_use_shader’ from ‘gl_nir_link_uniforms’
#  496|         }
#  497|   
#  498|->       link_util_mark_array_elements_referenced(*derefs, num_derefs, array_depth,
#  499|                                                  ainfo->indices);
#  500|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def185]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:501:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1534:1: enter_function: entry to ‘gl_nir_link_uniforms’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1546:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1548:32: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1549:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1550:13: branch_false: following ‘false’ branch (when ‘sh’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1554:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1558:10: call_function: calling ‘add_var_use_shader’ from ‘gl_nir_link_uniforms’
#  499|                                                  ainfo->indices);
#  500|   
#  501|->       util_dynarray_append(ainfo->deref_list, nir_deref_instr *, deref);
#  502|      }
#  503|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def186]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1099:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1534:1: enter_function: entry to ‘gl_nir_link_uniforms’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1576:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1612:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1615:35: branch_true: following ‘true’ branch (when ‘shader_type != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1616:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1617:10: branch_false: following ‘false’ branch (when ‘sh’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1620:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1633:22: branch_false: following ‘false’ branch (when ‘fill_parameters == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1633:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1635:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1635:7: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1635:7: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘gl_nir_link_uniforms’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1635:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1636:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1680:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1681:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniforms.c:1692:13: call_function: calling ‘build_type_tree_for_type’ from ‘gl_nir_link_uniforms’
# 1097|      struct type_tree_entry *entry = malloc(sizeof *entry);
# 1098|   
# 1099|->    entry->array_size = 1;
# 1100|      entry->next_index = UINT_MAX;
# 1101|      entry->children = NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def187]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:2679:11: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shader_list’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3611:1: enter_function: entry to ‘gl_nir_link_glsl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3617:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3620:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:10: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_false: following ‘false’ branch (when ‘i == 6’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3637:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3638:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: call_function: calling ‘link_intrastage_shaders’ from ‘gl_nir_link_glsl’
# 2677|         _mesa_hash_table_create(mem_ctx, _mesa_hash_string, _mesa_key_string_equal);
# 2678|      for (unsigned i = 0; i < num_shaders; i++) {
# 2679|->       if (shader_list[i] == NULL)
# 2680|            continue;
# 2681|         cross_validate_globals(mem_ctx, &ctx->Const, prog, shader_list[i]->nir,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def188]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3380:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var2_written’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3611:1: enter_function: entry to ‘gl_nir_link_glsl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3617:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3620:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_false: following ‘false’ branch (when ‘i == 6’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3637:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3638:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: call_function: calling ‘link_intrastage_shaders’ from ‘gl_nir_link_glsl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: return_function: returning to ‘gl_nir_link_glsl’ from ‘link_intrastage_shaders’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3745:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3751:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:52: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3758:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3759:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3760:10: branch_true: following ‘true’ branch (when ‘sh’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3761:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3770:13: call_function: calling ‘validate_vertex_shader_executable’ from ‘gl_nir_link_glsl’
# 3378|                        *var1_written = true;
# 3379|                     else if (var == var2)
# 3380|->                      *var2_written = true;
# 3381|                     else if (var == var3)
# 3382|                        *var3_written = true;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def189]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3382:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var3_written’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3611:1: enter_function: entry to ‘gl_nir_link_glsl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3617:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3620:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3631:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3629:20: branch_false: following ‘false’ branch (when ‘i == 6’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3637:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3638:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: call_function: calling ‘link_intrastage_shaders’ from ‘gl_nir_link_glsl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3742:13: return_function: returning to ‘gl_nir_link_glsl’ from ‘link_intrastage_shaders’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3745:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3751:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3740:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3739:52: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3758:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3759:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3760:10: branch_true: following ‘true’ branch (when ‘sh’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3761:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_linker.c:3770:13: call_function: calling ‘validate_vertex_shader_executable’ from ‘gl_nir_link_glsl’
# 3380|                        *var2_written = true;
# 3381|                     else if (var == var3)
# 3382|->                      *var3_written = true;
# 3383|                  }
# 3384|               }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def190]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_atomics.c:121:37: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘d’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_atomics.c:155:1: enter_function: entry to ‘gl_nir_lower_atomics_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_atomics.c:162:11: call_function: calling ‘lower_deref_instr’ from ‘gl_nir_lower_atomics_instr’
#  119|   
#  120|      nir_def *offset = nir_imm_int(b, offset_value);
#  121|->    for (nir_deref_instr *d = deref; d->deref_type != nir_deref_type_var;
#  122|           d = nir_deref_instr_parent(d)) {
#  123|         assert(d->deref_type == nir_deref_type_array);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def191]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:157:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:363:1: enter_function: entry to ‘gl_nir_lower_named_interface_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:365:29: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:366:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:366:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:367:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:368:10: call_function: calling ‘lower_named_interface_blocks’ from ‘gl_nir_lower_named_interface_blocks’
#  155|      nir_variable *var = nir_deref_instr_get_variable(deref);
#  156|   
#  157|->    const struct glsl_type * iface_t = glsl_without_array(var->type);
#  158|      if (iface_t != var->interface_type)
#  159|         return false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def192]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_samplers_as_deref.c:128:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_samplers_as_deref.c:353:1: enter_function: entry to ‘gl_nir_lower_samplers_as_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_samplers_as_deref.c:363:20: call_function: calling ‘nir_shader_instructions_pass’ from ‘gl_nir_lower_samplers_as_deref’
#  126|      /* Structs have been lowered already, so get_aoa_size is sufficient. */
#  127|      const unsigned size =
#  128|->       glsl_type_is_array(var->type) ? glsl_get_aoa_size(var->type) : 1;
#  129|   
#  130|      BITSET_SET_RANGE(info->images_used, var->data.binding,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def193]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_samplers_as_deref.c:161:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_samplers_as_deref.c:353:1: enter_function: entry to ‘gl_nir_lower_samplers_as_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_samplers_as_deref.c:363:20: call_function: calling ‘nir_shader_instructions_pass’ from ‘gl_nir_lower_samplers_as_deref’
#  159|      assert(path.path[0]->deref_type == nir_deref_type_var);
#  160|   
#  161|->    char *name = ralloc_asprintf(state->remap_table, "lower@%s", var->name);
#  162|      unsigned location = var->data.location;
#  163|      const struct glsl_type *type = NULL;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def194]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:106:19: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘get_field_name(name + 1)’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:153:1: enter_function: entry to ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:156:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:156:30: return_function: returning to ‘gl_nir_lower_xfb_varying’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:158:20: call_function: calling ‘nir_before_impl’ from ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:158:20: return_function: returning to ‘gl_nir_lower_xfb_varying’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:162:9: call_function: calling ‘get_deref’ from ‘gl_nir_lower_xfb_varying’
#argument 1 of ‘__builtin_strlen’ must be non-null
#  104|         *deref = nir_build_deref_struct(b, *deref, idx);
#  105|         *type = glsl_get_struct_field(*type, idx);
#  106|->       name += 1 + strlen(field);
#  107|         free(field);
#  108|         return get_deref(b, name, NULL, deref, type);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def195]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:112:15: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘get_field_name(name)’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:153:1: enter_function: entry to ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:156:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:156:30: return_function: returning to ‘gl_nir_lower_xfb_varying’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:158:20: call_function: calling ‘nir_before_impl’ from ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:158:20: return_function: returning to ‘gl_nir_lower_xfb_varying’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:162:9: call_function: calling ‘get_deref’ from ‘gl_nir_lower_xfb_varying’
#argument 1 of ‘__builtin_strlen’ must be non-null
#  110|         /* Top level variable */
#  111|         char *field = get_field_name(name);
#  112|->       name += strlen(field);
#  113|         free(field);
#  114|         if (toplevel_var == NULL) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def196]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:99:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘consumer_info.texcoord_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:449:1: enter_function: entry to ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:459:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: call_function: calling ‘initialise_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: return_function: returning to ‘gl_nir_opt_dead_builtin_varyings’ from ‘initialise_varying_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:468:4: call_function: calling ‘initialise_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:468:4: return_function: returning to ‘gl_nir_opt_dead_builtin_varyings’ from ‘initialise_varying_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:470:7: branch_true: following ‘true’ branch (when ‘producer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:7: call_function: calling ‘get_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
#   97|      nir_variable *var = nir_deref_instr_get_variable(deref);
#   98|   
#   99|->    if (!glsl_type_is_array(var->type) || !is_gl_identifier(var->name))
#  100|         return;
#  101|   

Error: GCC_ANALYZER_WARNING (CWE-465): [#def197]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:1208:17: warning[-Wanalyzer-deref-before-check]: check of ‘node_b’ for NULL after already dereferencing it
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2252:1: enter_function: entry to ‘_macro_equal’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2262:11: call_function: calling ‘_token_list_equal_ignoring_space’ from ‘_macro_equal’
# 1206|         /* Ignore trailing whitespace */
# 1207|         if (node_a == NULL && node_b->token->type == SPACE) {
# 1208|->          while (node_b && node_b->token->type == SPACE)
# 1209|               node_b = node_b->next;
# 1210|         }

Error: GCC_ANALYZER_WARNING (CWE-465): [#def198]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:1216:17: warning[-Wanalyzer-deref-before-check]: check of ‘node_a’ for NULL after already dereferencing it
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2252:1: enter_function: entry to ‘_macro_equal’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2262:11: call_function: calling ‘_token_list_equal_ignoring_space’ from ‘_macro_equal’
# 1214|   
# 1215|         if (node_b == NULL && node_a->token->type == SPACE) {
# 1216|->          while (node_a && node_a->token->type == SPACE)
# 1217|               node_a = node_a->next;
# 1218|         }

Error: GCC_ANALYZER_WARNING (CWE-465): [#def199]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:1230:17: warning[-Wanalyzer-deref-before-check]: check of ‘node_a’ for NULL after already dereferencing it
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2561:1: enter_function: entry to ‘glcpp_parser_copy_defines’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2567:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2570:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2574:24: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2574:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2575:7: branch_true: following ‘true’ branch (when ‘previous’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2576:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-parse.y:2576:11: call_function: calling ‘_macro_equal’ from ‘glcpp_parser_copy_defines’
# 1228|          */
# 1229|         if (node_a->token->type == SPACE && node_b->token->type == SPACE) {
# 1230|->          while (node_a && node_a->token->type == SPACE)
# 1231|               node_a = node_a->next;
# 1232|            while (node_b && node_b->token->type == SPACE)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def200]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/list.h:145:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1187:1: enter_function: entry to ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: return_function: returning to ‘nir_opt_loop_unroll’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1194:19: call_function: calling ‘nir_opt_loop_unroll_impl’ from ‘nir_opt_loop_unroll’
#  143|   exec_node_get_prev(struct exec_node *n)
#  144|   {
#  145|->    return n->prev;
#  146|   }
#  147|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def201]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/list.h:145:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘cursor.<U  a0>.block’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1187:1: enter_function: entry to ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: return_function: returning to ‘nir_opt_loop_unroll’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1194:19: call_function: calling ‘nir_opt_loop_unroll_impl’ from ‘nir_opt_loop_unroll’
#  143|   exec_node_get_prev(struct exec_node *n)
#  144|   {
#  145|->    return n->prev;
#  146|   }
#  147|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def202]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/list.h:145:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1187:1: enter_function: entry to ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: return_function: returning to ‘nir_opt_loop_unroll’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1194:19: call_function: calling ‘nir_opt_loop_unroll_impl’ from ‘nir_opt_loop_unroll’
#  143|   exec_node_get_prev(struct exec_node *n)
#  144|   {
#  145|->    return n->prev;
#  146|   }
#  147|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def203]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/list.h:151:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_comparison_pre.c:372:1: enter_function: entry to ‘nir_opt_comparison_pre_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_comparison_pre.c:377:4: call_function: inlined call to ‘block_queue_init’ from ‘nir_opt_comparison_pre_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_comparison_pre.c:383:7: call_function: calling ‘comparison_pre_block’ from ‘nir_opt_comparison_pre_impl’
#  149|   exec_node_remove(struct exec_node *n)
#  150|   {
#  151|->    n->next->prev = n->prev;
#  152|      n->prev->next = n->next;
#  153|      n->next = NULL;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def204]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:541:33: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘field_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/isa/ir3-isa.c:15768:6: enter_function: entry to ‘ir3_isa_disasm’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/isa/ir3-isa.c:15770:5: call_function: calling ‘isa_disasm’ from ‘ir3_isa_disasm’
#argument 1 of ‘__builtin_strlen’ must be non-null
#  539|   	struct decode_state *state = scope->state;
#  540|   	struct isa_print_state *print = &state->print;
#  541|-> 	size_t field_name_len = strlen(field_name);
#  542|   	int num_align = 0;
#  543|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def205]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:841:33: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘field_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:874:1: enter_function: entry to ‘decode_bitset’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:881:12: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:888:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:889:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:889:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:890:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:895:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:896:25: call_function: calling ‘decode_field’ from ‘decode_bitset’
#argument 1 of ‘__builtin_strlen’ must be non-null
#  839|   {
#  840|   	const struct isa_bitset *bitset = scope->bitset;
#  841|-> 	size_t field_name_len = strlen(field_name);
#  842|   
#  843|   	/* alignment handling */

Error: GCC_ANALYZER_WARNING (CWE-688): [#def206]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:979:17: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*<unknown>.print.out’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:954:1: enter_function: entry to ‘isa_disasm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:969:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:971:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:976:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:978:17: call_function: calling ‘disasm’ from ‘isa_disasm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:978:17: return_function: returning to ‘isa_disasm’ from ‘disasm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/isaspec/isaspec_decode_impl.c:979:17: danger: argument 1 (‘*<unknown>.print.out’) from [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3) could be NULL where non-null expected
#  977|   		state->options = &default_options;   /* skip hooks for prepass */
#  978|   		disasm(state, bin, sz);
#  979|-> 		fclose(state->print.out);
#  980|   		if (options) {
#  981|   			state->options = options;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def207]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:2205:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘old_uses.next’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:2236:1: enter_function: entry to ‘nir_shader_lower_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:2243:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_shader_lower_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:2243:4: return_function: returning to ‘nir_shader_lower_instructions’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:2243:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:2244:11: call_function: calling ‘nir_function_impl_lower_instructions’ from ‘nir_shader_lower_instructions’
# 2203|               preserved = nir_metadata_none;
# 2204|   
# 2205|->          list_for_each_entry_safe(nir_src, use_src, &old_uses, use_link)
# 2206|               nir_src_rewrite(use_src, new_def);
# 2207|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def208]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3073:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3064:1: enter_function: entry to ‘nir_intrinsic_instr_src_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3071:32: call_function: inlined call to ‘nir_src_as_deref’ from ‘nir_intrinsic_instr_src_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3072:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3072:10: branch_true: following ‘true’ branch (when ‘src == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3073:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3073:17: danger: dereference of NULL ‘<unknown>’
# 3071|         nir_deref_instr *deref = nir_src_as_deref(intrin->src[0]);
# 3072|         if (src == 1)
# 3073|->          return nir_get_nir_type_for_glsl_type(deref->type);
# 3074|         break;
# 3075|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def209]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3112:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3104:1: enter_function: entry to ‘nir_intrinsic_instr_dest_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3111:32: call_function: inlined call to ‘nir_src_as_deref’ from ‘nir_intrinsic_instr_dest_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3112:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.c:3112:14: danger: dereference of NULL ‘<unknown>’
# 3110|      case nir_intrinsic_load_deref: {
# 3111|         nir_deref_instr *deref = nir_src_as_deref(intrin->src[0]);
# 3112|->       return nir_get_nir_type_for_glsl_type(deref->type);
# 3113|      }
# 3114|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def210]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1135:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘c’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:84:1: enter_function: entry to ‘nir_lower_ubo_vec4_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:91:27: call_function: inlined call to ‘nir_ushr_imm’ from ‘nir_lower_ubo_vec4_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:91:27: call_function: inlined call to ‘nir_ushr_imm’ from ‘nir_lower_ubo_vec4_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:121:7: branch_false: following ‘false’ branch (when ‘aligned_mul == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:126:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:126:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:133:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:131:10: call_function: calling ‘nir_iand_imm’ from ‘nir_lower_ubo_vec4_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:131:10: return_function: returning to ‘nir_lower_ubo_vec4_lower’ from ‘nir_iand_imm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_ubo_vec4.c:135:16: call_function: calling ‘nir_vector_extract’ from ‘nir_lower_ubo_vec4_lower’
# 1133|   nir_src_is_const(nir_src src)
# 1134|   {
# 1135|->    return src.ssa->parent_instr->type == nir_instr_type_load_const;
# 1136|   }
# 1137|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def211]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1665:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:318:1: enter_function: entry to ‘gl_nir_lower_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:323:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:323:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:323:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘gl_nir_lower_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:332:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘gl_nir_lower_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:332:4: return_function: returning to ‘gl_nir_lower_buffers’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:332:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:333:11: call_function: calling ‘lower_buffer_interface_derefs_impl’ from ‘gl_nir_lower_buffers’
# 1663|      assert(!(modes & ~nir_var_all));
# 1664|      assert(deref->modes != 0);
# 1665|->    return (deref->modes & modes) != 0;
# 1666|   }
# 1667|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def212]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1665:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:363:1: enter_function: entry to ‘gl_nir_lower_named_interface_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:365:29: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:366:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:366:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:367:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:368:10: call_function: calling ‘lower_named_interface_blocks’ from ‘gl_nir_lower_named_interface_blocks’
# 1663|      assert(!(modes & ~nir_var_all));
# 1664|      assert(deref->modes != 0);
# 1665|->    return (deref->modes & modes) != 0;
# 1666|   }
# 1667|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def213]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1681:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:147:1: enter_function: entry to ‘nir_lower_array_deref_of_vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:153:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_array_deref_of_vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:153:4: return_function: returning to ‘nir_lower_array_deref_of_vec’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:153:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:154:11: call_function: calling ‘nir_lower_array_deref_of_vec_impl’ from ‘nir_lower_array_deref_of_vec’
# 1679|      assert(!(modes & ~nir_var_all));
# 1680|      assert(deref->modes != 0);
# 1681|->    return !(deref->modes & ~modes);
# 1682|   }
# 1683|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def214]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1681:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:892:1: enter_function: entry to ‘nir_lower_vars_to_ssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:896:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_vars_to_ssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:896:4: return_function: returning to ‘nir_lower_vars_to_ssa’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:896:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:897:19: call_function: calling ‘nir_lower_vars_to_ssa_impl’ from ‘nir_lower_vars_to_ssa’
# 1679|      assert(!(modes & ~nir_var_all));
# 1680|      assert(deref->modes != 0);
# 1681|->    return !(deref->modes & ~modes);
# 1682|   }
# 1683|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def215]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1707:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:449:1: enter_function: entry to ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:459:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:470:7: branch_true: following ‘true’ branch (when ‘producer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:7: call_function: calling ‘get_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
# 1705|      }
# 1706|   
# 1707|->    return deref->modes == mode;
# 1708|   }
# 1709|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def216]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1707:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_constant_folding.c:430:1: enter_function: entry to ‘nir_opt_constant_folding’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_constant_folding.c:436:20: call_function: calling ‘nir_shader_instructions_pass’ from ‘nir_opt_constant_folding’
# 1705|      }
# 1706|   
# 1707|->    return deref->modes == mode;
# 1708|   }
# 1709|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def217]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1756:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘operand’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:408:1: enter_function: entry to ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: return_function: returning to ‘nir_opt_combine_stores’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:422:19: call_function: calling ‘combine_stores_impl’ from ‘nir_opt_combine_stores’
# 1754|   nir_deref_instr_parent(const nir_deref_instr *instr)
# 1755|   {
# 1756|->    if (instr->deref_type == nir_deref_type_var)
# 1757|         return NULL;
# 1758|      else

Error: GCC_ANALYZER_WARNING (CWE-476): [#def218]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1756:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src_head’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:386:1: enter_function: entry to ‘lower_load_to_scalar_early’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:401:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:402:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:421:43: call_function: inlined call to ‘nir_src_as_deref’ from ‘lower_load_to_scalar_early’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:421:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:421:15: call_function: calling ‘clone_deref_array’ from ‘lower_load_to_scalar_early’
# 1754|   nir_deref_instr_parent(const nir_deref_instr *instr)
# 1755|   {
# 1756|->    if (instr->deref_type == nir_deref_type_var)
# 1757|         return NULL;
# 1758|      else

Error: GCC_ANALYZER_WARNING (CWE-476): [#def219]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1765:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_draw_helpers.c:164:1: enter_function: entry to ‘lower_aaline_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_draw_helpers.c:175:24: call_function: calling ‘nir_intrinsic_get_var’ from ‘lower_aaline_instr’
# 1763|   nir_deref_instr_get_variable(const nir_deref_instr *instr)
# 1764|   {
# 1765|->    while (instr->deref_type != nir_deref_type_var) {
# 1766|         if (instr->deref_type == nir_deref_type_cast)
# 1767|            return NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def220]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:2774:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘indirect’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:312:1: enter_function: entry to ‘nir_lower_locals_to_regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:316:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_locals_to_regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:316:4: return_function: returning to ‘nir_lower_locals_to_regs’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:316:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:317:18: call_function: calling ‘impl’ from ‘nir_lower_locals_to_regs’
# 2772|   nir_scalar_is_const(nir_scalar s)
# 2773|   {
# 2774|->    return s.def->parent_instr->type == nir_instr_type_load_const;
# 2775|   }
# 2776|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def221]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:3732:4: warning[-Wanalyzer-malloc-leak]: leak of ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:3732:4: danger: ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’ leaks here; was allocated at [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3)
# 3730|   nir_foreach_function_with_impl_first(const nir_shader *shader)
# 3731|   {
# 3732|->    foreach_list_typed(nir_function, func, node, &shader->functions) {
# 3733|         if (func->impl != NULL)
# 3734|            return func;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def222]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:3803:25: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:1117:1: enter_function: entry to ‘vtn_handle_opencl_core_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:1122:7: call_function: calling ‘handle_instr’ from ‘vtn_handle_opencl_core_instruction’
# 3801|   {
# 3802|      nir_foreach_function(func, shader) {
# 3803|->       if (func->name && strcmp(func->name, name) == 0)
# 3804|            return func;
# 3805|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def223]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:4083:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘node’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:136:1: enter_function: entry to ‘gl_nir_lower_discard_flow’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:138:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gl_nir_lower_discard_flow’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:138:30: return_function: returning to ‘gl_nir_lower_discard_flow’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:147:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘gl_nir_lower_discard_flow’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:147:4: return_function: returning to ‘gl_nir_lower_discard_flow’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:147:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_discard_flow.c:148:23: call_function: calling ‘nir_before_impl’ from ‘gl_nir_lower_discard_flow’
# 4081|   nir_before_cf_node(nir_cf_node *node)
# 4082|   {
# 4083|->    if (node->type == nir_cf_node_block)
# 4084|         return nir_before_block(nir_cf_node_as_block(node));
# 4085|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def224]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:4092:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘node’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:483:1: enter_function: entry to ‘gl_nir_lower_blend_equation_advanced’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:489:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gl_nir_lower_blend_equation_advanced’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:489:30: return_function: returning to ‘gl_nir_lower_blend_equation_advanced’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:491:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:495:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:497:20: call_function: calling ‘nir_after_impl’ from ‘gl_nir_lower_blend_equation_advanced’
# 4090|   nir_after_cf_node(nir_cf_node *node)
# 4091|   {
# 4092|->    if (node->type == nir_cf_node_block)
# 4093|         return nir_after_block(nir_cf_node_as_block(node));
# 4094|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def225]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:6169:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1248:1: enter_function: entry to ‘gl_nir_link_uniform_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1253:24: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1254:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1260:10: branch_false: following ‘false’ branch (when ‘linked’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: call_function: calling ‘link_linked_shader_uniform_blocks’ from ‘gl_nir_link_uniform_blocks’
# 6167|   {
# 6168|      return (var->data.mode == nir_var_mem_ubo &&
# 6169|->            var->interface_type != NULL);
# 6170|   }
# 6171|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def226]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.c:95:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.c:627:1: enter_function: entry to ‘nir_gen_rect_vertices’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.c:651:21: call_function: calling ‘nir_ilt_imm’ from ‘nir_gen_rect_vertices’
#   93|      if (bit_size == 0) {
#   94|         for (unsigned i = 0; i < op_info->num_inputs; i++) {
#   95|->          unsigned src_bit_size = instr->src[i].src.ssa->bit_size;
#   96|            if (nir_alu_type_get_type_size(op_info->input_types[i]) == 0) {
#   97|               if (bit_size)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def227]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:57:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_packed_varyings.c:993:1: enter_function: entry to ‘gl_nir_lower_packed_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_packed_varyings.c:1004:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gl_nir_lower_packed_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_packed_varyings.c:1004:30: return_function: returning to ‘gl_nir_lower_packed_varyings’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_packed_varyings.c:1009:4: branch_false: following ‘false’ branch (when ‘f’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_packed_varyings.c:1013:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_packed_varyings.c:1013:14: call_function: calling ‘nir_builder_create’ from ‘gl_nir_lower_packed_varyings’
#   55|      b.exact = false;
#   56|      b.impl = impl;
#   57|->    b.shader = impl->function->shader;
#   58|      return b;
#   59|   }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def228]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:360:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘value’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1172:1: enter_function: entry to ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1174:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1177:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1178:7: branch_false: following ‘false’ branch (when ‘c’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1181:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1204:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1212:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1216:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1309:23: call_function: calling ‘nir_shader_get_entrypoint’ from ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1309:23: return_function: returning to ‘etna_compile_shader’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1313:23: call_function: calling ‘emit_shader’ from ‘etna_compile_shader’
#  358|         return NULL;
#  359|   
#  360|->    memcpy(load_const->value, value, sizeof(nir_const_value) * num_components);
#  361|   
#  362|      nir_builder_instr_insert(build, &load_const->instr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def229]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:692:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:803:1: enter_function: entry to ‘prog_to_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:812:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:814:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:833:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:836:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:837:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:837:7: call_function: calling ‘ptn_emit_instruction’ from ‘prog_to_nir’
#  690|   nir_mov_alu(nir_builder *build, nir_alu_src src, unsigned num_components)
#  691|   {
#  692|->    if (src.src.ssa->num_components == num_components) {
#  693|         bool any_swizzles = false;
#  694|         for (unsigned i = 0; i < num_components; i++) {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def230]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:726:11: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:606:1: enter_function: entry to ‘nir_opt_vectorize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:611:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_vectorize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:611:4: return_function: returning to ‘nir_opt_vectorize’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:611:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:612:19: call_function: calling ‘nir_opt_vectorize_impl’ from ‘nir_opt_vectorize’
#  724|      bool is_identity_swizzle = true;
#  725|      for (unsigned i = 0; i < num_components && i < NIR_MAX_VEC_COMPONENTS; i++) {
#  726|->       if (swiz[i] != i)
#  727|            is_identity_swizzle = false;
#  728|         alu_src.swizzle[i] = (uint8_t)swiz[i];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def231]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:731:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:517:1: enter_function: entry to ‘vk_texcompress_etc2_late_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:523:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:525:26: call_function: inlined call to ‘vk_device_to_handle’ from ‘vk_texcompress_etc2_late_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:527:16: call_function: calling ‘etc2_init_ds_layout’ from ‘vk_texcompress_etc2_late_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:527:16: return_function: returning to ‘vk_texcompress_etc2_late_init’ from ‘etc2_init_ds_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:528:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:531:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:532:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:537:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_etc2.c:537:16: call_function: calling ‘etc2_init_pipeline’ from ‘vk_texcompress_etc2_late_init’
#  729|      }
#  730|   
#  731|->    if (num_components == src->num_components && is_identity_swizzle)
#  732|         return src;
#  733|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def232]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:857:14: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:184:1: enter_function: entry to ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:188:4: branch_true: following ‘true’ branch (when ‘ext_opcode == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:189:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:199:7: call_function: calling ‘vtn_value’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:199:7: return_function: returning to ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’ from ‘vtn_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:207:33: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:208:27: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:207:33: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:213:15: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:215:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:226:7: branch_true: following ‘true’ branch (when ‘vec_array_deref != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:228:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:228:13: call_function: calling ‘nir_vector_extract’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
#  855|   {
#  856|      if (start == end - 1) {
#  857|->       return arr[start];
#  858|      } else {
#  859|         unsigned mid = start + (end - start) / 2;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def233]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:899:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:731:1: enter_function: entry to ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:739:20: call_function: inlined call to ‘nir_imm_int’ from ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:739:20: call_function: inlined call to ‘nir_imm_int’ from ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:741:4: branch_true: following ‘true’ branch (when ‘__dword != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:742:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:742:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:745:47: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:746:28: call_function: calling ‘nir_undef’ from ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:746:28: return_function: returning to ‘ms_emit_attribute_ring_output_stores’ from ‘nir_undef’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:748:28: branch_true: following ‘true’ branch (when ‘c != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:749:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:749:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:750:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:750:25: call_function: calling ‘nir_vector_insert_imm’ from ‘ms_emit_attribute_ring_output_stores’
#  897|      assert(c < vec->num_components);
#  898|   
#  899|->    nir_op vec_op = nir_op_vec(vec->num_components);
#  900|      nir_alu_instr *vec_instr = nir_alu_instr_create(b->shader, vec_op);
#  901|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def234]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:963:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘x’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:708:1: enter_function: entry to ‘summarize_repack’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:733:21: call_function: inlined call to ‘nir_imul_imm’ from ‘summarize_repack’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:733:21: call_function: inlined call to ‘nir_imul_imm’ from ‘summarize_repack’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:733:21: call_function: calling ‘nir_iadd_imm’ from ‘summarize_repack’
#  961|   {
#  962|      assert(x->bit_size <= 64);
#  963|->    y &= BITFIELD64_MASK(x->bit_size);
#  964|   
#  965|      if (y == 0) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def235]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1005:52: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘x’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:592:6: enter_function: entry to ‘si_nir_lower_resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:600:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘si_nir_lower_resource’
# 1003|   nir_isub_imm(nir_builder *build, uint64_t y, nir_def *x)
# 1004|   {
# 1005|->    return nir_isub(build, nir_imm_intN_t(build, y, x->bit_size), x);
# 1006|   }
# 1007|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def236]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1036:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘x’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:708:1: enter_function: entry to ‘summarize_repack’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:730:7: branch_true: following ‘true’ branch (when ‘mask_lane_id != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:731:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:731:17: call_function: calling ‘nir_iand_imm’ from ‘summarize_repack’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:731:17: return_function: returning to ‘summarize_repack’ from ‘nir_iand_imm’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:733:21: call_function: inlined call to ‘nir_imul_imm’ from ‘summarize_repack’
# 1034|   {
# 1035|      assert(x->bit_size <= 64);
# 1036|->    y &= BITFIELD64_MASK(x->bit_size);
# 1037|   
# 1038|      if (amul && build->shader->options)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def237]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1077:54: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘y’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:356:1: enter_function: entry to ‘vc4_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:358:9: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘vc4_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:358:9: return_function: returning to ‘vc4_nir_lower_io’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:358:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:359:17: call_function: calling ‘vc4_nir_lower_io_impl’ from ‘vc4_nir_lower_io’
# 1075|   nir_fsub_imm(nir_builder *build, double x, nir_def *y)
# 1076|   {
# 1077|->    return nir_fsub(build, nir_imm_floatN_t(build, x, y->bit_size), y);
# 1078|   }
# 1079|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def238]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1102:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘x’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:761:1: enter_function: entry to ‘nak_nir_lower_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:763:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’
# 1100|   {
# 1101|      assert(x->bit_size <= 64);
# 1102|->    y &= BITFIELD64_MASK(x->bit_size);
# 1103|   
# 1104|      if (y == 0) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def239]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1124:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘x’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_nir_apply_pipeline_layout.c:1519:1: enter_function: entry to ‘lower_direct_buffer_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_nir_apply_pipeline_layout.c:1530:14: call_function: calling ‘try_lower_direct_buffer_intrinsic’ from ‘lower_direct_buffer_instr’
# 1122|   {
# 1123|      assert(x->bit_size <= 64);
# 1124|->    y &= BITFIELD64_MASK(x->bit_size);
# 1125|   
# 1126|      if (y == 0) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def240]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1175:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘x’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:551:1: enter_function: entry to ‘lower_cmat_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:555:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:561:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:564:7: call_function: calling ‘lower_cmat_load_store’ from ‘lower_cmat_instr’
# 1173|   {
# 1174|      assert(x->bit_size <= 64);
# 1175|->    y &= BITFIELD64_MASK(x->bit_size);
# 1176|   
# 1177|      if (y == 1) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def241]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1269:69: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builtin_builder.c:163:1: enter_function: entry to ‘nir_atan’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builtin_builder.c:195:19: call_function: calling ‘nir_imm_floatN_t’ from ‘nir_atan’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builtin_builder.c:195:19: return_function: returning to ‘nir_atan’ from ‘nir_imm_floatN_t’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builtin_builder.c:197:25: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builtin_builder.c:198:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builtin_builder.c:198:13: call_function: calling ‘nir_ffma_imm2’ from ‘nir_atan’
# 1267|   nir_ffma_imm2(nir_builder *build, nir_def *src0, nir_def *src1, double src2)
# 1268|   {
# 1269|->    return nir_ffma(build, src0, src1, nir_imm_floatN_t(build, src2, src0->bit_size));
# 1270|   }
# 1271|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def242]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1422:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:380:1: enter_function: entry to ‘lower_vs_input_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:391:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:392:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:392:21: call_function: calling ‘lower_load_vs_input_from_prolog’ from ‘lower_vs_input_instr’
# 1420|            assert(src_idx < (int)num_srcs);
# 1421|            src_start_bit = src_end_bit;
# 1422|->          src_end_bit += srcs[src_idx]->bit_size *
# 1423|                           srcs[src_idx]->num_components;
# 1424|         }

Error: GCC_ANALYZER_WARNING (CWE-126): [#def243]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1422:25: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1349:1: enter_function: entry to ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1351:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1372:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1377:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1379:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1384:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1384:7: call_function: calling ‘nir_bitcast_vector’ from ‘vtn_handle_bitcast’
# 1420|            assert(src_idx < (int)num_srcs);
# 1421|            src_start_bit = src_end_bit;
# 1422|->          src_end_bit += srcs[src_idx]->bit_size *
# 1423|                           srcs[src_idx]->num_components;
# 1424|         }

Error: GCC_ANALYZER_WARNING (CWE-126): [#def244]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1428:37: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1349:1: enter_function: entry to ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1351:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1372:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1377:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1379:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1384:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1384:7: call_function: calling ‘nir_bitcast_vector’ from ‘vtn_handle_bitcast’
# 1426|         assert(bit + common_bit_size <= src_end_bit);
# 1427|         const unsigned rel_bit = bit - src_start_bit;
# 1428|->       const unsigned src_bit_size = srcs[src_idx]->bit_size;
# 1429|   
# 1430|         nir_def *comp = nir_channel(b, srcs[src_idx],

Error: GCC_ANALYZER_WARNING (CWE-127): [#def245]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1428:37: warning[-Wanalyzer-out-of-bounds]: stack-based buffer under-read
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:380:1: enter_function: entry to ‘lower_vs_input_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:391:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:392:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:392:21: call_function: calling ‘lower_load_vs_input_from_prolog’ from ‘lower_vs_input_instr’
# 1426|         assert(bit + common_bit_size <= src_end_bit);
# 1427|         const unsigned rel_bit = bit - src_start_bit;
# 1428|->       const unsigned src_bit_size = srcs[src_idx]->bit_size;
# 1429|   
# 1430|         nir_def *comp = nir_channel(b, srcs[src_idx],

Error: GCC_ANALYZER_WARNING (CWE-126): [#def246]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1432:11: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1349:1: enter_function: entry to ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1351:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1371:28: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_bitcast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1372:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1377:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1379:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1384:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:1384:7: call_function: calling ‘nir_bitcast_vector’ from ‘vtn_handle_bitcast’
# 1430|         nir_def *comp = nir_channel(b, srcs[src_idx],
# 1431|                                     rel_bit / src_bit_size);
# 1432|->       if (srcs[src_idx]->bit_size > common_bit_size) {
# 1433|            nir_def *unpacked = nir_unpack_bits(b, comp, common_bit_size);
# 1434|            comp = nir_channel(b, unpacked, (rel_bit % src_bit_size) / common_bit_size);

Error: GCC_ANALYZER_WARNING (CWE-127): [#def247]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1432:11: warning[-Wanalyzer-out-of-bounds]: stack-based buffer under-read
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:380:1: enter_function: entry to ‘lower_vs_input_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:391:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:392:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_vs_inputs.c:392:21: call_function: calling ‘lower_load_vs_input_from_prolog’ from ‘lower_vs_input_instr’
# 1430|         nir_def *comp = nir_channel(b, srcs[src_idx],
# 1431|                                     rel_bit / src_bit_size);
# 1432|->       if (srcs[src_idx]->bit_size > common_bit_size) {
# 1433|            nir_def *unpacked = nir_unpack_bits(b, comp, common_bit_size);
# 1434|            comp = nir_channel(b, unpacked, (rel_bit % src_bit_size) / common_bit_size);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def248]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1470:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:429:1: enter_function: entry to ‘st_translate_atifs_program’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:452:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:453:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:454:28: branch_true: following ‘true’ branch (when ‘r != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:455:45: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:456:10: call_function: calling ‘compile_setupinst’ from ‘st_translate_atifs_program’
# 1468|   {
# 1469|      assert(src->num_components >= num_components);
# 1470|->    if (src->num_components == num_components)
# 1471|         return src;
# 1472|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def249]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1470:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘store_val’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:731:1: enter_function: entry to ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:739:20: call_function: inlined call to ‘nir_imm_int’ from ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:739:20: call_function: inlined call to ‘nir_imm_int’ from ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:741:4: branch_true: following ‘true’ branch (when ‘__dword != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:742:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:742:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:745:47: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:746:28: call_function: calling ‘nir_undef’ from ‘ms_emit_attribute_ring_output_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:746:28: return_function: returning to ‘ms_emit_attribute_ring_output_stores’ from ‘nir_undef’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:748:28: branch_true: following ‘true’ branch (when ‘c != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:749:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:749:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:748:35: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ngg_mesh.c:755:19: call_function: inlined call to ‘nir_trim_vector’ from ‘ms_emit_attribute_ring_output_stores’
# 1468|   {
# 1469|      assert(src->num_components >= num_components);
# 1470|->    if (src->num_components == num_components)
# 1471|         return src;
# 1472|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def250]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1565:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:640:1: enter_function: entry to ‘v3d_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:651:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:652:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:652:17: call_function: calling ‘v3d_nir_setup_vpm_layout_vs’ from ‘v3d_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:652:17: return_function: returning to ‘v3d_nir_lower_io’ from ‘v3d_nir_setup_vpm_layout_vs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:656:9: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘v3d_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:656:9: return_function: returning to ‘v3d_nir_lower_io’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:656:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:659:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:662:17: call_function: inlined call to ‘nir_start_block’ from ‘v3d_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:662:17: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:663:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:663:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:663:25: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘v3d_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:663:25: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:663:25: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:664:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/compiler/v3d_nir_lower_io.c:664:33: call_function: calling ‘v3d_nir_lower_io_instr’ from ‘v3d_nir_lower_io’
# 1563|   
# 1564|      deref->modes = (nir_variable_mode)var->data.mode;
# 1565|->    deref->type = var->type;
# 1566|      deref->var = var;
# 1567|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def251]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1668:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘parent’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:153:1: enter_function: entry to ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:156:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:156:30: return_function: returning to ‘gl_nir_lower_xfb_varying’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:158:20: call_function: calling ‘nir_before_impl’ from ‘gl_nir_lower_xfb_varying’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:158:20: return_function: returning to ‘gl_nir_lower_xfb_varying’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:160:21: release_memory: ‘deref’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_xfb_varying.c:162:9: call_function: calling ‘get_deref’ from ‘gl_nir_lower_xfb_varying’
# 1666|         nir_deref_instr_create(build->shader, nir_deref_type_struct);
# 1667|   
# 1668|->    deref->modes = parent->modes;
# 1669|      deref->type = glsl_get_struct_field(parent->type, index);
# 1670|      deref->parent = nir_src_for_ssa(&parent->def);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def252]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1810:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_single_sampled.c:91:1: enter_function: entry to ‘nir_lower_single_sampled’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_single_sampled.c:96:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_single_sampled.c:96:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_single_sampled.c:96:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘nir_lower_single_sampled’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_single_sampled.c:117:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘nir_lower_single_sampled’
# 1808|                              enum gl_access_qualifier access)
# 1809|   {
# 1810|->    return nir_build_load_deref(build, glsl_get_vector_elements(deref->type),
# 1811|                                  glsl_get_bit_size(deref->type), &deref->def,
# 1812|                                  access);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def253]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1827:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:312:1: enter_function: entry to ‘calc_blend_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:341:4: call_function: inlined call to ‘swizzle_w’ from ‘calc_blend_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:341:4: call_function: inlined call to ‘swizzle_w’ from ‘calc_blend_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:345:4: call_function: calling ‘nir_imm_vec3’ from ‘calc_blend_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:345:4: return_function: returning to ‘calc_blend_result’ from ‘nir_imm_vec3’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_blend_equation_advanced.c:345:4: call_function: calling ‘nir_store_var’ from ‘calc_blend_result’
# 1825|                               enum gl_access_qualifier access)
# 1826|   {
# 1827|->    writemask &= (1u << value->num_components) - 1u;
# 1828|      nir_build_store_deref(build, &deref->def, value, writemask, access);
# 1829|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def254]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1985:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:32:1: enter_function: entry to ‘lower_printf_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:53:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:54:7: call_function: inlined call to ‘nir_imm_int’ from ‘lower_printf_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:54:7: call_function: inlined call to ‘nir_imm_int’ from ‘lower_printf_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:54:7: call_function: calling ‘nir_store_global’ from ‘lower_printf_intrin’
# 1983|      nir_intrinsic_instr *store =
# 1984|         nir_intrinsic_instr_create(build->shader, nir_intrinsic_store_global);
# 1985|->    store->num_components = value->num_components;
# 1986|      store->src[0] = nir_src_for_ssa(value);
# 1987|      store->src[1] = nir_src_for_ssa(addr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def255]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1276:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1541:1: enter_function: entry to ‘nir_opt_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: return_function: returning to ‘nir_opt_deref’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1546:11: call_function: calling ‘nir_opt_deref_impl’ from ‘nir_opt_deref’
# 1274|          * opt_deref_cast() above.
# 1275|          */
# 1276|->       if (parent->deref_type == nir_deref_type_cast &&
# 1277|             parent->cast.align_mul == 0 &&
# 1278|             nir_deref_cast_is_trivial(parent))

Error: GCC_ANALYZER_WARNING (CWE-476): [#def256]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1284:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1541:1: enter_function: entry to ‘nir_opt_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: return_function: returning to ‘nir_opt_deref’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1546:11: call_function: calling ‘nir_opt_deref_impl’ from ‘nir_opt_deref’
# 1282|      }
# 1283|   
# 1284|->    if (parent->deref_type != nir_deref_type_array &&
# 1285|          parent->deref_type != nir_deref_type_ptr_as_array)
# 1286|         return false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def257]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1304:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘cast’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1541:1: enter_function: entry to ‘nir_opt_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: return_function: returning to ‘nir_opt_deref’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1545:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_deref.c:1546:11: call_function: calling ‘nir_opt_deref_impl’ from ‘nir_opt_deref’
# 1302|                           bool is_write)
# 1303|   {
# 1304|->    if (cast->deref_type != nir_deref_type_cast)
# 1305|         return false;
# 1306|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def258]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:434:22: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1482:1: enter_function: entry to ‘nir_vertex_divergence_analysis’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1494:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_vertex_divergence_analysis’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1494:4: return_function: returning to ‘nir_vertex_divergence_analysis’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1494:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1497:7: call_function: calling ‘visit_cf_list’ from ‘nir_vertex_divergence_analysis’
#  432|         break;
#  433|      case nir_intrinsic_load_per_view_output:
#  434|->       is_divergent = instr->src[0].ssa->divergent ||
#  435|                        instr->src[1].ssa->divergent ||
#  436|                        (stage == MESA_SHADER_TESS_CTRL &&

Error: GCC_ANALYZER_WARNING (CWE-126): [#def259]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:435:22: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1482:1: enter_function: entry to ‘nir_vertex_divergence_analysis’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1494:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_vertex_divergence_analysis’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1494:4: return_function: returning to ‘nir_vertex_divergence_analysis’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1494:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_divergence_analysis.c:1497:7: call_function: calling ‘visit_cf_list’ from ‘nir_vertex_divergence_analysis’
#  433|      case nir_intrinsic_load_per_view_output:
#  434|         is_divergent = instr->src[0].ssa->divergent ||
#  435|->                      instr->src[1].ssa->divergent ||
#  436|                        (stage == MESA_SHADER_TESS_CTRL &&
#  437|                         !(options & nir_divergence_single_patch_per_tcs_subgroup));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def260]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:354:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:318:1: enter_function: entry to ‘nir_gather_xfb_info_from_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:320:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_gather_xfb_info_from_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:320:30: return_function: returning to ‘nir_gather_xfb_info_from_intrinsics’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:328:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:329:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:329:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:329:7: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:330:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:330:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:331:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:330:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:336:29: call_function: inlined call to ‘nir_intrinsic_write_mask’ from ‘nir_gather_xfb_info_from_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:338:17: branch_true: following ‘true’ branch (when ‘wr_mask != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:339:26: call_function: inlined call to ‘u_bit_scan’ from ‘nir_gather_xfb_info_from_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:354:16: call_function: calling ‘util_dynarray_grow_bytes’ from ‘nir_gather_xfb_info_from_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:354:16: return_function: returning to ‘nir_gather_xfb_info_from_intrinsics’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_gather_xfb_info.c:354:16: danger: dereference of NULL ‘util_dynarray_grow_bytes(&array, 1, 8)’
#  352|                  out.buffer = xfb.out[index % 2].buffer;
#  353|                  out.offset = (uint32_t)xfb.out[index % 2].offset * 4;
#  354|->                util_dynarray_append(&array, nir_xfb_output_info, out);
#  355|   
#  356|                  uint8_t stream = (sem.gs_streams >> (i * 2)) & 0x3;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def261]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_inline_helpers.h:61:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:70:4: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:152:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:153:29: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:155:10: call_function: calling ‘nir_foreach_src’ from ‘nir_opt_tex_skip_helpers’
#   59|   nir_foreach_src(nir_instr *instr, nir_foreach_src_cb cb, void *state)
#   60|   {
#   61|->    switch (instr->type) {
#   62|      case nir_instr_type_alu: {
#   63|         nir_alu_instr *alu = nir_instr_as_alu(instr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def262]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:993:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘in_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1081:1: enter_function: entry to ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1086:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1086:30: return_function: returning to ‘replace_duplicate_input’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1090:32: call_function: calling ‘nir_intrinsic_get_var’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1090:32: return_function: returning to ‘replace_duplicate_input’ from ‘nir_intrinsic_get_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1093:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1094:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1094:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1094:7: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1095:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1095:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1099:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1099:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1102:38: call_function: inlined call to ‘nir_src_as_deref’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1103:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1106:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1106:33: call_function: calling ‘nir_deref_instr_get_variable’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1106:33: return_function: returning to ‘replace_duplicate_input’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1108:15: call_function: calling ‘does_varying_match’ from ‘replace_duplicate_input’
#  991|      return in_var->data.location == out_var->data.location &&
#  992|             in_var->data.location_frac == out_var->data.location_frac &&
#  993|->           in_var->type == out_var->type;
#  994|   }
#  995|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def263]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:993:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘out_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1081:1: enter_function: entry to ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1086:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1086:30: return_function: returning to ‘replace_duplicate_input’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1090:32: call_function: calling ‘nir_intrinsic_get_var’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1090:32: return_function: returning to ‘replace_duplicate_input’ from ‘nir_intrinsic_get_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1093:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1094:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1094:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1094:7: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1095:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1095:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1099:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1099:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1102:38: call_function: inlined call to ‘nir_src_as_deref’ from ‘replace_duplicate_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1103:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1106:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1108:15: call_function: calling ‘does_varying_match’ from ‘replace_duplicate_input’
#  991|      return in_var->data.location == out_var->data.location &&
#  992|             in_var->data.location_frac == out_var->data.location_frac &&
#  993|->           in_var->type == out_var->type;
#  994|   }
#  995|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def264]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1013:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘out_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1372:1: enter_function: entry to ‘nir_link_opt_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1375:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1376:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1375:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1382:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1382:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_link_opt_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1382:30: return_function: returning to ‘nir_link_opt_varyings’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1390:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1390:4: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1391:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1391:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1396:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1396:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1399:36: call_function: inlined call to ‘nir_src_as_deref’ from ‘nir_link_opt_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1400:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1403:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1403:31: call_function: calling ‘nir_deref_instr_get_variable’ from ‘nir_link_opt_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1403:31: return_function: returning to ‘nir_link_opt_varyings’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1404:12: call_function: calling ‘can_replace_varying’ from ‘nir_link_opt_varyings’
# 1011|       * TODO: add support for these types.
# 1012|       */
# 1013|->    if (glsl_type_is_array(out_var->type) ||
# 1014|          glsl_type_is_dual_slot(out_var->type) ||
# 1015|          glsl_type_is_matrix(out_var->type) ||

Error: GCC_ANALYZER_WARNING (CWE-476): [#def265]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1175:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘uniform’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1236:1: enter_function: entry to ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1240:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1240:30: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1244:28: call_function: calling ‘nir_intrinsic_get_var’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1244:28: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_intrinsic_get_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1247:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1248:28: call_function: calling ‘nir_deref_instr_get_variable’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1248:28: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1249:14: call_function: calling ‘nir_clone_uniform_variable’ from ‘replace_varying_input_by_uniform_load’
# 1173|              v->data.binding == uniform->data.binding) ||
# 1174|             (!spirv &&
# 1175|->            (!strcmp(uniform->name, v->name) &&
# 1176|               uniform->data.explicit_binding == v->data.explicit_binding &&
# 1177|               uniform->data.binding == v->data.binding))) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def266]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1196:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1193:1: enter_function: entry to ‘nir_clone_deref_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1196:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1199:36: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘nir_clone_deref_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1200:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1200:30: call_function: calling ‘nir_clone_deref_instr’ from ‘nir_clone_deref_instr’
# 1194|                         nir_deref_instr *deref)
# 1195|   {
# 1196|->    if (deref->deref_type == nir_deref_type_var)
# 1197|         return nir_build_deref_var(b, var);
# 1198|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def267]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:67:35: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:147:1: enter_function: entry to ‘nir_lower_array_deref_of_vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:153:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_array_deref_of_vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:153:4: return_function: returning to ‘nir_lower_array_deref_of_vec’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:153:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_array_deref_of_vec.c:154:11: call_function: calling ‘nir_lower_array_deref_of_vec_impl’ from ‘nir_lower_array_deref_of_vec’
#   65|   
#   66|            nir_deref_instr *vec_deref = nir_deref_instr_parent(deref);
#   67|->          if (!glsl_type_is_vector(vec_deref->type))
#   68|               continue;
#   69|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def268]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_bitmap.c:107:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_bitmap.c:113:1: enter_function: entry to ‘nir_lower_bitmap’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_bitmap.c:119:4: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_lower_bitmap’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_bitmap.c:119:4: return_function: returning to ‘nir_lower_bitmap’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_bitmap.c:119:4: call_function: calling ‘lower_bitmap_impl’ from ‘nir_lower_bitmap’
#  105|      nir_builder b = nir_builder_at(nir_before_impl(impl));
#  106|   
#  107|->    lower_bitmap(impl->function->shader, &b, options);
#  108|   
#  109|      nir_progress(true, impl, nir_metadata_control_flow);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def269]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:79:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:92:1: enter_function: entry to ‘lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:110:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:112:13: branch_false: following ‘false’ branch (when ‘suffix’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:112:61: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:118:25: branch_true: following ‘true’ branch (when ‘i != 470’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:119:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:128:25: branch_true: following ‘true’ branch (when ‘i != 703’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:129:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:129:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:130:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:129:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:132:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_calls_to_builtins.c:132:10: call_function: calling ‘lower_builtin_intr’ from ‘lower’
#   77|         nir_deref_instr *deref = nir_src_as_deref(call->params[0]);
#   78|   
#   79|->       unsigned bit_size = glsl_get_bit_size(deref->type);
#   80|         unsigned num_components = MAX2(glsl_get_length(deref->type), 1);
#   81|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def270]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_cl_images.c:12:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_cl_images.c:52:1: enter_function: entry to ‘nir_dedup_inline_samplers_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_cl_images.c:65:28: call_function: calling ‘nir_deref_instr_get_variable’ from ‘nir_dedup_inline_samplers_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_cl_images.c:65:28: return_function: returning to ‘nir_dedup_inline_samplers_instr’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_cl_images.c:66:9: call_function: calling ‘var_is_inline_sampler’ from ‘nir_dedup_inline_samplers_instr’
#   10|         return false;
#   11|   
#   12|->    return glsl_type_is_sampler(var->type) &&
#   13|             var->data.sampler.is_inline_sampler;
#   14|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def271]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_double_ops.c:723:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘func’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_double_ops.c:797:1: enter_function: entry to ‘lower_doubles_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_double_ops.c:807:7: call_function: calling ‘lower_doubles_instr_to_soft’ from ‘lower_doubles_instr’
#  721|      }
#  722|   
#  723|->    nir_inline_function_impl(b, func->impl, params, NULL);
#  724|   
#  725|      return nir_load_deref(b, ret_deref);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def272]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_fragcolor.c:65:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_fragcolor.c:51:1: enter_function: entry to ‘lower_fragcolor_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_fragcolor.c:59:10: call_function: calling ‘nir_intrinsic_get_var’ from ‘lower_fragcolor_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_fragcolor.c:59:10: return_function: returning to ‘lower_fragcolor_intrin’ from ‘nir_intrinsic_get_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_fragcolor.c:60:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_fragcolor.c:65:16: danger: dereference of NULL ‘nir_intrinsic_get_var(instr, 0)’
#   63|   
#   64|      nir_def *frag_color = instr->src[1].ssa;
#   65|->    ralloc_free(out->name);
#   66|   
#   67|      const char *name = out->data.index == 0 ? "gl_FragData[0]" : "gl_SecondaryFragDataEXT[0]";

Error: GCC_ANALYZER_WARNING (CWE-476): [#def273]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:704:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prev_level’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:842:1: enter_function: entry to ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:854:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:855:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: call_function: calling ‘inside_outside’ from ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: return_function: returning to ‘nir_structurize’ from ‘inside_outside’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:866:7: call_function: calling ‘organize_levels’ from ‘nir_structurize’
#  702|                                            entry->hash, entry->key)) {
#  703|               _mesa_set_remove(skip_targets, entry);
#  704|->             prev_level->skip_end = 1;
#  705|            }
#  706|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def274]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:736:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prev_level’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:842:1: enter_function: entry to ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:854:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:855:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: call_function: calling ‘inside_outside’ from ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: return_function: returning to ‘nir_structurize’ from ‘inside_outside’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:866:7: call_function: calling ‘organize_levels’ from ‘nir_structurize’
#  734|               _mesa_set_add_pre_hashed(skip_targets, entry->hash, entry->key);
#  735|               if (is_in_skip)
#  736|->                prev_level->skip_end = 1;
#  737|               curr_level->skip_start = 1;
#  738|            }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def275]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:755:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:842:1: enter_function: entry to ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:854:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:855:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: call_function: calling ‘inside_outside’ from ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: return_function: returning to ‘nir_structurize’ from ‘inside_outside’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:866:7: call_function: calling ‘organize_levels’ from ‘nir_structurize’
#  753|   
#  754|      if (skip_targets->entries)
#  755|->       list_last_entry(levels, struct strct_lvl, link)->skip_end = 1;
#  756|   
#  757|      /* Iterate throught all levels reverse and create all the paths and forks */

Error: GCC_ANALYZER_WARNING (CWE-121): [#def276]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:762:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:842:1: enter_function: entry to ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:854:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:855:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: call_function: calling ‘inside_outside’ from ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: return_function: returning to ‘nir_structurize’ from ‘inside_outside’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:866:7: call_function: calling ‘organize_levels’ from ‘nir_structurize’
#  760|      list_for_each_entry_rev(struct strct_lvl, level, levels, link) {
#  761|         bool need_var = !(is_domminated && level->link.prev == levels);
#  762|->       level->out_path = routing->regular;
#  763|         if (level->skip_end) {
#  764|            path_after_skip = routing->regular;

Error: GCC_ANALYZER_WARNING (CWE-126): [#def277]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:763:11: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:842:1: enter_function: entry to ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:854:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:855:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: call_function: calling ‘inside_outside’ from ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: return_function: returning to ‘nir_structurize’ from ‘inside_outside’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:866:7: call_function: calling ‘organize_levels’ from ‘nir_structurize’
#  761|         bool need_var = !(is_domminated && level->link.prev == levels);
#  762|         level->out_path = routing->regular;
#  763|->       if (level->skip_end) {
#  764|            path_after_skip = routing->regular;
#  765|         }

Error: GCC_ANALYZER_WARNING (CWE-126): [#def278]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:766:36: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:842:1: enter_function: entry to ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:854:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:855:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: call_function: calling ‘inside_outside’ from ‘nir_structurize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:860:7: return_function: returning to ‘nir_structurize’ from ‘inside_outside’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:866:7: call_function: calling ‘organize_levels’ from ‘nir_structurize’
#  764|            path_after_skip = routing->regular;
#  765|         }
#  766|->       routing->regular.reachable = level->blocks;
#  767|         routing->regular.fork = select_fork(routing->regular.reachable, impl,
#  768|                                             need_var, mem_ctx);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def279]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:846:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘block’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:914:1: enter_function: entry to ‘nir_lower_goto_ifs_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:916:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:920:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:929:4: call_function: calling ‘nir_after_impl’ from ‘nir_lower_goto_ifs_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:929:4: return_function: returning to ‘nir_lower_goto_ifs_impl’ from ‘nir_after_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:929:4: call_function: calling ‘nir_before_impl’ from ‘nir_lower_goto_ifs_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:929:4: return_function: returning to ‘nir_lower_goto_ifs_impl’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:935:20: call_function: calling ‘nir_before_impl’ from ‘nir_lower_goto_ifs_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:935:20: return_function: returning to ‘nir_lower_goto_ifs_impl’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:944:7: call_function: inlined call to ‘exec_list_get_head’ from ‘nir_lower_goto_ifs_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:947:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_goto_ifs.c:953:4: call_function: calling ‘nir_structurize’ from ‘nir_lower_goto_ifs_impl’
#  844|   {
#  845|      struct set *remaining = _mesa_pointer_set_create(mem_ctx);
#  846|->    for (int i = 0; i < block->num_dom_children; i++) {
#  847|         if (!_mesa_set_search(routing->brk.reachable, block->dom_children[i]))
#  848|            _mesa_set_add(remaining, block->dom_children[i]);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def280]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:479:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:446:1: enter_function: entry to ‘nir_lower_gs_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:461:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:468:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:476:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_lower_gs_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:476:30: return_function: returning to ‘nir_lower_gs_intrinsics’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_gs_intrinsics.c:479:9: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#  477|      assert(impl);
#  478|   
#  479|->    if (!a_block_needs_set_vertex_and_primitive_count(impl->end_block, per_stream))
#  480|         return false;
#  481|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def281]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:107:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:228:1: enter_function: entry to ‘nir_lower_indirect_var_derefs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_indirect_var_derefs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:232:4: return_function: returning to ‘nir_lower_indirect_var_derefs’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:233:18: call_function: calling ‘lower_indirects_impl’ from ‘nir_lower_indirect_var_derefs’
#  105|                      orig_instr->def.bit_size);
#  106|         nir_builder_instr_insert(b, &load->instr);
#  107|->       *dest = &load->def;
#  108|      } else {
#  109|         assert(orig_instr->intrinsic == nir_intrinsic_store_deref);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def282]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:145:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:228:1: enter_function: entry to ‘nir_lower_indirect_var_derefs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_indirect_var_derefs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:232:4: return_function: returning to ‘nir_lower_indirect_var_derefs’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_indirect_derefs.c:233:18: call_function: calling ‘lower_indirects_impl’ from ‘nir_lower_indirect_var_derefs’
#  143|            if (base->deref_type == nir_deref_type_array &&
#  144|                !nir_src_is_const(base->arr.index)) {
#  145|->             indirect_array_len *= glsl_get_length(parent->type);
#  146|               has_indirect = true;
#  147|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def283]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:93:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:184:1: enter_function: entry to ‘lower_input_attachments_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:201:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:203:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:203:17: call_function: calling ‘try_lower_input_load’ from ‘lower_input_attachments_instr’
#   91|      assert(glsl_type_is_image(deref->type));
#   92|   
#   93|->    enum glsl_sampler_dim image_dim = glsl_get_sampler_dim(deref->type);
#   94|      if (image_dim != GLSL_SAMPLER_DIM_SUBPASS &&
#   95|          image_dim != GLSL_SAMPLER_DIM_SUBPASS_MS)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def284]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:164:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:214:1: enter_function: entry to ‘nir_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_input_attachments.c:219:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nir_lower_input_attachments’
#  162|      nir_deref_instr *deref = nir_src_as_deref(tex->src[0].src);
#  163|   
#  164|->    if (glsl_get_sampler_dim(deref->type) != GLSL_SAMPLER_DIM_SUBPASS_MS)
#  165|         return false;
#  166|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def285]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:148:47: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3334:1: enter_function: entry to ‘nir_lower_io_passes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3336:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3340:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3387:4: call_function: calling ‘nir_lower_io’ from ‘nir_lower_io_passes’
#  146|   nir_is_arrayed_io(const nir_variable *var, gl_shader_stage stage)
#  147|   {
#  148|->    if (var->data.patch || !glsl_type_is_array(var->type))
#  149|         return false;
#  150|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def286]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:190:53: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3334:1: enter_function: entry to ‘nir_lower_io_passes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3336:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3340:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:3387:4: call_function: calling ‘nir_lower_io’ from ‘nir_lower_io_passes’
#  188|             state->options & nir_lower_io_lower_64bit_to_32_new &&
#  189|             var->data.mode == nir_var_shader_in &&
#  190|->           glsl_type_is_dual_slot(glsl_without_array(var->type));
#  191|   }
#  192|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def287]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:309:37: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:399:1: enter_function: entry to ‘nir_lower_io_arrays_to_elements’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:406:4: call_function: calling ‘create_indirects_mask’ from ‘nir_lower_io_arrays_to_elements’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:406:4: return_function: returning to ‘nir_lower_io_arrays_to_elements’ from ‘create_indirects_mask’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:407:4: call_function: calling ‘create_indirects_mask’ from ‘nir_lower_io_arrays_to_elements’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:407:4: return_function: returning to ‘nir_lower_io_arrays_to_elements’ from ‘create_indirects_mask’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_arrays_to_elements.c:409:4: call_function: calling ‘lower_io_arrays_to_elements’ from ‘nir_lower_io_arrays_to_elements’
#  307|               nir_variable_mode mode = var->data.mode;
#  308|   
#  309|->             const struct glsl_type *type = var->type;
#  310|               if (nir_is_arrayed_io(var, b.shader->info.stage)) {
#  311|                  assert(glsl_type_is_array(type));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def288]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:521:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:489:1: enter_function: entry to ‘nir_lower_io_to_scalar_early_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:493:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:498:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:498:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:501:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:509:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘nir_lower_io_to_scalar_early_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:510:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:513:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:513:24: call_function: calling ‘nir_deref_instr_get_variable’ from ‘nir_lower_io_to_scalar_early_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:513:24: return_function: returning to ‘nir_lower_io_to_scalar_early_instr’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:517:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:521:46: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io_to_scalar.c:521:46: danger: dereference of NULL ‘nir_deref_instr_get_variable(<unknown>)’
#  519|   
#  520|      /* TODO: add doubles support */
#  521|->    if (glsl_type_is_64bit(glsl_without_array(var->type)))
#  522|         return false;
#  523|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def289]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:119:40: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:312:1: enter_function: entry to ‘nir_lower_locals_to_regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:316:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_locals_to_regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:316:4: return_function: returning to ‘nir_lower_locals_to_regs’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:316:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_locals_to_regs.c:317:18: call_function: calling ‘impl’ from ‘nir_lower_locals_to_regs’
#  117|      for (nir_deref_instr *d = deref; d; d = nir_deref_instr_parent(d)) {
#  118|         if (d->deref_type == nir_deref_type_array)
#  119|->          array_size *= glsl_get_length(nir_deref_instr_parent(d)->type);
#  120|      }
#  121|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def290]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:150:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:187:1: enter_function: entry to ‘nir_lower_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:191:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:191:4: return_function: returning to ‘nir_lower_memcpy’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:191:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:192:11: call_function: calling ‘lower_memcpy_impl’ from ‘nir_lower_memcpy’
#  148|                */
#  149|               nir_deref_instr *copy_dst =
#  150|->                nir_build_deref_cast(&b, &dst->def, dst->modes,
#  151|                                       glsl_uint8_t_type(), 1);
#  152|               nir_deref_instr *copy_src =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def291]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:153:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:187:1: enter_function: entry to ‘nir_lower_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:191:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:191:4: return_function: returning to ‘nir_lower_memcpy’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:191:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memcpy.c:192:11: call_function: calling ‘lower_memcpy_impl’ from ‘nir_lower_memcpy’
#  151|                                       glsl_uint8_t_type(), 1);
#  152|               nir_deref_instr *copy_src =
#  153|->                nir_build_deref_cast(&b, &src->def, src->modes,
#  154|                                       glsl_uint8_t_type(), 1);
#  155|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def292]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:40:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:228:1: enter_function: entry to ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: return_function: returning to ‘nir_lower_memory_model’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch (when ‘cf_node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: call_function: calling ‘lower_make_visible’ from ‘nir_lower_memory_model’
#   38|      case nir_intrinsic_image_deref_load:
#   39|      case nir_intrinsic_image_deref_sparse_load:
#   40|->       *modes = nir_src_as_deref(intrin->src[0])->modes;
#   41|         *reads = true;
#   42|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def293]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:44:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:228:1: enter_function: entry to ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: return_function: returning to ‘nir_lower_memory_model’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch (when ‘cf_node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: call_function: calling ‘lower_make_visible’ from ‘nir_lower_memory_model’
#   42|         break;
#   43|      case nir_intrinsic_image_deref_store:
#   44|->       *modes = nir_src_as_deref(intrin->src[0])->modes;
#   45|         *writes = true;
#   46|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def294]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:49:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:228:1: enter_function: entry to ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: return_function: returning to ‘nir_lower_memory_model’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch (when ‘cf_node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: call_function: calling ‘lower_make_visible’ from ‘nir_lower_memory_model’
#   47|      case nir_intrinsic_image_deref_atomic:
#   48|      case nir_intrinsic_image_deref_atomic_swap:
#   49|->       *modes = nir_src_as_deref(intrin->src[0])->modes;
#   50|         *reads = true;
#   51|         *writes = true;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def295]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:82:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:228:1: enter_function: entry to ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: return_function: returning to ‘nir_lower_memory_model’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch (when ‘cf_node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: call_function: calling ‘lower_make_visible’ from ‘nir_lower_memory_model’
#   80|         break;
#   81|      case nir_intrinsic_load_deref:
#   82|->       *modes = nir_src_as_deref(intrin->src[0])->modes;
#   83|         *reads = true;
#   84|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def296]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:86:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:228:1: enter_function: entry to ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: return_function: returning to ‘nir_lower_memory_model’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch (when ‘cf_node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: call_function: calling ‘lower_make_visible’ from ‘nir_lower_memory_model’
#   84|         break;
#   85|      case nir_intrinsic_store_deref:
#   86|->       *modes = nir_src_as_deref(intrin->src[0])->modes;
#   87|         *writes = true;
#   88|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def297]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:91:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:228:1: enter_function: entry to ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_memory_model’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: return_function: returning to ‘nir_lower_memory_model’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:232:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:237:7: branch_true: following ‘true’ branch (when ‘cf_node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_memory_model.c:238:27: call_function: calling ‘lower_make_visible’ from ‘nir_lower_memory_model’
#   89|      case nir_intrinsic_deref_atomic:
#   90|      case nir_intrinsic_deref_atomic_swap:
#   91|->       *modes = nir_src_as_deref(intrin->src[0])->modes;
#   92|         *reads = true;
#   93|         *writes = true;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def298]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_non_uniform_access.c:203:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_non_uniform_access.c:504:1: enter_function: entry to ‘nir_lower_non_uniform_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_non_uniform_access.c:509:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_non_uniform_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_non_uniform_access.c:509:4: return_function: returning to ‘nir_lower_non_uniform_access’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_non_uniform_access.c:509:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_non_uniform_access.c:510:11: call_function: calling ‘nir_lower_non_uniform_access_impl’ from ‘nir_lower_non_uniform_access’
#  201|         src.srcs[i] = srcs[i];
#  202|   
#  203|->    util_dynarray_append(&data->srcs, struct nu_handle_src, src);
#  204|   }
#  205|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def299]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_passthrough_edgeflags.c:30:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_passthrough_edgeflags.c:56:1: enter_function: entry to ‘nir_lower_passthrough_edgeflags’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_passthrough_edgeflags.c:63:4: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_lower_passthrough_edgeflags’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_passthrough_edgeflags.c:63:4: return_function: returning to ‘nir_lower_passthrough_edgeflags’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_passthrough_edgeflags.c:63:4: call_function: calling ‘lower_impl’ from ‘nir_lower_passthrough_edgeflags’
#   28|   lower_impl(nir_function_impl *impl)
#   29|   {
#   30|->    nir_shader *shader = impl->function->shader;
#   31|      nir_builder b = nir_builder_at(nir_before_impl(impl));
#   32|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def300]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:77:30: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:142:1: enter_function: entry to ‘nir_lower_point_smooth’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:145:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_lower_point_smooth’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:145:30: return_function: returning to ‘nir_lower_point_smooth’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:149:22: branch_true: following ‘true’ branch (when ‘set_barycentrics != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:149:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:149:41: call_function: calling ‘find_any_used_barycentrics’ from ‘nir_lower_point_smooth’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:149:41: return_function: returning to ‘nir_lower_point_smooth’ from ‘find_any_used_barycentrics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_point_smooth.c:152:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘nir_lower_point_smooth’
#   75|         if ((var->data.location != FRAG_RESULT_COLOR &&
#   76|              var->data.location < FRAG_RESULT_DATA0) ||
#   77|->           glsl_get_base_type(var->type) != GLSL_TYPE_FLOAT)
#   78|            return false;
#   79|         out_src_idx = 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def301]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:95:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:32:1: enter_function: entry to ‘lower_printf_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:53:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:71:26: call_function: inlined call to ‘nir_intrinsic_fmt_idx’ from ‘lower_printf_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:83:28: call_function: inlined call to ‘nir_src_as_deref’ from ‘lower_printf_intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:91:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_printf.c:95:43: danger: dereference of NULL ‘<unknown>’
#   93|      /* Align the struct size to 4 */
#   94|      assert(glsl_type_is_struct_or_ifc(args->type));
#   95|->    int args_size = align(glsl_get_cl_size(args->type), 4);
#   96|      int fmt_str_id_size = 4;
#   97|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def302]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_readonly_images_to_tex.c:45:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_readonly_images_to_tex.c:251:1: enter_function: entry to ‘nir_lower_readonly_images_to_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_readonly_images_to_tex.c:254:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nir_lower_readonly_images_to_tex’
#   43|   replace_image_type_with_texture(nir_deref_instr *deref)
#   44|   {
#   45|->    const struct glsl_type *type = deref->type;
#   46|   
#   47|      /* If we've already chased up the deref chain this far from a different intrinsic, we're done */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def303]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1271:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1242:1: enter_function: entry to ‘lower_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1244:4: call_function: inlined call to ‘wrap_instrs’ from ‘lower_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1244:4: call_function: inlined call to ‘wrap_instrs’ from ‘lower_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1246:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lower_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1246:30: return_function: returning to ‘lower_resume’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1247:30: call_function: calling ‘find_resume_instr’ from ‘lower_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1247:30: return_function: returning to ‘lower_resume’ from ‘find_resume_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1249:8: call_function: calling ‘duplicate_loop_bodies’ from ‘lower_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1249:8: return_function: returning to ‘lower_resume’ from ‘duplicate_loop_bodies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1249:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1264:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1271:32: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
# 1269|       * by the spilling pass and which we shouldn't delete.
# 1270|       */
# 1271|->    struct sized_bitset remat = bitset_create(mem_ctx, impl->ssa_alloc);
# 1272|   
# 1273|      /* Create a nop instruction to use as a cursor as we extract and re-insert

Error: GCC_ANALYZER_WARNING (CWE-688): [#def304]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1660:13: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1616:1: enter_function: entry to ‘nir_opt_sort_and_pack_stack’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1621:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_sort_and_pack_stack’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1621:30: return_function: returning to ‘nir_opt_sort_and_pack_stack’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1630:32: branch_true: following ‘true’ branch (when ‘call_idx < num_calls’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1631:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1635:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1636:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1636:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1636:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘nir_opt_sort_and_pack_stack’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1636:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1636:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1637:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1637:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1641:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1641:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1644:17: call_function: inlined call to ‘nir_intrinsic_call_idx’ from ‘nir_opt_sort_and_pack_stack’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1644:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1647:39: call_function: inlined call to ‘nir_intrinsic_value_id’ from ‘nir_opt_sort_and_pack_stack’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1660:13: call_function: calling ‘util_dynarray_grow_bytes’ from ‘nir_opt_sort_and_pack_stack’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1660:13: return_function: returning to ‘nir_opt_sort_and_pack_stack’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_shader_calls.c:1660:13: danger: argument 1 (‘util_dynarray_grow_bytes(&ops, 1, 24)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1658|               };
# 1659|   
# 1660|->             util_dynarray_append(&ops, struct scratch_item, item);
# 1661|               _mesa_hash_table_u64_insert(value_id_to_item, value_id, (void *)(uintptr_t) true);
# 1662|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def305]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_texcoord_replace.c:110:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_texcoord_replace.c:131:1: enter_function: entry to ‘nir_lower_texcoord_replace’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_texcoord_replace.c:137:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_texcoord_replace’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_texcoord_replace.c:137:4: return_function: returning to ‘nir_lower_texcoord_replace’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_texcoord_replace.c:137:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_texcoord_replace.c:138:7: call_function: calling ‘nir_lower_texcoord_replace_impl’ from ‘nir_lower_texcoord_replace’
#  108|   
#  109|            b.cursor = nir_after_instr(instr);
#  110|->          uint32_t component_mask = BITFIELD_MASK(glsl_get_vector_elements(var->type)) << var->data.location_frac;
#  111|            nir_deref_instr *deref = nir_src_as_deref(intrin->src[0]);
#  112|            nir_def *index = get_io_index(&b, deref);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def306]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:148:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:892:1: enter_function: entry to ‘nir_lower_vars_to_ssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:896:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_lower_vars_to_ssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:896:4: return_function: returning to ‘nir_lower_vars_to_ssa’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:896:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_vars_to_ssa.c:897:19: call_function: calling ‘nir_lower_vars_to_ssa_impl’ from ‘nir_lower_vars_to_ssa’
#  146|                        struct lower_variables_state *state)
#  147|   {
#  148|->    if (deref->deref_type == nir_deref_type_var)
#  149|         return get_deref_node_for_var(deref->var, state);
#  150|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def307]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:98:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:285:1: enter_function: entry to ‘nir_opt_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: return_function: returning to ‘nir_opt_access’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:297:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:298:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:298:10: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:298:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:299:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:299:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:300:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:300:16: call_function: calling ‘gather_intrinsic’ from ‘nir_opt_access’
#   96|          * Therefore we have to group buffer samplers together with SSBO's.
#   97|          */
#   98|->       if (glsl_get_sampler_dim(glsl_without_array(var->type)) ==
#   99|             GLSL_SAMPLER_DIM_BUF) {
#  100|            state->buffers_read |= read;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def308]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:256:50: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:285:1: enter_function: entry to ‘nir_opt_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: return_function: returning to ‘nir_opt_access’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:298:10: branch_false: following ‘false’ branch (when ‘instr’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:297:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:297:7: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: call_function: calling ‘nir_foreach_function_with_impl_next’ from ‘nir_opt_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: return_function: returning to ‘nir_opt_access’ from ‘nir_foreach_function_with_impl_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:296:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:306:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:313:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:313:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:316:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:316:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_access’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:316:4: return_function: returning to ‘nir_opt_access’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:316:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_access.c:317:19: call_function: calling ‘opt_access_impl’ from ‘nir_opt_access’
#  254|   
#  255|         bool is_buffer =
#  256|->          glsl_get_sampler_dim(glsl_without_array(var->type)) == GLSL_SAMPLER_DIM_BUF;
#  257|   
#  258|         return update_access(state, instr, is_buffer, false);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def309]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:226:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:408:1: enter_function: entry to ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: return_function: returning to ‘nir_opt_combine_stores’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:422:19: call_function: calling ‘combine_stores_impl’ from ‘nir_opt_combine_stores’
#  224|         if (dst->deref_type != nir_deref_type_array ||
#  225|             !nir_src_is_const(dst->arr.index) ||
#  226|->           !glsl_type_is_vector(nir_deref_instr_parent(dst)->type)) {
#  227|            combine_stores_with_deref(state, dst);
#  228|            return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def310]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:234:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:408:1: enter_function: entry to ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: return_function: returning to ‘nir_opt_combine_stores’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:422:19: call_function: calling ‘combine_stores_impl’ from ‘nir_opt_combine_stores’
#  232|         vec_dst = nir_deref_instr_parent(dst);
#  233|   
#  234|->       if (index >= glsl_get_vector_elements(vec_dst->type)) {
#  235|            /* Storing to an invalid index is a no-op. */
#  236|            nir_instr_remove(&intrin->instr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def311]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:204:72: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1521:1: enter_function: entry to ‘nir_opt_copy_prop_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1525:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_copy_prop_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1525:4: return_function: returning to ‘nir_opt_copy_prop_vars’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1525:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1526:19: call_function: calling ‘nir_copy_prop_vars_impl’ from ‘nir_opt_copy_prop_vars’
#  202|                  nir_src_as_deref(*nir_get_shader_call_payload_src(intrin));
#  203|   
#  204|->             nir_component_mask_t mask = (1 << glsl_get_vector_elements(payload->type)) - 1;
#  205|   
#  206|               struct hash_entry *ht_entry =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def312]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:239:145: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1521:1: enter_function: entry to ‘nir_opt_copy_prop_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1525:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_copy_prop_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1525:4: return_function: returning to ‘nir_opt_copy_prop_vars’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1525:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_copy_prop_vars.c:1526:19: call_function: calling ‘nir_copy_prop_vars_impl’ from ‘nir_opt_copy_prop_vars’
#  237|               nir_deref_instr *dst = nir_src_as_deref(intrin->src[0]);
#  238|   
#  239|->             uintptr_t mask = intrin->intrinsic == nir_intrinsic_store_deref ? nir_intrinsic_write_mask(intrin) : (1 << glsl_get_vector_elements(dst->type)) - 1;
#  240|   
#  241|               struct hash_entry *ht_entry = _mesa_hash_table_search(written->derefs, dst);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def313]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:106:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:278:1: enter_function: entry to ‘nir_opt_dead_write_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:283:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_dead_write_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:283:4: return_function: returning to ‘nir_opt_dead_write_vars’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:283:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:284:19: call_function: calling ‘remove_dead_write_vars_impl’ from ‘nir_opt_dead_write_vars’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  104|      };
#  105|   
#  106|->    util_dynarray_append(unused_writes, struct write_entry, new_entry);
#  107|   
#  108|      return progress;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def314]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:235:69: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:278:1: enter_function: entry to ‘nir_opt_dead_write_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:283:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_dead_write_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:283:4: return_function: returning to ‘nir_opt_dead_write_vars’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:283:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_dead_write_vars.c:284:19: call_function: calling ‘remove_dead_write_vars_impl’ from ‘nir_opt_dead_write_vars’
#  233|   
#  234|            clear_unused_for_read(&unused_writes, src);
#  235|->          nir_component_mask_t mask = (1 << glsl_get_vector_elements(dst->type)) - 1;
#  236|            progress |= update_unused_writes(&unused_writes, intrin, dst, mask);
#  237|            break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def315]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:118:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘parent’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:674:1: enter_function: entry to ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: return_function: returning to ‘nir_opt_find_array_copies’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:679:11: call_function: calling ‘opt_find_array_copies_impl’ from ‘nir_opt_find_array_copies’
#  116|   
#  117|      case nir_deref_type_array_wildcard:
#  118|->       idx = parent->num_children - 1;
#  119|         break;
#  120|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def316]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:126:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘parent’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:674:1: enter_function: entry to ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: return_function: returning to ‘nir_opt_find_array_copies’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:679:11: call_function: calling ‘opt_find_array_copies_impl’ from ‘nir_opt_find_array_copies’
#  124|            assert(idx < parent->num_children - 1);
#  125|         } else {
#  126|->          idx = parent->num_children - 1;
#  127|         }
#  128|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def317]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:403:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:674:1: enter_function: entry to ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: return_function: returning to ‘nir_opt_find_array_copies’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:679:11: call_function: calling ‘opt_find_array_copies_impl’ from ‘nir_opt_find_array_copies’
#  401|      if (nir_deref_instr_has_indirect(src) ||
#  402|          nir_deref_instr_is_known_out_of_bounds(src) ||
#  403|->        (src->deref_type == nir_deref_type_array &&
#  404|           glsl_type_is_vector(nir_src_as_deref(src->parent)->type)))
#  405|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def318]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:404:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:674:1: enter_function: entry to ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_find_array_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: return_function: returning to ‘nir_opt_find_array_copies’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:678:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_find_array_copies.c:679:11: call_function: calling ‘opt_find_array_copies_impl’ from ‘nir_opt_find_array_copies’
#  402|          nir_deref_instr_is_known_out_of_bounds(src) ||
#  403|          (src->deref_type == nir_deref_type_array &&
#  404|->         glsl_type_is_vector(nir_src_as_deref(src->parent)->type)))
#  405|         return;
#  406|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def319]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:47:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1438:1: enter_function: entry to ‘nir_opt_if’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1442:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_if’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1442:4: return_function: returning to ‘nir_opt_if’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1442:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1446:18: call_function: calling ‘opt_if_safe_cf_list’ from ‘nir_opt_if’
#   45|      assert(header_block->predecessors->entries == 2);
#   46|   
#   47|->    set_foreach(header_block->predecessors, pred_entry) {
#   48|         if (pred_entry->key != prev_block)
#   49|            return (nir_block *)pred_entry->key;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def320]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:384:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1438:1: enter_function: entry to ‘nir_opt_if’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1442:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_if’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1442:4: return_function: returning to ‘nir_opt_if’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1442:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_if.c:1446:18: call_function: calling ‘opt_if_safe_cf_list’ from ‘nir_opt_if’
#  382|       * last block in the loop back to the top.
#  383|       */
#  384|->    if (header_block->predecessors->entries != 2)
#  385|         return false;
#  386|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def321]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_licm.c:60:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_licm.c:126:1: enter_function: entry to ‘nir_opt_licm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_licm.c:130:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_licm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_licm.c:130:4: return_function: returning to ‘nir_opt_licm’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_licm.c:130:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_licm.c:134:28: call_function: calling ‘visit_cf_list’ from ‘nir_opt_licm’
#   58|   {
#   59|      /* Ignore loops without back-edge */
#   60|->    if (nir_loop_first_block(loop)->predecessors->entries == 1)
#   61|         return false;
#   62|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def322]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:633:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1187:1: enter_function: entry to ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: return_function: returning to ‘nir_opt_loop_unroll’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1194:19: call_function: calling ‘nir_opt_loop_unroll_impl’ from ‘nir_opt_loop_unroll’
#  631|          * access of the array.
#  632|          */
#  633|->       unsigned length = glsl_type_is_vector(parent->type) ? glsl_get_vector_elements(parent->type) : glsl_get_length(parent->type);
#  634|         return length <= trip_count;
#  635|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def323]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:145:38: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:281:1: enter_function: entry to ‘nir_opt_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:285:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:285:4: return_function: returning to ‘nir_opt_memcpy’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:285:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:286:11: call_function: calling ‘opt_memcpy_impl’ from ‘nir_opt_memcpy’
#  143|      }
#  144|   
#  145|->    if (glsl_type_is_vector_or_scalar(src->type) &&
#  146|          glsl_type_is_vector_or_scalar(dst->type) &&
#  147|          glsl_get_explicit_size(dst->type, false) == size &&

Error: GCC_ANALYZER_WARNING (CWE-476): [#def324]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:146:38: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:281:1: enter_function: entry to ‘nir_opt_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:285:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:285:4: return_function: returning to ‘nir_opt_memcpy’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:285:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_memcpy.c:286:11: call_function: calling ‘opt_memcpy_impl’ from ‘nir_opt_memcpy’
#  144|   
#  145|      if (glsl_type_is_vector_or_scalar(src->type) &&
#  146|->        glsl_type_is_vector_or_scalar(dst->type) &&
#  147|          glsl_get_explicit_size(dst->type, false) == size &&
#  148|          glsl_get_explicit_size(src->type, false) == size) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def325]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:100:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘__prev’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:136:1: enter_function: entry to ‘nir_opt_move’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:140:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_move’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:140:4: return_function: returning to ‘nir_opt_move’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:140:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:142:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:143:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_move.c:143:14: call_function: calling ‘nir_opt_move_block’ from ‘nir_opt_move’
#   98|         if (first_user) {
#   99|            /* Check predecessor instructions for the same index to keep the order */
#  100|->          while (nir_instr_prev(first_user)->index == first_user->index)
#  101|               first_user = nir_instr_prev(first_user);
#  102|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def326]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_peephole_select.c:112:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_peephole_select.c:573:1: enter_function: entry to ‘nir_opt_peephole_select’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_peephole_select.c:578:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_peephole_select’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_peephole_select.c:578:4: return_function: returning to ‘nir_opt_peephole_select’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_peephole_select.c:578:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_peephole_select.c:579:19: call_function: calling ‘nir_opt_peephole_select_impl’ from ‘nir_opt_peephole_select’
#  110|               nir_deref_instr *const deref = nir_src_as_deref(intrin->src[0]);
#  111|   
#  112|->             switch (deref->modes) {
#  113|               case nir_var_shader_in:
#  114|               case nir_var_uniform:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def327]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_preamble.c:755:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_preamble.c:747:1: enter_function: entry to ‘nir_opt_preamble’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_preamble.c:754:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_preamble’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_preamble.c:754:30: return_function: returning to ‘nir_opt_preamble’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_preamble.c:755:24: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#  753|   
#  754|      nir_function_impl *impl = nir_shader_get_entrypoint(shader);
#  755|->    ctx.states = calloc(impl->ssa_alloc, sizeof(*ctx.states));
#  756|   
#  757|      /* Step 1: Calculate can_move */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def328]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:229:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:215:1: enter_function: entry to ‘nir_opt_ray_query_ranges’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:220:30: call_function: inlined call to ‘exec_list_get_head_const’ from ‘nir_opt_ray_query_ranges’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:224:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:224:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:224:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:229:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_ray_queries.c:229:4: danger: dereference of NULL ‘<unknown>’
#  227|         ray_query_count++;
#  228|      }
#  229|->    nir_foreach_function_temp_variable(var, func->impl) {
#  230|         if (!var->data.ray_query || glsl_type_is_array(var->type))
#  231|            continue;

Error: COMPILER_WARNING: [#def329]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_shrink_vectors.c:137:18: note[note]: at offset [1, 15] into destination object ‘swizzle’ of size 16
#  135|            /* Reswizzle sources, which must be ALU since they have swizzle */
#  136|            assert(first_bit + comps <= NIR_MAX_VEC_COMPONENTS);
#  137|->          uint8_t swizzle[NIR_MAX_VEC_COMPONENTS] = { 0 };
#  138|            for (unsigned i = 0; i < comps; ++i) {
#  139|               swizzle[first_bit + i] = i;

Error: COMPILER_WARNING: [#def330]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_shrink_vectors.c:139:13: warning[-Wstringop-overflow=]: writing 16 bytes into a region of size 15
#  137|            uint8_t swizzle[NIR_MAX_VEC_COMPONENTS] = { 0 };
#  138|            for (unsigned i = 0; i < comps; ++i) {
#  139|->             swizzle[first_bit + i] = i;
#  140|            }
#  141|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def331]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:152:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:236:1: enter_function: entry to ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: return_function: returning to ‘nir_opt_sink’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:244:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: call_function: inlined call to ‘exec_node_is_head_sentinel’ from ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:247:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:247:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:250:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:253:16: call_function: calling ‘get_preferred_block’ from ‘nir_opt_sink’
#  150|         if (node->type == nir_cf_node_loop) {
#  151|            nir_loop *loop = nir_cf_node_as_loop(node);
#  152|->          if (nir_loop_first_block(loop)->predecessors->entries > 1)
#  153|               return loop;
#  154|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def332]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:166:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:236:1: enter_function: entry to ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: return_function: returning to ‘nir_opt_sink’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:244:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: call_function: inlined call to ‘exec_node_is_head_sentinel’ from ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:247:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:247:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:250:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:253:16: call_function: calling ‘get_preferred_block’ from ‘nir_opt_sink’
#  164|      nir_block *after = nir_cf_node_as_block(nir_cf_node_next(&loop->cf_node));
#  165|   
#  166|->    return block->index > before->index && block->index < after->index;
#  167|   }
#  168|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def333]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:166:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:236:1: enter_function: entry to ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: return_function: returning to ‘nir_opt_sink’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:240:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:244:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: call_function: inlined call to ‘exec_node_is_head_sentinel’ from ‘nir_opt_sink’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:245:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:247:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:247:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:250:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_sink.c:253:16: call_function: calling ‘get_preferred_block’ from ‘nir_opt_sink’
#  164|      nir_block *after = nir_cf_node_as_block(nir_cf_node_next(&loop->cf_node));
#  165|   
#  166|->    return block->index > before->index && block->index < after->index;
#  167|   }
#  168|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def334]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:38:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:70:4: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:158:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:159:29: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:178:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:181:15: call_function: inlined call to ‘def_needs_helpers’ from ‘nir_opt_tex_skip_helpers’
#   36|   {
#   37|      struct helper_state *hs = _data;
#   38|->    return BITSET_TEST(hs->needs_helpers, def->index);
#   39|   }
#   40|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def335]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:62:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:62:24: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#   60|   
#   61|      struct helper_state hs = {
#   62|->       .needs_helpers = rzalloc_array(NULL, BITSET_WORD,
#   63|                                        BITSET_WORDS(impl->ssa_alloc)),
#   64|         .worklist = nir_instr_worklist_create(),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def336]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:166:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:320:1: enter_function: entry to ‘nir_opt_uniform_atomics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:333:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_uniform_atomics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:333:4: return_function: returning to ‘nir_opt_uniform_atomics’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:333:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:336:28: call_function: calling ‘opt_uniform_atomics’ from ‘nir_opt_uniform_atomics’
#  164|            nir_block *first_then = nir_if_first_then_block(nir_cf_node_as_if(cf));
#  165|            nir_block *last_then = nir_if_last_then_block(nir_cf_node_as_if(cf));
#  166|->          bool within_then = instr->instr.block->index >= first_then->index;
#  167|            within_then = within_then && instr->instr.block->index <= last_then->index;
#  168|            if (!within_then)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def337]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:167:68: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:320:1: enter_function: entry to ‘nir_opt_uniform_atomics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:333:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_uniform_atomics’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:333:4: return_function: returning to ‘nir_opt_uniform_atomics’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:333:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_uniform_atomics.c:336:28: call_function: calling ‘opt_uniform_atomics’ from ‘nir_opt_uniform_atomics’
#  165|            nir_block *last_then = nir_if_last_then_block(nir_cf_node_as_if(cf));
#  166|            bool within_then = instr->instr.block->index >= first_then->index;
#  167|->          within_then = within_then && instr->instr.block->index <= last_then->index;
#  168|            if (!within_then)
#  169|               continue;

Error: GCC_ANALYZER_WARNING (CWE-674): [#def338]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:470:26: warning[-Wanalyzer-infinite-recursion]: infinite recursion
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:455:1: enter_function: entry to ‘nir_opt_vectorize_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:463:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:465:8: call_function: inlined call to ‘util_bitcount’ from ‘nir_opt_vectorize_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:463:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:470:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:470:26: call_function: calling ‘nir_opt_vectorize_io’ from ‘nir_opt_vectorize_io’
#  468|          * separately.
#  469|          */
#  470|->       bool progress_in = nir_opt_vectorize_io(shader, nir_var_shader_in);
#  471|         bool progress_out = nir_opt_vectorize_io(shader, nir_var_shader_out);
#  472|         return progress_in || progress_out;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def339]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:567:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:455:1: enter_function: entry to ‘nir_opt_vectorize_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:463:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:465:8: call_function: inlined call to ‘util_bitcount’ from ‘nir_opt_vectorize_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:463:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:470:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize_io.c:470:26: call_function: calling ‘nir_opt_vectorize_io’ from ‘nir_opt_vectorize_io’
#  565|               assert(value->bit_size == 16 || value->bit_size == 32);
#  566|   
#  567|->             util_dynarray_append(&io_instructions, void *, intr);
#  568|               if (is_output)
#  569|                  BITSET_SET(is_load ? has_output_loads : has_output_stores, index);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def340]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_precompiled.h:669:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fp’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:243:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:245:7: branch_false: following ‘false’ branch (when ‘argc == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:251:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:258:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:264:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:267:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:274:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:274:17: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:278:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
#argument 4 of ‘__builtin_fwrite’ must be non-null
#  667|      for (unsigned i = 0; i < 2; ++i) {
#  668|         FILE *fp = i ? fp_c : fp_h;
#  669|->       fprintf(fp, "/*\n");
#  670|         fprintf(fp, " * Copyright %s\n", copyright);
#  671|         fprintf(fp, " * SPDX-License-Identifier: MIT\n");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def341]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:85:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:61:1: enter_function: entry to ‘remove_tex_shadow’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:73:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:76:16: call_function: inlined call to ‘nir_tex_instr_src_index’ from ‘remove_tex_shadow’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:78:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:82:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:83:45: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:84:20: call_function: calling ‘nir_deref_instr_get_variable’ from ‘remove_tex_shadow’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:84:20: return_function: returning to ‘remove_tex_shadow’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_remove_tex_shadow.c:85:26: danger: dereference of NULL ‘nir_deref_instr_get_variable(*_31->src.ssa.parent_instr)’
#   83|            sampler_deref = nir_instr_as_deref(tex->src[sampler_src_index].src.ssa->parent_instr);
#   84|            sampler = nir_deref_instr_get_variable(sampler_deref);
#   85|->          sampler->type = strip_shadow_with_array(sampler->type);
#   86|            sampler_deref->type = sampler->type;
#   87|         } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def342]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:447:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘n’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1274:1: enter_function: entry to ‘nir_schedule’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1277:42: call_function: calling ‘nir_schedule_get_scoreboard’ from ‘nir_schedule’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1277:42: return_function: returning to ‘nir_schedule’ from ‘nir_schedule_get_scoreboard’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1285:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_schedule’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1285:4: return_function: returning to ‘nir_schedule’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1285:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1286:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1287:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_schedule.c:1287:10: call_function: calling ‘nir_schedule_block’ from ‘nir_schedule’
#  445|   nir_schedule_calculate_deps(nir_deps_state *state, nir_schedule_node *n)
#  446|   {
#  447|->    nir_instr *instr = n->instr;
#  448|   
#  449|      /* For NIR SSA defs, we only need to do a single pass of making the uses

Error: GCC_ANALYZER_WARNING (CWE-476): [#def343]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:143:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘new_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:263:1: enter_function: entry to ‘nir_split_64bit_vec3_and_vec4_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:277:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:278:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:278:20: call_function: calling ‘split_load_deref’ from ‘nir_split_64bit_vec3_and_vec4_impl’
#  141|      if (!entry) {
#  142|         new_var = (variable_pair *)calloc(1, sizeof(variable_pair));
#  143|->       new_var->xy = nir_variable_clone(old_var, b->shader);
#  144|         new_var->zw = nir_variable_clone(old_var, b->shader);
#  145|         new_var->xy->type = glsl_dvec_type(2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def344]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:172:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:263:1: enter_function: entry to ‘nir_split_64bit_vec3_and_vec4_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:277:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:278:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_64bit_vec3_and_vec4.c:278:20: call_function: calling ‘split_load_deref’ from ‘nir_split_64bit_vec3_and_vec4_impl’
#  170|      nir_variable *old_var = nir_intrinsic_get_var(intr, 0);
#  171|      unsigned old_components = glsl_get_components(
#  172|->       glsl_without_array_or_matrix(old_var->type));
#  173|   
#  174|      variable_pair *vars = get_var_pair(b, old_var, split_vars);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def345]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:103:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:156:1: enter_function: entry to ‘nir_split_per_member_structs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘nir_split_per_member_structs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘nir_split_per_member_structs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:164:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:164:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:167:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: branch_false: following ‘false’ branch (when ‘__next’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:163:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:172:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:172:7: branch_true: following ‘true’ branch (when ‘progress != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:177:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_per_member_structs.c:177:4: call_function: calling ‘nir_shader_instructions_pass’ from ‘nir_split_per_member_structs’
#  101|   build_member_deref(nir_builder *b, nir_deref_instr *deref, nir_variable *member)
#  102|   {
#  103|->    if (deref->deref_type == nir_deref_type_var) {
#  104|         return nir_build_deref_var(b, member);
#  105|      } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def346]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:40:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:33:1: enter_function: entry to ‘is_array_deref_of_vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:39:30: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘is_array_deref_of_vec’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:40:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:40:41: danger: dereference of NULL ‘<unknown>’
#   38|   
#   39|      nir_deref_instr *parent = nir_deref_instr_parent(deref);
#   40|->    return glsl_type_is_vector_or_scalar(parent->type);
#   41|   }
#   42|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def347]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:40:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘copy_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1684:1: enter_function: entry to ‘nir_shrink_vec_array_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1694:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_shrink_vec_array_vars’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1694:4: return_function: returning to ‘nir_shrink_vec_array_vars’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1694:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1699:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1701:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_split_vars.c:1701:10: call_function: calling ‘find_used_components_impl’ from ‘nir_shrink_vec_array_vars’
#   38|   
#   39|      nir_deref_instr *parent = nir_deref_instr_parent(deref);
#   40|->    return glsl_type_is_vector_or_scalar(parent->type);
#   41|   }
#   42|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def348]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:99:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:394:1: enter_function: entry to ‘nir_convert_to_lcssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:402:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_convert_to_lcssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:402:4: return_function: returning to ‘nir_convert_to_lcssa’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:402:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:406:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:406:7: branch_true: following ‘true’ branch (when ‘node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:407:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:407:10: call_function: calling ‘convert_to_lcssa’ from ‘nir_convert_to_lcssa’
#   97|         nir_cf_node_as_block(nir_cf_node_prev(&loop->cf_node));
#   98|   
#   99|->    return instr->block->index <= block_before_loop->index;
#  100|   }
#  101|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def349]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:342:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:394:1: enter_function: entry to ‘nir_convert_to_lcssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:402:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_convert_to_lcssa’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:402:4: return_function: returning to ‘nir_convert_to_lcssa’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:402:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:406:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:406:7: branch_true: following ‘true’ branch (when ‘node’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:407:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_to_lcssa.c:407:10: call_function: calling ‘convert_to_lcssa’ from ‘nir_convert_to_lcssa’
#  340|             * We don't consider this, but assume all not_invariant.
#  341|             */
#  342|->          if (nir_loop_first_block(loop)->predecessors->entries == 1)
#  343|               goto end;
#  344|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def350]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:69:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘_src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:664:1: enter_function: entry to ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:667:33: call_function: calling ‘vtn_untyped_value’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:667:33: return_function: returning to ‘vtn_handle_alu’ from ‘vtn_untyped_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:668:40: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:668:40: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:670:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:675:4: call_function: inlined call to ‘vtn_handle_no_contraction’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:690:36: call_function: calling ‘vtn_handle_matrix_alu’ from ‘vtn_handle_alu’
#   67|      struct vtn_ssa_value *src0 = wrap_matrix(b, _src0);
#   68|      struct vtn_ssa_value *src1 = wrap_matrix(b, _src1);
#   69|->    struct vtn_ssa_value *src0_transpose = wrap_matrix(b, _src0->transposed);
#   70|      struct vtn_ssa_value *src1_transpose = wrap_matrix(b, _src1->transposed);
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def351]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:74:52: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:664:1: enter_function: entry to ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:667:33: call_function: calling ‘vtn_untyped_value’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:667:33: return_function: returning to ‘vtn_handle_alu’ from ‘vtn_untyped_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:668:40: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:668:40: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:670:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:675:4: call_function: inlined call to ‘vtn_handle_no_contraction’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:690:36: call_function: calling ‘vtn_handle_matrix_alu’ from ‘vtn_handle_alu’
#   72|      unsigned src0_rows = glsl_get_vector_elements(src0->type);
#   73|      unsigned src0_columns = glsl_get_matrix_columns(src0->type);
#   74|->    unsigned src1_columns = glsl_get_matrix_columns(src1->type);
#   75|   
#   76|      const struct glsl_type *dest_type;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def352]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:688:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:664:1: enter_function: entry to ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:667:33: call_function: calling ‘vtn_untyped_value’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:667:33: return_function: returning to ‘vtn_handle_alu’ from ‘vtn_untyped_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:668:40: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:668:40: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:670:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:675:4: call_function: inlined call to ‘vtn_handle_no_contraction’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:682:25: branch_true: following ‘true’ branch (when ‘i < num_inputs’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:683:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:684:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:685:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:685:23: call_function: calling ‘vtn_mediump_downconvert_value’ from ‘vtn_handle_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:685:23: return_function: returning to ‘vtn_handle_alu’ from ‘vtn_mediump_downconvert_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:688:28: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_alu.c:688:28: danger: dereference of NULL ‘vtn_src[0]’
#  686|      }
#  687|   
#  688|->    if (glsl_type_is_matrix(vtn_src[0]->type) ||
#  689|          (num_inputs >= 2 && glsl_type_is_matrix(vtn_src[1]->type))) {
#  690|         struct vtn_ssa_value *dest = vtn_handle_matrix_alu(b, opcode, vtn_src[0], vtn_src[1]);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def353]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:208:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:184:1: enter_function: entry to ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:188:4: branch_true: following ‘true’ branch (when ‘ext_opcode == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:189:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:199:7: call_function: calling ‘vtn_value’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:199:7: return_function: returning to ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’ from ‘vtn_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:207:33: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:208:27: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:208:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:208:27: danger: dereference of NULL ‘<unknown>’
#  206|       */
#  207|      const bool vec_array_deref = deref->deref_type == nir_deref_type_array &&
#  208|->       glsl_type_is_vector(nir_deref_instr_parent(deref)->type);
#  209|   
#  210|      nir_deref_instr *vec_deref = NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def354]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:218:54: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:184:1: enter_function: entry to ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:188:4: branch_true: following ‘true’ branch (when ‘ext_opcode == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:189:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:199:7: call_function: calling ‘vtn_value’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:199:7: return_function: returning to ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’ from ‘vtn_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:207:33: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:208:27: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:207:33: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:213:15: call_function: inlined call to ‘nir_deref_instr_parent’ from ‘vtn_handle_amd_shader_explicit_vertex_parameter_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_amd.c:218:54: danger: dereference of NULL ‘deref’
#  216|      intrin->src[1] = nir_src_for_ssa(vtn_get_nir_ssa(b, w[6]));
#  217|   
#  218|->    intrin->num_components = glsl_get_vector_elements(deref->type);
#  219|      nir_def_init(&intrin->instr, &intrin->def,
#  220|                   glsl_get_vector_elements(deref->type),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def355]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:522:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:656:1: enter_function: entry to ‘vtn_emit_cf_func_unstructured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:664:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:667:7: call_function: inlined call to ‘list_del’ from ‘vtn_emit_cf_func_unstructured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:669:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:671:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:707:10: call_function: inlined call to ‘list_inithead’ from ‘vtn_emit_cf_func_unstructured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:708:10: call_function: calling ‘vtn_parse_switch’ from ‘vtn_emit_cf_func_unstructured’
#  520|            cse->is_default = true;
#  521|         } else {
#  522|->          util_dynarray_append(&cse->values, uint64_t, literal);
#  523|         }
#  524|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def356]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:714:17: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:762:1: enter_function: entry to ‘vtn_function_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:772:12: call_function: calling ‘nir_after_impl’ from ‘vtn_function_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:772:12: return_function: returning to ‘vtn_function_emit’ from ‘nir_after_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:772:12: call_function: calling ‘nir_builder_at’ from ‘vtn_function_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:772:12: return_function: returning to ‘vtn_function_emit’ from ‘nir_builder_at’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_cfg.c:779:7: call_function: calling ‘vtn_emit_cf_func_unstructured’ from ‘vtn_function_emit’
#  712|            struct vtn_case *def = NULL;
#  713|            vtn_foreach_case(cse, &cases) {
#  714|->             if (cse->is_default) {
#  715|                  assert(def == NULL);
#  716|                  def = cse;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def357]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:218:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘w_dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:924:1: enter_function: entry to ‘vtn_handle_opencl_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:1076:7: call_function: calling ‘handle_instr’ from ‘vtn_handle_opencl_instruction’
#  216|      nir_def *result = handler(b, opcode, num_srcs, srcs, src_types, dest_type);
#  217|      if (result) {
#  218|->       vtn_push_nir_ssa(b, w_dest[1], result);
#  219|      } else {
#  220|         vtn_assert(dest_type == NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def358]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:282:53: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:924:1: enter_function: entry to ‘vtn_handle_opencl_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:969:7: call_function: calling ‘handle_instr’ from ‘vtn_handle_opencl_instruction’
#  280|                                       srcs[0], srcs[1], srcs[2], NULL);
#  281|      if (opcode == OpenCLstd_Popcount)
#  282|->       ret = nir_u2uN(&b->nb, ret, glsl_get_bit_size(dest_type->type));
#  283|      return ret;
#  284|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def359]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:506:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:924:1: enter_function: entry to ‘vtn_handle_opencl_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_opencl.c:1076:7: call_function: calling ‘handle_instr’ from ‘vtn_handle_opencl_instruction’
#  504|         return nir_copysign(nb, srcs[0], srcs[1]);
#  505|      case OpenCLstd_Cross:
#  506|->       if (dest_type->length == 4)
#  507|            return nir_cross4(nb, srcs[0], srcs[1]);
#  508|         return nir_cross3(nb, srcs[0], srcs[1]);

Error: GCC_ANALYZER_WARNING (CWE-127): [#def360]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:494:11: warning[-Wanalyzer-out-of-bounds]: heap-based buffer under-read
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1527:1: enter_function: entry to ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1532:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1541:4: call_function: inlined call to ‘init_construct_stack’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1544:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1545:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1563:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1565:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1611:16: call_function: inlined call to ‘top_construct’ from ‘vtn_emit_cf_func_structured’
#  492|   {
#  493|      assert(count_construct_stack(stack) > 0);
#  494|->    return util_dynarray_top(&stack->data, struct vtn_construct *);
#  495|   }
#  496|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def361]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:507:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1527:1: enter_function: entry to ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1532:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1541:4: call_function: inlined call to ‘init_construct_stack’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
#  505|   push_construct(struct vtn_construct_stack *stack, struct vtn_construct *c)
#  506|   {
#  507|->    util_dynarray_append(&stack->data, struct vtn_construct *, c);
#  508|   }
#  509|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def362]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1435:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘b’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1527:1: enter_function: entry to ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1532:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1541:4: call_function: inlined call to ‘init_construct_stack’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1544:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1545:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1563:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1615:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1615:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1624:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1645:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1646:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1650:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1653:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1718:16: call_function: calling ‘vtn_switch_case_condition’ from ‘vtn_emit_cf_func_structured’
# 1433|         nir_def *any = nir_imm_false(&b->nb);
# 1434|   
# 1435|->       struct vtn_block *header = b->func->ordered_blocks[swtch->start_pos];
# 1436|   
# 1437|         for (unsigned j = 0; j < header->successors_count; j++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def363]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1600:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘b’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1527:1: enter_function: entry to ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1532:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1541:4: call_function: inlined call to ‘init_construct_stack’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1544:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1545:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1563:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1565:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1591:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1597:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1597:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1598:34: call_function: inlined call to ‘nir_loop_last_block’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1599:21: call_function: inlined call to ‘nir_block_ends_in_jump’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1600:34: danger: dereference of NULL ‘b’
# 1598|                  nir_block *last = nir_loop_last_block(top->nloop);
# 1599|                  if (!nir_block_ends_in_jump(last)) {
# 1600|->                   b->nb.cursor = nir_after_block(last);
# 1601|                     nir_jump(&b->nb, nir_jump_break);
# 1602|                  }

Error: GCC_ANALYZER_WARNING (CWE-416): [#def364]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1600:34: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘b’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1527:1: enter_function: entry to ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1532:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1541:4: call_function: inlined call to ‘init_construct_stack’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1542:4: call_function: inlined call to ‘push_construct’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1544:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1545:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1563:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1565:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1591:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1597:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1597:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1598:34: call_function: inlined call to ‘nir_loop_last_block’ from ‘vtn_emit_cf_func_structured’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_structured_cfg.c:1600:34: danger: use after ‘free’ of ‘b’; freed at [(22)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/21)
# 1598|                  nir_block *last = nir_loop_last_block(top->nloop);
# 1599|                  if (!nir_block_ends_in_jump(last)) {
# 1600|->                   b->nb.cursor = nir_after_block(last);
# 1601|                     nir_jump(&b->nb, nir_jump_break);
# 1602|                  }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def365]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:1763:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘interface_type’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2639:1: enter_function: entry to ‘vtn_handle_variables’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2651:35: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_variables’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2651:35: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_variables’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2670:31: call_function: calling ‘vtn_push_value’ from ‘vtn_handle_variables’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2670:31: return_function: returning to ‘vtn_handle_variables’ from ‘vtn_push_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2671:39: branch_false: following ‘false’ branch (when ‘count <= 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2673:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/spirv/vtn_variables.c:2673:7: call_function: calling ‘vtn_create_variable’ from ‘vtn_handle_variables’
# 1761|             */
# 1762|            assert(interface_type != NULL);
# 1763|->          if (interface_type->base_type == vtn_base_type_accel_struct) {
# 1764|               mode = vtn_variable_mode_accel_struct;
# 1765|               nir_mode = nir_var_uniform;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def366]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1477:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘old_dri2_dpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1395:1: enter_function: entry to ‘dri2_make_current’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1409:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1413:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1413:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1416:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1423:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1440:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1440:12: branch_false: following ‘false’ branch (when ‘dsurf’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1441:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1441:12: branch_false: following ‘false’ branch (when ‘rsurf’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1442:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1442:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1442:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1444:7: branch_true: following ‘true’ branch (when ‘cctx’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1445:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1445:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1455:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1469:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1471:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1471:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1472:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1472:17: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1475:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1475:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1476:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1476:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/egl_dri2.c:1477:17: danger: dereference of NULL ‘old_dri2_dpy’
# 1475|            if (driBindContext(cctx, ddraw, rdraw)) {
# 1476|               if (old_dsurf && _eglSurfaceInSharedBufferMode(old_dsurf) &&
# 1477|->                 old_dri2_dpy->vtbl->set_shared_buffer_mode) {
# 1478|                  old_dri2_dpy->vtbl->set_shared_buffer_mode(old_disp, old_dsurf,
# 1479|                                                             true);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def367]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:294:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("kms_swrast")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:276:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:279:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:282:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:289:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:289:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:289:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:289:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:290:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:294:31: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:294:7: danger: ‘strdup("kms_swrast")’ leaks here; was allocated at [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8)
#  292|         free(dri2_dpy->driver_name);
#  293|         _eglLog(_EGL_WARNING, "NEEDS EXTENSION: falling back to kms_swrast");
#  294|->       dri2_dpy->driver_name = strdup("kms_swrast");
#  295|      }
#  296|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def368]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:321:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup(<unknown>)’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:336:1: enter_function: entry to ‘dri2_initialize_device’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:345:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:348:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:348:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:349:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_device.c:349:12: call_function: calling ‘device_probe_device_sw’ from ‘dri2_initialize_device’
#  319|      dri2_dpy->fd_display_gpu = -1;
#  320|      dri2_dpy->driver_name = strdup(disp->Options.Zink ? "zink" : "swrast");
#  321|->    if (!dri2_dpy->driver_name)
#  322|         return false;
#  323|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def369]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:126:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘visual’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:113:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:119:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:119:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:124:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:126:31: danger: dereference of NULL ‘visual’
#  124|         util_format_description(gl_config->color_format);
#  125|      const struct util_format_description *fmt_s =
#  126|->       util_format_description(visual->pipe_format);
#  127|   
#  128|      if (util_is_format_compatible(fmt_c, fmt_s) ||

Error: GCC_ANALYZER_WARNING (CWE-401): [#def370]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:635:9: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup(*_64->gbm_dri.driver_name)’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:613:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:618:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:628:7: branch_false: following ‘false’ branch (when the strings are equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:633:35: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:633:28: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:635:9: danger: ‘strdup(*_64->gbm_dri.driver_name)’ leaks here; was allocated at [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  633|      dri2_dpy->driver_name = strdup(dri2_dpy->gbm_dri->driver_name);
#  634|   
#  635|->    if (!dri2_load_driver(disp)) {
#  636|         err = "DRI3: failed to load driver";
#  637|         goto cleanup;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def371]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:264:13: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("kms_swrast")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:235:11: branch_true: following ‘true’ branch (when ‘dev_list’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:236:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:236:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:239:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:246:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:249:52: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:250:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:253:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:256:10: branch_true: following ‘true’ branch (when ‘swrast != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:262:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:262:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:262:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:264:37: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:264:13: danger: ‘strdup("kms_swrast")’ leaks here; was allocated at [(13)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/12)
#  262|            if (driver_name && (strcmp(driver_name, "vgem") == 0 ||
#  263|                                strcmp(driver_name, "virtio_gpu") == 0))
#  264|->             dri2_dpy->driver_name = strdup("kms_swrast");
#  265|            free(driver_name);
#  266|         } else {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def372]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:336:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup(<unknown>)’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:335:28: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_surfaceless.c:336:7: danger: ‘strdup(<unknown>)’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  334|   
#  335|      dri2_dpy->driver_name = strdup(disp->Options.Zink ? "zink" : "swrast");
#  336|->    if (!dri2_dpy->driver_name)
#  337|         return false;
#  338|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def373]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:10: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("zink")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1769:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1772:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1772:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1775:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1775:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1780:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1782:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1784:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1784:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:10: danger: ‘strdup("zink")’ leaks here; was allocated at [(11)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/10)
# 1783|   #ifdef HAVE_WAYLAND_PLATFORM
# 1784|         if (dri2_dpy->kopper)
# 1785|->          dri2_dpy->device_name = strdup("zink");
# 1786|   #endif
# 1787|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def374]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("zink")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1974:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:31: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:7: danger: ‘strdup("zink")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 1973|       */
# 1974|      if (dri2_dpy->kopper)
# 1975|->       dri2_dpy->driver_name = strdup("zink");
# 1976|      else if (disp->Options.ForceSoftware)
# 1977|         dri2_dpy->driver_name = strdup("swrast");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def375]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("swrast")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1974:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1976:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1976:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:31: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:7: danger: ‘strdup("swrast")’ leaks here; was allocated at [(5)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/4)
# 1975|         dri2_dpy->driver_name = strdup("zink");
# 1976|      else if (disp->Options.ForceSoftware)
# 1977|->       dri2_dpy->driver_name = strdup("swrast");
# 1978|   
# 1979|      if (!dri2_get_xcb_connection(disp, dri2_dpy))

Error: GCC_ANALYZER_WARNING (CWE-476): [#def376]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1627:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1607:1: enter_function: entry to ‘_eglWaitClientCommon’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1613:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1616:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1616:11: call_function: calling ‘_eglLockDisplay’ from ‘_eglWaitClientCommon’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1616:11: return_function: returning to ‘_eglWaitClientCommon’ from ‘_eglLockDisplay’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1619:8: call_function: inlined call to ‘_eglGetContextHandle’ from ‘_eglWaitClientCommon’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1620:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1620:8: call_function: inlined call to ‘_eglGetSurfaceHandle’ from ‘_eglWaitClientCommon’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1626:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1626:4: call_function: calling ‘_egl_relax_begin’ from ‘_eglWaitClientCommon’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1626:4: return_function: returning to ‘_eglWaitClientCommon’ from ‘_egl_relax_begin’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1626:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1627:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1627:13: danger: dereference of NULL ‘_eglLockDisplay(*<unknown>.Resource.Display)’
# 1625|   
# 1626|      egl_relax (disp, &ctx->Resource) {
# 1627|->       ret = disp->Driver->WaitClient(disp, ctx);
# 1628|      }
# 1629|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def377]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1672:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1650:1: enter_function: entry to ‘eglWaitNative’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1656:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1659:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1661:11: call_function: calling ‘_eglLockDisplay’ from ‘eglWaitNative’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1661:11: return_function: returning to ‘eglWaitNative’ from ‘_eglLockDisplay’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1664:8: call_function: inlined call to ‘_eglGetContextHandle’ from ‘eglWaitNative’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1665:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1665:8: call_function: inlined call to ‘_eglGetSurfaceHandle’ from ‘eglWaitNative’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1671:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1671:4: call_function: calling ‘_egl_relax_begin’ from ‘eglWaitNative’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1671:4: return_function: returning to ‘eglWaitNative’ from ‘_egl_relax_begin’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1671:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1672:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/main/eglapi.c:1672:13: danger: dereference of NULL ‘_eglLockDisplay(*<unknown>.Resource.Display)’
# 1670|   
# 1671|      egl_relax (disp) {
# 1672|->       ret = disp->Driver->WaitNative(engine);
# 1673|      }
# 1674|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def378]
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:207:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bo_from_handle(dev,  size,  req.handle,  flags)’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:186:17: enter_function: entry to ‘etna_bo_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:196:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:199:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:202:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:205:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:206:14: call_function: calling ‘bo_from_handle’ from ‘etna_bo_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:206:14: return_function: returning to ‘etna_bo_new’ from ‘bo_from_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_bo.c:207:9: danger: dereference of NULL ‘bo_from_handle(dev,  size,  req.handle,  flags)’
#  205|   	simple_mtx_lock(&etna_device_lock);
#  206|   	bo = bo_from_handle(dev, size, req.handle, flags);
#  207|-> 	bo->reuse = 1;
#  208|   	simple_mtx_unlock(&etna_device_lock);
#  209|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def379]
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:78:23: warning[-Wanalyzer-malloc-leak]: leak of ‘dom’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:124:22: enter_function: entry to ‘etna_perfmon_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:130:12: branch_false: following ‘false’ branch (when ‘pm’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:135:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:139:15: call_function: calling ‘etna_perfmon_query_domains’ from ‘etna_perfmon_create’
#   76|   			break;
#   77|   
#   78|-> 		dom = calloc(1, sizeof(*dom));
#   79|   		if (!dom)
#   80|   			return -ENOMEM;

Error: GCC_ANALYZER_WARNING (CWE-126): [#def380]
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:107:9: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:124:22: enter_function: entry to ‘etna_perfmon_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:130:12: branch_false: following ‘false’ branch (when ‘pm’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:135:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:139:15: call_function: calling ‘etna_perfmon_query_domains’ from ‘etna_perfmon_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:139:15: return_function: returning to ‘etna_perfmon_create’ from ‘etna_perfmon_query_domains’
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:140:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:141:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/etnaviv/drm/etnaviv_perfmon.c:146:9: call_function: inlined call to ‘etna_perfmon_del’ from ‘etna_perfmon_create’
#  105|   	struct etna_perfmon_signal *sig, *next;
#  106|   
#  107|-> 	LIST_FOR_EACH_ENTRY_SAFE(sig, next, &dom->signals, head) {
#  108|   		list_del(&sig->head);
#  109|   		free(sig);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def381]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:35:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘heap’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:33:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:35:4: danger: ‘heap’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   33|      heap = calloc(1, sizeof(*heap));
#   34|   
#   35|->    heap->dev = dev;
#   36|      heap->flags = flags;
#   37|      simple_mtx_init(&heap->lock, mtx_plain);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def382]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:225:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:199:1: enter_function: entry to ‘fd_bo_heap_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:201:4: call_function: calling ‘heap_clean’ from ‘fd_bo_heap_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:201:4: return_function: returning to ‘fd_bo_heap_alloc’ from ‘heap_clean’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:218:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:223:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:223:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo_heap.c:225:4: danger: ‘s’ could be NULL: unchecked value from [(12)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/11)
#  223|      struct sa_bo *s = calloc(1, sizeof(*s));
#  224|   
#  225|->    s->heap = heap;
#  226|      s->offset = offset;
#  227|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def383]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_pipe.c:222:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘f’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_pipe.c:220:25: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_pipe.c:222:4: danger: ‘f’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  220|      struct fd_fence *f = calloc(1, sizeof(*f));
#  221|   
#  222|->    f->refcnt = 1;
#  223|      f->pipe = fd_pipe_ref(pipe);
#  224|      util_queue_fence_init(&f->ready);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def384]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_priv.h:66:7: warning[-Wanalyzer-malloc-leak]: leak of ‘*bo.fences’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo.c:783:1: enter_function: entry to ‘fd_bo_add_fence’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo.c:787:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo.c:811:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo.c:815:7: call_function: calling ‘grow’ from ‘fd_bo_add_fence’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo.c:815:7: return_function: returning to ‘fd_bo_add_fence’ from ‘grow’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_bo.c:818:4: call_function: calling ‘grow’ from ‘fd_bo_add_fence’
#   64|         else
#   65|            *max = *max * 2;
#   66|->       *ptr = realloc(*ptr, *max * sz);
#   67|      }
#   68|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def385]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_priv.h:68:1: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp_reloc.h:41:17: enter_function: entry to ‘fd_ringbuffer_sp_emit_reloc_ring_64’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp_reloc.h:57:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp_reloc.h:64:69: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp_reloc.h:64:7: call_function: calling ‘fd_ringbuffer_sp_emit_reloc_nonobj_64’ from ‘fd_ringbuffer_sp_emit_reloc_ring_64’
#   66|         *ptr = realloc(*ptr, *max * sz);
#   67|      }
#   68|-> }
#   69|   
#   70|   #define DECLARE_ARRAY(type, name)                                              \

Error: GCC_ANALYZER_WARNING (CWE-476): [#def386]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:761:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fd_ring’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:750:1: enter_function: entry to ‘fd_ringbuffer_sp_new_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:753:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:759:4: call_function: calling ‘simple_mtx_lock’ from ‘fd_ringbuffer_sp_new_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:759:4: return_function: returning to ‘fd_ringbuffer_sp_new_object’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:761:4: danger: ‘fd_ring’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  759|      simple_mtx_lock(&dev->suballoc_lock);
#  760|   
#  761|->    fd_ring->offset = align(dev->suballoc_offset, SUBALLOC_ALIGNMENT);
#  762|      if (!dev->suballoc_bo ||
#  763|          fd_ring->offset + size > fd_bo_size(dev->suballoc_bo)) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def387]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:780:11: warning[-Wanalyzer-malloc-leak]: leak of ‘fd_ring’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:750:1: enter_function: entry to ‘fd_ringbuffer_sp_new_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:753:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:780:11: call_function: calling ‘fd_ringbuffer_sp_init’ from ‘fd_ringbuffer_sp_new_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:780:11: return_function: returning to ‘fd_ringbuffer_sp_new_object’ from ‘fd_ringbuffer_sp_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/freedreno_ringbuffer_sp.c:780:11: danger: ‘fd_ring’ leaks here; was allocated at [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  778|      simple_mtx_unlock(&dev->suballoc_lock);
#  779|   
#  780|->    return fd_ringbuffer_sp_init(fd_ring, size, _FD_RINGBUFFER_OBJECT);
#  781|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def388]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_device.c:69:4: warning[-Wanalyzer-malloc-leak]: leak of ‘msm_dev’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_device.c:40:14: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_device.c:41:7: branch_false: following ‘false’ branch (when ‘msm_dev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_device.c:44:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_device.c:69:4: danger: ‘msm_dev’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   67|      }
#   68|   
#   69|->    dev->bo_size = sizeof(struct msm_bo);
#   70|   
#   71|      return dev;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def389]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:63:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:644:1: enter_function: entry to ‘msm_ringbuffer_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:664:20: call_function: calling ‘cmd_new’ from ‘msm_ringbuffer_init’
#   61|   {
#   62|      struct msm_cmd *cmd = malloc(sizeof(*cmd));
#   63|->    cmd->ring_bo = fd_bo_ref(ring_bo);
#   64|      cmd->size = 0;
#   65|      cmd->nr_relocs = cmd->max_relocs = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def390]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:675:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘msm_ring’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:672:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:675:4: danger: ‘msm_ring’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  673|   
#  674|      msm_ring->u.pipe = pipe;
#  675|->    msm_ring->offset = 0;
#  676|      msm_ring->ring_bo = fd_bo_new_ring(pipe->dev, size);
#  677|      msm_ring->base.refcnt = 1;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def391]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:685:11: warning[-Wanalyzer-malloc-leak]: leak of ‘msm_ring’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:672:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer.c:685:11: danger: ‘msm_ring’ leaks here; was allocated at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  683|         _mesa_set_create(NULL, _mesa_hash_pointer, _mesa_key_pointer_equal);
#  684|   
#  685|->    return msm_ringbuffer_init(msm_ring, size, _FD_RINGBUFFER_OBJECT);
#  686|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def392]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:120:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘submit_bos’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:95:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:99:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:99:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:109:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:113:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:116:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:116:20: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:119:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:120:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/drm/msm/msm_ringbuffer_sp.c:120:7: danger: ‘submit_bos + (long unsigned int)i * 16’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8)
#  118|   
#  119|      for (unsigned i = 0; i < fd_submit->nr_bos; i++) {
#  120|->       submit_bos[i].flags = fd_submit->bos[i]->reloc_flags;
#  121|         submit_bos[i].handle = fd_submit->bos[i]->handle;
#  122|         submit_bos[i].presumed = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def393]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1355:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1326:1: enter_function: entry to ‘ir3_valid_flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1340:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1346:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1346:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1353:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1353:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1354:40: call_function: inlined call to ‘ssa’ from ‘ir3_valid_flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1355:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.c:1355:14: danger: dereference of NULL ‘<unknown>’
# 1353|         if (instr->srcs[n]->flags & IR3_REG_SSA) {
# 1354|            struct ir3_instruction *src = ssa(instr->srcs[n]);
# 1355|->          if (src->address->def->instr->block != instr->block)
# 1356|               return false;
# 1357|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def394]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3.h:1059:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:496:1: enter_function: entry to ‘instr_cp’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:508:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:508:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:511:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:514:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:514:10: call_function: calling ‘instr_cp’ from ‘instr_cp’
# 1057|      struct ir3_register *dst;
# 1058|   
# 1059|->    switch (instr->opc) {
# 1060|      case OPC_MOV:
# 1061|         if (instr->cat1.src_type != instr->cat1.dst_type)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def395]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:578:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:496:1: enter_function: entry to ‘instr_cp’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:508:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:508:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:511:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:514:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_cp.c:514:10: call_function: calling ‘instr_cp’ from ‘instr_cp’
#  576|         assert(samp_tex->opc == OPC_META_COLLECT);
#  577|   
#  578|->       struct ir3_register *tex = samp_tex->srcs[0];
#  579|         struct ir3_register *samp = samp_tex->srcs[1];
#  580|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def396]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:682:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:676:1: enter_function: entry to ‘ir3_nir_opt_prefetch_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:680:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ir3_nir_opt_prefetch_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:680:30: return_function: returning to ‘ir3_nir_opt_prefetch_descriptors’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:682:34: danger: dereference of NULL ‘nir_shader_get_entrypoint(nir)’
#  680|      nir_function_impl *main = nir_shader_get_entrypoint(nir);
#  681|      struct set *instr_set = nir_instr_set_create(NULL);
#  682|->    nir_function_impl *preamble = main->preamble ? main->preamble->impl : NULL;
#  683|      nir_builder b;
#  684|      bool progress = false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def397]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:800:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:796:1: enter_function: entry to ‘ir3_nir_lower_preamble’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:798:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ir3_nir_lower_preamble’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:798:30: return_function: returning to ‘ir3_nir_lower_preamble’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_opt_preamble.c:800:9: danger: dereference of NULL ‘nir_shader_get_entrypoint(nir)’
#  798|      nir_function_impl *main = nir_shader_get_entrypoint(nir);
#  799|      
#  800|->    if (!main->preamble)
#  801|         return false;
#  802|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def398]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:246:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘stream’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:474:1: enter_function: entry to ‘ir3_shader_get_variant’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:481:35: call_function: calling ‘shader_variant’ from ‘ir3_shader_get_variant’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:481:35: return_function: returning to ‘ir3_shader_get_variant’ from ‘shader_variant’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:483:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:485:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shader.c:485:11: call_function: calling ‘create_variant’ from ‘ir3_shader_get_variant’
#  244|            FILE *stream = open_memstream(&stream_data, &stream_size);
#  245|   
#  246|->          fprintf(stream,
#  247|                    "Native code%s for unnamed %s shader %s with sha1 %s:\n",
#  248|                    shader_overridden ? " (overridden)" : "", ir3_shader_stage(v),

Error: GCC_ANALYZER_WARNING (CWE-457): [#def399]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:235:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*ctx.available[<unknown>]’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:1460:1: enter_function: entry to ‘ir3_ra_shared’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:1477:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:1478:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:1478:7: call_function: calling ‘handle_block’ from ‘ir3_ra_shared’
#  233|   {
#  234|      for (unsigned i = 0; i < RA_SHARED_SIZE; i++) {
#  235|->       BITSET_SET(ctx->available, i);
#  236|      }
#  237|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def400]
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:333:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:828:1: enter_function: entry to ‘ensure_src_live’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:836:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:841:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:841:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:842:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_shared_ra.c:842:10: call_function: calling ‘reload_src’ from ‘ensure_src_live’
#  331|             */
#  332|            unsigned cur_merge_set_offset = reg->merge_set_offset + i;
#  333|->          unsigned interval_offset = cur_physreg - interval->physreg_start;
#  334|            if (cur_merge_set_offset !=
#  335|                live_reg->merge_set_offset + interval_offset) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def401]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:1408:48: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:1414:1: enter_function: entry to ‘cso_single_sampler’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:1423:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:1428:11: call_function: inlined call to ‘cso_set_sampler’ from ‘cso_single_sampler’
# 1406|      struct cso_sampler *cso = set_sampler(ctx, shader_stage, idx, templ, size);
# 1407|      ctx->samplers[shader_stage].cso_samplers[idx] = cso;
# 1408|->    ctx->samplers[shader_stage].samplers[idx] = cso->data;
# 1409|      return true;
# 1410|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def402]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:119:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*hash.buckets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:155:1: enter_function: entry to ‘cso_data_has_shrunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:157:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:158:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:157:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:159:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_hash.c:160:7: call_function: calling ‘cso_data_rehash’ from ‘cso_data_has_shrunk’
#  117|         hash->buckets = MALLOC(sizeof(struct cso_node*) * hash->numBuckets);
#  118|         for (int i = 0; i < hash->numBuckets; ++i)
#  119|->          hash->buckets[i] = e;
#  120|   
#  121|         for (int i = 0; i < oldNumBuckets; ++i) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def403]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:823:10: warning[-Wanalyzer-malloc-leak]: leak of ‘llvm_gs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:799:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:800:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:800:17: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:802:10: branch_false: following ‘false’ branch (when ‘llvm_gs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:805:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:814:7: branch_false: following ‘false’ branch (when ‘gs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:817:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:820:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:821:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:822:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:823:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:823:10: danger: ‘llvm_gs’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  821|         gs->state.tokens = tgsi_dup_tokens(state->tokens);
#  822|         if (!gs->state.tokens) {
#  823|->          FREE(gs);
#  824|            return NULL;
#  825|         }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def404]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:906:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:789:1: enter_function: entry to ‘draw_create_geometry_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:799:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:800:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:802:10: branch_false: following ‘false’ branch (when ‘llvm_gs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:805:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:814:7: branch_false: following ‘false’ branch (when ‘gs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:817:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:843:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:848:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:903:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:904:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:905:22: call_function: calling ‘os_malloc_aligned’ from ‘draw_create_geometry_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:905:22: return_function: returning to ‘draw_create_geometry_shader’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:905:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_gs.c:906:7: danger: argument 1 (‘os_malloc_aligned(30720, 16)’) NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#  904|         int vector_size = gs->vector_length * sizeof(float);
#  905|         gs->gs_input = align_malloc(sizeof(struct draw_gs_inputs), 16);
#  906|->       memset(gs->gs_input, 0, sizeof(struct draw_gs_inputs));
#  907|         gs->llvm_prim_lengths = 0;
#  908|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def405]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1059:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘aos[j]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1546:1: enter_function: entry to ‘draw_llvm_generate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1632:16: branch_true: following ‘true’ branch (when ‘i != 14’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1633:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1632:16: branch_true: following ‘true’ branch (when ‘i != 14’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1633:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1973:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1975:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1975:10: call_function: calling ‘store_clip’ from ‘draw_llvm_generate’
# 1057|   
# 1058|         /* Unaligned store */
# 1059|->       LLVMSetAlignment(LLVMBuildStore(builder, aos[j], clip_ptr), sizeof(float));
# 1060|      }
# 1061|   }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def406]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1629:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*variant.function_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1628:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:1629:4: danger: argument 1 (‘malloc(strlen(&func_name) + 1)’) from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 1627|      variant->function = variant_func;
# 1628|      variant->function_name = MALLOC(strlen(func_name)+1);
# 1629|->    strcpy(variant->function_name, func_name);
# 1630|   
# 1631|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def407]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2367:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*variant.function_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2366:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2367:4: danger: argument 1 (‘malloc(strlen(&func_name) + 1)’) from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 2365|      variant->function = variant_func;
# 2366|      variant->function_name = MALLOC(strlen(func_name)+1);
# 2367|->    strcpy(variant->function_name, func_name);
# 2368|   
# 2369|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def408]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2367:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc(strlen(&func_name) + 1)’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2501:1: enter_function: entry to ‘draw_gs_llvm_create_variant’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2516:7: branch_false: following ‘false’ branch (when ‘variant’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2519:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2547:4: call_function: calling ‘draw_gs_llvm_generate’ from ‘draw_gs_llvm_create_variant’
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 2365|      variant->function = variant_func;
# 2366|      variant->function_name = MALLOC(strlen(func_name)+1);
# 2367|->    strcpy(variant->function_name, func_name);
# 2368|   
# 2369|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def409]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2961:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*variant.function_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2960:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2961:4: danger: argument 1 (‘malloc(strlen(&func_name) + 1)’) from [(1)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 2959|      variant->function = variant_func;
# 2960|      variant->function_name = MALLOC(strlen(func_name)+1);
# 2961|->    strcpy(variant->function_name, func_name);
# 2962|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);
# 2963|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def410]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:2961:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc(strlen(&func_name) + 1)’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3175:1: enter_function: entry to ‘draw_tcs_llvm_create_variant’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3188:7: branch_false: following ‘false’ branch (when ‘variant’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3191:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3222:4: call_function: calling ‘draw_tcs_llvm_generate’ from ‘draw_tcs_llvm_create_variant’
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 2959|      variant->function = variant_func;
# 2960|      variant->function_name = MALLOC(strlen(func_name)+1);
# 2961|->    strcpy(variant->function_name, func_name);
# 2962|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);
# 2963|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def411]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3545:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*variant.function_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3544:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3545:4: danger: argument 1 (‘malloc(strlen(&func_name) + 1)’) from [(1)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 3543|      variant->function = variant_func;
# 3544|      variant->function_name = MALLOC(strlen(func_name)+1);
# 3545|->    strcpy(variant->function_name, func_name);
# 3546|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);
# 3547|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def412]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3545:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc(strlen(&func_name) + 1)’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3714:1: enter_function: entry to ‘draw_tes_llvm_create_variant’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3727:7: branch_false: following ‘false’ branch (when ‘variant’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3730:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_llvm.c:3762:4: call_function: calling ‘draw_tes_llvm_generate’ from ‘draw_tes_llvm_create_variant’
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 3543|      variant->function = variant_func;
# 3544|      variant->function_name = MALLOC(strlen(func_name)+1);
# 3545|->    strcpy(variant->function_name, func_name);
# 3546|      LLVMSetFunctionCallConv(variant_func, LLVMCCallConv);
# 3547|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def413]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_mesh_prim.c:206:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*output_prims.primitive_lengths’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_mesh_prim.c:205:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_mesh_prim.c:206:4: danger: ‘malloc(4)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  204|      output_prims->flags = 0x0;
#  205|      output_prims->primitive_lengths = MALLOC(sizeof(unsigned));
#  206|->    output_prims->primitive_lengths[0] = 0;
#  207|      output_prims->primitive_count = 0;
#  208|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def414]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:406:1: warning[-Wanalyzer-malloc-leak]: leak of ‘vbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:413:1: enter_function: entry to ‘draw_vbuf_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:415:30: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:416:7: branch_false: following ‘false’ branch (when ‘vbuf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:419:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:431:33: call_function: calling ‘os_malloc_aligned’ from ‘draw_vbuf_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:431:33: return_function: returning to ‘draw_vbuf_stage’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:434:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:435:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:449:7: call_function: calling ‘vbuf_destroy’ from ‘draw_vbuf_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:449:7: return_function: returning to ‘draw_vbuf_stage’ from ‘vbuf_destroy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:406:1: danger: ‘vbuf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  404|   
#  405|      FREE(stage);
#  406|-> }
#  407|   
#  408|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def415]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:445:11: warning[-Wanalyzer-malloc-leak]: leak of ‘vbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:413:1: enter_function: entry to ‘draw_vbuf_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:415:30: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:416:7: branch_false: following ‘false’ branch (when ‘vbuf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:419:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:431:33: call_function: calling ‘os_malloc_aligned’ from ‘draw_vbuf_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:431:33: return_function: returning to ‘draw_vbuf_stage’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:434:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:437:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:438:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:441:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pipe_vbuf.c:445:11: danger: ‘vbuf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  443|      vbuf->zero4[0] = vbuf->zero4[1] = vbuf->zero4[2] = vbuf->zero4[3] = 0.0f;
#  444|   
#  445|->    return &vbuf->stage;
#  446|   
#  447|   fail:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def416]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_prim_assembler.c:294:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*output_prims.primitive_lengths’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_prim_assembler.c:293:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_prim_assembler.c:294:4: danger: ‘malloc(4)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  292|      output_prims->flags = 0x0;
#  293|      output_prims->primitive_lengths = MALLOC(sizeof(unsigned));
#  294|->    output_prims->primitive_lengths[0] = 0;
#  295|      output_prims->primitive_count = 1;
#  296|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def417]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_prim_assembler.c:325:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ia’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_prim_assembler.c:323:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_prim_assembler.c:325:4: danger: ‘ia’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  323|      struct draw_assembler *ia = CALLOC_STRUCT(draw_assembler);
#  324|   
#  325|->    ia->draw = draw;
#  326|   
#  327|      return ia;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def418]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_emit.c:365:11: warning[-Wanalyzer-malloc-leak]: leak of ‘fse’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_emit.c:352:35: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_emit.c:353:7: branch_false: following ‘false’ branch (when ‘fse’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_emit.c:356:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_emit.c:365:11: danger: ‘fse’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  363|      fse->draw = draw;
#  364|   
#  365|->    return &fse->base;
#  366|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def419]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:494:1: warning[-Wanalyzer-malloc-leak]: leak of ‘fpme’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:498:1: enter_function: entry to ‘draw_pt_fetch_pipeline_or_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:501:7: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:502:7: branch_false: following ‘false’ branch (when ‘fpme’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:505:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:516:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:517:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:535:7: call_function: calling ‘fetch_pipeline_destroy’ from ‘draw_pt_fetch_pipeline_or_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:535:7: return_function: returning to ‘draw_pt_fetch_pipeline_or_emit’ from ‘fetch_pipeline_destroy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:494:1: danger: ‘fpme’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  492|   
#  493|      FREE(middle);
#  494|-> }
#  495|   
#  496|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def420]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:531:11: warning[-Wanalyzer-malloc-leak]: leak of ‘fpme’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:501:7: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:502:7: branch_false: following ‘false’ branch (when ‘fpme’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:505:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:516:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:519:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:520:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:523:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:524:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:527:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:528:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:531:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:531:11: danger: ‘fpme’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  529|         goto fail;
#  530|   
#  531|->    return &fpme->base;
#  532|   
#  533|    fail:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def421]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:870:1: warning[-Wanalyzer-malloc-leak]: leak of ‘fpme’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:874:1: enter_function: entry to ‘draw_pt_fetch_pipeline_or_emit_llvm’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:878:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:881:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:881:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:882:7: branch_false: following ‘false’ branch (when ‘fpme’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:885:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:896:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:897:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:921:7: call_function: calling ‘llvm_middle_end_destroy’ from ‘draw_pt_fetch_pipeline_or_emit_llvm’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:921:7: return_function: returning to ‘draw_pt_fetch_pipeline_or_emit_llvm’ from ‘llvm_middle_end_destroy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:870:1: danger: ‘fpme’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#  868|   
#  869|      FREE(middle);
#  870|-> }
#  871|   
#  872|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def422]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:917:11: warning[-Wanalyzer-malloc-leak]: leak of ‘fpme’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:878:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:881:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:881:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:882:7: branch_false: following ‘false’ branch (when ‘fpme’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:885:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:896:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:899:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:900:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:903:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:904:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:907:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:908:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:911:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:912:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:915:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:917:11: danger: ‘fpme’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#  915|      fpme->current_variant = NULL;
#  916|   
#  917|->    return &fpme->base;
#  918|   
#  919|    fail:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def423]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:62:1: warning[-Wanalyzer-malloc-leak]: leak of ‘mpme’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:106:1: enter_function: entry to ‘draw_pt_mesh_pipeline_or_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:109:7: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:110:7: branch_false: following ‘false’ branch (when ‘mpme’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:113:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:118:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:119:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:128:7: call_function: calling ‘mesh_pipeline_destroy’ from ‘draw_pt_mesh_pipeline_or_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:128:7: return_function: returning to ‘draw_pt_mesh_pipeline_or_emit’ from ‘mesh_pipeline_destroy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:62:1: danger: ‘mpme’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#   60|         draw_pt_post_vs_destroy(mpme->post_vs);
#   61|      FREE(middle);
#   62|-> }
#   63|   
#   64|   static void

Error: GCC_ANALYZER_WARNING (CWE-401): [#def424]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:125:11: warning[-Wanalyzer-malloc-leak]: leak of ‘mpme’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:109:7: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:110:7: branch_false: following ‘false’ branch (when ‘mpme’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:113:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:118:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:121:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:122:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:125:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_mesh_pipeline.c:125:11: danger: ‘mpme’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  123|         goto fail;
#  124|   
#  125|->    return &mpme->base;
#  126|    fail:
#  127|      if (mpme)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def425]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:149:35: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:272:1: enter_function: entry to ‘draw_pt_so_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:299:30: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:300:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:302:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:303:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:310:27: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:312:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:314:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:315:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_pt_so_emit.c:315:13: call_function: calling ‘so_run_linear’ from ‘draw_pt_so_emit’
#  147|   
#  148|      /* check have we space to emit prim first - if not don't do anything */
#  149|->    for (unsigned slot = 0; slot < state->num_outputs; ++slot) {
#  150|         int ob = state->output[slot].output_buffer;
#  151|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def426]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:404:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:321:5: enter_function: entry to ‘draw_tess_eval_shader_run’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:366:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:367:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:371:7: call_function: calling ‘llvm_fetch_tess_factors’ from ‘draw_tess_eval_shader_run’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:371:7: return_function: returning to ‘draw_tess_eval_shader_run’ from ‘llvm_fetch_tess_factors’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:376:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:380:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:400:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:404:47: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:404:27: call_function: inlined call to ‘u_prim_vertex_count’ from ‘draw_tess_eval_shader_run’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:404:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:404:16: danger: dereference of NULL ‘<unknown>’
#  402|         }
#  403|   
#  404|->       uint32_t prim_len = u_prim_vertex_count(output_prims->prim)->min;
#  405|         uint32_t prims_per_patch = data.num_indices / prim_len;
#  406|         output_prims->primitive_count += prims_per_patch;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def427]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:465:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:426:1: enter_function: entry to ‘draw_create_tess_ctrl_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:436:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:437:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:439:10: branch_false: following ‘false’ branch (when ‘llvm_tcs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:442:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:451:7: branch_false: following ‘false’ branch (when ‘tcs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:454:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:462:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:24: call_function: calling ‘os_malloc_aligned’ from ‘draw_create_tess_ctrl_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:24: return_function: returning to ‘draw_create_tess_ctrl_shader’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:465:7: danger: argument 1 (‘os_malloc_aligned(24576, 16)’) NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#  463|   
#  464|         tcs->tcs_input = align_malloc(sizeof(struct draw_tcs_inputs), 16);
#  465|->       memset(tcs->tcs_input, 0, sizeof(struct draw_tcs_inputs));
#  466|   
#  467|         tcs->tcs_output = align_malloc(sizeof(struct draw_tcs_outputs), 16);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def428]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:468:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:426:1: enter_function: entry to ‘draw_create_tess_ctrl_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:436:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:437:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:439:10: branch_false: following ‘false’ branch (when ‘llvm_tcs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:442:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:451:7: branch_false: following ‘false’ branch (when ‘tcs’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:454:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:462:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:24: call_function: calling ‘os_malloc_aligned’ from ‘draw_create_tess_ctrl_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:464:24: return_function: returning to ‘draw_create_tess_ctrl_shader’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:467:25: call_function: calling ‘os_malloc_aligned’ from ‘draw_create_tess_ctrl_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:467:25: return_function: returning to ‘draw_create_tess_ctrl_shader’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:467:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:468:7: danger: argument 1 (‘os_malloc_aligned(40960, 16)’) NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#  466|   
#  467|         tcs->tcs_output = align_malloc(sizeof(struct draw_tcs_outputs), 16);
#  468|->       memset(tcs->tcs_output, 0, sizeof(struct draw_tcs_outputs));
#  469|   
#  470|         tcs->jit_resources = &draw->llvm->jit_resources[PIPE_SHADER_TESS_CTRL];

Error: GCC_ANALYZER_WARNING (CWE-688): [#def429]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:593:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:528:1: enter_function: entry to ‘draw_create_tess_eval_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:538:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:539:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:541:10: branch_false: following ‘false’ branch (when ‘llvm_tes’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:544:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:552:7: branch_false: following ‘false’ branch (when ‘tes’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:555:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:590:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:592:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:592:24: call_function: calling ‘os_malloc_aligned’ from ‘draw_create_tess_eval_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:592:24: return_function: returning to ‘draw_create_tess_eval_shader’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:592:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/draw/draw_tess.c:593:7: danger: argument 1 (‘os_malloc_aligned(40960, 16)’) NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#  591|   
#  592|         tes->tes_input = align_malloc(sizeof(struct draw_tes_inputs), 16);
#  593|->       memset(tes->tes_input, 0, sizeof(struct draw_tes_inputs));
#  594|   
#  595|         tes->jit_resources = &draw->llvm->jit_resources[PIPE_SHADER_TESS_EVAL];

Error: GCC_ANALYZER_WARNING (CWE-401): [#def430]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:550:14: warning[-Wanalyzer-malloc-leak]: leak of ‘dscreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:549:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:552:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:552:7: branch_false: following ‘false’ branch (when the strings are non-equal)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:628:14: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:629:7: branch_false: following ‘false’ branch (when ‘dscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:635:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:639:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:639:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:643:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:643:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:647:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:647:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:652:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:652:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:653:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:653:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:654:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:654:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:656:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:656:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:657:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:657:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:658:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:658:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:660:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:660:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:661:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:661:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:662:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:662:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:663:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:663:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:664:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:664:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:665:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:665:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:666:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:666:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:667:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:667:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:668:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:668:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:669:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:669:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:670:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:670:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:671:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:671:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:672:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:672:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:673:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:673:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:674:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:674:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:676:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:676:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:677:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:677:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:706:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:707:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_ddebug/dd_screen.c:550:14: danger: ‘dscreen’ leaks here; was allocated at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  548|      option = debug_get_option("GALLIUM_DDEBUG", NULL);
#  549|      if (!option)
#  550|->       return screen;
#  551|   
#  552|      if (!strcmp(option, "help")) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def431]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:242:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:221:14: enter_function: entry to ‘noop_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:232:7: branch_false: following ‘false’ branch (when ‘transfer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:234:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:234:4: call_function: calling ‘pipe_resource_reference’ from ‘noop_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:234:4: return_function: returning to ‘noop_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:242:11: danger: dereference of NULL ‘resource’
#  240|      *ptransfer = transfer;
#  241|   
#  242|->    return nresource->data;
#  243|   }
#  244|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def432]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:338:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘f’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:337:34: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:338:7: danger: ‘f’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  336|      if (fence) {
#  337|         struct pipe_reference *f = MALLOC_STRUCT(pipe_reference);
#  338|->       f->count = 1;
#  339|   
#  340|         ctx->screen->fence_reference(ctx->screen, fence, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def433]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:395:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘f’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:393:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_pipe.c:395:4: danger: ‘f’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  393|      struct pipe_reference *f = MALLOC_STRUCT(pipe_reference);
#  394|   
#  395|->    f->count = 1;
#  396|      return (struct pipe_fence_handle*)f;
#  397|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def434]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:300:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:285:1: enter_function: entry to ‘trace_context_end_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:292:31: call_function: inlined call to ‘trace_query_unwrap’ from ‘trace_context_end_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:294:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:299:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:300:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_context.c:300:7: danger: dereference of NULL ‘<unknown>’
#  298|   
#  299|      if (tr_ctx->threaded)
#  300|->       threaded_query(query)->flushed = trace_query(_query)->base.flushed;
#  301|      ret = pipe->end_query(pipe, query);
#  302|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def435]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:59:4: warning[-Wanalyzer-malloc-leak]: leak of ‘tr_surf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:38:1: enter_function: entry to ‘trace_surf_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:44:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:49:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:49:14: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:50:7: branch_false: following ‘false’ branch (when ‘tr_surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:53:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:58:4: call_function: calling ‘pipe_resource_reference’ from ‘trace_surf_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:58:4: return_function: returning to ‘trace_surf_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:59:4: danger: ‘tr_surf’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#   57|      tr_surf->base.texture = NULL;
#   58|      pipe_resource_reference(&tr_surf->base.texture, res);
#   59|->    tr_surf->surface = surface;
#   60|   
#   61|      return &tr_surf->base;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def436]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:100:11: warning[-Wanalyzer-malloc-leak]: leak of ‘tr_trans’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:79:1: enter_function: entry to ‘trace_transfer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:85:7: branch_false: following ‘false’ branch (when ‘transfer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:88:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:88:15: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:89:7: branch_false: following ‘false’ branch (when ‘tr_trans’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:92:38: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:97:4: call_function: calling ‘pipe_resource_reference’ from ‘trace_transfer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:97:4: return_function: returning to ‘trace_transfer_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:100:11: danger: ‘tr_trans’ leaks here; was allocated at [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3)
#   98|      assert(tr_trans->base.b.resource == res);
#   99|   
#  100|->    return &tr_trans->base.b;
#  101|   
#  102|   error:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def437]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:131:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tr_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:120:1: enter_function: entry to ‘trace_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:125:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:129:4: call_function: calling ‘pipe_resource_reference’ from ‘trace_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:129:4: return_function: returning to ‘trace_sampler_view_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:131:4: danger: ‘tr_view’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  129|      pipe_resource_reference(&tr_view->base.texture, tr_res);
#  130|      tr_view->base.context = &tr_ctx->base;
#  131|->    tr_view->sampler_view = view;
#  132|      return &tr_view->base;
#  133|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def438]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:132:11: warning[-Wanalyzer-malloc-leak]: leak of ‘tr_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:120:1: enter_function: entry to ‘trace_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:125:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:129:4: call_function: calling ‘pipe_resource_reference’ from ‘trace_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:129:4: return_function: returning to ‘trace_sampler_view_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/driver_trace/tr_texture.c:132:11: danger: ‘tr_view’ leaks here; was allocated at [(2)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/1)
#  130|      tr_view->base.context = &tr_ctx->base;
#  131|      tr_view->sampler_view = view;
#  132|->    return &tr_view->base;
#  133|   }
#  134|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def439]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:347:10: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:339:1: enter_function: entry to ‘gallivm_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:345:7: branch_true: following ‘true’ branch (when ‘gallivm’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:346:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:346:12: call_function: calling ‘init_gallivm_state’ from ‘gallivm_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:346:12: return_function: returning to ‘gallivm_create’ from ‘init_gallivm_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:346:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:347:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_init.c:347:10: danger: ‘<unknown>’ leaks here; was allocated at [(10)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/9)
#  345|      if (gallivm) {
#  346|         if (!init_gallivm_state(gallivm, name, context, cache)) {
#  347|->          FREE(gallivm);
#  348|            gallivm = NULL;
#  349|         }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def440]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_intr.c:166:23: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_intr.c:355:1: enter_function: entry to ‘lp_build_intrinsic_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_intr.c:370:15: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_intr.c:371:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_intr.c:376:18: call_function: calling ‘lp_build_intrinsic’ from ‘lp_build_intrinsic_map’
#argument 1 of ‘__builtin_strlen’ must be non-null
#  164|   
#  165|      const char *attr_name = attr_to_str(attr);
#  166|->    unsigned kind_id = LLVMGetEnumAttributeKindForName(attr_name,
#  167|                                                         strlen(attr_name));
#  168|      LLVMAttributeRef llvm_attr = LLVMCreateEnumAttribute(ctx, kind_id, 0);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def441]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:272:24: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘shuffles[<unknown>]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:867:1: enter_function: entry to ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:883:28: branch_true: following ‘true’ branch (when ‘chan != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:884:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch (when ‘variable’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: call_function: calling ‘nir_next_decl_reg’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: branch_false: following ‘false’ branch (when ‘reg’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:931:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:934:4: call_function: calling ‘visit_cf_list’ from ‘lp_build_nir_aos’
#  270|   
#  271|         for (unsigned i = nc; i < type.length; ++i) {
#  272|->          shuffles[i] = shuffles[i % nc];
#  273|         }
#  274|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def442]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:933:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:867:1: enter_function: entry to ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:883:28: branch_true: following ‘true’ branch (when ‘chan != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:884:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch (when ‘variable’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: call_function: calling ‘nir_next_decl_reg’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: branch_false: following ‘false’ branch (when ‘reg’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:931:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:933:26: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#  931|      nir_index_ssa_defs(impl);
#  932|      nir_print_shader(shader, stdout);
#  933|->    bld.ssa_defs = calloc(impl->ssa_alloc, sizeof(LLVMValueRef));
#  934|      visit_cf_list(&bld, &impl->body);
#  935|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def443]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:227:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:883:1: enter_function: entry to ‘lp_build_resize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:914:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:922:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:922:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:926:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:926:19: call_function: calling ‘lp_build_pack’ from ‘lp_build_resize’
#  225|   
#  226|      for (i = 0; i < num_vectors; i++)
#  227|->       tmp[i] = src[i];
#  228|   
#  229|      while (num_vectors > 1) {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def444]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:241:11: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘tmp[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:883:1: enter_function: entry to ‘lp_build_resize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:914:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:922:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:922:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:926:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_pack.c:926:19: call_function: calling ‘lp_build_pack’ from ‘lp_build_resize’
#  239|      }
#  240|   
#  241|->    return tmp[0];
#  242|   }
#  243|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def445]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:110:8: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:4981:1: enter_function: entry to ‘lp_build_image_op_array_case’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:4996:4: call_function: calling ‘lp_build_img_op_soa’ from ‘lp_build_image_op_array_case’
#  108|      resident = LLVMBuildICmp(builder, LLVMIntNE, resident, lp_build_zero(gallivm, type), "");
#  109|   
#  110|->    if (*out_resident)
#  111|         *out_resident = LLVMBuildAnd(builder, *out_resident, resident, "");
#  112|      else

Error: GCC_ANALYZER_WARNING (CWE-121): [#def446]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:111:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:4981:1: enter_function: entry to ‘lp_build_image_op_array_case’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:4996:4: call_function: calling ‘lp_build_img_op_soa’ from ‘lp_build_image_op_array_case’
#  109|   
#  110|      if (*out_resident)
#  111|->       *out_resident = LLVMBuildAnd(builder, *out_resident, resident, "");
#  112|      else
#  113|         *out_resident = resident;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def447]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:113:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:4981:1: enter_function: entry to ‘lp_build_image_op_array_case’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c:4996:4: call_function: calling ‘lp_build_img_op_soa’ from ‘lp_build_image_op_array_case’
#  111|         *out_resident = LLVMBuildAnd(builder, *out_resident, resident, "");
#  112|      else
#  113|->       *out_resident = resident;
#  114|   }
#  115|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def448]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_info.c:549:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_info.c:548:10: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_info.c:549:4: danger: ‘ctx’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  547|   
#  548|      ctx = CALLOC(1, sizeof(struct analysis_context));
#  549|->    ctx->info = info;
#  550|   
#  551|      tgsi_parse_init(&parse, tokens);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def449]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:956:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1041:1: enter_function: entry to ‘emit_fetch_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1053:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1083:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1083:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1104:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1105:14: call_function: inlined call to ‘tgsi_type_is_64bit’ from ‘emit_fetch_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1106:91: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_tgsi_soa.c:1106:19: call_function: calling ‘emit_fetch_64bit’ from ‘emit_fetch_input’
#  954|      res = LLVMBuildShuffleVector(builder, input, input2, LLVMConstVector(shuffles, len), "");
#  955|   
#  956|->    return LLVMBuildBitCast(builder, res, bld_fetch->vec_type, "");
#  957|   }
#  958|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def450]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/hud/hud_sensors_temp.c:261:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘sti’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/hud/hud_sensors_temp.c:329:1: enter_function: entry to ‘hud_get_num_sensors’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/hud/hud_sensors_temp.c:349:4: call_function: calling ‘build_sensor_list’ from ‘hud_get_num_sensors’
#  259|      struct sensors_temp_info *sti = CALLOC_STRUCT(sensors_temp_info);
#  260|   
#  261|->    sti->mode = mode;
#  262|      sti->chip = (sensors_chip_name *) chip;
#  263|      sti->feature = feature;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def451]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:110:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:250:6: enter_function: entry to ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:333:4: branch_false: following ‘false’ branch (when ‘variable’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:410:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:411:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:412:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:413:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:415:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:430:4: branch_false: following ‘false’ branch (when ‘variable’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:597:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:597:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:618:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:624:40: call_function: calling ‘__bitset_last_bit’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:624:40: return_function: returning to ‘nir_tgsi_scan_shader’ from ‘__bitset_last_bit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:625:45: call_function: calling ‘__bitset_last_bit’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:625:45: return_function: returning to ‘nir_tgsi_scan_shader’ from ‘__bitset_last_bit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:628:38: call_function: calling ‘__bitset_last_bit’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:628:38: return_function: returning to ‘nir_tgsi_scan_shader’ from ‘__bitset_last_bit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:634:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:638:7: call_function: inlined call to ‘exec_list_get_head_const’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:640:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:641:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:641:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:641:7: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:642:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:642:10: call_function: calling ‘scan_instruction’ from ‘nir_tgsi_scan_shader’
#  108|   
#  109|      unsigned location_frac = path.path[0]->var->data.location_frac;
#  110|->    if (glsl_type_is_64bit(deref->type)) {
#  111|         uint8_t new_mask = 0;
#  112|         for (unsigned i = 0; i < 4; i++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def452]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:640:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:250:6: enter_function: entry to ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:333:4: branch_false: following ‘false’ branch (when ‘variable’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:410:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:411:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:412:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:413:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:415:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:430:4: branch_false: following ‘false’ branch (when ‘variable’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:597:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:597:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:618:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:624:40: call_function: calling ‘__bitset_last_bit’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:624:40: return_function: returning to ‘nir_tgsi_scan_shader’ from ‘__bitset_last_bit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:625:45: call_function: calling ‘__bitset_last_bit’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:625:45: return_function: returning to ‘nir_tgsi_scan_shader’ from ‘__bitset_last_bit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:628:38: call_function: calling ‘__bitset_last_bit’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:628:38: return_function: returning to ‘nir_tgsi_scan_shader’ from ‘__bitset_last_bit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:634:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:638:7: call_function: inlined call to ‘exec_list_get_head_const’ from ‘nir_tgsi_scan_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:640:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/nir_to_tgsi_info.c:640:4: danger: dereference of NULL ‘<unknown>’
#  638|         exec_list_get_head_const(&nir->functions);
#  639|   
#  640|->    nir_foreach_block(block, func->impl) {
#  641|         nir_foreach_instr(instr, block)
#  642|            scan_instruction(nir, need_texcoord, info, instr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def453]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/tgsi_to_nir.c:2250:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘screen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/tgsi_to_nir.c:2692:1: enter_function: entry to ‘tgsi_to_nir_noscreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/nir/tgsi_to_nir.c:2698:8: call_function: calling ‘ttn_compile_init’ from ‘tgsi_to_nir_noscreen’
# 2248|      if (!options) {
# 2249|         options =
# 2250|->          screen->get_compiler_options(screen, PIPE_SHADER_IR_NIR, scan.processor);
# 2251|      }
# 2252|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def454]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:103:11: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘driver_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:329:1: enter_function: entry to ‘pipe_loader_get_compatible_render_capable_device_fds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:358:9: call_function: calling ‘pipe_loader_drm_probe_fd’ from ‘pipe_loader_get_compatible_render_capable_device_fds’
#  101|   #ifdef GALLIUM_STATIC_TARGETS
#  102|      for (int i = 0; i < ARRAY_SIZE(driver_descriptors); i++) {
#  103|->       if (strcmp(driver_descriptors[i]->driver_name, driver_name) == 0)
#  104|            return driver_descriptors[i];
#  105|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def455]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:176:8: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*ddev.base.driver_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:329:1: enter_function: entry to ‘pipe_loader_get_compatible_render_capable_device_fds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:358:9: call_function: calling ‘pipe_loader_drm_probe_fd’ from ‘pipe_loader_get_compatible_render_capable_device_fds’
#  174|      }
#  175|   
#  176|->    if (strcmp(ddev->base.driver_name, "virtio_gpu") == 0) {
#  177|         struct virgl_renderer_capset_drm caps;
#  178|         if (get_nctx_caps(fd, &caps) == 0) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def456]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:426:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘driconf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:396:1: enter_function: entry to ‘pipe_loader_drm_get_driconf_by_name’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:401:7: call_function: calling ‘get_driver_descriptor’ from ‘pipe_loader_drm_get_driconf_by_name’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:401:7: return_function: returning to ‘pipe_loader_drm_get_driconf_by_name’ from ‘get_driver_descriptor’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:418:17: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:424:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:425:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:425:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:426:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:426:13: danger: ‘driconf + (long unsigned int)i * 128’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/6)
#  424|         for (unsigned i = 0; i < dd->driconf_count; i++) {
#  425|            if (dd->driconf[i].desc) {
#  426|->             driconf[i].desc = (void*)ptr;
#  427|               size_t str_size = strlen(dd->driconf[i].desc) + 1;
#  428|               memcpy((void*)driconf[i].desc, dd->driconf[i].desc, str_size);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def457]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:227:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sdev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:207:1: enter_function: entry to ‘pipe_loader_sw_probe_dri’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:209:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:212:7: branch_false: following ‘false’ branch (when ‘sdev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:215:9: call_function: inlined call to ‘pipe_loader_sw_probe_init_common’ from ‘pipe_loader_sw_probe_dri’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:224:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:227:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:227:4: danger: ‘sdev’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  225|         goto fail;
#  226|   
#  227|->    *devs = &sdev->base;
#  228|      return true;
#  229|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def458]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:257:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sdev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:237:1: enter_function: entry to ‘pipe_loader_vk_probe_dri’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:239:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:242:7: branch_false: following ‘false’ branch (when ‘sdev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:245:9: call_function: inlined call to ‘pipe_loader_vk_probe_init_common’ from ‘pipe_loader_vk_probe_dri’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:254:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:257:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:257:4: danger: ‘sdev’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  255|         goto fail;
#  256|   
#  257|->    *devs = &sdev->base;
#  258|      return true;
#  259|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def459]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:293:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sdev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:270:1: enter_function: entry to ‘pipe_loader_sw_probe_kms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:272:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:275:7: branch_false: following ‘false’ branch (when ‘sdev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:278:9: call_function: inlined call to ‘pipe_loader_sw_probe_init_common’ from ‘pipe_loader_sw_probe_kms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:281:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:284:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:285:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:290:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:293:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:293:4: danger: ‘sdev’ leaks here; was allocated at [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  291|         goto fail;
#  292|   
#  293|->    *devs = &sdev->base;
#  294|      return true;
#  295|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def460]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:326:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sdev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:306:1: enter_function: entry to ‘pipe_loader_sw_probe_null’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:308:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:311:7: branch_false: following ‘false’ branch (when ‘sdev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:314:9: call_function: inlined call to ‘pipe_loader_sw_probe_init_common’ from ‘pipe_loader_sw_probe_null’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:317:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:318:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:323:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:326:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:326:4: danger: ‘sdev’ leaks here; was allocated at [(2)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/1)
#  324|         goto fail;
#  325|   
#  326|->    *devs = &sdev->base;
#  327|      return true;
#  328|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def461]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:371:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sdev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:350:1: enter_function: entry to ‘pipe_loader_sw_probe_wrapped’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:353:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:356:7: branch_false: following ‘false’ branch (when ‘sdev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:359:9: call_function: inlined call to ‘pipe_loader_sw_probe_init_common’ from ‘pipe_loader_sw_probe_wrapped’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:362:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:363:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:368:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:371:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_sw.c:371:4: danger: ‘sdev’ leaks here; was allocated at [(2)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/1)
#  369|         goto fail;
#  370|   
#  371|->    *dev = &sdev->base;
#  372|      return true;
#  373|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def462]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:220:11: warning[-Wanalyzer-malloc-leak]: leak of ‘mm_buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:175:1: enter_function: entry to ‘mm_bufmgr_create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:189:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:190:7: branch_false: following ‘false’ branch (when ‘mm_buf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:195:4: call_function: inlined call to ‘pipe_reference_init’ from ‘mm_bufmgr_create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:205:6: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:219:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_mm.c:220:11: danger: ‘mm_buf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  218|      
#  219|      mtx_unlock(&mm->mutex);
#  220|->    return SUPER(mm_buf);
#  221|   }
#  222|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def463]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:574:11: warning[-Wanalyzer-malloc-leak]: leak of ‘mgr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:540:7: branch_false: following ‘false’ branch (when ‘provider’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:543:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:543:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:544:7: branch_false: following ‘false’ branch (when ‘mgr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:547:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:563:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:567:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:574:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/pipebuffer/pb_bufmgr_slab.c:574:11: danger: ‘mgr’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  572|      }
#  573|   
#  574|->    return &mgr->base;
#  575|   
#  576|   out_err2: 

Error: GCC_ANALYZER_WARNING (CWE-476): [#def464]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:80:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:465:10: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:466:4: call_function: inlined call to ‘fill_scan_register1d’ from ‘iter_immediate’
#   78|                        enum tgsi_file_type file, unsigned index)
#   79|   {
#   80|->    reg->file = file;
#   81|      reg->dimensions = 1;
#   82|      reg->indices[0] = index;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def465]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:91:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:392:1: enter_function: entry to ‘iter_declaration’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:409:9: call_function: inlined call to ‘check_file_name’ from ‘iter_declaration’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:411:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:411:32: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:414:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:437:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:438:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:439:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_sanity.c:439:13: call_function: inlined call to ‘fill_scan_register2d’ from ‘iter_declaration’
#   89|                        unsigned index1, unsigned index2)
#   90|   {
#   91|->    reg->file = file;
#   92|      reg->dimensions = 2;
#   93|      reg->indices[0] = index1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def466]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:186:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘is_mem_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:219:1: enter_function: entry to ‘scan_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:246:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:247:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:247:7: call_function: calling ‘scan_src_operand’ from ‘scan_instruction’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:247:7: return_function: returning to ‘scan_instruction’ from ‘scan_src_operand’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:251:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:252:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/tgsi/tgsi_scan.c:257:10: call_function: calling ‘scan_src_operand’ from ‘scan_instruction’
#  184|      if (is_memory_file(src->Register.File) &&
#  185|          !is_mem_query_inst(fullinst->Instruction.Opcode)) {
#  186|->       *is_mem_inst = true;
#  187|   
#  188|         if (src->Register.File == TGSI_FILE_IMAGE &&

Error: GCC_ANALYZER_WARNING (CWE-401): [#def467]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:846:11: warning[-Wanalyzer-malloc-leak]: leak of ‘tg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:784:35: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:787:7: branch_false: following ‘false’ branch (when ‘tg’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:792:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:800:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:844:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_generic.c:846:11: danger: ‘tg’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  844|      tg->nr_attrib = key->nr_elements;
#  845|   
#  846|->    return &tg->translate;
#  847|   }
#  848|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def468]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1420:15: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘vb’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1507:1: enter_function: entry to ‘translate_sse2_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1512:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1515:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1515:8: call_function: calling ‘os_malloc_aligned’ from ‘translate_sse2_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1515:8: return_function: returning to ‘translate_sse2_create’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1516:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1519:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1529:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1569:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/translate/translate_sse.c:1569:9: call_function: calling ‘build_vertex_emit’ from ‘translate_sse2_create’
# 1418|            }
# 1419|   
# 1420|->          if (!translate_attr(p, a,
# 1421|                                x86_make_disp(vb, a->input_offset),
# 1422|                                x86_make_disp(p->outbuf_EBX, a->output_offset)))

Error: GCC_ANALYZER_WARNING (CWE-476): [#def469]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_buffer.c:647:30: enter_function: entry to ‘si_buffer_from_user_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_buffer.c:651:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_buffer.c:655:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_buffer.c:656:30: call_function: calling ‘si_alloc_buffer_struct’ from ‘si_buffer_from_user_memory’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def470]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_bufmgr.c:396:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_bufmgr.c:401:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_bufmgr.c:401:14: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_bufmgr.c:402:9: call_function: inlined call to ‘pipe_reference_init’ from ‘vc4_bo_open_handle’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def471]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fence’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_fence.c:23:35: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_fence.c:25:4: call_function: inlined call to ‘pipe_reference_init’ from ‘i915_drm_fence_create’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def472]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘f’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:283:1: enter_function: entry to ‘lp_create_fence_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:289:7: branch_false: following ‘false’ branch (when ‘type == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:292:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:292:25: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:294:7: branch_false: following ‘false’ branch (when ‘fence’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:297:4: call_function: inlined call to ‘pipe_reference_init’ from ‘lp_create_fence_fd’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def473]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:451:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:452:4: call_function: inlined call to ‘pipe_reference_init’ from ‘llvmpipe_memobj_create_from_handle’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def474]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘rbuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_buffer_common.c:537:19: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_buffer_common.c:541:9: call_function: inlined call to ‘pipe_reference_init’ from ‘r600_alloc_buffer_struct’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def475]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1336:9: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1346:9: call_function: inlined call to ‘pipe_reference_init’ from ‘r600_compute_global_buffer_create’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def476]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:723:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:724:7: branch_false: following ‘false’ branch (when ‘templ’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:726:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:727:4: call_function: inlined call to ‘pipe_reference_init’ from ‘virgl_resource_from_handle’
#   57|   pipe_reference_init(struct pipe_reference *dst, unsigned count)
#   58|   {
#   59|->    dst->count = count;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def477]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:175:29: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:1034:1: enter_function: entry to ‘vc4_flush_resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:1086:17: call_function: calling ‘pipe_resource_reference’ from ‘vc4_flush_resource’
#  173|      /* Avoid recursion, which would prevent inlining this function */
#  174|      do {
#  175|->       struct pipe_resource *next = res->next;
#  176|   
#  177|         res->screen->resource_destroy(res->screen, res);

Error: GCC_ANALYZER_WARNING (CWE-126): [#def478]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:177:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:1034:1: enter_function: entry to ‘vc4_flush_resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:1086:17: call_function: calling ‘pipe_resource_reference’ from ‘vc4_flush_resource’
#  175|         struct pipe_resource *next = res->next;
#  176|   
#  177|->       res->screen->resource_destroy(res->screen, res);
#  178|         res = next;
#  179|      } while (pipe_reference_described(res ? &res->reference : NULL,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def479]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:190:8: warning[-Wanalyzer-malloc-leak]: leak of ‘nv50_surface_from_miptree(pt,  templ)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:496:1: enter_function: entry to ‘nv50_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:501:30: call_function: calling ‘nv50_surface_from_miptree’ from ‘nv50_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:501:30: return_function: returning to ‘nv50_miptree_surface_new’ from ‘nv50_surface_from_miptree’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:502:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:504:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:190:8: danger: ‘nv50_surface_from_miptree(pt,  templ)’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#  188|      struct pipe_resource *old_dst = *dst;
#  189|   
#  190|->    if (pipe_reference_described(old_dst ? &old_dst->reference : NULL,
#  191|                                   src ? &src->reference : NULL,
#  192|                                   (debug_reference_descriptor)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def480]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_inlines.h:347:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pt’
mesa-25.1.0-rc2/redhat-linux-build/src/gallium/frontends/rusticl/rusticl_mesa_bindings.c:620:6: enter_function: entry to ‘pipe_surface_init__extern’
mesa-25.1.0-rc2/redhat-linux-build/src/gallium/frontends/rusticl/rusticl_mesa_bindings.c:620:151: call_function: inlined call to ‘pipe_surface_init’ from ‘pipe_surface_init__extern’
mesa-25.1.0-rc2/redhat-linux-build/src/gallium/frontends/rusticl/rusticl_mesa_bindings.c:620:151: call_function: inlined call to ‘pipe_surface_init’ from ‘pipe_surface_init__extern’
#  345|   {
#  346|      pipe_resource_reference(&ps->texture, pt);
#  347|->    ps->format = pt->format;
#  348|      ps->u.tex.level = level;
#  349|      ps->u.tex.first_layer = ps->u.tex.last_layer = layer;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def481]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:177:4: warning[-Wanalyzer-malloc-leak]: leak of ‘new_entries’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:156:7: branch_false: following ‘false’ branch (when ‘page’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:163:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:163:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:164:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:168:10: branch_false: following ‘false’ branch (when ‘new_entries’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:171:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_log.c:177:4: danger: ‘new_entries’ leaks here; was allocated at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  175|      page->entries[page->num_entries].type = type;
#  176|      page->entries[page->num_entries].data = data;
#  177|->    page->num_entries++;
#  178|      return;
#  179|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def482]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_prim.h:107:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3355:1: enter_function: entry to ‘panfrost_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3374:7: call_function: calling ‘panfrost_multi_draw_direct’ from ‘panfrost_draw_vbo’
#  105|      assert(info->incr != 0);
#  106|   
#  107|->    if (num < info->min)
#  108|         return 0;
#  109|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def483]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_prim.h:215:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_context.c:149:1: enter_function: entry to ‘v3d_update_primitive_counters’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_context.c:152:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_context.c:159:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_context.c:162:12: branch_false: following ‘false’ branch (when ‘prims_before != prims_after’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_context.c:165:53: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_context.c:166:30: call_function: inlined call to ‘u_vertices_for_prims’ from ‘v3d_update_primitive_counters’
#  213|      assert(info);
#  214|   
#  215|->    return info->min + (count - 1) * info->incr;
#  216|   }
#  217|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def484]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_range.h:66:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:20:1: enter_function: entry to ‘r600_create_so_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:30:12: branch_false: following ‘false’ branch (when ‘t’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:36:54: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:37:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:42:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:44:9: call_function: calling ‘pipe_resource_reference’ from ‘r600_create_so_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:44:9: return_function: returning to ‘r600_create_so_target’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_streamout.c:48:9: call_function: calling ‘util_range_add’ from ‘r600_create_so_target’
#   64|   {
#   65|      if (start < range->start || end > range->end) {
#   66|->       if (resource->flags & PIPE_RESOURCE_FLAG_SINGLE_THREAD_USE ||
#   67|             p_atomic_read(&resource->screen->num_contexts) == 1) {
#   68|            range->start = MIN2(start, range->start);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def485]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_range.h:77:1: warning[-Wanalyzer-malloc-leak]: leak of ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:764:1: enter_function: entry to ‘nouveau_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:769:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:770:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:773:4: call_function: inlined call to ‘pipe_reference_init’ from ‘nouveau_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:786:4: call_function: calling ‘util_range_add’ from ‘nouveau_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:786:4: return_function: returning to ‘nouveau_user_buffer_create’ from ‘util_range_add’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_range.h:77:1: danger: ‘buffer’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#   75|         }
#   76|      }
#   77|-> }
#   78|   
#   79|   static inline bool

Error: GCC_ANALYZER_WARNING (CWE-476): [#def486]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_transfer_helper.c:581:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘helper’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_transfer_helper.c:579:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/util/u_transfer_helper.c:581:4: danger: ‘helper’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  579|      struct u_transfer_helper *helper = calloc(1, sizeof(*helper));
#  580|   
#  581|->    helper->vtbl = vtbl;
#  582|      helper->separate_z32s8 = flags & U_TRANSFER_HELPER_SEPARATE_Z32S8;
#  583|      helper->separate_stencil = flags & U_TRANSFER_HELPER_SEPARATE_STENCIL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def487]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:116:20: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘t_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:84:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_true: following ‘true’ branch (when ‘i < num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:116:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:116:20: danger: ‘t_array + (long unsigned int)i * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  114|   
#  115|      for (i = 0; i < num_offsets; ++i)
#  116|->       t_array[i] = ureg_DECL_temporary(shader);
#  117|      o_fragment = ureg_DECL_output(shader, TGSI_SEMANTIC_COLOR, 0);
#  118|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def488]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘t_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:84:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_true: following ‘true’ branch (when ‘i == median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:78: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: danger: ‘t_array + (long unsigned int)(j + 4294967295) * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  147|         }
#  148|         if (i == median)
#  149|->          ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|            ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def489]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_true: following ‘true’ branch (when ‘i == median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:78: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: danger: use of uninitialized value ‘*<unknown>’ here
#  147|         }
#  148|         if (i == median)
#  149|->          ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|            ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def490]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘t_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:84:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: following ‘false’ branch (when ‘i != median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:82: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: danger: ‘t_array + (long unsigned int)(j + 4294967295) * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/1)
#  149|            ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|->          ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  152|      }
#  153|      ureg_MOV(shader, o_fragment, ureg_src(t_array[median]));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def491]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: following ‘false’ branch (when ‘i != median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:82: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: danger: use of uninitialized value ‘*<unknown>’ here
#  149|            ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|->          ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  152|      }
#  153|      ureg_MOV(shader, o_fragment, ureg_src(t_array[median]));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def492]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:773:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:750:1: enter_function: entry to ‘vl_mpeg12_end_frame’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:769:10: call_function: calling ‘vl_mpeg12_get_decode_buffer’ from ‘vl_mpeg12_end_frame’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:769:10: return_function: returning to ‘vl_mpeg12_end_frame’ from ‘vl_mpeg12_get_decode_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:773:8: danger: dereference of NULL ‘vl_mpeg12_get_decode_buffer(decoder,  target)’
#  771|      vl_vb_unmap(&buf->vertex_stream, dec->context);
#  772|   
#  773|->    if (buf->tex_transfer)
#  774|         dec->context->texture_unmap(dec->context, buf->tex_transfer);
#  775|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def493]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:509:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:486:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:487:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:490:44: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:500:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:501:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:500:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:501:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:500:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:501:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:500:16: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:504:11: branch_false: following ‘false’ branch (when ‘i == 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:509:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_video_buffer.c:509:11: danger: ‘buffer’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  507|      }
#  508|   
#  509|->    return &buffer->base;
#  510|   }
#  511|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def494]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:225:11: warning[-Wanalyzer-malloc-leak]: leak of ‘scrn’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:166:1: enter_function: entry to ‘vl_kopper_screen_create_x11’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:170:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:171:7: branch_false: following ‘false’ branch (when ‘scrn’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:174:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:228:4: call_function: calling ‘vl_kopper_screen_destroy’ from ‘vl_kopper_screen_create_x11’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:228:4: return_function: returning to ‘vl_kopper_screen_create_x11’ from ‘vl_kopper_screen_destroy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_winsys_kopper.c:225:11: danger: ‘scrn’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  223|      vl_compositor_reset_dirty_area(&scrn->dirty_area);
#  224|   
#  225|->    return &scrn->base;
#  226|   
#  227|   error:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def495]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:82:19: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘o_vtex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#   80|   
#   81|      for (i = 0; i < zscan->num_channels; ++i)
#   82|->       o_vtex[i] = ureg_DECL_output(shader, TGSI_SEMANTIC_GENERIC, VS_O_VTEX + i);
#   83|   
#   84|      /*

Error: GCC_ANALYZER_WARNING (CWE-476): [#def496]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:148:17: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vtex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#  146|   
#  147|      for (i = 0; i < zscan->num_channels; ++i)
#  148|->       vtex[i] = ureg_DECL_fs_input(shader, TGSI_SEMANTIC_GENERIC, VS_O_VTEX + i, TGSI_INTERPOLATE_LINEAR);
#  149|   
#  150|      samp_src = ureg_DECL_sampler(shader, 0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def497]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:155:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tmp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#  153|   
#  154|      for (i = 0; i < zscan->num_channels; ++i)
#  155|->       tmp[i] = ureg_DECL_temporary(shader);
#  156|      quant = ureg_DECL_temporary(shader);
#  157|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def498]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:166:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vtex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#  164|       */
#  165|      for (i = 0; i < zscan->num_channels; ++i)
#  166|->       ureg_TEX(shader, ureg_writemask(tmp[i], TGSI_WRITEMASK_X), TGSI_TEXTURE_2D, vtex[i], samp_scan);
#  167|   
#  168|      for (i = 0; i < zscan->num_channels; ++i)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def499]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:166:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#  164|       */
#  165|      for (i = 0; i < zscan->num_channels; ++i)
#  166|->       ureg_TEX(shader, ureg_writemask(tmp[i], TGSI_WRITEMASK_X), TGSI_TEXTURE_2D, vtex[i], samp_scan);
#  167|   
#  168|      for (i = 0; i < zscan->num_channels; ++i)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def500]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:177:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tmp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#  175|   
#  176|      ureg_MUL(shader, quant, ureg_src(quant), ureg_imm1f(shader, 16.0f));
#  177|->    ureg_MUL(shader, fragment, ureg_src(tmp[0]), ureg_src(quant));
#  178|   
#  179|      for (i = 0; i < zscan->num_channels; ++i)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def501]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:177:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*tmp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:380:1: enter_function: entry to ‘vl_zscan_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_zscan.c:394:8: call_function: calling ‘init_shaders’ from ‘vl_zscan_init’
#  175|   
#  176|      ureg_MUL(shader, quant, ureg_src(quant), ureg_imm1f(shader, 16.0f));
#  177|->    ureg_MUL(shader, fragment, ureg_src(tmp[0]), ureg_src(quant));
#  178|   
#  179|      for (i = 0; i < zscan->num_channels; ++i)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def502]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:618:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:657:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:703:27: call_function: inlined call to ‘agx_lookup_bo’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:724:10: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:724:10: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
#  616|         return;
#  617|   
#  618|->    syncs[(*count)++] = (struct drm_asahi_sync){
#  619|         .sync_type = DRM_ASAHI_SYNC_SYNCOBJ,
#  620|         .handle = handle,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def503]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:727:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shared_bos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:658:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:703:27: call_function: inlined call to ‘agx_lookup_bo’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:724:10: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:727:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:727:10: danger: ‘shared_bos + (long unsigned int)shared_bo_count * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  725|   
#  726|            /* And keep track of the BO for cloning the out_sync */
#  727|->          shared_bos[shared_bo_count++] = bo;
#  728|            if (dev->is_virtio)
#  729|               virt.extres_count++;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def504]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:743:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shared_bos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:658:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:703:27: call_function: inlined call to ‘agx_lookup_bo’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:705:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:735:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:742:13: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:743:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:743:13: danger: ‘shared_bos + (long unsigned int)shared_bo_count * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  741|   
#  742|               agx_add_sync(syncs, &in_sync_count, agx_bo_writer_syncobj(writer));
#  743|->             shared_bos[shared_bo_count++] = NULL;
#  744|            }
#  745|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def505]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:778:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:657:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: following ‘true’ branch (when ‘wait_seqid != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:776:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:778:7: danger: ‘syncs + (long unsigned int)in_sync_count * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/1)
#  776|         batch_debug(batch, "Waits on inter-context sync point %" PRIu64,
#  777|                     wait_seqid);
#  778|->       syncs[in_sync_count++] = (struct drm_asahi_sync){
#  779|            .sync_type = DRM_ASAHI_SYNC_TIMELINE_SYNCOBJ,
#  780|            .handle = screen->flush_syncobj,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def506]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:806:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘out_syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:657:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_false: following ‘false’ branch (when ‘wait_seqid == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:804:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:806:4: danger: ‘out_syncs’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/1)
#  804|      struct drm_asahi_sync *out_syncs = syncs + in_sync_count;
#  805|   
#  806|->    out_syncs[0] = (struct drm_asahi_sync){
#  807|         .sync_type = DRM_ASAHI_SYNC_SYNCOBJ,
#  808|         .handle = batch->syncobj,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def507]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_false: following ‘false’ branch (when ‘wait_seqid == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:804:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:819:4: call_function: inlined call to ‘util_dynarray_init’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:821:7: branch_true: following ‘true’ branch (when ‘compute’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: return_function: returning to ‘agx_batch_submit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&cmdbuf, 1, 8)’
#  823|         struct drm_asahi_cmd_header header = agx_cmd_header(true, 0, 0);
#  824|   
#  825|->       util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_header, header);
#  826|         util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_compute, *compute);
#  827|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def508]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_false: following ‘false’ branch (when ‘wait_seqid == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:804:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:819:4: call_function: inlined call to ‘util_dynarray_init’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:821:7: branch_true: following ‘true’ branch (when ‘compute’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: return_function: returning to ‘agx_batch_submit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: return_function: returning to ‘agx_batch_submit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: danger: argument 1 (‘util_dynarray_grow_bytes(&cmdbuf, 1, 64)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  824|   
#  825|         util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_header, header);
#  826|->       util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_compute, *compute);
#  827|      }
#  828|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def509]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_disk_cache.c:95:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_disk_cache.c:94:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_disk_cache.c:95:4: danger: ‘binary’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   93|   {
#   94|      struct agx_compiled_shader *binary = CALLOC_STRUCT(agx_compiled_shader);
#   95|->    binary->stage = uncompiled->type;
#   96|      binary->so = uncompiled;
#   97|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def510]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_bindings.c:148:62: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_bindings.c:158:1: enter_function: entry to ‘agx_nir_lower_bindings’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_bindings.c:169:16: call_function: calling ‘nir_shader_instructions_pass’ from ‘agx_nir_lower_bindings’
#  146|         index = nir_umin(
#  147|            b, index,
#  148|->          nir_imm_intN_t(b, b->shader->info.num_textures - 1, index->bit_size));
#  149|   
#  150|         nir_tex_instr_add_src(tex, nir_tex_src_texture_handle,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def511]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:281:1: enter_function: entry to ‘record_loads’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘record_loads’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: return_function: returning to ‘record_loads’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct state *)data.loads, 1, 8)’
#  303|      }
#  304|   
#  305|->    util_dynarray_append(&state->loads, nir_intrinsic_instr *, intr);
#  306|      return false;
#  307|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def512]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:987:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘transfer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:903:1: enter_function: entry to ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: call_function: calling ‘agx_prepare_for_map’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: return_function: returning to ‘agx_transfer_map’ from ‘agx_prepare_for_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:939:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: call_function: calling ‘pipe_resource_reference’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: return_function: returning to ‘agx_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:947:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:982:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:987:7: danger: ‘transfer’ could be NULL: unchecked value from [(35)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/34)
#  985|            rsrc->layout.format, transfer->base.stride, box->height);
#  986|   
#  987|->       transfer->map = calloc(transfer->base.layer_stride, box->depth);
#  988|   
#  989|         if ((usage & PIPE_MAP_READ) && agx_resource_valid(rsrc, level)) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def513]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:1000:14: warning[-Wanalyzer-malloc-leak]: leak of ‘transfer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:903:1: enter_function: entry to ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: call_function: calling ‘agx_prepare_for_map’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: return_function: returning to ‘agx_transfer_map’ from ‘agx_prepare_for_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:939:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: call_function: calling ‘pipe_resource_reference’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: return_function: returning to ‘agx_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:947:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:982:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:1000:14: danger: ‘transfer’ leaks here; was allocated at [(35)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/34)
#  998|         }
#  999|   
# 1000|->       return transfer->map;
# 1001|      } else {
# 1002|         assert(rsrc->modifier == DRM_FORMAT_MOD_LINEAR);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def514]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:149:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:147:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:149:4: danger: ‘query’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  147|      struct agx_query *query = calloc(1, sizeof(struct agx_query));
#  148|   
#  149|->    query->type = query_type;
#  150|      query->index = index;
#  151|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def515]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:548:1: enter_function: entry to ‘agx_batch_add_timestamp_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:550:7: branch_true: following ‘true’ branch (when ‘q’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:551:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_add_timestamp_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: return_function: returning to ‘agx_batch_add_timestamp_query’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*batch.timestamps, 1, 16)’
#  550|      if (q) {
#  551|         agx_add_query_to_batch(batch, q);
#  552|->       util_dynarray_append(&batch->timestamps, struct agx_ptr, q->ptr);
#  553|      }
#  554|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def516]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:1516:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘compiled’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2155:1: enter_function: entry to ‘asahi_fast_link’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2166:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2175:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2175:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2181:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2180:16: call_function: calling ‘agx_build_meta_shader_internal’ from ‘asahi_fast_link’
# 1514|   {
# 1515|      struct agx_compiled_shader *compiled = CALLOC_STRUCT(agx_compiled_shader);
# 1516|->    compiled->stage = stage;
# 1517|      if (attrib_components_read)
# 1518|         BITSET_COPY(compiled->attrib_components_read, attrib_components_read);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def517]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:99:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:535:1: enter_function: entry to ‘crocus_fence_signal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:542:25: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:543:28: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:544:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:547:14: call_function: inlined call to ‘crocus_fine_fence_signaled’ from ‘crocus_fence_signal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:551:10: call_function: calling ‘crocus_batch_add_syncobj’ from ‘crocus_fence_signal’
#   97|         util_dynarray_grow(&batch->exec_fences, struct drm_i915_gem_exec_fence, 1);
#   98|   
#   99|->    *fence = (struct drm_i915_gem_exec_fence){
#  100|         .handle = syncobj->handle,
#  101|         .flags = flags,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def518]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:107:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:535:1: enter_function: entry to ‘crocus_fence_signal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:542:25: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:543:28: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:544:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:547:14: call_function: inlined call to ‘crocus_fine_fence_signaled’ from ‘crocus_fence_signal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_fence.c:551:10: call_function: calling ‘crocus_batch_add_syncobj’ from ‘crocus_fence_signal’
#  105|         util_dynarray_grow(&batch->syncobjs, struct crocus_syncobj *, 1);
#  106|   
#  107|->    *store = NULL;
#  108|      crocus_syncobj_reference(batch->screen, store, syncobj);
#  109|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def519]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:104:11: warning[-Wanalyzer-malloc-leak]: leak of ‘q’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:94:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:97:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:97:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:98:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:103:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_performance_query.c:104:11: danger: ‘q’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  102|   
#  103|      q->query = obj;
#  104|->    return (struct pipe_query *)&q->base;
#  105|   }
#  106|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def520]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:267:37: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:281:1: enter_function: entry to ‘crocus_lower_storage_image_derefs_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:294:32: call_function: inlined call to ‘nir_src_as_deref’ from ‘crocus_lower_storage_image_derefs_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:295:27: call_function: calling ‘nir_deref_instr_get_variable’ from ‘crocus_lower_storage_image_derefs_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:295:27: return_function: returning to ‘crocus_lower_storage_image_derefs_instr’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:299:10: call_function: calling ‘get_aoa_deref_offset’ from ‘crocus_lower_storage_image_derefs_instr’
#  265|         deref = nir_deref_instr_parent(deref);
#  266|         assert(glsl_type_is_array(deref->type));
#  267|->       array_size *= glsl_get_length(deref->type);
#  268|      }
#  269|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def521]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2895:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘crocus_create_uncompiled_shader(ctx, *state.prog, 0)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2885:1: enter_function: entry to ‘crocus_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2893:7: call_function: calling ‘crocus_create_uncompiled_shader’ from ‘crocus_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2893:7: return_function: returning to ‘crocus_create_compute_state’ from ‘crocus_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2895:4: danger: dereference of NULL ‘crocus_create_uncompiled_shader(ctx, *state.prog, 0)’
# 2893|         crocus_create_uncompiled_shader(ctx, (void *) state->prog, NULL);
# 2894|   
# 2895|->    ish->nos |= (1ull << CROCUS_NOS_TEXTURES);
# 2896|      // XXX: disallow more than 64KB of shared variables
# 2897|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def522]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_query.c:475:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘q’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_query.c:473:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_query.c:475:4: danger: ‘q’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  473|      struct crocus_query *q = calloc(1, sizeof(struct crocus_query));
#  474|   
#  475|->    q->type = query_type;
#  476|      q->index = index;
#  477|      q->monitor = NULL;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def523]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1910:11: warning[-Wanalyzer-malloc-leak]: leak of ‘memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1869:42: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1873:7: branch_false: following ‘false’ branch (when ‘memobj’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1876:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1900:7: branch_false: following ‘false’ branch (when ‘bo’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1905:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_resource.c:1910:11: danger: ‘memobj’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 1908|      memobj->stride = whandle->stride;
# 1909|   
# 1910|->    return &memobj->b;
# 1911|   }
# 1912|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def524]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:5481:48: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘shs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:5851:1: enter_function: entry to ‘crocus_upload_dirty_render_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6258:24: branch_true: following ‘true’ branch (when ‘stage != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6259:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6258:24: branch_false: following ‘false’ branch (when ‘stage == 5’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6282:24: branch_true: following ‘true’ branch (when ‘stage != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6283:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6282:24: branch_true: following ‘true’ branch (when ‘stage != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6283:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6283:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6284:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6284:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6301:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6301:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6303:13: call_function: calling ‘crocus_populate_binding_table’ from ‘crocus_upload_dirty_render_state’
# 5479|         if (shs->ssbo[i].buffer)
# 5480|            surf_offsets[s] = emit_ssbo_buffer(ice, batch, &shs->ssbo[i],
# 5481|->                                             !!(shs->writable_ssbos & (1 << i)));
# 5482|         else
# 5483|            emit_null_surface(batch, &surf_offsets[s]);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def525]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6068:29: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘urb_cfg.size[3]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6028:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6046:50: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6051:40: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6052:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6051:40: branch_false: following ‘false’ branch (when ‘i == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6066:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6066:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6067:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6066:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6068:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6068:29: danger: use of uninitialized value ‘urb_cfg.size[3]’ here
# 6066|         if (ice->urb.vsize == urb_cfg.size[MESA_SHADER_VERTEX] &&
# 6067|             ice->urb.gs_present == gs_present &&
# 6068|->           ice->urb.gsize == urb_cfg.size[MESA_SHADER_GEOMETRY] &&
# 6069|             ice->urb.tess_present == tess_present &&
# 6070|             ice->urb.hsize == urb_cfg.size[MESA_SHADER_TESS_CTRL] &&

Error: GCC_ANALYZER_WARNING (CWE-457): [#def526]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6078:27: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘urb_cfg.size[3]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6028:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6046:50: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6051:40: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6052:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6051:40: branch_false: following ‘false’ branch (when ‘i == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6066:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_state.c:6078:27: danger: use of uninitialized value ‘urb_cfg.size[3]’ here
# 6076|            ice->urb.vsize = urb_cfg.size[MESA_SHADER_VERTEX];
# 6077|            ice->urb.gs_present = gs_present;
# 6078|->          ice->urb.gsize = urb_cfg.size[MESA_SHADER_GEOMETRY];
# 6079|            ice->urb.tess_present = tess_present;
# 6080|            ice->urb.hsize = urb_cfg.size[MESA_SHADER_TESS_CTRL];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def527]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1309:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1172:1: enter_function: entry to ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1174:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1177:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1178:7: branch_false: following ‘false’ branch (when ‘c’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1181:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1204:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1212:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1227:7: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1309:23: call_function: calling ‘nir_shader_get_entrypoint’ from ‘etna_compile_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1309:23: return_function: returning to ‘etna_compile_shader’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir.c:1309:23: danger: dereference of NULL ‘nir_shader_get_entrypoint(nir_shader_clone(0, *v_128(D)->shader.nir))’
# 1307|         nir_print_shader(s, stdout);
# 1308|   
# 1309|->    unsigned block_ptr[nir_shader_get_entrypoint(s)->num_blocks];
# 1310|      c->block_ptr = block_ptr;
# 1311|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def528]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:139:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:116:1: enter_function: entry to ‘etna_ra_assign’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:121:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘etna_ra_assign’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:121:30: return_function: returning to ‘etna_ra_assign’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:128:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘etna_ra_assign’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:128:4: return_function: returning to ‘etna_ra_assign’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:128:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:139:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_compiler_nir_ra.c:139:13: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#  137|       * (some ssa values do not represent an allocated register)
#  138|       */
#  139|->    unsigned max_nodes = impl->ssa_alloc;
#  140|      unsigned *live_map = ralloc_array(NULL, unsigned, max_nodes);
#  141|      memset(live_map, 0xff, sizeof(unsigned) * max_nodes);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def529]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:103:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:77:1: enter_function: entry to ‘etna_etc2_calculate_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:98:25: branch_true: following ‘true’ branch (when ‘y < height’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:101:28: branch_true: following ‘true’ branch (when ‘x < width’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:102:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:102:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:103:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:103:13: call_function: calling ‘util_dynarray_grow_bytes’ from ‘etna_etc2_calculate_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:103:13: return_function: returning to ‘etna_etc2_calculate_blocks’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_etc2.c:103:13: danger: dereference of NULL ‘util_dynarray_grow_bytes(offsets, 1, 4)’
#  101|         for (unsigned x = 0; x < width; x += bw) {
#  102|            if (needs_patching(src + offset, punchthrough_alpha))
#  103|->             util_dynarray_append(offsets, unsigned, src + offset - base);
#  104|   
#  105|            src += bs;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def530]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:331:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:520:1: enter_function: entry to ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:530:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:535:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:544:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:544:9: return_function: returning to ‘etna_ml_subgraph_create’ from ‘util_dynarray_resize_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:544:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:546:55: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:549:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:549:9: return_function: returning to ‘etna_ml_subgraph_create’ from ‘util_dynarray_resize_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:549:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:551:55: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:554:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:554:9: return_function: returning to ‘etna_ml_subgraph_create’ from ‘util_dynarray_resize_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:554:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:556:53: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:558:4: call_function: calling ‘lower_operations’ from ‘etna_ml_subgraph_create’
#  329|   
#  330|               struct etna_operation *operation = calloc(1, sizeof(*operation));
#  331|->             operation->type = ETNA_JOB_TYPE_CONCAT;
#  332|               assert(poperation->input_count <= MAX_TENSORS);
#  333|               unsigned input_size = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def531]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:372:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:520:1: enter_function: entry to ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:530:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:535:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:544:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:544:9: return_function: returning to ‘etna_ml_subgraph_create’ from ‘util_dynarray_resize_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:544:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:546:55: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:549:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:549:9: return_function: returning to ‘etna_ml_subgraph_create’ from ‘util_dynarray_resize_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:549:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:551:55: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:554:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘etna_ml_subgraph_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:554:9: return_function: returning to ‘etna_ml_subgraph_create’ from ‘util_dynarray_resize_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:554:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:556:53: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:558:4: call_function: calling ‘lower_operations’ from ‘etna_ml_subgraph_create’
#  370|            case PIPE_ML_OPERATION_TYPE_SPLIT: {
#  371|               struct etna_operation *operation = calloc(1, sizeof(*operation));
#  372|->             operation->type = ETNA_JOB_TYPE_SPLIT;
#  373|   
#  374|               operation->input_tensors[0] = poperation->input_tensors[1]->index;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def532]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:598:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fopen(&buffer, "wb")’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:596:14: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:598:4: danger: argument 4 (‘fopen(&buffer, "wb")’) from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#  596|      FILE *f = fopen(buffer, "wb");
#  597|      assert(f);
#  598|->    fwrite(ptr + offset, 1, size, f);
#  599|      if(ferror(f)) {
#  600|         ML_DBG("Error in writing to file: %s\n", strerror(errno));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def533]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:452:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:439:1: enter_function: entry to ‘etna_pm_query_setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:443:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:446:25: branch_true: following ‘true’ branch (when ‘i != 47’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:449:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:449:12: call_function: inlined call to ‘etna_pm_cfg_supported’ from ‘etna_pm_query_setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:449:12: call_function: inlined call to ‘etna_pm_cfg_supported’ from ‘etna_pm_query_setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:449:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:452:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:452:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘etna_pm_query_setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:452:7: return_function: returning to ‘etna_pm_query_setup’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_perfmon.c:452:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*screen.supported_pm_queries, 1, 4)’
#  450|            continue;
#  451|   
#  452|->       util_dynarray_append(&screen->supported_pm_queries, unsigned, i);
#  453|      }
#  454|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def534]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:121:11: warning[-Wanalyzer-malloc-leak]: leak of ‘pq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:108:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:111:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:111:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:114:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:114:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:115:7: branch_false: following ‘false’ branch (when ‘pq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:118:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_acc_perfmon.c:121:11: danger: ‘pq’ leaks here; was allocated at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  119|      pq->multiply_with_8 = cfg->multiply_with_8;
#  120|   
#  121|->    return &pq->base;
#  122|   }
#  123|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def535]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_sw.c:117:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_sw.c:111:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_sw.c:112:7: branch_false: following ‘false’ branch (when ‘sq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_sw.c:115:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_query_sw.c:117:4: danger: ‘sq’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  115|      q = &sq->base;
#  116|      q->funcs = &sw_query_funcs;
#  117|->    q->type = query_type;
#  118|   
#  119|      return q;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def536]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:178:11: warning[-Wanalyzer-malloc-leak]: leak of ‘surf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:83:1: enter_function: entry to ‘etna_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:92:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:94:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:100:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:103:4: call_function: calling ‘pipe_resource_reference’ from ‘etna_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:103:4: return_function: returning to ‘etna_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:104:4: call_function: calling ‘pipe_resource_reference’ from ‘etna_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:104:4: return_function: returning to ‘etna_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_surface.c:178:11: danger: ‘surf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  176|      }
#  177|   
#  178|->    return &surf->base;
#  179|   }
#  180|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def537]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:61:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:49:1: enter_function: entry to ‘emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:60:7: branch_true: following ‘true’ branch (when ‘patches’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:61:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:61:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:61:7: return_function: returning to ‘emit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_program.c:61:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(patches, 1, 8)’
#   59|   
#   60|      if (patches)
#   61|->       util_dynarray_append(patches, uint32_t *,
#   62|                              &ring->cur[info->mem_export_ptr]);
#   63|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def538]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_query.c:157:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_query.c:154:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_query.c:157:4: danger: ‘data’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  155|         fd_batch_query_data, num_queries * sizeof(data->query_entries[0]));
#  156|   
#  157|->    data->screen = screen;
#  158|      data->num_query_entries = num_queries;
#  159|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def539]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:136:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:339:1: enter_function: entry to ‘assemble’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:372:27: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:373:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:376:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:395:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_assemble.c:395:7: call_function: calling ‘fill_instr’ from ‘assemble’
#  134|   src_to_reg(struct ir2_context *ctx, struct ir2_src *src)
#  135|   {
#  136|->    return get_reg_src(ctx, src)->idx;
#  137|   }
#  138|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def540]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:170:23: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘c[i]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:83:1: enter_function: entry to ‘cp_export’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:90:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:90:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:90:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:90:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:90:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:91:12: call_function: inlined call to ‘is_export’ from ‘cp_export’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:94:12: call_function: calling ‘is_mov’ from ‘cp_export’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:94:12: return_function: returning to ‘cp_export’ from ‘is_mov’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:94:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:99:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:99:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:102:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:105:13: call_function: inlined call to ‘get_reg_src’ from ‘cp_export’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:106:15: call_function: calling ‘dst_ncomp’ from ‘cp_export’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:106:15: return_function: returning to ‘cp_export’ from ‘dst_ncomp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:127:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:127:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:127:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:127:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:127:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:128:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:128:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:128:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:162:13: branch_true: following ‘true’ branch (when ‘ok != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:169:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:169:23: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:170:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_cp.c:170:23: danger: use of uninitialized value ‘c[i]’ here
#  168|         /* must all be in same block */
#  169|         for (int i = 0; i < ncomp; i++)
#  170|->          redirect &= (c[i]->block_idx == instr->block_idx);
#  171|   
#  172|         /* no other instr using the value */

Error: GCC_ANALYZER_WARNING (CWE-457): [#def541]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:153:17: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1117:1: enter_function: entry to ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1125:7: branch_false: following ‘false’ branch (when ‘binning == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1128:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1134:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1136:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1164:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1164:4: branch_false: following ‘false’ branch (when ‘in’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1167:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1167:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1169:21: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1174:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1175:7: call_function: calling ‘update_range’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1175:7: return_function: returning to ‘ir2_nir_compile’ from ‘update_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1184:29: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1184:29: return_function: returning to ‘ir2_nir_compile’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: call_function: calling ‘nir_next_decl_reg’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: return_function: returning to ‘ir2_nir_compile’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: branch_false: following ‘false’ branch (when ‘decl’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1192:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1193:4: call_function: calling ‘emit_cf_list’ from ‘ir2_nir_compile’
#  151|         for (i = 0; i < ncomp; i++) {
#  152|            for (j = 0; j < imm_ncomp; j++) {
#  153|->             if (value[i] == so->immediates[idx].val[j])
#  154|                  break;
#  155|            }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def542]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:159:52: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1117:1: enter_function: entry to ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1125:7: branch_false: following ‘false’ branch (when ‘binning == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1128:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1134:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1136:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1164:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1164:4: branch_false: following ‘false’ branch (when ‘in’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1167:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1167:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1169:21: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1174:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1175:7: call_function: calling ‘update_range’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1175:7: return_function: returning to ‘ir2_nir_compile’ from ‘update_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1184:29: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1184:29: return_function: returning to ‘ir2_nir_compile’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: call_function: calling ‘nir_next_decl_reg’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: return_function: returning to ‘ir2_nir_compile’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: branch_false: following ‘false’ branch (when ‘decl’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1192:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1193:4: call_function: calling ‘emit_cf_list’ from ‘ir2_nir_compile’
#  157|               if (j == 4)
#  158|                  break;
#  159|->             so->immediates[idx].val[imm_ncomp++] = value[i];
#  160|            }
#  161|            swiz |= swiz_set(j, i);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def543]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:178:52: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1117:1: enter_function: entry to ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1125:7: branch_false: following ‘false’ branch (when ‘binning == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1128:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1134:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1136:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1164:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1164:4: branch_false: following ‘false’ branch (when ‘in’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1167:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1167:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1169:21: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1174:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1175:7: call_function: calling ‘update_range’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1175:7: return_function: returning to ‘ir2_nir_compile’ from ‘update_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1184:29: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1184:29: return_function: returning to ‘ir2_nir_compile’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: call_function: calling ‘nir_next_decl_reg’ from ‘ir2_nir_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: return_function: returning to ‘ir2_nir_compile’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1186:4: branch_false: following ‘false’ branch (when ‘decl’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1192:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_nir.c:1193:4: call_function: calling ‘emit_cf_list’ from ‘ir2_nir_compile’
#  176|            }
#  177|            if (j == imm_ncomp) {
#  178|->             so->immediates[idx].val[imm_ncomp++] = value[i];
#  179|            }
#  180|            swiz |= swiz_set(j, i);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def544]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:193:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:179:1: enter_function: entry to ‘ra_src_free’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:185:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:185:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:188:13: call_function: inlined call to ‘get_reg_src’ from ‘ra_src_free’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:191:23: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:192:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:193:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:193:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/ir2_ra.c:193:36: danger: dereference of NULL ‘<unknown>’
#  191|         for (int i = 0; i < src_ncomp(instr); i++) {
#  192|            comp = &reg->comp[swiz_get(src->swizzle, i)];
#  193|->          if (!--comp->ref_count && reg->block_idx_free < 0) {
#  194|               reg_freemask(ctx, reg->idx, comp->c);
#  195|               comp->alloc = false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def545]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_gmem.c:113:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_gmem.c:987:1: enter_function: entry to ‘fd3_emit_tile_renderprep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_gmem.c:1023:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_gmem.c:1043:7: call_function: inlined call to ‘OUT_PKT0’ from ‘fd3_emit_tile_renderprep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_gmem.c:1052:4: call_function: calling ‘emit_mrt’ from ‘fd3_emit_tile_renderprep’
#  111|            OUT_RING(ring, A3XX_RB_MRT_BUF_BASE_COLOR_BUF_BASE(base));
#  112|         } else {
#  113|->          OUT_RELOC(ring, rsc->bo, offset, 0, -1);
#  114|         }
#  115|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def546]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_program.c:448:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_program.c:444:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_program.c:448:4: danger: ‘state’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  446|      tc_assert_driver_thread(ctx->tc);
#  447|   
#  448|->    state->bs = bs;
#  449|      state->vs = vs;
#  450|      state->fs = fs;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def547]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_program.c:452:11: warning[-Wanalyzer-malloc-leak]: leak of ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_program.c:444:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_program.c:452:11: danger: ‘state’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  450|      state->fs = fs;
#  451|   
#  452|->    return &state->base;
#  453|   }
#  454|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def548]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:195:11: warning[-Wanalyzer-malloc-leak]: leak of ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:131:1: enter_function: entry to ‘fd3_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:134:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:138:7: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:141:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:142:4: call_function: inlined call to ‘pipe_reference’ from ‘fd3_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:142:4: call_function: inlined call to ‘pipe_reference’ from ‘fd3_sampler_view_create’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:148:20: call_function: inlined call to ‘A3XX_TEX_CONST_0_TYPE’ from ‘fd3_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:158:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:167:13: call_function: inlined call to ‘fd_sampler_first_level’ from ‘fd3_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:168:19: call_function: inlined call to ‘fd_sampler_last_level’ from ‘fd3_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:168:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_texture.c:195:11: danger: ‘so’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  193|      }
#  194|   
#  195|->    return &so->base;
#  196|   }
#  197|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def549]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_gmem.c:116:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_gmem.c:522:1: enter_function: entry to ‘fd4_emit_sysmem_prep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_gmem.c:533:4: call_function: calling ‘emit_mrt’ from ‘fd4_emit_sysmem_prep’
#  114|            OUT_RING(ring, A4XX_RB_MRT_CONTROL3_STRIDE(stride));
#  115|         } else {
#  116|->          OUT_RELOC(ring, rsc->bo, offset, 0, 0);
#  117|            /* RB_MRT[i].CONTROL3.STRIDE not emitted by c2d..
#  118|             * not sure if we need to skip it for bypass or

Error: GCC_ANALYZER_WARNING (CWE-457): [#def550]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:111:26: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘s[1].instrlen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:136:1: enter_function: entry to ‘fd4_program_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:152:4: call_function: calling ‘setup_stages’ from ‘fd4_program_emit’
#  109|       * is run from external memory.
#  110|       */
#  111|->    if ((s[VS].instrlen + s[FS].instrlen) > 64) {
#  112|         /* prioritize FS for internal memory: */
#  113|         if (s[FS].instrlen < 64) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def551]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:576:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:572:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:576:4: danger: ‘state’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  574|      tc_assert_driver_thread(ctx->tc);
#  575|   
#  576|->    state->bs = bs;
#  577|      state->vs = vs;
#  578|      state->fs = fs;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def552]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:580:11: warning[-Wanalyzer-malloc-leak]: leak of ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:572:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_program.c:580:11: danger: ‘state’ leaks here; was allocated at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  578|      state->fs = fs;
#  579|   
#  580|->    return &state->base;
#  581|   }
#  582|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def553]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:212:11: warning[-Wanalyzer-malloc-leak]: leak of ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:118:1: enter_function: entry to ‘fd4_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:121:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:126:7: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:129:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:135:4: call_function: inlined call to ‘pipe_reference’ from ‘fd4_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:135:4: call_function: inlined call to ‘pipe_reference’ from ‘fd4_sampler_view_create’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:143:20: call_function: inlined call to ‘A4XX_TEX_CONST_0_TYPE’ from ‘fd4_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:153:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:154:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a4xx/fd4_texture.c:212:11: danger: ‘so’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  210|      }
#  211|   
#  212|->    return &so->base;
#  213|   }
#  214|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def554]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:95:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:699:1: enter_function: entry to ‘fd5_emit_sysmem_prep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:706:4: call_function: calling ‘fd5_emit_lrz_flush’ from ‘fd5_emit_sysmem_prep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:706:4: return_function: returning to ‘fd5_emit_sysmem_prep’ from ‘fd5_emit_lrz_flush’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:714:4: call_function: calling ‘fd5_event_write’ from ‘fd5_emit_sysmem_prep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:714:4: return_function: returning to ‘fd5_emit_sysmem_prep’ from ‘fd5_event_write’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:732:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:737:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_gmem.c:761:4: call_function: calling ‘emit_mrt’ from ‘fd5_emit_sysmem_prep’
#   93|            OUT_RING(ring, 0x00000000); /* RB_MRT[i].BASE_HI */
#   94|         } else {
#   95|->          OUT_RELOC(ring, rsc->bo, offset, 0, 0); /* BASE_LO/HI */
#   96|         }
#   97|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def555]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:208:26: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘s[1].instrlen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:243:1: enter_function: entry to ‘fd5_program_emit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:256:4: call_function: calling ‘setup_stages’ from ‘fd5_program_emit’
#  206|       * is run from external memory.
#  207|       */
#  208|->    if ((s[VS].instrlen + s[FS].instrlen) > 64) {
#  209|         /* prioritize FS for internal memory: */
#  210|         if (s[FS].instrlen < 64) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def556]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:746:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:742:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:746:4: danger: ‘state’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  744|      tc_assert_driver_thread(ctx->tc);
#  745|   
#  746|->    state->bs = bs;
#  747|      state->vs = vs;
#  748|      state->fs = fs;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def557]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:750:11: warning[-Wanalyzer-malloc-leak]: leak of ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:742:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_program.c:750:11: danger: ‘state’ leaks here; was allocated at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  748|      state->fs = fs;
#  749|   
#  750|->    return &state->base;
#  751|   }
#  752|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def558]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_query.c:372:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_query.c:369:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_query.c:372:4: danger: ‘data’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  370|         fd_batch_query_data, num_queries * sizeof(data->query_entries[0]));
#  371|   
#  372|->    data->screen = screen;
#  373|      data->num_query_entries = num_queries;
#  374|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def559]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:209:11: warning[-Wanalyzer-malloc-leak]: leak of ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:111:1: enter_function: entry to ‘fd5_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:114:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:119:7: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:122:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:128:4: call_function: inlined call to ‘pipe_reference’ from ‘fd5_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:128:4: call_function: inlined call to ‘pipe_reference’ from ‘fd5_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:155:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:156:27: branch_true: ...to here
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:178:21: call_function: inlined call to ‘A5XX_TEX_CONST_2_TYPE’ from ‘fd5_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a5xx/fd5_texture.c:209:11: danger: ‘so’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  207|      }
#  208|   
#  209|->    return &so->base;
#  210|   }
#  211|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def560]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:257:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:446:1: enter_function: entry to ‘fd_batch_add_dep’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:458:21: release_memory: ‘other’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:459:4: call_function: calling ‘fd_batch_reference_locked’ from ‘fd_batch_add_dep’
#  255|   __fd_batch_destroy_locked(struct fd_batch *batch)
#  256|   {
#  257|->    struct fd_context *ctx = batch->ctx;
#  258|   
#  259|      DBG("%p", batch);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def561]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:316:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:597:1: enter_function: entry to ‘fd_batch_check_size’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:599:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:600:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch.c:600:7: call_function: calling ‘fd_batch_flush’ from ‘fd_batch_check_size’
#  314|   __fd_batch_destroy(struct fd_batch *batch)
#  315|   {
#  316|->    struct fd_screen *screen = batch->ctx->screen;
#  317|      fd_screen_lock(screen);
#  318|      __fd_batch_destroy_locked(batch);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def562]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch_cache.c:563:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘key’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch_cache.c:557:1: enter_function: entry to ‘fd_batch_from_fb’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch_cache.c:561:31: call_function: inlined call to ‘key_alloc’ from ‘fd_batch_from_fb’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_batch_cache.c:563:4: danger: ‘key’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  561|      struct fd_batch_key *key = key_alloc(n);
#  562|   
#  563|->    key->width = pfb->width;
#  564|      key->height = pfb->height;
#  565|      key->layers = pfb->layers;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def563]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_context.c:232:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘string’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_context.c:229:27: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_context.c:232:4: danger: ‘string’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  230|   
#  231|      /* format: <magic><formatted string>\0 */
#  232|->    *(uint32_t *)string = magic;
#  233|      vsnprintf(string + 4, fmt_len + 1, fmt, args);
#  234|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def564]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_draw.h:73:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_draw.c:153:1: enter_function: entry to ‘fd3_draw_vbos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_draw.c:161:25: branch_true: following ‘true’ branch (when ‘i < num_draws’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_draw.c:162:62: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a3xx/fd3_draw.c:162:7: call_function: calling ‘fd3_draw_vbo’ from ‘fd3_draw_vbos’
#   71|         BEGIN_RING(ring, size + 1);
#   72|         if (vismode)
#   73|->          util_dynarray_append(&batch->draw_patches, uint32_t *, ring->cur);
#   74|   
#   75|         OUT_PKT3(ring, vismode ? CP_DRAW_INDX_BIN : CP_DRAW_INDX, size);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def565]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_fence.c:382:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘fence_create(pctx, 0, -1, 0)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_fence.c:377:1: enter_function: entry to ‘fd_pipe_fence_create_unflushed’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_fence.c:381:7: call_function: calling ‘fence_create’ from ‘fd_pipe_fence_create_unflushed’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_fence.c:381:7: return_function: returning to ‘fd_pipe_fence_create_unflushed’ from ‘fence_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_fence.c:382:4: danger: dereference of NULL ‘fence_create(pctx, 0, -1, 0)’
#  380|      struct pipe_fence_handle *fence =
#  381|         fence_create(fd_context(pctx), NULL, -1, 0);
#  382|->    fence->needs_signal = true;
#  383|      util_queue_fence_reset(&fence->ready);
#  384|      tc_unflushed_batch_token_reference(&fence->tc_token, tc_token);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def566]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:238:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘info’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:228:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:232:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:233:44: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:234:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:235:73: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query.c:238:10: danger: ‘info’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  236|            const struct fd_perfcntr_countable *c = &g->countables[j];
#  237|   
#  238|->          info->name = c->name;
#  239|            info->query_type = FD_QUERY_FIRST_PERFCNTR + idx;
#  240|            info->type = query_type(c->query_type);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def567]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:267:4: warning[-Wanalyzer-malloc-leak]: leak of ‘aq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:253:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:254:7: branch_false: following ‘false’ branch (when ‘aq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:257:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:257:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:259:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_acc.c:267:4: danger: ‘aq’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  265|      q->funcs = &acc_query_funcs;
#  266|      q->type = query_type;
#  267|->    q->index = index;
#  268|   
#  269|      return q;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def568]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:37:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:338:1: enter_function: entry to ‘fd_hw_query_update_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:344:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:345:28: call_function: inlined call to ‘query_active_in_batch’ from ‘fd_hw_query_update_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:349:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:351:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:351:18: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:352:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_hw.c:352:13: call_function: calling ‘pause_query’ from ‘fd_hw_query_update_batch’
#   35|            ctx->hw_sample_providers[idx]->get_sample(batch, ring);
#   36|         fd_hw_sample_reference(ctx, &batch->sample_cache[idx], new_samp);
#   37|->       util_dynarray_append(&batch->samples, struct fd_hw_sample *, new_samp);
#   38|         fd_batch_needs_flush(batch);
#   39|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def569]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_sw.c:182:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_sw.c:176:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_sw.c:177:7: branch_false: following ‘false’ branch (when ‘sq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_sw.c:180:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_query_sw.c:182:4: danger: ‘sq’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  180|      q = &sq->base;
#  181|      q->funcs = &sw_query_funcs;
#  182|->    q->type = query_type;
#  183|   
#  184|      return q;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def570]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1750:11: warning[-Wanalyzer-malloc-leak]: leak of ‘memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1737:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1738:7: branch_false: following ‘false’ branch (when ‘memobj’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1741:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1742:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1747:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_resource.c:1750:11: danger: ‘memobj’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 1748|      memobj->bo = bo;
# 1749|   
# 1750|->    return &memobj->b;
# 1751|   }
# 1752|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def571]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:638:11: warning[-Wanalyzer-malloc-leak]: leak of ‘target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:613:1: enter_function: entry to ‘fd_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:620:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:621:7: branch_false: following ‘false’ branch (when ‘target’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:624:4: call_function: inlined call to ‘pipe_reference_init’ from ‘fd_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:625:4: call_function: calling ‘pipe_resource_reference’ from ‘fd_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:625:4: return_function: returning to ‘fd_create_stream_output_target’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_state.c:638:11: danger: ‘target’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  636|                     buffer_offset + buffer_size);
#  637|   
#  638|->    return &target->base;
#  639|   }
#  640|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def572]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:35:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ptex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:17:1: enter_function: entry to ‘fd_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:22:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:26:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: call_function: calling ‘pipe_resource_reference’ from ‘fd_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: return_function: returning to ‘fd_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:35:8: danger: dereference of NULL ‘ptex’
#   33|      psurf->nr_samples = surf_tmpl->nr_samples;
#   34|   
#   35|->    if (ptex->target == PIPE_BUFFER) {
#   36|         psurf->u.buf.first_element = surf_tmpl->u.buf.first_element;
#   37|         psurf->u.buf.last_element = surf_tmpl->u.buf.last_element;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def573]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:44:11: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:17:1: enter_function: entry to ‘fd_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:20:33: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:22:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:26:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: call_function: calling ‘pipe_resource_reference’ from ‘fd_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: return_function: returning to ‘fd_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:44:11: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#   42|      }
#   43|   
#   44|->    return &surface->base;
#   45|   }
#   46|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def574]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_util.h:326:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_draw.c:537:1: enter_function: entry to ‘fd2_clear’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/a2xx/fd2_draw.c:544:8: call_function: calling ‘fd2_clear_fast’ from ‘fd2_clear’
#  324|             (uint32_t)(ring->cur - ring->start), data);
#  325|      }
#  326|->    util_dynarray_append(buf, struct fd_cs_patch,
#  327|                           ((struct fd_cs_patch){
#  328|                              .cs = ring->cur++,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def575]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:117:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘shaders[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:71:1: enter_function: entry to ‘ir3_cache_lookup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:74:20: call_function: inlined call to ‘key_hash’ from ‘ir3_cache_lookup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:74:20: call_function: inlined call to ‘key_hash’ from ‘ir3_cache_lookup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:78:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:82:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:105:53: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:107:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:107:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:113:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:113:10: release_memory: ‘shaders[(int)stage]’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:105:53: branch_true: following ‘true’ branch (when ‘stage != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:107:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:107:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:109:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:110:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:106:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:105:53: branch_false: following ‘false’ branch (when ‘stage == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:117:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_cache.c:117:25: danger: dereference of NULL ‘ir3_get_shader(*key.vs)’
#  115|      }
#  116|   
#  117|->    struct ir3_compiler *compiler = shaders[MESA_SHADER_VERTEX]->compiler;
#  118|      uint32_t safe_constlens = ir3_trim_constlen(variants, compiler);
#  119|      shader_key.safe_constlen = true;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def576]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_gallium.c:308:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘hwcso’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_gallium.c:305:37: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/ir3/ir3_gallium.c:308:4: danger: ‘hwcso’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  306|   
#  307|      util_queue_fence_init(&hwcso->ready);
#  308|->    hwcso->shader = shader;
#  309|   
#  310|      /* Immediately compile a standard variant.  We have so few variants in our

Error: GCC_ANALYZER_WARNING (CWE-457): [#def577]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:139:14: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘c[i]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:176:1: enter_function: entry to ‘i915_emit_texld’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:199:14: call_function: calling ‘i915_get_temp’ from ‘i915_emit_texld’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:199:14: return_function: returning to ‘i915_emit_texld’ from ‘i915_get_temp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:202:7: call_function: calling ‘i915_emit_arith’ from ‘i915_emit_texld’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:202:7: return_function: returning to ‘i915_emit_texld’ from ‘i915_emit_arith’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:213:7: branch_true: following ‘true’ branch (when ‘destmask != 15360’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:215:22: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:215:22: call_function: calling ‘i915_get_utemp’ from ‘i915_emit_texld’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:215:22: return_function: returning to ‘i915_emit_texld’ from ‘i915_get_utemp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_emit.c:216:7: call_function: calling ‘i915_emit_texld’ from ‘i915_emit_texld’
#  137|         first = GET_UREG_NR(s[c[0]]);
#  138|         for (i = 1; i < nr_const; i++) {
#  139|->          if (GET_UREG_NR(s[c[i]]) != first) {
#  140|               uint32_t tmp = i915_get_utemp(p);
#  141|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def578]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:254:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘o’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:620:1: enter_function: entry to ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:641:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:645:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:647:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: call_function: calling ‘copy_token’ from ‘i915_optimize’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  252|   {
#  253|      if (i->Token.Type != TGSI_TOKEN_TYPE_INSTRUCTION)
#  254|->       memcpy(o, i, sizeof(*o));
#  255|      else
#  256|         copy_instruction(&o->FullInstruction, &i->FullInstruction);

Error: GCC_ANALYZER_WARNING (CWE-122): [#def579]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:278:8: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:620:1: enter_function: entry to ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:645:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:647:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: call_function: calling ‘copy_token’ from ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: return_function: returning to ‘i915_optimize’ from ‘copy_token’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:656:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:658:4: call_function: calling ‘liveness_analysis’ from ‘i915_optimize’
#  276|   {
#  277|      int src_reg_index;
#  278|->    if (src_reg->Register.File == TGSI_FILE_TEMPORARY) {
#  279|         src_reg_index = src_reg->Register.Index;
#  280|         assert(src_reg_index < TGSI_EXEC_NUM_TEMPS);

Error: GCC_ANALYZER_WARNING (CWE-122): [#def580]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:279:23: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:620:1: enter_function: entry to ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:645:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:647:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: call_function: calling ‘copy_token’ from ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: return_function: returning to ‘i915_optimize’ from ‘copy_token’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:656:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:658:4: call_function: calling ‘liveness_analysis’ from ‘i915_optimize’
#  277|      int src_reg_index;
#  278|      if (src_reg->Register.File == TGSI_FILE_TEMPORARY) {
#  279|->       src_reg_index = src_reg->Register.Index;
#  280|         assert(src_reg_index < TGSI_EXEC_NUM_TEMPS);
#  281|         /* live -> dead transition */

Error: GCC_ANALYZER_WARNING (CWE-122): [#def581]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:328:11: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:620:1: enter_function: entry to ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:645:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:647:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: call_function: calling ‘copy_token’ from ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: return_function: returning to ‘i915_optimize’ from ‘copy_token’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:656:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:658:4: call_function: calling ‘liveness_analysis’ from ‘i915_optimize’
#  326|         current = &tokens->Tokens[i];
#  327|   
#  328|->       if (current->Token.Type != TGSI_TOKEN_TYPE_INSTRUCTION)
#  329|            continue;
#  330|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def582]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:331:16: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:620:1: enter_function: entry to ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:645:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:647:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: call_function: calling ‘copy_token’ from ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: return_function: returning to ‘i915_optimize’ from ‘copy_token’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:656:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:658:4: call_function: calling ‘liveness_analysis’ from ‘i915_optimize’
#  329|            continue;
#  330|   
#  331|->       opcode = current->FullInstruction.Instruction.Opcode;
#  332|         num_src = op_num_src(opcode);
#  333|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def583]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:597:8: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((unsigned char*)&*next.Token)[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:620:1: enter_function: entry to ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:645:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:647:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: call_function: calling ‘copy_token’ from ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:652:7: return_function: returning to ‘i915_optimize’ from ‘copy_token’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:644:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:656:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:658:4: call_function: calling ‘liveness_analysis’ from ‘i915_optimize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:658:4: return_function: returning to ‘i915_optimize’ from ‘liveness_analysis’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:661:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:662:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:662:7: call_function: calling ‘i915_fpc_optimize_useless_mov_after_inst’ from ‘i915_optimize’
#  595|      // &out_tokens->Tokens[i-1], &out_tokens->Tokens[i]);
#  596|      if (current->Token.Type == TGSI_TOKEN_TYPE_INSTRUCTION &&
#  597|->        next->Token.Type == TGSI_TOKEN_TYPE_INSTRUCTION &&
#  598|          next->FullInstruction.Instruction.Opcode == TGSI_OPCODE_MOV &&
#  599|          op_has_dst(current->FullInstruction.Instruction.Opcode) &&

Error: GCC_ANALYZER_WARNING (CWE-476): [#def584]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:629:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘out_tokens’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:622:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_optimize.c:629:4: danger: ‘out_tokens’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/0)
#  627|      ctx = malloc(sizeof(*ctx));
#  628|   
#  629|->    out_tokens->NumTokens = 0;
#  630|   
#  631|      /* Count the tokens */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def585]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:92:7: warning[-Wanalyzer-malloc-leak]: leak of ‘*fs.program’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:982:1: enter_function: entry to ‘i915_fini_compile’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1016:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1017:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1017:7: call_function: calling ‘i915_use_passthrough_shader’ from ‘i915_fini_compile’
#   90|      if (fs->program) {
#   91|         memcpy(fs->program, passthrough_program, sizeof(passthrough_program));
#   92|->       fs->program_len = ARRAY_SIZE(passthrough_program);
#   93|      }
#   94|      fs->num_constants = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def586]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:941:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘p’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:938:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:941:4: danger: ‘p’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  939|      int i;
#  940|   
#  941|->    p->shader = ifs;
#  942|      p->error = ralloc_strdup(NULL, "");
#  943|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def587]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1030:14: warning[-Wanalyzer-malloc-leak]: leak of ‘*ifs.program’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1016:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1020:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1027:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_fpc_translate.c:1030:14: danger: ‘*ifs.program’ leaks here; was allocated at [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
# 1028|         memcpy(ifs->program, p->declarations, decl_size * sizeof(uint32_t));
# 1029|         memcpy(&ifs->program[decl_size], p->program,
# 1030|->              program_size * sizeof(uint32_t));
# 1031|   
# 1032|         if (i915) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def588]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_emit.c:200:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_emit.c:198:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_emit.c:200:4: danger: ‘setup’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  198|      struct setup_stage *setup = CALLOC_STRUCT(setup_stage);
#  199|   
#  200|->    setup->i915 = i915;
#  201|      setup->stage.draw = i915->draw;
#  202|      setup->stage.point = setup_point;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def589]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_emit.c:209:11: warning[-Wanalyzer-malloc-leak]: leak of ‘setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_emit.c:198:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_emit.c:209:11: danger: ‘setup’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  207|      setup->stage.destroy = render_destroy;
#  208|   
#  209|->    return &setup->stage;
#  210|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def590]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_vbuf.c:651:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘i915_render’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_vbuf.c:649:43: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_vbuf.c:651:4: danger: ‘i915_render’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  649|      struct i915_vbuf_render *i915_render = CALLOC_STRUCT(i915_vbuf_render);
#  650|   
#  651|->    i915_render->i915 = i915;
#  652|   
#  653|      i915_render->base.max_vertex_buffer_bytes = 4 * 4096;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def591]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_vbuf.c:679:11: warning[-Wanalyzer-malloc-leak]: leak of ‘i915_render’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_vbuf.c:649:43: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_prim_vbuf.c:679:11: danger: ‘i915_render’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  677|      i915_render->vbo_alloc_size = i915_render->base.max_vertex_buffer_bytes * 4;
#  678|   
#  679|->    return &i915_render->base;
#  680|   }
#  681|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def592]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:125:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:108:1: enter_function: entry to ‘i915_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:111:30: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:113:7: branch_false: following ‘false’ branch (when ‘buf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:116:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:119:16: call_function: calling ‘os_malloc_aligned’ from ‘i915_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:119:16: return_function: returning to ‘i915_buffer_create’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:122:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:125:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:125:11: danger: ‘buf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  123|         goto err;
#  124|   
#  125|->    return &buf->b;
#  126|   
#  127|   err:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def593]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:155:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:133:1: enter_function: entry to ‘i915_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:136:30: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:138:7: branch_false: following ‘false’ branch (when ‘buf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:141:4: call_function: inlined call to ‘pipe_reference_init’ from ‘i915_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_buffer.c:155:11: danger: ‘buf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  153|      buf->free_on_destroy = false;
#  154|   
#  155|->    return &buf->b;
#  156|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def594]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:129:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc((long unsigned int)nr_images * 4)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:918:1: enter_function: entry to ‘i915_texture_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:926:7: branch_false: following ‘false’ branch (when ‘tex’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:929:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:938:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:939:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:939:12: call_function: calling ‘i945_texture_layout’ from ‘i915_texture_create’
#  127|      tex->nr_images[level] = nr_images;
#  128|      tex->image_offset[level] = MALLOC(nr_images * sizeof(struct offset_pair));
#  129|->    tex->image_offset[level][0].nblocksx = 0;
#  130|      tex->image_offset[level][0].nblocksy = 0;
#  131|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def595]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:129:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc(4)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:974:1: enter_function: entry to ‘i915_texture_from_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:991:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:993:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:991:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:993:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:991:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:997:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:998:7: branch_false: following ‘false’ branch (when ‘tex’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:1001:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_resource_texture.c:1009:4: call_function: inlined call to ‘i915_texture_set_level_info’ from ‘i915_texture_from_handle’
#  127|      tex->nr_images[level] = nr_images;
#  128|      tex->image_offset[level] = MALLOC(nr_images * sizeof(struct offset_pair));
#  129|->    tex->image_offset[level][0].nblocksx = 0;
#  130|      tex->image_offset[level][0].nblocksy = 0;
#  131|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def596]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:172:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:155:40: acquire_memory: this call could return NULL
 branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:177:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:172:10: danger: ‘cso_data’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  170|         if (srcA != srcRGB || dstA != dstRGB || eqA != eqRGB) {
#  171|   
#  172|->          cso_data->iab = (_3DSTATE_INDEPENDENT_ALPHA_BLEND_CMD |
#  173|                             IAB_MODIFY_ENABLE | IAB_ENABLE | IAB_MODIFY_FUNC |
#  174|                             IAB_MODIFY_SRC_FACTOR | IAB_MODIFY_DST_FACTOR |

Error: GCC_ANALYZER_WARNING (CWE-476): [#def597]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:179:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:155:40: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:170:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:179:10: danger: ‘cso_data’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  177|                             (i915_translate_blend_func(eqA) << IAB_FUNC_SHIFT));
#  178|         } else {
#  179|->          cso_data->iab =
#  180|               (_3DSTATE_INDEPENDENT_ALPHA_BLEND_CMD | IAB_MODIFY_ENABLE | 0);
#  181|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def598]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:287:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:280:37: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:287:4: danger: ‘cso’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  285|      unsigned mipFilt;
#  286|   
#  287|->    cso->templ = *sampler;
#  288|   
#  289|      mipFilt = translate_mip_filter(sampler->min_mip_filter);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def599]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:451:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:449:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:451:4: danger: ‘cso’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  449|         CALLOC_STRUCT(i915_depth_stencil_state);
#  450|   
#  451|->    cso->stencil_modes4_cw = i915_get_modes4_stencil(&depth_stencil->stencil[0]);
#  452|      cso->stencil_modes4_ccw =
#  453|         i915_get_modes4_stencil(&depth_stencil->stencil[1]);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def600]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:924:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:922:40: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:924:4: danger: ‘cso’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/0)
#  922|      struct i915_rasterizer_state *cso = CALLOC_STRUCT(i915_rasterizer_state);
#  923|   
#  924|->    cso->templ = *rasterizer;
#  925|      cso->light_twoside = rasterizer->light_twoside;
#  926|      cso->ds[0].u = _3DSTATE_DEPTH_OFFSET_SCALE;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def601]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:420:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:387:1: enter_function: entry to ‘i915_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:399:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:402:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:405:4: call_function: calling ‘pipe_resource_reference’ from ‘i915_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:405:4: return_function: returning to ‘i915_create_surface_custom’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:412:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:413:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:420:22: danger: dereference of NULL ‘pt’
#  418|      }
#  419|   
#  420|->    surf->buf_info |= BUF_3D_PITCH(tex->stride); /* pitch in bytes */
#  421|   
#  422|      switch (tex->tiling) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def602]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:422:4: warning[-Wanalyzer-malloc-leak]: leak of ‘surf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:387:1: enter_function: entry to ‘i915_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:398:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:399:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:402:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:405:4: call_function: calling ‘pipe_resource_reference’ from ‘i915_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:405:4: return_function: returning to ‘i915_create_surface_custom’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:412:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:413:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_surface.c:422:4: danger: ‘surf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  420|      surf->buf_info |= BUF_3D_PITCH(tex->stride); /* pitch in bytes */
#  421|   
#  422|->    switch (tex->tiling) {
#  423|      case I915_TILE_Y:
#  424|         surf->buf_info |= BUF_3D_TILED_SURFACE | BUF_3D_TILE_WALK_Y;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def603]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:326:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘validation_list’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:302:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:309:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:310:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:315:10: branch_false: following ‘false’ branch (when ‘prev_index == -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:320:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/i915/iris_kmd_backend.c:326:10: danger: ‘validation_list + (long unsigned int)validation_count * 56’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  324|   
#  325|            index_for_handle[bo->gem_handle] = validation_count;
#  326|->          validation_list[validation_count] =
#  327|               (struct drm_i915_gem_exec_object2) {
#  328|                  .handle = bo->gem_handle,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def604]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_blorp.c:99:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘blorp_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_blorp.c:476:1: enter_function: entry to ‘iris_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_blorp.c:479:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_blorp.c:480:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_blorp.c:480:7: call_function: calling ‘iris_blorp_exec_blitter’ from ‘iris_blorp_exec’
#   97|                           struct blorp_address addr)
#   98|   {
#   99|->    struct iris_batch *batch = blorp_batch->driver_batch;
#  100|      struct iris_bo *bo = addr.buffer;
#  101|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def605]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:496:14: warning[-Wanalyzer-malloc-leak]: leak of ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1652:1: enter_function: entry to ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1659:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1660:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1666:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1669:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1671:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: call_function: calling ‘bo_unreference_final’ from ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: return_function: returning to ‘iris_bo_unreference’ from ‘bo_unreference_final’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1673:13: call_function: calling ‘cleanup_bo_cache’ from ‘iris_bo_unreference’
#  494|       */
#  495|      if (!is_external && bo->idle)
#  496|->       return 0;
#  497|   
#  498|      simple_mtx_lock(&bufmgr->bo_deps_lock);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def606]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:509:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1652:1: enter_function: entry to ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1659:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1660:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1666:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1669:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1671:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: call_function: calling ‘bo_unreference_final’ from ‘iris_bo_unreference’
#  507|         external_implicit_syncobj = iris_bo_export_sync_state(bo);
#  508|         if (external_implicit_syncobj)
#  509|->          handles[handle_count++] = external_implicit_syncobj->handle;
#  510|      }
#  511|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def607]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:517:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1652:1: enter_function: entry to ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1659:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1660:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1666:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1669:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1671:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: call_function: calling ‘bo_unreference_final’ from ‘iris_bo_unreference’
#  515|            struct iris_syncobj *w = bo->deps[d].write_syncobjs[b];
#  516|            if (r)
#  517|->             handles[handle_count++] = r->handle;
#  518|            if (w)
#  519|               handles[handle_count++] = w->handle;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def608]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:519:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1652:1: enter_function: entry to ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1659:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1660:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1666:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1669:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1671:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: call_function: calling ‘bo_unreference_final’ from ‘iris_bo_unreference’
#  517|               handles[handle_count++] = r->handle;
#  518|            if (w)
#  519|->             handles[handle_count++] = w->handle;
#  520|         }
#  521|      }

Error: GCC_ANALYZER_WARNING (CWE-590): [#def609]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:554:7: warning[-Wanalyzer-free-of-non-heap]: ‘free’ of ‘handles’ which points to memory on the stack
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1652:1: enter_function: entry to ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1659:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1660:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1666:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1669:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1671:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: call_function: calling ‘bo_unreference_final’ from ‘iris_bo_unreference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1672:13: return_function: returning to ‘iris_bo_unreference’ from ‘bo_unreference_final’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_bufmgr.c:1673:13: call_function: calling ‘cleanup_bo_cache’ from ‘iris_bo_unreference’
#  552|   out:
#  553|      if (handles_len > 32)
#  554|->       free(handles);
#  555|      if (external_implicit_syncobj)
#  556|         iris_syncobj_reference(bufmgr, &external_implicit_syncobj, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def610]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:244:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘brw’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:199:7: branch_false: following ‘false’ branch (when ‘cache’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:203:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:217:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:222:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:232:38: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:234:38: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:241:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:246:7: branch_false: following ‘false’ branch (when ‘elk’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:244:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:244:19: danger: dereference of NULL ‘brw’
#  242|      blob_copy_bytes(&blob, prog_data, prog_data_size);
#  243|   
#  244|->    const unsigned program_size =
#  245|   #ifdef INTEL_USE_ELK
#  246|         elk ? elk->program_size :

Error: GCC_ANALYZER_WARNING (CWE-476): [#def611]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:277:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘elk’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:199:7: branch_false: following ‘false’ branch (when ‘cache’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:203:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:217:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:222:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:232:38: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:234:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:234:38: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:241:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:252:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:259:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:259:7: branch_false: following ‘false’ branch (when ‘brw’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:276:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:276:7: release_memory: ‘brw’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_disk_cache.c:277:11: danger: dereference of NULL ‘elk’
#  275|   #ifdef INTEL_USE_ELK
#  276|         elk->relocs = NULL;
#  277|->       if (elk->num_relocs) {
#  278|            struct elk_shader_reloc *relocs =
#  279|               ralloc_array(NULL, struct elk_shader_reloc, elk->num_relocs);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def612]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:118:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:611:1: enter_function: entry to ‘iris_fence_signal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:616:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:619:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:619:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:620:28: branch_true: following ‘true’ branch (when ‘i != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:621:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:628:10: call_function: calling ‘iris_batch_add_syncobj’ from ‘iris_fence_signal’
#  116|         util_dynarray_grow(&batch->exec_fences, struct iris_batch_fence, 1);
#  117|   
#  118|->    *fence = (struct iris_batch_fence) {
#  119|         .handle = syncobj->handle,
#  120|         .flags = flags,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def613]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:126:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:611:1: enter_function: entry to ‘iris_fence_signal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:616:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:619:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:619:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:620:28: branch_true: following ‘true’ branch (when ‘i != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:621:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_fence.c:628:10: call_function: calling ‘iris_batch_add_syncobj’ from ‘iris_fence_signal’
#  124|         util_dynarray_grow(&batch->syncobjs, struct iris_syncobj *, 1);
#  125|   
#  126|->    *store = NULL;
#  127|      iris_syncobj_reference(batch->screen->bufmgr, store, syncobj);
#  128|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def614]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:104:11: warning[-Wanalyzer-malloc-leak]: leak of ‘q’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:94:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:97:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:97:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:98:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:103:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_performance_query.c:104:11: danger: ‘q’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  102|   
#  103|      q->query = obj;
#  104|->    return (struct pipe_query *)&q->base;
#  105|   }
#  106|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def615]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:756:37: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:770:1: enter_function: entry to ‘iris_lower_storage_image_derefs_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:783:32: call_function: inlined call to ‘nir_src_as_deref’ from ‘iris_lower_storage_image_derefs_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:784:27: call_function: calling ‘nir_deref_instr_get_variable’ from ‘iris_lower_storage_image_derefs_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:784:27: return_function: returning to ‘iris_lower_storage_image_derefs_instr’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:788:10: call_function: calling ‘get_aoa_deref_offset’ from ‘iris_lower_storage_image_derefs_instr’
#  754|         deref = nir_deref_instr_parent(deref);
#  755|         assert(glsl_type_is_array(deref->type));
#  756|->       array_size *= glsl_get_length(deref->type);
#  757|      }
#  758|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def616]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3430:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3429:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3430:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3430:10: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3428|         /* User clip planes */
# 3429|         if (info->clip_distance_array_size == 0)
# 3430|->          ish->nos |= (1ull << IRIS_NOS_RASTERIZER);
# 3431|   
# 3432|         key.vs = (struct iris_vs_prog_key) { KEY_INIT(vue.base) };

Error: GCC_ANALYZER_WARNING (CWE-476): [#def617]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3432:44: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3429:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3432:44: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3432:44: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3430|            ish->nos |= (1ull << IRIS_NOS_RASTERIZER);
# 3431|   
# 3432|->       key.vs = (struct iris_vs_prog_key) { KEY_INIT(vue.base) };
# 3433|         key_size = sizeof(key.vs);
# 3434|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def618]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3438:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3438:10: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3436|      case MESA_SHADER_TESS_CTRL: {
# 3437|         key.tcs = (struct iris_tcs_prog_key) {
# 3438|->          KEY_INIT(vue.base),
# 3439|            // XXX: make sure the linker fills this out from the TES...
# 3440|            ._tes_primitive_mode =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def619]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3462:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3461:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3462:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3462:10: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3460|         /* User clip planes */
# 3461|         if (info->clip_distance_array_size == 0)
# 3462|->          ish->nos |= (1ull << IRIS_NOS_RASTERIZER);
# 3463|   
# 3464|         key.tes = (struct iris_tes_prog_key) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def620]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3465:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3461:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3465:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3465:10: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3463|   
# 3464|         key.tes = (struct iris_tes_prog_key) {
# 3465|->          KEY_INIT(vue.base),
# 3466|            // XXX: not ideal, need TCS output/TES input unification
# 3467|            .inputs_read = info->inputs_read,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def621]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3475:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3475:7: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3473|   
# 3474|      case MESA_SHADER_GEOMETRY:
# 3475|->       ish->nos |= (1ull << IRIS_NOS_RASTERIZER);
# 3476|   
# 3477|         key.gs = (struct iris_gs_prog_key) { KEY_INIT(vue.base) };

Error: GCC_ANALYZER_WARNING (CWE-476): [#def622]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3482:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3482:7: danger: dereference of NULL ‘iris_create_uncompiled_shader(screen,  nir, &*state.stream_output)’
# 3480|   
# 3481|      case MESA_SHADER_FRAGMENT:
# 3482|->       ish->nos |= (1ull << IRIS_NOS_FRAMEBUFFER) |
# 3483|                     (1ull << IRIS_NOS_DEPTH_STENCIL_ALPHA) |
# 3484|                     (1ull << IRIS_NOS_RASTERIZER) |

Error: GCC_ANALYZER_WARNING (CWE-476): [#def623]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3538:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3405:1: enter_function: entry to ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: call_function: calling ‘iris_create_uncompiled_shader’ from ‘iris_create_shader_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3419:7: return_function: returning to ‘iris_create_shader_state’ from ‘iris_create_uncompiled_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3521:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3522:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3532:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3536:50: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3536:50: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_program.c:3538:10: danger: ‘job’ could be NULL: unchecked value from [(29)](sarif:/runs/0/results/12/codeFlows/0/threadFlows/0/locations/28)
# 3536|            struct iris_threaded_compile_job *job = calloc(1, sizeof(*job));
# 3537|   
# 3538|->          job->screen = screen;
# 3539|            job->uploader = uploader;
# 3540|            job->ish = ish;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def624]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_resource.c:988:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘iris_alloc_resource(pscreen,  templ)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_resource.c:2082:1: enter_function: entry to ‘iris_map_copy_region’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_resource.c:2103:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_resource.c:2105:22: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_resource.c:2105:22: call_function: calling ‘iris_resource_create_for_buffer’ from ‘iris_map_copy_region’
#  986|             util_format_get_blocksize(templ->format) == 1);
#  987|   
#  988|->    res->internal_format = templ->format;
#  989|      res->surf.tiling = ISL_TILING_LINEAR;
#  990|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def625]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_state.c:10582:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*ice.state.genx’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_state.c:10578:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/iris/iris_state.c:10582:4: danger: ‘calloc(1, 1312)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#10580|   
#10581|   #if GFX_VERx10 >= 120
#10582|->    ice->state.genx->object_preemption = true;
#10583|   #endif
#10584|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def626]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/nir.c:446:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/nir.c:442:6: enter_function: entry to ‘gpir_compile_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/nir.c:445:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘gpir_compile_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/nir.c:445:30: return_function: returning to ‘gpir_compile_nir’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/nir.c:446:26: danger: dereference of NULL ‘nir_shader_get_entrypoint(nir)’
#  444|   {
#  445|      nir_function_impl *func = nir_shader_get_entrypoint(nir);
#  446|->    gpir_compiler *comp = gpir_compiler_create(prog, func->ssa_alloc);
#  447|      if (!comp)
#  448|         return false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def627]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/scheduler.c:688:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/scheduler.c:1343:13: enter_function: entry to ‘place_move’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/gp/scheduler.c:1356:22: call_function: calling ‘create_move’ from ‘place_move’
#  686|   {
#  687|      gpir_node *move = create_replacement(ctx, node, gpir_op_mov);
#  688|->    gpir_debug("create move %d for %d\n", move->index, node->index);
#  689|      return move;
#  690|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def628]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:167:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:163:13: enter_function: entry to ‘ppir_lower_texture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:165:22: call_function: calling ‘ppir_node_get_dest’ from ‘ppir_lower_texture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:165:22: return_function: returning to ‘ppir_lower_texture’ from ‘ppir_node_get_dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:167:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:167:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:167:43: danger: dereference of NULL ‘ppir_node_get_dest(node)’
#  165|      ppir_dest *dest = ppir_node_get_dest(node);
#  166|   
#  167|->    if (ppir_node_has_single_succ(node) && dest->type == ppir_target_ssa) {
#  168|         ppir_node *succ = ppir_node_first_succ(node);
#  169|         dest->type = ppir_target_pipeline;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def629]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:287:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:276:13: enter_function: entry to ‘ppir_lower_fold_src_mod’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:280:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:283:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:283:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:286:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:286:22: call_function: calling ‘ppir_node_get_dest’ from ‘ppir_lower_fold_src_mod’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:286:22: return_function: returning to ‘ppir_lower_fold_src_mod’ from ‘ppir_node_get_dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:287:8: danger: dereference of NULL ‘ppir_node_get_dest(node)’
#  285|   
#  286|      ppir_dest *dest = ppir_node_get_dest(node);
#  287|->    if (dest->type != ppir_target_ssa)
#  288|         return false;
#  289|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def630]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:388:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:385:13: enter_function: entry to ‘ppir_lower_fold_dest_mod’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:387:22: call_function: calling ‘ppir_node_get_dest’ from ‘ppir_lower_fold_dest_mod’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:387:22: return_function: returning to ‘ppir_lower_fold_dest_mod’ from ‘ppir_node_get_dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/lower.c:388:8: danger: dereference of NULL ‘ppir_node_get_dest(node)’
#  386|   {
#  387|      ppir_dest *dest = ppir_node_get_dest(node);
#  388|->    if (dest->type != ppir_target_ssa)
#  389|         return false;
#  390|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def631]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/nir.c:1010:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/nir.c:1005:6: enter_function: entry to ‘ppir_compile_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/nir.c:1009:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ppir_compile_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/nir.c:1009:30: return_function: returning to ‘ppir_compile_nir’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/nir.c:1010:26: danger: dereference of NULL ‘nir_shader_get_entrypoint(nir)’
# 1008|   {
# 1009|      nir_function_impl *func = nir_shader_get_entrypoint(nir);
# 1010|->    ppir_compiler *comp = ppir_compiler_create(prog, func->ssa_alloc);
# 1011|      if (!comp)
# 1012|         return false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def632]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:753:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:745:19: enter_function: entry to ‘ppir_node_insert_mov_local’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:747:22: call_function: calling ‘ppir_node_create’ from ‘ppir_node_insert_mov_local’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:747:22: return_function: returning to ‘ppir_node_insert_mov_local’ from ‘ppir_node_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:748:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:751:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:751:22: call_function: calling ‘ppir_node_get_dest’ from ‘ppir_node_insert_mov_local’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:751:22: return_function: returning to ‘ppir_node_insert_mov_local’ from ‘ppir_node_get_dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:753:4: danger: dereference of NULL ‘ppir_node_get_dest(node)’
#  751|      ppir_dest *dest = ppir_node_get_dest(node);
#  752|      ppir_alu_node *alu = ppir_node_to_alu(move);
#  753|->    alu->dest = *dest;
#  754|      alu->num_src = 1;
#  755|      ppir_node_target_assign(alu->src, node);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def633]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:138:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:132:13: enter_function: entry to ‘ppir_node_is_identity_reg_mov’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:137:20: call_function: calling ‘ppir_node_get_src’ from ‘ppir_node_is_identity_reg_mov’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:137:20: return_function: returning to ‘ppir_node_is_identity_reg_mov’ from ‘ppir_node_get_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:138:8: danger: dereference of NULL ‘ppir_node_get_src(node, 0)’
#  136|   
#  137|      ppir_src *src = ppir_node_get_src(node, 0);
#  138|->    if (src->type != ppir_target_register)
#  139|         return false;
#  140|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def634]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/ppir.h:617:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:745:19: enter_function: entry to ‘ppir_node_insert_mov_local’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:747:22: call_function: calling ‘ppir_node_create’ from ‘ppir_node_insert_mov_local’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:747:22: return_function: returning to ‘ppir_node_insert_mov_local’ from ‘ppir_node_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:748:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:751:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:755:4: call_function: calling ‘ppir_node_target_assign’ from ‘ppir_node_insert_mov_local’
#  615|   {
#  616|      ppir_dest *dest = ppir_node_get_dest(node);
#  617|->    src->type = dest->type;
#  618|      switch (src->type) {
#  619|      case ppir_target_ssa:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def635]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/ppir.h:639:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:772:12: enter_function: entry to ‘ppir_node_insert_mov’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:774:22: call_function: calling ‘ppir_node_insert_mov_local’ from ‘ppir_node_insert_mov’
#  637|   static inline bool ppir_node_target_equal(ppir_src *src, ppir_dest *dest)
#  638|   {
#  639|->    if (src->type != dest->type ||
#  640|          (src->type == ppir_target_ssa && src->ssa != &dest->ssa) ||
#  641|          (src->type == ppir_target_register && src->reg != dest->reg) ||

Error: GCC_ANALYZER_WARNING (CWE-476): [#def636]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/ppir.h:697:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:180:6: enter_function: entry to ‘ppir_instr_insert_node’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:182:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:214:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:215:23: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:217:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:217:28: call_function: calling ‘ppir_node_get_dest’ from ‘ppir_instr_insert_node’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:217:28: return_function: returning to ‘ppir_instr_insert_node’ from ‘ppir_node_get_dest’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:219:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:241:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:339:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:343:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:343:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:346:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/instr.c:346:18: call_function: calling ‘ppir_target_is_scalar’ from ‘ppir_instr_insert_node’
#  695|   static inline bool ppir_target_is_scalar(ppir_dest *dest)
#  696|   {
#  697|->    switch (dest->type) {
#  698|      case ppir_target_ssa:
#  699|         return dest->ssa.num_components == 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def637]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:299:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1143:1: enter_function: entry to ‘lima_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1164:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1177:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1196:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1199:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1199:7: call_function: calling ‘lima_draw_vbo_count’ from ‘lima_draw_vbo’
#  297|   
#  298|      if (!info->index_size) {
#  299|->       VS_CMD_ARRAYS_SEMAPHORE_BEGIN_1();
#  300|         VS_CMD_ARRAYS_SEMAPHORE_BEGIN_2();
#  301|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def638]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:305:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1143:1: enter_function: entry to ‘lima_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1164:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1177:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1196:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1199:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_draw.c:1199:7: call_function: calling ‘lima_draw_vbo_count’ from ‘lima_draw_vbo’
#  303|   
#  304|      int size = uniform_size + vs->state.constant_size + 32;
#  305|->    VS_CMD_UNIFORMS_ADDRESS(
#  306|         lima_ctx_buff_va(ctx, lima_ctx_buff_gp_uniform),
#  307|         align(size, 16));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def639]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:221:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1126:6: enter_function: entry to ‘lima_job_fini’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1130:4: call_function: calling ‘lima_flush’ from ‘lima_job_fini’
#  219|      struct drm_lima_gem_submit_bo *job_bo =
#  220|         util_dynarray_grow(job->gem_bos + pipe, struct drm_lima_gem_submit_bo, 1);
#  221|->    job_bo->handle = bo->handle;
#  222|      job_bo->flags = flags;
#  223|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def640]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:225:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1126:6: enter_function: entry to ‘lima_job_fini’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1130:4: call_function: calling ‘lima_flush’ from ‘lima_job_fini’
#  223|   
#  224|      struct lima_bo **jbo = util_dynarray_grow(job->bos + pipe, struct lima_bo *, 1);
#  225|->    *jbo = bo;
#  226|   
#  227|      /* prevent bo from being freed when job start */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def641]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:407:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1126:6: enter_function: entry to ‘lima_job_fini’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1130:4: call_function: calling ‘lima_flush’ from ‘lima_job_fini’
#  405|      assert((fb->block_h & PLBU_BLOCK_H_MASK) == fb->block_h);
#  406|   
#  407|->    PLBU_CMD_UNKNOWN2();
#  408|      PLBU_CMD_BLOCK_STEP(fb->shift_min, fb->shift_h, fb->shift_w);
#  409|      PLBU_CMD_TILED_DIMENSIONS(fb->tiled_w, fb->tiled_h);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def642]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:730:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1126:6: enter_function: entry to ‘lima_job_fini’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_job.c:1130:4: call_function: calling ‘lima_flush’ from ‘lima_job_fini’
#  728|      uint32_t *plbu_cmd = util_dynarray_ensure_cap(plbu_cmd_array, plbu_cmd_array->size + 2 * 4);
#  729|   
#  730|->    plbu_cmd[i++] = 0x00000000;
#  731|      plbu_cmd[i++] = 0x50000000; /* END */
#  732|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def643]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:588:35: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pres’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:564:1: enter_function: entry to ‘lima_surface_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:570:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:576:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: call_function: calling ‘pipe_resource_reference’ from ‘lima_surface_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: return_function: returning to ‘lima_surface_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:588:35: danger: dereference of NULL ‘pres’
#  586|      psurf->u.tex.last_layer = surf_tmpl->u.tex.last_layer;
#  587|   
#  588|->    surf->tiled_w = align(u_minify(pres->width0, level), 16) >> 4;
#  589|      surf->tiled_h = align(u_minify(pres->height0, level), 16) >> 4;
#  590|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def644]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:599:11: warning[-Wanalyzer-malloc-leak]: leak of ‘surf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:564:1: enter_function: entry to ‘lima_surface_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:568:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:570:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:576:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: call_function: calling ‘pipe_resource_reference’ from ‘lima_surface_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: return_function: returning to ‘lima_surface_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:599:11: danger: ‘surf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  597|         surf->reload |= PIPE_CLEAR_COLOR0;
#  598|   
#  599|->    return &surf->base;
#  600|   }
#  601|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def645]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:306:4: warning[-Wanalyzer-malloc-leak]: leak of ‘f’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:289:7: branch_false: following ‘false’ branch (when ‘type == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:292:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:292:25: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:294:7: branch_true: following ‘true’ branch (when ‘fence’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:295:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_fence.c:306:4: danger: ‘f’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#  304|      return;
#  305|   fail:
#  306|->    *fence = NULL;
#  307|      return;
#  308|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def646]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:51:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(blend, 36)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:45:1: enter_function: entry to ‘llvmpipe_create_blend_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:48:37: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_blend_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:48:37: return_function: returning to ‘llvmpipe_create_blend_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:50:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:51:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:51:7: danger: dereference of NULL ‘mem_dup(blend, 36)’
#   49|   
#   50|      if (LP_PERF & PERF_NO_BLEND) {
#   51|->       state->independent_blend_enable = 0;
#   52|         for (unsigned i = 0; i < PIPE_MAX_COLOR_BUFS; i++)
#   53|            state->rt[i].blend_enable = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def647]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:117:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(depth_stencil, 32)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:109:1: enter_function: entry to ‘llvmpipe_create_depth_stencil_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:114:12: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_depth_stencil_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:114:12: return_function: returning to ‘llvmpipe_create_depth_stencil_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:116:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:117:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:117:7: danger: dereference of NULL ‘mem_dup(depth_stencil, 32)’
#  115|   
#  116|      if (LP_PERF & PERF_NO_DEPTH) {
#  117|->       state->depth_enabled = 0;
#  118|         state->depth_writemask = 0;
#  119|         state->stencil[0].enabled = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def648]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:124:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(depth_stencil, 32)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:109:1: enter_function: entry to ‘llvmpipe_create_depth_stencil_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:114:12: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_depth_stencil_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:114:12: return_function: returning to ‘llvmpipe_create_depth_stencil_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:116:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:123:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:123:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:124:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_blend.c:124:7: danger: dereference of NULL ‘mem_dup(depth_stencil, 32)’
#  122|   
#  123|      if (LP_PERF & PERF_NO_ALPHATEST) {
#  124|->       state->alpha_enabled = 0;
#  125|      }
#  126|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def649]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2073:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘elts’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2056:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2060:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2066:27: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2070:25: branch_true: following ‘true’ branch (when ‘p < prim_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2071:53: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2072:30: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2073:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2073:10: danger: ‘elts + (long unsigned int)elts_idx * 2’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
# 2071|         uint32_t *prim_idxs = (uint32_t *)(prim_ptr + p * psize + prim_out_idx * 4 * sizeof(float));
# 2072|         for (unsigned elt = 0; elt < prim_len; elt++){
# 2073|->          elts[elts_idx++] = prim_idxs[elt];
# 2074|         }
# 2075|         prim_lengths[p] = prim_len;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def650]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2075:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘prim_lengths’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2056:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2060:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2067:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2070:25: branch_true: following ‘true’ branch (when ‘p < prim_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2071:53: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2072:30: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2075:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_cs.c:2075:7: danger: ‘prim_lengths + (long unsigned int)p * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 2073|            elts[elts_idx++] = prim_idxs[elt];
# 2074|         }
# 2075|->       prim_lengths[p] = prim_len;
# 2076|      }
# 2077|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def651]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs.c:3265:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc(strlen(&func_name) + 1)’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs.c:3198:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs.c:3198:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs.c:3212:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs.c:3264:43: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs.c:3265:4: danger: argument 1 (‘malloc(strlen(&func_name) + 1)’) from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4) could be NULL where non-null expected
#argument 1 of ‘__builtin_strcpy’ must be non-null
# 3263|      variant->function[partial_mask] = function;
# 3264|      variant->function_name[partial_mask] = MALLOC(strlen(func_name)+1);
# 3265|->    strcpy(variant->function_name[partial_mask], func_name);
# 3266|   
# 3267|      /* XXX: need to propagate noalias down into color param now we are

Error: GCC_ANALYZER_WARNING (CWE-688): [#def652]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs_linear_llvm.c:295:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*variant.linear_function_name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs_linear_llvm.c:294:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_fs_linear_llvm.c:295:4: danger: argument 1 (‘malloc(strlen(&func_name) + 1)’) from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 1 of ‘__builtin_strcpy’ must be non-null
#  293|      variant->linear_function = function;
#  294|      variant->linear_function_name = MALLOC(strlen(func_name)+1);
#  295|->    strcpy(variant->linear_function_name, func_name);
#  296|   
#  297|      /* XXX: need to propagate noalias down into color param now we are

Error: GCC_ANALYZER_WARNING (CWE-457): [#def653]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:52:11: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((unsigned char*)&*<unknown>)[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:46:1: enter_function: entry to ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: return_function: returning to ‘llvmpipe_create_sampler_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:51:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:52:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:52:11: danger: use of uninitialized value ‘((unsigned char*)&*<unknown>)[1]’ here
#   50|   
#   51|      if (LP_PERF & PERF_NO_MIP_LINEAR) {
#   52|->       if (state->min_mip_filter == PIPE_TEX_MIPFILTER_LINEAR)
#   53|            state->min_mip_filter = PIPE_TEX_MIPFILTER_NEAREST;
#   54|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def654]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:57:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(sampler, 36)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:46:1: enter_function: entry to ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: return_function: returning to ‘llvmpipe_create_sampler_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:51:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:57:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:57:7: danger: dereference of NULL ‘mem_dup(sampler, 36)’
#   55|   
#   56|      if (LP_PERF & PERF_NO_MIPMAPS)
#   57|->       state->min_mip_filter = PIPE_TEX_MIPFILTER_NONE;
#   58|   
#   59|      if (LP_PERF & PERF_NO_LINEAR) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def655]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:60:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(sampler, 36)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:46:1: enter_function: entry to ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: return_function: returning to ‘llvmpipe_create_sampler_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:51:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:59:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:59:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:60:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:60:7: danger: dereference of NULL ‘mem_dup(sampler, 36)’
#   58|   
#   59|      if (LP_PERF & PERF_NO_LINEAR) {
#   60|->       state->mag_img_filter = PIPE_TEX_FILTER_NEAREST;
#   61|         state->min_img_filter = PIPE_TEX_FILTER_NEAREST;
#   62|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def656]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:102:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘*targets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:73:1: enter_function: entry to ‘llvmpipe_set_so_targets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:81:16: branch_true: following ‘true’ branch (when ‘i < num_targets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:82:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:92:7: call_function: calling ‘pipe_so_target_reference’ from ‘llvmpipe_set_so_targets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:92:7: return_function: returning to ‘llvmpipe_set_so_targets’ from ‘pipe_so_target_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:100:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:101:22: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_so.c:102:10: danger: dereference of NULL ‘*(struct llvmpipe_context *)pipe.so_targets[i]’
#  100|         if (targets[i]) {
#  101|            void *buf = llvmpipe_resource(targets[i]->buffer)->data;
#  102|->          llvmpipe->so_targets[i]->mapping = buf;
#  103|         }
#  104|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def657]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:388:11: warning[-Wanalyzer-malloc-leak]: leak of ‘lpr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:430:1: enter_function: entry to ‘llvmpipe_resource_create_unbacked’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:435:7: call_function: calling ‘llvmpipe_resource_create_all’ from ‘llvmpipe_resource_create_unbacked’
#  386|   #endif
#  387|   
#  388|->    return &lpr->base;
#  389|   
#  390|    fail:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def658]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:496:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘lpr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:491:7: branch_false: following ‘false’ branch (when ‘memobj’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:495:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:495:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:496:4: danger: ‘lpr’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
#  494|      struct llvmpipe_memory_object *lpmo = llvmpipe_memory_object(memobj);
#  495|      struct llvmpipe_resource *lpr = CALLOC_STRUCT(llvmpipe_resource);
#  496|->    lpr->base = *templat;
#  497|   
#  498|      lpr->screen = screen;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def659]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:546:11: warning[-Wanalyzer-malloc-leak]: leak of ‘lpr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:486:1: enter_function: entry to ‘llvmpipe_resource_from_memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:491:7: branch_false: following ‘false’ branch (when ‘memobj’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:495:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:495:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:502:8: call_function: inlined call to ‘llvmpipe_resource_is_texture’ from ‘llvmpipe_resource_from_memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:511:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:529:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:532:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:532:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:534:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:538:4: call_function: inlined call to ‘pipe_reference’ from ‘llvmpipe_resource_from_memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:538:4: call_function: inlined call to ‘pipe_reference’ from ‘llvmpipe_resource_from_memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:546:11: danger: ‘lpr’ leaks here; was allocated at [(4)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/3)
#  544|   #endif
#  545|   
#  546|->    return &lpr->base;
#  547|   
#  548|   fail:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def660]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:798:11: warning[-Wanalyzer-malloc-leak]: leak of ‘lpr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:718:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:721:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:721:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:722:7: branch_false: following ‘false’ branch (when ‘lpr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:726:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:742:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:749:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:784:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:798:11: danger: ‘lpr’ leaks here; was allocated at [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
#  796|   #endif
#  797|   
#  798|->    return &lpr->base;
#  799|   
#  800|   no_dt:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def661]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:895:11: warning[-Wanalyzer-malloc-leak]: leak of ‘lpr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:865:1: enter_function: entry to ‘llvmpipe_resource_from_user_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:872:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:873:7: branch_false: following ‘false’ branch (when ‘lpr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:877:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:882:8: call_function: inlined call to ‘llvmpipe_resource_is_texture’ from ‘llvmpipe_resource_from_user_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:888:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:895:11: danger: ‘lpr’ leaks here; was allocated at [(2)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/1)
#  893|      simple_mtx_unlock(&resource_list_mutex);
#  894|   #endif
#  895|->    return &lpr->base;
#  896|   fail:
#  897|      FREE(lpr);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def662]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1035:14: warning[-Wanalyzer-malloc-leak]: leak of ‘lpt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:903:1: enter_function: entry to ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:956:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:957:7: branch_false: following ‘false’ branch (when ‘lpt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:959:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:960:4: call_function: calling ‘pipe_resource_reference’ from ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:960:4: return_function: returning to ‘llvmpipe_transfer_map_ms’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:994:8: call_function: inlined call to ‘llvmpipe_resource_is_texture’ from ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:994:51: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:994:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:995:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:995:13: call_function: calling ‘llvmpipe_resource_map’ from ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:995:13: return_function: returning to ‘llvmpipe_transfer_map_ms’ from ‘llvmpipe_resource_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:996:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1000:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1035:14: danger: ‘lpt’ leaks here; was allocated at [(2)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/1)
# 1033|         }
# 1034|   
# 1035|->       return lpt->map;
# 1036|      }
# 1037|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def663]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1039:7: warning[-Wanalyzer-malloc-leak]: leak of ‘lpt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:903:1: enter_function: entry to ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:956:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:957:7: branch_false: following ‘false’ branch (when ‘lpt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:959:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:960:4: call_function: calling ‘pipe_resource_reference’ from ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:960:4: return_function: returning to ‘llvmpipe_transfer_map_ms’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1038:10: call_function: calling ‘llvmpipe_resource_map’ from ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1038:10: return_function: returning to ‘llvmpipe_transfer_map_ms’ from ‘llvmpipe_resource_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1039:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1039:7: danger: ‘lpt’ leaks here; was allocated at [(2)](sarif:/runs/0/results/8/codeFlows/0/threadFlows/0/locations/1)
# 1037|   
# 1038|      map = llvmpipe_resource_map(resource, level, box->z, tex_usage);
# 1039|->    if (!map)
# 1040|         return NULL;
# 1041|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def664]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1243:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1225:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1226:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1229:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1243:11: danger: ‘buffer’ leaks here; was allocated at [(1)](sarif:/runs/0/results/9/codeFlows/0/threadFlows/0/locations/0)
# 1241|      buffer->data = ptr;
# 1242|   
# 1243|->    return &buffer->base;
# 1244|   }
# 1245|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def665]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1313:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1308:45: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1313:4: danger: ‘mem’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/0)
# 1311|         alignment = 256;
# 1312|   
# 1313|->    mem->size = align64(size, alignment);
# 1314|   
# 1315|   #if DETECT_OS_LINUX

Error: GCC_ANALYZER_WARNING (CWE-476): [#def666]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1483:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1482:47: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:1483:4: danger: ‘alloc’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/11/codeFlows/0/threadFlows/0/locations/0)
# 1481|   {
# 1482|      struct llvmpipe_memory_allocation *alloc = CALLOC_STRUCT(llvmpipe_memory_allocation);
# 1483|->    alloc->mem_fd = -1;
# 1484|      alloc->dmabuf_fd = -1;
# 1485|   #if defined(HAVE_LIBDRM) && defined(HAVE_LINUX_UDMABUF_H)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def667]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.h:188:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:903:1: enter_function: entry to ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:957:7: branch_false: following ‘false’ branch (when ‘lpt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:959:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:960:4: call_function: calling ‘pipe_resource_reference’ from ‘llvmpipe_transfer_map_ms’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:960:4: return_function: returning to ‘llvmpipe_transfer_map_ms’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture.c:994:8: call_function: inlined call to ‘llvmpipe_resource_is_texture’ from ‘llvmpipe_transfer_map_ms’
#  186|   llvmpipe_resource_is_texture(const struct pipe_resource *resource)
#  187|   {
#  188|->    switch (resource->target) {
#  189|      case PIPE_BUFFER:
#  190|         return false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def668]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture_handle.c:269:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture_handle.c:1018:1: enter_function: entry to ‘register_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture_handle.c:1022:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture_handle.c:1024:53: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_texture_handle.c:1026:7: call_function: calling ‘register_sample_key’ from ‘register_instr’
#  267|      gallivm_free_ir(gallivm);
#  268|   
#  269|->    util_dynarray_append(&ctx->sampler_matrix.gallivms, struct gallivm_state *, gallivm);
#  270|   
#  271|      return function_ptr;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def669]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:159:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘nv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:671:1: enter_function: entry to ‘nouveau_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:679:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:682:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:720:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:723:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:723:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:724:7: call_function: calling ‘nouveau_buffer_cache’ from ‘nouveau_buffer_create’
#  157|      const unsigned size = align(tx->base.box.width, 4) + adj;
#  158|   
#  159|->    if (!nv->push_data)
#  160|         permit_pb = false;
#  161|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def670]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:659:11: warning[-Wanalyzer-malloc-leak]: leak of ‘tx’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:648:1: enter_function: entry to ‘nouveau_user_ptr_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:654:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:655:7: branch_false: following ‘false’ branch (when ‘tx’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:657:4: call_function: inlined call to ‘nouveau_buffer_transfer_init’ from ‘nouveau_user_ptr_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:659:11: danger: ‘tx’ leaks here; was allocated at [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  657|      nouveau_buffer_transfer_init(tx, resource, box, usage);
#  658|      *ptransfer = &tx->base;
#  659|->    return nv04_resource(resource)->data;
#  660|   }
#  661|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def671]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:730:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:671:1: enter_function: entry to ‘nouveau_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:678:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:679:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:682:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:686:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:689:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:718:10: call_function: calling ‘nouveau_buffer_allocate’ from ‘nouveau_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:718:10: return_function: returning to ‘nouveau_buffer_create’ from ‘nouveau_buffer_allocate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:720:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:723:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:723:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:728:4: call_function: inlined call to ‘util_range_init’ from ‘nouveau_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:730:11: danger: ‘buffer’ leaks here; was allocated at [(2)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/1)
#  728|      util_range_init(&buffer->valid_buffer_range);
#  729|   
#  730|->    return &buffer->base;
#  731|   
#  732|   fail:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def672]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:760:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:744:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:745:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:748:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:760:11: danger: ‘buffer’ leaks here; was allocated at [(1)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/0)
#  758|      pipe_reference_init(&buffer->base.reference, 1);
#  759|   
#  760|->    return &buffer->base;
#  761|   }
#  762|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def673]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:983:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:980:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_buffer.c:983:4: danger: dereference of NULL ‘realloc(*nv.scratch.runout, ((long unsigned int)(n + 1) + 1) * 8)’
#  981|                                   (sizeof(*nv->scratch.runout) + (n + 0) * sizeof(void *)),
#  982|                                    sizeof(*nv->scratch.runout) + (n + 1) * sizeof(void *));
#  983|->    nv->scratch.runout->nr = n + 1;
#  984|      nv->scratch.runout->bo[n] = NULL;
#  985|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def674]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_fence.c:117:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_fence.c:380:1: enter_function: entry to ‘nouveau_fence_next_if_current’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_fence.c:383:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_fence.c:384:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_fence.c:384:7: call_function: calling ‘_nouveau_fence_next’ from ‘nouveau_fence_next_if_current’
#  115|         } else {
#  116|            for (it = fence_list->head; it && it->next != fence; it = it->next);
#  117|->          it->next = fence->next;
#  118|            if (fence_list->tail == fence)
#  119|               fence_list->tail = it;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def675]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_screen.c:253:4: warning[-Wanalyzer-malloc-leak]: leak of ‘p’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_screen.c:502:1: enter_function: entry to ‘nouveau_context_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_screen.c:510:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_screen.c:513:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_screen.c:513:10: call_function: calling ‘nouveau_pushbuf_create’ from ‘nouveau_context_init’
#  251|      p->context = context;
#  252|      (*push)->kick_notify = nouveau_pushbuf_cb;
#  253|->    (*push)->user_priv = p;
#  254|      return 0;
#  255|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def676]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:796:14: warning[-Wanalyzer-malloc-leak]: leak of ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:793:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:794:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:793:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:793:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:793:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:799:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:802:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:803:7: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:806:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:829:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:831:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:835:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:837:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nouveau_video.c:796:14: danger: ‘buffer’ leaks here; was allocated at [(7)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/6)
#  794|          (screen->device->chipset >= 0x98 && screen->device->chipset != 0xa0) ||
#  795|          screen->device->chipset < 0x40)
#  796|->       return vl_video_buffer_create(pipe, templat);
#  797|   
#  798|      assert(pipe_format_to_chroma_format(templat->buffer_format) == PIPE_VIDEO_CHROMA_FORMAT_420);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def677]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_draw.c:496:11: warning[-Wanalyzer-malloc-leak]: leak of ‘r’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_draw.c:477:28: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_draw.c:478:7: branch_false: following ‘false’ branch (when ‘r’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_draw.c:481:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_draw.c:496:11: danger: ‘r’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  494|      r->base.release_vertices = nv30_render_release_vertices;
#  495|      r->base.destroy = nv30_render_destroy;
#  496|->    return &r->base;
#  497|   }
#  498|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def678]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:300:53: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:281:1: enter_function: entry to ‘nv30_miptree_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:294:7: branch_false: following ‘false’ branch (when ‘tx’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:296:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:296:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_miptree_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:296:4: return_function: returning to ‘nv30_miptree_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:300:53: danger: dereference of NULL ‘pt’
#  298|      tx->base.usage = usage;
#  299|      tx->base.box = *box;
#  300|->    tx->base.stride = align(util_format_get_nblocksx(pt->format, box->width) *
#  301|                              util_format_get_blocksize(pt->format), 64);
#  302|      tx->base.layer_stride = util_format_get_nblocksy(pt->format, box->height) *

Error: GCC_ANALYZER_WARNING (CWE-476): [#def679]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:419:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:411:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:419:7: danger: ‘mt’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  417|      switch (tmpl->nr_samples) {
#  418|      case 4:
#  419|->       mt->ms_mode = 0x00004000;
#  420|         mt->ms_x = 1;
#  421|         mt->ms_y = 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def680]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:424:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:411:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:424:7: danger: ‘mt’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  422|         break;
#  423|      case 2:
#  424|->       mt->ms_mode = 0x00003000;
#  425|         mt->ms_x = 1;
#  426|         mt->ms_y = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def681]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:430:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:411:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:430:7: danger: ‘mt’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  428|      default:
#  429|         mt->ms_mode = 0x00000000;
#  430|->       mt->ms_x = 0;
#  431|         mt->ms_y = 0;
#  432|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def682]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:567:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:545:1: enter_function: entry to ‘nv30_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:555:7: branch_false: following ‘false’ branch (when ‘ns’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:557:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: return_function: returning to ‘nv30_miptree_surface_new’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:567:25: danger: dereference of NULL ‘pt’
#  565|      ps->u.tex.last_layer = tmpl->u.tex.last_layer;
#  566|   
#  567|->    ns->width = u_minify(pt->width0, ps->u.tex.level);
#  568|      ns->height = u_minify(pt->height0, ps->u.tex.level);
#  569|      ns->depth = ps->u.tex.last_layer - ps->u.tex.first_layer + 1;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def683]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:574:7: warning[-Wanalyzer-malloc-leak]: leak of ‘ns’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:545:1: enter_function: entry to ‘nv30_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:554:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:555:7: branch_false: following ‘false’ branch (when ‘ns’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:557:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: return_function: returning to ‘nv30_miptree_surface_new’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:574:7: danger: ‘ns’ leaks here; was allocated at [(2)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/1)
#  572|         ns->pitch = 4096; /* random, just something the hw won't reject.. */
#  573|      else
#  574|->       ns->pitch = lvl->pitch;
#  575|   
#  576|      return ps;

Error: GCC_ANALYZER_WARNING (CWE-416): [#def684]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:44:14: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘qo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:178:1: enter_function: entry to ‘nv30_query_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:185:15: call_function: calling ‘nv30_query_object_new’ from ‘nv30_query_end’
#   42|      volatile void *ntfy = NULL;
#   43|   
#   44|->    if (qo && qo->hw)
#   45|         ntfy = (char *)notify->map + query->offset + qo->hw->start;
#   46|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def685]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:56:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:178:1: enter_function: entry to ‘nv30_query_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:185:15: call_function: calling ‘nv30_query_object_new’ from ‘nv30_query_end’
#   54|      if (qo) {
#   55|         volatile uint32_t *ntfy = nv30_ntfy(screen, qo);
#   56|->       while (ntfy[3] & 0xff000000) {
#   57|         }
#   58|         nouveau_heap_free(&qo->hw);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def686]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:84:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:178:1: enter_function: entry to ‘nv30_query_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:185:15: call_function: calling ‘nv30_query_object_new’ from ‘nv30_query_end’
#   82|   
#   83|      ntfy = nv30_ntfy(screen, qo);
#   84|->    ntfy[0] = 0x00000000;
#   85|      ntfy[1] = 0x00000000;
#   86|      ntfy[2] = 0x00000000;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def687]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:219:47: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:200:1: enter_function: entry to ‘nv30_query_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:205:31: call_function: calling ‘nv30_ntfy’ from ‘nv30_query_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:205:31: return_function: returning to ‘nv30_query_result’ from ‘nv30_ntfy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:206:31: call_function: calling ‘nv30_ntfy’ from ‘nv30_query_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:206:31: return_function: returning to ‘nv30_query_result’ from ‘nv30_ntfy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:208:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_query.c:219:47: danger: dereference of NULL ‘nv30_ntfy(*pipe.screen, *(struct nv30_query *)pq.qo[0])’
#  217|            break;
#  218|         case PIPE_QUERY_TIME_ELAPSED:
#  219|->          q->result = *(uint64_t *)&ntfy1[0] - *(uint64_t *)&ntfy0[0];
#  220|            break;
#  221|         default:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def688]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:237:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:219:1: enter_function: entry to ‘nv30_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:228:7: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:230:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:234:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:234:4: return_function: returning to ‘nv30_sampler_view_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:237:12: danger: dereference of NULL ‘pt’
#  235|   
#  236|      so->fmt = NV30_3D_TEX_FORMAT_NO_BORDER;
#  237|->    switch (pt->target) {
#  238|      case PIPE_TEXTURE_1D:
#  239|         so->fmt |= NV30_3D_TEX_FORMAT_DIMS_1D;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def689]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:307:11: warning[-Wanalyzer-malloc-leak]: leak of ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:219:1: enter_function: entry to ‘nv30_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:227:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:228:7: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:230:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:234:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_sampler_view_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:234:4: return_function: returning to ‘nv30_sampler_view_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_texture.c:307:11: danger: ‘so’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  305|      so->base_lod = so->pipe.u.tex.first_level << 8;
#  306|      so->high_lod = MIN2(pt->last_level, so->pipe.u.tex.last_level) << 8;
#  307|->    return &so->pipe;
#  308|   }
#  309|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def690]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:74:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1062:1: enter_function: entry to ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1073:7: branch_false: following ‘false’ branch (when ‘fpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1076:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: call_function: calling ‘nvfx_fragprog_prepare’ from ‘_nvfx_fragprog_translate’
#   72|      int idx = fpc->imm_data.size >> 4;
#   73|   
#   74|->    memcpy(util_dynarray_grow(&fpc->imm_data, float, 4), v, 4 * sizeof(float));
#   75|      return nvfx_reg(NVFXSR_IMM, idx);
#   76|   }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def691]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:536:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘src[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1062:1: enter_function: entry to ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1073:7: branch_false: following ‘false’ branch (when ‘fpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1076:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: call_function: calling ‘nvfx_fragprog_prepare’ from ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: return_function: returning to ‘_nvfx_fragprog_translate’ from ‘nvfx_fragprog_prepare’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1092:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1095:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1096:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1098:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1099:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1103:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1103:10: return_function: returning to ‘_nvfx_fragprog_translate’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1105:15: call_function: calling ‘nvfx_fragprog_parse_instruction’ from ‘_nvfx_fragprog_translate’
#  534|      switch (finst->Instruction.Opcode) {
#  535|      case TGSI_OPCODE_ADD:
#  536|->       nvfx_fp_emit(fpc, arith(sat, ADD, dst, mask, src[0], src[1], none));
#  537|         break;
#  538|      case TGSI_OPCODE_CEIL:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def692]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1011:38: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*fpc.r_imm + (long unsigned int)*fpc.nr_imm * 8’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1062:1: enter_function: entry to ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1073:7: branch_false: following ‘false’ branch (when ‘fpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1076:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: call_function: calling ‘nvfx_fragprog_prepare’ from ‘_nvfx_fragprog_translate’
# 1009|            assert(fpc->nr_imm < fpc->fp->info.immediate_count);
# 1010|   
# 1011|->          fpc->r_imm[fpc->nr_imm++] = nvfx_fp_imm(fpc, imm->u[0].Float, imm->u[1].Float, imm->u[2].Float, imm->u[3].Float);
# 1012|            break;
# 1013|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def693]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1045:27: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*fpc.r_temp + (long unsigned int)i * 8’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1062:1: enter_function: entry to ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1073:7: branch_false: following ‘false’ branch (when ‘fpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1076:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: call_function: calling ‘nvfx_fragprog_prepare’ from ‘_nvfx_fragprog_translate’
# 1043|         fpc->r_temp = CALLOC(high_temp, sizeof(struct nvfx_reg));
# 1044|         for (i = 0; i < high_temp; i++)
# 1045|->          fpc->r_temp[i] = temp(fpc);
# 1046|         fpc->r_temps_discard = 0ULL;
# 1047|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def694]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1103:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1062:1: enter_function: entry to ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1073:7: branch_false: following ‘false’ branch (when ‘fpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1076:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: call_function: calling ‘nvfx_fragprog_prepare’ from ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:9: return_function: returning to ‘_nvfx_fragprog_translate’ from ‘nvfx_fragprog_prepare’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1089:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1092:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1093:4: call_function: inlined call to ‘util_dynarray_init’ from ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1095:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1096:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1098:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1099:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1103:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘_nvfx_fragprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1103:10: return_function: returning to ‘_nvfx_fragprog_translate’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_fragprog.c:1103:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&insns, 1, 4)’
# 1101|            const struct tgsi_full_instruction *finst;
# 1102|   
# 1103|->          util_dynarray_append(&insns, unsigned, fp->insn_len);
# 1104|            finst = &parse.FullToken.FullInstruction;
# 1105|            if (!nvfx_fragprog_parse_instruction(fpc, finst))

Error: GCC_ANALYZER_WARNING (CWE-476): [#def695]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:934:27: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*vpc.r_temp + (long unsigned int)i * 8’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:956:1: enter_function: entry to ‘_nvfx_vertprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:969:7: branch_false: following ‘false’ branch (when ‘vpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:971:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:977:9: call_function: calling ‘nvfx_vertprog_prepare’ from ‘_nvfx_vertprog_translate’
#  932|         vpc->r_temp = CALLOC(high_temp, sizeof(struct nvfx_reg));
#  933|         for (i = 0; i < high_temp; i++)
#  934|->          vpc->r_temp[i] = temp(vpc);
#  935|      }
#  936|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def696]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:940:30: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc((long unsigned int)high_addr, 8)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:956:1: enter_function: entry to ‘_nvfx_vertprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:969:7: branch_false: following ‘false’ branch (when ‘vpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:971:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:977:9: call_function: calling ‘nvfx_vertprog_prepare’ from ‘_nvfx_vertprog_translate’
#  938|         vpc->r_address = CALLOC(high_addr, sizeof(struct nvfx_reg));
#  939|         for (i = 0; i < high_addr; i++)
#  940|->          vpc->r_address[i] = nvfx_reg(NVFXSR_TEMP, i);
#  941|      }
#  942|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def697]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:1007:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:956:1: enter_function: entry to ‘_nvfx_vertprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:969:7: branch_false: following ‘false’ branch (when ‘vpc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:971:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:977:9: call_function: calling ‘nvfx_vertprog_prepare’ from ‘_nvfx_vertprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:977:9: return_function: returning to ‘_nvfx_vertprog_translate’ from ‘nvfx_vertprog_prepare’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:977:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:986:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:986:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:992:4: call_function: inlined call to ‘util_dynarray_init’ from ‘_nvfx_vertprog_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:995:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:996:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:1006:10: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:1006:18: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nvfx_vertprog.c:1007:13: danger: dereference of NULL ‘*vpc.imm + (long unsigned int)*vpc.nr_imm * 8’
# 1005|            assert(imm->Immediate.NrTokens == 4 + 1);
# 1006|            vpc->imm[vpc->nr_imm++] =
# 1007|->             constant(vpc, -1,
# 1008|                   imm->u[0].Float,
# 1009|                   imm->u[1].Float,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def698]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:342:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:331:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:339:7: branch_false: following ‘false’ branch (when ‘mt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:342:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_miptree.c:342:4: danger: ‘mt’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  340|         return NULL;
#  341|   
#  342|->    *pt = *templ;
#  343|      pipe_reference_init(&pt->reference, 1);
#  344|      pt->screen = pscreen;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def699]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:309:19: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘base[3]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:328:1: enter_function: entry to ‘nv50_program_translate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:337:7: branch_false: following ‘false’ branch (when ‘info’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:340:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:386:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:408:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:409:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:409:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:413:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:413:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:414:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:442:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:444:52: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_program.c:443:18: call_function: calling ‘nv50_program_create_strmout_state’ from ‘nv50_program_translate’
#  307|      }
#  308|   
#  309|->    so->map_size = base[3] + so->num_attribs[3];
#  310|   
#  311|      for (i = 0; i < pso->num_outputs; ++i) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def700]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:409:7: warning[-Wanalyzer-malloc-leak]: leak of ‘hq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:362:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:367:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:368:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:373:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:373:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:374:7: branch_false: following ‘false’ branch (when ‘hq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:377:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw.c:409:7: danger: ‘hq’ leaks here; was allocated at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  407|      default:
#  408|         debug_printf("invalid query type: %u\n", type);
#  409|->       FREE(q);
#  410|         return NULL;
#  411|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def701]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:77:1: warning[-Wanalyzer-malloc-leak]: leak of ‘hmq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:152:1: enter_function: entry to ‘nv50_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:159:7: branch_false: following ‘false’ branch (when ‘type == 1280’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:162:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:162:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:163:7: branch_false: following ‘false’ branch (when ‘hmq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:166:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:174:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:175:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:175:10: call_function: calling ‘nv50_hw_metric_destroy_query’ from ‘nv50_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:175:10: return_function: returning to ‘nv50_hw_metric_create_query’ from ‘nv50_hw_metric_destroy_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:77:1: danger: ‘hmq’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#   75|            hmq->queries[i]->funcs->destroy_query(nv50, hmq->queries[i]);
#   76|      FREE(hmq);
#   77|-> }
#   78|   
#   79|   static bool

Error: GCC_ANALYZER_WARNING (CWE-401): [#def702]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: warning[-Wanalyzer-malloc-leak]: leak of ‘hmq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:159:7: branch_false: following ‘false’ branch (when ‘type == 1280’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:162:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:162:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:163:7: branch_false: following ‘false’ branch (when ‘hmq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:166:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: danger: ‘hmq’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#  170|      cfg = nv50_hw_metric_query_get_cfg(nv50, hq);
#  171|   
#  172|->    for (i = 0; i < cfg->num_queries; i++) {
#  173|         hmq->queries[i] = nv50_hw_sm_create_query(nv50, cfg->queries[i]);
#  174|         if (!hmq->queries[i]) {

Error: GCC_ANALYZER_WARNING (CWE-122): [#def703]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:7: warning[-Wanalyzer-out-of-bounds]: heap-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:159:7: branch_false: following ‘false’ branch (when ‘type == 1280’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:162:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:163:7: branch_false: following ‘false’ branch (when ‘hmq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:166:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:174:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:178:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:174:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:178:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:174:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:178:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:174:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:178:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:174:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:178:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:172:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_metric.c:173:7: danger: out-of-bounds write from byte 120 till byte 127 but region ends at byte 120
#  171|   
#  172|      for (i = 0; i < cfg->num_queries; i++) {
#  173|->       hmq->queries[i] = nv50_hw_sm_create_query(nv50, cfg->queries[i]);
#  174|         if (!hmq->queries[i]) {
#  175|            nv50_hw_metric_destroy_query(nv50, hq);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def704]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_sm.c:231:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘prog’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_sm.c:229:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_sm.c:230:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_sm.c:230:35: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_query_hw_sm.c:231:7: danger: ‘prog’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  229|      if (unlikely(!screen->pm.prog)) {
#  230|         struct nv50_program *prog = CALLOC_STRUCT(nv50_program);
#  231|->       prog->type = PIPE_SHADER_COMPUTE;
#  232|         prog->translated = true;
#  233|         prog->max_gpr = 7;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def705]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:70:11: warning[-Wanalyzer-malloc-leak]: leak of ‘sf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:44:1: enter_function: entry to ‘nv50_surface_from_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:48:30: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:49:7: branch_false: following ‘false’ branch (when ‘sf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:52:4: call_function: inlined call to ‘pipe_reference_init’ from ‘nv50_surface_from_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:53:4: call_function: calling ‘pipe_resource_reference’ from ‘nv50_surface_from_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:53:4: return_function: returning to ‘nv50_surface_from_buffer’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:70:11: danger: ‘sf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#   68|   
#   69|      sf->base.context = pipe;
#   70|->    return &sf->base;
#   71|   }
#   72|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def706]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:107:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘memobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:105:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:107:4: danger: ‘memobj’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  105|      struct nv50_memobj *memobj = CALLOC_STRUCT(nv50_memobj);
#  106|   
#  107|->    memobj->bo = nouveau_screen_bo_from_handle(screen, handle, &memobj->stride);
#  108|      if (memobj->bo == NULL) {
#  109|         FREE(memobj);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def707]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:164:11: warning[-Wanalyzer-malloc-leak]: leak of ‘mt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:139:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:141:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:139:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:142:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:139:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:143:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:139:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:146:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:146:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:147:7: branch_false: following ‘false’ branch (when ‘mt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:150:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_resource.c:164:11: danger: ‘mt’ leaks here; was allocated at [(9)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/8)
#  162|   
#  163|      /* no need to adjust bo reference count */
#  164|->    return &mt->base.base;
#  165|   }
#  166|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def708]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1166:11: warning[-Wanalyzer-malloc-leak]: leak of ‘targ’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1135:1: enter_function: entry to ‘nv50_so_target_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1140:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1141:7: branch_false: following ‘false’ branch (when ‘targ’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1144:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1144:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1152:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1160:4: call_function: calling ‘pipe_resource_reference’ from ‘nv50_so_target_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1160:4: return_function: returning to ‘nv50_so_target_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv50/nv50_state.c:1166:11: danger: ‘targ’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 1164|      util_range_add(&buf->base, &buf->valid_buffer_range, offset, offset + size);
# 1165|   
# 1166|->    return &targ->pipe;
# 1167|   }
# 1168|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def709]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_miptree.c:461:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mt’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_miptree.c:449:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_miptree.c:458:7: branch_false: following ‘false’ branch (when ‘mt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_miptree.c:461:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_miptree.c:461:4: danger: ‘mt’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  459|         return NULL;
#  460|   
#  461|->    *pt = *templ;
#  462|      pipe_reference_init(&pt->reference, 1);
#  463|      pt->screen = pscreen;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def710]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:586:7: warning[-Wanalyzer-malloc-leak]: leak of ‘hq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:533:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:538:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:539:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:544:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:544:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:545:7: branch_false: following ‘false’ branch (when ‘hq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:548:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c:586:7: danger: ‘hq’ leaks here; was allocated at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  584|      default:
#  585|         debug_printf("invalid query type: %u\n", type);
#  586|->       FREE(q);
#  587|         return NULL;
#  588|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def711]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:475:1: warning[-Wanalyzer-malloc-leak]: leak of ‘hmq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:717:1: enter_function: entry to ‘nvc0_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:724:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:727:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:727:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:728:7: branch_false: following ‘false’ branch (when ‘hmq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:731:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:735:10: call_function: calling ‘nvc0_hw_metric_query_get_cfg’ from ‘nvc0_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:735:10: return_function: returning to ‘nvc0_hw_metric_create_query’ from ‘nvc0_hw_metric_query_get_cfg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:737:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:738:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:739:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:740:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:740:10: call_function: calling ‘nvc0_hw_metric_destroy_query’ from ‘nvc0_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:740:10: return_function: returning to ‘nvc0_hw_metric_create_query’ from ‘nvc0_hw_metric_destroy_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:475:1: danger: ‘hmq’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#  473|            hmq->queries[i]->funcs->destroy_query(nvc0, hmq->queries[i]);
#  474|      FREE(hmq);
#  475|-> }
#  476|   
#  477|   static bool

Error: GCC_ANALYZER_WARNING (CWE-401): [#def712]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:737:16: warning[-Wanalyzer-malloc-leak]: leak of ‘hmq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:717:1: enter_function: entry to ‘nvc0_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:724:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:727:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:727:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:728:7: branch_false: following ‘false’ branch (when ‘hmq’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:731:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:735:10: call_function: calling ‘nvc0_hw_metric_query_get_cfg’ from ‘nvc0_hw_metric_create_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:735:10: return_function: returning to ‘nvc0_hw_metric_create_query’ from ‘nvc0_hw_metric_query_get_cfg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:737:16: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:737:16: danger: ‘hmq’ leaks here; was allocated at [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3)
#  735|      cfg = nvc0_hw_metric_query_get_cfg(nvc0, hq);
#  736|   
#  737|->    for (i = 0; i < cfg->num_queries; i++) {
#  738|         hmq->queries[i] = nvc0_hw_sm_create_query(nvc0, cfg->queries[i]);
#  739|         if (!hmq->queries[i]) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def713]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:771:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:750:1: enter_function: entry to ‘nvc0_hw_metric_get_driver_query_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:760:7: branch_false: following ‘false’ branch (when ‘info’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:763:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:763:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:764:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:764:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:765:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:765:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:767:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:769:16: call_function: inlined call to ‘nvc0_hw_metric_get_cfg’ from ‘nvc0_hw_metric_get_driver_query_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_query_hw_metric.c:771:26: danger: dereference of NULL ‘<unknown>’
#  769|                  nvc0_hw_metric_get_cfg(queries[id]->type);
#  770|   
#  771|->             info->name = cfg->name;
#  772|               info->query_type = NVC0_HW_METRIC_QUERY(queries[id]->type);
#  773|               info->type = cfg->type;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def714]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1104:11: warning[-Wanalyzer-malloc-leak]: leak of ‘targ’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1078:1: enter_function: entry to ‘nvc0_so_target_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1083:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1084:7: branch_false: following ‘false’ branch (when ‘targ’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1087:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1088:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1092:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1098:4: call_function: calling ‘pipe_resource_reference’ from ‘nvc0_so_target_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1098:4: return_function: returning to ‘nvc0_so_target_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1104:11: danger: ‘targ’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 1102|      util_range_add(&buf->base, &buf->valid_buffer_range, offset, offset + size);
# 1103|   
# 1104|->    return &targ->pipe;
# 1105|   }
# 1106|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def715]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:236:11: warning[-Wanalyzer-malloc-leak]: leak of ‘view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1421:1: enter_function: entry to ‘gm107_create_image_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1430:7: call_function: calling ‘gm107_create_texture_view_from_image’ from ‘gm107_create_image_handle’
#  234|      tic[7] |= mt->ms_mode << GM107_TIC2_7_MULTI_SAMPLE_COUNT__SHIFT;
#  235|   
#  236|->    return &view->pipe;
#  237|   }
#  238|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def716]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:438:11: warning[-Wanalyzer-malloc-leak]: leak of ‘view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1421:1: enter_function: entry to ‘gm107_create_image_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1430:7: call_function: calling ‘gm107_create_texture_view_from_image’ from ‘gm107_create_image_handle’
#  436|      tic[7] |= mt->ms_mode << 12;
#  437|   
#  438|->    return &view->pipe;
#  439|   }
#  440|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def717]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:887:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:881:35: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:887:7: danger: ‘res’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  885|         assert(tic->bindless);
#  886|   
#  887|->       res->handle = handle;
#  888|         res->buf = nv04_resource(tic->pipe.texture);
#  889|         res->flags = NOUVEAU_BO_RD;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def718]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1363:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc(1, 32)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1355:11: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1361:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1362:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1363:4: danger: ‘calloc(1, 32)’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
# 1361|      screen->img.next = (i + 1) & (NVE4_IMG_MAX_HANDLES - 1);
# 1362|      screen->img.entries[i] = calloc(1, sizeof(struct pipe_image_view));
# 1363|->    *screen->img.entries[i] = *view;
# 1364|   
# 1365|      for (s = 0; s < 6; s++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def719]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1405:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1396:7: branch_true: following ‘true’ branch (when ‘resident != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1397:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1397:35: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1405:7: danger: ‘res’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
# 1403|             access & PIPE_IMAGE_ACCESS_WRITE)
# 1404|            nvc0_mark_image_range_valid(view);
# 1405|->       res->handle = handle;
# 1406|         res->buf = nv04_resource(view->resource);
# 1407|         res->flags = (access & 3) << 8;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def720]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1491:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1485:35: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_tex.c:1491:7: danger: ‘res’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/0)
# 1489|         assert(tic->bindless);
# 1490|   
# 1491|->       res->handle = handle;
# 1492|         res->buf = nv04_resource(tic->pipe.texture);
# 1493|         res->flags = (access & 3) << 8;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def721]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3952:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3951:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3952:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 3950|   {
# 3951|      struct panfrost_blend_state *so = CALLOC_STRUCT(panfrost_blend_state);
# 3952|->    so->base = *blend;
# 3953|   
# 3954|      so->pan.logicop_enable = blend->logicop_enable;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def722]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:134:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo_handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:82:1: enter_function: entry to ‘jm_submit_jc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:117:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:120:24: call_function: inlined call to ‘panfrost_pool_num_bos’ from ‘jm_submit_jc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:120:17: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:129:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:130:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:130:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:134:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_jm.c:134:7: danger: ‘bo_handles + (long unsigned int)submit.bo_handle_count * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  132|   
#  133|         assert(submit.bo_handle_count < batch->num_bos);
#  134|->       bo_handles[submit.bo_handle_count++] = i;
#  135|   
#  136|         /* Update the BO access flags so that panfrost_bo_wait() knows

Error: GCC_ANALYZER_WARNING (CWE-476): [#def723]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_mempool.c:61:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_mempool.c:133:1: enter_function: entry to ‘panfrost_pool_alloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_mempool.c:169:12: call_function: calling ‘panfrost_pool_alloc_backing’ from ‘panfrost_pool_alloc_aligned’
#   59|   
#   60|      if (pool->owned)
#   61|->       util_dynarray_append(&pool->bos, struct panfrost_bo *, bo);
#   62|      else
#   63|         panfrost_bo_unreference(pool->transient_bo);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def724]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:281:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:227:1: enter_function: entry to ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: call_function: calling ‘panfrost_precomp_cache_get’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘panfrost_precomp_cache_get’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: call_function: calling ‘emit_tls’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘emit_tls’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: call_function: calling ‘pan_pool_alloc_descs’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘pan_pool_alloc_descs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:269:4: call_function: calling ‘panfrost_pack_work_groups_compute’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:269:4: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘panfrost_pack_work_groups_compute’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:274:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:275:47: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:280:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:281:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:281:19: danger: dereference of NULL ‘panfrost_precomp_cache_get(((struct panfrost_device *)((char *)MEM[(struct pipe_context *)ctx_44].screen + 696))[1].precomp_cache,  idx)’
#  279|   
#  280|      pan_section_pack(job.cpu, COMPUTE_JOB, DRAW, cfg) {
#  281|->       cfg.state = shader->state_ptr;
#  282|         cfg.push_uniforms = push_uniforms.gpu;
#  283|         cfg.thread_storage = tsd;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def725]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:295:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:227:1: enter_function: entry to ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: call_function: calling ‘panfrost_precomp_cache_get’ from ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: return_function: returning to ‘panfrost_launch_precomp_v9’ from ‘panfrost_precomp_cache_get’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: call_function: calling ‘emit_tls’ from ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: return_function: returning to ‘panfrost_launch_precomp_v9’ from ‘emit_tls’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: call_function: calling ‘pan_pool_alloc_descs’ from ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: return_function: returning to ‘panfrost_launch_precomp_v9’ from ‘pan_pool_alloc_descs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:286:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:287:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:295:28: danger: dereference of NULL ‘panfrost_precomp_cache_get(((struct panfrost_device *)((char *)MEM[(struct pipe_context *)ctx_42].screen + 696))[1].precomp_cache,  idx)’
#  293|         cfg.workgroup_count_z = grid.count[2];
#  294|   
#  295|->       cfg.compute.shader = shader->state_ptr;
#  296|   
#  297|         uint64_t fau_count =

Error: GCC_ANALYZER_WARNING (CWE-688): [#def726]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_shader.c:586:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_shader.c:580:1: enter_function: entry to ‘panfrost_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_shader.c:585:41: call_function: inlined call to ‘panfrost_alloc_variant’ from ‘panfrost_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_shader.c:585:41: call_function: inlined call to ‘panfrost_alloc_variant’ from ‘panfrost_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_shader.c:586:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*<unknown>.variants, 1, 2432)’) NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#  584|      struct panfrost_uncompiled_shader *so = panfrost_alloc_shader(cso->prog);
#  585|      struct panfrost_compiled_shader *v = panfrost_alloc_variant(so);
#  586|->    memset(v, 0, sizeof *v);
#  587|   
#  588|      assert(cso->ir_type == PIPE_SHADER_IR_NIR && "TGSI kernels unsupported");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def727]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:45:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘newblock’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:44:15: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:45:4: danger: ‘newblock’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   43|   
#   44|      newblock = malloc(blocksize);
#   45|->    newblock->next = pool->blocks;
#   46|      pool->blocks = newblock;
#   47|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def728]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:74:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘block’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:56:7: branch_false: following ‘false’ branch (when ‘bytes > 4095’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:72:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:72:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/memory_pool.c:74:7: danger: ‘block’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#   72|         struct memory_block *block = malloc(bytes + sizeof(struct memory_block));
#   73|   
#   74|->       block->next = pool->blocks;
#   75|         pool->blocks = block;
#   76|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def729]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:126:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:633:1: enter_function: entry to ‘ntr_get_chased_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:644:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:645:35: call_function: inlined call to ‘nir_src_for_ssa’ from ‘ntr_get_chased_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:645:35: call_function: calling ‘ntr_get_src’ from ‘ntr_get_chased_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:645:35: return_function: returning to ‘ntr_get_chased_src’ from ‘ntr_get_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:646:17: call_function: calling ‘ntr_reladdr’ from ‘ntr_get_chased_src’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  124|         .precise = c->precise,
#  125|      };
#  126|->    util_dynarray_append(&c->cur_block->insns, struct ntr_insn, insn);
#  127|      return util_dynarray_top_ptr(&c->cur_block->insns, struct ntr_insn);
#  128|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def730]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:1743:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:1977:1: enter_function: entry to ‘nir_to_rc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:2147:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_to_rc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:2147:30: return_function: returning to ‘nir_to_rc’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/nir_to_rc.c:2148:4: call_function: calling ‘ntr_emit_impl’ from ‘nir_to_rc’
# 1741|      c->impl = impl;
# 1742|   
# 1743|->    c->ssa_temp = rzalloc_array(c, struct ureg_src, impl->ssa_alloc);
# 1744|      c->reg_temp = rzalloc_array(c, struct ureg_dst, impl->ssa_alloc);
# 1745|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def731]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:503:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:372:57: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:374:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:390:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:398:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:494:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:498:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:498:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:503:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r3xx_vertprog.c:503:10: danger: out-of-bounds read from byte 17179869180 till byte 17179869183 but ‘loops’ ends at byte 32
#  501|            }
#  502|   
#  503|->          ret_addr = loops[--loop_depth];
#  504|            act_addr = ret_addr - 1;
#  505|            last_addr = (compiler->code->length / 4) - 1;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def732]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r500_nir_lower_fcsel.c:59:31: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘src_def_index[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r500_nir_lower_fcsel.c:116:1: enter_function: entry to ‘r300_nir_lower_fcsel_r500’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/r500_nir_lower_fcsel.c:118:11: call_function: calling ‘nir_shader_alu_pass’ from ‘r300_nir_lower_fcsel_r500’
#   57|            src_def_index[i] = index;
#   58|      }
#   59|->    return src_def_index[0] != src_def_index[1] && src_def_index[0] != src_def_index[2] &&
#   60|             src_def_index[1] != src_def_index[2];
#   61|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def733]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ra_q_values’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:457:16: branch_true: following ‘true’ branch (when ‘i < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:458:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:475:18: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:477:16: branch_true: following ‘true’ branch (when ‘i < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:7: danger: ‘ra_q_values + (long unsigned int)i * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  476|   
#  477|      for (i = 0; i < class_count; i++) {
#  478|->       ra_q_values[i] = MALLOC(class_count * sizeof(unsigned));
#  479|         for (j = 0; j < class_count; j++) {
#  480|            if (prog == RC_FRAGMENT_PROGRAM)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def734]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:481:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc((long unsigned int)class_count * 4)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:457:16: branch_true: following ‘true’ branch (when ‘i < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:458:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:477:16: branch_true: following ‘true’ branch (when ‘i < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:24: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:479:19: branch_true: following ‘true’ branch (when ‘j < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:480:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:480:13: branch_true: following ‘true’ branch (when ‘prog == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:481:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:481:13: danger: ‘malloc((long unsigned int)class_count * 4) + (long unsigned int)j * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  479|         for (j = 0; j < class_count; j++) {
#  480|            if (prog == RC_FRAGMENT_PROGRAM)
#  481|->             ra_q_values[i][j] = q_values_fp[i][j];
#  482|            else
#  483|               ra_q_values[i][j] = q_values_vp[i][j];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def735]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:483:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc((long unsigned int)class_count * 4)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:457:16: branch_true: following ‘true’ branch (when ‘i < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:458:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:477:16: branch_true: following ‘true’ branch (when ‘i < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:478:24: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:479:19: branch_true: following ‘true’ branch (when ‘j < class_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:480:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:480:13: branch_false: following ‘false’ branch (when ‘prog != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:483:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_regalloc.c:483:13: danger: ‘malloc((long unsigned int)class_count * 4) + (long unsigned int)j * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/4)
#  481|               ra_q_values[i][j] = q_values_fp[i][j];
#  482|            else
#  483|->             ra_q_values[i][j] = q_values_vp[i][j];
#  484|         }
#  485|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def736]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:83:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘remap_state.new_constants.Constants’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:163:1: enter_function: entry to ‘rc_remove_unused_constants’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:170:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:175:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:175:4: call_function: calling ‘init_constant_remap_state’ from ‘rc_remove_unused_constants’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:175:4: return_function: returning to ‘rc_remove_unused_constants’ from ‘init_constant_remap_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:179:9: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:185:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:185:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:185:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:197:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:198:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:198:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:200:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:200:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:201:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:201:10: call_function: calling ‘place_constant_in_free_slot’ from ‘rc_remove_unused_constants’
#   81|         }
#   82|      }
#   83|->    s->new_constants.Constants[count] = s->constants[i];
#   84|   
#   85|      if (count != i) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def737]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_variable.c:513:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_variable.c:510:1: enter_function: entry to ‘rc_variable_list_get_writers_one_reader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_variable.c:512:34: call_function: calling ‘rc_variable_list_get_writers’ from ‘rc_variable_list_get_writers_one_reader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_variable.c:512:34: return_function: returning to ‘rc_variable_list_get_writers_one_reader’ from ‘rc_variable_list_get_writers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/compiler/radeon_variable.c:513:60: danger: dereference of NULL ‘rc_variable_list_get_writers(var_list,  src_type,  src)’
#  511|   {
#  512|      struct rc_list *writer_list = rc_variable_list_get_writers(var_list, src_type, src);
#  513|->    struct rc_list *reader_list = rc_variable_readers_union(writer_list->Item);
#  514|      if (rc_list_count(reader_list) > 1) {
#  515|         return NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def738]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:421:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:392:6: enter_function: entry to ‘r300_emit_fb_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:418:17: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:419:16: call_function: inlined call to ‘r300_get_nonnull_cb’ from ‘r300_emit_fb_state’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:419:16: call_function: inlined call to ‘r300_get_nonnull_cb’ from ‘r300_emit_fb_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:419:16: call_function: inlined call to ‘r300_get_nonnull_cb’ from ‘r300_emit_fb_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:421:9: danger: dereference of NULL ‘<unknown>’
#  419|           surf = r300_surface(r300_get_nonnull_cb(fb, i));
#  420|   
#  421|->         OUT_CS_REG(R300_RB3D_COLOROFFSET0 + (4 * i), surf->offset);
#  422|           OUT_CS_RELOC(surf);
#  423|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def739]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:487:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&*(struct r300_hyperz_state *)state.cb_flush_begin’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:492:6: enter_function: entry to ‘r300_emit_hyperz_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:503:5: call_function: calling ‘r300_emit_hyperz_state’ from ‘r300_emit_hyperz_end’
#  485|   
#  486|       if (z->flush)
#  487|->         WRITE_CS_TABLE(&z->cb_flush_begin, size);
#  488|       else
#  489|           WRITE_CS_TABLE(&z->cb_begin, size - 2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def740]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:600:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:559:6: enter_function: entry to ‘r300_emit_fb_state_pipelined’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:590:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:591:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:599:17: branch_true: following ‘true’ branch (when ‘i < num_cbufs’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:600:9: call_function: inlined call to ‘r300_get_nonnull_cb’ from ‘r300_emit_fb_state_pipelined’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_emit.c:600:9: danger: dereference of NULL ‘<unknown>’
#  598|       OUT_CS_REG_SEQ(R300_US_OUT_FMT_0, 4);
#  599|       for (i = 0; i < num_cbufs; i++) {
#  600|->         OUT_CS(r300_surface(r300_get_nonnull_cb(fb, i))->format);
#  601|       }
#  602|       for (; i < 1; i++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def741]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:244:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*shader.cb_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:234:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:238:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:242:9: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:243:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:244:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:244:13: danger: ‘malloc((long unsigned int)((unsigned int)((*(struct r500_fragment_program_code *)shader.inst_end + 1) * 6) + imm_count * 7 + *(struct r500_fragment_program_code *)shader.int_constant_count * 2 + 19) * 4)’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
#  242|           NEW_CB(shader->cb_code, shader->cb_code_size);
#  243|           if (r300->screen->options.ieeemath)
#  244|->             OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_DEFAULT);
#  245|           else
#  246|               OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_LEGACY);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def742]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:244:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc((long unsigned int)((unsigned int)((*(struct r500_fragment_program_code *)shader.inst_end + 1) * 6) + imm_count * 7 + *(struct r500_fragment_program_code *)shader.int_constant_count * 2 + 19) * 4)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:560:6: enter_function: entry to ‘r300_pick_fragment_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:566:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:568:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:571:9: call_function: calling ‘r300_translate_fragment_shader’ from ‘r300_pick_fragment_shader’
#  242|           NEW_CB(shader->cb_code, shader->cb_code_size);
#  243|           if (r300->screen->options.ieeemath)
#  244|->             OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_DEFAULT);
#  245|           else
#  246|               OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_LEGACY);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def743]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:246:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*shader.cb_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:234:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:238:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:242:9: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:243:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:246:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:246:13: danger: ‘malloc((long unsigned int)((unsigned int)((*(struct r500_fragment_program_code *)shader.inst_end + 1) * 6) + imm_count * 7 + *(struct r500_fragment_program_code *)shader.int_constant_count * 2 + 19) * 4)’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  244|               OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_DEFAULT);
#  245|           else
#  246|->             OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_LEGACY);
#  247|           OUT_CB_REG(R500_US_PIXSIZE, code->max_temp_idx);
#  248|           OUT_CB_REG(R500_US_FC_CTRL, code->us_fc_ctrl);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def744]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:246:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc((long unsigned int)((unsigned int)((*(struct r500_fragment_program_code *)shader.inst_end + 1) * 6) + imm_count * 7 + *(struct r500_fragment_program_code *)shader.int_constant_count * 2 + 19) * 4)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:560:6: enter_function: entry to ‘r300_pick_fragment_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:566:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:568:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:571:9: call_function: calling ‘r300_translate_fragment_shader’ from ‘r300_pick_fragment_shader’
#  244|               OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_DEFAULT);
#  245|           else
#  246|->             OUT_CB_REG(R500_US_CONFIG, R500_ZERO_TIMES_ANYTHING_EQUALS_ZERO_LEGACY);
#  247|           OUT_CB_REG(R500_US_PIXSIZE, code->max_temp_idx);
#  248|           OUT_CB_REG(R500_US_FC_CTRL, code->us_fc_ctrl);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def745]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:312:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*shader.cb_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:234:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:286:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:290:13: branch_false: following ‘false’ branch (when ‘tex_length == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:291:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:307:13: branch_false: following ‘false’ branch (when ‘tex_length == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:295:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:310:9: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:312:9: danger: ‘malloc((long unsigned int)(<unknown> + <unknown> + <unknown> + <unknown> + alu_length * 4 + <unknown> + imm_count * 5) * 4)’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/6)
#  310|           NEW_CB(shader->cb_code, shader->cb_code_size);
#  311|   
#  312|->         OUT_CB_REG(R300_US_CONFIG, code->config);
#  313|           OUT_CB_REG(R300_US_PIXSIZE, code->pixsize);
#  314|           OUT_CB_REG(R300_US_CODE_OFFSET, code->code_offset);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def746]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:594:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:566:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:577:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:577:12: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:580:20: branch_true: following ‘true’ branch (when ‘ptr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:581:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:581:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:589:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:593:19: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_fs.c:594:13: danger: ‘ptr’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/8)
#  592|               /* Not found, gotta compile a new one. */
#  593|               ptr = CALLOC_STRUCT(r300_fragment_shader_code);
#  594|->             ptr->next = fs->first;
#  595|               fs->first = fs->shader = ptr;
#  596|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def747]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:445:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘imm_indices3[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:775:13: enter_function: entry to ‘r300_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:782:7: branch_false: following ‘false’ branch (when ‘num_draws <= 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:788:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:791:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:792:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:792:10: call_function: calling ‘u_trim_pipe_prim’ from ‘r300_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:792:10: return_function: returning to ‘r300_draw_vbo’ from ‘u_trim_pipe_prim’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:791:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:796:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:805:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:809:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:809:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:810:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:812:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:818:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:825:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:826:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:829:17: call_function: calling ‘r300_draw_elements’ from ‘r300_draw_vbo’
#  443|           OUT_CS(R300_VAP_VF_CNTL__PRIM_WALK_INDICES | (3 << 16) |
#  444|                  R300_VAP_VF_CNTL__PRIM_TRIANGLES);
#  445|->         OUT_CS(imm_indices3[1] << 16 | imm_indices3[0]);
#  446|           OUT_CS(imm_indices3[2]);
#  447|           END_CS;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def748]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:599:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:775:13: enter_function: entry to ‘r300_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:782:7: branch_false: following ‘false’ branch (when ‘num_draws <= 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:788:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:791:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:792:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:792:10: call_function: calling ‘u_trim_pipe_prim’ from ‘r300_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:792:10: return_function: returning to ‘r300_draw_vbo’ from ‘u_trim_pipe_prim’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:791:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:796:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:805:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:809:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:809:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:810:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:812:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:818:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:825:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:826:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:829:17: call_function: calling ‘r300_draw_elements’ from ‘r300_draw_vbo’
#  597|       if (indexSize == 2 && (start & 1) && indexBuffer) {
#  598|           /* If we got here, then orgIndexBuffer == indexBuffer. */
#  599|->         uint16_t *ptr = r300->rws->buffer_map(r300->rws, r300_resource(orgIndexBuffer)->buf,
#  600|                                                 &r300->cs,
#  601|                                                 PIPE_MAP_READ |

Error: GCC_ANALYZER_WARNING (CWE-476): [#def749]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:1095:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘r300render’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:1093:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:1095:5: danger: ‘r300render’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
# 1093|       struct r300_render* r300render = CALLOC_STRUCT(r300_render);
# 1094|   
# 1095|->     r300render->r300 = r300;
# 1096|   
# 1097|       r300render->base.max_vertex_buffer_bytes = R300_MAX_DRAW_VBO_SIZE;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def750]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:1110:12: warning[-Wanalyzer-malloc-leak]: leak of ‘r300render’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:1093:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render.c:1110:12: danger: ‘r300render’ leaks here; was allocated at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 1108|       r300render->base.destroy = r300_render_destroy;
# 1109|   
# 1110|->     return &r300render->base;
# 1111|   }
# 1112|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def751]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render_stencilref.c:111:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*r300.stencilref_fallback’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render_stencilref.c:108:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_render_stencilref.c:111:5: danger: ‘calloc(1, 24)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  109|   
#  110|       /* Save original draw function. */
#  111|->     r300->stencilref_fallback->draw_vbo = r300->context.draw_vbo;
#  112|   
#  113|       /* Override the draw function. */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def752]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:154:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘rbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:152:12: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:154:5: danger: ‘rbuf’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  152|       rbuf = MALLOC_STRUCT(r300_resource);
#  153|   
#  154|->     rbuf->b = *templ;
#  155|       pipe_reference_init(&rbuf->b.reference, 1);
#  156|       rbuf->b.screen = screen;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def753]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:168:16: warning[-Wanalyzer-malloc-leak]: leak of ‘rbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:146:23: enter_function: entry to ‘r300_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:152:12: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:167:33: call_function: calling ‘os_malloc_aligned’ from ‘r300_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:167:33: return_function: returning to ‘r300_buffer_create’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:168:16: danger: ‘rbuf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  166|           (!r300screen->caps.has_tcl && !(templ->bind & PIPE_BIND_CUSTOM))) {
#  167|           rbuf->malloced_buffer = align_malloc(templ->width0, 64);
#  168|->         return &rbuf->b;
#  169|       }
#  170|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def754]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:180:12: warning[-Wanalyzer-malloc-leak]: leak of ‘rbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:152:12: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:165:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:166:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:176:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:180:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_screen_buffer.c:180:12: danger: ‘rbuf’ leaks here; was allocated at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  178|           return NULL;
#  179|       }
#  180|->     return &rbuf->b;
#  181|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def755]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:678:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘dsa’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:670:34: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:678:5: danger: ‘dsa’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  676|       uint32_t stencil_ref_bf = 0;
#  677|   
#  678|->     dsa->dsa = *state;
#  679|   
#  680|       /* Depth test setup. - separate write mask depth for decomp flush */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def756]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1033:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1030:40: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1033:5: danger: ‘fs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 1031|   
# 1032|       /* Copy state directly into shader. */
# 1033|->     fs->state = *shader;
# 1034|   
# 1035|       if (fs->state.type == PIPE_SHADER_IR_NIR) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def757]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1198:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘rs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1175:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1198:5: danger: ‘rs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
# 1196|   
# 1197|       /* Copy rasterizer state. */
# 1198|->     rs->rs = *state;
# 1199|       rs->rs_draw = *state;
# 1200|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def758]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1458:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘sampler’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1454:42: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1458:5: danger: ‘sampler’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 1456|       int lod_bias;
# 1457|   
# 1458|->     sampler->state = *state;
# 1459|   
# 1460|       /* r300 doesn't handle CLAMP and MIRROR_CLAMP correctly when either MAG

Error: GCC_ANALYZER_WARNING (CWE-476): [#def759]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1953:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1950:37: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1953:5: danger: ‘vs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/0)
# 1951|   
# 1952|       /* Copy state directly into shader. */
# 1953|->     vs->state = *shader;
# 1954|   
# 1955|       if (vs->state.type == PIPE_SHADER_IR_NIR) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def760]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1187:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘texture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1164:22: enter_function: entry to ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1176:8: branch_true: following ‘true’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1179:9: call_function: inlined call to ‘pipe_reference_init’ from ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1180:9: call_function: calling ‘pipe_resource_reference’ from ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1180:9: return_function: returning to ‘r300_create_surface_custom’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1187:24: danger: dereference of NULL ‘texture’
# 1185|           surface->base.u.tex.last_layer = surf_tmpl->u.tex.last_layer;
# 1186|   
# 1187|->         surface->buf = tex->buf;
# 1188|   
# 1189|           /* Prefer VRAM if there are multiple domains to choose from. */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def761]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1235:12: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1164:22: enter_function: entry to ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1171:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1176:8: branch_true: following ‘true’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1179:9: call_function: inlined call to ‘pipe_reference_init’ from ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1180:9: call_function: calling ‘pipe_resource_reference’ from ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1180:9: return_function: returning to ‘r300_create_surface_custom’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1196:9: call_function: calling ‘r300_texture_setup_fb_state’ from ‘r300_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1196:9: return_function: returning to ‘r300_create_surface_custom’ from ‘r300_texture_setup_fb_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_texture.c:1235:12: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
# 1233|       }
# 1234|   
# 1235|->     return &surface->base;
# 1236|   }
# 1237|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def762]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:198:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘trans’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:106:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:107:8: release_memory: assuming ‘trans’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:107:8: branch_false: following ‘false’ branch (when ‘trans’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:198:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:198:9: danger: dereference of NULL ‘trans’
#  196|       }
#  197|   
#  198|->     if (trans->linear_texture) {
#  199|           /* The detiled texture is of the same size as the region being mapped
#  200|            * (no offset needed). */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def763]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:209:9: warning[-Wanalyzer-malloc-leak]: leak of ‘trans’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:106:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:107:8: branch_true: following ‘true’ branch (when ‘trans’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:109:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:203:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:209:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:209:9: danger: ‘trans’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  207|               return NULL;
#  208|           }
#  209|-> 	*transfer = &trans->transfer;
#  210|           return map;
#  211|       } else {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def764]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:220:16: warning[-Wanalyzer-malloc-leak]: leak of ‘trans’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:106:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:107:8: branch_true: following ‘true’ branch (when ‘trans’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:109:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:117:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:198:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:213:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:214:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:219:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r300/r300_transfer.c:220:16: danger: ‘trans’ leaks here; was allocated at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  218|   
#  219|   	*transfer = &trans->transfer;
#  220|->         return map + trans->transfer.offset +
#  221|               box->y / util_format_get_blockheight(format) * trans->transfer.stride +
#  222|               box->x / util_format_get_blockwidth(format) * util_format_get_blocksize(format);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def765]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:200:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
#  198|   	 * of global symbols.
#  199|   	 */
#  200|-> 	binary->global_symbol_offsets = CALLOC(symbol_count, sizeof(uint64_t));
#  201|   
#  202|   	while (gelf_getsym(symbol_table_data, i++, &symbol)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def766]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:209:17: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*binary.global_symbol_offsets + (long unsigned int)*binary.global_symbol_count * 8’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
#  207|   		}
#  208|   
#  209|-> 		binary->global_symbol_offsets[binary->global_symbol_count] =
#  210|   					symbol.st_value;
#  211|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def767]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:289:25: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
#  287|   			section_data = elf_getdata(section, section_data);
#  288|   			binary->code_size = section_data->d_size;
#  289|-> 			binary->code = MALLOC(binary->code_size * sizeof(unsigned char));
#  290|   			memcpy(binary->code, section_data->d_buf, binary->code_size);
#  291|   		} else if (!strcmp(name, ".AMDGPU.config")) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def768]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:294:25: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
#  292|   			section_data = elf_getdata(section, section_data);
#  293|   			binary->config_size = section_data->d_size;
#  294|-> 			binary->config = MALLOC(binary->config_size * sizeof(unsigned char));
#  295|   			memcpy(binary->config, section_data->d_buf, binary->config_size);
#  296|   		} else if (!strcmp(name, ".AMDGPU.disasm")) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def769]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:304:25: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
#  302|   			section_data = elf_getdata(section, section_data);
#  303|   			binary->rodata_size = section_data->d_size;
#  304|-> 			binary->rodata = MALLOC(binary->rodata_size * sizeof(unsigned char));
#  305|   			memcpy(binary->rodata, section_data->d_buf, binary->rodata_size);
#  306|   		} else if (!strncmp(name, ".symtab", 7)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def770]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:340:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: return_function: returning to ‘evergreen_create_compute_state’ from ‘r600_elf_read’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:438:9: call_function: calling ‘r600_create_shader’ from ‘evergreen_create_compute_state’
#  338|   	unsigned i;
#  339|   	for (i = 0; i < binary->global_symbol_count; ++i) {
#  340|-> 		if (binary->global_symbol_offsets[i] == symbol_offset) {
#  341|   			unsigned offset = i * binary->config_size_per_symbol;
#  342|   			return binary->config + offset;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def771]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:340:21: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*binary.global_symbol_offsets + (long unsigned int)i * 8’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:404:14: enter_function: entry to ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:421:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:434:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: call_function: calling ‘r600_elf_read’ from ‘evergreen_create_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:437:9: return_function: possible return of NULL to ‘evergreen_create_compute_state’ from ‘r600_elf_read’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:438:9: call_function: calling ‘r600_create_shader’ from ‘evergreen_create_compute_state’
#  338|   	unsigned i;
#  339|   	for (i = 0; i < binary->global_symbol_count; ++i) {
#  340|-> 		if (binary->global_symbol_offsets[i] == symbol_offset) {
#  341|   			unsigned offset = i * binary->config_size_per_symbol;
#  342|   			return binary->config + offset;

Error: GCC_ANALYZER_WARNING (CWE-131): [#def772]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:389:9: warning[-Wanalyzer-allocation-size]: allocated buffer size is not a multiple of the pointee's size
#  387|   {
#  388|   	assert(binary->code_size % 4 == 0);
#  389|-> 	bc->bytecode = CALLOC(1, binary->code_size);
#  390|   	memcpy(bc->bytecode, binary->code, binary->code_size);
#  391|   	bc->ndw = binary->code_size / 4;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def773]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:415:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:408:44: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:415:9: danger: ‘shader’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/11/codeFlows/0/threadFlows/0/locations/0)
#  413|   #endif
#  414|   
#  415|-> 	shader->ctx = rctx;
#  416|   	shader->local_size = cso->static_shared_mem;
#  417|   	shader->input_size = cso->req_input_mem;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def774]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1358:16: warning[-Wanalyzer-malloc-leak]: leak of ‘result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1322:23: enter_function: entry to ‘r600_compute_global_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1336:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1346:9: call_function: inlined call to ‘pipe_reference_init’ from ‘r600_compute_global_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1352:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1358:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/evergreen_compute.c:1358:16: danger: ‘result’ leaks here; was allocated at [(2)](sarif:/runs/0/results/12/codeFlows/0/threadFlows/0/locations/1)
# 1356|   	}
# 1357|   
# 1358|-> 	return &result->base.b.b;
# 1359|   }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def775]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1018:33: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘kcache + (long unsigned int)i * 16’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1401:5: enter_function: entry to ‘r600_bytecode_add_alu’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1403:16: call_function: calling ‘r600_bytecode_add_alu_type’ from ‘r600_bytecode_add_alu’
# 1016|   				}
# 1017|   
# 1018|-> 				memmove(&kcache[i+1],&kcache[i], (kcache_banks-i-1)*sizeof(struct r600_bytecode_kcache));
# 1019|   				kcache[i].mode = V_SQ_CF_KCACHE_LOCK_1;
# 1020|   				kcache[i].bank = bank;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def776]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:385:33: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:280:20: enter_function: entry to ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:293:12: branch_false: following ‘false’ branch (when ‘pc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:296:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:297:12: branch_false: following ‘false’ branch (when ‘query’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:300:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:306:21: branch_true: following ‘true’ branch (when ‘i < num_queries’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:309:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:309:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:312:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:312:25: call_function: calling ‘lookup_counter’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:312:25: return_function: returning to ‘r600_create_batch_query’ from ‘lookup_counter’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:314:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:317:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:320:25: call_function: calling ‘get_group_state’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:320:25: return_function: returning to ‘r600_create_batch_query’ from ‘get_group_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:321:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:324:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:324:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:330:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:342:37: branch_true: following ‘true’ branch (when ‘group’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:343:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:342:37: branch_false: following ‘false’ branch (when ‘group’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:364:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:364:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:371:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:372:21: branch_true: following ‘true’ branch (when ‘i < num_queries’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:373:52: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:376:25: call_function: calling ‘lookup_counter’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:376:25: return_function: returning to ‘r600_create_batch_query’ from ‘lookup_counter’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:382:25: call_function: calling ‘get_group_state’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:382:25: return_function: returning to ‘r600_create_batch_query’ from ‘get_group_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:385:33: danger: dereference of NULL ‘get_group_state(screen,  query,  lookup_counter(pc, *<unknown> + 4294966940, &base_gid, & sub_index), sub_gid)’
#  383|   		assert(group != NULL);
#  384|   
#  385|-> 		for (j = 0; j < group->num_counters; ++j) {
#  386|   			if (group->selectors[j] == sub_index)
#  387|   				break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def777]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:390:17: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘counter’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:280:20: enter_function: entry to ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:293:12: branch_false: following ‘false’ branch (when ‘pc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:296:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:297:12: branch_false: following ‘false’ branch (when ‘query’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:300:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:306:21: branch_true: following ‘true’ branch (when ‘i < num_queries’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:309:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:309:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:312:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:312:25: call_function: calling ‘lookup_counter’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:312:25: return_function: returning to ‘r600_create_batch_query’ from ‘lookup_counter’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:314:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:317:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:320:25: call_function: calling ‘get_group_state’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:320:25: return_function: returning to ‘r600_create_batch_query’ from ‘get_group_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:321:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:324:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:324:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:330:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:342:37: branch_true: following ‘true’ branch (when ‘group’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:343:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:342:37: branch_false: following ‘false’ branch (when ‘group’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:364:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:364:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:371:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:371:27: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:372:21: branch_true: following ‘true’ branch (when ‘i < num_queries’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:373:52: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:376:25: call_function: calling ‘lookup_counter’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:376:25: return_function: returning to ‘r600_create_batch_query’ from ‘lookup_counter’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:382:25: call_function: calling ‘get_group_state’ from ‘r600_create_batch_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:382:25: return_function: returning to ‘r600_create_batch_query’ from ‘get_group_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_perfcounter.c:390:17: danger: ‘counter’ could be NULL: unchecked value from [(38)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/37)
#  388|   		}
#  389|   
#  390|-> 		counter->base = group->result_base + j;
#  391|   		counter->stride = group->num_counters;
#  392|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def778]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_query.c:772:17: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘qbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_query.c:770:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_query.c:771:50: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_query.c:771:50: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_query.c:772:17: danger: ‘qbuf’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  770|   	if (query->buffer.results_end + query->result_size > query->buffer.buf->b.b.width0) {
#  771|   		struct r600_query_buffer *qbuf = MALLOC_STRUCT(r600_query_buffer);
#  772|-> 		*qbuf = query->buffer;
#  773|   		query->buffer.results_end = 0;
#  774|   		query->buffer.previous = qbuf;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def779]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:921:17: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2117:13: enter_function: entry to ‘r600_draw_vbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2123:12: branch_false: following ‘false’ branch (when ‘num_draws <= 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2129:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2141:12: branch_true: following ‘true’ branch (when ‘indirect’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2141:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2141:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2150:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2150:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2154:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_state_common.c:2192:14: call_function: calling ‘r600_update_derived_state’ from ‘r600_draw_vbo’
#  919|   	if (unlikely(!shader)) {
#  920|   		shader = CALLOC(1, sizeof(struct r600_pipe_shader));
#  921|-> 		shader->selector = sel;
#  922|   
#  923|   		r = r600_pipe_shader_create(ctx, shader, key);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def780]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:60:42: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ptr_cpu’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:155:6: enter_function: entry to ‘r600_test_dma’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:186:21: branch_true: following ‘true’ branch (when ‘i != 1000000000’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:187:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:237:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:248:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:260:17: call_function: calling ‘alloc_cpu_texture’ from ‘r600_test_dma’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:260:17: return_function: returning to ‘r600_test_dma’ from ‘alloc_cpu_texture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_test_dma.c:272:17: call_function: calling ‘set_random_pixels’ from ‘r600_test_dma’
#   58|   
#   59|   			for (x = 0; x < size; x++) {
#   60|-> 				*ptr++ = *ptr_cpu++ =
#   61|   					rand_xorshift128plus(seed_xorshift128plus);
#   62|   			}

Error: GCC_ANALYZER_WARNING (CWE-401): [#def781]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1519:16: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1497:22: enter_function: entry to ‘r600_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1502:40: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1504:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1510:9: call_function: inlined call to ‘pipe_reference_init’ from ‘r600_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1511:9: call_function: calling ‘pipe_resource_reference’ from ‘r600_create_surface_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1511:9: return_function: returning to ‘r600_create_surface_custom’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_texture.c:1519:16: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 1517|   	surface->height0 = height0;
# 1518|   
# 1519|-> 	return &surface->base;
# 1520|   }
# 1521|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def782]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:44:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:57:1: enter_function: entry to ‘r600_instr_can_rewrite’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:70:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘r600_instr_can_rewrite’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:71:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:74:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:74:11: call_function: calling ‘nir_deref_instr_get_variable’ from ‘r600_instr_can_rewrite’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:74:11: return_function: returning to ‘r600_instr_can_rewrite’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/sfn/sfn_nir_vectorize_vs_inputs.c:74:11: call_function: calling ‘r600_variable_can_rewrite’ from ‘r600_instr_can_rewrite’
#   42|   
#   43|      /* Skip complex types we don't split in the first place */
#   44|->    if (!glsl_type_is_vector_or_scalar(glsl_without_array(var->type)))
#   45|         return false;
#   46|   

Error: GCC_ANALYZER_WARNING (CWE-835): [#def783]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:355:32: warning[-Wanalyzer-infinite-loop]: infinite loop
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:355:32: danger: infinite loop here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:355:24: branch_true: if it ever follows ‘true’ branch, it will always do so...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:355:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:356:22: branch_true: if it ever follows ‘true’ branch, it will always do so...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:356:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:357:10: branch_true: when ‘end == 0’: always following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/gfx11_query.c:357:10: branch_true: ...to here
#  353|      struct gfx11_sh_query_buffer *qbuf = query->first;
#  354|      for (;;) {
#  355|->       unsigned begin = qbuf == query->first ? query->first_begin : 0;
#  356|         unsigned end = qbuf == query->last ? query->last_end : qbuf->buf->b.b.width0;
#  357|         if (!end)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def784]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:249:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘slice_segment’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:183:14: enter_function: entry to ‘radeon_uvd_enc_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:193:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:200:7: branch_false: following ‘false’ branch (when ‘data’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:203:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:205:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:214:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:214:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:245:21: call_function: inlined call to ‘align’ from ‘radeon_uvd_enc_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:249:4: danger: dereference of NULL ‘slice_segment’
#  247|   
#  248|      assert(slice_segment);
#  249|->    slice_segment->offset = enc->bs_offset;
#  250|   
#  251|      enc->ws->buffer_unmap(enc->ws, enc->bs_handle);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def785]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:274:4: warning[-Wanalyzer-malloc-leak]: leak of ‘radeon_uvd_enc_encode_headers(encoder)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:256:13: enter_function: entry to ‘radeon_uvd_enc_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:267:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:272:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:272:25: call_function: calling ‘radeon_uvd_enc_encode_headers’ from ‘radeon_uvd_enc_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:272:25: return_function: returning to ‘radeon_uvd_enc_encode_bitstream’ from ‘radeon_uvd_enc_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_uvd_enc.c:274:4: danger: ‘radeon_uvd_enc_encode_headers(encoder)’ leaks here; was allocated at [(8)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/7)
#  272|      enc->fb->user_data = radeon_uvd_enc_encode_headers(enc);
#  273|   
#  274|->    enc->need_feedback = true;
#  275|      enc->encode(enc);
#  276|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def786]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:254:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘slice_segment’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:188:14: enter_function: entry to ‘si_vce_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:198:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:205:7: branch_false: following ‘false’ branch (when ‘data’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:208:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:210:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:219:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:219:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:250:21: call_function: inlined call to ‘align’ from ‘si_vce_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:254:4: danger: dereference of NULL ‘slice_segment’
#  252|   
#  253|      assert(slice_segment);
#  254|->    slice_segment->offset = enc->bs_offset;
#  255|   
#  256|      enc->ws->buffer_unmap(enc->ws, enc->bs_handle);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def787]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:648:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘hevc_reflist’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1486:31: enter_function: entry to ‘rvcn_dec_message_decode’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1526:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1531:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1545:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1590:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1609:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1767:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1772:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1794:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1799:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1799:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1822:8: branch_false: ...to here
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1822:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1822:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1823:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1823:7: call_function: calling ‘get_h265_reflist’ from ‘rvcn_dec_message_decode’
#  646|                                struct pipe_h265_picture_desc *pic)
#  647|   {
#  648|->    hevc_reflist->num_direct_reflist = pic->slice_parameter.slice_count;
#  649|      for (int i = 0; i <hevc_reflist->num_direct_reflist; i++) {
#  650|         for (int j = 0; j < 2; j++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def788]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1599:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1526:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1531:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1531:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1536:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1545:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1590:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1599:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1599:7: danger: dereference of NULL ‘index_dynamic_dpb’
# 1597|   
# 1598|      if (dec->dpb_type == DPB_DYNAMIC_TIER_1 || dec->dpb_type == DPB_DYNAMIC_TIER_2) {
# 1599|->       index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB;
# 1600|         index_dynamic_dpb->offset = offset_dynamic_dpb;
# 1601|         index_dynamic_dpb->filled = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def789]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1610:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_hevc_direct_reflist’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1526:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1531:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1531:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1536:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1545:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1590:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1609:8: branch_false: ...to here
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1609:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1609:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1610:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1610:7: danger: dereference of NULL ‘index_hevc_direct_reflist’
# 1608|   
# 1609|      if (u_reduce_video_profile(picture->profile) == PIPE_VIDEO_FORMAT_HEVC) {
# 1610|->       index_hevc_direct_reflist->message_id = RDECODE_MESSAGE_HEVC_DIRECT_REF_LIST;
# 1611|         index_hevc_direct_reflist->offset = offset_hevc_direct_reflist;
# 1612|         index_hevc_direct_reflist->size = align((4 + 2 * 15 * ((struct pipe_h265_picture_desc *)picture)->slice_parameter.slice_count), 4);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def790]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1805:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1526:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1531:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1545:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1590:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1598:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1609:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1767:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1772:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1794:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1799:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1799:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1800:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1802:10: branch_false: following ‘false’ branch (when ‘dpb_resize == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1805:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1805:7: danger: dereference of NULL ‘dynamic_dpb’
# 1803|           decode->decode_flags |= RDECODE_FLAGS_DPB_RESIZE_MASK;
# 1804|   
# 1805|->       dynamic_dpb->dpbArraySize = NUM_VP9_REFS + 1;
# 1806|         dynamic_dpb->dpbLumaPitch = align(dec->max_width, dec->db_alignment);
# 1807|         dynamic_dpb->dpbLumaAlignedHeight = align(dec->max_height, dec->db_alignment);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def791]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2821:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2782:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2785:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2785:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2791:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2792:24: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2792:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2811:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2817:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2821:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2822:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2822:67: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2821:9: danger: dereference of NULL ‘*dec.ectx’
# 2819|      dec->sq.engine_ib_size_of_packages = NULL;
# 2820|   
# 2821|->    if (!ws->cs_create(&dec->cs,
# 2822|                         (sctx->vcn_has_ctx) ? ((struct si_context *)dec->ectx)->ctx : sctx->ctx,
# 2823|                         ring, NULL, NULL)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def792]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1746:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘slice_segment’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1694:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1695:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1700:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1707:7: branch_false: following ‘false’ branch (when ‘data’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1710:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1712:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1721:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1721:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1722:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1722:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1729:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1746:4: danger: dereference of NULL ‘slice_segment’
# 1744|   
# 1745|      assert(slice_segment);
# 1746|->    slice_segment->offset = enc->bs_offset;
# 1747|   
# 1748|      enc->ws->buffer_unmap(enc->ws, enc->bs_handle);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def793]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1776:8: warning[-Wanalyzer-malloc-leak]: leak of ‘radeon_vcn_enc_encode_headers(encoder)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1753:13: enter_function: entry to ‘radeon_enc_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1769:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1774:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1774:25: call_function: calling ‘radeon_vcn_enc_encode_headers’ from ‘radeon_enc_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1774:25: return_function: returning to ‘radeon_enc_encode_bitstream’ from ‘radeon_vcn_enc_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1776:8: danger: ‘radeon_vcn_enc_encode_headers(encoder)’ leaks here; was allocated at [(10)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/9)
# 1774|      enc->fb->user_data = radeon_vcn_enc_encode_headers(enc);
# 1775|   
# 1776|->    if (vid_buf->base.statistics_data) {
# 1777|         enc->get_buffer(vid_buf->base.statistics_data, &enc->stats, NULL);
# 1778|         if (enc->stats->size < sizeof(rvcn_encode_stats_type_0_t)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def794]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1973:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘dpb’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1967:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1972:40: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1972:40: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_enc.c:1973:4: danger: ‘dpb’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
# 1971|   
# 1972|      struct radeon_enc_dpb_buffer *dpb = CALLOC_STRUCT(radeon_enc_dpb_buffer);
# 1973|->    dpb->templ = templ;
# 1974|      dpb->luma = (struct si_texture *)((struct vl_video_buffer *)buf)->resources[0];
# 1975|      dpb->chroma = (struct si_texture *)((struct vl_video_buffer *)buf)->resources[1];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def795]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:157:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:1039:6: enter_function: entry to ‘si_log_draw_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:1046:4: call_function: calling ‘si_dump_gfx_shader’ from ‘si_log_draw_state’
#  155|   
#  156|      struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
#  157|->    chunk->ctx = ctx;
#  158|      chunk->shader = current;
#  159|      si_shader_selector_reference(ctx, &chunk->sel, current->selector);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def796]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:171:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:1062:6: enter_function: entry to ‘si_log_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:1067:4: call_function: calling ‘si_dump_compute_shader’ from ‘si_log_compute_state’
#  169|   
#  170|      struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
#  171|->    chunk->ctx = ctx;
#  172|      chunk->shader = &state->program->shader;
#  173|      si_compute_reference(&chunk->program, state->program);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def797]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:743:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:1062:6: enter_function: entry to ‘si_log_compute_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug.c:1068:4: call_function: calling ‘si_dump_compute_descriptors’ from ‘si_log_compute_state’
#  741|      struct si_log_chunk_desc_list *chunk =
#  742|         CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * element_dw_size * num_elements);
#  743|->    chunk->shader_name = shader_name;
#  744|      chunk->elem_name = elem_name;
#  745|      chunk->element_dw_size = element_dw_size;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def798]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2649:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2628:13: enter_function: entry to ‘si_make_texture_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2637:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2640:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2643:7: branch_true: following ‘true’ branch (when ‘resident != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2644:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2644:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2647:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2647:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2648:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2648:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2649:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2649:16: call_function: calling ‘util_dynarray_grow_bytes’ from ‘si_make_texture_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2649:16: return_function: returning to ‘si_make_texture_handle_resident’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2649:16: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct si_context *)ctx.resident_tex_needs_depth_decompress, 1, 8)’
# 2647|            if (sctx->gfx_level < GFX12) {
# 2648|               if (depth_needs_decompression(tex, sview->is_stencil_sampler)) {
# 2649|->                util_dynarray_append(&sctx->resident_tex_needs_depth_decompress,
# 2650|                                       struct si_texture_handle *, tex_handle);
# 2651|               }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def799]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2676:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2628:13: enter_function: entry to ‘si_make_texture_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2637:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2640:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2643:7: branch_true: following ‘true’ branch (when ‘resident != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2644:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2676:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘si_make_texture_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2676:7: return_function: returning to ‘si_make_texture_handle_resident’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2676:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct si_context *)ctx.resident_tex_handles, 1, 8)’
# 2674|   
# 2675|         /* Add the texture handle to the per-context list. */
# 2676|->       util_dynarray_append(&sctx->resident_tex_handles, struct si_texture_handle *, tex_handle);
# 2677|   
# 2678|         /* Add the buffers to the current CS in case si_begin_new_cs()

Error: GCC_ANALYZER_WARNING (CWE-476): [#def800]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2732:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘*view.resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2698:17: enter_function: entry to ‘si_create_image_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2705:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2709:7: branch_false: following ‘false’ branch (when ‘img_handle’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2712:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2713:4: call_function: inlined call to ‘si_init_descriptor_list’ from ‘si_create_image_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2713:4: call_function: inlined call to ‘si_init_descriptor_list’ from ‘si_create_image_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2718:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2723:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2725:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2730:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2730:4: call_function: calling ‘util_copy_image_view’ from ‘si_create_image_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2730:4: return_function: returning to ‘si_create_image_handle’ from ‘util_copy_image_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2732:4: danger: dereference of NULL ‘*view.resource’
# 2730|      util_copy_image_view(&img_handle->view, view);
# 2731|   
# 2732|->    si_resource(view->resource)->image_handle_allocated = true;
# 2733|   
# 2734|      if (view->access & PIPE_IMAGE_ACCESS_WRITE && view->resource)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def801]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2781:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2757:13: enter_function: entry to ‘si_make_image_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2767:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2770:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2774:7: branch_true: following ‘true’ branch (when ‘resident != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2775:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2775:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2777:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2779:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2780:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2780:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2781:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2781:16: call_function: calling ‘util_dynarray_grow_bytes’ from ‘si_make_image_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2781:16: return_function: returning to ‘si_make_image_handle_resident’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2781:16: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct si_context *)ctx.resident_img_needs_color_decompress, 1, 8)’
# 2779|            if (sctx->gfx_level < GFX12) {
# 2780|               if (color_needs_decompression(tex)) {
# 2781|->                util_dynarray_append(&sctx->resident_img_needs_color_decompress,
# 2782|                                       struct si_image_handle *, img_handle);
# 2783|               }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def802]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2802:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2757:13: enter_function: entry to ‘si_make_image_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2767:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2770:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2774:7: branch_true: following ‘true’ branch (when ‘resident != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2775:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2802:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘si_make_image_handle_resident’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2802:7: return_function: returning to ‘si_make_image_handle_resident’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_descriptors.c:2802:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct si_context *)ctx.resident_img_handles, 1, 8)’
# 2800|   
# 2801|         /* Add the image handle to the per-context list. */
# 2802|->       util_dynarray_append(&sctx->resident_img_handles, struct si_image_handle *, img_handle);
# 2803|   
# 2804|         /* Add the buffers to the current CS in case si_begin_new_cs()

Error: GCC_ANALYZER_WARNING (CWE-401): [#def803]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:375:4: warning[-Wanalyzer-malloc-leak]: leak of ‘si_alloc_fence()’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:362:13: enter_function: entry to ‘si_create_fence_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:371:13: call_function: calling ‘si_alloc_fence’ from ‘si_create_fence_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:371:13: return_function: returning to ‘si_create_fence_fd’ from ‘si_alloc_fence’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:372:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:375:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_fence.c:375:4: danger: ‘si_alloc_fence()’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#  373|         return;
#  374|   
#  375|->    switch (type) {
#  376|      case PIPE_FD_TYPE_NATIVE_SYNC:
#  377|         if (!sscreen->info.has_fence_to_handle)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def804]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:170:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:592:6: enter_function: entry to ‘si_nir_lower_resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:600:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘si_nir_lower_resource’
#  168|      unsigned const_index = 0;
#  169|      nir_def *dynamic_index = NULL;
#  170|->    while (deref->deref_type != nir_deref_type_var) {
#  171|         assert(deref->deref_type == nir_deref_type_array);
#  172|         unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def805]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:332:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:592:6: enter_function: entry to ‘si_nir_lower_resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_resource.c:600:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘si_nir_lower_resource’
#  330|            desc_type = AC_DESC_FMASK;
#  331|         } else {
#  332|->          enum glsl_sampler_dim dim = glsl_get_sampler_dim(deref->type);
#  333|            desc_type = dim == GLSL_SAMPLER_DIM_BUF ? AC_DESC_BUFFER : AC_DESC_IMAGE;
#  334|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def806]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1193:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc(32)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1226:28: enter_function: entry to ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1233:7: branch_false: following ‘false’ branch (when ‘sscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug_options.h:1:1: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: call_function: calling ‘si_setup_force_shader_use_aco’ from ‘radeonsi_screen_create_impl’
# 1191|      if (_mesa_blake3_from_printed_string(blake, option)) {
# 1192|         sscreen->use_aco_shader_blakes = MALLOC(sizeof(blake));
# 1193|->       memcpy(sscreen->use_aco_shader_blakes[0], blake, sizeof(blake));
# 1194|         sscreen->num_use_aco_shader_blakes = 1;
# 1195|         return;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def807]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1210:10: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1226:28: enter_function: entry to ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1233:7: branch_false: following ‘false’ branch (when ‘sscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug_options.h:1:1: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: call_function: calling ‘si_setup_force_shader_use_aco’ from ‘radeonsi_screen_create_impl’
# 1208|      while (fgets(line, sizeof(line), f)) {
# 1209|         if (sscreen->num_use_aco_shader_blakes * sizeof(blake3_hash) >= max_size) {
# 1210|->          sscreen->use_aco_shader_blakes = REALLOC(
# 1211|               sscreen->use_aco_shader_blakes, max_size, max_size * 2);
# 1212|            max_size *= 2;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def808]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1298:7: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1226:28: enter_function: entry to ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1233:7: branch_false: following ‘false’ branch (when ‘sscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug_options.h:1:1: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: call_function: calling ‘si_setup_force_shader_use_aco’ from ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: return_function: returning to ‘radeonsi_screen_create_impl’ from ‘si_setup_force_shader_use_aco’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1295:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1296:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1295:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1297:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1298:7: danger: ‘<unknown>’ leaks here; was allocated at [(26)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/25)
# 1296|          !sscreen->info.has_tmz_support) {
# 1297|         fprintf(stderr, "radeonsi: requesting TMZ features but TMZ is not supported\n");
# 1298|->       FREE(sscreen);
# 1299|         return NULL;
# 1300|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def809]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_query.c:532:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘qbuf’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_query.c:1449:13: enter_function: entry to ‘si_query_hw_resume’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_query.c:1451:4: call_function: calling ‘si_query_hw_emit_start’ from ‘si_query_hw_resume’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  530|         if (buffer->buf) {
#  531|            struct si_query_buffer *qbuf = MALLOC_STRUCT(si_query_buffer);
#  532|->          memcpy(qbuf, buffer, sizeof(*qbuf));
#  533|            buffer->previous = qbuf;
#  534|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def810]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3275:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3501:13: enter_function: entry to ‘si_shader_select_ps_parts’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3511:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3513:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3513:10: call_function: calling ‘si_get_shader_part’ from ‘si_shader_select_ps_parts’
# 3273|      /* Compile a new one. */
# 3274|      result = CALLOC_STRUCT(si_shader_part);
# 3275|->    result->key = *key;
# 3276|   
# 3277|      bool ok =

Error: GCC_ANALYZER_WARNING (CWE-688): [#def811]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3636:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*shader.gs_copy_shader’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3581:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3603:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3603:10: branch_false: following ‘false’ branch (when ‘mainp’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3606:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3629:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3635:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3635:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_shader.c:3636:13: danger: argument 1 (‘calloc(1, 1472)’) from [(9)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/8) could be NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 3634|   
# 3635|               shader->gs_copy_shader = CALLOC_STRUCT(si_shader);
# 3636|->             memcpy(shader->gs_copy_shader, mainp->gs_copy_shader,
# 3637|                      sizeof(*shader->gs_copy_shader));
# 3638|               /* Increase the reference count. */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def812]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:773:10: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:736:1: enter_function: entry to ‘si_sqtt_add_code_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:745:7: branch_false: following ‘false’ branch (when ‘record’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:749:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:753:25: branch_true: following ‘true’ branch (when ‘i != 14’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:757:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:757:10: branch_false: following ‘false’ branch (when ‘gfx_sh_offsets’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:762:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:762:17: branch_true: following ‘true’ branch (when ‘i <= 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:763:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:763:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:766:21: call_function: calling ‘si_sqtt_pipe_to_rgp_shader_stage’ from ‘si_sqtt_add_code_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:766:21: return_function: returning to ‘si_sqtt_add_code_object’ from ‘si_sqtt_pipe_to_rgp_shader_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:771:23: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:772:10: branch_false: following ‘false’ branch (when ‘code’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:776:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:778:49: branch_true: following ‘true’ branch (when ‘gfx_sh_offsets’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:778:81: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:753:25: branch_true: following ‘true’ branch (when ‘i != 14’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:757:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:757:10: branch_false: following ‘false’ branch (when ‘gfx_sh_offsets’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:762:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:762:17: branch_true: following ‘true’ branch (when ‘i <= 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:763:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:763:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:766:21: call_function: calling ‘si_sqtt_pipe_to_rgp_shader_stage’ from ‘si_sqtt_add_code_object’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:766:21: return_function: returning to ‘si_sqtt_add_code_object’ from ‘si_sqtt_pipe_to_rgp_shader_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:772:10: branch_true: following ‘true’ branch (when ‘code’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:773:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_sqtt.c:773:10: danger: ‘<unknown>’ leaks here; was allocated at [(17)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/16)
#  771|         uint8_t *code = malloc(shader->binary.uploaded_code_size);
#  772|         if (!code) {
#  773|->          free(record);
#  774|            return false;
#  775|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def813]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:464:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘blend’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4831:14: enter_function: entry to ‘si_create_blend_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4838:11: call_function: calling ‘si_create_blend_state_mode’ from ‘si_create_blend_custom’
#  462|      si_pm4_clear_state(pm4, sctx->screen, false);
#  463|   
#  464|->    blend->alpha_to_coverage = state->alpha_to_coverage;
#  465|      blend->alpha_to_one = state->alpha_to_one;
#  466|      blend->dual_src_blend = util_blend_state_is_dual(state, 0);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def814]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:536:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘blend_cntl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4831:14: enter_function: entry to ‘si_create_blend_custom’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4838:11: call_function: calling ‘si_create_blend_state_mode’ from ‘si_create_blend_custom’
#  534|            }
#  535|   
#  536|->          ac_pm4_set_reg(&pm4->base, R_028780_CB_BLEND0_CONTROL + i * 4, blend_cntl);
#  537|            continue;
#  538|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def815]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4053:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘texture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4024:34: enter_function: entry to ‘si_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4029:35: call_function: calling ‘align_calloc’ from ‘si_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4029:35: return_function: returning to ‘si_create_sampler_view’ from ‘align_calloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4036:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4040:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4046:4: call_function: calling ‘pipe_resource_reference’ from ‘si_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4046:4: return_function: returning to ‘si_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4053:8: danger: dereference of NULL ‘texture’
# 4051|   
# 4052|      /* Buffer resource. */
# 4053|->    if (texture->target == PIPE_BUFFER) {
# 4054|         uint32_t elements = si_clamp_texture_texel_count(sctx->screen->b.caps.max_texel_buffer_elements,
# 4055|                                                          state->format, state->u.buf.size);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def816]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4757:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4738:1: enter_function: entry to ‘si_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4756:40: call_function: calling ‘si_create_vertex_elements’ from ‘si_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4756:40: return_function: returning to ‘si_create_vertex_state’ from ‘si_create_vertex_elements’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4757:4: danger: dereference of NULL ‘si_create_vertex_elements(&ctx.b,  num_elements,  elements)’
# 4755|      ctx.b.screen = screen;
# 4756|      struct si_vertex_elements *velems = si_create_vertex_elements(&ctx.b, num_elements, elements);
# 4757|->    state->velems = *velems;
# 4758|      si_delete_vertex_element(&ctx.b, velems);
# 4759|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def817]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4757:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4738:1: enter_function: entry to ‘si_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4746:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4756:40: call_function: calling ‘si_create_vertex_elements’ from ‘si_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4756:40: return_function: returning to ‘si_create_vertex_state’ from ‘si_create_vertex_elements’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state.c:4757:4: danger: ‘state’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/1)
# 4755|      ctx.b.screen = screen;
# 4756|      struct si_vertex_elements *velems = si_create_vertex_elements(&ctx.b, num_elements, elements);
# 4757|->    state->velems = *velems;
# 4758|      si_delete_vertex_element(&ctx.b, velems);
# 4759|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def818]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:39:11: warning[-Wanalyzer-malloc-leak]: leak of ‘t’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:19:42: enter_function: entry to ‘si_create_so_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:27:8: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:28:7: branch_false: following ‘false’ branch (when ‘t’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:32:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:34:4: call_function: calling ‘pipe_resource_reference’ from ‘si_create_so_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:34:4: return_function: returning to ‘si_create_so_target’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_state_streamout.c:39:11: danger: ‘t’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#   37|   
#   38|      util_range_add(&buf->b.b, &buf->valid_buffer_range, buffer_offset, buffer_offset + buffer_size);
#   39|->    return &t->b;
#   40|   }
#   41|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def819]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:350:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘cpu’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:306:20: branch_true: following ‘true’ branch (when ‘i != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:307:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:310:23: branch_true: following ‘true’ branch (when ‘l != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:311:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:315:23: branch_true: following ‘true’ branch (when ‘l != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:316:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:318:23: branch_true: following ‘true’ branch (when ‘j != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:319:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:320:26: branch_true: following ‘true’ branch (when ‘k != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:321:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:321:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:324:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:327:16: branch_false: following ‘false’ branch (when ‘domain == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:340:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:347:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:349:24: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:350:13: danger: argument 1 (‘cpu’) from [(17)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/16) could be NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#  348|   
#  349|               int *cpu = calloc(1, buffer_size);
#  350|->             memset(cpu, 'c', buffer_size);
#  351|               fflush(stdout);
#  352|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def820]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:360:19: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘ptr’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:306:20: branch_true: following ‘true’ branch (when ‘i != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:307:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:310:23: branch_true: following ‘true’ branch (when ‘l != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:311:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:315:23: branch_true: following ‘true’ branch (when ‘l != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:316:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:318:23: branch_true: following ‘true’ branch (when ‘j != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:319:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:320:26: branch_true: following ‘true’ branch (when ‘k != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:321:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:321:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:324:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:327:16: branch_false: following ‘false’ branch (when ‘domain == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:340:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:340:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:347:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:355:32: branch_true: following ‘true’ branch (when ‘loop != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:356:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:360:19: danger: argument 1 (‘ptr’) from [(15)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/14) could be NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  358|                  switch (i) {
#  359|                  case 0:
#  360|->                   memcpy(ptr, cpu, buffer_size);
#  361|                     break;
#  362|                  case 1:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def821]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:440:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘clear_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:431:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:434:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:434:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:439:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:440:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:440:10: danger: ‘clear_value + (sizetype)i’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
#  438|   
#  439|         for (unsigned i = 0; i < buf_size; i++) {
#  440|->          clear_value[i] = rand();
#  441|            init_dst_buffer[i] = rand();
#  442|            expected_dst_buffer[i] = rand();

Error: GCC_ANALYZER_WARNING (CWE-476): [#def822]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:441:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘init_dst_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:431:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:434:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:435:45: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:439:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:440:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:441:10: danger: ‘init_dst_buffer + (sizetype)i’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
#  439|         for (unsigned i = 0; i < buf_size; i++) {
#  440|            clear_value[i] = rand();
#  441|->          init_dst_buffer[i] = rand();
#  442|            expected_dst_buffer[i] = rand();
#  443|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def823]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:442:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘expected_dst_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:431:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:434:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:436:49: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:439:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:440:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:442:10: danger: ‘expected_dst_buffer + (sizetype)i’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  440|            clear_value[i] = rand();
#  441|            init_dst_buffer[i] = rand();
#  442|->          expected_dst_buffer[i] = rand();
#  443|         }
#  444|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def824]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘init_src_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:546:45: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:10: danger: ‘init_src_buffer + (sizetype)i’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/0)
#  550|   
#  551|         for (unsigned i = 0; i < buf_size; i++) {
#  552|->          init_src_buffer[i] = rand();
#  553|            init_dst_buffer[i] = rand();
#  554|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def825]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:553:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘init_dst_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:547:45: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:553:10: danger: ‘init_dst_buffer + (sizetype)i’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/0)
#  551|         for (unsigned i = 0; i < buf_size; i++) {
#  552|            init_src_buffer[i] = rand();
#  553|->          init_dst_buffer[i] = rand();
#  554|         }
#  555|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def826]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:564:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘expected_dst_buffer’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:548:49: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:564:7: danger: argument 1 (‘expected_dst_buffer’) from [(1)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  562|         unsigned dwords_per_thread = 1 << (rand() % 3);
#  563|   
#  564|->       memcpy(expected_dst_buffer, init_dst_buffer, buf_size);
#  565|         memcpy(expected_dst_buffer + dst_offset, init_src_buffer + src_offset, op_size);
#  566|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def827]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:599:26: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘read_dst_buffer’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:522:6: enter_function: entry to ‘si_test_copy_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:549:45: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:571:31: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:574:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:577:31: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:580:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:583:31: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:586:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:597:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:598:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:598:10: call_function: calling ‘pipe_buffer_read’ from ‘si_test_copy_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:598:10: return_function: returning to ‘si_test_copy_buffer’ from ‘pipe_buffer_read’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:599:26: danger: argument 1 (‘read_dst_buffer’) from [(2)](sarif:/runs/0/results/8/codeFlows/0/threadFlows/0/locations/1) could be NULL where non-null expected
#  597|         if (done) {
#  598|            pipe_buffer_read(ctx, dst, 0, buf_size, read_dst_buffer);
#  599|->          bool success = !memcmp(read_dst_buffer, expected_dst_buffer, buf_size);
#  600|   
#  601|            num_tests++;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def828]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:610:23: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:522:6: enter_function: entry to ‘si_test_copy_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:551:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:552:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:571:31: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:574:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:577:31: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:580:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:583:31: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:586:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:597:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:598:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:598:10: call_function: calling ‘pipe_buffer_read’ from ‘si_test_copy_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:598:10: return_function: returning to ‘si_test_copy_buffer’ from ‘pipe_buffer_read’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:606:34: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:610:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_dma_perf.c:610:23: danger: use of uninitialized value ‘*<unknown>’ here
#  608|                         read_dst_buffer[i] != expected_dst_buffer[i] ? COLOR_RED :
#  609|                         i >= dst_offset && i < dst_offset + op_size ? COLOR_YELLOW : COLOR_CYAN,
#  610|->                       read_dst_buffer[i]);
#  611|               }
#  612|               printf("%s, ", COLOR_RESET);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def829]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2123:11: warning[-Wanalyzer-malloc-leak]: leak of ‘trans’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:1998:14: enter_function: entry to ‘si_texture_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2015:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2018:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2064:12: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2065:7: branch_false: following ‘false’ branch (when ‘trans’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2067:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2067:4: call_function: calling ‘pipe_resource_reference’ from ‘si_texture_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2067:4: return_function: returning to ‘si_texture_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2072:7: branch_true: following ‘true’ branch (when ‘use_staging_texture != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2075:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2078:7: call_function: calling ‘si_init_temp_resource_from_box’ from ‘si_texture_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2078:7: return_function: returning to ‘si_texture_transfer_map’ from ‘si_init_temp_resource_from_box’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2090:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2094:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2097:7: call_function: calling ‘si_texture_get_offset’ from ‘si_texture_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2097:7: return_function: returning to ‘si_texture_transfer_map’ from ‘si_texture_get_offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2119:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2122:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2123:11: danger: ‘trans’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
# 2121|   
# 2122|      *ptransfer = &trans->b.b;
# 2123|->    return map + offset;
# 2124|   
# 2125|   fail_trans:

Error: GCC_ANALYZER_WARNING (CWE-401): [#def830]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2309:11: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2259:29: enter_function: entry to ‘si_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2289:33: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2291:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2297:4: call_function: inlined call to ‘pipe_reference_init’ from ‘si_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2298:4: call_function: calling ‘pipe_resource_reference’ from ‘si_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2298:4: return_function: returning to ‘si_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_texture.c:2309:11: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
# 2307|         tex->target != PIPE_BUFFER &&
# 2308|         vi_dcc_formats_are_incompatible(tex, templ->u.tex.level, templ->format);
# 2309|->    return &surface->base;
# 2310|   }
# 2311|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def831]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:267:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘alloc_entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:1267:1: enter_function: entry to ‘svga_get_timestamp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:1269:27: call_function: calling ‘svga_create_query’ from ‘svga_get_timestamp’
#  265|         assert(index != -1);
#  266|         alloc_entry = CALLOC_STRUCT(svga_qmem_alloc_entry);
#  267|->       alloc_entry->block_index = index;
#  268|      }
#  269|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def832]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:736:11: warning[-Wanalyzer-malloc-leak]: leak of ‘sq’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:1267:1: enter_function: entry to ‘svga_get_timestamp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:1269:27: call_function: calling ‘svga_create_query’ from ‘svga_get_timestamp’
#  734|      sq->type = query_type;
#  735|   
#  736|->    return &sq->base;
#  737|   
#  738|   fail:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def833]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:838:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘q’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:1267:1: enter_function: entry to ‘svga_get_timestamp’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_query.c:1273:4: call_function: calling ‘svga_begin_query’ from ‘svga_get_timestamp’
#  836|      svga_hwtnl_flush_retry(svga);
#  837|   
#  838|->    switch (sq->type) {
#  839|      case PIPE_QUERY_OCCLUSION_COUNTER:
#  840|      case PIPE_QUERY_OCCLUSION_PREDICATE:

Error: GCC_ANALYZER_WARNING (CWE-122): [#def834]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:188:7: warning[-Wanalyzer-out-of-bounds]: heap-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:211:1: enter_function: entry to ‘svga_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:217:7: branch_false: following ‘false’ branch (when ‘cso’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:220:42: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:260:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:261:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:261:7: call_function: calling ‘define_sampler_state_object’ from ‘svga_create_sampler_state’
#  186|      unsigned i;
#  187|      for (i = 0; i <= ss->compare_mode; i++) {
#  188|->       ss->id[i] = util_bitmask_add(svga->sampler_object_id_bm);
#  189|   
#  190|         SVGA_RETRY(svga, SVGA3D_vgpu10_DefineSamplerState

Error: GCC_ANALYZER_WARNING (CWE-401): [#def835]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:365:11: warning[-Wanalyzer-malloc-leak]: leak of ‘sv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:342:1: enter_function: entry to ‘svga_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:347:40: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:349:7: branch_false: following ‘false’ branch (when ‘sv’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:353:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:356:4: call_function: calling ‘pipe_resource_reference’ from ‘svga_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:356:4: return_function: returning to ‘svga_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:365:11: danger: ‘sv’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  363|                           SVGA_STATS_COUNT_SAMPLERVIEW);
#  364|   
#  365|->    return &sv->base;
#  366|   }
#  367|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def836]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:382:11: warning[-Wanalyzer-malloc-leak]: leak of ‘sot’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:357:1: enter_function: entry to ‘svga_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:371:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:372:7: branch_false: following ‘false’ branch (when ‘sot’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:375:4: call_function: inlined call to ‘pipe_reference_init’ from ‘svga_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:376:4: call_function: calling ‘pipe_resource_reference’ from ‘svga_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:376:4: return_function: returning to ‘svga_create_stream_output_target’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_streamout.c:382:11: danger: ‘sot’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  380|      sot->base.buffer_size = buffer_size;
#  381|   
#  382|->    return &sot->base;
#  383|   }
#  384|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def837]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_resource_buffer.c:592:11: warning[-Wanalyzer-malloc-leak]: leak of ‘sbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_resource_buffer.c:561:1: enter_function: entry to ‘svga_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_resource_buffer.c:569:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_resource_buffer.c:570:7: branch_false: following ‘false’ branch (when ‘sbuf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_resource_buffer.c:573:4: call_function: inlined call to ‘pipe_reference_init’ from ‘svga_user_buffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_resource_buffer.c:592:11: danger: ‘sbuf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  590|      ss->hud.num_resources++;
#  591|   
#  592|->    return &sbuf->b;
#  593|   
#  594|   no_sbuf:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def838]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:203:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘v’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:39:1: enter_function: entry to ‘svga_get_tex_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:46:30: release_memory: ‘sv’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:46:30: release_memory: ‘sv’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:77:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:78:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:77:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:79:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:77:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:80:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_sampler_view.c:80:10: call_function: calling ‘svga_sampler_view_reference’ from ‘svga_get_tex_sampler_view’
#  201|   svga_destroy_sampler_view_priv(struct svga_sampler_view *v)
#  202|   {
#  203|->    struct svga_texture *tex = svga_texture(v->texture);
#  204|   
#  205|      if (v->handle != tex->handle) {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def839]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:722:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&viewports’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:677:1: enter_function: entry to ‘emit_viewport’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:692:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:695:12: call_function: inlined call to ‘svga_have_vgpu10’ from ‘emit_viewport’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:695:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:717:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:719:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:722:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:722:7: danger: use of uninitialized value ‘&viewports’ here
#  720|               return ret;
#  721|         }
#  722|->       memcpy(svga->state.hw_clear.viewports, viewports,
#  723|                max_viewports * sizeof viewports[0]);
#  724|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def840]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:729:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&prescale’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:692:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:727:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:726:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:728:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_framebuffer.c:729:7: danger: use of uninitialized value ‘&prescale’ here
#  727|                 max_viewports * sizeof prescale[0]) != 0) {
#  728|         svga->dirty |= SVGA_NEW_PRESCALE;
#  729|->       memcpy(svga->state.hw_clear.prescale, prescale,
#  730|                max_viewports * sizeof prescale[0]);
#  731|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def841]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_tgsi_transform.c:38:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_tgsi_transform.c:402:1: enter_function: entry to ‘update_tgsi_transform’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_tgsi_transform.c:414:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_tgsi_transform.c:415:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_state_tgsi_transform.c:415:7: call_function: calling ‘write_vpos’ from ‘update_tgsi_transform’
#   36|   insert_at_head(struct svga_shader *head, struct svga_shader *shader)
#   37|   {
#   38|->    shader->parent = head;
#   39|      shader->next = head->next;
#   40|      head->next = shader;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def842]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:403:4: warning[-Wanalyzer-malloc-leak]: leak of ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:515:1: enter_function: entry to ‘svga_validate_surface_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:534:38: branch_true: following ‘true’ branch (when ‘shader != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:535:60: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:535:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:534:69: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:553:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_surface.c:554:11: call_function: calling ‘create_backed_surface_view’ from ‘svga_validate_surface_view’
#  401|   
#  402|      svga->hud.num_surface_views++;
#  403|->    retVal = &s->base;
#  404|   
#  405|   done:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def843]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_swtnl_backend.c:372:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘svga_render’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_swtnl_backend.c:370:43: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_swtnl_backend.c:372:4: danger: ‘svga_render’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  370|      struct svga_vbuf_render *svga_render = CALLOC_STRUCT(svga_vbuf_render);
#  371|   
#  372|->    svga_render->svga = svga;
#  373|      svga_render->ibuf_size = 0;
#  374|      svga_render->vbuf_size = 0;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def844]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_swtnl_backend.c:390:11: warning[-Wanalyzer-malloc-leak]: leak of ‘svga_render’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_swtnl_backend.c:370:43: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_swtnl_backend.c:390:11: danger: ‘svga_render’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  388|      svga_render->base.destroy = svga_vbuf_render_destroy;
#  389|   
#  390|->    return &svga_render->base;
#  391|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def845]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:855:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘presource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:836:1: enter_function: entry to ‘tegra_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:845:7: branch_false: following ‘false’ branch (when ‘view’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:848:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:853:4: call_function: calling ‘pipe_resource_reference’ from ‘tegra_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:853:4: return_function: returning to ‘tegra_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:855:16: danger: dereference of NULL ‘presource’
#  853|      pipe_resource_reference(&view->base.texture, presource);
#  854|   
#  855|->    view->gpu = context->gpu->create_sampler_view(context->gpu, resource->gpu,
#  856|                                                    template);
#  857|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def846]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:862:11: warning[-Wanalyzer-malloc-leak]: leak of ‘view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:836:1: enter_function: entry to ‘tegra_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:844:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:845:7: branch_false: following ‘false’ branch (when ‘view’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:848:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:853:4: call_function: calling ‘pipe_resource_reference’ from ‘tegra_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:853:4: return_function: returning to ‘tegra_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:862:11: danger: ‘view’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  860|      view->refcount = 100000000;
#  861|   
#  862|->    return &view->base;
#  863|   }
#  864|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def847]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:904:4: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:879:1: enter_function: entry to ‘tegra_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:887:14: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:888:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:891:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:893:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:898:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:903:4: call_function: calling ‘pipe_resource_reference’ from ‘tegra_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:903:4: return_function: returning to ‘tegra_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_context.c:904:4: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  902|      pipe_reference_init(&surface->base.reference, 1);
#  903|      pipe_resource_reference(&surface->base.texture, presource);
#  904|->    surface->base.context = &context->base;
#  905|   
#  906|      return &surface->base;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def848]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:263:4: warning[-Wanalyzer-malloc-leak]: leak of ‘resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:250:15: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:251:7: branch_false: following ‘false’ branch (when ‘resource’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:254:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:256:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:261:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/tegra/tegra_screen.c:263:4: danger: ‘resource’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  261|      memcpy(&resource->base, resource->gpu, sizeof(*resource->gpu));
#  262|      pipe_reference_init(&resource->base.reference, 1);
#  263|->    resource->base.screen = &screen->base;
#  264|   
#  265|      return &resource->base;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def849]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:226:9: warning[-Wanalyzer-malloc-leak]: leak of ‘pquery’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:209:18: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:210:12: branch_false: following ‘false’ branch (when ‘pquery’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:213:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:214:12: branch_false: following ‘false’ branch (when ‘perfmon’ is non-NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:219:21: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:222:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_perfcnt.c:226:9: danger: ‘pquery’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  224|   
#  225|           query = &pquery->base;
#  226|->         query->funcs = &perfcnt_query_funcs;
#  227|   
#  228|           /* Note that struct pipe_query isn't actually defined anywhere. */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def850]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:281:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘pquery’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:275:12: branch_false: following ‘false’ branch (when ‘query_type <= 255’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:278:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:278:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:281:9: danger: ‘pquery’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  279|           struct v3d_query *query = &pquery->base;
#  280|   
#  281|->         pquery->type = query_type;
#  282|           query->funcs = &pipe_query_funcs;
#  283|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def851]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:287:9: warning[-Wanalyzer-malloc-leak]: leak of ‘pquery’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:275:12: branch_false: following ‘false’ branch (when ‘query_type <= 255’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:278:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:278:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_query_pipe.c:287:9: danger: ‘pquery’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#  285|            * as well
#  286|            */
#  287|->         switch (pquery->type) {
#  288|           case PIPE_QUERY_TIMESTAMP:
#  289|           case PIPE_QUERY_TIME_ELAPSED:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def852]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:754:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1076:1: enter_function: entry to ‘v3d_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1086:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1090:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: call_function: calling ‘pipe_resource_reference’ from ‘v3d_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: return_function: returning to ‘v3d_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1102:27: call_function: calling ‘v3d_layer_offset’ from ‘v3d_create_surface’
#  752|           struct v3d_resource_slice *slice = &rsc->slices[level];
#  753|   
#  754|->         if (prsc->target == PIPE_TEXTURE_3D)
#  755|                   return slice->offset + layer * slice->size;
#  756|           else

Error: GCC_ANALYZER_WARNING (CWE-401): [#def853]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:775:20: warning[-Wanalyzer-malloc-leak]: leak of ‘v3d_resource_setup(pscreen,  tmpl)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:897:1: enter_function: entry to ‘v3d_resource_from_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:903:36: call_function: calling ‘v3d_resource_setup’ from ‘v3d_resource_from_handle’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:903:36: return_function: returning to ‘v3d_resource_from_handle’ from ‘v3d_resource_setup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:907:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:910:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:775:20: danger: ‘v3d_resource_setup(pscreen,  tmpl)’ leaks here; was allocated at [(4)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/3)
#  773|           prsc->screen = pscreen;
#  774|   
#  775|->         rsc->cpp = util_format_get_blocksize(prsc->format);
#  776|           rsc->serial_id++;
#  777|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def854]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:830:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘v3d_resource_setup(pscreen,  tmpl)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:889:1: enter_function: entry to ‘v3d_resource_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:893:16: call_function: calling ‘v3d_resource_create_with_modifiers’ from ‘v3d_resource_create’
#  828|           /* No user-specified modifier; determine our own. */
#  829|           if (count == 1 && modifiers[0] == DRM_FORMAT_MOD_INVALID) {
#  830|->                 rsc->tiled = should_tile;
#  831|           } else if (should_tile &&
#  832|                      drm_find_modifier(DRM_FORMAT_MOD_BROADCOM_UIF,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def855]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1147:16: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1076:1: enter_function: entry to ‘v3d_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1083:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1086:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1090:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: call_function: calling ‘pipe_resource_reference’ from ‘v3d_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: return_function: returning to ‘v3d_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1114:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1128:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1134:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1141:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1141:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1147:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1147:16: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/13/codeFlows/0/threadFlows/0/locations/1)
# 1145|           }
# 1146|   
# 1147|->         return &surface->base;
# 1148|   }
# 1149|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def856]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1226:16: warning[-Wanalyzer-malloc-leak]: leak of ‘target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1208:1: enter_function: entry to ‘v3d_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1215:18: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1216:12: branch_false: following ‘false’ branch (when ‘target’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1219:9: call_function: inlined call to ‘pipe_reference_init’ from ‘v3d_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1220:9: call_function: calling ‘pipe_resource_reference’ from ‘v3d_create_stream_output_target’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1220:9: return_function: returning to ‘v3d_create_stream_output_target’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1226:16: danger: ‘target’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
# 1224|           target->base.buffer_size = buffer_size;
# 1225|   
# 1226|->         return &target->base;
# 1227|   }
# 1228|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def857]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:255:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘result’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:356:1: enter_function: entry to ‘vc4_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:358:9: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘vc4_nir_lower_io’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:358:9: return_function: returning to ‘vc4_nir_lower_io’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:358:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_nir_lower_io.c:359:17: call_function: calling ‘vc4_nir_lower_io_impl’ from ‘vc4_nir_lower_io’
#  253|   
#  254|                   if (result != &intr->def) {
#  255|->                         nir_def_rewrite_uses_after(&intr->def,
#  256|                                                          result,
#  257|                                                          result->parent_instr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def858]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qir.c:592:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qir.c:590:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qir.c:592:9: danger: ‘inst’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  590|           struct qinst *inst = CALLOC_STRUCT(qinst);
#  591|   
#  592|->         inst->op = op;
#  593|           inst->dst = dst;
#  594|           inst->src[0] = src0;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def859]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:451:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  449|                           }
#  450|   
#  451|->                         handle_r4_qpu_write(block, qinst, dst);
#  452|                           handled_qinst_cond = true;
#  453|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def860]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:458:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  456|                   case QOP_LOAD_IMM:
#  457|                           assert(qinst->src[0].file == QFILE_LOAD_IMM);
#  458|->                         queue(block, qpu_load_imm_ui(dst, qinst->src[0].index));
#  459|                           break;
#  460|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def861]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:462:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  460|   
#  461|                   case QOP_LOAD_IMM_U2:
#  462|->                         queue(block, qpu_load_imm_u2(dst, qinst->src[0].index));
#  463|                           break;
#  464|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def862]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:466:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  464|   
#  465|                   case QOP_LOAD_IMM_I2:
#  466|->                         queue(block, qpu_load_imm_i2(dst, qinst->src[0].index));
#  467|                           break;
#  468|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def863]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:477:31: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  475|   
#  476|                           queue(block,
#  477|->                               qpu_m_rot(dst, src[0], qinst->src[1].index -
#  478|                                           QPU_SMALL_IMM_MUL_ROT) | unpack);
#  479|                           set_last_cond_mul(block, qinst->cond);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def864]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:486:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  484|                   case QOP_MS_MASK:
#  485|                           src[1] = qpu_ra(QPU_R_MS_REV_FLAGS);
#  486|->                         fixup_raddr_conflict(block, dst, &src[0], &src[1],
#  487|                                                qinst, &unpack);
#  488|                           queue(block, qpu_a_AND(qpu_ra(QPU_W_MS_FLAGS),

Error: GCC_ANALYZER_WARNING (CWE-457): [#def865]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:503:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  501|                           *last_inst(block) = qpu_set_sig(*last_inst(block),
#  502|                                                           QPU_SIG_COLOR_LOAD);
#  503|->                         handle_r4_qpu_write(block, qinst, dst);
#  504|                           handled_qinst_cond = true;
#  505|                           break;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def866]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:516:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  514|                           *last_inst(block) = qpu_set_sig(*last_inst(block),
#  515|                                                           QPU_SIG_LOAD_TMU0);
#  516|->                         handle_r4_qpu_write(block, qinst, dst);
#  517|                           handled_qinst_cond = true;
#  518|                           break;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def867]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:537:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  535|   
#  536|                   case QOP_UNIFORMS_RESET:
#  537|->                         fixup_raddr_conflict(block, dst, &src[0], &src[1],
#  538|                                                qinst, &unpack);
#  539|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def868]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:549:29: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  547|   
#  548|                           /* Skip emitting the MOV if it's a no-op. */
#  549|->                         if (qir_is_raw_mov(qinst) &&
#  550|                               dst.mux == src[0].mux && dst.addr == src[0].addr) {
#  551|                                   break;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def869]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:561:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(unsigned int *)((char *)&dst + offsetof(struct qpu_reg, mux))’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:590:1: enter_function: entry to ‘vc4_generate_code’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:596:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:599:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:609:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_emit.c:610:17: call_function: calling ‘vc4_generate_code_block’ from ‘vc4_generate_code’
#  559|                                   src[1] = src[0];
#  560|   
#  561|->                         fixup_raddr_conflict(block, dst, &src[0], &src[1],
#  562|                                                qinst, &unpack);
#  563|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def870]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:229:25: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1078:1: enter_function: entry to ‘qpu_schedule_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1112:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1113:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1116:27: call_function: calling ‘qpu_schedule_instructions_block’ from ‘qpu_schedule_instructions’
#  227|                      uint32_t waddr, bool is_add)
#  228|   {
#  229|->         uint64_t inst = n->inst->inst;
#  230|           bool is_a = is_add ^ ((inst & QPU_WS) != 0);
#  231|   

Error: GCC_ANALYZER_WARNING (CWE-126): [#def871]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:325:25: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1078:1: enter_function: entry to ‘qpu_schedule_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1112:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1113:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_qpu_schedule.c:1116:27: call_function: calling ‘qpu_schedule_instructions_block’ from ‘qpu_schedule_instructions’
#  323|   calculate_deps(struct schedule_state *state, struct schedule_node *n)
#  324|   {
#  325|->         uint64_t inst = n->inst->inst;
#  326|           uint32_t add_op = QPU_GET_FIELD(inst, QPU_OP_ADD);
#  327|           uint32_t mul_op = QPU_GET_FIELD(inst, QPU_OP_MUL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def872]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_register_allocate.c:266:37: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘temp_registers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_register_allocate.c:255:42: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_register_allocate.c:265:30: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_register_allocate.c:266:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_register_allocate.c:266:37: danger: ‘temp_registers + (long unsigned int)i * 8’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  264|            */
#  265|           for (uint32_t i = 0; i < c->num_temps; i++)
#  266|->                 temp_registers[i] = qpu_rn(0);
#  267|   
#  268|           vc4_alloc_reg_set(vc4);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def873]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:71:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘uniform_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:46:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:49:33: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:50:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:50:28: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:53:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:53:28: branch_true: following ‘true’ branch (when ‘new == 4294967295’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:54:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:55:36: branch_true: following ‘true’ branch (when ‘uniform_index_size <= next_uniform’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:57:49: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:71:38: release_memory: ‘uniform_index’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_reorder_uniforms.c:71:25: danger: dereference of NULL ‘uniform_index + (long unsigned int)new * 4’
#   69|                           }
#   70|   
#   71|->                         uniform_index[new] = inst->src[i].index;
#   72|                           inst->src[i].index = new;
#   73|                   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def874]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:573:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:548:1: enter_function: entry to ‘vc4_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:554:12: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:557:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:560:9: call_function: calling ‘pipe_resource_reference’ from ‘vc4_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:560:9: return_function: returning to ‘vc4_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:573:13: danger: dereference of NULL ‘prsc’
#  571|           if ((cso->u.tex.first_level &&
#  572|                (cso->u.tex.first_level != cso->u.tex.last_level)) ||
#  573|->             rsc->vc4_format == VC4_TEXTURE_TYPE_RGBA32R ||
#  574|               rsc->vc4_format == ~0) {
#  575|                   struct vc4_resource *shadow_parent = rsc;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def875]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:579:44: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:548:1: enter_function: entry to ‘vc4_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:554:12: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:557:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:560:9: call_function: calling ‘pipe_resource_reference’ from ‘vc4_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:560:9: return_function: returning to ‘vc4_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:571:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:572:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:571:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:576:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:579:44: danger: dereference of NULL ‘prsc’
#  577|                           .target = prsc->target,
#  578|                           .format = prsc->format,
#  579|->                         .width0 = u_minify(prsc->width0,
#  580|                                              cso->u.tex.first_level),
#  581|                           .height0 = u_minify(prsc->height0,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def876]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:633:16: warning[-Wanalyzer-malloc-leak]: leak of ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:548:1: enter_function: entry to ‘vc4_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:551:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:554:12: branch_false: following ‘false’ branch (when ‘so’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:557:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:560:9: call_function: calling ‘pipe_resource_reference’ from ‘vc4_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:560:9: return_function: returning to ‘vc4_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:592:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:599:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_state.c:633:16: danger: ‘so’ leaks here; was allocated at [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  631|                   so->texture_p1 |= VC4_TEX_P1_ETCFLIP_MASK;
#  632|   
#  633|->         return &so->base;
#  634|   }
#  635|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def877]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1135:11: warning[-Wanalyzer-malloc-leak]: leak of ‘grview’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1108:34: enter_function: entry to ‘virgl_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1117:7: branch_false: following ‘false’ branch (when ‘state’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1120:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1120:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1121:7: branch_false: following ‘false’ branch (when ‘grview’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1125:13: call_function: inlined call to ‘virgl_object_assign_handle’ from ‘virgl_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1133:4: call_function: calling ‘pipe_resource_reference’ from ‘virgl_create_sampler_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1133:4: return_function: returning to ‘virgl_create_sampler_view’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1135:11: danger: ‘grview’ leaks here; was allocated at [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
# 1133|      pipe_resource_reference(&grview->base.texture, texture);
# 1134|      grview->handle = handle;
# 1135|->    return &grview->base;
# 1136|   }
# 1137|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def878]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1685:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1682:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_context.c:1685:4: danger: ‘vctx’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 1683|      const char *host_debug_flagstring;
# 1684|   
# 1685|->    vctx->cbuf = rs->vws->cmd_buf_create(rs->vws, VIRGL_MAX_CMDBUF_DWORDS);
# 1686|      if (!vctx->cbuf) {
# 1687|         FREE(vctx);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def879]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:759:7: warning[-Wanalyzer-malloc-leak]: leak of ‘str’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:740:7: branch_false: following ‘false’ branch (when ‘str’ is non-NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:747:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:751:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:754:13: branch_false: following ‘false’ branch (when ‘str’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:757:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:757:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:759:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:759:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:759:7: danger: ‘str’ leaks here; was allocated at [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  757|      } while (bret == false && retry_size < 1024);
#  758|   
#  759|->    if (bret == false)
#  760|         return -1;
#  761|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def880]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.h:63:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘stride’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:1070:7: branch_false: following ‘false’ branch (when ‘encode_stride != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:1073:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:1073:14: branch_false: following ‘false’ branch (when ‘encode_stride != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:1084:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_encode.c:1087:4: call_function: inlined call to ‘virgl_encoder_write_dword’ from ‘virgl_encoder_transfer3d_common’
#   61|                                               uint32_t dword)
#   62|   {
#   63|->    state->buf[state->cdw++] = dword;
#   64|   }
#   65|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def881]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:649:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:646:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:649:4: danger: ‘res’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  647|      uint32_t alloc_size;
#  648|   
#  649|->    res->b = *templ;
#  650|      res->b.screen = &vs->base;
#  651|      pipe_reference_init(&res->b.reference, 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def882]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:725:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:720:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:723:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:723:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:724:7: branch_true: following ‘true’ branch (when ‘templ’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:725:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_resource.c:725:7: danger: ‘res’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
#  723|      struct virgl_resource *res = CALLOC_STRUCT(virgl_resource);
#  724|      if (templ)
#  725|->       res->b = *templ;
#  726|      res->b.screen = &vs->base;
#  727|      pipe_reference_init(&res->b.reference, 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def883]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:87:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘**targets.buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:72:13: enter_function: entry to ‘virgl_set_so_targets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:80:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:81:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:81:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:82:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:85:10: call_function: calling ‘pipe_resource_reference’ from ‘virgl_set_so_targets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:85:10: return_function: returning to ‘virgl_set_so_targets’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_streamout.c:87:10: danger: dereference of NULL ‘**_3.buffer’
#   85|            pipe_resource_reference(&vctx->so_targets[i].base.buffer, targets[i]->buffer);
#   86|   
#   87|->          vws->emit_res(vws, vctx->cbuf, res->hw_res, false);
#   88|         } else {
#   89|            pipe_resource_reference(&vctx->so_targets[i].base.buffer, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def884]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_video.c:1272:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_video.c:1268:13: enter_function: entry to ‘virgl_video_destroy_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_video.c:1270:39: call_function: inlined call to ‘virgl_video_buffer’ from ‘virgl_video_destroy_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_video.c:1272:5: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/virgl/virgl_video.c:1272:5: danger: dereference of NULL ‘<unknown>’
# 1270|       struct virgl_video_buffer *vbuf = virgl_video_buffer(buffer);
# 1271|   
# 1272|->     virgl_encode_destroy_video_buffer(vbuf->vctx, vbuf);
# 1273|   
# 1274|       vl_video_buffer_destroy(buffer);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def885]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5042:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4602:1: enter_function: entry to ‘nir_to_spirv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4620:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4620:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4624:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘nir_to_spirv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4779:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4778:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘nir_to_spirv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4781:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4785:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4785:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4785:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4795:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4798:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4798:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4800:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4804:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4804:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4804:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4806:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4809:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4809:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4809:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4811:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4820:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4820:4: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4820:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:4830:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5007:8: call_function: calling ‘__bitset_test_range’ from ‘nir_to_spirv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5007:8: return_function: returning to ‘nir_to_spirv’ from ‘__bitset_test_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5039:31: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_to_spirv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5039:31: return_function: returning to ‘nir_to_spirv’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5042:15: danger: dereference of NULL ‘nir_shader_get_entrypoint(s)’
# 5040|      nir_metadata_require(entry, nir_metadata_block_index);
# 5041|   
# 5042|->    ctx.defs = rzalloc_array_size(ctx.mem_ctx,
# 5043|                                    sizeof(SpvId), entry->ssa_alloc);
# 5044|      ctx.def_types = ralloc_array_size(ctx.mem_ctx,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def886]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:71:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:797:1: enter_function: entry to ‘zink_end_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:811:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:815:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:815:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:818:10: call_function: inlined call to ‘pop_batch_state’ from ‘zink_end_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:819:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:819:10: call_function: calling ‘zink_reset_batch_state’ from ‘zink_end_batch’
#   69|       * usually trigger an ioctl, so defer deletion to the submit thread to avoid blocking
#   70|       */
#   71|->    util_dynarray_append(&bs->unref_resources, struct zink_resource_object*, obj);
#   72|   }
#   73|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def887]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1062:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1049:1: enter_function: entry to ‘zink_batch_reference_resource_move’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1054:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1055:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1062:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_batch_reference_resource_move’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1062:7: return_function: returning to ‘zink_batch_reference_resource_move’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1062:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*bs.swapchain_obj, 1, 8)’
# 1060|            }
# 1061|         }
# 1062|->       util_dynarray_append(&bs->swapchain_obj, struct zink_resource_object*, res->obj);
# 1063|         return false;
# 1064|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def888]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1088:1: enter_function: entry to ‘zink_batch_reference_resource_move_unsync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1093:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1094:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_batch_reference_resource_move_unsync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: return_function: returning to ‘zink_batch_reference_resource_move_unsync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*bs.swapchain_obj_unsync, 1, 8)’
# 1099|            }
# 1100|         }
# 1101|->       util_dynarray_append(&bs->swapchain_obj_unsync, struct zink_resource_object*, res->obj);
# 1102|         return false;
# 1103|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def889]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:130:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:875:1: enter_function: entry to ‘zink_fb_clears_apply_region’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:877:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:878:23: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:879:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:879:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:880:13: call_function: calling ‘fb_clears_apply_or_discard_internal’ from ‘zink_fb_clears_apply_region’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  128|   {
#  129|      struct zink_framebuffer_clear_data cd = {0};
#  130|->    util_dynarray_append(&fb_clear->clears, struct zink_framebuffer_clear_data, cd);
#  131|      return zink_fb_clear_element(fb_clear, zink_fb_clear_count(fb_clear) - 1);
#  132|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def890]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:258:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pcolor’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:875:1: enter_function: entry to ‘zink_fb_clears_apply_region’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:877:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:878:23: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:879:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:879:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_clear.c:880:13: call_function: calling ‘fb_clears_apply_or_discard_internal’ from ‘zink_fb_clears_apply_region’
#  256|               clear->conditional = ctx->render_condition_active;
#  257|               clear->has_scissor = needs_rp;
#  258|->             memcpy(&clear->color, pcolor, sizeof(union pipe_color_union));
#  259|               zink_convert_color(screen, psurf->format, &clear->color, pcolor);
#  260|               if (scissor_state && needs_rp)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def891]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:977:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘pool’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1576:1: enter_function: entry to ‘zink_batch_descriptor_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1578:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1579:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1578:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1579:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1578:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1579:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1578:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1579:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1578:25: branch_false: following ‘false’ branch (when ‘i == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1580:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1580:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1581:28: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1582:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1582:37: call_function: calling ‘create_push_pool’ from ‘zink_batch_descriptor_init’
#  975|         sizes[1].descriptorCount = MAX_LAZY_DESCRIPTORS;
#  976|      }
#  977|->    pool->pool = create_pool(screen, !is_compute && has_fbfetch ? 2 : 1, sizes, 0);
#  978|      return pool;
#  979|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def892]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:992:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1305:1: enter_function: entry to ‘zink_descriptors_update’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1375:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1375:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1376:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1419:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1419:13: branch_false: following ‘false’ branch (when ‘have_KHR_push_descriptor == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1424:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1424:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1425:118: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1425:52: call_function: calling ‘check_push_pool_alloc’ from ‘zink_descriptors_update’
#  990|            /* overflowed pool: store for reuse */
#  991|            pool->set_idx = 0;
#  992|->          util_dynarray_append(&mpool->overflowed_pools[mpool->overflow_idx], struct zink_descriptor_pool*, pool);
#  993|            if (util_dynarray_contains(&mpool->overflowed_pools[!mpool->overflow_idx], struct zink_descriptor_pool*))
#  994|               bs->dd.push_pool[is_compute].pool = util_dynarray_pop(&mpool->overflowed_pools[!mpool->overflow_idx], struct zink_descriptor_pool*);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def893]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1712:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1697:1: enter_function: entry to ‘zink_descriptor_util_init_fbfetch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1699:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1702:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1707:26: call_function: calling ‘create_gfx_layout’ from ‘zink_descriptor_util_init_fbfetch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1707:26: return_function: returning to ‘zink_descriptor_util_init_fbfetch’ from ‘create_gfx_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1707:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1710:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1712:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_descriptors.c:1712:7: danger: dereference of NULL ‘create_gfx_layout(ctx, &*ctx.dd.push_layout_keys[0], 1)’
# 1710|      if (zink_descriptor_mode == ZINK_DESCRIPTOR_MODE_DB) {
# 1711|         VkDeviceSize val;
# 1712|->       VKSCR(GetDescriptorSetLayoutSizeEXT)(screen->dev, ctx->dd.push_dsl[0]->layout, &val);
# 1713|         ctx->dd.db_size[0] = align64(val, screen->info.db_props.descriptorBufferOffsetAlignment);
# 1714|         for (unsigned i = 0; i < ARRAY_SIZE(ctx->dd.db_offset); i++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def894]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:251:1: enter_function: entry to ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:256:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: return_function: returning to ‘zink_fence_server_sync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_context *)pctx_12(D)].bs.wait_semaphores, 1, 8)’
#  260|      /* this will be applied on the next submit */
#  261|      VkPipelineStageFlags flag = VK_PIPELINE_STAGE_ALL_COMMANDS_BIT;
#  262|->    util_dynarray_append(&ctx->bs->wait_semaphores, VkSemaphore, mfence->sem);
#  263|      util_dynarray_append(&ctx->bs->wait_semaphore_stages, VkPipelineStageFlags, flag);
#  264|      pipe_reference(NULL, &mfence->reference);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def895]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:263:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:251:1: enter_function: entry to ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:256:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: return_function: returning to ‘zink_fence_server_sync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:263:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:263:4: return_function: returning to ‘zink_fence_server_sync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:263:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_context *)pctx_12(D)].bs.wait_semaphore_stages, 1, 4)’
#  261|      VkPipelineStageFlags flag = VK_PIPELINE_STAGE_ALL_COMMANDS_BIT;
#  262|      util_dynarray_append(&ctx->bs->wait_semaphores, VkSemaphore, mfence->sem);
#  263|->    util_dynarray_append(&ctx->bs->wait_semaphore_stages, VkPipelineStageFlags, flag);
#  264|      pipe_reference(NULL, &mfence->reference);
#  265|      util_dynarray_append(&ctx->bs->fences, struct zink_tc_fence*, mfence);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def896]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:265:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:251:1: enter_function: entry to ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:256:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:262:4: return_function: returning to ‘zink_fence_server_sync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:263:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:263:4: return_function: returning to ‘zink_fence_server_sync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:264:4: call_function: inlined call to ‘pipe_reference’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:264:4: call_function: inlined call to ‘pipe_reference’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:265:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_fence_server_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:265:4: return_function: returning to ‘zink_fence_server_sync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_fence.c:265:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_context *)pctx_12(D)].bs.fences, 1, 8)’
#  263|      util_dynarray_append(&ctx->bs->wait_semaphore_stages, VkPipelineStageFlags, flag);
#  264|      pipe_reference(NULL, &mfence->reference);
#  265|->    util_dynarray_append(&ctx->bs->fences, struct zink_tc_fence*, mfence);
#  266|   }
#  267|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def897]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:154:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:147:1: enter_function: entry to ‘destroy_swapchain’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:152:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:153:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:153:7: call_function: calling ‘simple_mtx_lock’ from ‘destroy_swapchain’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:153:7: return_function: returning to ‘destroy_swapchain’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:154:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘destroy_swapchain’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:154:7: return_function: returning to ‘destroy_swapchain’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_kopper.c:154:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*screen.semaphores, 1, 8)’
#  152|      for (unsigned i = 0; i < cswap->num_images; i++) {
#  153|         simple_mtx_lock(&screen->semaphores_lock);
#  154|->       util_dynarray_append(&screen->semaphores, VkSemaphore, cswap->images[i].acquire);
#  155|         simple_mtx_unlock(&screen->semaphores_lock);
#  156|         pipe_resource_reference(&cswap->images[i].readback, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def898]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_pipeline.c:640:40: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘binding_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_pipeline.c:900:1: enter_function: entry to ‘zink_find_or_create_input_dynamic’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_pipeline.c:904:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_pipeline.c:905:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_pipeline.c:907:24: call_function: calling ‘zink_create_gfx_pipeline_input’ from ‘zink_find_or_create_input_dynamic’
#  638|         if (!state->uses_dynamic_stride) {
#  639|            for (int i = 0; i < state->element_state->num_bindings; ++i) {
#  640|->             const unsigned buffer_id = binding_map[i];
#  641|               VkVertexInputBindingDescription *binding = &state->element_state->b.bindings[i];
#  642|               binding->stride = state->vertex_strides[buffer_id];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def899]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:293:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: return_function: returning to ‘gfx_program_precompile_job’ from ‘gfx_program_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2199:4: call_function: calling ‘generate_gfx_program_modules_optimal’ from ‘gfx_program_precompile_job’
#  291|      }
#  292|      zm->default_variant = !util_dynarray_contains(&prog->shader_cache[stage][0][0], void*);
#  293|->    util_dynarray_append(&prog->shader_cache[stage][0][0], void*, zm);
#  294|      return zm;
#  295|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def900]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:469:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: return_function: returning to ‘gfx_program_precompile_job’ from ‘gfx_program_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2199:4: call_function: calling ‘generate_gfx_program_modules_optimal’ from ‘gfx_program_precompile_job’
#  467|   
#  468|         struct zink_shader_module *zm = create_shader_module_for_stage_optimal(ctx, screen, prog->shaders[i], prog, i, state);
#  469|->       prog->objs[i] = zm->obj;
#  470|         prog->objects[i] = zm->obj.obj;
#  471|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def901]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1047:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘libs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
# 1045|   {
# 1046|      struct zink_gfx_lib_cache *libs = CALLOC_STRUCT(zink_gfx_lib_cache);
# 1047|->    libs->stages_present = prog->stages_present;
# 1048|      if (generated_tcs)
# 1049|         libs->stages_present &= ~BITFIELD_BIT(MESA_SHADER_TESS_CTRL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def902]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1061:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prog’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2210:1: enter_function: entry to ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2226:25: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2227:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2240:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: call_function: calling ‘gfx_program_create’ from ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: return_function: returning to ‘zink_link_gfx_shader’ from ‘gfx_program_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2250:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2251:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2252:7: call_function: calling ‘gfx_program_init’ from ‘zink_link_gfx_shader’
# 1059|   find_or_create_lib_cache(struct zink_screen *screen, struct zink_gfx_program *prog)
# 1060|   {
# 1061|->    unsigned stages_present = prog->stages_present;
# 1062|      bool generated_tcs = prog->shaders[MESA_SHADER_TESS_CTRL] && prog->shaders[MESA_SHADER_TESS_CTRL]->non_fs.is_generated;
# 1063|      if (generated_tcs)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def903]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1083:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
# 1081|            if (prog->shaders[i] && (!generated_tcs || i != MESA_SHADER_TESS_CTRL)) {
# 1082|               simple_mtx_lock(&prog->shaders[i]->lock);
# 1083|->             util_dynarray_append(&prog->shaders[i]->pipeline_libs, struct zink_gfx_lib_cache*, libs);
# 1084|               simple_mtx_unlock(&prog->shaders[i]->lock);
# 1085|               refs++;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def904]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1179:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘nir[2]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
# 1177|            /* this may have already been precompiled for separate shader */
# 1178|            if (i == MESA_SHADER_TESS_CTRL && prog->shaders[i]->non_fs.is_generated && prog->shaders[MESA_SHADER_TESS_CTRL]->nir)
# 1179|->             zink_shader_tcs_init(screen, prog->shaders[MESA_SHADER_TESS_CTRL], nir[MESA_SHADER_TESS_EVAL], &nir[i]);
# 1180|            else
# 1181|               nir[i] = zink_shader_deserialize(screen, prog->shaders[i]);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def905]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1195:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prog’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2210:1: enter_function: entry to ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2226:25: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2227:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2240:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: call_function: calling ‘gfx_program_create’ from ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: return_function: returning to ‘zink_link_gfx_shader’ from ‘gfx_program_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2250:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2251:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2252:7: call_function: calling ‘gfx_program_init’ from ‘zink_link_gfx_shader’
# 1193|      if (screen->optimal_keys)
# 1194|         prog->libs = find_or_create_lib_cache(screen, prog);
# 1195|->    if (prog->libs)
# 1196|         p_atomic_inc(&prog->libs->refcount);
# 1197|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def906]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2158:4: warning[-Wanalyzer-malloc-leak]: leak of ‘gkey’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: return_function: returning to ‘gfx_program_precompile_job’ from ‘gfx_program_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2199:4: call_function: calling ‘generate_gfx_program_modules_optimal’ from ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2199:4: return_function: returning to ‘gfx_program_precompile_job’ from ‘generate_gfx_program_modules_optimal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2201:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2202:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2202:7: call_function: calling ‘simple_mtx_lock’ from ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2202:7: return_function: returning to ‘gfx_program_precompile_job’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2203:7: call_function: calling ‘zink_create_pipeline_lib’ from ‘gfx_program_precompile_job’
# 2156|         gkey->modules[i] = prog->objs[i].mod;
# 2157|      gkey->pipeline = zink_create_gfx_pipeline_library(screen, prog);
# 2158|->    _mesa_set_add(&prog->libs->libs, gkey);
# 2159|      return gkey;
# 2160|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def907]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:394:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:401:1: enter_function: entry to ‘unref_vk_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:405:4: call_function: calling ‘unref_vk_pool’ from ‘unref_vk_query’
#  392|      if (!pool || --pool->refcount)
#  393|         return;
#  394|->    util_dynarray_append(&ctx->bs->dead_querypools, VkQueryPool, pool->query_pool);
#  395|      if (list_is_linked(&pool->list))
#  396|         list_del(&pool->list);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def908]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:394:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘start’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:1053:1: enter_function: entry to ‘zink_end_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:1085:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_query.c:1086:7: call_function: inlined call to ‘update_query_id’ from ‘zink_end_query’
#  392|      if (!pool || --pool->refcount)
#  393|         return;
#  394|->    util_dynarray_append(&ctx->bs->dead_querypools, VkQueryPool, pool->query_pool);
#  395|      if (list_is_linked(&pool->list))
#  396|         list_del(&pool->list);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def909]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_render_pass.c:528:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_render_pass.c:820:1: enter_function: entry to ‘zink_begin_render_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_render_pass.c:822:4: call_function: calling ‘setup_framebuffer’ from ‘zink_begin_render_pass’
#  526|         }
#  527|         ppstate = (void*)cache_entry->key;
#  528|->       rp->pipeline_state = ppstate->id;
#  529|      }
#  530|      return rp;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def910]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_resource.h:182:13: warning[-Wanalyzer-malloc-leak]: leak of ‘*bs.acquires.data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:1749:1: enter_function: entry to ‘zink_flush_frontbuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:1770:7: call_function: inlined call to ‘zink_resource_reference’ from ‘zink_flush_frontbuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:1770:7: call_function: inlined call to ‘zink_resource_reference’ from ‘zink_flush_frontbuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:1772:7: call_function: calling ‘zink_batch_resource_usage_set’ from ‘zink_flush_frontbuffer’
#  180|            VkSemaphore acquire = zink_kopper_acquire_submit(zink_screen(bs->ctx->base.screen), res);
#  181|            if (acquire)
#  182|->             util_dynarray_append(&bs->acquires, VkSemaphore, acquire);
#  183|         }
#  184|         if (write) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def911]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_resource.h:182:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:966:1: enter_function: entry to ‘zink_batch_reference_resource_rw’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:974:4: call_function: calling ‘zink_batch_resource_usage_set’ from ‘zink_batch_reference_resource_rw’
#  180|            VkSemaphore acquire = zink_kopper_acquire_submit(zink_screen(bs->ctx->base.screen), res);
#  181|            if (acquire)
#  182|->             util_dynarray_append(&bs->acquires, VkSemaphore, acquire);
#  183|         }
#  184|         if (write) {

Error: GCC_ANALYZER_WARNING: [#def912]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:3366:13: warning[-Wanalyzer-overlapping-buffers]: overlapping buffers passed as arguments to ‘memcpy’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:3757:1: enter_function: entry to ‘zink_win32_create_screen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_screen.c:3759:30: call_function: calling ‘zink_internal_create_screen’ from ‘zink_win32_create_screen’
# 3364|               screen->heap_count[i] = screen->heap_count[ZINK_HEAP_HOST_VISIBLE_COHERENT];
# 3365|            } else {
# 3366|->             memcpy(screen->heap_map[i], screen->heap_map[ZINK_HEAP_DEVICE_LOCAL], screen->heap_count[ZINK_HEAP_DEVICE_LOCAL]);
# 3367|               screen->heap_count[i] = screen->heap_count[ZINK_HEAP_DEVICE_LOCAL];
# 3368|               if (i == ZINK_HEAP_DEVICE_LOCAL_VISIBLE)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def913]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:160:48: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘strides[j]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:793:1: enter_function: entry to ‘zink_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:801:7: branch_false: following ‘false’ branch (when ‘zstate’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:806:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:814:47: call_function: calling ‘zink_create_vertex_elements_state’ from ‘zink_create_vertex_state’
#  158|            ves->hw_state.dynbindings[j].binding = ves->bindings[j].binding;
#  159|            ves->hw_state.dynbindings[j].inputRate = ves->bindings[j].inputRate;
#  160|->          ves->hw_state.dynbindings[j].stride = strides[j];
#  161|            if (ves->divisor[j])
#  162|               ves->hw_state.dynbindings[j].divisor = ves->divisor[j];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def914]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:815:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘zink_create_vertex_elements_state(&ctx.base,  num_elements,  elements)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:793:1: enter_function: entry to ‘zink_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:801:7: branch_false: following ‘false’ branch (when ‘zstate’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:806:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:814:47: call_function: calling ‘zink_create_vertex_elements_state’ from ‘zink_create_vertex_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:814:47: return_function: returning to ‘zink_create_vertex_state’ from ‘zink_create_vertex_elements_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_state.c:815:4: danger: dereference of NULL ‘zink_create_vertex_elements_state(&ctx.base,  num_elements,  elements)’
#  813|      ctx.base.screen = pscreen;
#  814|      struct zink_vertex_elements_state *elems = zink_create_vertex_elements_state(&ctx.base, num_elements, elements);
#  815|->    zstate->velems = *elems;
#  816|      zink_delete_vertex_elements_state(&ctx.base, elems);
#  817|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def915]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:429:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:407:1: enter_function: entry to ‘zink_destroy_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:427:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:428:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:429:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:429:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_destroy_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:429:10: return_function: returning to ‘zink_destroy_surface’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:429:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_resource *)_1].obj.views, 1, 8)’
#  427|      if (surface->is_swapchain) {
#  428|         for (unsigned i = 0; i < surface->swapchain_size; i++)
#  429|->          util_dynarray_append(&res->obj->views, VkImageView, surface->swapchain[i]);
#  430|         free(surface->swapchain);
#  431|      } else

Error: GCC_ANALYZER_WARNING (CWE-476): [#def916]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:432:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:407:1: enter_function: entry to ‘zink_destroy_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:427:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:432:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:432:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_destroy_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:432:7: return_function: returning to ‘zink_destroy_surface’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:432:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_resource *)_1].obj.views, 1, 8)’
#  430|         free(surface->swapchain);
#  431|      } else
#  432|->       util_dynarray_append(&res->obj->views, VkImageView, surface->image_view);
#  433|      simple_mtx_unlock(&res->obj->view_lock);
#  434|      pipe_resource_reference(&psurface->texture, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def917]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:477:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:440:1: enter_function: entry to ‘zink_rebind_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:445:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:448:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:454:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:461:102: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:467:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:472:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:477:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_rebind_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:477:4: return_function: returning to ‘zink_rebind_surface’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:477:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_resource *)_3].obj.views, 1, 8)’
#  475|      assert(entry);
#  476|      simple_mtx_lock(&res->obj->view_lock);
#  477|->    util_dynarray_append(&res->obj->views, VkImageView, surface->image_view);
#  478|      simple_mtx_unlock(&res->obj->view_lock);
#  479|      surface->image_view = image_view;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def918]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:539:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:526:1: enter_function: entry to ‘zink_surface_swapchain_update’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:531:7: branch_false: following ‘false’ branch (when ‘cdt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:533:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:533:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:537:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:538:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:539:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:539:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_surface_swapchain_update’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:539:10: return_function: returning to ‘zink_surface_swapchain_update’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_surface.c:539:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*MEM[(struct zink_resource *)_2].obj.views, 1, 8)’
#  537|         simple_mtx_lock(&res->obj->view_lock);
#  538|         for (unsigned i = 0; i < surface->swapchain_size; i++)
#  539|->          util_dynarray_append(&res->obj->views, VkImageView, surface->swapchain[i]);
#  540|         simple_mtx_unlock(&res->obj->view_lock);
#  541|         free(surface->swapchain);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def919]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_helpers.c:136:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fence’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_helpers.c:122:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_helpers.c:129:7: branch_true: following ‘true’ branch (when ‘fd == -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_helpers.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_helpers.c:136:9: danger: ‘fence’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  134|         ctx->create_fence_fd(ctx, &fence->pipe_fence, fd, PIPE_FD_TYPE_NATIVE_SYNC);
#  135|      }
#  136|->    if (!fence->pipe_fence) {
#  137|         FREE(fence);
#  138|         return NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def920]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:291:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘all’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:288:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:290:17: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:291:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:291:9: danger: ‘all + (long unsigned int)i * 8’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  289|       index = 0;
#  290|       for (i = 0; a[i] != NULL; i++)
#  291|->         all[index++] = a[i];
#  292|       for (j = 0; b[j] != NULL; j++)
#  293|           all[index++] = b[j];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def921]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:293:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘all’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:288:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:290:17: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:292:17: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:293:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:293:9: danger: ‘all + (long unsigned int)index * 8’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  291|           all[index++] = a[i];
#  292|       for (j = 0; b[j] != NULL; j++)
#  293|->         all[index++] = b[j];
#  294|       all[index++] = NULL;
#  295|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def922]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:294:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘all’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:288:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:290:17: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:292:17: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:294:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri_screen.c:294:5: danger: ‘all + (long unsigned int)index * 8’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  292|       for (j = 0; b[j] != NULL; j++)
#  293|           all[index++] = b[j];
#  294|->     all[index++] = NULL;
#  295|   
#  296|       free(a);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def923]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:1617:56: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘buffer_fds[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2329:1: enter_function: entry to ‘dri3_find_back_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2334:9: call_function: calling ‘dri3_find_back’ from ‘dri3_find_back_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2334:9: return_function: returning to ‘dri3_find_back_alloc’ from ‘dri3_find_back’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2335:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2338:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2340:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2342:14: call_function: calling ‘dri3_alloc_render_buffer’ from ‘dri3_find_back_alloc’
# 1615|                                                          width, height, buffer->strides[0],
# 1616|                                                          depth, buffer->cpp * 8,
# 1617|->                                                        buffer_fds[0]);
# 1618|      }
# 1619|      cookie_fence = xcb_dri3_fence_from_fd_checked(draw->conn,

Error: GCC_ANALYZER_WARNING (CWE-457): [#def924]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:1645:11: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘buffer_fds[i]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2160:1: enter_function: entry to ‘loader_dri3_get_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2176:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2179:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2182:21: branch_true: following ‘true’ branch (when ‘buf_id != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2185:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2199:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2208:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/loader_dri3_helper.c:2215:18: call_function: calling ‘dri3_get_buffer’ from ‘loader_dri3_get_buffers’
# 1643|   no_buffer_attrib:
# 1644|      do {
# 1645|->       if (buffer_fds[i] != -1)
# 1646|            close(buffer_fds[i]);
# 1647|      } while (--i >= 0);

Error: GCC_ANALYZER_WARNING (CWE-122): [#def925]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:215:13: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:411:1: enter_function: entry to ‘lvp_encode_as’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:487:7: branch_false: following ‘false’ branch (when ‘node_depth’ is non-NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:492:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:493:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:548:7: branch_true: following ‘true’ branch (when ‘max_node_depth > 23’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: call_function: calling ‘lvp_flatten_as’ from ‘lvp_encode_as’
#  213|      uint32_t available_depth = 23 - depth;
#  214|      uint32_t allowed_child_count = 1 << available_depth;
#  215|->    uint32_t child_count = child_counts[index];
#  216|      bool flatten = child_count > allowed_child_count;
#  217|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def926]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:239:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:411:1: enter_function: entry to ‘lvp_encode_as’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:487:7: branch_false: following ‘false’ branch (when ‘node_depth’ is non-NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:492:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:493:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:548:7: branch_true: following ‘true’ branch (when ‘max_node_depth > 23’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: call_function: calling ‘lvp_flatten_as’ from ‘lvp_encode_as’
#  237|   
#  238|      if (flatten && has_internal_child) {
#  239|->       util_dynarray_append(subtrees, uint32_t, index);
#  240|         *max_subtree_size = MAX2(*max_subtree_size, child_count);
#  241|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def927]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:285:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:978:28: enter_function: entry to ‘lvp_GetDescriptorEXT’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:1085:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:1088:28: call_function: calling ‘get_texture_handle_bda’ from ‘lvp_GetDescriptorEXT’
#  283|   
#  284|      struct lp_texture_handle *handle = (void *)(uintptr_t)ctx->create_texture_handle(ctx, view, NULL);
#  285|->    util_dynarray_append(&device->bda_texture_handles, struct lp_texture_handle *, handle);
#  286|   
#  287|      simple_mtx_unlock(&device->queue.lock);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def928]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:309:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:978:28: enter_function: entry to ‘lvp_GetDescriptorEXT’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:1097:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:1100:28: call_function: calling ‘get_image_handle_bda’ from ‘lvp_GetDescriptorEXT’
#  307|   
#  308|      struct lp_texture_handle *handle = (void *)(uintptr_t)ctx->create_image_handle(ctx, &view);
#  309|->    util_dynarray_append(&device->bda_image_handles, struct lp_texture_handle *, handle);
#  310|   
#  311|      simple_mtx_unlock(&device->queue.lock);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def929]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:463:120: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:444:28: enter_function: entry to ‘lvp_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:453:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:454:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:459:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:461:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:461:13: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_UpdateDescriptorSets’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:461:13: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:463:120: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:463:120: danger: dereference of NULL ‘<unknown>’
#  461|               vk_find_struct_const(write->pNext, WRITE_DESCRIPTOR_SET_INLINE_UNIFORM_BLOCK);
#  462|            assert(uniform_data);
#  463|->          memcpy((uint8_t *)set->map + bind_layout->uniform_block_offset + write->dstArrayElement, uniform_data->pData, uniform_data->dataSize);
#  464|            continue;
#  465|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def930]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:633:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:444:28: enter_function: entry to ‘lvp_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:453:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:454:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:459:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:467:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:630:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:632:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:632:16: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_UpdateDescriptorSets’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:632:16: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:633:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_descriptor_set.c:633:13: danger: dereference of NULL ‘<unknown>’
#  631|               const VkWriteDescriptorSetAccelerationStructureKHR *accel_structs =
#  632|                  vk_find_struct_const(write->pNext, WRITE_DESCRIPTOR_SET_ACCELERATION_STRUCTURE_KHR);
#  633|->             VK_FROM_HANDLE(vk_acceleration_structure, accel_struct, accel_structs->pAccelerationStructures[j]);
#  634|   
#  635|               desc[j].accel_struct = accel_struct ? vk_acceleration_structure_get_va(accel_struct) : 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def931]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2366:63: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2315:32: enter_function: entry to ‘lvp_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2321:25: branch_true: following ‘true’ branch (when ‘i < bindInfoCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2322:59: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2325:39: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2325:39: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2328:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2333:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2333:7: branch_false: following ‘false’ branch (when ‘<unknown> == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2333:7: branch_true: following ‘true’ branch (when ‘<unknown> != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2360:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2360:10: branch_false: following ‘false’ branch (when ‘did_bind == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2361:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2363:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2365:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2365:16: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2365:16: call_function: inlined call to ‘__vk_find_struct’ from ‘lvp_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2366:63: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_device.c:2366:63: danger: dereference of NULL ‘<unknown>’
# 2364|               const VkBindImagePlaneMemoryInfo *plane_info =
# 2365|                  vk_find_struct_const(pBindInfos[i].pNext, BIND_IMAGE_PLANE_MEMORY_INFO);
# 2366|->             uint8_t plane = lvp_image_aspects_to_plane(image, plane_info->planeAspect);
# 2367|               result = lvp_image_plane_bind(device, &image->planes[plane],
# 2368|                                             mem, bind_info->memoryOffset, &offset_B);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def932]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:1056:54: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 1054|               state->pctx->buffer_unmap(state->pctx, xfer);
# 1055|               state->vb[idx].buffer.resource = get_buffer_resource(state->pctx, mem);
# 1056|->             state->vb[idx].buffer.resource->width0 = MIN2(vcb->offsets[i] + vcb->sizes[i], state->vb[idx].buffer.resource->width0);
# 1057|               state->vb_sizes[idx] = vcb->sizes[i];
# 1058|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def933]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:1115:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 1113|      lvp_descriptor_set_create(state->device, in_set->layout, &set);
# 1114|   
# 1115|->    util_dynarray_append(&state->push_desc_sets, struct lvp_descriptor_set *, set);
# 1116|   
# 1117|      memcpy(set->map, in_set->map, in_set->bo->width0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def934]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:1887:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘draws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 1885|   
# 1886|      for (unsigned i = 0; i < cmd->u.draw_multi_ext.draw_count; i++) {
# 1887|->       draws[i].start = cmd->u.draw_multi_ext.vertex_info[i].firstVertex;
# 1888|         draws[i].count = cmd->u.draw_multi_ext.vertex_info[i].vertexCount;
# 1889|         draws[i].index_bias = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def935]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:2631:27: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘draws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 2629|      if (state->index_buffer_size != UINT32_MAX) {
# 2630|         for (unsigned i = 0; i < cmd->u.draw_multi_indexed_ext.draw_count; i++)
# 2631|->          draws[i].count = MIN2(draws[i].count, state->index_buffer_size / state->index_size - draws[i].start);
# 2632|      }
# 2633|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def936]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:2637:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘draws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 2635|      if (cmd->u.draw_multi_indexed_ext.draw_count &&
# 2636|          cmd->u.draw_multi_indexed_ext.vertex_offset)
# 2637|->       draws[0].index_bias = *cmd->u.draw_multi_indexed_ext.vertex_offset;
# 2638|   
# 2639|      /* TODO: avoid calculating multiple times if cmdbuf is submitted again */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def937]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:2641:24: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘draws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 2639|      /* TODO: avoid calculating multiple times if cmdbuf is submitted again */
# 2640|      for (unsigned i = 0; i < cmd->u.draw_multi_indexed_ext.draw_count; i++)
# 2641|->       draws[i].start = util_clamped_uadd(state->index_offset / state->index_size,
# 2642|                                            draws[i].start);
# 2643|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def938]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:2669:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5308:10: enter_function: entry to ‘lvp_execute_cmds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’
# 2667|            state->pctx->buffer_unmap(state->pctx, xfer);
# 2668|            index = get_buffer_resource(state->pctx, mem + state->index_offset);
# 2669|->          index->width0 = MIN2(state->index_buffer->width0 - state->index_offset, state->index_buffer_size);
# 2670|            state->info.index.resource = index;
# 2671|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def939]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:55:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:78:1: enter_function: entry to ‘lvp_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:83:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘lvp_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:83:4: return_function: returning to ‘lvp_lower_input_attachments’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:83:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:84:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘lvp_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:86:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:86:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:91:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:91:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:94:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:94:25: call_function: calling ‘try_lower_input_load’ from ‘lvp_lower_input_attachments’
#   53|      assert(glsl_type_is_image(deref->type));
#   54|   
#   55|->    enum glsl_sampler_dim image_dim = glsl_get_sampler_dim(deref->type);
#   56|      if (image_dim != GLSL_SAMPLER_DIM_SUBPASS &&
#   57|          image_dim != GLSL_SAMPLER_DIM_SUBPASS_MS)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def940]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:234:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘group’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:176:8: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:179:17: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:186:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:186:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:232:5: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:232:5: release_memory: ‘group’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_buffer_upload.c:234:5: danger: dereference of NULL ‘group’
#  232|       buf->parent = group;
#  233|       buf->resource = NULL;
#  234|->     pipe_resource_reference(&buf->resource, group->resource);
#  235|       buf->offset = group->free_offset;
#  236|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def941]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:625:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘oPsz.WriteMask’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:352:17: branch_true: following ‘true’ branch (when ‘i != 24’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:353:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:411:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:414:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:414:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:416:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:418:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:425:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:428:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:433:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:594:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:594:9: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:595:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:599:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:604:37: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:608:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:625:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_ff.c:625:9: danger: use of uninitialized value ‘oPsz.WriteMask’ here
#  623|           }
#  624|   
#  625|->         ureg_MOV(ureg, oPsz, _Z(tmp));
#  626|           ureg_release_temporary(ureg, tmp);
#  627|       }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def942]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:28:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘r’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:11:28: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:15:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:17:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:27:17: branch_true: following ‘true’ branch (when ‘i != 63’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:28:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_helpers.c:28:9: danger: ‘r’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   26|   
#   27|       for (i = 0; i < 63; ++i, r = r->next)
#   28|->         r->next = (struct nine_range *)
#   29|               ((uint8_t *)r + sizeof(struct nine_range));
#   30|       r->next = NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def943]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_memory_helper.c:1063:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_memory_helper.c:1057:1: enter_function: entry to ‘nine_allocate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_memory_helper.c:1062:18: call_function: calling ‘align_calloc’ from ‘nine_allocate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_memory_helper.c:1062:18: return_function: returning to ‘nine_allocate’ from ‘align_calloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_memory_helper.c:1063:5: danger: dereference of NULL ‘align_calloc((long unsigned int)(size + 32), 32)’
# 1061|       assert(sizeof(struct nine_allocation) <= NINE_ALLOCATION_ALIGNMENT);
# 1062|       allocation = align_calloc(size + NINE_ALLOCATION_ALIGNMENT, NINE_ALLOCATION_ALIGNMENT);
# 1063|->     allocation->is_external = false;
# 1064|       return allocation;
# 1065|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def944]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_shader.h:277:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc(328)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3082:1: enter_function: entry to ‘nine_context_update_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3084:5: call_function: calling ‘nine_update_state’ from ‘nine_context_update_state’
#  275|           current = *next_allocate;
#  276|           index++;
#  277|->         current->next = NULL;
#  278|           memcpy(current->const_i, const_i, sizeof(current->const_i));
#  279|           memcpy(current->const_b, const_b, sizeof(current->const_b));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def945]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:907:48: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘vtxbuf_holes_map[b]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3082:1: enter_function: entry to ‘nine_context_update_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3084:5: call_function: calling ‘nine_update_state’ from ‘nine_context_update_state’
#  905|               ve.velems[n] = vdecl->elems[index];
#  906|               b = ve.velems[n].vertex_buffer_index;
#  907|->             ve.velems[n].vertex_buffer_index = vtxbuf_holes_map[b];
#  908|               ve.velems[n].src_stride = context->vtxstride[b];
#  909|               context->stream_usage_mask |= 1 << b;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def946]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3183:48: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘vtxbuf_holes_map[b]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3373:1: enter_function: entry to ‘nine_state_prepare_draw_sw’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3386:24: call_function: calling ‘update_vertex_elements_sw’ from ‘nine_state_prepare_draw_sw’
# 3181|               ve.velems[n] = vdecl->elems[index];
# 3182|               b = ve.velems[n].vertex_buffer_index;
# 3183|->             ve.velems[n].vertex_buffer_index = vtxbuf_holes_map[b];
# 3184|               /* XXX wine just uses 1 here: */
# 3185|               if (state->stream_freq[b] & D3DSTREAMSOURCE_INSTANCEDATA)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def947]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3192:48: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘vtxbuf_holes_map[dummy_vbo_stream]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3171:17: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3178:17: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3179:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3180:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3192:48: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/nine_state.c:3192:48: danger: use of uninitialized value ‘vtxbuf_holes_map[dummy_vbo_stream]’ here
# 3190|                * This is not precised by the spec, but is the behaviour
# 3191|                * tested on win */
# 3192|->             ve.velems[n].vertex_buffer_index = vtxbuf_holes_map[dummy_vbo_stream];
# 3193|               ve.velems[n].src_format = PIPE_FORMAT_R32G32B32A32_FLOAT;
# 3194|               ve.velems[n].src_offset = 0;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def948]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:268:5: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&nresult’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:201:5: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:202:5: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:202:5: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:203:5: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:203:5: branch_false: following ‘false’ branch (when ‘dwGetDataFlags <= 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:206:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:206:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:217:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:229:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:231:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:231:8: branch_false: following ‘false’ branch (when ‘dwSize != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:234:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/query9.c:268:5: danger: use of uninitialized value ‘&nresult’ here
#  266|           break;
#  267|       }
#  268|->     memcpy(pData, &nresult, MIN2(sizeof(nresult), dwSize));
#  269|   
#  270|       return S_OK;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def949]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/surface9.c:836:49: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘resource’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/surface9.c:825:1: enter_function: entry to ‘NineSurface9_SetResourceResize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/surface9.c:834:5: call_function: calling ‘pipe_resource_reference’ from ‘NineSurface9_SetResourceResize’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/surface9.c:834:5: return_function: returning to ‘NineSurface9_SetResourceResize’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/nine/surface9.c:836:49: danger: dereference of NULL ‘resource’
#  834|       pipe_resource_reference(&This->base.resource, resource);
#  835|   
#  836|->     This->desc.Width = This->base.info.width0 = resource->width0;
#  837|       This->desc.Height = This->base.info.height0 = resource->height0;
#  838|       This->base.info.nr_samples = resource->nr_samples;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def950]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:548:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘supported_nodes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:537:1: enter_function: entry to ‘PrepareDelegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:541:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:543:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:543:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:543:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:544:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:544:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:547:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:548:4: danger: ‘supported_nodes’ could be NULL: unchecked value from [(19)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/18)
#  546|      // Get a list of supported nodes.
#  547|      TfLiteIntArray *supported_nodes = malloc(plan->size * sizeof(int) + sizeof(*supported_nodes));
#  548|->    supported_nodes->size = plan->size;
#  549|      unsigned node_count = 0;
#  550|      for (int i = 0; i < plan->size; i++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def951]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:758:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘delegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:743:65: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:756:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:757:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:757:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:758:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:758:10: danger: ‘delegate’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  756|      for (int i = 0; i < n; i++) {
#  757|         if (strstr("etnaviv", devs[i]->driver_name))
#  758|->          delegate->dev = devs[i];
#  759|         else
#  760|            pipe_loader_release(&devs[i], 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def952]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:764:8: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘delegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:743:65: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:756:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:762:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:764:8: danger: ‘delegate’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  762|      free(devs);
#  763|   
#  764|->    if (delegate->dev == NULL) {
#  765|         fprintf(stderr, "Couldn't open kernel device\n");
#  766|         return NULL;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def953]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:765:7: warning[-Wanalyzer-malloc-leak]: leak of ‘delegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:743:65: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:764:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:765:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:765:7: danger: ‘delegate’ leaks here; was allocated at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  763|   
#  764|      if (delegate->dev == NULL) {
#  765|->       fprintf(stderr, "Couldn't open kernel device\n");
#  766|         return NULL;
#  767|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def954]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:774:11: warning[-Wanalyzer-malloc-leak]: leak of ‘delegate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:743:65: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:756:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:757:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:757:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:758:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:756:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:762:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:764:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:769:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:774:11: danger: ‘delegate’ leaks here; was allocated at [(1)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/0)
#  772|      delegate->context = screen->context_create(screen, NULL, PIPE_CONTEXT_COMPUTE_ONLY);
#  773|   
#  774|->    return &delegate->base;
#  775|   }
#  776|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def955]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:224:19: warning[-Wanalyzer-malloc-leak]: leak of ‘calloc(1, 48)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:131:7: branch_false: following ‘false’ branch (when ‘ctx’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:134:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:135:7: branch_false: following ‘false’ branch (when ‘drv’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:138:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:138:7: branch_false: following ‘false’ branch (when ‘pbuff’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:141:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:143:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:151:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:162:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:198:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:201:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:202:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:214:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:220:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:222:32: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:223:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:223:19: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:224:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:224:40: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/buffer.c:224:19: danger: ‘calloc(1, 48)’ leaks here; was allocated at [(21)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/20)
#  222|               for (size_t i = 0; i < buf->extended_metadata.codec_unit_metadata_count - 1; i++) {
#  223|                  if (!curr_buf_ptr->next)
#  224|->                   curr_buf_ptr->next = CALLOC(1, sizeof(VACodedBufferSegment));
#  225|                  if (!curr_buf_ptr->next)
#  226|                     return VA_STATUS_ERROR_ALLOCATION_FAILED;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def956]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1287:1: enter_function: entry to ‘vlVaAddRawHeader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1294:7: branch_true: following ‘true’ branch (when ‘emulation_bytes_start != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1296:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1298:48: branch_false: following ‘false’ branch (when ‘i >= size’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘vlVaAddRawHeader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: return_function: returning to ‘vlVaAddRawHeader’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(headers, 1, 16)’
# 1311|         memcpy(header.buffer, buf, size);
# 1312|      }
# 1313|->    util_dynarray_append(headers, struct pipe_enc_raw_header, header);
# 1314|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def957]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1314:1: warning[-Wanalyzer-malloc-leak]: leak of ‘header.buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1287:1: enter_function: entry to ‘vlVaAddRawHeader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1294:7: branch_true: following ‘true’ branch (when ‘emulation_bytes_start != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1296:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1296:23: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1298:48: branch_false: following ‘false’ branch (when ‘i >= size’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘vlVaAddRawHeader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1313:4: return_function: returning to ‘vlVaAddRawHeader’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture.c:1314:1: danger: ‘header.buffer’ leaks here; was allocated at [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3)
# 1312|      }
# 1313|      util_dynarray_append(headers, struct pipe_enc_raw_header, header);
# 1314|-> }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def958]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:243:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:170:1: enter_function: entry to ‘vlVaAssociateSubpicture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:186:7: branch_false: following ‘false’ branch (when ‘ctx’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:188:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:192:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:199:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:197:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:226:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:231:4: call_function: calling ‘pipe_resource_reference’ from ‘vlVaAssociateSubpicture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:231:4: return_function: returning to ‘vlVaAssociateSubpicture’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:232:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:237:16: branch_true: following ‘true’ branch (when ‘i < num_surfaces’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:238:57: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:239:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:243:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:243:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘vlVaAssociateSubpicture’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:243:7: return_function: returning to ‘vlVaAssociateSubpicture’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/subpicture.c:243:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*<unknown>.subpics, 1, 8)’
#  241|            return VA_STATUS_ERROR_INVALID_SURFACE;
#  242|         }
#  243|->       util_dynarray_append(&surf->subpics, vlVaSubpicture *, sub);
#  244|      }
#  245|      mtx_unlock(&drv->mutex);

Error: GCC_ANALYZER_WARNING (CWE-121): [#def959]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:981:20: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:993:1: enter_function: entry to ‘vlVdpDecoderRender’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1023:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1026:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1027:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1029:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1033:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1036:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1036:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1039:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1072:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1076:7: branch_false: ...to here
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1087:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1095:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1096:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1096:10: call_function: calling ‘vlVdpDecoderFixVC1Startcode’ from ‘vlVdpDecoderRender’
#  979|      VDPAU_MSG(VDPAU_TRACE, "[VDPAU] Manually adding VC-1 startcode\n");
#  980|      for (i = *num_buffers; i > 0; --i) {
#  981|->       buffers[i] = buffers[i - 1];
#  982|         sizes[i] = sizes[i - 1];
#  983|      }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def960]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:982:18: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:993:1: enter_function: entry to ‘vlVdpDecoderRender’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1023:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1026:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1027:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1029:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1033:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1036:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1036:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1039:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1072:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1076:7: branch_false: ...to here
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1087:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1095:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1096:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/decode.c:1096:10: call_function: calling ‘vlVdpDecoderFixVC1Startcode’ from ‘vlVdpDecoderRender’
#  980|      for (i = *num_buffers; i > 0; --i) {
#  981|         buffers[i] = buffers[i - 1];
#  982|->       sizes[i] = sizes[i - 1];
#  983|      }
#  984|      ++(*num_buffers);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def961]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:246:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:170:1: enter_function: entry to ‘vlVdpPresentationQueueTargetCreateX11’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:176:7: branch_false: following ‘false’ branch (when ‘drawable != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:179:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:180:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:183:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:184:7: branch_false: following ‘false’ branch (when ‘pqt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:187:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:187:4: call_function: calling ‘DeviceReference’ from ‘vlVdpPresentationQueueTargetCreateX11’
#  244|      mtx_destroy(&dev->mutex);
#  245|      vl_compositor_cleanup(&dev->compositor);
#  246|->    dev->context->sampler_view_release(dev->context, dev->dummy_sv);
#  247|      dev->context->destroy(dev->context);
#  248|      dev->vscreen->destroy(dev->vscreen);

Error: GCC_ANALYZER_WARNING (CWE-787): [#def962]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:135:18: warning[-Wanalyzer-out-of-bounds]: buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:123:7: branch_false: following ‘false’ branch (when ‘function_id > 4095’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:127:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:127:14: branch_false: following ‘false’ branch (when ‘function_id > 8191’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:133:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:134:10: branch_true: following ‘true’ branch (when ‘function_id <= 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:135:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/ftab.c:135:18: danger: read of 8 bytes at offset ‘function_id * 8 + 34359672832’ exceeds ‘ftab_driver’
#  133|         function_id -= VDP_FUNC_ID_BASE_DRIVER;
#  134|         if (function_id < ARRAY_SIZE(ftab_driver))
#  135|->          *func = ftab_driver[function_id];
#  136|      }
#  137|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def963]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:411:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pipe’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:260:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:263:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:266:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:268:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:270:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:274:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:275:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:278:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:278:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:281:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:282:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:285:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:295:7: branch_false: following ‘false’ branch (when ‘bg’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:299:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:347:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:388:16: branch_false: following ‘false’ branch (when ‘i >= layer_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:404:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:406:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:407:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:411:16: danger: dereference of NULL ‘pipe’
#  409|                                    sampler_view, dst->surface);
#  410|         } else {
#  411|->          res = pipe->screen->resource_create(pipe->screen, &res_tmpl);
#  412|            struct pipe_sampler_view *sampler_view_temp = pipe->create_sampler_view(pipe, res, &sv_templ);
#  413|            struct pipe_surface *surface_temp = pipe->create_surface(pipe, res, &surf_templ);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def964]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:432:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pipe’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:260:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:263:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:266:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:268:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:270:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:274:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:275:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:273:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:278:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:278:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:281:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:282:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:285:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:295:7: branch_false: following ‘false’ branch (when ‘bg’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:299:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:347:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:388:16: branch_false: following ‘false’ branch (when ‘i >= layer_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:404:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:406:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:427:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:428:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:428:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:432:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/mixer.c:432:16: danger: dereference of NULL ‘pipe’
#  430|                                    sampler_view, dst->surface);
#  431|         } else {
#  432|->          res = pipe->screen->resource_create(pipe->screen, &res_tmpl);
#  433|            struct pipe_sampler_view *sampler_view_temp = pipe->create_sampler_view(pipe, res, &sv_templ);
#  434|            struct pipe_surface *surface_temp = pipe->create_surface(pipe, res, &surf_templ);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def965]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/xa/xa_context.c:58:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/xa/xa_context.c:56:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/xa/xa_context.c:58:5: danger: ‘ctx’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   56|       struct xa_context *ctx = calloc(1, sizeof(*ctx));
#   57|   
#   58|->     ctx->xa = xa;
#   59|       ctx->pipe = xa->screen->context_create(xa->screen, NULL, 0);
#   60|       ctx->cso = cso_create_context(ctx->pipe, 0);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def966]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/include/winsys/radeon_winsys.h:782:19: warning[-Wanalyzer-malloc-leak]: leak of ‘si_vce_encode_headers(encoder)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:261:13: enter_function: entry to ‘rvce_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:271:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:25: call_function: calling ‘si_vce_encode_headers’ from ‘rvce_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:25: return_function: returning to ‘rvce_encode_bitstream’ from ‘si_vce_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:278:9: call_function: inlined call to ‘radeon_emitted’ from ‘rvce_encode_bitstream’
#  780|   static inline bool radeon_emitted(struct radeon_cmdbuf *rcs, unsigned num_dw)
#  781|   {
#  782|->    return rcs && (rcs->prev_dw + rcs->current.cdw > num_dw);
#  783|   }
#  784|   

Error: GCC_ANALYZER_WARNING (CWE-131): [#def967]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:388:14: warning[-Wanalyzer-allocation-size]: allocated buffer size is not a multiple of the pointee's size
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:450:1: enter_function: entry to ‘drilCreateNewScreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:455:34: call_function: calling ‘init_dri2_configs’ from ‘drilCreateNewScreen’
#  386|      eglconfigs = malloc(sizeof(EGLConfig) * num_configs);
#  387|      /* overestimate: num_configs * doubleBuffer * sRGB + NULL */
#  388|->    configs = calloc(num_configs * 2 * 2 + 1, sizeof(struct gl_config));
#  389|      if (!peglGetConfigs(dpy, eglconfigs, num_configs, &num_configs))
#  390|         goto out_egl;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def968]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘configs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:450:1: enter_function: entry to ‘drilCreateNewScreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:456:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:457:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:457:10: branch_false: following ‘false’ branch (when ‘fd == -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:460:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:460:17: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:462:23: branch_true: following ‘true’ branch (when ‘i != 90’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:25: call_function: calling ‘mem_dup’ from ‘drilCreateNewScreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:25: return_function: returning to ‘drilCreateNewScreen’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:10: danger: ‘configs + (long unsigned int)c * 8’ could be NULL: unchecked value from [(6)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/5)
#  462|         for (int i = 0; i < ARRAY_SIZE(drilConfigs); i++) {
#  463|            /* create normal config */
#  464|->          configs[c++] = mem_dup(&drilConfigs[i], sizeof(drilConfigs[i]));
#  465|   
#  466|            /* create double-buffered config */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def969]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:469:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(&drilConfigs[i], 108)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:450:1: enter_function: entry to ‘drilCreateNewScreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:456:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:457:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:457:10: branch_false: following ‘false’ branch (when ‘fd == -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:460:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:462:23: branch_true: following ‘true’ branch (when ‘i != 90’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:25: call_function: calling ‘mem_dup’ from ‘drilCreateNewScreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:464:25: return_function: returning to ‘drilCreateNewScreen’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:467:23: call_function: calling ‘mem_dup’ from ‘drilCreateNewScreen’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:467:23: return_function: returning to ‘drilCreateNewScreen’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/targets/dril/dril_target.c:469:10: danger: dereference of NULL ‘mem_dup(&drilConfigs[i], 108)’
#  467|            configs[c] = mem_dup(&drilConfigs[i], sizeof(drilConfigs[i]));
#  468|            struct gl_config *cfg = (void*)configs[c++];
#  469|->          cfg->doubleBufferMode = 1;
#  470|         }
#  471|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def970]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:130:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘aws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:376:1: enter_function: entry to ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:386:7: branch_false: following ‘false’ branch (when ‘sws’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:389:4: call_function: inlined call to ‘pipe_reference_init’ from ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:400:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:407:47: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:408:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:437:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:438:10: branch_false: following ‘false’ branch (when ‘aws’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:441:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:460:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:462:7: call_function: inlined call to ‘simple_mtx_init’ from ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:470:12: call_function: calling ‘do_winsys_init’ from ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:470:12: return_function: returning to ‘amdgpu_winsys_create’ from ‘do_winsys_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:470:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:476:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:482:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:492:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:492:10: call_function: calling ‘amdgpu_winsys_destroy_locked’ from ‘amdgpu_winsys_create’
#  128|      if (destroy && dev_tab) {
#  129|         _mesa_hash_table_remove_key(dev_tab,
#  130|->                                   (void *)ac_drm_device_get_cookie(aws->dev));
#  131|         if (_mesa_hash_table_num_entries(dev_tab) == 0) {
#  132|            _mesa_hash_table_destroy(dev_tab, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def971]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:140:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘aws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:376:1: enter_function: entry to ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:386:7: branch_false: following ‘false’ branch (when ‘sws’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:389:4: call_function: inlined call to ‘pipe_reference_init’ from ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:400:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:407:47: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:408:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:437:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:438:10: branch_false: following ‘false’ branch (when ‘aws’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:441:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:460:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:462:7: call_function: inlined call to ‘simple_mtx_init’ from ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:470:12: call_function: calling ‘do_winsys_init’ from ‘amdgpu_winsys_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:470:12: return_function: returning to ‘amdgpu_winsys_create’ from ‘do_winsys_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:470:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:476:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:482:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:492:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/amdgpu/drm/amdgpu_winsys.c:492:10: call_function: calling ‘amdgpu_winsys_destroy_locked’ from ‘amdgpu_winsys_create’
#  138|         simple_mtx_unlock(&dev_tab_mutex);
#  139|   
#  140|->    if (sws->fd != aws->fd)
#  141|         close(sws->fd);
#  142|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def972]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:57:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:59:4: danger: ‘batch’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   57|      struct i915_drm_batchbuffer *batch = CALLOC_STRUCT(i915_drm_batchbuffer);
#   58|   
#   59|->    batch->actual_size = idws->max_batch_size;
#   60|   
#   61|      batch->base.map = MALLOC(batch->actual_size);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def973]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:71:11: warning[-Wanalyzer-malloc-leak]: leak of ‘batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:54:1: enter_function: entry to ‘i915_drm_batchbuffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:57:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:69:4: call_function: calling ‘i915_drm_batchbuffer_reset’ from ‘i915_drm_batchbuffer_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:69:4: return_function: returning to ‘i915_drm_batchbuffer_create’ from ‘i915_drm_batchbuffer_reset’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/i915/drm/i915_drm_batchbuffer.c:71:11: danger: ‘batch’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#   69|      i915_drm_batchbuffer_reset(batch);
#   70|   
#   71|->    return &batch->base;
#   72|   }
#   73|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def974]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/nouveau/drm/nouveau.c:679:14: warning[-Wanalyzer-malloc-leak]: leak of ‘nvbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/nouveau/drm/nouveau.c:1775:1: enter_function: entry to ‘nouveau_pushbuf_validate’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/nouveau/drm/nouveau.c:1777:11: call_function: calling ‘pushbuf_validate’ from ‘nouveau_pushbuf_validate’
#  677|      struct nouveau_bo_priv *nvbo = calloc(1, sizeof(*nvbo));
#  678|      if (!nvbo)
#  679|->       return -ENOMEM;
#  680|   
#  681|      struct nouveau_bo *bo = &nvbo->base;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def975]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:210:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘n’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1068:31: enter_function: entry to ‘radeon_winsys_bo_from_ptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1078:7: branch_false: following ‘false’ branch (when ‘bo’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1081:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1088:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1096:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1114:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1117:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1117:16: call_function: calling ‘radeon_bomgr_find_va64’ from ‘radeon_winsys_bo_from_ptr’
#  208|            if (waste) {
#  209|               n = CALLOC_STRUCT(radeon_bo_va_hole);
#  210|->             n->size = waste;
#  211|               n->offset = hole->offset;
#  212|               list_add(&n->list, &hole->list);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def976]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:219:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:191:1: enter_function: entry to ‘vmw_dma_bufmgr_create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:201:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:202:6: branch_false: following ‘false’ branch (when ‘buf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:205:4: call_function: inlined call to ‘pipe_reference_init’ from ‘vmw_dma_bufmgr_create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:215:9: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:219:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:219:11: danger: ‘buf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  217|      }
#  218|   	 
#  219|->    return &buf->base;
#  220|   error2:
#  221|      FREE(buf);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def977]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:257:11: warning[-Wanalyzer-malloc-leak]: leak of ‘mgr’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:247:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:248:6: branch_false: following ‘false’ branch (when ‘mgr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:251:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_buffer.c:257:11: danger: ‘mgr’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  255|      mgr->vws = vws;
#  256|      
#  257|->    return &mgr->base;
#  258|   }
#  259|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def978]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:863:4: warning[-Wanalyzer-malloc-leak]: leak of ‘vswc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:778:1: enter_function: entry to ‘vmw_svga_winsys_context_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:783:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:784:6: branch_false: following ‘false’ branch (when ‘vswc’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:787:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:812:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:815:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:827:6: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:830:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:831:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:834:8: call_function: inlined call to ‘vmw_has_userspace_surface’ from ‘vmw_svga_winsys_context_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:854:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:856:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/svga/drm/vmw_context.c:863:4: danger: ‘vswc’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  861|   #endif
#  862|   
#  863|->    vswc->base.force_coherent = vws->force_coherent;
#  864|      return &vswc->base;
#  865|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def979]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/dri/dri_sw_winsys.c:324:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
#  322|      struct sw_displaytarget *sw = dri_sw_displaytarget_create(winsys, templ->usage, templ->format, templ->width0, templ->height0, 64, NULL, stride);
#  323|      struct dri_sw_displaytarget *dri_sw_dt = dri_sw_displaytarget(sw);
#  324|->    dri_sw_dt->fd = fd;
#  325|      dri_sw_dt->offset = whandle->offset;
#  326|      return sw;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def980]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/dri/dri_sw_winsys.c:410:11: warning[-Wanalyzer-malloc-leak]: leak of ‘ws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/dri/dri_sw_winsys.c:388:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/dri/dri_sw_winsys.c:389:7: branch_false: following ‘false’ branch (when ‘ws’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/dri/dri_sw_winsys.c:392:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/dri/dri_sw_winsys.c:410:11: danger: ‘ws’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  408|      ws->base.displaytarget_display = dri_sw_displaytarget_display;
#  409|   
#  410|->    return &ws->base;
#  411|   }
#  412|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def981]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c:539:11: warning[-Wanalyzer-malloc-leak]: leak of ‘ws’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c:514:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c:515:7: branch_false: following ‘false’ branch (when ‘ws’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c:518:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c:539:11: danger: ‘ws’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  537|      ws->base.displaytarget_display = kms_sw_displaytarget_display;
#  538|   
#  539|->    return &ws->base;
#  540|   }
#  541|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def982]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:314:11: warning[-Wanalyzer-malloc-leak]: leak of ‘wsw’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:290:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:292:7: branch_false: following ‘false’ branch (when ‘wsw’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:295:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:306:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:309:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/sw/wrapper/wrapper_sw_winsys.c:314:11: danger: ‘wsw’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  312|         wsw->target = PIPE_TEXTURE_RECT;
#  313|   
#  314|->    return &wsw->base;
#  315|   
#  316|   err_free:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def983]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:150:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘old’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:768:13: enter_function: entry to ‘virgl_drm_add_res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:773:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:776:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:776:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:777:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:781:10: branch_false: following ‘false’ branch (when ‘new_ptr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:785:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:790:10: branch_false: following ‘false’ branch (when ‘new_ptr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:794:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:798:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:799:4: call_function: calling ‘virgl_drm_resource_reference’ from ‘virgl_drm_add_res’
#  148|      if (pipe_reference(&(*dres)->reference, &sres->reference)) {
#  149|   
#  150|->       if (!can_cache_resource(old->bind) ||
#  151|             p_atomic_read(&old->external)) {
#  152|            virgl_hw_res_destroy(qdws, old);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def984]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:870:11: warning[-Wanalyzer-malloc-leak]: leak of ‘cbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:844:30: enter_function: entry to ‘virgl_drm_cmd_buf_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:849:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:850:7: branch_false: following ‘false’ branch (when ‘cbuf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:853:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:855:9: call_function: calling ‘virgl_drm_alloc_res_list’ from ‘virgl_drm_cmd_buf_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:855:9: return_function: returning to ‘virgl_drm_cmd_buf_create’ from ‘virgl_drm_alloc_res_list’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:855:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:860:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:861:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:868:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/drm/virgl_drm_winsys.c:870:11: danger: ‘cbuf’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  868|      cbuf->in_fence_fd = -1;
#  869|      cbuf->base.buf = cbuf->buf;
#  870|->    return &cbuf->base;
#  871|   }
#  872|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def985]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:215:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘old’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:497:13: enter_function: entry to ‘virgl_vtest_add_res’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:502:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:505:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:505:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:506:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:510:10: branch_false: following ‘false’ branch (when ‘new_re_bo’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:515:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:519:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:520:4: call_function: calling ‘virgl_vtest_resource_reference’ from ‘virgl_vtest_add_res’
#  213|   
#  214|      if (pipe_reference(&(*dres)->reference, &sres->reference)) {
#  215|->       if (!can_cache_resource_with_bind(old->bind)) {
#  216|            virgl_hw_res_destroy(vtws, old);
#  217|         } else {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def986]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:550:11: warning[-Wanalyzer-malloc-leak]: leak of ‘cbuf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:530:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:531:7: branch_false: following ‘false’ branch (when ‘cbuf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:534:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:536:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:541:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:542:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:548:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/winsys/virgl/vtest/virgl_vtest_winsys.c:550:11: danger: ‘cbuf’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  548|      cbuf->ws = vws;
#  549|      cbuf->base.buf = cbuf->buf;
#  550|->    return &cbuf->base;
#  551|   }
#  552|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def987]
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1119:14: warning[-Wanalyzer-malloc-leak]: leak of ‘surf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1106:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1107:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1112:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1117:7: branch_true: following ‘true’ branch (when ‘modifiers’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1119:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1119:14: danger: ‘surf’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 1117|      if (!modifiers) {
# 1118|         assert(!count);
# 1119|->       return &surf->base;
# 1120|      }
# 1121|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def988]
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1136:11: warning[-Wanalyzer-malloc-leak]: leak of ‘surf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1106:11: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1107:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1112:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1117:7: branch_false: following ‘false’ branch (when ‘modifiers’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1122:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1123:7: branch_false: following ‘false’ branch (when ‘count == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1133:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gbm/backends/dri/gbm_dri.c:1136:11: danger: ‘surf’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 1134|      memcpy(surf->base.v0.modifiers, modifiers, count * sizeof(*modifiers));
# 1135|   
# 1136|->    return &surf->base;
# 1137|   }
# 1138|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def989]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:209:11: warning[-Wanalyzer-malloc-leak]: leak of ‘driConfig’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:967:1: enter_function: entry to ‘dri_screen_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:972:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:976:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:997:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:1001:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/dri_common.c:1001:14: call_function: calling ‘driConvertConfigs’ from ‘dri_screen_init’
#  207|      driConfig->driConfig = driConfigs[i];
#  208|   
#  209|->    return &driConfig->base;
#  210|   }
#  211|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def990]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxcmds.c:1478:17: warning[-Wanalyzer-malloc-leak]: leak of ‘glXChooseFBConfig(dpy, *vis.screen, & attrib_list, & nconfigs)’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxcmds.c:1787:1: enter_function: entry to ‘glXGetFBConfigFromVisualSGIX’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxcmds.c:1794:18: call_function: calling ‘glXChooseFBConfig’ from ‘glXGetFBConfigFromVisualSGIX’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxcmds.c:1794:18: return_function: returning to ‘glXGetFBConfigFromVisualSGIX’ from ‘glXChooseFBConfig’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxcmds.c:1478:17: danger: ‘glXChooseFBConfig(dpy, *vis.screen, & attrib_list, & nconfigs)’ leaks here; was allocated at [(16)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/15)
# 1476|   
# 1477|      *nelements = 0;
# 1478|->    if (priv && (priv->screens != NULL)
# 1479|          && (screen >= 0) && (screen < ScreenCount(dpy))
# 1480|          && (priv->screens[screen]->configs != NULL)

Error: GCC_ANALYZER_WARNING (CWE-401): [#def991]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1101:10: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:944:1: enter_function: entry to ‘__glXInitialize’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:963:7: branch_false: following ‘false’ branch (when ‘dpyPriv’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:966:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:967:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:972:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:976:9: call_function: calling ‘QueryVersion’ from ‘__glXInitialize’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:976:9: return_function: returning to ‘__glXInitialize’ from ‘QueryVersion’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:976:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:978:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:976:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:979:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:979:11: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:984:16: branch_true: following ‘true’ branch (when ‘i != 17’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:985:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1020:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1020:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1020:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1021:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1044:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1045:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1093:9: call_function: calling ‘AllocAndFetchScreenConfigs’ from ‘__glXInitialize’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1093:9: return_function: returning to ‘__glXInitialize’ from ‘AllocAndFetchScreenConfigs’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1093:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1096:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1096:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1101:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/glxext.c:1101:10: danger: ‘<unknown>’ leaks here; was allocated at [(29)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/28)
# 1099|   #endif
# 1100|         if (fail) {
# 1101|->          free(dpyPriv);
# 1102|            return NULL;
# 1103|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def992]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1193:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1168:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1193:4: danger: dereference of NULL ‘get_array_entry(arrays, 32884, 0)’
# 1191|      a = get_array_entry(arrays, GL_VERTEX_ARRAY, 0);
# 1192|      assert(a != NULL);
# 1193|->    COMMON_ARRAY_DATA_INIT(a, pointer, type, stride, size, GL_FALSE, 4,
# 1194|                             opcode);
# 1195|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def993]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1241:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1213:7: branch_false: following ‘false’ branch (when ‘stride >= 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1218:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1241:4: danger: dereference of NULL ‘get_array_entry(arrays, 32885, 0)’
# 1239|      a = get_array_entry(arrays, GL_NORMAL_ARRAY, 0);
# 1240|      assert(a != NULL);
# 1241|->    COMMON_ARRAY_DATA_INIT(a, pointer, type, stride, 3, GL_TRUE, 4, opcode);
# 1242|   
# 1243|      if (a->enabled) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def994]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1321:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1284:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1321:4: danger: dereference of NULL ‘get_array_entry(arrays, 32886, 0)’
# 1319|      a = get_array_entry(arrays, GL_COLOR_ARRAY, 0);
# 1320|      assert(a != NULL);
# 1321|->    COMMON_ARRAY_DATA_INIT(a, pointer, type, stride, size, GL_TRUE, 4, opcode);
# 1322|   
# 1323|      if (a->enabled) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def995]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1367:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1339:7: branch_false: following ‘false’ branch (when ‘stride >= 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1344:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1367:4: danger: dereference of NULL ‘get_array_entry(arrays, 32887, 0)’
# 1365|      a = get_array_entry(arrays, GL_INDEX_ARRAY, 0);
# 1366|      assert(a != NULL);
# 1367|->    COMMON_ARRAY_DATA_INIT(a, pointer, type, stride, 1, GL_FALSE, 4, opcode);
# 1368|   
# 1369|      if (a->enabled) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def996]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1392:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1384:7: branch_false: following ‘false’ branch (when ‘stride >= 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1390:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1392:4: danger: dereference of NULL ‘get_array_entry(arrays, 32889, 0)’
# 1390|      a = get_array_entry(arrays, GL_EDGE_FLAG_ARRAY, 0);
# 1391|      assert(a != NULL);
# 1392|->    COMMON_ARRAY_DATA_INIT(a, pointer, GL_UNSIGNED_BYTE, stride, 1, GL_FALSE,
# 1393|                             4, X_GLrop_EdgeFlagv);
# 1394|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def997]
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1499:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1448:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/glx/indirect_vertex_array.c:1499:4: danger: dereference of NULL ‘get_array_entry(arrays, 32888,  index)’
# 1497|      a = get_array_entry(arrays, GL_TEXTURE_COORD_ARRAY, index);
# 1498|      assert(a != NULL);
# 1499|->    COMMON_ARRAY_DATA_INIT(a, pointer, type, stride, size, GL_FALSE,
# 1500|                             header_size, opcode);
# 1501|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def998]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:146:39: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
#  144|   
#  145|      pco_func *entry = pco_entrypoint(shader);
#  146|->    shader->data.common.entry_offset = entry->enc_offset;
#  147|   
#  148|      if (pco_should_print_binary(shader))

Error: GCC_ANALYZER_WARNING (CWE-476): [#def999]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:37:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:26:6: enter_function: entry to ‘pco_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:31:28: call_function: inlined call to ‘pco_last_instr’ from ‘pco_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:34:7: call_function: inlined call to ‘pco_cursor_after_block’ from ‘pco_end’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:36:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:37:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_end.c:37:11: danger: dereference of NULL ‘<unknown>’
#   35|   
#   36|      if (shader->stage == MESA_SHADER_VERTEX) {
#   37|->       if (last_instr->op == PCO_OP_UVSW_WRITE &&
#   38|             pco_instr_default_exec(last_instr) &&
#   39|             pco_instr_get_rpt(last_instr) == 1) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1000]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:116:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:95:13: enter_function: entry to ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:115:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:115:39: call_function: inlined call to ‘nir_src_num_components’ from ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:115:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:116:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:116:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:116:10: return_function: returning to ‘lower_pfo’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:116:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct pfo_state *)cb_data.stores, 1, 8)’
#  114|         /* Already in expected format. */
#  115|         if (b->shader->info.internal && nir_src_num_components(*value) == 1) {
#  116|->          util_dynarray_append(&state->stores, nir_intrinsic_instr *, intr);
#  117|            return false;
#  118|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1001]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:163:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:95:13: enter_function: entry to ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:139:45: call_function: calling ‘base_type_from_fmt’ from ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:139:45: return_function: returning to ‘lower_pfo’ from ‘base_type_from_fmt’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:146:19: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:146:19: return_function: returning to ‘lower_pfo’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:151:10: branch_true: following ‘true’ branch (when ‘format == 53’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:153:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:153:13: call_function: calling ‘_nir_build_store_output’ from ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:153:13: return_function: returning to ‘lower_pfo’ from ‘_nir_build_store_output’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:163:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘lower_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:163:10: return_function: returning to ‘lower_pfo’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_nir_pvfio.c:163:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct pfo_state *)cb_data.stores, 1, 8)’
#  161|                                .io_xfb = nir_intrinsic_io_xfb(intr),
#  162|                                .io_xfb2 = nir_intrinsic_io_xfb2(intr));
#  163|->          util_dynarray_append(&state->stores, nir_intrinsic_instr *, store);
#  164|         } else {
#  165|            unreachable();

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1002]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_opt.c:147:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_opt.c:504:6: enter_function: entry to ‘pco_opt’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_opt.c:509:16: call_function: calling ‘prep_mods’ from ‘pco_opt’
#  145|            pco_builder b = pco_builder_create(func, pco_cursor_before_instr(mod));
#  146|            pco_instr *mov = pco_mov(&b, mod->dest[0], src);
#  147|->          util_dynarray_append(&ctx->mods, pco_instr *, mov);
#  148|            pco_instr_delete(mod);
#  149|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1003]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:89:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:54:6: enter_function: entry to ‘rogue_nir_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:56:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘rogue_nir_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:56:30: return_function: returning to ‘rogue_nir_pfo’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:60:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:63:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:65:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:66:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:66:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:66:7: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘rogue_nir_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:66:7: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:67:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:67:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:76:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:76:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:80:18: call_function: inlined call to ‘nir_deref_mode_is’ from ‘rogue_nir_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:80:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:83:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:83:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:86:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:86:33: call_function: calling ‘nir_deref_instr_get_variable’ from ‘rogue_nir_pfo’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:86:33: return_function: returning to ‘rogue_nir_pfo’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/nir/rogue_nir_pfo.c:89:13: danger: dereference of NULL ‘nir_deref_instr_get_variable(instr)’
#   87|   
#   88|               deref->type = glsl_uintN_t_type(32);
#   89|->             out->type = glsl_uintN_t_type(32);
#   90|            }
#   91|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1004]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue.h:1488:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘emitpix’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/usc/pvr_uscgen.c:33:6: enter_function: entry to ‘pvr_uscgen_eot’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/usc/pvr_uscgen.c:47:4: call_function: inlined call to ‘rogue_push_block’ from ‘pvr_uscgen_eot’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/usc/pvr_uscgen.c:47:4: call_function: inlined call to ‘rogue_push_block’ from ‘pvr_uscgen_eot’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/usc/pvr_uscgen.c:49:25: branch_false: following ‘false’ branch (when ‘u >= emit_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/usc/pvr_uscgen.c:65:4: call_function: inlined call to ‘rogue_set_backend_op_mod’ from ‘pvr_uscgen_eot’
# 1486|                                               enum rogue_backend_op_mod mod)
# 1487|   {
# 1488|->    backend->mod |= BITFIELD64_BIT(mod);
# 1489|   }
# 1490|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1005]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:107:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:634:13: enter_function: entry to ‘validate_reg_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:639:41: branch_true: following ‘true’ branch (when ‘class != 11’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:641:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:642:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:646:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:646:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:648:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:648:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:652:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:652:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:656:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/rogue/rogue_validate.c:653:13: call_function: calling ‘validate_log’ from ‘validate_reg_state’
#  105|      va_start(args, fmt);
#  106|      ralloc_vasprintf_append(&msg, fmt, args);
#  107|->    util_dynarray_append(state->error_msgs, const char *, msg);
#  108|      va_end(args);
#  109|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1006]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:87:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1071:17: call_function: calling ‘pvr_pds_disassemble_instruction_add32’ from ‘pvr_pds_disassemble_instruction2’
#   85|      assert(op);
#   86|   
#   87|->    op->type = UNRESOLVED;
#   88|      instruction &= PVR_ROGUE_PDSINST_REGS32_MASK;
#   89|      switch (pvr_pds_inst_decode_field_range_regs32(instruction)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1007]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:125:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_false: following ‘false’ branch (when ‘opcode_B != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1112:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1114:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp32’ from ‘pvr_pds_disassemble_instruction2’
#  123|      case PVR_ROGUE_PDSINST_REGS32TP_TEMP32:
#  124|         op->type = TEMP32;
#  125|->       op->address = instruction - PVR_ROGUE_PDSINST_REGS32TP_TEMP32_LOWER;
#  126|         op->absolute_address = op->address;
#  127|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1008]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:129:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_false: following ‘false’ branch (when ‘opcode_B != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1112:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1114:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp32’ from ‘pvr_pds_disassemble_instruction2’
#  127|         break;
#  128|      case PVR_ROGUE_PDSINST_REGS32TP_PTEMP32:
#  129|->       op->type = PTEMP32;
#  130|         op->address = instruction - PVR_ROGUE_PDSINST_REGS32TP_PTEMP32_LOWER;
#  131|         op->absolute_address = op->address;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1009]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:153:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_false: following ‘false’ branch (when ‘opcode_B != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1112:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1114:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp32’ from ‘pvr_pds_disassemble_instruction2’
#  151|      case PVR_ROGUE_PDSINST_REGS32T_TEMP32:
#  152|         op->type = TEMP32;
#  153|->       op->address = instruction - PVR_ROGUE_PDSINST_REGS32T_TEMP32_LOWER;
#  154|         op->absolute_address = op->address;
#  155|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1010]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:172:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1065:17: call_function: calling ‘pvr_pds_disassemble_instruction_add64’ from ‘pvr_pds_disassemble_instruction2’
#  170|      assert(op);
#  171|   
#  172|->    op->type = UNRESOLVED;
#  173|      instruction &= PVR_ROGUE_PDSINST_REGS64_MASK;
#  174|      switch (pvr_pds_inst_decode_field_range_regs64(instruction)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1011]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:234:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1097:17: call_function: calling ‘pvr_pds_disassemble_instruction_ddmad’ from ‘pvr_pds_disassemble_instruction2’
#  232|      switch (pvr_rogue_pds_inst_decode_field_range_regs64c(instruction)) {
#  233|      case PVR_ROGUE_PDSINST_REGS64C_CONST64:
#  234|->       op->type = CONST64;
#  235|         op->address = instruction - PVR_ROGUE_PDSINST_REGS64C_CONST64_LOWER;
#  236|         op->absolute_address = op->address * 2;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1012]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:258:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1077:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp64’ from ‘pvr_pds_disassemble_instruction2’
#  256|      switch (pvr_pds_inst_decode_field_range_regs64tp(instruction)) {
#  257|      case PVR_ROGUE_PDSINST_REGS64TP_TEMP64:
#  258|->       op->type = TEMP64;
#  259|         op->address = instruction - PVR_ROGUE_PDSINST_REGS64TP_TEMP64_LOWER;
#  260|         op->absolute_address = op->address * 2;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1013]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:263:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘op’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1077:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp64’ from ‘pvr_pds_disassemble_instruction2’
#  261|         break;
#  262|      case PVR_ROGUE_PDSINST_REGS64TP_PTEMP64:
#  263|->       op->type = PTEMP64;
#  264|         op->address = instruction - PVR_ROGUE_PDSINST_REGS64TP_PTEMP64_LOWER;
#  265|         op->absolute_address = op->address * 2;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1014]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:293:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘add’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1065:17: call_function: calling ‘pvr_pds_disassemble_instruction_add64’ from ‘pvr_pds_disassemble_instruction2’
#  291|      add->instruction.next = NULL;
#  292|   
#  293|->    add->cc = instruction & PVR_ROGUE_PDSINST_ADD64_CC_ENABLE;
#  294|      add->alum = instruction & PVR_ROGUE_PDSINST_ADD64_ALUM_SIGNED;
#  295|      add->sna = instruction & PVR_ROGUE_PDSINST_ADD64_SNA_SUB;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1015]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:319:11: warning[-Wanalyzer-malloc-leak]: leak of ‘add’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1065:17: call_function: calling ‘pvr_pds_disassemble_instruction_add64’ from ‘pvr_pds_disassemble_instruction2’
#  317|      add->dst->instruction = &add->instruction;
#  318|   
#  319|->    return &add->instruction;
#  320|   }
#  321|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1016]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:334:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘add’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1071:17: call_function: calling ‘pvr_pds_disassemble_instruction_add32’ from ‘pvr_pds_disassemble_instruction2’
#  332|      add->instruction.next = NULL;
#  333|   
#  334|->    add->cc = instruction & PVR_ROGUE_PDSINST_ADD32_CC_ENABLE;
#  335|      add->alum = instruction & PVR_ROGUE_PDSINST_ADD32_ALUM_SIGNED;
#  336|      add->sna = instruction & PVR_ROGUE_PDSINST_ADD32_SNA_SUB;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1017]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:360:11: warning[-Wanalyzer-malloc-leak]: leak of ‘add’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1071:17: call_function: calling ‘pvr_pds_disassemble_instruction_add32’ from ‘pvr_pds_disassemble_instruction2’
#  358|      add->dst->instruction = &add->instruction;
#  359|   
#  360|->    return &add->instruction;
#  361|   }
#  362|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1018]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:375:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stm’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_true: following ‘true’ branch (when ‘opcode_B == 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1118:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1120:17: call_function: calling ‘pvr_pds_disassemble_instruction_stm’ from ‘pvr_pds_disassemble_instruction2’
#  373|      stm->instruction.type = INS_STM;
#  374|   
#  375|->    stm->cc = instruction & (1 << PVR_ROGUE_PDSINST_STM_CCS_CCS_CC_SHIFT);
#  376|      stm->ccs_global = instruction &
#  377|                        (1 << PVR_ROGUE_PDSINST_STM_CCS_CCS_GLOBAL_SHIFT);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1019]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:416:11: warning[-Wanalyzer-malloc-leak]: leak of ‘stm’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_true: following ‘true’ branch (when ‘opcode_B == 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1118:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1120:17: call_function: calling ‘pvr_pds_disassemble_instruction_stm’ from ‘pvr_pds_disassemble_instruction2’
#  414|      stm->src3->instruction = &stm->instruction;
#  415|   
#  416|->    return &stm->instruction;
#  417|   }
#  418|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1020]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:431:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_false: following ‘false’ branch (when ‘opcode_B != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1112:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1114:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp32’ from ‘pvr_pds_disassemble_instruction2’
#  429|      ins->instruction.type = INS_SFTLP32;
#  430|   
#  431|->    ins->cc = instruction & PVR_ROGUE_PDSINST_SFTLP32_CC_ENABLE;
#  432|      ins->IM = instruction & PVR_ROGUE_PDSINST_SFTLP32_IM_ENABLE;
#  433|      ins->lop = (instruction >> PVR_ROGUE_PDSINST_SFTLP32_LOP_SHIFT) &

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1021]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:465:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc(1, 40)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_false: following ‘false’ branch (when ‘opcode_B != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1112:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1114:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp32’ from ‘pvr_pds_disassemble_instruction2’
#  463|         assert(ins->src2);
#  464|   
#  465|->       ins->src2->literal = abs((cImmediate / 4));
#  466|         ins->src2->negate = cImmediate < 0;
#  467|         ins->src2->instruction = &ins->instruction;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1022]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:478:11: warning[-Wanalyzer-malloc-leak]: leak of ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1109:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1111:7: branch_false: following ‘false’ branch (when ‘opcode_B != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1112:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1114:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp32’ from ‘pvr_pds_disassemble_instruction2’
#  476|      }
#  477|   
#  478|->    return &ins->instruction;
#  479|   }
#  480|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1023]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:493:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1077:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp64’ from ‘pvr_pds_disassemble_instruction2’
#  491|      ins->instruction.type = INS_SFTLP64;
#  492|   
#  493|->    ins->cc = instruction & PVR_ROGUE_PDSINST_SFTLP64_CC_ENABLE;
#  494|      ins->IM = instruction & PVR_ROGUE_PDSINST_SFTLP64_IM_ENABLE;
#  495|      ins->lop = (instruction >> PVR_ROGUE_PDSINST_SFTLP64_LOP_SHIFT) &

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1024]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:526:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc(1, 40)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1077:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp64’ from ‘pvr_pds_disassemble_instruction2’
#  524|         assert(ins->src2);
#  525|   
#  526|->       ins->src2->literal = (abs(cImmediate) > 63) ? 63 : abs(cImmediate);
#  527|         ins->src2->negate = (cImmediate < 0);
#  528|         ins->src2->instruction = &ins->instruction;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1025]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:539:11: warning[-Wanalyzer-malloc-leak]: leak of ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1077:17: call_function: calling ‘pvr_pds_disassemble_instruction_sftlp64’ from ‘pvr_pds_disassemble_instruction2’
#  537|      }
#  538|   
#  539|->    return &ins->instruction;
#  540|   }
#  541|   static struct pvr_instruction *

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1026]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:552:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cmp’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1083:17: call_function: calling ‘pvr_pds_disassemble_instruction_cmp’ from ‘pvr_pds_disassemble_instruction2’
#  550|      cmp->instruction.next = NULL;
#  551|      cmp->instruction.type = INS_CMP;
#  552|->    cmp->cc = instruction & PVR_ROGUE_PDSINST_CMP_CC_ENABLE;
#  553|      cmp->IM = instruction & PVR_ROGUE_PDSINST_CMP_IM_ENABLE;
#  554|      cmp->cop = instruction >> PVR_ROGUE_PDSINST_CMP_COP_SHIFT &

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1027]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:570:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc(1, 40)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1083:17: call_function: calling ‘pvr_pds_disassemble_instruction_cmp’ from ‘pvr_pds_disassemble_instruction2’
#  568|         assert(cmp->src1);
#  569|   
#  570|->       cmp->src1->type = LITERAL_NUM;
#  571|         cmp->src1->literal = immediate;
#  572|      } else {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1028]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:582:11: warning[-Wanalyzer-malloc-leak]: leak of ‘cmp’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1083:17: call_function: calling ‘pvr_pds_disassemble_instruction_cmp’ from ‘pvr_pds_disassemble_instruction2’
#  580|      cmp->src1->instruction = &cmp->instruction;
#  581|   
#  582|->    return &cmp->instruction;
#  583|   }
#  584|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1029]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:599:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  597|      ins->instruction.type = ld ? INS_LD : INS_ST;
#  598|   
#  599|->    ins->cc = cc;
#  600|      ins->src0 =
#  601|         pvr_pds_disassemble_regs64(context,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1030]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:609:11: warning[-Wanalyzer-malloc-leak]: leak of ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  607|      ins->st = !ld;
#  608|   
#  609|->    return &ins->instruction;
#  610|   }
#  611|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1031]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:621:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stmc’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  619|      stmc->instruction.type = INS_STMC;
#  620|   
#  621|->    stmc->cc = cc;
#  622|      stmc->src0 = calloc(1, sizeof(*stmc->src0));
#  623|      assert(stmc->src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1032]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:625:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc(1, 40)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  623|      assert(stmc->src0);
#  624|   
#  625|->    stmc->src0->type = LITERAL_NUM;
#  626|      stmc->src0->literal = (instruction >> PVR_ROGUE_PDSINST_STMC_SOMASK_SHIFT) &
#  627|                            PVR_ROGUE_PDSINST_SOMASK_MASK;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1033]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:630:11: warning[-Wanalyzer-malloc-leak]: leak of ‘stmc’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  628|      stmc->src0->instruction = &stmc->instruction;
#  629|   
#  630|->    return &stmc->instruction;
#  631|   }
#  632|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1034]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:645:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘limm’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  643|      limm->instruction.type = INS_LIMM;
#  644|   
#  645|->    limm->cc = cc;
#  646|      limm->GR = (instruction & PVR_ROGUE_PDSINST_LIMM_GR_ENABLE) != 0;
#  647|      limm->src0 = calloc(1, sizeof(*limm->src0));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1035]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:650:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc(1, 40)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  648|      assert(limm->src0);
#  649|   
#  650|->    limm->src0->type = LITERAL_NUM;
#  651|      limm->src0->literal = (instruction >> PVR_ROGUE_PDSINST_LIMM_SRC0_SHIFT) &
#  652|                            PVR_ROGUE_PDSINST_IMM16_MASK;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1036]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:662:11: warning[-Wanalyzer-malloc-leak]: leak of ‘limm’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  660|      limm->dst->instruction = &limm->instruction;
#  661|   
#  662|->    return &limm->instruction;
#  663|   }
#  664|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1037]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:673:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1091:17: call_function: calling ‘pvr_pds_disassemble_instruction_sp’ from ‘pvr_pds_disassemble_instruction2’
#  671|      ins->instruction.next = NULL;
#  672|      ins->instruction.type = type;
#  673|->    ins->cc = cc;
#  674|   
#  675|      return &ins->instruction;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1038]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:690:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bra’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1089:17: call_function: calling ‘pvr_pds_disassemble_instruction_bra’ from ‘pvr_pds_disassemble_instruction2’
#  688|      branch_addr = (instruction >> PVR_ROGUE_PDSINST_BRA_ADDR_SHIFT) &
#  689|                    PVR_ROGUE_PDSINST_BRAADDR_MASK;
#  690|->    bra->address = (branch_addr & 0x40000U) ? ((int)branch_addr) - 0x80000
#  691|                                              : (int)branch_addr;
#  692|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1039]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:696:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc(8)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1089:17: call_function: calling ‘pvr_pds_disassemble_instruction_bra’ from ‘pvr_pds_disassemble_instruction2’
#  694|      assert(bra->srcc);
#  695|   
#  696|->    bra->srcc->predicate = (instruction >> PVR_ROGUE_PDSINST_BRA_SRCC_SHIFT) &
#  697|                             PVR_ROGUE_PDSINST_PREDICATE_MASK;
#  698|      bra->srcc->negate = instruction & PVR_ROGUE_PDSINST_BRA_NEG_ENABLE;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1040]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:703:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc(8)’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1089:17: call_function: calling ‘pvr_pds_disassemble_instruction_bra’ from ‘pvr_pds_disassemble_instruction2’
#  701|      assert(bra->setc);
#  702|   
#  703|->    bra->setc->predicate = (instruction >> PVR_ROGUE_PDSINST_BRA_SETC_SHIFT) &
#  704|                             PVR_ROGUE_PDSINST_PREDICATE_MASK;
#  705|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1041]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:708:11: warning[-Wanalyzer-malloc-leak]: leak of ‘bra’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1089:17: call_function: calling ‘pvr_pds_disassemble_instruction_bra’ from ‘pvr_pds_disassemble_instruction2’
#  706|      bra->target = NULL;
#  707|   
#  708|->    return &bra->instruction;
#  709|   }
#  710|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1042]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:785:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ddmad’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1097:17: call_function: calling ‘pvr_pds_disassemble_instruction_ddmad’ from ‘pvr_pds_disassemble_instruction2’
#  783|      ddmad->instruction.type = INS_DDMAD;
#  784|   
#  785|->    ddmad->cc = instruction & PVR_ROGUE_PDSINST_DDMAD_CC_ENABLE;
#  786|      ddmad->END = instruction & PVR_ROGUE_PDSINST_DDMAD_END_ENABLE;
#  787|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1043]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:820:11: warning[-Wanalyzer-malloc-leak]: leak of ‘ddmad’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1097:17: call_function: calling ‘pvr_pds_disassemble_instruction_ddmad’ from ‘pvr_pds_disassemble_instruction2’
#  818|      ddmad->src3->instruction = &ddmad->instruction;
#  819|   
#  820|->    return &ddmad->instruction;
#  821|   }
#  822|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1044]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:835:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mad’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1108:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1126:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1127:14: call_function: calling ‘pvr_pds_disassemble_instruction_mad’ from ‘pvr_pds_disassemble_instruction2’
#  833|      mad->instruction.type = INS_MAD;
#  834|   
#  835|->    mad->cc = instruction & PVR_ROGUE_PDSINST_MAD_CC_ENABLE;
#  836|      mad->sna = instruction & PVR_ROGUE_PDSINST_MAD_SNA_SUB;
#  837|      mad->alum = (instruction & PVR_ROGUE_PDSINST_MAD_ALUM_SIGNED);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1045]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:886:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘dout’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1103:17: call_function: calling ‘pvr_pds_disassemble_instruction_dout’ from ‘pvr_pds_disassemble_instruction2’
#  884|      dout->instruction.type = INS_DOUT;
#  885|   
#  886|->    dout->END = instruction & PVR_ROGUE_PDSINST_DOUT_END_ENABLE;
#  887|      dout->cc = instruction & PVR_ROGUE_PDSINST_DOUT_CC_ENABLE;
#  888|      dout->dst = (instruction >> PVR_ROGUE_PDSINST_DOUT_DST_SHIFT) &

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1046]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:907:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dout’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1052:1: enter_function: entry to ‘pvr_pds_disassemble_instruction2’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1059:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1060:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pds/pvr_pds_disasm.c:1103:17: call_function: calling ‘pvr_pds_disassemble_instruction_dout’ from ‘pvr_pds_disassemble_instruction2’
#  905|      dout->src1->instruction = &dout->instruction;
#  906|   
#  907|->    return &dout->instruction;
#  908|   }
#  909|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1047]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1819:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:2011:6: enter_function: entry to ‘pvr_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:2019:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:2020:58: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:2020:7: call_function: calling ‘pvr_write_descriptor_set’ from ‘pvr_UpdateDescriptorSets’
# 1817|       * can skip this update.
# 1818|       */
# 1819|->    if (binding->shader_stage_mask == 0)
# 1820|         return;
# 1821|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1048]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1911:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
# 1909|      uint32_t *dst_mem_ptr;
# 1910|   
# 1911|->    switch (src_binding->type) {
# 1912|      case VK_DESCRIPTOR_TYPE_SAMPLER:
# 1913|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1049]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1928:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1898:13: enter_function: entry to ‘pvr_copy_descriptor_set’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1904:7: call_function: calling ‘pvr_get_descriptor_binding’ from ‘pvr_copy_descriptor_set’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1904:7: return_function: returning to ‘pvr_copy_descriptor_set’ from ‘pvr_get_descriptor_binding’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_descriptor_set.c:1928:10: danger: dereference of NULL ‘pvr_get_descriptor_binding(*(struct pvr_descriptor_set *)copy_set_60(D)->dstSet.layout, *copy_set.dstBinding)’
# 1926|            src_binding->descriptor_index + copy_set->srcArrayElement;
# 1927|         const uint32_t dst_idx =
# 1928|->          dst_binding->descriptor_index + copy_set->dstArrayElement;
# 1929|   
# 1930|         for (uint32_t j = 0; j < copy_set->descriptorCount; j++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1050]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:333:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:323:6: enter_function: entry to ‘pvr_hard_code_get_idfwdf_program’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:333:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘pvr_hard_code_get_idfwdf_program’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:333:4: return_function: returning to ‘pvr_hard_code_get_idfwdf_program’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:333:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(program_out, 1, 8)’
#  331|      mesa_loge("No hard coded idfwdf program. Returning empty program.");
#  332|   
#  333|->    util_dynarray_append_mem(program_out, ARRAY_SIZE(shader), &shader[0]);
#  334|   
#  335|      *usc_shareds_out = 12U;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1051]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:348:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:339:6: enter_function: entry to ‘pvr_hard_code_get_passthrough_vertex_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:348:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘pvr_hard_code_get_passthrough_vertex_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:348:4: return_function: returning to ‘pvr_hard_code_get_passthrough_vertex_shader’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:348:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(program_out, 1, 8)’
#  346|         "No hard coded passthrough vertex shader. Returning empty shader.");
#  347|   
#  348|->    util_dynarray_append_mem(program_out, ARRAY_SIZE(shader), &shader[0]);
#  349|   };
#  350|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1052]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:358:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:352:6: enter_function: entry to ‘pvr_hard_code_get_passthrough_rta_vertex_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:358:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘pvr_hard_code_get_passthrough_rta_vertex_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:358:4: return_function: returning to ‘pvr_hard_code_get_passthrough_rta_vertex_shader’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hardcode.c:358:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(program_out, 1, 8)’
#  356|      uint32_t shader[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
#  357|   
#  358|->    util_dynarray_append_mem(program_out, ARRAY_SIZE(shader), &shader);
#  359|   
#  360|      mesa_loge("No hard coded passthrough rta vertex shader. Returning "

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1053]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1820:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1771:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1782:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1782:7: release_memory: ‘*sp_dsts.color’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1788:26: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1789:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1792:10: branch_false: following ‘false’ branch (when ‘attach_idx != 4294967295’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1795:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1801:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1820:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1820:10: release_memory: ‘*sp_dsts.color’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1820:24: release_memory: ‘*sp_dsts.color’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_hw_pass.c:1820:10: danger: dereference of NULL ‘*sp_dsts.color + (long unsigned int)i * 12’
# 1818|            }
# 1819|         } else {
# 1820|->          sp_dsts->color[i].type = USC_MRT_RESOURCE_TYPE_INVALID;
# 1821|         }
# 1822|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1054]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_query.c:412:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_query.c:363:6: enter_function: entry to ‘pvr_CmdBeginQuery’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_query.c:372:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_query.c:412:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘pvr_CmdBeginQuery’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_query.c:412:4: return_function: returning to ‘pvr_CmdBeginQuery’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_query.c:412:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&((struct pvr_cmd_buffer_state *)((char *)commandBuffer + 176))[5].query_indices, 1, 4)’
#  410|   
#  411|      /* Add the index to the list for this render. */
#  412|->    util_dynarray_append(&state->query_indices, __typeof__(query), query);
#  413|   }
#  414|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1055]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:301:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘entry_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:315:17: enter_function: entry to ‘pvr_transfer_frag_store_get_entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:327:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:329:56: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:329:56: release_memory: ‘entry_data’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:331:16: call_function: calling ‘pvr_transfer_frag_store_entry_data_create’ from ‘pvr_transfer_frag_store_get_entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:331:16: return_function: returning to ‘pvr_transfer_frag_store_get_entry’ from ‘pvr_transfer_frag_store_entry_data_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:335:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:340:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:340:15: release_memory: ‘entry_data’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:343:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/pvr_transfer_frag_store.c:344:10: call_function: inlined call to ‘pvr_transfer_frag_store_entry_data_destroy’ from ‘pvr_transfer_frag_store_get_entry’
#  299|      const struct pvr_transfer_frag_store_entry_data *entry_data)
#  300|   {
#  301|->    pvr_bo_free(device, entry_data->kick_usc_pds_upload);
#  302|      pvr_bo_suballoc_free(entry_data->usc_upload);
#  303|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1056]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:197:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:166:10: enter_function: entry to ‘pvr_drm_winsys_compute_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:192:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:196:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:197:20: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_compute_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:197:20: danger: dereference of NULL ‘<unknown>’
#  195|         assert(!(sync->flags & VK_SYNC_IS_TIMELINE));
#  196|         sync_ops[job_args.sync_ops.count++] = (struct drm_pvr_sync_op){
#  197|->          .handle = vk_sync_as_drm_syncobj(sync)->syncobj,
#  198|            .flags = DRM_PVR_SYNC_OP_FLAG_WAIT |
#  199|                     DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1057]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:207:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:166:10: enter_function: entry to ‘pvr_drm_winsys_compute_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:204:7: branch_true: following ‘true’ branch (when ‘signal_sync’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:206:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:207:20: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_compute_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_compute.c:207:20: danger: dereference of NULL ‘<unknown>’
#  205|         assert(!(signal_sync->flags & VK_SYNC_IS_TIMELINE));
#  206|         sync_ops[job_args.sync_ops.count++] = (struct drm_pvr_sync_op){
#  207|->          .handle = vk_sync_as_drm_syncobj(signal_sync)->syncobj,
#  208|            .flags = DRM_PVR_SYNC_OP_FLAG_SIGNAL |
#  209|                     DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1058]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:55:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:41:10: enter_function: entry to ‘pvr_drm_winsys_null_job_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:51:7: branch_true: following ‘true’ branch (when ‘wait_count == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:52:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:58:32: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_null_job_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:55:13: danger: dereference of NULL ‘<unknown>’
#   53|         struct vk_sync *dst_sync = signal_sync->sync;
#   54|   
#   55|->       ret = drmSyncobjTransfer(drm_ws->base.render_fd,
#   56|                                  vk_sync_as_drm_syncobj(dst_sync)->syncobj,
#   57|                                  signal_sync->signal_value,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1059]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:89:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:41:10: enter_function: entry to ‘pvr_drm_winsys_null_job_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:51:7: branch_false: following ‘false’ branch (when ‘wait_count != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:72:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:75:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:83:25: branch_true: following ‘true’ branch (when ‘i < wait_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:84:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:86:10: branch_false: following ‘false’ branch (when ‘src_sync’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:89:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:92:32: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_null_job_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:89:13: danger: dereference of NULL ‘<unknown>’
#   87|            continue;
#   88|   
#   89|->       ret = drmSyncobjTransfer(drm_ws->base.render_fd,
#   90|                                  tmp_syncobj,
#   91|                                  i + 1,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1060]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:106:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:41:10: enter_function: entry to ‘pvr_drm_winsys_null_job_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:51:7: branch_false: following ‘false’ branch (when ‘wait_count != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:72:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:75:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:107:29: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_null_job_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_null.c:106:10: danger: dereference of NULL ‘<unknown>’
#  104|      }
#  105|   
#  106|->    ret = drmSyncobjTransfer(drm_ws->base.render_fd,
#  107|                               vk_sync_as_drm_syncobj(signal_sync->sync)->syncobj,
#  108|                               signal_sync->signal_value,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1061]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:526:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:463:10: enter_function: entry to ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:521:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:526:20: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:526:20: danger: dereference of NULL ‘<unknown>’
#  524|         assert(!(sync->flags & VK_SYNC_IS_TIMELINE));
#  525|         geom_sync_ops[num_geom_syncs++] = (struct drm_pvr_sync_op){
#  526|->          .handle = vk_sync_as_drm_syncobj(sync)->syncobj,
#  527|            .flags = DRM_PVR_SYNC_OP_FLAG_WAIT |
#  528|                     DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1062]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:536:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:463:10: enter_function: entry to ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:533:7: branch_true: following ‘true’ branch (when ‘signal_sync_geom’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:535:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:536:20: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:536:20: danger: dereference of NULL ‘<unknown>’
#  534|         assert(!(signal_sync_geom->flags & VK_SYNC_IS_TIMELINE));
#  535|         geom_sync_ops[num_geom_syncs++] = (struct drm_pvr_sync_op){
#  536|->          .handle = vk_sync_as_drm_syncobj(signal_sync_geom)->syncobj,
#  537|            .flags = DRM_PVR_SYNC_OP_FLAG_SIGNAL |
#  538|                     DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1063]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:597:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:463:10: enter_function: entry to ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:568:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:569:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:592:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:597:23: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:597:23: danger: dereference of NULL ‘<unknown>’
#  595|            assert(!(sync->flags & VK_SYNC_IS_TIMELINE));
#  596|            frag_sync_ops[num_frag_syncs++] = (struct drm_pvr_sync_op){
#  597|->             .handle = vk_sync_as_drm_syncobj(sync)->syncobj,
#  598|               .flags = DRM_PVR_SYNC_OP_FLAG_WAIT |
#  599|                        DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1064]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:607:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:463:10: enter_function: entry to ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:568:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:569:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:604:10: branch_true: following ‘true’ branch (when ‘signal_sync_frag’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:606:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:607:23: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_render_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_render.c:607:23: danger: dereference of NULL ‘<unknown>’
#  605|            assert(!(signal_sync_frag->flags & VK_SYNC_IS_TIMELINE));
#  606|            frag_sync_ops[num_frag_syncs++] = (struct drm_pvr_sync_op){
#  607|->             .handle = vk_sync_as_drm_syncobj(signal_sync_frag)->syncobj,
#  608|               .flags = DRM_PVR_SYNC_OP_FLAG_SIGNAL |
#  609|                        DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1065]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:158:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:126:10: enter_function: entry to ‘pvr_drm_winsys_transfer_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:153:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:157:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:158:20: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_transfer_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:158:20: danger: dereference of NULL ‘<unknown>’
#  156|         assert(!(sync->flags & VK_SYNC_IS_TIMELINE));
#  157|         sync_ops[job_args.sync_ops.count++] = (struct drm_pvr_sync_op){
#  158|->          .handle = vk_sync_as_drm_syncobj(sync)->syncobj,
#  159|            .flags = DRM_PVR_SYNC_OP_FLAG_WAIT |
#  160|                     DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1066]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:168:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:126:10: enter_function: entry to ‘pvr_drm_winsys_transfer_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:165:7: branch_true: following ‘true’ branch (when ‘signal_sync’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:167:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:168:20: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘pvr_drm_winsys_transfer_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/powervr/pvr_drm_job_transfer.c:168:20: danger: dereference of NULL ‘<unknown>’
#  166|         assert(!(signal_sync->flags & VK_SYNC_IS_TIMELINE));
#  167|         sync_ops[job_args.sync_ops.count++] = (struct drm_pvr_sync_op){
#  168|->          .handle = vk_sync_as_drm_syncobj(signal_sync)->syncobj,
#  169|            .flags = DRM_PVR_SYNC_OP_FLAG_SIGNAL |
#  170|                     DRM_PVR_SYNC_OP_FLAG_HANDLE_TYPE_SYNCOBJ,

Error: GCC_ANALYZER_WARNING (CWE-775): [#def1067]
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:107:7: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘display_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:63:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:71:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:71:7: branch_true: following ‘true’ branch (when ‘display_path’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:72:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:72:20: acquire_resource: opened here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:73:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:84:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:85:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:92:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:92:7: branch_false: following ‘false’ branch (when the strings are non-equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:99:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:107:7: branch_false: following ‘false’ branch (when ‘result == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/vulkan/winsys/pvr_winsys.c:107:7: danger: ‘display_fd’ leaks here; was opened at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  105|      drmFreeVersion(version);
#  106|   
#  107|->    if (result != VK_SUCCESS)
#  108|         goto err_close_display_fd;
#  109|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1068]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_brw.h:1338:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘surface_offsets[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:523:1: enter_function: entry to ‘gfx9_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:542:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:543:7: call_function: inlined call to ‘blorp_exec_on_blitter’ from ‘gfx9_blorp_exec’
# 1336|   
# 1337|         if (params->dst.enabled) {
# 1338|->          blorp_emit_surface_state(batch, &params->dst,
# 1339|                                     params->fast_clear_op,
# 1340|                                     surface_maps[BLORP_RENDERBUFFER_BT_INDEX],

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1069]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_brw.h:1348:40: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘surface_maps[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:523:1: enter_function: entry to ‘gfx9_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:542:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:543:7: call_function: inlined call to ‘blorp_exec_on_blitter’ from ‘gfx9_blorp_exec’
# 1346|               params->depth.enabled ? &params->depth : &params->stencil;
# 1347|            blorp_emit_null_surface_state(batch, surface,
# 1348|->                                        surface_maps[BLORP_RENDERBUFFER_BT_INDEX]);
# 1349|         }
# 1350|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1070]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1398:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘urb_deref_block_size’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1308:1: enter_function: entry to ‘blorp_emit_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1321:30: call_function: calling ‘blorp_emit_color_calc_state’ from ‘blorp_emit_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1321:30: return_function: returning to ‘blorp_emit_pipeline’ from ‘blorp_emit_color_calc_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1322:33: call_function: calling ‘blorp_emit_depth_stencil_state’ from ‘blorp_emit_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1322:33: return_function: returning to ‘blorp_emit_pipeline’ from ‘blorp_emit_depth_stencil_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1398:4: danger: use of uninitialized value ‘urb_deref_block_size’ here
# 1396|      }
# 1397|   
# 1398|->    blorp_emit_sf_config(batch, params, urb_deref_block_size);
# 1399|      blorp_emit_ps_config(batch, params);
# 1400|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1071]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1583:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘surface_offsets[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:336:1: enter_function: entry to ‘gfx7_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:360:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:363:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:363:7: call_function: calling ‘blorp_exec_on_render’ from ‘gfx7_blorp_exec’
# 1581|   
# 1582|         if (params->dst.enabled) {
# 1583|->          blorp_emit_surface_state(batch, &params->dst,
# 1584|                                     params->fast_clear_op,
# 1585|                                     surface_maps[BLORP_RENDERBUFFER_BT_INDEX],

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1072]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/blorp/blorp_genX_exec_elk.h:1593:40: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘surface_maps[0]’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:336:1: enter_function: entry to ‘gfx7_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:360:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:361:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:361:7: call_function: calling ‘blorp_exec_on_compute’ from ‘gfx7_blorp_exec’
# 1591|               params->depth.enabled ? &params->depth : &params->stencil;
# 1592|            blorp_emit_null_surface_state(batch, surface,
# 1593|->                                        surface_maps[BLORP_RENDERBUFFER_BT_INDEX]);
# 1594|         }
# 1595|   

Error: COMPILER_WARNING: [#def1073] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/common/intel_clflushopt.c:44:7: error[-Wimplicit-function-declaration]: implicit declaration of function ‘__builtin_ia32_clflushopt’; did you mean ‘__builtin_ia32_clflush’?
#   42|   
#   43|      while (p < end) {
#   44|->       __builtin_ia32_clflushopt(p);
#   45|         p += cpu_caps->cacheline;
#   46|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1074]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/common/intel_uuid.c:69:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&shared_uuid’
#   67|      assert(sizeof(shared_uuid) == 16);
#   68|   
#   69|->    memcpy(uuid, &shared_uuid, size);
#   70|   }
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1075]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:721:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:709:1: enter_function: entry to ‘brw_num_sources_from_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:714:7: call_function: inlined call to ‘brw_opcode_desc’ from ‘brw_num_sources_from_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:717:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:717:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:721:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu.c:721:14: danger: dereference of NULL ‘<unknown>’
#  719|      } else {
#  720|         assert(desc->nsrc < 4);
#  721|->       return desc->nsrc;
#  722|      }
#  723|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def1076]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2226:8: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2331:1: enter_function: entry to ‘brw_compact_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2404:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2406:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2414:10: call_function: calling ‘update_uip_jip’ from ‘brw_compact_instructions’
# 2224|   compacted_between(int old_ip, int old_target_ip, int *compacted_counts)
# 2225|   {
# 2226|->    int this_compacted_count = compacted_counts[old_ip];
# 2227|      int target_compacted_count = compacted_counts[old_target_ip];
# 2228|      return target_compacted_count - this_compacted_count;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1077]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2366:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘old_ip’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2354:18: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2363:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2366:7: danger: ‘old_ip + ((sizetype)offset >> 3) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 2364|         void *dst = store + offset;
# 2365|   
# 2366|->       old_ip[offset / sizeof(brw_eu_compact_inst)] = src_offset / sizeof(brw_eu_inst);
# 2367|         compacted_counts[src_offset / sizeof(brw_eu_inst)] = compacted_count;
# 2368|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1078]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2367:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘compacted_counts’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2347:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2363:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2367:7: danger: ‘compacted_counts + ((sizetype)src_offset >> 4) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
# 2365|   
# 2366|         old_ip[offset / sizeof(brw_eu_compact_inst)] = src_offset / sizeof(brw_eu_inst);
# 2367|->       compacted_counts[src_offset / sizeof(brw_eu_inst)] = compacted_count;
# 2368|   
# 2369|         brw_eu_inst inst = precompact(p->isa, *src);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1079]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘old_ip’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2354:18: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: danger: ‘old_ip + ((long unsigned int)offset >> 3) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
# 2397|       * simplifies the linked list walk at the end of the function.
# 2398|       */
# 2399|->    old_ip[offset / sizeof(brw_eu_compact_inst)] =
# 2400|         (p->next_insn_offset - start_offset) / sizeof(brw_eu_inst);
# 2401|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def1080]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2408:11: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2404:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2406:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2408:11: danger: read of 4 bytes at offset ‘(long unsigned int)(int)(*p.next_insn_offset - (unsigned int)start_offset >> 4) * 4’ exceeds the buffer
# 2406|         brw_eu_inst *insn = store + offset;
# 2407|         int this_old_ip = old_ip[offset / sizeof(brw_eu_compact_inst)];
# 2408|->       int this_compacted_count = compacted_counts[this_old_ip];
# 2409|   
# 2410|         switch (brw_eu_inst_opcode(p->isa, insn)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1081]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:248:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:180:1: enter_function: entry to ‘brw_nir_analyze_ubo_ranges’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘brw_nir_analyze_ubo_ranges’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:193:4: return_function: returning to ‘brw_nir_analyze_ubo_ranges’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:193:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:203:4: call_function: inlined call to ‘util_dynarray_init’ from ‘brw_nir_analyze_ubo_ranges’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:205:4: branch_true: following ‘true’ branch (when ‘entry’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:206:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:218:14: branch_true: following ‘true’ branch (when ‘offsets != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:222:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:242:13: call_function: calling ‘util_dynarray_grow_bytes’ from ‘brw_nir_analyze_ubo_ranges’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:242:13: return_function: returning to ‘brw_nir_analyze_ubo_ranges’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_analyze_ubo_ranges.c:248:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&ranges, 1, 8)’
#  246|            /* first_hole is one beyond the end, so we don't need to add 1 */
#  247|            entry->range.length = first_hole - first_bit;
#  248|->          entry->benefit = 0;
#  249|   
#  250|            for (int i = 0; i < entry->range.length; i++)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1082]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:246:54: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:551:1: enter_function: entry to ‘lower_cmat_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:555:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:561:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_cooperative_matrix.c:564:7: call_function: calling ‘lower_cmat_load_store’ from ‘lower_cmat_instr’
#  244|   
#  245|      nir_deref_instr *pointer = nir_src_as_deref(intrin->src[ptr_src]);
#  246|->    const unsigned ptr_comp_width = glsl_get_bit_size(pointer->type);
#  247|      const unsigned ptr_num_comps = glsl_get_vector_elements(pointer->type);
#  248|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1083]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:53:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:149:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:157:7: branch_true: following ‘true’ branch (when ‘any_hit’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:158:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:160:22: call_function: calling ‘lower_any_hit_for_intersection’ from ‘brw_nir_lower_intersection_shader’
#   51|         },
#   52|      };
#   53|->    impl->function->num_params = ARRAY_SIZE(params);
#   54|      impl->function->params =
#   55|         ralloc_array(any_hit, nir_parameter, ARRAY_SIZE(params));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1084]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:175:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:149:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:157:7: branch_true: following ‘true’ branch (when ‘any_hit’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:158:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:160:22: call_function: calling ‘lower_any_hit_for_intersection’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:160:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘lower_any_hit_for_intersection’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:164:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:164:30: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:166:24: call_function: calling ‘nir_before_impl’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:166:24: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:169:22: call_function: calling ‘brw_nir_rt_mem_hit_addr’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:169:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘brw_nir_rt_mem_hit_addr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:175:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(intersection)’
#  173|   
#  174|      assert(impl->end_block->predecessors->entries == 1);
#  175|->    set_foreach(impl->end_block->predecessors, block_entry) {
#  176|         struct nir_block *block = (void *)block_entry->key;
#  177|         b->cursor = nir_after_block_before_jump(block);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1085]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:175:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘any_hit_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:149:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:157:7: branch_false: following ‘false’ branch (when ‘any_hit’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:164:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:164:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:164:30: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:166:24: call_function: calling ‘nir_before_impl’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:166:24: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_before_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:169:22: call_function: calling ‘brw_nir_rt_mem_hit_addr’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:169:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘brw_nir_rt_mem_hit_addr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_intersection_shader.c:175:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(intersection)’
#  173|   
#  174|      assert(impl->end_block->predecessors->entries == 1);
#  175|->    set_foreach(impl->end_block->predecessors, block_entry) {
#  176|         struct nir_block *block = (void *)block_entry->key;
#  177|         b->cursor = nir_after_block_before_jump(block);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1086]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_storage_image.c:210:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_storage_image.c:331:1: enter_function: entry to ‘brw_nir_lower_storage_image_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_storage_image.c:342:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_storage_image.c:343:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_lower_storage_image.c:343:17: call_function: calling ‘lower_image_load_instr’ from ‘brw_nir_lower_storage_image_instr’
#  208|   
#  209|      nir_def_rewrite_uses(placeholder, color);
#  210|->    nir_instr_remove(placeholder->parent_instr);
#  211|   
#  212|      return true;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1087]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:807:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:778:1: enter_function: entry to ‘elk_num_sources_from_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:783:7: call_function: inlined call to ‘elk_inst_opcode’ from ‘elk_num_sources_from_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:783:7: call_function: inlined call to ‘elk_opcode_desc’ from ‘elk_num_sources_from_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:786:8: call_function: inlined call to ‘elk_inst_opcode’ from ‘elk_num_sources_from_inst’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:786:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:788:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu.c:807:14: danger: dereference of NULL ‘<unknown>’
#  805|      } else {
#  806|         assert(desc->nsrc < 4);
#  807|->       return desc->nsrc;
#  808|      }
#  809|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def1088]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1782:8: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1921:1: enter_function: entry to ‘elk_compact_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1924:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1927:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1953:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2007:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2012:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2014:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2022:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2023:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2023:13: call_function: calling ‘update_uip_jip’ from ‘elk_compact_instructions’
# 1780|   compacted_between(int old_ip, int old_target_ip, int *compacted_counts)
# 1781|   {
# 1782|->    int this_compacted_count = compacted_counts[old_ip];
# 1783|      int target_compacted_count = compacted_counts[old_target_ip];
# 1784|      return target_compacted_count - this_compacted_count;

Error: GCC_ANALYZER_WARNING (CWE-122): [#def1089]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1841:8: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1921:1: enter_function: entry to ‘elk_compact_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1924:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1927:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1953:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2007:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2012:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2014:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2022:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2025:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2025:13: call_function: calling ‘update_gfx4_jump_count’ from ‘elk_compact_instructions’
# 1839|      int target_old_ip = this_old_ip + (jump_count_compacted / 2);
# 1840|   
# 1841|->    int this_compacted_count = compacted_counts[this_old_ip];
# 1842|      int target_compacted_count = compacted_counts[target_old_ip];
# 1843|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1090]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1958:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘old_ip’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1924:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1927:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1946:18: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1953:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1955:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1958:7: danger: ‘old_ip + ((sizetype)offset >> 3) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
# 1956|         void *dst = store + offset;
# 1957|   
# 1958|->       old_ip[offset / sizeof(elk_compact_inst)] = src_offset / sizeof(elk_inst);
# 1959|         compacted_counts[src_offset / sizeof(elk_inst)] = compacted_count;
# 1960|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1091]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1959:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘compacted_counts’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1924:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1927:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1939:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1953:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1955:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1959:7: danger: ‘compacted_counts + ((sizetype)src_offset >> 4) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
# 1957|   
# 1958|         old_ip[offset / sizeof(elk_compact_inst)] = src_offset / sizeof(elk_inst);
# 1959|->       compacted_counts[src_offset / sizeof(elk_inst)] = compacted_count;
# 1960|   
# 1961|         elk_inst inst = precompact(p->isa, *src);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1092]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2007:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘old_ip’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1924:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1927:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1946:18: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1953:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2007:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2007:4: danger: ‘old_ip + ((long unsigned int)offset >> 3) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
# 2005|       * simplifies the linked list walk at the end of the function.
# 2006|       */
# 2007|->    old_ip[offset / sizeof(elk_compact_inst)] =
# 2008|         (p->next_insn_offset - start_offset) / sizeof(elk_inst);
# 2009|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def1093]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2016:11: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1924:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1927:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:1953:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2007:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2012:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2014:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_compact.c:2016:11: danger: read of 4 bytes at offset ‘(long unsigned int)(int)(*p.next_insn_offset - (unsigned int)start_offset >> 4) * 4’ exceeds the buffer
# 2014|         elk_inst *insn = store + offset;
# 2015|         int this_old_ip = old_ip[offset / sizeof(elk_compact_inst)];
# 2016|->       int this_compacted_count = compacted_counts[this_old_ip];
# 2017|   
# 2018|         switch (elk_inst_opcode(p->isa, insn)) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1094]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_validate.c:54:4: warning[-Wanalyzer-malloc-leak]: leak of ‘error_msg.str’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_validate.c:2306:1: enter_function: entry to ‘elk_validate_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_validate.c:2313:40: branch_true: following ‘true’ branch (when ‘src_offset < end_offset’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_validate.c:2314:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_eu_validate.c:2326:16: call_function: calling ‘elk_validate_instruction’ from ‘elk_validate_instructions’
#   52|   cat(struct string *dest, const struct string src)
#   53|   {
#   54|->    dest->str = realloc(dest->str, dest->len + src.len + 1);
#   55|      memcpy(dest->str + dest->len, src.str, src.len);
#   56|      dest->str[dest->len + src.len] = '\0';

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1095]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_nir_lower_storage_image.c:416:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_nir_lower_storage_image.c:704:1: enter_function: entry to ‘elk_nir_lower_storage_image_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_nir_lower_storage_image.c:715:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_nir_lower_storage_image.c:716:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_nir_lower_storage_image.c:716:17: call_function: calling ‘lower_image_load_instr’ from ‘elk_nir_lower_storage_image_instr’
#  414|   
#  415|         nir_def_rewrite_uses(placeholder, color);
#  416|->       nir_instr_remove(placeholder->parent_instr);
#  417|      } else {
#  418|         /* This code part is only useful prior to Gfx9, we do not have plans to

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1096]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:330:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘table’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:321:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:323:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:323:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:325:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:325:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:329:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:329:34: branch_true: following ‘true’ branch (when ‘i != 15’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:330:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:330:16: release_memory: ‘table’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_reg_type.c:330:11: danger: dereference of NULL ‘table + (long unsigned int)i * 8’
#  328|   
#  329|      for (enum elk_reg_type i = 0; i <= ELK_REGISTER_TYPE_LAST; i++) {
#  330|->       if (table[i].reg_type == hw_type) {
#  331|            return i;
#  332|         }

Error: GCC_ANALYZER_WARNING (CWE-787): [#def1097]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_vue_map.c:297:11: warning[-Wanalyzer-out-of-bounds]: buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_vue_map.c:286:4: branch_false: following ‘false’ branch (when ‘slot <= 66’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_vue_map.c:288:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_vue_map.c:288:7: branch_false: following ‘false’ branch (when ‘slot > 63’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_vue_map.c:297:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/elk/elk_vue_map.c:297:11: danger: read of 8 bytes at offset ‘slot * 8 + 34359737856’ exceeds ‘elk_names’
#  295|      };
#  296|   
#  297|->    return elk_names[slot - VARYING_SLOT_MAX];
#  298|   }
#  299|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1098]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_clamp_image_1d_2d_array_sizes.c:64:42: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_clamp_image_1d_2d_array_sizes.c:137:1: enter_function: entry to ‘intel_nir_clamp_image_1d_2d_array_sizes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_clamp_image_1d_2d_array_sizes.c:139:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘intel_nir_clamp_image_1d_2d_array_sizes’
#   62|            assert(glsl_type_is_image(deref->type));
#   63|   
#   64|->          if (!glsl_sampler_type_is_array(deref->type))
#   65|               break;
#   66|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1099]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:45:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:37:1: enter_function: entry to ‘add_src_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:45:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘add_src_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:45:4: return_function: returning to ‘add_src_instr’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:45:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(state, 1, 8)’
#   43|      }
#   44|   
#   45|->    util_dynarray_append(inst_array, nir_instr *, src->ssa->parent_instr);
#   46|   
#   47|      return true;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1100]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:60:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:219:1: enter_function: entry to ‘intel_nir_lower_non_uniform_resource_intel’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_lower_non_uniform_resource_intel.c:226:15: call_function: calling ‘nir_shader_instructions_pass’ from ‘intel_nir_lower_non_uniform_resource_intel’
#   58|         return NULL;
#   59|   
#   60|->    util_dynarray_append(inst_array, nir_instr *, def->parent_instr);
#   61|   
#   62|      unsigned idx = 0, scan_index = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1101]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1595:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1585:1: enter_function: entry to ‘intel_print_accumulated_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1588:4: call_function: inlined call to ‘util_dynarray_init’ from ‘intel_print_accumulated_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1590:4: branch_true: following ‘true’ branch (when ‘entry’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1592:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1595:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘intel_print_accumulated_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1595:7: return_function: returning to ‘intel_print_accumulated_instrs’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1595:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&arr, 1, 16)’
# 1593|            .ptr  = entry->data,
# 1594|         };
# 1595|->       util_dynarray_append(&arr, struct inst_ptr, inst);
# 1596|      }
# 1597|      qsort(util_dynarray_begin(&arr),

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1102]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1597:4: warning[-Wanalyzer-null-argument]: use of NULL ‘arr.mem_ctx’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1585:1: enter_function: entry to ‘intel_print_accumulated_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1588:4: call_function: inlined call to ‘util_dynarray_init’ from ‘intel_print_accumulated_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1590:4: branch_false: following ‘false’ branch (when ‘entry’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1598:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1597:4: release_memory: ‘arr.mem_ctx’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1597:4: danger: argument 1 (‘arr.data’) NULL where non-null expected
# 1595|         util_dynarray_append(&arr, struct inst_ptr, inst);
# 1596|      }
# 1597|->    qsort(util_dynarray_begin(&arr),
# 1598|            util_dynarray_num_elements(&arr, struct inst_ptr),
# 1599|            sizeof(struct inst_ptr),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1103]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1897:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1887:1: enter_function: entry to ‘intel_batch_print_stats’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1890:4: call_function: inlined call to ‘util_dynarray_init’ from ‘intel_batch_print_stats’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1892:4: branch_true: following ‘true’ branch (when ‘entry’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1894:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1897:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘intel_batch_print_stats’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1897:7: return_function: returning to ‘intel_batch_print_stats’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1897:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&arr, 1, 16)’
# 1895|            .count = (uintptr_t)entry->data,
# 1896|         };
# 1897|->       util_dynarray_append(&arr, struct inst_stat, inst);
# 1898|      }
# 1899|      qsort(util_dynarray_begin(&arr),

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1104]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1899:4: warning[-Wanalyzer-null-argument]: use of NULL ‘arr.mem_ctx’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1887:1: enter_function: entry to ‘intel_batch_print_stats’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1890:4: call_function: inlined call to ‘util_dynarray_init’ from ‘intel_batch_print_stats’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1892:4: branch_false: following ‘false’ branch (when ‘entry’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1900:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1899:4: release_memory: ‘arr.mem_ctx’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_batch_decoder.c:1899:4: danger: argument 1 (‘arr.data’) NULL where non-null expected
# 1897|         util_dynarray_append(&arr, struct inst_stat, inst);
# 1898|      }
# 1899|->    qsort(util_dynarray_begin(&arr),
# 1900|            util_dynarray_num_elements(&arr, struct inst_stat),
# 1901|            sizeof(struct inst_stat),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1105]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_decoder.c:1257:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_decoder.c:1460:1: enter_function: entry to ‘intel_print_group’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/decoder/intel_decoder.c:1467:4: call_function: calling ‘intel_print_group_custom_spacing’ from ‘intel_print_group’
# 1255|      } v;
# 1256|   
# 1257|->    if (iter->field->name)
# 1258|         snprintf(iter->name, sizeof(iter->name), "%s", iter->field->name);
# 1259|      else

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1106]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:1516:18: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘logical_el.<Ub000>.w’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4638:1: enter_function: entry to ‘isl_tiling_get_intratile_offset_el’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4655:7: branch_false: following ‘false’ branch (when ‘tiling != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4669:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4669:4: call_function: calling ‘isl_tiling_get_info’ from ‘isl_tiling_get_intratile_offset_el’
# 1514|         }
# 1515|   
# 1516|->       phys_B.w = logical_el.w * bs;
# 1517|         phys_B.h = 64 * 1024 / phys_B.w;
# 1518|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1107]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2497:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2492:1: enter_function: entry to ‘isl_drm_modifier_has_aux’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2494:7: branch_false: following ‘false’ branch (when ‘modifier != 72057594037927935’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2497:11: call_function: inlined call to ‘isl_drm_modifier_get_info’ from ‘isl_drm_modifier_has_aux’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2497:11: danger: dereference of NULL ‘<unknown>’
# 2495|         return false;
# 2496|   
# 2497|->    return isl_drm_modifier_get_info(modifier)->supports_render_compression ||
# 2498|             isl_drm_modifier_get_info(modifier)->supports_media_compression;
# 2499|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1108]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2498:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2492:1: enter_function: entry to ‘isl_drm_modifier_has_aux’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2494:7: branch_false: following ‘false’ branch (when ‘modifier != 72057594037927935’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2497:11: call_function: inlined call to ‘isl_drm_modifier_get_info’ from ‘isl_drm_modifier_has_aux’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2497:11: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2498:11: call_function: inlined call to ‘isl_drm_modifier_get_info’ from ‘isl_drm_modifier_has_aux’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.h:2498:11: danger: dereference of NULL ‘<unknown>’
# 2496|   
# 2497|      return isl_drm_modifier_get_info(modifier)->supports_render_compression ||
# 2498|->           isl_drm_modifier_get_info(modifier)->supports_media_compression;
# 2499|   }
# 2500|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1109]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:298:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:284:1: enter_function: entry to ‘isl_drm_modifier_get_plane_count’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:297:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:298:11: call_function: inlined call to ‘isl_drm_modifier_get_info’ from ‘isl_drm_modifier_get_plane_count’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:298:11: danger: dereference of NULL ‘<unknown>’
#  296|   
#  297|      if (devinfo->has_flat_ccs) {
#  298|->       if (isl_drm_modifier_get_info(modifier)->supports_clear_color)
#  299|            return 2 * fmt_planes;
#  300|         else

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1110]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:303:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:284:1: enter_function: entry to ‘isl_drm_modifier_get_plane_count’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:297:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:303:11: call_function: inlined call to ‘isl_drm_modifier_get_info’ from ‘isl_drm_modifier_get_plane_count’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_drm.c:303:11: danger: dereference of NULL ‘<unknown>’
#  301|            return 1 * fmt_planes;
#  302|      } else {
#  303|->       if (isl_drm_modifier_get_info(modifier)->supports_clear_color)
#  304|            return 3 * fmt_planes;
#  305|         else if (isl_drm_modifier_has_aux(modifier))

Error: COMPILER_WARNING: [#def1111] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_tiled_memcpy.c:1309:21: error[-Wimplicit-function-declaration]: implicit declaration of function ‘_mm_stream_load_si128’; did you mean ‘_mm_stream_si128’?
# 1307|   {
# 1308|      if (count == 16) {
# 1309|->       __m128i val = _mm_stream_load_si128((__m128i *)src);
# 1310|         _mm_storeu_si128((__m128i *)dest, val);
# 1311|         return dest;

Error: COMPILER_WARNING: [#def1112] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_tiled_memcpy.c:1309:21: error[error]: incompatible types when initializing type ‘__m128i’ using type ‘int’
# 1307|   {
# 1308|      if (count == 16) {
# 1309|->       __m128i val = _mm_stream_load_si128((__m128i *)src);
# 1310|         _mm_storeu_si128((__m128i *)dest, val);
# 1311|         return dest;

Error: COMPILER_WARNING: [#def1113] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_tiled_memcpy.c:1313:22: error[error]: incompatible types when initializing type ‘__m128i’ using type ‘int’
# 1311|         return dest;
# 1312|      } else if (count == 64) {
# 1313|->       __m128i val0 = _mm_stream_load_si128(((__m128i *)src) + 0);
# 1314|         __m128i val1 = _mm_stream_load_si128(((__m128i *)src) + 1);
# 1315|         __m128i val2 = _mm_stream_load_si128(((__m128i *)src) + 2);

Error: COMPILER_WARNING: [#def1114] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_tiled_memcpy.c:1314:22: error[error]: incompatible types when initializing type ‘__m128i’ using type ‘int’
# 1312|      } else if (count == 64) {
# 1313|         __m128i val0 = _mm_stream_load_si128(((__m128i *)src) + 0);
# 1314|->       __m128i val1 = _mm_stream_load_si128(((__m128i *)src) + 1);
# 1315|         __m128i val2 = _mm_stream_load_si128(((__m128i *)src) + 2);
# 1316|         __m128i val3 = _mm_stream_load_si128(((__m128i *)src) + 3);

Error: COMPILER_WARNING: [#def1115] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_tiled_memcpy.c:1315:22: error[error]: incompatible types when initializing type ‘__m128i’ using type ‘int’
# 1313|         __m128i val0 = _mm_stream_load_si128(((__m128i *)src) + 0);
# 1314|         __m128i val1 = _mm_stream_load_si128(((__m128i *)src) + 1);
# 1315|->       __m128i val2 = _mm_stream_load_si128(((__m128i *)src) + 2);
# 1316|         __m128i val3 = _mm_stream_load_si128(((__m128i *)src) + 3);
# 1317|         _mm_storeu_si128(((__m128i *)dest) + 0, val0);

Error: COMPILER_WARNING: [#def1116] [important]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl_tiled_memcpy.c:1316:22: error[error]: incompatible types when initializing type ‘__m128i’ using type ‘int’
# 1314|         __m128i val1 = _mm_stream_load_si128(((__m128i *)src) + 1);
# 1315|         __m128i val2 = _mm_stream_load_si128(((__m128i *)src) + 2);
# 1316|->       __m128i val3 = _mm_stream_load_si128(((__m128i *)src) + 3);
# 1317|         _mm_storeu_si128(((__m128i *)dest) + 0, val0);
# 1318|         _mm_storeu_si128(((__m128i *)dest) + 1, val1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1117]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/intel_perf.c:742:4: warning[-Wanalyzer-jump-through-null]: jump through null pointer
#  740|       * the kernel is advertising.
#  741|       */
#  742|->    oa_register(perf);
#  743|   
#  744|      if (!INTEL_DEBUG(DEBUG_NO_OACONFIG)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1118]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/intel_perf_query.c:968:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/intel_perf_query.c:959:1: enter_function: entry to ‘read_oa_samples_until’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/intel_perf_query.c:964:7: call_function: inlined call to ‘exec_list_get_tail’ from ‘read_oa_samples_until’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/intel_perf_query.c:968:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/intel_perf_query.c:968:7: danger: dereference of NULL ‘<unknown>’
#  966|         exec_node_data(struct oa_sample_buf, tail_node, link);
#  967|      uint32_t last_timestamp =
#  968|->       tail_buf->len == 0 ? start_timestamp : tail_buf->last_timestamp;
#  969|      bool sample_read = false;
#  970|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1119]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:509:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stall_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:498:25: branch_true: following ‘true’ branch (when ‘offset < end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:502:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:505:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:508:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:508:25: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:509:10: danger: ‘stall_result’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  507|         } else {
#  508|            stall_result = calloc(1, sizeof(struct intel_perf_query_eustall_event));
#  509|->          stall_result->ip_addr = ip_addr;
#  510|            _mesa_hash_table_insert(result->accumulator,
#  511|                                    (const void*)&stall_result->ip_addr,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1120]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:482:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:941:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:946:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
#  480|      assert((offset - bo_offset) + size <= bo->size);
#  481|   
#  482|->    return bo->map + (offset - bo_offset);
#  483|   }
#  484|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1121]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:770:35: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘st_idx’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:941:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:946:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
#  768|      for (int i = 0; i < count; i++) {
#  769|         /* update states that were added back to the state table */
#  770|->       struct anv_state *state_i = anv_state_table_get(&pool->table,
#  771|                                                         st_idx + i);
#  772|         state_i->alloc_size = block_size;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1122]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:784:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘st_idx’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:941:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_allocator.c:946:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
#  782|         return;
#  783|   
#  784|->    anv_free_list_push(&pool->buckets[block_bucket].free_list,
#  785|                         &pool->table, st_idx, count);
#  786|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1123]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:382:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:595:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:603:25: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:610:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:613:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:616:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:617:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:617:7: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:617:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’
#  380|   {
#  381|      anv_reloc_list_finish(&bbo->relocs);
#  382|->    ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);
#  383|      anv_bo_pool_free(&cmd_buffer->device->batch_bo_pool, bbo->bo);
#  384|      vk_free(&cmd_buffer->vk.pool->alloc, bbo);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1124]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:502:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:554:1: enter_function: entry to ‘anv_cmd_buffer_chain_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:562:25: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:573:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:576:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:579:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:583:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:583:4: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:583:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:585:4: call_function: calling ‘cmd_buffer_chain_to_batch_bo’ from ‘anv_cmd_buffer_chain_batch’
#  500|      assert(batch->end == current_bbo->bo->map + current_bbo->bo->size);
#  501|   
#  502|->    emit_batch_buffer_start(batch, bbo->bo, 0);
#  503|   
#  504|      anv_batch_bo_finish(current_bbo, batch);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1125]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1506:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo_signals’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1500:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1500:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1500:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1502:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1503:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1503:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1506:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1506:7: danger: ‘bo_signals + (long unsigned int)bo_signal_count * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/2)
# 1504|            continue;
# 1505|   
# 1506|->       bo_signals[bo_signal_count++] =
# 1507|            container_of(submit->signals[i].sync, struct anv_bo_sync, sync);
# 1508|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1126]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1587:11: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘result’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1510:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1523:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1529:28: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1566:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1566:25: branch_false: following ‘false’ branch (when ‘bo_signal_count <= i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1583:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1586:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1587:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1587:11: danger: use of uninitialized value ‘result’ here
# 1585|    fail:
# 1586|      STACK_ARRAY_FINISH(bo_signals);
# 1587|->    return result;
# 1588|   }
# 1589|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1127]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1700:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1681:1: enter_function: entry to ‘anv_async_submit_extend_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1697:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1700:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1700:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘anv_async_submit_extend_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1700:4: return_function: returning to ‘anv_async_submit_extend_batch’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:1700:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct anv_async_submit *)user_data.batch_bos, 1, 8)’
# 1698|         return result;
# 1699|   
# 1700|->    util_dynarray_append(&submit->batch_bos, struct anv_bo *, bo);
# 1701|   
# 1702|      batch->end += 4 * GFX9_MI_BATCH_BUFFER_START_length;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1128]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2248:13: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2810:1: enter_function: entry to ‘anv_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2815:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2819:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2825:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2827:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_descriptor_set.c:2828:13: call_function: calling ‘anv_descriptor_set_write_image_view’ from ‘anv_descriptor_set_write_template’
# 2246|         if (sampler) {
# 2247|            for (unsigned p = 0; p < sampler->n_planes; p++)
# 2248|->             desc_data[p].sampler = sampler->bindless_state.offset + p * 32;
# 2249|         }
# 2250|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1129]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:208:11: warning[-Wanalyzer-malloc-leak]: leak of ‘buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:195:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:196:7: branch_false: following ‘false’ branch (when ‘buf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:201:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:208:11: danger: ‘buf’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  206|      buf->base.map = buf->state.map;
#  207|      buf->base.driver_bo = &buf->state;
#  208|->    return &buf->base;
#  209|   }
#  210|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1130]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1897:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1843:10: enter_function: entry to ‘anv_MapMemory2KHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1851:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1856:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1856:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1866:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1866:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1872:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1887:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1893:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1893:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1895:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1895:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_MapMemory2KHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1895:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_MapMemory2KHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1897:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_device.c:1897:7: danger: dereference of NULL ‘<unknown>’
# 1895|            vk_find_struct_const(pMemoryMapInfo->pNext, MEMORY_MAP_PLACED_INFO_EXT);
# 1896|         assert(placed_info != NULL);
# 1897|->       placed_addr = placed_info->pPlacedAddress;
# 1898|      }
# 1899|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1131]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_formats.c:1523:48: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘modifier_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_formats.c:2002:10: enter_function: entry to ‘anv_GetPhysicalDeviceImageFormatProperties2’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_formats.c:2009:11: call_function: calling ‘anv_get_image_format_properties’ from ‘anv_GetPhysicalDeviceImageFormatProperties2’
# 1521|   
# 1522|      if (info->tiling == VK_IMAGE_TILING_DRM_FORMAT_MODIFIER_EXT) {
# 1523|->       isl_mod_info = isl_drm_modifier_get_info(modifier_info->drmFormatModifier);
# 1524|         if (isl_mod_info == NULL)
# 1525|            goto unsupported;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1132]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1643:47: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1614:1: enter_function: entry to ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1630:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1633:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1633:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1633:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1635:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1635:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1639:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1639:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1643:47: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1643:47: danger: dereference of NULL ‘<unknown>’
# 1641|            isl_mod_info = choose_drm_format_mod(device->physical,
# 1642|                                                 mod_list_info->drmFormatModifierCount,
# 1643|->                                               mod_list_info->pDrmFormatModifiers);
# 1644|         }
# 1645|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1133]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1648:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘isl_mod_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1614:1: enter_function: entry to ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1630:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1633:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1633:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1633:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1635:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1635:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1639:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1639:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1641:25: call_function: calling ‘choose_drm_format_mod’ from ‘anv_image_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1641:25: return_function: returning to ‘anv_image_init’ from ‘choose_drm_format_mod’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_image.c:1648:34: danger: dereference of NULL ‘isl_mod_info’
# 1646|         assert(isl_mod_info);
# 1647|         assert(image->vk.drm_format_mod == DRM_FORMAT_MOD_INVALID);
# 1648|->       image->vk.drm_format_mod = isl_mod_info->modifier;
# 1649|   
# 1650|         if (isl_drm_modifier_needs_display_layout(image->vk.drm_format_mod))

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1134]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_nir_apply_pipeline_layout.c:1319:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_nir_apply_pipeline_layout.c:1519:1: enter_function: entry to ‘lower_direct_buffer_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_nir_apply_pipeline_layout.c:1530:14: call_function: calling ‘try_lower_direct_buffer_intrinsic’ from ‘lower_direct_buffer_instr’
# 1317|                             struct apply_pipeline_layout_state *state)
# 1318|   {
# 1319|->    if (intrin->intrinsic == nir_intrinsic_vulkan_resource_index) {
# 1320|         b->cursor = nir_before_instr(&intrin->instr);
# 1321|         *set = nir_intrinsic_desc_set(intrin);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1135]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:187:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:165:1: enter_function: entry to ‘anv_rmv_log_bo_gtt_unmap_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:187:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘anv_rmv_log_bo_gtt_unmap_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:187:4: return_function: returning to ‘anv_rmv_log_bo_gtt_unmap_locked’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:187:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*device.vk.memory_trace_data.tokens, 1, 144)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  185|         },
#  186|      };
#  187|->    util_dynarray_append(&device->vk.memory_trace_data.tokens,
#  188|                           struct vk_rmv_token, token);
#  189|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1136]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:259:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:232:1: enter_function: entry to ‘anv_rmv_log_bos_gtt_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:237:25: branch_true: following ‘true’ branch (when ‘i < bo_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:238:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:240:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:245:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:259:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘anv_rmv_log_bos_gtt_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:259:7: return_function: returning to ‘anv_rmv_log_bos_gtt_map’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:259:7: danger: argument 1 (‘util_dynarray_grow_bytes(&*device.vk.memory_trace_data.tokens, 1, 144)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  257|            },
#  258|         };
#  259|->       util_dynarray_append(&device->vk.memory_trace_data.tokens,
#  260|                              struct vk_rmv_token, token);
#  261|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1137]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:291:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:268:1: enter_function: entry to ‘anv_rmv_log_vm_binds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:273:25: branch_true: following ‘true’ branch (when ‘i < bind_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:277:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:291:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘anv_rmv_log_vm_binds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:291:7: return_function: returning to ‘anv_rmv_log_vm_binds’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_rmv.c:291:7: danger: argument 1 (‘util_dynarray_grow_bytes(&*device.vk.memory_trace_data.tokens, 1, 144)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  289|            },
#  290|         };
#  291|->       util_dynarray_append(&device->vk.memory_trace_data.tokens,
#  292|                              struct vk_rmv_token, token);
#  293|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1138]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_sparse.c:424:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_sparse.c:1044:1: enter_function: entry to ‘anv_free_sparse_bindings’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_sparse.c:1047:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_sparse.c:1050:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_sparse.c:1070:19: call_function: calling ‘anv_sparse_bind’ from ‘anv_free_sparse_bindings’
#  422|         .entry_addr = entry_addr,
#  423|      };
#  424|->    util_dynarray_append(binds, struct anv_trtt_bind, b);
#  425|   }
#  426|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1139]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:158:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:112:1: enter_function: entry to ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:141:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:144:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:144:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:146:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:146:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:149:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:158:7: danger: dereference of NULL ‘<unknown>’
#  156|         ext->fieldOffsetGranularity.x = 0;
#  157|         ext->fieldOffsetGranularity.y = 0;
#  158|->       ext->maxLevelIdc = STD_VIDEO_H264_LEVEL_IDC_5_1;
#  159|         strcpy(pCapabilities->stdHeaderVersion.extensionName, VK_STD_VULKAN_VIDEO_CODEC_H264_DECODE_EXTENSION_NAME);
#  160|         pCapabilities->stdHeaderVersion.specVersion = VK_STD_VULKAN_VIDEO_CODEC_H264_DECODE_SPEC_VERSION;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1140]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:168:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:112:1: enter_function: entry to ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:141:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:166:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:166:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:168:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:168:11: danger: dereference of NULL ‘<unknown>’
#  166|            vk_find_struct_const(pVideoProfile->pNext, VIDEO_DECODE_AV1_PROFILE_INFO_KHR);
#  167|   
#  168|->       if (av1_profile->stdProfile != STD_VIDEO_AV1_PROFILE_MAIN)
#  169|            return VK_ERROR_VIDEO_PROFILE_OPERATION_NOT_SUPPORTED_KHR;
#  170|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1141]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:178:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:112:1: enter_function: entry to ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:141:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:166:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:166:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:168:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:171:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:171:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:176:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:176:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:178:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:178:7: danger: dereference of NULL ‘<unknown>’
#  176|            vk_find_struct(pCapabilities->pNext, VIDEO_DECODE_AV1_CAPABILITIES_KHR);
#  177|   
#  178|->       ext->maxLevel = STD_VIDEO_AV1_LEVEL_6_0;
#  179|   
#  180|         pCapabilities->maxDpbSlots = STD_VIDEO_AV1_NUM_REF_FRAMES + 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1142]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:182:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:112:1: enter_function: entry to ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:141:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:166:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:166:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:168:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:171:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:171:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:176:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:176:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:182:7: danger: dereference of NULL ‘<unknown>’
#  180|         pCapabilities->maxDpbSlots = STD_VIDEO_AV1_NUM_REF_FRAMES + 1;
#  181|         pCapabilities->maxActiveReferencePictures = STD_VIDEO_AV1_NUM_REF_FRAMES;
#  182|->       dec_caps->flags |= VK_VIDEO_DECODE_CAPABILITY_DPB_AND_OUTPUT_DISTINCT_BIT_KHR;
#  183|   
#  184|         strcpy(pCapabilities->stdHeaderVersion.extensionName, VK_STD_VULKAN_VIDEO_CODEC_AV1_DECODE_EXTENSION_NAME);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1143]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:197:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:112:1: enter_function: entry to ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:141:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:190:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:190:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:193:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:193:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:193:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:197:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:197:11: danger: dereference of NULL ‘<unknown>’
#  195|   
#  196|         /* No hardware supports the scc extension profile */
#  197|->       if (h265_profile->stdProfileIdc != STD_VIDEO_H265_PROFILE_IDC_MAIN &&
#  198|             h265_profile->stdProfileIdc != STD_VIDEO_H265_PROFILE_IDC_MAIN_10 &&
#  199|             h265_profile->stdProfileIdc != STD_VIDEO_H265_PROFILE_IDC_MAIN_STILL_PICTURE &&

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1144]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:227:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:112:1: enter_function: entry to ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:129:7: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:131:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:135:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:141:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:190:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:190:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:193:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:193:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:193:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetPhysicalDeviceVideoCapabilitiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:197:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:204:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:216:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:220:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:227:7: danger: dereference of NULL ‘<unknown>’
#  225|         pCapabilities->maxActiveReferencePictures = ANV_VIDEO_H265_HCP_NUM_REF_FRAME;
#  226|   
#  227|->       ext->maxLevelIdc = STD_VIDEO_H265_LEVEL_IDC_6_2;
#  228|   
#  229|         strcpy(pCapabilities->stdHeaderVersion.extensionName, VK_STD_VULKAN_VIDEO_CODEC_H265_DECODE_EXTENSION_NAME);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1145]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:842:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:824:1: enter_function: entry to ‘anv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:840:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetEncodedVideoSessionParametersKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:840:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:841:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:842:11: danger: dereference of NULL ‘<unknown>’
#  840|            vk_find_struct_const(pVideoSessionParametersInfo->pNext, VIDEO_ENCODE_H264_SESSION_PARAMETERS_GET_INFO_KHR);
#  841|         size_t sps_size = 0, pps_size = 0;
#  842|->       if (h264_get_info->writeStdSPS) {
#  843|            for (unsigned i = 0; i < params->vk.h264_enc.h264_sps_count; i++)
#  844|               if (params->vk.h264_enc.h264_sps[i].base.seq_parameter_set_id == h264_get_info->stdSPSId)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1146]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:861:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:824:1: enter_function: entry to ‘anv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:859:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetEncodedVideoSessionParametersKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:859:10: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetEncodedVideoSessionParametersKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:860:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_video.c:861:11: danger: dereference of NULL ‘<unknown>’
#  859|            vk_find_struct_const(pVideoSessionParametersInfo->pNext, VIDEO_ENCODE_H265_SESSION_PARAMETERS_GET_INFO_KHR);
#  860|         size_t sps_size = 0, pps_size = 0, vps_size = 0;
#  861|->       if (h265_get_info->writeStdVPS) {
#  862|            for (unsigned i = 0; i < params->vk.h265_enc.h265_vps_count; i++)
#  863|               if (params->vk.h265_enc.h265_vps[i].base.vps_video_parameter_set_id == h265_get_info->stdVPSId)

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1147]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:184:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:523:1: enter_function: entry to ‘gfx9_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:542:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:543:7: call_function: inlined call to ‘blorp_exec_on_blitter’ from ‘gfx9_blorp_exec’
#  182|   
#  183|         bt_map[i] = surface_state.offset + state_offset;
#  184|->       surface_offsets[i] = surface_state.offset;
#  185|         surface_maps[i] = surface_state.map;
#  186|      }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1148]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:185:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:523:1: enter_function: entry to ‘gfx9_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:542:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_blorp_exec.c:543:7: call_function: inlined call to ‘blorp_exec_on_blitter’ from ‘gfx9_blorp_exec’
#  183|         bt_map[i] = surface_state.offset + state_offset;
#  184|         surface_offsets[i] = surface_state.offset;
#  185|->       surface_maps[i] = surface_state.map;
#  186|      }
#  187|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1149]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1052:49: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1050|            const struct VkVideoDecodeH264DpbSlotInfoKHR *dpb_slot =
# 1051|               vk_find_struct_const(frame_info->pReferenceSlots[i].pNext, VIDEO_DECODE_H264_DPB_SLOT_INFO_KHR);
# 1052|->          const StdVideoDecodeH264ReferenceInfo *ref_info = dpb_slot->pStdReferenceInfo;
# 1053|   
# 1054|            if (frame_info->pReferenceSlots[i].slotIndex < 0)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1150]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1088:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1086|         avc_img.FrameSize = (sps->pic_width_in_mbs_minus1 + 1) * pic_height;
# 1087|   
# 1088|->       if (!h264_pic_info->pStdPictureInfo->flags.field_pic_flag)
# 1089|            avc_img.ImageStructure = FramePicture;
# 1090|         else if (h264_pic_info->pStdPictureInfo->flags.bottom_field_flag)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1151]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1167:49: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1165|               vk_find_struct_const(frame_info->pReferenceSlots[i].pNext, VIDEO_DECODE_H264_DPB_SLOT_INFO_KHR);
# 1166|            const struct anv_image_view *ref_iv = anv_image_view_from_handle(frame_info->pReferenceSlots[i].pPictureResource->imageViewBinding);
# 1167|->          const StdVideoDecodeH264ReferenceInfo *ref_info = dpb_slot->pStdReferenceInfo;
# 1168|            avc_directmode.DirectMVBufferAddress[idx] = anv_image_address(ref_iv->image,
# 1169|                                                                        &ref_iv->image->vid_dmv_top_surface);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1152]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1185:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1183|            .MOCS = anv_mocs(cmd_buffer->device, img->bindings[0].address.bo, 0),
# 1184|         };
# 1185|->       avc_directmode.POCList[32] = h264_pic_info->pStdPictureInfo->PicOrderCnt[0];
# 1186|         avc_directmode.POCList[33] = h264_pic_info->pStdPictureInfo->PicOrderCnt[1];
# 1187|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1153]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1191:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1189|      uint32_t buffer_offset = frame_info->srcBufferOffset & 4095;
# 1190|   #define HEADER_OFFSET 3
# 1191|->    for (unsigned s = 0; s < h264_pic_info->sliceCount; s++) {
# 1192|         bool last_slice = s == (h264_pic_info->sliceCount - 1);
# 1193|         uint32_t current_offset = h264_pic_info->pSliceOffsets[s];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1154]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:393:94: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:2440:1: enter_function: entry to ‘gfx9_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:2446:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx9_CmdEncodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:2446:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx9_CmdEncodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:2448:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:2449:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video_enc.c:2450:7: call_function: calling ‘anv_h264_encode_video’ from ‘gfx9_CmdEncodeVideoKHR’
#  391|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
#  392|   
#  393|->    const StdVideoH264SequenceParameterSet *sps = vk_video_find_h264_enc_std_sps(&params->vk, frame_info->pStdPictureInfo->seq_parameter_set_id);
#  394|      const StdVideoH264PictureParameterSet *pps = vk_video_find_h264_enc_std_pps(&params->vk, frame_info->pStdPictureInfo->pic_parameter_set_id);
#  395|      const StdVideoEncodeH264ReferenceListsInfo *ref_list_info = frame_info->pStdPictureInfo->pRefLists;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1155]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:178:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:314:1: enter_function: entry to ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:321:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:323:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:322:7: call_function: calling ‘emit_ves_vf_instancing’ from ‘emit_vertex_input’
#  176|      const struct anv_device *device = pipeline->base.base.device;
#  177|      const struct brw_vs_prog_data *vs_prog_data = get_vs_prog_data(pipeline);
#  178|->    const uint64_t inputs_read = vs_prog_data->inputs_read;
#  179|      const uint64_t double_inputs_read =
#  180|         vs_prog_data->double_inputs_read & inputs_read;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1156]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:329:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:314:1: enter_function: entry to ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:327:50: call_function: inlined call to ‘get_vs_prog_data’ from ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:328:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:328:33: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:329:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:329:34: danger: dereference of NULL ‘<unknown>’
#  327|      const struct brw_vs_prog_data *vs_prog_data = get_vs_prog_data(pipeline);
#  328|      const bool needs_svgs_elem = pipeline->svgs_count > 1 ||
#  329|->                                 !vs_prog_data->uses_drawid;
#  330|      const uint32_t id_slot = pipeline->vs_input_elements;
#  331|      const uint32_t drawid_slot = id_slot + needs_svgs_elem;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1157]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:348:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:314:1: enter_function: entry to ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:327:50: call_function: inlined call to ‘get_vs_prog_data’ from ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:328:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:328:33: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:332:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:335:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:337:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:348:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:348:32: danger: dereference of NULL ‘<unknown>’
#  346|             * well.  Just do all or nothing.
#  347|             */
#  348|->          uint32_t base_ctrl = (vs_prog_data->uses_firstvertex ||
#  349|                                  vs_prog_data->uses_baseinstance) ?
#  350|                                 VFCOMP_STORE_SRC : VFCOMP_STORE_0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1158]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:379:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:314:1: enter_function: entry to ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:327:50: call_function: inlined call to ‘get_vs_prog_data’ from ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:328:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:328:33: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:332:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:335:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:337:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:369:71: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:379:11: danger: dereference of NULL ‘<unknown>’
#  377|         }
#  378|   
#  379|->       if (vs_prog_data->uses_drawid) {
#  380|            struct GENX(VERTEX_ELEMENT_STATE) element = {
#  381|               .VertexBufferIndex = ANV_DRAWID_VB_INDEX,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1159]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:773:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:655:1: enter_function: entry to ‘emit_3dstate_sbe’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:657:50: call_function: inlined call to ‘get_wm_prog_data’ from ‘emit_3dstate_sbe’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:659:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:669:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:669:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:670:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:670:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:675:36: call_function: inlined call to ‘anv_pipeline_is_primitive’ from ‘emit_3dstate_sbe’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:680:28: branch_true: following ‘true’ branch (when ‘i != 32’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:681:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:683:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:767:60: call_function: inlined call to ‘get_mesh_prog_data’ from ‘emit_3dstate_sbe’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:768:10: call_function: inlined call to ‘anv_gfx_pipeline_add’ from ‘emit_3dstate_sbe’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:768:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:773:58: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:773:58: danger: dereference of NULL ‘<unknown>’
#  771|   
#  772|               assert(mue->per_vertex_header_size_dw % 8 == 0);
#  773|->             sbe_mesh.PerVertexURBEntryOutputReadOffset = mue->per_vertex_header_size_dw / 8;
#  774|               sbe_mesh.PerVertexURBEntryOutputReadLength = DIV_ROUND_UP(mue->per_vertex_data_size_dw, 8);
#  775|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1160]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1262:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1221:1: enter_function: entry to ‘emit_3dstate_hs_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1224:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1232:46: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1238:52: call_function: inlined call to ‘get_tcs_prog_data’ from ‘emit_3dstate_hs_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1239:52: call_function: inlined call to ‘get_tes_prog_data’ from ‘emit_3dstate_hs_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1247:43: call_function: inlined call to ‘get_sampler_count’ from ‘emit_3dstate_hs_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1248:35: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1262:26: danger: dereference of NULL ‘<unknown>’
# 1260|         hs.MaximumNumberofThreads = devinfo->max_tcs_threads - 1;
# 1261|         hs.IncludeVertexHandles = true;
# 1262|->       hs.InstanceCount = tcs_prog_data->instances - 1;
# 1263|   
# 1264|         hs.VertexURBEntryReadLength = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1161]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1551:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1535:1: enter_function: entry to ‘emit_3dstate_wm’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1542:50: call_function: inlined call to ‘get_wm_prog_data’ from ‘emit_3dstate_wm’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1544:4: call_function: inlined call to ‘anv_gfx_pipeline_add’ from ‘emit_3dstate_wm’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1544:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1550:11: call_function: inlined call to ‘anv_pipeline_has_stage’ from ‘emit_3dstate_wm’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1550:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1551:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1551:14: danger: dereference of NULL ‘<unknown>’
# 1549|   
# 1550|         if (anv_pipeline_has_stage(pipeline, MESA_SHADER_FRAGMENT)) {
# 1551|->          if (wm_prog_data->early_fragment_tests) {
# 1552|               wm.EarlyDepthStencilControl         = EDSC_PREPS;
# 1553|            } else if (wm_prog_data->has_side_effects) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1162]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1826:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1760:1: enter_function: entry to ‘emit_task_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1764:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1776:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1800:54: call_function: inlined call to ‘get_task_prog_data’ from ‘emit_task_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1802:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1804:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1806:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1826:26: danger: dereference of NULL ‘<unknown>’
# 1824|         task.IndirectDataLength = align(task_bin->bind_map.push_ranges[0].length * 32, 64);
# 1825|   
# 1826|->       task.XP0Required = task_prog_data->uses_drawid;
# 1827|   
# 1828|   #if GFX_VER >= 30

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1163]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1858:41: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1845:1: enter_function: entry to ‘emit_mesh_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1850:54: call_function: inlined call to ‘get_mesh_prog_data’ from ‘emit_mesh_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1858:41: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1858:41: danger: dereference of NULL ‘<unknown>’
# 1856|         mc.MaximumNumberofThreadGroups = 511;
# 1857|   #if GFX_VER >= 20
# 1858|->       mc.VPandRTAIndexAutostripEnable = mesh_prog_data->autostrip_enable;
# 1859|   #endif
# 1860|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1164]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1880:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1845:1: enter_function: entry to ‘emit_mesh_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1850:54: call_function: inlined call to ‘get_mesh_prog_data’ from ‘emit_mesh_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1853:4: call_function: inlined call to ‘GFX125_3DSTATE_MESH_CONTROL_pack’ from ‘emit_mesh_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_pipeline.c:1880:7: danger: dereference of NULL ‘<unknown>’
# 1878|   
# 1879|      const unsigned output_topology =
# 1880|->       mesh_prog_data->primitive_type == MESA_PRIM_POINTS ? OUTPUT_POINT :
# 1881|         mesh_prog_data->primitive_type == MESA_PRIM_LINES  ? OUTPUT_LINE :
# 1882|                                                                OUTPUT_TRI;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1165]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:49:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:257:1: enter_function: entry to ‘xe_queue_exec_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:273:13: call_function: calling ‘xe_exec_process_syncs’ from ‘xe_queue_exec_locked’
#   47|         .timeline_value = value,
#   48|      };
#   49|->    drm_sync.handle = syncobj->syncobj;
#   50|   
#   51|      return drm_sync;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1166]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:588:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:1114:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:1119:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
#  586|         assert((offset - bo_offset) + size <= bo->size);
#  587|   
#  588|->       return bo->map + (offset - bo_offset);
#  589|      } else {
#  590|         return pool->map + offset;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1167]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:955:35: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘st_idx’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:1114:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:1119:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
#  953|      for (int i = 0; i < count; i++) {
#  954|         /* update states that were added back to the state table */
#  955|->       struct anv_state *state_i = anv_state_table_get(&pool->table,
#  956|                                                         st_idx + i);
#  957|         state_i->alloc_size = block_size;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1168]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:965:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘st_idx’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:1114:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_allocator.c:1119:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
#  963|   
#  964|      uint32_t block_bucket = anv_state_pool_get_bucket(block_size);
#  965|->    anv_free_list_push(&pool->buckets[block_bucket].free_list,
#  966|                         &pool->table, st_idx, count);
#  967|   }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1169]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1429:13: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1815:1: enter_function: entry to ‘anv_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1821:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1825:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1831:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1833:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1834:13: call_function: calling ‘anv_descriptor_set_write_image_view’ from ‘anv_descriptor_set_write_template’
# 1427|         if (sampler) {
# 1428|            for (unsigned p = 0; p < sampler->n_planes; p++)
# 1429|->             desc_data[p].sampler = sampler->bindless_state.offset + p * 32;
# 1430|         }
# 1431|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1170]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1727:55: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1658:6: enter_function: entry to ‘anv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1667:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1668:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1720:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_UpdateDescriptorSets’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1720:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_UpdateDescriptorSets’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1727:55: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1727:55: danger: dereference of NULL ‘<unknown>’
# 1725|                                                         inline_write->pData,
# 1726|                                                         write->dstArrayElement,
# 1727|->                                                       inline_write->dataSize);
# 1728|            break;
# 1729|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1171]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:982:48: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1337:10: enter_function: entry to ‘anv_GetPhysicalDeviceImageFormatProperties2’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1351:4: branch_false: following ‘false’ branch (when ‘<unknown> == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1351:4: branch_true: following ‘true’ branch (when ‘<unknown> != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1373:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1373:4: branch_false: following ‘false’ branch (when ‘<unknown> == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1373:4: branch_false: following ‘false’ branch (when ‘s’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1373:4: branch_true: following ‘true’ branch (when ‘<unknown> != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1390:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_formats.c:1390:13: call_function: calling ‘anv_get_image_format_properties’ from ‘anv_GetPhysicalDeviceImageFormatProperties2’
#  980|            vk_find_struct_const(info->pNext, PHYSICAL_DEVICE_IMAGE_DRM_FORMAT_MODIFIER_INFO_EXT);
#  981|   
#  982|->       isl_mod_info = isl_drm_modifier_get_info(vk_mod_info->drmFormatModifier);
#  983|         if (isl_mod_info == NULL)
#  984|            goto unsupported;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1172]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_nir_apply_pipeline_layout.c:554:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘intrin’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_nir_apply_pipeline_layout.c:714:1: enter_function: entry to ‘lower_direct_buffer_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_nir_apply_pipeline_layout.c:727:14: call_function: calling ‘try_lower_direct_buffer_intrinsic’ from ‘lower_direct_buffer_instr’
#  552|                             struct apply_pipeline_layout_state *state)
#  553|   {
#  554|->    if (intrin->intrinsic == nir_intrinsic_vulkan_resource_index) {
#  555|         b->cursor = nir_before_instr(&intrin->instr);
#  556|         *set = nir_intrinsic_desc_set(intrin);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1173]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:929:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘stream’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1002:1: enter_function: entry to ‘anv_pipeline_add_executables’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1015:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1016:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1016:10: call_function: calling ‘anv_pipeline_add_executable’ from ‘anv_pipeline_add_executables’
#argument 4 of ‘__builtin_fwrite’ must be non-null
#  927|            push_size += stage->bind_map.push_ranges[i].length;
#  928|         if (push_size > 0) {
#  929|->          fprintf(stream, "Push constant ranges:\n");
#  930|            for (unsigned i = 0; i < 4; i++) {
#  931|               if (stage->bind_map.push_ranges[i].length == 0)

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1174]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:997:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1002:1: enter_function: entry to ‘anv_pipeline_add_executables’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1019:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1021:38: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_pipeline.c:1020:10: call_function: calling ‘anv_pipeline_add_executable’ from ‘anv_pipeline_add_executables’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  995|         .disasm = disasm,
#  996|      };
#  997|->    util_dynarray_append(&pipeline->executables,
#  998|                           struct anv_pipeline_executable, exe);
#  999|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1175]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:75:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:336:1: enter_function: entry to ‘gfx7_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:360:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:363:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:363:7: call_function: calling ‘blorp_exec_on_render’ from ‘gfx7_blorp_exec’
#   73|                    void *location, struct blorp_address address, uint32_t delta)
#   74|   {
#   75|->    struct anv_cmd_buffer *cmd_buffer = batch->driver_batch;
#   76|      assert(cmd_buffer->batch.start <= location &&
#   77|             location < cmd_buffer->batch.end);

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1176]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:176:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:336:1: enter_function: entry to ‘gfx7_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:360:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:361:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:361:7: call_function: calling ‘blorp_exec_on_compute’ from ‘gfx7_blorp_exec’
#  174|            anv_cmd_buffer_alloc_surface_state(cmd_buffer);
#  175|         bt_map[i] = surface_state.offset + state_offset;
#  176|->       surface_offsets[i] = surface_state.offset;
#  177|         surface_maps[i] = surface_state.map;
#  178|      }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1177]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:177:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:336:1: enter_function: entry to ‘gfx7_blorp_exec’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:360:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:361:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_blorp_exec.c:361:7: call_function: calling ‘blorp_exec_on_compute’ from ‘gfx7_blorp_exec’
#  175|         bt_map[i] = surface_state.offset + state_offset;
#  176|         surface_offsets[i] = surface_state.offset;
#  177|->       surface_maps[i] = surface_state.map;
#  178|      }
#  179|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1178]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:99:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:93:1: enter_function: entry to ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:96:50: call_function: inlined call to ‘get_vs_prog_data’ from ‘emit_vertex_input’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:99:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:99:19: danger: dereference of NULL ‘<unknown>’
#   97|   
#   98|      /* Pull inputs_read out of the VS prog data */
#   99|->    const uint64_t inputs_read = vs_prog_data->inputs_read;
#  100|      const uint64_t double_inputs_read =
#  101|         vs_prog_data->double_inputs_read & inputs_read;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1179]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1403:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1375:1: enter_function: entry to ‘emit_3dstate_hs_te_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1378:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1385:46: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1391:52: call_function: inlined call to ‘get_tcs_prog_data’ from ‘emit_3dstate_hs_te_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1392:52: call_function: inlined call to ‘get_tes_prog_data’ from ‘emit_3dstate_hs_te_ds’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1394:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1397:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan_hasvk/genX_pipeline.c:1403:26: danger: dereference of NULL ‘<unknown>’
# 1401|         hs.MaximumNumberofThreads = devinfo->max_tcs_threads - 1;
# 1402|         hs.IncludeVertexHandles = true;
# 1403|->       hs.InstanceCount = tcs_prog_data->instances - 1;
# 1404|   
# 1405|         hs.VertexURBEntryReadLength = 0;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def1180]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:234:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘loader_open_device(device_41->nodes[2])’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:207:1: enter_function: entry to ‘loader_open_render_node_platform_devices’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:218:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:223:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:226:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:227:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:229:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:230:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:229:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:233:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:233:15: call_function: calling ‘loader_open_device’ from ‘loader_open_render_node_platform_devices’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:233:15: return_function: returning to ‘loader_open_render_node_platform_devices’ from ‘loader_open_device’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:234:13: danger: ‘loader_open_device(device_41->nodes[2])’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
#  232|   
#  233|            fd = loader_open_device(device->nodes[DRM_NODE_RENDER]);
#  234|->          if (fd < 0)
#  235|               continue;
#  236|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1181]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:385:17: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘name’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:362:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:370:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:370:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:374:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:381:17: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:385:17: danger: argument 1 (‘name’) from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4) could be NULL where non-null expected
#argument 1 of ‘__builtin_strchr’ must be non-null
#  383|            name = strdup(name + 1);
#  384|   
#  385|->       address = strchr(name, '@');
#  386|         if (address) {
#  387|            *address++ = '\0';

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1182]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:601:44: warning[-Wanalyzer-null-argument]: use of NULL ‘<unknown>’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:428:6: enter_function: entry to ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:458:7: branch_false: following ‘false’ branch (when ‘<unknown>’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:462:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:462:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:464:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:480:18: call_function: calling ‘drm_get_id_path_tag_for_fd’ from ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:480:18: return_function: returning to ‘loader_get_user_preferred_fd’ from ‘drm_get_id_path_tag_for_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:481:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:484:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:485:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:488:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:515:7: branch_false: following ‘false’ branch (when ‘<unknown> != 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:523:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:524:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:524:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:527:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:527:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:562:28: call_function: calling ‘drm_construct_id_path_tag’ from ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:562:28: return_function: returning to ‘loader_get_user_preferred_fd’ from ‘drm_construct_id_path_tag’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:585:12: call_function: calling ‘loader_open_device’ from ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:585:12: return_function: returning to ‘loader_get_user_preferred_fd’ from ‘loader_open_device’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:590:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:593:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:593:7: branch_false: following ‘false’ branch (when ‘fd >= 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:601:44: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:601:44: danger: argument 2 (‘prime.str’) NULL where non-null expected
#  599|      }
#  600|   
#  601|->    bool is_render_and_display_gpu_diff = !!strcmp(default_tag, prime.str);
#  602|      if (original_fd) {
#  603|         if (is_render_and_display_gpu_diff) {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def1183]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:617:11: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:428:6: enter_function: entry to ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:458:7: branch_false: following ‘false’ branch (when ‘<unknown>’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:462:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:462:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:464:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:480:18: call_function: calling ‘drm_get_id_path_tag_for_fd’ from ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:480:18: return_function: returning to ‘loader_get_user_preferred_fd’ from ‘drm_get_id_path_tag_for_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:481:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:484:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:485:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:488:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:515:7: branch_false: following ‘false’ branch (when ‘<unknown> != 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:523:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:524:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:524:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:527:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:527:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:562:28: call_function: calling ‘drm_construct_id_path_tag’ from ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:562:28: return_function: returning to ‘loader_get_user_preferred_fd’ from ‘drm_construct_id_path_tag’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:585:12: call_function: calling ‘loader_open_device’ from ‘loader_get_user_preferred_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:585:12: return_function: returning to ‘loader_get_user_preferred_fd’ from ‘loader_open_device’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:593:7: branch_true: following ‘true’ branch (when ‘fd < 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:594:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:617:11: danger: ‘fd’ leaks here; was opened at [(37)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/36)
#  615|      free(default_tag);
#  616|      free(prime.str);
#  617|->    return is_render_and_display_gpu_diff;
#  618|    err:
#  619|      log_(debug ? _LOADER_WARNING : _LOADER_INFO,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1184]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:171:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘crtc_cookies’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:167:19: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:169:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:171:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:171:10: danger: ‘crtc_cookies + (long unsigned int)c * 4’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  169|      for (unsigned c = 0; c < res->num_crtcs; c++) {
#  170|         crtc_cookies[c] =
#  171|->          xcb_randr_get_crtc_info_unchecked(res->conn, res->crtcs[c].id,
#  172|                                              res->config_timestamp);
#  173|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1185]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:227:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘crtc_cookies’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:175:25: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:195:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:197:7: branch_false: following ‘false’ branch (when ‘config_unchanged == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:204:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:223:19: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:225:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:227:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader_dri_helper.c:227:10: danger: ‘crtc_cookies + (long unsigned int)c * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  225|      for (unsigned c = 0; c < reply->num_crtcs; c++) {
#  226|         crtc_cookies[c] =
#  227|->          xcb_randr_get_crtc_info_unchecked(res->conn, new_crtcs[c],
#  228|                                              res->config_timestamp);
#  229|      }

Error: GCC_ANALYZER_WARNING (CWE-131): [#def1186]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:235:14: warning[-Wanalyzer-allocation-size]: allocated buffer size is not a multiple of the pointee's size
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:397:1: enter_function: entry to ‘accum’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:401:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:406:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:406:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:409:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:433:7: call_function: calling ‘accum_or_load’ from ‘accum’
#  233|         GLfloat (*rgba)[4];
#  234|   
#  235|->       rgba = malloc(width * 4 * sizeof(GLfloat));
#  236|         if (rgba) {
#  237|            for (j = 0; j < height; j++) {

Error: GCC_ANALYZER_WARNING (CWE-131): [#def1187]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:328:17: warning[-Wanalyzer-allocation-size]: allocated buffer size is not a multiple of the pointee's size
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:397:1: enter_function: entry to ‘accum’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:401:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:406:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:406:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:409:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:436:7: call_function: calling ‘accum_return’ from ‘accum’
#  326|            GLfloat (*rgba)[4], (*dest)[4];
#  327|   
#  328|->          rgba = malloc(width * 4 * sizeof(GLfloat));
#  329|            dest = malloc(width * 4 * sizeof(GLfloat));
#  330|   

Error: GCC_ANALYZER_WARNING (CWE-131): [#def1188]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:329:17: warning[-Wanalyzer-allocation-size]: allocated buffer size is not a multiple of the pointee's size
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:397:1: enter_function: entry to ‘accum’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:401:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:406:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:406:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:409:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/accum.c:436:7: call_function: calling ‘accum_return’ from ‘accum’
#  327|   
#  328|            rgba = malloc(width * 4 * sizeof(GLfloat));
#  329|->          dest = malloc(width * 4 * sizeof(GLfloat));
#  330|   
#  331|            if (rgba && dest) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1189]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:347:40: warning[-Wanalyzer-malloc-leak]: leak of ‘calloc(12, 6)’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:323:1: enter_function: entry to ‘_mesa_BeginFragmentShaderATI’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:328:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:333:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:338:16: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:339:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:338:16: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:339:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:338:16: branch_false: following ‘false’ branch (when ‘i == 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:343:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:343:4: call_function: inlined call to ‘_mesa_reference_program’ from ‘_mesa_BeginFragmentShaderATI’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:347:16: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:348:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:349:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:352:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:347:40: danger: ‘calloc(12, 6)’ leaks here; was allocated at [(16)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/15)
#  345|      /* malloc the instructions here - not sure if the best place but its
#  346|         a start */
#  347|->    for (i = 0; i < MAX_NUM_PASSES_ATI; i++) {
#  348|         ctx->ATIFragmentShader.Current->Instructions[i] =
#  349|   	 calloc(sizeof(struct atifs_instruction),

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1190]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:352:10: warning[-Wanalyzer-malloc-leak]: leak of ‘calloc(112, 8)’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:323:1: enter_function: entry to ‘_mesa_BeginFragmentShaderATI’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:328:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:333:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:338:16: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:339:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:338:16: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:339:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:338:16: branch_false: following ‘false’ branch (when ‘i == 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:343:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:343:4: call_function: inlined call to ‘_mesa_reference_program’ from ‘_mesa_BeginFragmentShaderATI’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:347:16: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:348:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:349:10: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/atifragshader.c:352:10: danger: ‘calloc(112, 8)’ leaks here; was allocated at [(15)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/14)
#  350|                   MAX_NUM_INSTRUCTIONS_PER_PASS_ATI);
#  351|         ctx->ATIFragmentShader.Current->SetupInst[i] =
#  352|-> 	 calloc(sizeof(struct atifs_setupinst),
#  353|                   MAX_NUM_FRAGMENT_REGISTERS_ATI);
#  354|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1191]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1272:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘_mesa_bufferobj_alloc(ctx,  id)’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1945:1: enter_function: entry to ‘create_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1971:20: branch_true: following ‘true’ branch (when ‘i < n’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1972:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1972:10: branch_true: following ‘true’ branch (when ‘dsa != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1973:49: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:1973:16: call_function: calling ‘new_gl_buffer_object’ from ‘create_buffers’
# 1270|      struct gl_buffer_object *buf = _mesa_bufferobj_alloc(ctx, id);
# 1271|   
# 1272|->    buf->Ctx = ctx;
# 1273|      buf->RefCount++; /* global buffer reference held by the context */
# 1274|      return buf;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1192]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5105:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘obj’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5125:1: enter_function: entry to ‘_mesa_InvalidateBufferSubData_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5130:38: call_function: inlined call to ‘_mesa_lookup_bufferobj’ from ‘_mesa_InvalidateBufferSubData_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5131:4: call_function: inlined call to ‘invalidate_buffer_subdata’ from ‘_mesa_InvalidateBufferSubData_no_error’
# 5103|   
# 5104|      /* We ignore partial invalidates. */
# 5105|->    if (offset != 0 || size != obj->Size)
# 5106|         return;
# 5107|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1193]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5192:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5187:1: enter_function: entry to ‘_mesa_InvalidateBufferData_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5191:37: call_function: inlined call to ‘_mesa_lookup_bufferobj’ from ‘_mesa_InvalidateBufferData_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5192:46: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.c:5192:46: danger: dereference of NULL ‘<unknown>’
# 5190|   
# 5191|      struct gl_buffer_object *bufObj =_mesa_lookup_bufferobj(ctx, buffer);
# 5192|->    invalidate_buffer_subdata(ctx, bufObj, 0, bufObj->Size);
# 5193|   }
# 5194|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1194]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.h:225:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/arrayobj.c:1175:1: enter_function: entry to ‘_mesa_VertexArrayElementBuffer_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/arrayobj.c:1178:4: call_function: inlined call to ‘vertex_array_element_buffer’ from ‘_mesa_VertexArrayElementBuffer_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/arrayobj.c:1178:4: call_function: inlined call to ‘vertex_array_element_buffer’ from ‘_mesa_VertexArrayElementBuffer_no_error’
#  223|                                 struct gl_buffer_object *bufObj)
#  224|   {
#  225|->    if (*ptr != bufObj)
#  226|         _mesa_reference_buffer_object_(ctx, ptr, bufObj, false);
#  227|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1195]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/bufferobj.h:225:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/arrayobj.c:1175:1: enter_function: entry to ‘_mesa_VertexArrayElementBuffer_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/arrayobj.c:1178:4: call_function: inlined call to ‘vertex_array_element_buffer’ from ‘_mesa_VertexArrayElementBuffer_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/arrayobj.c:1178:4: call_function: inlined call to ‘vertex_array_element_buffer’ from ‘_mesa_VertexArrayElementBuffer_no_error’
#  223|                                 struct gl_buffer_object *bufObj)
#  224|   {
#  225|->    if (*ptr != bufObj)
#  226|         _mesa_reference_buffer_object_(ctx, ptr, bufObj, false);
#  227|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1196]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/condrender.c:88:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘q’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/condrender.c:169:1: enter_function: entry to ‘_mesa_BeginConditionalRender_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/condrender.c:172:4: call_function: inlined call to ‘begin_conditional_render’ from ‘_mesa_BeginConditionalRender_no_error’
#   86|      }
#   87|   
#   88|->    cso_set_render_condition(st->cso_context, q->pq, inverted, m);
#   89|   }
#   90|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1197]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:261:19: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:567:1: enter_function: entry to ‘_mesa_dump_image’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:572:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:575:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:575:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:578:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:578:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:581:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:581:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:584:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:584:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:586:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:589:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:592:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:592:7: call_function: calling ‘write_ppm’ from ‘_mesa_dump_image’
#  259|               int yy = invert ? (height - 1 - y) : y;
#  260|               int i = (yy * width + x) * comps;
#  261|->             fputc(ptr[i+rcomp], f); /* write red */
#  262|               fputc(ptr[i+gcomp], f); /* write green */
#  263|               fputc(ptr[i+bcomp], f); /* write blue */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1198]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:516:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buf2’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:506:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:515:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:516:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:516:7: danger: ‘buf2 + (sizetype)(i * 3)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  514|      /* spread 24 bits of Z across R, G, B */
#  515|      for (i = 0; i < w * h; i++) {
#  516|->       buf2[i*3+0] = (buf[i] >> 24) & 0xff;
#  517|         buf2[i*3+1] = (buf[i] >> 16) & 0xff;
#  518|         buf2[i*3+2] = (buf[i] >>  8) & 0xff;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1199]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:551:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buf2’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:542:11: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:550:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:551:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:551:7: danger: ‘buf2 + (sizetype)(i * 3)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  549|   
#  550|      for (i = 0; i < w * h; i++) {
#  551|->       buf2[i*3+0] = buf[i];
#  552|         buf2[i*3+1] = (buf[i] & 127) * 2;
#  553|         buf2[i*3+2] = (buf[i] - 128) * 2;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1200]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:590:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:572:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:575:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:575:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:578:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:578:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:581:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:581:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:584:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:584:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:586:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:586:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:589:19: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:590:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:590:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:590:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:590:10: danger: ‘buf + (long unsigned int)i’ could be NULL: unchecked value from [(11)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/10)
#  588|         GLuint i;
#  589|         for (i = 0; i < w * h * 4; i++) {
#  590|->          UNCLAMPED_FLOAT_TO_UBYTE(buf[i], f[i]);
#  591|         }
#  592|         write_ppm(filename, buf, w, h, 4, 0, 1, 2, invert);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1201]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:601:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buf’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:572:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:575:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:575:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:578:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:578:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:581:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:581:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:584:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:584:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:595:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:595:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:597:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:597:22: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:600:19: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:601:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:601:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:601:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/debug.c:601:10: danger: ‘buf + (long unsigned int)i’ could be NULL: unchecked value from [(13)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/12)
#  599|         GLuint i;
#  600|         for (i = 0; i < w * h; i++) {
#  601|->          UNCLAMPED_FLOAT_TO_UBYTE(buf[i], f[i]);
#  602|         }
#  603|         write_ppm(filename, buf, w, h, 1, 0, 0, 0, invert);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1202]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:519:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:492:1: enter_function: entry to ‘_mesa_GetnMapdvARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:503:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:503:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:508:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:509:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapdvARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:509:12: return_function: returning to ‘_mesa_GetnMapdvARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:514:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:519:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:519:13: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  517|            }
#  518|            else {
#  519|->             data = map2d->Points;
#  520|               n = map2d->Uorder * map2d->Vorder * comps;
#  521|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1203]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:542:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:492:1: enter_function: entry to ‘_mesa_GetnMapdvARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:503:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:503:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:508:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:509:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapdvARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:509:12: return_function: returning to ‘_mesa_GetnMapdvARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:532:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:540:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:540:16: branch_false: following ‘false’ branch (when ‘bufSize > 15’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:542:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:542:31: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  540|               if (bufSize < numBytes)
#  541|                  goto overflow;
#  542|->             v[0] = (GLdouble) map2d->Uorder;
#  543|               v[1] = (GLdouble) map2d->Vorder;
#  544|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1204]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:558:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:492:1: enter_function: entry to ‘_mesa_GetnMapdvARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:503:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:503:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:508:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:509:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapdvARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:509:12: return_function: returning to ‘_mesa_GetnMapdvARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:547:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:556:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:556:16: branch_false: following ‘false’ branch (when ‘bufSize > 31’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:558:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:558:31: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  556|               if (bufSize < numBytes)
#  557|                  goto overflow;
#  558|->             v[0] = (GLdouble) map2d->u1;
#  559|               v[1] = (GLdouble) map2d->u2;
#  560|               v[2] = (GLdouble) map2d->v1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1205]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:609:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:582:1: enter_function: entry to ‘_mesa_GetnMapfvARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:593:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:593:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:598:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:599:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapfvARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:599:12: return_function: returning to ‘_mesa_GetnMapfvARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:604:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:609:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:609:13: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  607|            }
#  608|            else {
#  609|->             data = map2d->Points;
#  610|               n = map2d->Uorder * map2d->Vorder * comps;
#  611|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1206]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:632:30: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:582:1: enter_function: entry to ‘_mesa_GetnMapfvARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:593:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:593:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:598:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:599:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapfvARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:599:12: return_function: returning to ‘_mesa_GetnMapfvARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:622:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:630:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:630:16: branch_false: following ‘false’ branch (when ‘bufSize > 7’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:632:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:632:30: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  630|               if (bufSize < numBytes)
#  631|                  goto overflow;
#  632|->             v[0] = (GLfloat) map2d->Uorder;
#  633|               v[1] = (GLfloat) map2d->Vorder;
#  634|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1207]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:648:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:582:1: enter_function: entry to ‘_mesa_GetnMapfvARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:593:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:593:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:598:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:599:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapfvARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:599:12: return_function: returning to ‘_mesa_GetnMapfvARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:637:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:646:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:646:16: branch_false: following ‘false’ branch (when ‘bufSize > 15’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:648:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:648:20: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  646|               if (bufSize < numBytes)
#  647|                  goto overflow;
#  648|->             v[0] = map2d->u1;
#  649|               v[1] = map2d->u2;
#  650|               v[2] = map2d->v1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1208]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:701:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:674:1: enter_function: entry to ‘_mesa_GetnMapivARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:685:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:685:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:690:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:691:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapivARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:691:12: return_function: returning to ‘_mesa_GetnMapivARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:696:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:701:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:701:13: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  699|            }
#  700|            else {
#  701|->             data = map2d->Points;
#  702|               n = map2d->Uorder * map2d->Vorder * comps;
#  703|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1209]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:724:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:674:1: enter_function: entry to ‘_mesa_GetnMapivARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:685:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:685:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:690:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:691:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapivARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:691:12: return_function: returning to ‘_mesa_GetnMapivARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:714:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:722:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:722:16: branch_false: following ‘false’ branch (when ‘bufSize > 7’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:724:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:724:20: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  722|               if (bufSize < numBytes)
#  723|                  goto overflow;
#  724|->             v[0] = map2d->Uorder;
#  725|               v[1] = map2d->Vorder;
#  726|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1210]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:740:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:674:1: enter_function: entry to ‘_mesa_GetnMapivARB’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:685:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:685:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:690:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:691:12: call_function: calling ‘get_2d_map’ from ‘_mesa_GetnMapivARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:691:12: return_function: returning to ‘_mesa_GetnMapivARB’ from ‘get_2d_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:729:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:738:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:738:16: branch_false: following ‘false’ branch (when ‘bufSize > 15’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:740:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/eval.c:740:28: danger: dereference of NULL ‘get_2d_map(ctx,  target)’
#  738|               if (bufSize < numBytes)
#  739|                  goto overflow;
#  740|->             v[0] = lroundf(map2d->u1);
#  741|               v[1] = lroundf(map2d->u2);
#  742|               v[2] = lroundf(map2d->v1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1211]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:250:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘fb’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:4513:1: enter_function: entry to ‘_mesa_NamedFramebufferTexture_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:4516:4: call_function: inlined call to ‘frame_buffer_texture’ from ‘_mesa_NamedFramebufferTexture_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:4516:4: call_function: inlined call to ‘frame_buffer_texture’ from ‘_mesa_NamedFramebufferTexture_no_error’
#  248|   invalidate_framebuffer(struct gl_framebuffer *fb)
#  249|   {
#  250|->    fb->_Status = 0; /* "indeterminate" */
#  251|   }
#  252|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1212]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:511:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘att’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:4562:1: enter_function: entry to ‘_mesa_framebuffer_renderbuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:4571:4: call_function: calling ‘_mesa_FramebufferRenderbuffer_sw’ from ‘_mesa_framebuffer_renderbuffer’
#  509|                     struct gl_renderbuffer_attachment *att)
#  510|   {
#  511|->    struct gl_renderbuffer *rb = att->Renderbuffer;
#  512|   
#  513|      /* tell driver that we're done rendering to this texture. */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1213]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:5875:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘fb’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:5966:1: enter_function: entry to ‘_mesa_NamedFramebufferSampleLocationsfvARB_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:5971:4: call_function: inlined call to ‘_mesa_lookup_framebuffer’ from ‘_mesa_NamedFramebufferSampleLocationsfvARB_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:5971:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/fbobject.c:5971:4: call_function: calling ‘sample_locations’ from ‘_mesa_NamedFramebufferSampleLocationsfvARB_no_error’
# 5873|      }
# 5874|   
# 5875|->    if (!fb->SampleLocationTable) {
# 5876|         size_t size = MAX_SAMPLE_LOCATION_TABLE_SIZE * 2 * sizeof(GLfloat);
# 5877|         fb->SampleLocationTable = malloc(size);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1214]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:365:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘result’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:339:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:340:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:340:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:343:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:344:24: branch_false: following ‘false’ branch (when ‘size == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:345:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:349:23: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:350:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:364:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:365:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:365:31: release_memory: ‘result’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/feedback.c:365:25: danger: dereference of NULL ‘result + (long unsigned int)index * 4’
#  363|            bool gpu_hit = false;
#  364|            if (metadata[1]) {
#  365|->             gpu_hit = !!result[index];
#  366|   
#  367|               if (gpu_hit) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1215]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:131:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:120:1: enter_function: entry to ‘_mesa_get_format_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:122:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:127:42: call_function: inlined call to ‘_mesa_get_format_info’ from ‘_mesa_get_format_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:131:11: danger: dereference of NULL ‘<unknown>’
#  129|      assert(info->BytesPerBlock <= MAX_PIXEL_BYTES ||
#  130|             _mesa_is_format_compressed(format));
#  131|->    return info->BytesPerBlock;
#  132|   }
#  133|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1216]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:151:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:151:14: danger: dereference of NULL ‘<unknown>’
#  149|      case GL_FRAMEBUFFER_ATTACHMENT_RED_SIZE:
#  150|      case GL_INTERNALFORMAT_RED_SIZE:
#  151|->       return info->RedBits;
#  152|      case GL_GREEN_BITS:
#  153|      case GL_TEXTURE_GREEN_SIZE:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1217]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:157:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:157:14: danger: dereference of NULL ‘<unknown>’
#  155|      case GL_FRAMEBUFFER_ATTACHMENT_GREEN_SIZE:
#  156|      case GL_INTERNALFORMAT_GREEN_SIZE:
#  157|->       return info->GreenBits;
#  158|      case GL_BLUE_BITS:
#  159|      case GL_TEXTURE_BLUE_SIZE:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1218]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:163:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:163:14: danger: dereference of NULL ‘<unknown>’
#  161|      case GL_FRAMEBUFFER_ATTACHMENT_BLUE_SIZE:
#  162|      case GL_INTERNALFORMAT_BLUE_SIZE:
#  163|->       return info->BlueBits;
#  164|      case GL_ALPHA_BITS:
#  165|      case GL_TEXTURE_ALPHA_SIZE:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1219]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:169:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:169:14: danger: dereference of NULL ‘<unknown>’
#  167|      case GL_FRAMEBUFFER_ATTACHMENT_ALPHA_SIZE:
#  168|      case GL_INTERNALFORMAT_ALPHA_SIZE:
#  169|->       return info->AlphaBits;
#  170|      case GL_TEXTURE_INTENSITY_SIZE:
#  171|         return info->IntensityBits;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1220]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:171:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:171:14: danger: dereference of NULL ‘<unknown>’
#  169|         return info->AlphaBits;
#  170|      case GL_TEXTURE_INTENSITY_SIZE:
#  171|->       return info->IntensityBits;
#  172|      case GL_TEXTURE_LUMINANCE_SIZE:
#  173|         return info->LuminanceBits;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1221]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:173:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:173:14: danger: dereference of NULL ‘<unknown>’
#  171|         return info->IntensityBits;
#  172|      case GL_TEXTURE_LUMINANCE_SIZE:
#  173|->       return info->LuminanceBits;
#  174|      case GL_INDEX_BITS:
#  175|         return 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1222]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:181:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:181:14: danger: dereference of NULL ‘<unknown>’
#  179|      case GL_FRAMEBUFFER_ATTACHMENT_DEPTH_SIZE:
#  180|      case GL_INTERNALFORMAT_DEPTH_SIZE:
#  181|->       return info->DepthBits;
#  182|      case GL_STENCIL_BITS:
#  183|      case GL_TEXTURE_STENCIL_SIZE:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1223]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:187:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:141:1: enter_function: entry to ‘_mesa_get_format_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:187:14: danger: dereference of NULL ‘<unknown>’
#  185|      case GL_FRAMEBUFFER_ATTACHMENT_STENCIL_SIZE:
#  186|      case GL_INTERNALFORMAT_STENCIL_SIZE:
#  187|->       return info->StencilBits;
#  188|      default:
#  189|         _mesa_problem(NULL, "bad pname in _mesa_get_format_bits()");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1224]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:199:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:196:1: enter_function: entry to ‘_mesa_get_format_max_bits’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:199:23: danger: dereference of NULL ‘<unknown>’
#  197|   {
#  198|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  199|->    unsigned int max = MAX2(info->RedBits, info->GreenBits);
#  200|      max = MAX2(max, info->BlueBits);
#  201|      max = MAX2(max, info->AlphaBits);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1225]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:217:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:652:1: enter_function: entry to ‘_mesa_is_format_s3tc’
#  215|   {
#  216|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  217|->    return info->Layout;
#  218|   }
#  219|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1226]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:235:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:232:1: enter_function: entry to ‘_mesa_get_format_datatype’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:235:11: danger: dereference of NULL ‘<unknown>’
#  233|   {
#  234|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  235|->    return info->DataType;
#  236|   }
#  237|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1227]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:324:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:320:1: enter_function: entry to ‘_mesa_get_format_base_format’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:322:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:323:45: call_function: inlined call to ‘_mesa_get_format_info’ from ‘_mesa_get_format_base_format’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:324:14: danger: dereference of NULL ‘<unknown>’
#  322|      if (!_mesa_format_is_mesa_array_format(format)) {
#  323|         const struct mesa_format_info *info = _mesa_get_format_info(format);
#  324|->       return info->BaseFormat;
#  325|      } else {
#  326|         return get_base_format_for_array_format(format);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1228]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:346:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:339:1: enter_function: entry to ‘_mesa_get_format_block_size’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:346:10: danger: dereference of NULL ‘<unknown>’
#  344|      assert(info->BlockDepth == 1);
#  345|   
#  346|->    *bw = info->BlockWidth;
#  347|      *bh = info->BlockHeight;
#  348|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1229]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:366:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:360:1: enter_function: entry to ‘_mesa_get_format_block_size_3d’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:366:10: danger: dereference of NULL ‘<unknown>’
#  364|   {
#  365|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  366|->    *bw = info->BlockWidth;
#  367|      *bh = info->BlockHeight;
#  368|      *bd = info->BlockDepth;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1230]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:395:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:392:1: enter_function: entry to ‘_mesa_get_format_swizzle’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:395:4: danger: dereference of NULL ‘<unknown>’
#  393|   {
#  394|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  395|->    memcpy(swizzle_out, info->Swizzle, sizeof(info->Swizzle));
#  396|   }
#  397|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1231]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:441:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:445:1: enter_function: entry to ‘_mesa_format_to_array_format’
#  439|      else
#  440|   #endif
#  441|->       return info->ArrayFormat;
#  442|   }
#  443|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1232]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:531:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:528:1: enter_function: entry to ‘_mesa_is_format_compressed’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:531:11: danger: dereference of NULL ‘<unknown>’
#  529|   {
#  530|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  531|->    return info->BlockWidth > 1 || info->BlockHeight > 1;
#  532|   }
#  533|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1233]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:543:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:539:1: enter_function: entry to ‘_mesa_is_format_packed_depth_stencil’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:543:11: danger: dereference of NULL ‘<unknown>’
#  541|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  542|   
#  543|->    return info->BaseFormat == GL_DEPTH_STENCIL;
#  544|   }
#  545|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1234]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:554:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:551:1: enter_function: entry to ‘_mesa_is_format_integer_color’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:554:12: danger: dereference of NULL ‘<unknown>’
#  552|   {
#  553|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  554|->    return (info->DataType == GL_INT || info->DataType == GL_UNSIGNED_INT) &&
#  555|         info->BaseFormat != GL_DEPTH_COMPONENT &&
#  556|         info->BaseFormat != GL_DEPTH_STENCIL &&

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1235]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:568:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:565:1: enter_function: entry to ‘_mesa_is_format_unsigned’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:568:34: danger: dereference of NULL ‘<unknown>’
#  566|   {
#  567|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  568|->    return _mesa_is_type_unsigned(info->DataType);
#  569|   }
#  570|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1236]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:585:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:576:1: enter_function: entry to ‘_mesa_is_format_signed’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:578:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:584:45: call_function: inlined call to ‘_mesa_get_format_info’ from ‘_mesa_is_format_signed’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:585:15: danger: dereference of NULL ‘<unknown>’
#  583|      else {
#  584|         const struct mesa_format_info *info = _mesa_get_format_info(format);
#  585|->       return (info->DataType == GL_SIGNED_NORMALIZED ||
#  586|                 info->DataType == GL_INT ||
#  587|                 info->DataType == GL_FLOAT);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1237]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:598:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:595:1: enter_function: entry to ‘_mesa_is_format_integer’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:598:12: danger: dereference of NULL ‘<unknown>’
#  596|   {
#  597|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  598|->    return (info->DataType == GL_INT || info->DataType == GL_UNSIGNED_INT);
#  599|   }
#  600|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1238]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:609:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:606:1: enter_function: entry to ‘_mesa_is_format_color_format’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:609:12: danger: dereference of NULL ‘<unknown>’
#  607|   {
#  608|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  609|->    switch (info->BaseFormat) {
#  610|      case GL_DEPTH_COMPONENT:
#  611|      case GL_STENCIL_INDEX:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1239]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:623:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:620:1: enter_function: entry to ‘_mesa_is_format_srgb’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:623:11: danger: dereference of NULL ‘<unknown>’
#  621|   {
#  622|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  623|->    return info->IsSRGBFormat;
#  624|   }
#  625|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1240]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:644:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:641:1: enter_function: entry to ‘_mesa_is_format_astc_2d’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:644:11: danger: dereference of NULL ‘<unknown>’
#  642|   {
#  643|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  644|->    return info->Layout == MESA_FORMAT_LAYOUT_ASTC && info->BlockDepth == 1;
#  645|   }
#  646|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1241]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:763:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:760:1: enter_function: entry to ‘_mesa_format_num_components’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:763:13: danger: dereference of NULL ‘<unknown>’
#  761|   {
#  762|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  763|->    return ((info->RedBits > 0) +
#  764|              (info->GreenBits > 0) +
#  765|              (info->BlueBits > 0) +

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1242]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:789:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:779:1: enter_function: entry to ‘_mesa_format_has_color_component’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:789:15: danger: dereference of NULL ‘<unknown>’
#  787|      switch (component) {
#  788|      case 0:
#  789|->       return (info->RedBits + info->IntensityBits + info->LuminanceBits) > 0;
#  790|      case 1:
#  791|         return (info->GreenBits + info->IntensityBits + info->LuminanceBits) > 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1243]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:791:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:779:1: enter_function: entry to ‘_mesa_format_has_color_component’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:791:15: danger: dereference of NULL ‘<unknown>’
#  789|         return (info->RedBits + info->IntensityBits + info->LuminanceBits) > 0;
#  790|      case 1:
#  791|->       return (info->GreenBits + info->IntensityBits + info->LuminanceBits) > 0;
#  792|      case 2:
#  793|         return (info->BlueBits + info->IntensityBits + info->LuminanceBits) > 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1244]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:793:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:779:1: enter_function: entry to ‘_mesa_format_has_color_component’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:793:15: danger: dereference of NULL ‘<unknown>’
#  791|         return (info->GreenBits + info->IntensityBits + info->LuminanceBits) > 0;
#  792|      case 2:
#  793|->       return (info->BlueBits + info->IntensityBits + info->LuminanceBits) > 0;
#  794|      case 3:
#  795|         return (info->AlphaBits + info->IntensityBits) > 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1245]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:795:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:779:1: enter_function: entry to ‘_mesa_format_has_color_component’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:795:15: danger: dereference of NULL ‘<unknown>’
#  793|         return (info->BlueBits + info->IntensityBits + info->LuminanceBits) > 0;
#  794|      case 3:
#  795|->       return (info->AlphaBits + info->IntensityBits) > 0;
#  796|      default:
#  797|         assert(!"Invalid color component: must be 0..3");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1246]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:814:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:808:1: enter_function: entry to ‘_mesa_format_image_size’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:814:8: danger: dereference of NULL ‘<unknown>’
#  812|      uint32_t sz;
#  813|      /* Strictly speaking, a conditional isn't needed here */
#  814|->    if (info->BlockWidth > 1 || info->BlockHeight > 1 || info->BlockDepth > 1) {
#  815|         /* compressed format (2D only for now) */
#  816|         const uint32_t bw = info->BlockWidth;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1247]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:842:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:836:1: enter_function: entry to ‘_mesa_format_image_size64’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:842:8: danger: dereference of NULL ‘<unknown>’
#  840|      uint64_t sz;
#  841|      /* Strictly speaking, a conditional isn't needed here */
#  842|->    if (info->BlockWidth > 1 || info->BlockHeight > 1 || info->BlockDepth > 1) {
#  843|         /* compressed format (2D only for now) */
#  844|         const uint64_t bw = info->BlockWidth;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1248]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:866:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:862:1: enter_function: entry to ‘_mesa_format_row_stride’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/formats.c:866:8: danger: dereference of NULL ‘<unknown>’
#  864|      const struct mesa_format_info *info = _mesa_get_format_info(format);
#  865|      /* Strictly speaking, a conditional isn't needed here */
#  866|->    if (info->BlockWidth > 1 || info->BlockHeight > 1) {
#  867|         /* compressed format */
#  868|         const uint32_t bw = info->BlockWidth;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1249]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:108:20: warning[-Wanalyzer-malloc-leak]: leak of ‘module’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:93:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:98:13: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:99:7: branch_false: following ‘false’ branch (when ‘module’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:104:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:108:20: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:108:20: danger: ‘module’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  106|      memcpy(&module->Binary[0], binary, length);
#  107|   
#  108|->    for (int i = 0; i < n; ++i) {
#  109|         struct gl_shader *sh = shaders[i];
#  110|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1250]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:255:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘spec_entries’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:251:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:254:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:255:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:255:7: danger: ‘spec_entries + (long unsigned int)i * 24’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  253|   
#  254|      for (unsigned i = 0; i < spirv_data->NumSpecializationConstants; ++i) {
#  255|->       spec_entries[i].id = spirv_data->SpecializationConstantsIndex[i];
#  256|         spec_entries[i].value.u32 = spirv_data->SpecializationConstantsValue[i];
#  257|         spec_entries[i].defined_on_module = false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1251]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:398:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘spec_entries’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:351:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:356:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:357:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:360:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:360:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:366:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:366:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:395:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:395:19: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:397:25: branch_true: following ‘true’ branch (when ‘i < numSpecializationConstants’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:398:42: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glspirv.c:398:7: danger: ‘spec_entries + (long unsigned int)i * 24’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/8)
#  396|   
#  397|      for (unsigned i = 0; i < numSpecializationConstants; ++i) {
#  398|->       spec_entries[i].id = pConstantIndex[i];
#  399|         spec_entries[i].value.u32 = pConstantValue[i];
#  400|         spec_entries[i].defined_on_module = false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1252]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:143:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘*ctx.GLThread.upload_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:88:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:92:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:99:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:116:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:118:7: release_memory: ‘*ctx.GLThread.upload_buffer’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:143:7: danger: dereference of NULL ‘new_upload_buffer(ctx, 1048576, &*(struct glthread_state *)((char *)ctx + 88).upload_ptr)’
#  141|          * This can increase performance by 20%.
#  142|          */
#  143|->       glthread->upload_buffer->RefCount += default_size;
#  144|         glthread->upload_buffer_private_refcount = default_size;
#  145|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1253]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:143:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:488:1: enter_function: entry to ‘_mesa_marshal_BufferSubData_merged’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:502:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:503:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:502:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:503:59: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:502:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:505:32: release_memory: ‘upload_buffer’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:508:7: call_function: calling ‘_mesa_glthread_upload’ from ‘_mesa_marshal_BufferSubData_merged’
#  141|          * This can increase performance by 20%.
#  142|          */
#  143|->       glthread->upload_buffer->RefCount += default_size;
#  144|         glthread->upload_buffer_private_refcount = default_size;
#  145|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1254]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:143:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘upload_buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:488:1: enter_function: entry to ‘_mesa_marshal_BufferSubData_merged’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:502:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:503:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:502:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:503:59: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:502:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:505:32: release_memory: ‘upload_buffer’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/glthread_bufferobj.c:508:7: call_function: calling ‘_mesa_glthread_upload’ from ‘_mesa_marshal_BufferSubData_merged’
#  141|          * This can increase performance by 20%.
#  142|          */
#  143|->       glthread->upload_buffer->RefCount += default_size;
#  144|         glthread->upload_buffer_private_refcount = default_size;
#  145|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1255]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1624:16: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: danger: dereference of NULL ‘_mesa_unpack_color_index_to_rgba_float(ctx,  dims,  src,  srcFormat,  srcType,  srcWidth,  srcHeight,  srcDepth,  srcPacking,  transferOps) + (long unsigned int)(i * 4) * 4’
# 1623|      dst = malloc(count * 4 * sizeof(GLubyte));
# 1624|      for (i = 0; i < count; i++) {
# 1625|->       CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 0], rgba[i * 4 + 0]);
# 1626|         CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 1], rgba[i * 4 + 1]);
# 1627|         CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 2], rgba[i * 4 + 2]);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1256]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘dst’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1606:1: enter_function: entry to ‘_mesa_unpack_color_index_to_rgba_ubyte’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1617:11: call_function: calling ‘_mesa_unpack_color_index_to_rgba_float’ from ‘_mesa_unpack_color_index_to_rgba_ubyte’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1617:11: return_function: returning to ‘_mesa_unpack_color_index_to_rgba_ubyte’ from ‘_mesa_unpack_color_index_to_rgba_float’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1623:10: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1624:16: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: danger: ‘dst + (long unsigned int)(i * 4)’ could be NULL: unchecked value from [(15)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/14)
# 1623|      dst = malloc(count * 4 * sizeof(GLubyte));
# 1624|      for (i = 0; i < count; i++) {
# 1625|->       CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 0], rgba[i * 4 + 0]);
# 1626|         CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 1], rgba[i * 4 + 1]);
# 1627|         CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 2], rgba[i * 4 + 2]);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1257]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1606:1: enter_function: entry to ‘_mesa_unpack_color_index_to_rgba_ubyte’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1617:11: call_function: calling ‘_mesa_unpack_color_index_to_rgba_float’ from ‘_mesa_unpack_color_index_to_rgba_ubyte’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1617:11: return_function: returning to ‘_mesa_unpack_color_index_to_rgba_ubyte’ from ‘_mesa_unpack_color_index_to_rgba_float’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1624:16: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/pack.c:1625:7: danger: use of uninitialized value ‘*<unknown>’ here
# 1623|      dst = malloc(count * 4 * sizeof(GLubyte));
# 1624|      for (i = 0; i < count; i++) {
# 1625|->       CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 0], rgba[i * 4 + 0]);
# 1626|         CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 1], rgba[i * 4 + 1]);
# 1627|         CLAMPED_FLOAT_TO_UBYTE(dst[i * 4 + 2], rgba[i * 4 + 2]);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1258]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3278:9: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘str’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3652:1: enter_function: entry to ‘_mesa_IsNamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3656:7: branch_false: following ‘false’ branch (when ‘name’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3659:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3659:20: call_function: calling ‘copy_string’ from ‘_mesa_IsNamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3659:20: return_function: returning to ‘_mesa_IsNamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3661:25: call_function: inlined call to ‘_mesa_lookup_shader_include’ from ‘_mesa_IsNamedStringARB’
# 3276|      int i = 0;
# 3277|   
# 3278|->    if (!str[i] || (!relative_path && str[i] != '/'))
# 3279|         return false;
# 3280|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1259]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3483:33: warning[-Wanalyzer-malloc-leak]: leak of ‘copy_string(ctx,  string,  stringlen, "glNamedStringARB")’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3491:1: enter_function: entry to ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3497:7: branch_false: following ‘false’ branch (when ‘type == 36270’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3504:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3510:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: call_function: calling ‘validate_and_tokenise_sh_incl’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: return_function: returning to ‘_mesa_NamedStringARB’ from ‘validate_and_tokenise_sh_incl’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: call_function: calling ‘simple_mtx_lock’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: return_function: returning to ‘_mesa_NamedStringARB’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3483:33: danger: ‘copy_string(ctx,  string,  stringlen, "glNamedStringARB")’ leaks here; was allocated at [(17)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/16)
# 3481|         cp = strdup(str);
# 3482|      else {
# 3483|->       cp = calloc(sizeof(char), str_len + 1);
# 3484|         memcpy(cp, str, str_len);
# 3485|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1260]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3504:8: warning[-Wanalyzer-malloc-leak]: leak of ‘copy_string(ctx,  string,  stringlen, "glNamedStringARB")’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3491:1: enter_function: entry to ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3497:7: branch_false: following ‘false’ branch (when ‘type == 36270’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3504:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3510:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: call_function: calling ‘validate_and_tokenise_sh_incl’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: return_function: returning to ‘_mesa_NamedStringARB’ from ‘validate_and_tokenise_sh_incl’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: call_function: calling ‘simple_mtx_lock’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: return_function: returning to ‘_mesa_NamedStringARB’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3504:8: danger: ‘copy_string(ctx,  string,  stringlen, "glNamedStringARB")’ leaks here; was allocated at [(17)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/16)
# 3502|      char *name_cp = copy_string(ctx, name, namelen, caller);
# 3503|      char *string_cp = copy_string(ctx, string, stringlen, caller);
# 3504|->    if (!name_cp || !string_cp) {
# 3505|         free(string_cp);
# 3506|         free(name_cp);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1261]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3534:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘sh_incl_ht_entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3491:1: enter_function: entry to ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3497:7: branch_false: following ‘false’ branch (when ‘type == 36270’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3504:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3510:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: call_function: calling ‘validate_and_tokenise_sh_incl’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: return_function: returning to ‘_mesa_NamedStringARB’ from ‘validate_and_tokenise_sh_incl’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: call_function: calling ‘simple_mtx_lock’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: return_function: returning to ‘_mesa_NamedStringARB’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3527:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3529:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3532:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3533:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3533:29: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3534:10: danger: ‘sh_incl_ht_entry’ could be NULL: unchecked value from [(36)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/35)
# 3532|         if (!ht_entry) {
# 3533|            sh_incl_ht_entry = calloc(1, sizeof(struct sh_incl_path_ht_entry));
# 3534|->          sh_incl_ht_entry->path =
# 3535|               _mesa_hash_table_create(NULL, _mesa_hash_string,
# 3536|                                       _mesa_key_string_equal);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1262]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3537:10: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup(*entry.path)’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3491:1: enter_function: entry to ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3497:7: branch_false: following ‘false’ branch (when ‘type == 36270’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3502:20: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: call_function: calling ‘copy_string’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3503:22: return_function: returning to ‘_mesa_NamedStringARB’ from ‘copy_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3504:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3510:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: call_function: calling ‘validate_and_tokenise_sh_incl’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:9: return_function: returning to ‘_mesa_NamedStringARB’ from ‘validate_and_tokenise_sh_incl’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3513:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: call_function: calling ‘simple_mtx_lock’ from ‘_mesa_NamedStringARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3521:4: return_function: returning to ‘_mesa_NamedStringARB’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3527:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3529:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3532:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3533:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3537:43: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/shaderapi.c:3537:10: danger: ‘strdup(*entry.path)’ leaks here; was allocated at [(36)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/35)
# 3535|               _mesa_hash_table_create(NULL, _mesa_hash_string,
# 3536|                                       _mesa_key_string_equal);
# 3537|->          _mesa_hash_table_insert(path_ht, strdup(entry->path),
# 3538|                                    sh_incl_ht_entry);
# 3539|         } else {

Error: COMPILER_WARNING: [#def1263]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/sse_minmax.c:70:20: note[note]: called from here
#   68|         for (i = 0; i < vec_count / 4; i++) {
#   69|            ui_indices4 = _mm_load_si128(&ui_indices_ptr[i]);
#   70|->          max_ui4 = _mm_max_epu32(ui_indices4, max_ui4);
#   71|            min_ui4 = _mm_min_epu32(ui_indices4, min_ui4);
#   72|         }

Error: COMPILER_WARNING: [#def1264]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/sse_minmax.c:71:20: note[note]: called from here
#   69|            ui_indices4 = _mm_load_si128(&ui_indices_ptr[i]);
#   70|            max_ui4 = _mm_max_epu32(ui_indices4, max_ui4);
#   71|->          min_ui4 = _mm_min_epu32(ui_indices4, min_ui4);
#   72|         }
#   73|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1265]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/syncobj.c:202:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘syncObj’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/syncobj.c:440:1: enter_function: entry to ‘_mesa_WaitSync_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/syncobj.c:445:4: call_function: calling ‘wait_sync’ from ‘_mesa_WaitSync_no_error’
#  200|   
#  201|      simple_mtx_lock(&ctx->Shared->Mutex);
#  202|->    syncObj->RefCount -= amount;
#  203|      if (syncObj->RefCount == 0) {
#  204|         entry = _mesa_set_search(ctx->Shared->SyncObjects, syncObj);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1266]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/syncobj.c:422:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘syncObj’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/syncobj.c:440:1: enter_function: entry to ‘_mesa_WaitSync_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/syncobj.c:445:4: call_function: calling ‘wait_sync’ from ‘_mesa_WaitSync_no_error’
#  420|      /* If the fence doesn't exist, assume it's signalled. */
#  421|      simple_mtx_lock(&syncObj->mutex);
#  422|->    if (!syncObj->fence) {
#  423|         simple_mtx_unlock(&syncObj->mutex);
#  424|         syncObj->StatusFlag = GL_TRUE;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1267]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:57:28: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*curaddr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:79:1: enter_function: entry to ‘_mesa_texstore_red_rgtc1’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:95:7: branch_false: following ‘false’ branch (when ‘tempImage’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:98:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:111:16: branch_true: following ‘true’ branch (when ‘j < srcHeight’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:112:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:115:19: branch_true: following ‘true’ branch (when ‘i < srcWidth’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:116:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:118:10: call_function: calling ‘extractsrc_u’ from ‘_mesa_texstore_red_rgtc1’
#   55|         curaddr = srcaddr + j * srcRowStride * comps;
#   56|         for (i = 0; i < numxpixels; i++) {
#   57|->          srcpixels[j][i] = *curaddr;
#   58|            curaddr += comps;
#   59|         }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1268]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:71:28: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*curaddr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:132:1: enter_function: entry to ‘_mesa_texstore_signed_red_rgtc1’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:149:7: branch_false: following ‘false’ branch (when ‘tempImage’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:151:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:164:16: branch_true: following ‘true’ branch (when ‘j < srcHeight’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:165:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:168:19: branch_true: following ‘true’ branch (when ‘i < srcWidth’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:169:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_rgtc.c:171:10: call_function: calling ‘extractsrc_s’ from ‘_mesa_texstore_signed_red_rgtc1’
#   69|         curaddr = srcaddr + j * srcRowStride * comps;
#   70|         for (i = 0; i < numxpixels; i++) {
#   71|->          srcpixels[j][i] = *curaddr;
#   72|            curaddr += comps;
#   73|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1269]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texobj.c:2273:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texobj.c:2257:7: branch_true: following ‘true’ branch (when ‘image’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texobj.c:2273:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texobj.c:2273:15: danger: dereference of NULL ‘invalidate_tex_image_error_check(ctx,  texture,  level, "glInvalidateTexSubImage")’
# 2271|          *     equal to one."
# 2272|          */
# 2273|->       switch (t->Target) {
# 2274|         case GL_TEXTURE_BUFFER:
# 2275|            xBorder = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1270]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:290:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:644:1: enter_function: entry to ‘_mesa_GetTextureSamplerHandleARB_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:658:11: call_function: calling ‘get_texture_handle’ from ‘_mesa_GetTextureSamplerHandleARB_no_error’
#  288|      texHandleObj->sampObj = separate_sampler ? sampObj : NULL;
#  289|      texHandleObj->handle = handle;
#  290|->    util_dynarray_append(&texObj->SamplerHandles,
#  291|                           struct gl_texture_handle_object *, texHandleObj);
#  292|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1271]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:295:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:662:1: enter_function: entry to ‘_mesa_GetTextureSamplerHandleARB’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:681:7: branch_true: following ‘true’ branch (when ‘texture != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:682:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:684:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:695:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:696:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:709:35: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:719:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:725:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:725:11: call_function: calling ‘get_texture_handle’ from ‘_mesa_GetTextureSamplerHandleARB’
#  293|      if (separate_sampler) {
#  294|         /* Store the handle into the separate sampler if needed. */
#  295|->       util_dynarray_append(&sampObj->Handles,
#  296|                              struct gl_texture_handle_object *, texHandleObj);
#  297|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1272]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:386:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:821:1: enter_function: entry to ‘_mesa_GetImageHandleARB_no_error’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texturebindless.c:833:11: call_function: calling ‘get_image_handle’ from ‘_mesa_GetImageHandleARB_no_error’
#  384|      memcpy(&imgHandleObj->imgObj, &imgObj, sizeof(struct gl_image_unit));
#  385|      imgHandleObj->handle = handle;
#  386|->    util_dynarray_append(&texObj->ImageHandles,
#  387|                           struct gl_image_handle_object *, imgHandleObj);
#  388|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1273]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_cache.c:203:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘c’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_cache.c:201:27: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_cache.c:203:4: danger: ‘c’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  201|      struct cache_item *c = CALLOC_STRUCT(cache_item);
#  202|   
#  203|->    c->hash = hash;
#  204|   
#  205|      c->key = malloc(keysize);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1274]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:216:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘chans[3]’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:803:1: enter_function: entry to ‘prog_to_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:812:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:814:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:833:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:836:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:837:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/prog_to_nir.c:837:7: call_function: calling ‘ptn_emit_instruction’ from ‘prog_to_nir’
#  214|               chans[i] = nir_fneg(b, chans[i]);
#  215|         }
#  216|->       def = nir_vec4(b, chans[0], chans[1], chans[2], chans[3]);
#  217|      }
#  218|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1275]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:131:12: warning[-Wanalyzer-malloc-leak]: leak of ‘*lval.inst’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:1507:1: enter_function: entry to ‘_mesa_program_lexer_lex’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:188:3: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:188:3: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:188:3: call_function: calling ‘handle_ident’ from ‘_mesa_program_lexer_lex’
#  129|      lval->string = strdup(text);
#  130|   
#  131|->    return (_mesa_symbol_table_find_symbol(state->st, text) == NULL)
#  132|         ? IDENTIFIER : USED_IDENTIFIER;
#  133|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1276]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:483:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:473:1: enter_function: entry to ‘st_nir_lower_atifs_samplers_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:480:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:482:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:482:27: call_function: calling ‘nir_deref_instr_get_variable’ from ‘st_nir_lower_atifs_samplers_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:482:27: return_function: returning to ‘st_nir_lower_atifs_samplers_instr’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atifs_to_nir.c:483:32: danger: dereference of NULL ‘nir_deref_instr_get_variable(instr)’
#  481|         nir_deref_instr *deref = nir_instr_as_deref(instr);
#  482|         nir_variable *var = nir_deref_instr_get_variable(deref);
#  483|->       if (glsl_type_is_sampler(var->type))
#  484|            deref->type = var->type;
#  485|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1277]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atom_sampler.c:73:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘texobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atom_sampler.c:406:1: enter_function: entry to ‘st_update_compute_samplers’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atom_sampler.c:410:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atom_sampler.c:411:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_atom_sampler.c:411:7: call_function: calling ‘update_shader_samplers’ from ‘st_update_compute_samplers’
#   71|      sampler->seamless_cube_map |= seamless_cube_map;
#   72|   
#   73|->    if (texobj->_IsIntegerFormat ||
#   74|          (texobj->_IsFloat && st->ctx->Const.ForceFloat32TexNearest)) {
#   75|         sampler->min_img_filter = PIPE_TEX_FILTER_NEAREST;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1278]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:201:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:191:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:201:4: danger: ‘fs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  199|      fs->stage.reset_stipple_counter = feedback_reset_stipple_counter;
#  200|      fs->stage.destroy = feedback_destroy;
#  201|->    fs->ctx = ctx;
#  202|   
#  203|      return &fs->stage;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1279]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:203:11: warning[-Wanalyzer-malloc-leak]: leak of ‘fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:191:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:203:11: danger: ‘fs’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  201|      fs->ctx = ctx;
#  202|   
#  203|->    return &fs->stage;
#  204|   }
#  205|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1280]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:274:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:264:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:274:4: danger: ‘fs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  272|      fs->stage.reset_stipple_counter = select_reset_stipple_counter;
#  273|      fs->stage.destroy = select_destroy;
#  274|->    fs->ctx = ctx;
#  275|   
#  276|      return &fs->stage;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1281]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:276:11: warning[-Wanalyzer-malloc-leak]: leak of ‘fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:264:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_feedback.c:276:11: danger: ‘fs’ leaks here; was allocated at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  274|      fs->ctx = ctx;
#  275|   
#  276|->    return &fs->stage;
#  277|   }
#  278|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1282]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_rasterpos.c:205:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘rs’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_rasterpos.c:194:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_rasterpos.c:205:4: danger: ‘rs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  203|      rs->stage.reset_stipple_counter = rastpos_reset_stipple_counter;
#  204|      rs->stage.destroy = rastpos_destroy;
#  205|->    rs->ctx = ctx;
#  206|   
#  207|      rs->VAO = _mesa_new_vao(ctx, ~((GLuint)0));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1283]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_texture.c:538:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*texImage.compressed_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_texture.c:537:32: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_cb_texture.c:538:4: danger: ‘calloc(1, 16)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  536|   
#  537|      texImage->compressed_data = CALLOC_STRUCT(st_compressed_data);
#  538|->    texImage->compressed_data->ptr =
#  539|         malloc(data_size * _mesa_num_tex_faces(texImage->TexObject->Target));
#  540|      pipe_reference_init(&texImage->compressed_data->reference, 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1284]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:440:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘st’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:802:1: enter_function: entry to ‘st_create_context’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:809:34: branch_false: following ‘false’ branch (when ‘share’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:813:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:817:10: call_function: calling ‘os_malloc_aligned’ from ‘st_create_context’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:817:10: return_function: returning to ‘st_create_context’ from ‘os_malloc_aligned’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:818:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:820:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:825:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:831:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_context.c:848:9: call_function: calling ‘st_create_context_priv’ from ‘st_create_context’
#  438|      struct st_context *st = CALLOC_STRUCT( st_context);
#  439|   
#  440|->    st->options = *options;
#  441|   
#  442|      ctx->st_opts = &st->options;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1285]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:94:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:759:1: enter_function: entry to ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:761:26: call_function: calling ‘make_state_key’ from ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:761:26: return_function: returning to ‘st_draw_hw_select_prepare_mode’ from ‘make_state_key’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:762:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:765:28: call_function: inlined call to ‘st_context’ from ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:772:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:773:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:773:12: call_function: calling ‘hw_select_create_gs’ from ‘st_draw_hw_select_prepare_mode’
#   92|      nir_def *is_nan_or_inf = NULL;
#   93|      for (int i = 0; i < num_in_vert; i++) {
#   94|->       v[i] = nir_load_per_vertex_input(b, 4, 32, nir_imm_int(b, i),
#   95|                                          nir_imm_int(b, 0),
#   96|                                          .io_semantics.location = VARYING_SLOT_POS);

Error: GCC_ANALYZER_WARNING (CWE-126): [#def1286]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:170:23: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:759:1: enter_function: entry to ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:761:26: call_function: calling ‘make_state_key’ from ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:761:26: return_function: returning to ‘st_draw_hw_select_prepare_mode’ from ‘make_state_key’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:762:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:765:28: call_function: inlined call to ‘st_context’ from ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:772:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:773:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:773:12: call_function: calling ‘hw_select_create_gs’ from ‘st_draw_hw_select_prepare_mode’
#  168|   
#  169|         for (int j = 0; j < b->shader->info.gs.vertices_in; j++) {
#  170|->          nir_def *c = nir_channel(b, v[j], i >> 1);
#  171|            if (i & 1)
#  172|               c = nir_fneg(b, c);

Error: GCC_ANALYZER_WARNING (CWE-126): [#def1287]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:174:23: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:759:1: enter_function: entry to ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:761:26: call_function: calling ‘make_state_key’ from ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:761:26: return_function: returning to ‘st_draw_hw_select_prepare_mode’ from ‘make_state_key’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:762:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:765:28: call_function: inlined call to ‘st_context’ from ‘st_draw_hw_select_prepare_mode’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:772:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:773:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_draw_hw_select.c:773:12: call_function: calling ‘hw_select_create_gs’ from ‘st_draw_hw_select_prepare_mode’
#  172|               c = nir_fneg(b, c);
#  173|   
#  174|->          nir_def *r = nir_flt(b, nir_channel(b, v[j], 3), c);
#  175|            outside = j ? nir_iand(b, outside, r) : r;
#  176|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1288]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:169:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:157:1: enter_function: entry to ‘lower_builtin_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:160:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:163:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘lower_builtin_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:164:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:168:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:168:24: call_function: calling ‘nir_deref_instr_get_variable’ from ‘lower_builtin_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:168:24: return_function: returning to ‘lower_builtin_instr’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_builtin.c:169:16: danger: dereference of NULL ‘nir_deref_instr_get_variable(<unknown>)’
#  167|      /* built-in's will always start with "gl_" */
#  168|      nir_variable *var = nir_deref_instr_get_variable(deref);
#  169|->    if (strncmp(var->name, "gl_", 3) != 0)
#  170|         return false;
#  171|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1289]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_tex_src_plane.c:69:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_tex_src_plane.c:164:1: enter_function: entry to ‘st_nir_lower_tex_src_plane’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_nir_lower_tex_src_plane.c:173:4: call_function: calling ‘assign_extra_samplers’ from ‘st_nir_lower_tex_src_plane’
#   67|      char *name;
#   68|   
#   69|->    UNUSED int r = asprintf(&name, "%s:%s", orig_sampler->name, ext);
#   70|      new_sampler = nir_variable_create(state->shader, nir_var_uniform,
#   71|                                samplerExternalOES, name);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1290]
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_program.c:777:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘v’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_program.c:1500:1: enter_function: entry to ‘st_finalize_program’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/state_tracker/st_program.c:1542:11: call_function: calling ‘st_precompile_shader_variant’ from ‘st_finalize_program’
#  775|      struct gl_program_parameter_list *params = prog->Parameters;
#  776|   
#  777|->    v->key = *key;
#  778|   
#  779|      state.stream_output = prog->state.stream_output;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1291]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:237:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘block’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:486:1: enter_function: entry to ‘nak_nir_lower_cf’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:490:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:490:4: branch_true: following ‘true’ branch (when ‘func’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:491:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:491:11: call_function: calling ‘lower_cf_func’ from ‘nak_nir_lower_cf’
#  235|   {
#  236|      /* If it's unreachable, there is no merge */
#  237|->    if (block->imm_dom == NULL)
#  238|         return false;
#  239|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1292]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:100:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘nus.pred’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:473:1: enter_function: entry to ‘nak_nir_lower_non_uniform_ldcx’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:476:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nak_nir_lower_non_uniform_ldcx’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:476:30: return_function: returning to ‘nak_nir_lower_non_uniform_ldcx’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:482:20: call_function: calling ‘lower_cf_list’ from ‘nak_nir_lower_non_uniform_ldcx’
#   98|   def_needs_hoist(nir_def *def, nir_block *target)
#   99|   {
#  100|->    return def->parent_instr->block->index > target->index;
#  101|   }
#  102|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1293]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:100:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘target’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:473:1: enter_function: entry to ‘nak_nir_lower_non_uniform_ldcx’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:476:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nak_nir_lower_non_uniform_ldcx’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:476:30: return_function: returning to ‘nak_nir_lower_non_uniform_ldcx’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_non_uniform_ldcx.c:482:20: call_function: calling ‘lower_cf_list’ from ‘nak_nir_lower_non_uniform_ldcx’
#   98|   def_needs_hoist(nir_def *def, nir_block *target)
#   99|   {
#  100|->    return def->parent_instr->block->index > target->index;
#  101|   }
#  102|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1294]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:15:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘tex_h’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:761:1: enter_function: entry to ‘nak_nir_lower_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:763:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’
#   13|   tex_handle_as_cbuf(nir_def *tex_h, uint32_t *cbuf_out)
#   14|   {
#   15|->    if (tex_h->parent_instr->type != nir_instr_type_intrinsic)
#   16|         return false;
#   17|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1295]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:312:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘binds’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:303:7: branch_false: following ‘false’ branch (when ‘bind_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:306:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:306:4: branch_false: following ‘false’ branch (when ‘bind_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:306:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:306:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:308:25: branch_true: following ‘true’ branch (when ‘i < bind_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:309:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:316:17: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:318:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_buffer.c:312:7: danger: ‘binds + (long unsigned int)i * 48’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  310|         VK_FROM_HANDLE(nvk_device_memory, mem, bind->memory);
#  311|   
#  312|->       binds[i] = (struct nvkmd_ctx_bind) {
#  313|            .op = mem ? NVKMD_BIND_OP_BIND : NVKMD_BIND_OP_UNBIND,
#  314|            .va = buffer->va,

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1296]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_cmd_buffer.c:159:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_cmd_buffer.c:631:1: enter_function: entry to ‘nvk_CmdPipelineBarrier2’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_cmd_buffer.c:636:4: call_function: calling ‘nvk_cmd_flush_wait_dep’ from ‘nvk_CmdPipelineBarrier2’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  157|            .incomplete = incomplete,
#  158|         };
#  159|->       util_dynarray_append(&cmd->pushes, struct nvk_cmd_push, push);
#  160|      }
#  161|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1297]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_cmd_draw.c:1628:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘last_vtgm’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_cmd_draw.c:4537:1: enter_function: entry to ‘nvk_CmdDrawIndirectByteCountEXT’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_cmd_draw.c:4548:4: call_function: calling ‘nvk_cmd_flush_gfx_state’ from ‘nvk_CmdDrawIndirectByteCountEXT’
# 1626|   
# 1627|         assert(last_vtgm->vtgm_push_dw_count > last_vtgm->push_dw_count);
# 1628|->       const uint16_t dw_start = last_vtgm->push_dw_count;
# 1629|         const uint16_t dw_count = last_vtgm->vtgm_push_dw_count - dw_start;
# 1630|         struct nv_push *p = nvk_cmd_buffer_push(cmd, dw_count);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1298]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_codegen.c:198:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_codegen.c:189:1: enter_function: entry to ‘lower_image_size_to_txs’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_codegen.c:197:27: call_function: inlined call to ‘nir_src_as_deref’ from ‘lower_image_size_to_txs’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_codegen.c:198:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_codegen.c:198:19: danger: dereference of NULL ‘<unknown>’
#  196|   
#  197|      nir_deref_instr *img = nir_src_as_deref(intrin->src[0]);
#  198|->    nir_def *lod = nir_tex_type_has_lod(img->type) ?
#  199|                         intrin->src[1].ssa : NULL;
#  200|      nir_def *size = nir_txs_deref(b, img, lod);

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1299]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set.c:88:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set.c:998:1: enter_function: entry to ‘nvk_GetDescriptorEXT’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set.c:1016:7: call_function: calling ‘get_sampled_image_view_desc’ from ‘nvk_GetDescriptorEXT’
#   86|            uint8_t sampler_plane = MIN2(plane, sampler->plane_count - 1);
#   87|            assert(sampler->planes[sampler_plane].desc_index < (1 << 12));
#   88|->          desc[plane].sampler_index = sampler->planes[sampler_plane].desc_index;
#   89|         }
#   90|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1300]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:108:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:384:1: enter_function: entry to ‘nvk_GetDescriptorSetLayoutSupport’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:392:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_GetDescriptorSetLayoutSupport’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:392:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_GetDescriptorSetLayoutSupport’
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:395:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_GetDescriptorSetLayoutSupport’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:395:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_GetDescriptorSetLayoutSupport’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:403:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:403:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:404:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:406:10: call_function: inlined call to ‘nvk_descriptor_get_type_list’ from ‘nvk_GetDescriptorSetLayoutSupport’
#  106|         assert(info != NULL);
#  107|         assert(info_idx < info->mutableDescriptorTypeListCount);
#  108|->       type_list = &info->pMutableDescriptorTypeLists[info_idx];
#  109|      }
#  110|      return type_list;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1301]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:171:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:131:1: enter_function: entry to ‘nvk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:161:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘nvk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:162:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘nvk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:164:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘nvk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:167:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:170:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:170:10: release_memory: ‘layout’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_descriptor_set_layout.c:171:4: danger: dereference of NULL ‘layout’
#  169|   
#  170|      layout->vk.destroy = nvk_descriptor_set_layout_destroy;
#  171|->    layout->flags = pCreateInfo->flags;
#  172|      layout->binding_count = num_bindings;
#  173|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1302]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:294:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:268:1: enter_function: entry to ‘nvk_MapMemory2KHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:276:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:281:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:290:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:292:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:292:10: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_MapMemory2KHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:292:10: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_MapMemory2KHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:294:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_device_memory.c:294:7: danger: dereference of NULL ‘<unknown>’
#  292|            vk_find_struct_const(pMemoryMapInfo->pNext, MEMORY_MAP_PLACED_INFO_EXT);
#  293|         map_flags |= NVKMD_MEM_MAP_FIXED;
#  294|->       fixed_addr = placed_info->pPlacedAddress;
#  295|      }
#  296|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1303]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1233:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1224:1: enter_function: entry to ‘nvk_GetImageMemoryRequirements2’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1232:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_GetImageMemoryRequirements2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1232:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_GetImageMemoryRequirements2’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1234:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1234:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1233:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1233:29: danger: dereference of NULL ‘<unknown>’
# 1231|      const VkImagePlaneMemoryRequirementsInfo *plane_info =
# 1232|         vk_find_struct_const(pInfo->pNext, IMAGE_PLANE_MEMORY_REQUIREMENTS_INFO);
# 1233|->    const VkImageAspectFlags aspects =
# 1234|         image->disjoint ? plane_info->planeAspect : image->vk.aspects;
# 1235|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1304]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1520:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1475:1: enter_function: entry to ‘nvk_bind_image_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1495:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_bind_image_memory’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1495:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_bind_image_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1497:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1497:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1515:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1516:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1518:10: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_bind_image_memory’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1518:10: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_bind_image_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1520:51: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1520:51: danger: dereference of NULL ‘<unknown>’
# 1518|            vk_find_struct_const(info->pNext, BIND_IMAGE_PLANE_MEMORY_INFO);
# 1519|         const uint8_t plane =
# 1520|->          nvk_image_memory_aspects_to_plane(image, plane_info->planeAspect);
# 1521|         result = nvk_image_plane_bind(dev, image, &image->planes[plane],
# 1522|                                       mem, &offset_B);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1305]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1655:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘nvkmd_binds’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1629:4: branch_false: following ‘false’ branch (when ‘nvkmd_bind_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1629:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1629:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1635:28: branch_true: following ‘true’ branch (when ‘z_tl < <unknown>’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1637:31: branch_true: following ‘true’ branch (when ‘y_tl < <unknown>’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1642:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1660:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1662:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1655:10: danger: ‘nvkmd_binds + (long unsigned int)nvkmd_bind_idx * 48’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
# 1653|               image_z_tl * level_extent_tl.width * level_extent_tl.height;
# 1654|   
# 1655|->          nvkmd_binds[nvkmd_bind_idx++] = (struct nvkmd_ctx_bind) {
# 1656|               .op = mem ? NVKMD_BIND_OP_BIND : NVKMD_BIND_OP_UNBIND,
# 1657|               .va = plane->va,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1306]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1838:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘nvkmd_binds’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1800:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1805:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1816:4: branch_false: following ‘false’ branch (when ‘nvkmd_bind_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1816:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1816:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1819:31: branch_true: following ‘true’ branch (when ‘a < end_a’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1822:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1842:17: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1843:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:1838:7: danger: ‘nvkmd_binds + (long unsigned int)nvkmd_bind_idx * 48’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/4)
# 1836|            mip_tail_offset_B + (a * mip_tail_stride_B) + a_offset_B;
# 1837|   
# 1838|->       nvkmd_binds[nvkmd_bind_idx++] = (struct nvkmd_ctx_bind) {
# 1839|            .op = mem ? NVKMD_BIND_OP_BIND : NVKMD_BIND_OP_UNBIND,
# 1840|            .va = plane->va,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1307]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_indirect_execution_set.c:26:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_indirect_execution_set.c:189:1: enter_function: entry to ‘nvk_ies_set_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_indirect_execution_set.c:196:10: call_function: inlined call to ‘vk_pipeline_get_shader’ from ‘nvk_ies_set_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_indirect_execution_set.c:199:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_indirect_execution_set.c:199:7: call_function: calling ‘nvk_ies_set_cs’ from ‘nvk_ies_set_pipeline’
#   24|   {
#   25|      struct nak_qmd_info qmd_info = {
#   26|->       .addr = shader->hdr_addr,
#   27|         .smem_size = shader->info.cs.smem_size,
#   28|         .smem_max = NVK_MAX_SHARED_SIZE,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1308]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:181:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:364:1: enter_function: entry to ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:389:35: call_function: inlined call to ‘nir_src_as_deref’ from ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:390:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:390:10: call_function: calling ‘record_deref_descriptor_cbuf_use’ from ‘record_cbuf_uses_instr’
#  179|   {
#  180|      nir_src *index_src = NULL;
#  181|->    if (deref->deref_type == nir_deref_type_array) {
#  182|         index_src = &deref->arr.index;
#  183|         deref = nir_deref_instr_parent(deref);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1309]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:236:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:364:1: enter_function: entry to ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:377:35: call_function: inlined call to ‘nir_src_as_deref’ from ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:378:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:379:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:379:13: call_function: calling ‘record_load_ubo_cbuf_uses’ from ‘record_cbuf_uses_instr’
#  234|      uint64_t range = glsl_get_explicit_size(deref->type, false);
#  235|      bool offset_valid = true;
#  236|->    while (deref->deref_type != nir_deref_type_cast) {
#  237|         nir_deref_instr *parent = nir_deref_instr_parent(deref);
#  238|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1310]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:250:37: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:364:1: enter_function: entry to ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:377:35: call_function: inlined call to ‘nir_src_as_deref’ from ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:378:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:379:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:379:13: call_function: calling ‘record_load_ubo_cbuf_uses’ from ‘record_cbuf_uses_instr’
#  248|               offset += nir_src_as_uint(deref->arr.index) * stride;
#  249|            } else {
#  250|->             range = glsl_get_length(parent->type) * stride;
#  251|            }
#  252|            break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1311]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:264:49: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:364:1: enter_function: entry to ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:377:35: call_function: inlined call to ‘nir_src_as_deref’ from ‘record_cbuf_uses_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:378:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:379:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_nir_lower_descriptors.c:379:13: call_function: calling ‘record_load_ubo_cbuf_uses’ from ‘record_cbuf_uses_instr’
#  262|   
#  263|         case nir_deref_type_struct: {
#  264|->          offset += glsl_get_struct_field_offset(parent->type,
#  265|                                                   deref->strct.index);
#  266|            break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1312]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:319:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘execs’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:362:1: enter_function: entry to ‘nvk_queue_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:368:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:371:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:371:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:372:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:371:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:373:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:371:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:379:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:379:16: call_function: calling ‘nvk_queue_submit_exec’ from ‘nvk_queue_submit’
#  317|               continue;
#  318|   
#  319|->          execs[exec_count++] = (struct nvkmd_ctx_exec) {
#  320|               .addr = push->addr,
#  321|               .size_B = push->range,

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1313]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:406:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘dw’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:435:1: enter_function: entry to ‘nvk_queue_init_context_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:447:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:458:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:458:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:464:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:470:42: call_function: inlined call to ‘nv_push_dw_count’ from ‘nvk_queue_init_context_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_queue.c:470:11: call_function: calling ‘nvk_queue_submit_simple’ from ‘nvk_queue_init_context_state’
#  404|         return result;
#  405|   
#  406|->    memcpy(push_mem->map, dw, dw_count * 4);
#  407|   
#  408|      const struct nvkmd_ctx_exec exec = {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1314]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:276:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘bc_srgb[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:286:1: enter_function: entry to ‘nvk_CreateSampler’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:297:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_CreateSampler’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:297:7: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_CreateSampler’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:300:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:301:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:305:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:309:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvk_sampler.c:311:7: call_function: calling ‘nvk_sampler_fill_header’ from ‘nvk_CreateSampler’
#  274|   
#  275|      SAMP_SET_U(samp, NV9097, 2, S_R_G_B_BORDER_COLOR_R, bc_srgb[0]);
#  276|->    SAMP_SET_U(samp, NV9097, 3, S_R_G_B_BORDER_COLOR_G, bc_srgb[1]);
#  277|      SAMP_SET_U(samp, NV9097, 3, S_R_G_B_BORDER_COLOR_B, bc_srgb[2]);
#  278|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1315]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:36:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:112:1: enter_function: entry to ‘nvkmd_nouveau_exec_ctx_wait’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:119:25: branch_true: following ‘true’ branch (when ‘i < wait_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:124:57: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:120:25: call_function: inlined call to ‘nvkmd_nouveau_ctx_add_sync’ from ‘nvkmd_nouveau_exec_ctx_wait’
#   34|         .flags = sync_value ? DRM_NOUVEAU_SYNC_TIMELINE_SYNCOBJ :
#   35|                               DRM_NOUVEAU_SYNC_SYNCOBJ,
#   36|->       .handle = syncobj->syncobj,
#   37|         .timeline_value = sync_value,
#   38|      };

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1316]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:304:4: warning[-Wanalyzer-malloc-leak]: leak of ‘ctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:286:41: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:287:7: branch_false: following ‘false’ branch (when ‘ctx’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:290:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:304:4: danger: ‘ctx’ leaks here; was allocated at [(1)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/0)
#  302|      };
#  303|   
#  304|->    *ctx_out = &ctx->base;
#  305|   
#  306|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1317]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:45:14: warning[-Wanalyzer-malloc-leak]: leak of ‘pdev’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:44:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:47:12: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:49:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:71:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:71:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:74:39: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:75:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:78:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:78:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:85:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:85:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:91:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:93:38: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:94:7: branch_false: following ‘false’ branch (when ‘pdev’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:99:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_pdev.c:45:14: danger: ‘pdev’ leaks here; was allocated at [(13)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/12)
#   43|   {
#   44|      if (!(drm_device->available_nodes & (1 << DRM_NODE_RENDER)))
#   45|->       return VK_ERROR_INCOMPATIBLE_DRIVER;
#   46|   
#   47|      switch (drm_device->bustype) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1318]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:159:4: warning[-Wanalyzer-malloc-leak]: leak of ‘va’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:115:1: enter_function: entry to ‘nvkmd_nouveau_alloc_va’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:124:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:125:7: branch_false: following ‘false’ branch (when ‘va’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:128:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:136:13: call_function: calling ‘alloc_heap_addr’ from ‘nvkmd_nouveau_alloc_va’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:136:13: return_function: returning to ‘nvkmd_nouveau_alloc_va’ from ‘alloc_heap_addr’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:138:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:141:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_va.c:159:4: danger: ‘va’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  157|      va->base.size_B = size_B;
#  158|   
#  159|->    *va_out = &va->base;
#  160|   
#  161|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1319]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:128:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:124:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:127:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:127:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:128:4: danger: ‘bo’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  126|   
#  127|      struct nouveau_ws_bo *bo = CALLOC_STRUCT(nouveau_ws_bo);
#  128|->    bo->size = size;
#  129|      bo->handle = req.info.handle;
#  130|      bo->map_handle = req.info.map_handle;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1320]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:202:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:169:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:173:49: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:174:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:185:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:190:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:194:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:194:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:196:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:201:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_bo.c:202:4: danger: ‘bo’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/8)
#  200|   
#  201|      struct nouveau_ws_bo *bo = CALLOC_STRUCT(nouveau_ws_bo);
#  202|->    bo->size = info.size;
#  203|      bo->handle = info.handle;
#  204|      bo->map_handle = info.map_handle;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1321]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:301:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘device’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:267:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:272:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:275:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:276:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:279:38: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:279:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:287:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:293:7: branch_false: following ‘false’ branch (when ‘version > 16777984’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:298:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:300:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:301:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/winsys/nouveau_device.c:301:7: danger: ‘device’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  299|      int ret = drmCommandWrite(fd, DRM_NOUVEAU_VM_INIT, &vminit, sizeof(vminit));
#  300|      if (ret == 0)
#  301|->       device->has_vm_bind = true;
#  302|   
#  303|      if (nouveau_ws_device_alloc(fd, device))

Error: GCC_ANALYZER_WARNING (CWE-775): [#def1322]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(output_c_path, "w")’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:346:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:348:7: branch_false: following ‘false’ branch (when ‘argc == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:356:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:364:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:369:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:370:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:375:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:376:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:381:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:385:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:392:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: acquire_resource: opened here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:398:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:403:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: danger: ‘fopen(output_c_path, "w")’ leaks here; was opened at [(14)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/13)
#   99|   
#  100|      nir_shader *nir =
#  101|->       spirv_to_nir(spirv, spirv_size / 4, NULL, 0, MESA_SHADER_KERNEL,
#  102|                      "library", &spirv_options, nir_options);
#  103|      nir_validate_shader(nir, "after spirv_to_nir");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1323]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(output_c_path, "w")’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:346:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:348:7: branch_false: following ‘false’ branch (when ‘argc == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:356:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:364:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:369:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:370:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:375:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:376:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:381:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:385:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:392:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:398:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:403:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: danger: ‘fopen(output_c_path, "w")’ leaks here; was allocated at [(14)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/13)
#   99|   
#  100|      nir_shader *nir =
#  101|->       spirv_to_nir(spirv, spirv_size / 4, NULL, 0, MESA_SHADER_KERNEL,
#  102|                      "library", &spirv_options, nir_options);
#  103|      nir_validate_shader(nir, "after spirv_to_nir");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1324]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:263:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:346:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:348:7: branch_false: following ‘false’ branch (when ‘argc == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:356:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:364:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:369:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:370:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:375:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:376:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:381:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:385:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:392:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:398:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:403:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:417:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:425:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:429:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:430:26: call_function: inlined call to ‘get_compiler_options’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:474:10: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:474:10: return_function: returning to ‘main’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:489:10: call_function: calling ‘print_shader’ from ‘main’
#  261|      uint32_t *mem = calloc(sz_el, 4);
#  262|   
#  263|->    memcpy(mem, &info, sizeof(info));
#  264|      memcpy((uint8_t *)mem + sizeof(info), binary->data, binary->size);
#  265|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1325]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/bifrost/bi_schedule.c:449:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/bifrost/bi_schedule.c:2155:1: enter_function: entry to ‘bi_schedule’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/bifrost/bi_schedule.c:2160:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/bifrost/bi_schedule.c:2161:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/bifrost/bi_schedule.c:2161:7: call_function: calling ‘bi_schedule_block’ from ‘bi_schedule’
#  447|   
#  448|      bi_foreach_instr_in_block(block, ins)
#  449|->       instructions[i++] = ins;
#  450|   
#  451|      return instructions;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1326]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:216:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘elem’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:162:1: enter_function: entry to ‘nodearray_orr’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:171:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:172:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:175:10: branch_false: following ‘false’ branch (when ‘size == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:191:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:191:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:199:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:201:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:203:45: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:206:16: branch_false: following ‘false’ branch (when ‘left == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:210:35: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:212:13: branch_false: following ‘false’ branch (when ‘size == left’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:216:18: call_function: inlined call to ‘nodearray_encode’ from ‘nodearray_orr’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/compiler/nodearray.h:216:10: danger: ‘elem’ could be NULL: unchecked value from [(10)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/9)
#  214|                       (size - left) * sizeof(nodearray_sparse));
#  215|   
#  216|->          *elem = nodearray_encode(key, value);
#  217|   
#  218|            if (realloc)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1327]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/cs_builder.h:646:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ins’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_exception_handler.c:151:1: enter_function: entry to ‘panvk_v10_init_tiler_oom’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_exception_handler.c:159:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_exception_handler.c:162:30: branch_true: following ‘true’ branch (when ‘zs_ext != 2’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_exception_handler.c:163:35: branch_true: following ‘true’ branch (when ‘rt_count != 9’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_exception_handler.c:164:25: call_function: inlined call to ‘get_tiler_oom_handler_idx’ from ‘panvk_v10_init_tiler_oom’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_exception_handler.c:178:13: call_function: calling ‘generate_tiler_oom_handler’ from ‘panvk_v10_init_tiler_oom’
#  644|          * it with the final offset.
#  645|          */
#  646|->       int16_t offset = *ins & BITFIELD64_MASK(16);
#  647|   
#  648|         next_forward_ref =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1328]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode.h:89:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:489:1: enter_function: entry to ‘pandecode_shader_disassemble’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:492:13: call_function: calling ‘__pandecode_fetch_gpu_mem’ from ‘pandecode_shader_disassemble’
#   87|      assert(size + (gpu_va - mem->gpu_va) <= mem->length);
#   88|   
#   89|->    return mem->addr + gpu_va - mem->gpu_va;
#   90|   }
#   91|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1329]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:97:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:489:1: enter_function: entry to ‘pandecode_shader_disassemble’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:492:13: call_function: calling ‘__pandecode_fetch_gpu_mem’ from ‘pandecode_shader_disassemble’
#   95|         mprotect(mem->addr, mem->length, PROT_READ);
#   96|         mem->ro = true;
#   97|->       util_dynarray_append(&ctx->ro_mappings, struct pandecode_mapped_memory *,
#   98|                              mem);
#   99|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1330]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:193:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mapped_mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:174:1: enter_function: entry to ‘pandecode_inject_mmap’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:177:4: call_function: calling ‘simple_mtx_lock’ from ‘pandecode_inject_mmap’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:177:4: return_function: returning to ‘pandecode_inject_mmap’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:182:7: call_function: inlined call to ‘pandecode_find_mapped_gpu_mem_containing_rw’ from ‘pandecode_inject_mmap’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:182:7: call_function: inlined call to ‘pandecode_find_mapped_gpu_mem_containing_rw’ from ‘pandecode_inject_mmap’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:184:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:192:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:192:20: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:193:7: danger: ‘mapped_mem’ could be NULL: unchecked value from [(16)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/15)
#  191|   
#  192|         mapped_mem = calloc(1, sizeof(*mapped_mem));
#  193|->       mapped_mem->gpu_va = gpu_va;
#  194|         mapped_mem->length = sz;
#  195|         mapped_mem->addr = cpu;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1331]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:294:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ctx’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:289:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:294:4: danger: ‘ctx’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  292|       * worst that could happen is having the files dumped with their filenames
#  293|       * in a different order. */
#  294|->    ctx->id = num_ctxs++;
#  295|   
#  296|      /* This will be initialized later and can be changed at run time through

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1332]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:497:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:489:1: enter_function: entry to ‘pandecode_shader_disassemble’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:492:13: call_function: calling ‘__pandecode_fetch_gpu_mem’ from ‘pandecode_shader_disassemble’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:492:13: return_function: returning to ‘pandecode_shader_disassemble’ from ‘__pandecode_fetch_gpu_mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:496:7: call_function: calling ‘pandecode_find_mapped_gpu_mem_containing’ from ‘pandecode_shader_disassemble’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:496:7: return_function: returning to ‘pandecode_shader_disassemble’ from ‘pandecode_find_mapped_gpu_mem_containing’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/genxml/decode_common.c:497:16: danger: dereference of NULL ‘pandecode_find_mapped_gpu_mem_containing(ctx,  shader_ptr)’
#  495|      struct pandecode_mapped_memory *mem =
#  496|         pandecode_find_mapped_gpu_mem_containing(ctx, shader_ptr);
#  497|->    size_t sz = mem->length - (shader_ptr - mem->gpu_va);
#  498|   
#  499|      /* Print some boilerplate to clearly denote the assembly (which doesn't

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1333]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:996:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘sync_ops’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:858:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:864:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:864:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:871:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:871:7: branch_false: following ‘false’ branch (when ‘op_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:878:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:889:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:895:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:904:25: branch_true: following ‘true’ branch (when ‘va_collect_cnt > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:906:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:907:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:912:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:912:10: branch_true: following ‘true’ branch (when ‘i == 0’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:918:7: branch_false: following ‘false’ branch (when ‘syncop_cnt <= 16’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:926:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:926:14: branch_false: following ‘false’ branch (when ‘syncop_cnt == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:931:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:931:7: branch_false: following ‘false’ branch (when ‘op_count <= 16’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:941:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:953:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:956:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:956:25: branch_true: following ‘true’ branch (when ‘i < op_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:957:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:960:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:971:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:971:10: branch_false: following ‘false’ branch (when ‘mode != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:995:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:995:28: branch_true: following ‘true’ branch (when ‘j < op_sync_cnt’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:996:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:996:18: release_memory: ‘sync_ops’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/kmod/panthor_kmod.c:996:10: danger: dereference of NULL ‘sync_ops + (long unsigned int)syncop_ptr * 16’
#  994|   
#  995|         for (uint32_t j = 0; j < ops[i].syncs.count; j++) {
#  996|->          sync_ops[syncop_ptr++] = (struct drm_panthor_sync_op){
#  997|               .flags = (ops[i].syncs.array[j].type == PAN_KMOD_SYNC_TYPE_WAIT
#  998|                            ? DRM_PANTHOR_SYNC_OP_WAIT

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1334]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:747:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:701:1: enter_function: entry to ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:707:42: call_function: calling ‘pan_image_view_get_first_plane’ from ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:707:42: return_function: returning to ‘panfrost_new_texture_v4’ from ‘pan_image_view_get_first_plane’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:717:4: call_function: calling ‘panfrost_emit_texture_payload’ from ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:717:4: return_function: returning to ‘panfrost_new_texture_v4’ from ‘panfrost_emit_texture_payload’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:736:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:747:39: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:747:24: danger: dereference of NULL ‘pan_image_view_get_first_plane(iview)’
#  745|         depth = 1;
#  746|      } else {
#  747|->       width = u_minify(layout->width, iview->first_level);
#  748|         height = u_minify(layout->height, iview->first_level);
#  749|         depth = u_minify(layout->depth, iview->first_level);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1335]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:773:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:701:1: enter_function: entry to ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:707:42: call_function: calling ‘pan_image_view_get_first_plane’ from ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:707:42: return_function: returning to ‘panfrost_new_texture_v4’ from ‘pan_image_view_get_first_plane’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:717:4: call_function: calling ‘panfrost_emit_texture_payload’ from ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:717:4: return_function: returning to ‘panfrost_new_texture_v4’ from ‘panfrost_emit_texture_payload’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:736:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:765:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:770:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:773:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:773:29: danger: dereference of NULL ‘pan_image_view_get_first_plane(iview)’
#  771|            cfg.depth = depth;
#  772|         else
#  773|->          cfg.sample_count = layout->nr_samples;
#  774|         cfg.swizzle = panfrost_translate_swizzle_4(iview->swizzle);
#  775|   #if PAN_ARCH >= 9

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1336]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:779:56: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:701:1: enter_function: entry to ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:707:42: call_function: calling ‘pan_image_view_get_first_plane’ from ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:707:42: return_function: returning to ‘panfrost_new_texture_v4’ from ‘pan_image_view_get_first_plane’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:717:4: call_function: calling ‘panfrost_emit_texture_payload’ from ‘panfrost_new_texture_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:717:4: return_function: returning to ‘panfrost_new_texture_v4’ from ‘panfrost_emit_texture_payload’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:736:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:765:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:770:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:771:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/lib/pan_texture.c:779:56: danger: dereference of NULL ‘pan_image_view_get_first_plane(iview)’
#  777|                                util_format_is_compressed(iview->format);
#  778|   #else
#  779|->       cfg.texel_ordering = panfrost_modifier_to_layout(layout->modifier);
#  780|   #endif
#  781|         cfg.levels = iview->last_level - iview->first_level + 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1337]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/disassemble.c:1846:11: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘ctx.midg_tags’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/disassemble.c:1837:20: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/disassemble.c:1841:11: branch_true: following ‘true’ branch (when ‘i < num_words’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/disassemble.c:1842:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/disassemble.c:1846:11: danger: ‘ctx.midg_tags + (long unsigned int)i * 4’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 1844|         unsigned num_quad_words = midgard_tag_props[tag].size;
# 1845|   
# 1846|->       if (ctx.midg_tags[i] && ctx.midg_tags[i] != tag) {
# 1847|            fprintf(fp, "\t/* XXX: TAG ERROR branch, got %s expected %s */\n",
# 1848|                    midgard_tag_props[tag].name,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1338]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:794:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:928:1: enter_function: entry to ‘emit_binary_bundle’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:943:7: call_function: calling ‘emit_alu_bundle’ from ‘emit_binary_bundle’
#  792|               .cond = cond,
#  793|            };
#  794|->          memcpy(util_dynarray_grow_bytes(emission, size, 1), &branch, size);
#  795|         } else {
#  796|            assert(op == midgard_jmp_writeout_op_branch_uncond);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1339]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:812:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:928:1: enter_function: entry to ‘emit_binary_bundle’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:943:7: call_function: calling ‘emit_alu_bundle’ from ‘emit_binary_bundle’
#  810|            midgard_create_branch_extended(cond, op, dest_tag, quadword_offset);
#  811|   
#  812|->       memcpy(util_dynarray_grow_bytes(emission, size, 1), &branch, size);
#  813|      }
#  814|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1340]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:822:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:928:1: enter_function: entry to ‘emit_binary_bundle’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:943:7: call_function: calling ‘emit_alu_bundle’ from ‘emit_binary_bundle’
#  820|   {
#  821|      /* Emit the control word */
#  822|->    util_dynarray_append(emission, uint32_t, bundle->control | lookahead);
#  823|   
#  824|      /* Next up, emit register words */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1341]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:849:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:928:1: enter_function: entry to ‘emit_binary_bundle’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:943:7: call_function: calling ‘emit_alu_bundle’ from ‘emit_binary_bundle’
#  847|         };
#  848|         memcpy(&reg_word, &registers, sizeof(uint16_t));
#  849|->       util_dynarray_append(emission, uint16_t, reg_word);
#  850|      }
#  851|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1342]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:868:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:928:1: enter_function: entry to ‘emit_binary_bundle’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:943:7: call_function: calling ‘emit_alu_bundle’ from ‘emit_binary_bundle’
#  866|            mir_pack_vector_srcs(ins, &source);
#  867|            unsigned size = sizeof(source);
#  868|->          memcpy(util_dynarray_grow_bytes(emission, size, 1), &source, size);
#  869|         } else {
#  870|            midgard_scalar_alu source =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1343]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:873:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:928:1: enter_function: entry to ‘emit_binary_bundle’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_emit.c:943:7: call_function: calling ‘emit_alu_bundle’ from ‘emit_binary_bundle’
#  871|               vector_to_scalar_alu(vector_alu_from_instr(ins), ins);
#  872|            unsigned size = sizeof(source);
#  873|->          memcpy(util_dynarray_grow_bytes(emission, size, 1), &source, size);
#  874|         }
#  875|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1344]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_nir_type_csel.c:33:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_nir_type_csel.c:27:1: enter_function: entry to ‘midgard_nir_type_csel’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_nir_type_csel.c:29:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘midgard_nir_type_csel’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_nir_type_csel.c:29:30: return_function: returning to ‘midgard_nir_type_csel’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/midgard/midgard_nir_type_csel.c:33:14: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#   31|   
#   32|      BITSET_WORD *float_types =
#   33|->       calloc(BITSET_WORDS(impl->ssa_alloc), sizeof(BITSET_WORD));
#   34|      nir_gather_types(impl, float_types, NULL);
#   35|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1345]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/lcra.c:47:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘l’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/lcra.c:45:27: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/lcra.c:47:4: danger: ‘l’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   45|      struct lcra_state *l = calloc(1, sizeof(*l));
#   46|   
#   47|->    l->node_count = node_count;
#   48|      l->class_count = class_count;
#   49|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1346]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:67:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:60:1: enter_function: entry to ‘panvk_v10_GetEventStatus’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:64:39: call_function: inlined call to ‘panvk_priv_mem_host_addr’ from ‘panvk_v10_GetEventStatus’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:66:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:66:25: branch_true: following ‘true’ branch (when ‘i != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:67:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:67:20: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:67:12: danger: dereference of NULL ‘<unknown> + (long unsigned int)i * 8’
#   65|   
#   66|      for (uint32_t i = 0; i < PANVK_SUBQUEUE_COUNT; i++) {
#   67|->       if (!syncobjs[i].seqno)
#   68|            return VK_EVENT_RESET;
#   69|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1347]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:82:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:75:1: enter_function: entry to ‘panvk_v10_SetEvent’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:79:39: call_function: inlined call to ‘panvk_priv_mem_host_addr’ from ‘panvk_v10_SetEvent’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:81:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:81:25: branch_true: following ‘true’ branch (when ‘i != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:82:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:82:15: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:82:7: danger: dereference of NULL ‘<unknown> + (long unsigned int)i * 8’
#   80|   
#   81|      for (uint32_t i = 0; i < PANVK_SUBQUEUE_COUNT; i++)
#   82|->       syncobjs[i].seqno = 1;
#   83|   
#   84|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1348]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:94:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:88:1: enter_function: entry to ‘panvk_v10_ResetEvent’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:92:39: call_function: inlined call to ‘panvk_priv_mem_host_addr’ from ‘panvk_v10_ResetEvent’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:94:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_event.c:94:4: danger: argument 1 (‘<unknown>’) NULL where non-null expected
#argument 1 of ‘__builtin_memset’ must be non-null
#   92|      struct panvk_cs_sync32 *syncobjs = panvk_priv_mem_host_addr(event->syncobjs);
#   93|   
#   94|->    memset(syncobjs, 0, sizeof(*syncobjs) * PANVK_SUBQUEUE_COUNT);
#   95|      return VK_SUCCESS;
#   96|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1349]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:685:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:1246:1: enter_function: entry to ‘panvk_v10_queue_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:1250:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:1253:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:1254:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:1260:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/csf/panvk_vX_queue.c:1260:13: call_function: calling ‘init_tiler’ from ‘panvk_v10_queue_init’
#  683|      tiler_heap->context.dev_addr = thc.tiler_heap_ctx_gpu_va;
#  684|   
#  685|->    pan_cast_and_pack(panvk_priv_mem_host_addr(tiler_heap->desc), TILER_HEAP,
#  686|                        cfg) {
#  687|         cfg.size = tiler_heap->chunk_size;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1350]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:72:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:312:1: enter_function: entry to ‘panvk_v6_CmdPipelineBarrier2’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:323:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:325:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:327:7: call_function: calling ‘panvk_v6_cmd_close_batch’ from ‘panvk_v6_CmdPipelineBarrier2’
#   70|      pan_jc_add_job(&batch->frag_jc, MALI_JOB_TYPE_FRAGMENT, false, false, 0, 0,
#   71|                     &job_ptr, false);
#   72|->    util_dynarray_append(&batch->jobs, void *, job_ptr.cpu);
#   73|      return VK_SUCCESS;
#   74|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1351]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:100:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:302:1: enter_function: entry to ‘panvk_v6_EndCommandBuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:306:4: call_function: calling ‘panvk_v6_cmd_close_batch’ from ‘panvk_v6_EndCommandBuffer’
#   98|   
#   99|            if (ptr.gpu) {
#  100|->             util_dynarray_append(&batch->jobs, void *, ptr.cpu);
#  101|               pan_jc_add_job(&batch->vtc_jc, MALI_JOB_TYPE_NULL, false, false, 0,
#  102|                              0, &ptr, false);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1352]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:101:13: warning[-Wanalyzer-malloc-leak]: leak of ‘*batch.jobs.data’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:302:1: enter_function: entry to ‘panvk_v6_EndCommandBuffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c:306:4: call_function: calling ‘panvk_v6_cmd_close_batch’ from ‘panvk_v6_EndCommandBuffer’
#   99|            if (ptr.gpu) {
#  100|               util_dynarray_append(&batch->jobs, void *, ptr.cpu);
#  101|->             pan_jc_add_job(&batch->vtc_jc, MALI_JOB_TYPE_NULL, false, false, 0,
#  102|                              0, &ptr, false);
#  103|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1353]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:128:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:61:1: enter_function: entry to ‘panvk_v6_CmdDispatchBase’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:70:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:74:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:77:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:96:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:99:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:103:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:107:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:111:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:114:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:124:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:127:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:127:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:128:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:128:10: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_CmdDispatchBase’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:128:10: return_function: returning to ‘panvk_v6_CmdDispatchBase’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:128:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*<unknown>.jobs, 1, 8)’
#  126|   
#  127|         if (copy_desc_job.cpu)
#  128|->          util_dynarray_append(&batch->jobs, void *, copy_desc_job.cpu);
#  129|      }
#  130|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1354]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:135:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:61:1: enter_function: entry to ‘panvk_v6_CmdDispatchBase’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:70:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:74:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:77:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:96:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:99:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:103:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:107:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:111:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:114:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:131:30: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_CmdDispatchBase’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:131:30: return_function: returning to ‘panvk_v6_CmdDispatchBase’ from ‘panvk_pool_descs_to_alloc_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:131:30: call_function: calling ‘panvk_cmd_alloc_from_pool’ from ‘panvk_v6_CmdDispatchBase’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:131:30: return_function: returning to ‘panvk_v6_CmdDispatchBase’ from ‘panvk_cmd_alloc_from_pool’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:132:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:135:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:135:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_CmdDispatchBase’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:135:4: return_function: returning to ‘panvk_v6_CmdDispatchBase’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_dispatch.c:135:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*<unknown>.jobs, 1, 8)’
#  133|         return;
#  134|   
#  135|->    util_dynarray_append(&batch->jobs, void *, job.cpu);
#  136|   
#  137|      panfrost_pack_work_groups_compute(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1355]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:33:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:19:1: enter_function: entry to ‘panvk_add_set_event_operation’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:33:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_add_set_event_operation’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:33:7: return_function: returning to ‘panvk_add_set_event_operation’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:33:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*cmdbuf_1(D)->cur_batch.event_ops, 1, 16)’
#   31|          */
#   32|         panvk_per_arch(cmd_open_batch)(cmdbuf);
#   33|->       util_dynarray_append(&cmdbuf->cur_batch->event_ops,
#   34|                              struct panvk_cmd_event_op, op);
#   35|         panvk_per_arch(cmd_close_batch)(cmdbuf);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1356]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:60:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:104:1: enter_function: entry to ‘panvk_v6_CmdWaitEvents2’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:112:25: branch_true: following ‘true’ branch (when ‘i < eventCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:113:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:114:7: call_function: calling ‘panvk_add_wait_event_operation’ from ‘panvk_v6_CmdWaitEvents2’
#   58|         /* No open batch, let's create a new one and have it wait for this event. */
#   59|         panvk_per_arch(cmd_open_batch)(cmdbuf);
#   60|->       util_dynarray_append(&cmdbuf->cur_batch->event_ops,
#   61|                              struct panvk_cmd_event_op, op);
#   62|      } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1357]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:72:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:104:1: enter_function: entry to ‘panvk_v6_CmdWaitEvents2’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:112:25: branch_true: following ‘true’ branch (when ‘i < eventCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:113:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_cmd_event.c:114:7: call_function: calling ‘panvk_add_wait_event_operation’ from ‘panvk_v6_CmdWaitEvents2’
#   70|            panvk_per_arch(cmd_open_batch)(cmdbuf);
#   71|         }
#   72|->       util_dynarray_append(&cmdbuf->cur_batch->event_ops,
#   73|                              struct panvk_cmd_event_op, op);
#   74|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1358]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:229:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:215:1: enter_function: entry to ‘panvk_queue_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:224:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:227:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:227:10: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘panvk_queue_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:229:27: danger: dereference of NULL ‘<unknown>’
#  227|            vk_sync_as_drm_syncobj(submit->waits[i].sync);
#  228|   
#  229|->       semaphores[i + 1] = syncobj->syncobj;
#  230|      }
#  231|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1359]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:303:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:215:1: enter_function: entry to ‘panvk_queue_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:298:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:301:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:301:10: call_function: inlined call to ‘vk_sync_as_drm_syncobj’ from ‘panvk_queue_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/jm/panvk_vX_queue.c:303:7: danger: dereference of NULL ‘<unknown>’
#  301|            vk_sync_as_drm_syncobj(submit->signals[i].sync);
#  302|   
#  303|->       panvk_queue_transfer_sync(queue, syncobj->syncobj);
#  304|      }
#  305|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1360]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:576:52: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:544:1: enter_function: entry to ‘panvk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:548:7: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:548:7: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:550:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:550:25: branch_true: following ‘true’ branch (when ‘i < bindInfoCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:551:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:554:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:567:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:571:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:573:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:573:16: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:573:16: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:576:52: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:576:52: danger: dereference of NULL ‘<unknown>’
#  574|                                       BIND_IMAGE_PLANE_MEMORY_INFO);
#  575|               uint8_t plane =
#  576|->                panvk_plane_index(image->vk.format, plane_info->planeAspect);
#  577|               panvk_image_plane_bind(&image->planes[plane], image->bo,
#  578|                                      mem->addr.dev, offset);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1361]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1615:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1587:1: enter_function: entry to ‘get_image_format_properties’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1600:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_image_format_properties’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1613:10: call_function: inlined call to ‘__vk_find_struct’ from ‘get_image_format_properties’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1613:10: call_function: inlined call to ‘__vk_find_struct’ from ‘get_image_format_properties’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1615:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_physical_device.c:1615:11: danger: dereference of NULL ‘<unknown>’
# 1613|            vk_find_struct_const(
# 1614|               info->pNext, PHYSICAL_DEVICE_IMAGE_DRM_FORMAT_MODIFIER_INFO_EXT);
# 1615|->       if (mod_info->drmFormatModifier != DRM_FORMAT_MOD_LINEAR)
# 1616|            goto unsupported;
# 1617|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1362]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:483:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1447:1: enter_function: entry to ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: call_function: calling ‘nir_shader_instructions_pass’ from ‘panvk_v6_nir_lower_descriptors’
#  481|      *index_ssa = NULL;
#  482|   
#  483|->    if (deref->deref_type == nir_deref_type_array) {
#  484|         if (nir_src_is_const(deref->arr.index)) {
#  485|            *index_imm = nir_src_as_uint(deref->arr.index);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1363]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:492:48: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1447:1: enter_function: entry to ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: call_function: calling ‘nir_shader_instructions_pass’ from ‘panvk_v6_nir_lower_descriptors’
#  490|            /* Zero means variable array. The minus one should give us UINT32_MAX,
#  491|             * which matches what we want. */
#  492|->          *max_idx = ((uint32_t)glsl_array_size(nir_deref_instr_parent(deref)->type)) - 1;
#  493|         }
#  494|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1364]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:846:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1447:1: enter_function: entry to ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: call_function: calling ‘nir_shader_instructions_pass’ from ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: return_function: returning to ‘panvk_v6_nir_lower_descriptors’ from ‘nir_shader_instructions_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1495:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1495:4: call_function: calling ‘create_copy_table’ from ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1495:4: return_function: returning to ‘panvk_v6_nir_lower_descriptors’ from ‘create_copy_table’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1496:4: call_function: calling ‘upload_shader_desc_info’ from ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1496:4: return_function: returning to ‘panvk_v6_nir_lower_descriptors’ from ‘upload_shader_desc_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1498:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1499:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1499:7: call_function: calling ‘lower_input_attachment_loads’ from ‘panvk_v6_nir_lower_descriptors’
#  844|   
#  845|      nir_deref_instr *deref = nir_src_as_deref(intr->src[0]);
#  846|->    enum glsl_sampler_dim image_dim = glsl_get_sampler_dim(deref->type);
#  847|      if (image_dim != GLSL_SAMPLER_DIM_SUBPASS &&
#  848|          image_dim != GLSL_SAMPLER_DIM_SUBPASS_MS)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1365]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:974:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:967:1: enter_function: entry to ‘collect_frag_writes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:972:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘collect_frag_writes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:974:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:974:8: danger: dereference of NULL ‘<unknown>’
#  972|      nir_deref_instr *deref = nir_src_as_deref(intr->src[0]);
#  973|   
#  974|->    if (deref->modes != nir_var_shader_out)
#  975|         return false;
#  976|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1366]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1033:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1457:13: call_function: calling ‘shader_desc_info_deserialize’ from ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1457:13: return_function: returning to ‘panvk_deserialize_shader’ from ‘shader_desc_info_deserialize’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1459:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1031|         return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1032|   
# 1033|->    pan_cast_and_pack(panvk_priv_mem_host_addr(shader->rsd), RENDERER_STATE,
# 1034|                        cfg) {
# 1035|         pan_shader_prepare_rsd(&shader->info, panvk_shader_get_dev_addr(shader),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1367]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1044:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1042|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1043|   
# 1044|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spd), SHADER_PROGRAM,
# 1045|                           cfg) {
# 1046|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1368]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1071:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1069|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1070|   
# 1071|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.all_points),
# 1072|                           SHADER_PROGRAM, cfg) {
# 1073|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1369]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1086:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1084|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1085|   
# 1086|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.all_triangles),
# 1087|                           SHADER_PROGRAM, cfg) {
# 1088|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1370]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1102:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1100|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1101|   
# 1102|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.pos_points),
# 1103|                           SHADER_PROGRAM, cfg) {
# 1104|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1371]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1118:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1116|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1117|   
# 1118|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.pos_triangles),
# 1119|                           SHADER_PROGRAM, cfg) {
# 1120|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1372]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1136:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1134|               return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1135|   
# 1136|->          pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.var),
# 1137|                              SHADER_PROGRAM, cfg) {
# 1138|               unsigned work_count = shader->info.vs.secondary_work_reg_count;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1373]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1764:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1748:1: enter_function: entry to ‘emit_varying_attrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1753:26: call_function: inlined call to ‘__bitset_count’ from ‘emit_varying_attrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1753:26: call_function: inlined call to ‘__bitset_count’ from ‘emit_varying_attrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1755:11: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘emit_varying_attrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1755:11: return_function: returning to ‘emit_varying_attrs’ from ‘panvk_pool_descs_to_alloc_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1760:42: call_function: inlined call to ‘panvk_priv_mem_host_addr’ from ‘emit_varying_attrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1763:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1763:25: branch_true: following ‘true’ branch (when ‘attr_idx < varying_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1764:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1764:7: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1764:7: danger: dereference of NULL ‘<unknown> + (long unsigned int)attr_idx * 8’
# 1762|   
# 1763|      for (unsigned i = 0; i < varying_count; i++) {
# 1764|->       pan_pack(&attrs[attr_idx++], ATTRIBUTE, cfg) {
# 1765|            gl_varying_slot loc = varyings[i].location;
# 1766|            enum pipe_format pfmt = varyings[i].format != PIPE_FORMAT_NONE

Error: GCC_ANALYZER_WARNING (CWE-674): [#def1374]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/bitset.h:256:7: warning[-Wanalyzer-infinite-recursion]: infinite recursion
mesa-25.1.0-rc2/redhat-linux-build/../src/util/bitset.h:246:1: enter_function: entry to ‘__bitset_set_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/bitset.h:251:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/bitset.h:254:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/bitset.h:256:7: call_function: calling ‘__bitset_set_range’ from ‘__bitset_set_range’
#  254|         const unsigned first_size = BITSET_WORDBITS - start_mod;
#  255|   
#  256|->       __bitset_set_range(r, start, start + first_size - 1);
#  257|         __bitset_set_range(r, start + first_size, end);
#  258|      }

Error: GCC_ANALYZER_WARNING (CWE-674): [#def1375]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/bitset.h:275:7: warning[-Wanalyzer-infinite-recursion]: infinite recursion
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1281:1: enter_function: entry to ‘v3d_set_shader_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1290:12: branch_false: following ‘false’ branch (when ‘buffers’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1310:38: branch_false: following ‘false’ branch (when ‘i >= count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1317:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3dx_state.c:1317:17: call_function: calling ‘__bitclear_clear_range’ from ‘v3d_set_shader_buffers’
#  273|         const unsigned first_size = BITSET_WORDBITS - start_mod;
#  274|   
#  275|->       __bitclear_clear_range(r, start, start + first_size - 1);
#  276|         __bitclear_clear_range(r, start + first_size, end);
#  277|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1376]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/box.h:37:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘boxes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri2.c:1850:7: branch_true: following ‘true’ branch (when ‘nrects != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri2.c:1851:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri2.c:1851:15: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri2.c:1854:32: branch_true: following ‘true’ branch (when ‘i < nrects’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri2.c:1855:29: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/dri/dri2.c:1857:10: call_function: inlined call to ‘u_box_2d’ from ‘dri_set_damage_region’
#   35|   u_box_2d(unsigned x,unsigned y, unsigned w, unsigned h, struct pipe_box *box)
#   36|   {
#   37|->    box->x = x;
#   38|      box->y = y;
#   39|      box->z = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1377]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/dag.c:255:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/dag.c:266:1: enter_function: entry to ‘dag_validate’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/dag.c:282:4: branch_true: following ‘true’ branch (when ‘node != dag’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/dag.c:283:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/dag.c:283:7: call_function: calling ‘dag_validate_node’ from ‘dag_validate’
#  253|      _mesa_set_add(state->stack_set, node);
#  254|      _mesa_set_add(state->seen, node);
#  255|->    util_dynarray_append(&state->stack, struct dag_node *, node);
#  256|   
#  257|      util_dynarray_foreach(&node->edges, struct dag_edge, edge) {

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1378]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:162:14: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘p’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:897:1: enter_function: entry to ‘disk_cache_generate_cache_dir’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:927:14: call_function: calling ‘concatenate_and_mkdir’ from ‘disk_cache_generate_cache_dir’
#argument 1 of ‘__builtin_strlen’ must be non-null
#  160|   
#  161|      p = strdup(path);
#  162|->    end = p + strlen(p) + 1; /* end points to the \0 terminator */
#  163|      for (char *q = p; q != end; q++) {
#  164|         if (*q == '/' || q == end - 1) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1379]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:302:33: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:486:1: enter_function: entry to ‘disk_cache_evict_lru_item’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:496:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:499:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:499:18: call_function: calling ‘unlink_lru_file_from_directory’ from ‘disk_cache_evict_lru_item’
#  300|               processed_files++;
#  301|   
#  302|->             char *tmp = realloc(entry->lru_name, len + 1);
#  303|               if (tmp) {
#  304|                  /* Find location to insert new lru item. We want to keep the

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1380]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/format/texcompress_bptc_tmp.h:1446:34: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘endpoint_luminances[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/format/u_format_bptc.c:263:1: enter_function: entry to ‘util_format_bptc_rgb_ufloat_pack_rgba_8unorm’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/format/u_format_bptc.c:267:4: call_function: calling ‘compress_rgba_unorm’ from ‘util_format_bptc_rgb_ufloat_pack_rgba_8unorm’
# 1444|      /* If the endpoints have the same luminance then we'll just use index 0 for
# 1445|       * all of the texels */
# 1446|->    if (endpoint_luminances[0] == endpoint_luminances[1]) {
# 1447|         write_bits(writer, BLOCK_SIZE * BLOCK_SIZE * 2 - 1, 0);
# 1448|         return;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1381]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/format/texcompress_bptc_tmp.h:1604:27: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*src’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_bptc.c:233:1: enter_function: entry to ‘_mesa_texstore_bptc_rgb_unsigned_float’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_bptc.c:237:11: call_function: calling ‘texstore_bptc_rgb_float’ from ‘_mesa_texstore_bptc_rgb_unsigned_float’
# 1602|      for (y = 0; y < height; y++) {
# 1603|         for (x = 0; x < width; x++) {
# 1604|->          luminance_sum += src[0] + src[1] + src[2];
# 1605|            src += 3;
# 1606|         }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1382]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/format/texcompress_bptc_tmp.h:1700:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*src’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_bptc.c:233:1: enter_function: entry to ‘_mesa_texstore_bptc_rgb_unsigned_float’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_bptc.c:237:11: call_function: calling ‘texstore_bptc_rgb_float’ from ‘_mesa_texstore_bptc_rgb_unsigned_float’
# 1698|      midpoint = (endpoint_luminances[0] + endpoint_luminances[1]) / 2.0f;
# 1699|   
# 1700|->    if ((src[0] + src[1] + src[2] <= midpoint) !=
# 1701|          (endpoint_luminances[0] <= midpoint)) {
# 1702|         memcpy(temp, endpoints[0], sizeof temp);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1383]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/format/texcompress_s3tc_tmp.h:898:34: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*curaddr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_s3tc.c:213:1: enter_function: entry to ‘_mesa_texstore_rgba_dxt5’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_s3tc.c:232:10: branch_false: following ‘false’ branch (when ‘tempImage’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_s3tc.c:234:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/main/texcompress_s3tc.c:255:4: call_function: calling ‘tx_compress_dxt5’ from ‘_mesa_texstore_rgba_dxt5’
#  896|         for (i = 0; i < numxpixels; i++) {
#  897|            for (c = 0; c < comps; c++) {
#  898|->             srcpixels[j][i][c] = *curaddr++ / (CHAN_MAX / 255);
#  899|            }
#  900|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1384]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:55:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘lru_file_list’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:486:1: enter_function: entry to ‘disk_cache_evict_lru_item’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:496:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:499:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:499:18: call_function: calling ‘unlink_lru_file_from_directory’ from ‘disk_cache_evict_lru_item’
#   53|   static inline void list_inithead(struct list_head *item)
#   54|   {
#   55|->     item->prev = item;
#   56|       item->next = item;
#   57|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1385]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:67:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘priv’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:750:1: enter_function: entry to ‘vl_mpeg12_end_frame’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_mpeg12_decoder.c:769:10: call_function: calling ‘vl_mpeg12_get_decode_buffer’ from ‘vl_mpeg12_end_frame’
#   65|   static inline void list_add(struct list_head *item, struct list_head *list)
#   66|   {
#   67|->     item->prev = list;
#   68|       item->next = list->next;
#   69|       list->next->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1386]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:81:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:870:25: release_memory: ‘batch_bo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:880:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:883:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:883:26: release_memory: ‘batch_bo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:883:4: call_function: inlined call to ‘list_addtail’ from ‘anv_cmd_buffer_init_batch_bo_chain’
#   79|   static inline void list_addtail(struct list_head *item, struct list_head *list)
#   80|   {
#   81|->     item->next = list;
#   82|       item->prev = list->prev;
#   83|       list->prev->next = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1387]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:81:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prev_bbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:397:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:398:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:398:28: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:400:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:402:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:402:28: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:402:7: call_function: inlined call to ‘list_addtail’ from ‘anv_batch_bo_list_clone’
#   79|   static inline void list_addtail(struct list_head *item, struct list_head *list)
#   80|   {
#   81|->     item->next = list;
#   82|       item->prev = list->prev;
#   83|       list->prev->next = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1388]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_blockify_uniform_loads.c:142:1: enter_function: entry to ‘brw_nir_rebase_const_offset_ubo_loads’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/intel_nir_blockify_uniform_loads.c:144:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘brw_nir_rebase_const_offset_ubo_loads’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1389]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dupl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/lima_nir_duplicate_modifiers.c:123:1: enter_function: entry to ‘lima_nir_duplicate_modifiers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/lima_nir_duplicate_modifiers.c:125:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘lima_nir_duplicate_modifiers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/lima_nir_duplicate_modifiers.c:125:4: return_function: returning to ‘lima_nir_duplicate_modifiers’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/lima_nir_duplicate_modifiers.c:125:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/lima_nir_duplicate_modifiers.c:126:7: call_function: calling ‘lima_nir_duplicate_modifier_impl’ from ‘lima_nir_duplicate_modifiers’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1390]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘new_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:606:1: enter_function: entry to ‘nir_opt_vectorize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:611:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_vectorize’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:611:4: return_function: returning to ‘nir_opt_vectorize’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:611:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_vectorize.c:612:19: call_function: calling ‘nir_opt_vectorize_impl’ from ‘nir_opt_vectorize’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1391]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_atomics.c:155:1: enter_function: entry to ‘gl_nir_lower_atomics_instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_atomics.c:162:11: call_function: calling ‘lower_deref_instr’ from ‘gl_nir_lower_atomics_instr’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1392]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘sample’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:204:1: enter_function: entry to ‘agx_nir_lower_sample_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:207:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_sample_intrinsics’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1393]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:201:1: enter_function: entry to ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:203:35: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:203:35: return_function: returning to ‘nir_opt_phi_to_bool’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: return_function: returning to ‘nir_opt_phi_to_bool’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:206:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:207:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:208:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:208:10: branch_false: following ‘false’ branch (when ‘instr’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:206:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: call_function: calling ‘nir_foreach_function_with_impl_next’ from ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: return_function: returning to ‘nir_opt_phi_to_bool’ from ‘nir_foreach_function_with_impl_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:235:11: call_function: calling ‘nir_shader_phi_pass’ from ‘nir_opt_phi_to_bool’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1394]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘txq_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:761:1: enter_function: entry to ‘nak_nir_lower_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:763:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1395]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:83:5: warning[-Wanalyzer-malloc-leak]: leak of ‘r600_bytecode_gds()’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1573:5: enter_function: entry to ‘r600_bytecode_add_gds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1575:42: call_function: calling ‘r600_bytecode_gds’ from ‘r600_bytecode_add_gds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1575:42: return_function: returning to ‘r600_bytecode_add_gds’ from ‘r600_bytecode_gds’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1578:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1580:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1587:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1588:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1587:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1589:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1587:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1598:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1598:9: call_function: inlined call to ‘list_addtail’ from ‘r600_bytecode_add_gds’
#   81|       item->next = list;
#   82|       item->prev = list->prev;
#   83|->     list->prev->next = item;
#   84|       list->prev = item;
#   85|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1396]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:83:5: warning[-Wanalyzer-malloc-leak]: leak of ‘r600_bytecode_tex()’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1499:5: enter_function: entry to ‘r600_bytecode_add_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1501:42: call_function: calling ‘r600_bytecode_tex’ from ‘r600_bytecode_add_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1501:42: return_function: returning to ‘r600_bytecode_add_tex’ from ‘r600_bytecode_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1504:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1506:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1551:21: call_function: calling ‘r600_bytecode_add_cf’ from ‘r600_bytecode_add_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1551:21: return_function: returning to ‘r600_bytecode_add_tex’ from ‘r600_bytecode_add_cf’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1552:20: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1556:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1558:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1561:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1561:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1564:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1564:9: call_function: inlined call to ‘list_addtail’ from ‘r600_bytecode_add_tex’
#   81|       item->next = list;
#   82|       item->prev = list->prev;
#   83|->     list->prev->next = item;
#   84|       list->prev = item;
#   85|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1397]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:83:5: warning[-Wanalyzer-malloc-leak]: leak of ‘r600_bytecode_vtx()’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1431:12: enter_function: entry to ‘r600_bytecode_add_vtx_internal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1434:42: call_function: calling ‘r600_bytecode_vtx’ from ‘r600_bytecode_add_vtx_internal’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1434:42: return_function: returning to ‘r600_bytecode_add_vtx_internal’ from ‘r600_bytecode_vtx’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1437:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1439:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1448:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1449:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1448:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1450:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1448:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1476:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/r600/r600_asm.c:1476:9: call_function: inlined call to ‘list_addtail’ from ‘r600_bytecode_add_vtx_internal’
#   81|       item->next = list;
#   82|       item->prev = list->prev;
#   83|->     list->prev->next = item;
#   84|       list->prev = item;
#   85|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1398]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:103:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_helper_writes.c:106:1: enter_function: entry to ‘nir_lower_helper_writes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_helper_writes.c:109:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘nir_lower_helper_writes’
#  101|   static inline void list_del(struct list_head *item)
#  102|   {
#  103|->     item->prev->next = item->next;
#  104|       item->next->prev = item->prev;
#  105|       item->prev = item->next = NULL;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1399]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/log.c:461:18: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘next’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/util/log.c:488:1: enter_function: entry to ‘_mesa_log_multiline’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/log.c:493:14: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/log.c:496:4: call_function: calling ‘mesa_log_stream_flush’ from ‘_mesa_log_multiline’
#argument 1 of ‘__builtin_strchr’ must be non-null
#  459|      char *end;
#  460|      char *next = stream->msg;
#  461|->    while ((end = strchr(stream->msg + scan_offset, '\n'))) {
#  462|         *end = 0;
#  463|         mesa_log(stream->level, stream->tag, "%s", next);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1400]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:328:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘payload’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:324:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:328:4: danger: ‘payload’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  326|      p_atomic_set(&payload->refcount, 1);
#  327|   
#  328|->    payload->buf = (uint8_t *) (payload + 1);
#  329|      payload->end = payload->buf + PAYLOAD_BUFFER_SIZE;
#  330|      payload->next = payload->buf;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1401]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:417:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:415:12: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:417:4: danger: ‘chunk’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  415|      chunk = calloc(1, sizeof(*chunk));
#  416|   
#  417|->    chunk->utctx = ut->utctx;
#  418|      chunk->timestamps =
#  419|         ut->utctx->create_buffer(ut->utctx,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1402]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:875:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘from_chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:860:1: enter_function: entry to ‘u_trace_clone_append’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:866:15: call_function: calling ‘sanitize_iterator’ from ‘u_trace_clone_append’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:866:15: return_function: returning to ‘u_trace_clone_append’ from ‘sanitize_iterator’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:869:26: release_memory: ‘from_chunk’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:873:40: call_function: calling ‘get_chunk’ from ‘u_trace_clone_append’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:873:40: return_function: returning to ‘u_trace_clone_append’ from ‘get_chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:875:26: danger: dereference of NULL ‘from_chunk’
#  873|         struct u_trace_chunk *to_chunk = get_chunk(into, 0 /* payload_size */);
#  874|   
#  875|->       unsigned to_copy = MIN2(TRACES_PER_CHUNK - to_chunk->num_traces,
#  876|                                 from_chunk->num_traces - from_idx);
#  877|         if (from_chunk == end_it.chunk)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1403]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:939:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘current_chunk’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:928:1: enter_function: entry to ‘u_trace_disable_event_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:931:15: call_function: calling ‘sanitize_iterator’ from ‘u_trace_disable_event_range’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:931:15: return_function: returning to ‘u_trace_disable_event_range’ from ‘sanitize_iterator’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:934:26: release_memory: ‘current_chunk’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:937:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:939:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/perf/u_trace.c:939:15: danger: dereference of NULL ‘current_chunk’
#  937|      while (current_chunk != end_it.chunk) {
#  938|         memset(&current_chunk->traces[start_idx], 0,
#  939|->              (current_chunk->num_traces - start_idx) *
#  940|                   sizeof(struct u_trace_event));
#  941|         start_idx = 0;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1404]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1283:16: warning[-Wanalyzer-null-argument]: use of NULL ‘*str’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1273:1: enter_function: entry to ‘linear_vasprintf_rewrite_tail’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1281:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1282:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1282:14: call_function: calling ‘linear_vasprintf’ from ‘linear_vasprintf_rewrite_tail’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1282:14: return_function: returning to ‘linear_vasprintf_rewrite_tail’ from ‘linear_vasprintf’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1282:7: release_memory: ‘*str’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/ralloc.c:1283:16: danger: argument 1 (‘linear_vasprintf(ctx,  fmt,  args)’) NULL where non-null expected
#argument 1 of ‘__builtin_strlen’ must be non-null
# 1281|      if (unlikely(*str == NULL)) {
# 1282|         *str = linear_vasprintf(ctx, fmt, args);
# 1283|->       *start = strlen(*str);
# 1284|         return true;
# 1285|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1405]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:907:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:928:1: enter_function: entry to ‘ra_select’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:933:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:936:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:939:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:947:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: call_function: calling ‘ra_compute_available_regs’ from ‘ra_select’
#  905|            } else {
#  906|               for (int j = 0; j < BITSET_WORDS(g->regs->count); j++)
#  907|->                regs[j] &= ~g->regs->regs[n2->reg].conflicts[j];
#  908|            }
#  909|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1406]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:907:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:928:1: enter_function: entry to ‘ra_select’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:933:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:934:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:934:21: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:936:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:939:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:947:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: call_function: calling ‘ra_compute_available_regs’ from ‘ra_select’
#  905|            } else {
#  906|               for (int j = 0; j < BITSET_WORDS(g->regs->count); j++)
#  907|->                regs[j] &= ~g->regs->regs[n2->reg].conflicts[j];
#  908|            }
#  909|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1407]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:913:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:928:1: enter_function: entry to ‘ra_select’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:933:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:936:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:939:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:947:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: call_function: calling ‘ra_compute_available_regs’ from ‘ra_select’
#  911|   
#  912|      for (int i = 0; i < BITSET_WORDS(g->regs->count); i++) {
#  913|->       if (regs[i])
#  914|            return true;
#  915|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1408]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:913:11: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:928:1: enter_function: entry to ‘ra_select’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:933:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:934:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:934:21: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:936:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:939:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:947:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:948:15: call_function: calling ‘ra_compute_available_regs’ from ‘ra_select’
#  911|   
#  912|      for (int i = 0; i < BITSET_WORDS(g->regs->count); i++) {
#  913|->       if (regs[i])
#  914|            return true;
#  915|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1409]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:981:13: warning[-Wanalyzer-malloc-leak]: leak of ‘select_regs’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:933:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:934:28: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:934:21: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:936:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:939:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:947:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:981:13: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/register_allocate.c:981:13: danger: ‘select_regs’ leaks here; was allocated at [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  979|            }
#  980|   
#  981|->          if (ri >= g->regs->count)
#  982|               return false;
#  983|         }

Error: COMPILER_WARNING: [#def1410]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/streaming-load-memcpy.c:73:23: note[note]: called from here
#   71|         __m128i *src_cacheline = (__m128i *)s;
#   72|   
#   73|->       __m128i temp1 = _mm_stream_load_si128(src_cacheline + 0);
#   74|         __m128i temp2 = _mm_stream_load_si128(src_cacheline + 1);
#   75|         __m128i temp3 = _mm_stream_load_si128(src_cacheline + 2);

Error: COMPILER_WARNING: [#def1411]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/streaming-load-memcpy.c:74:23: note[note]: called from here
#   72|   
#   73|         __m128i temp1 = _mm_stream_load_si128(src_cacheline + 0);
#   74|->       __m128i temp2 = _mm_stream_load_si128(src_cacheline + 1);
#   75|         __m128i temp3 = _mm_stream_load_si128(src_cacheline + 2);
#   76|         __m128i temp4 = _mm_stream_load_si128(src_cacheline + 3);

Error: COMPILER_WARNING: [#def1412]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/streaming-load-memcpy.c:75:23: note[note]: called from here
#   73|         __m128i temp1 = _mm_stream_load_si128(src_cacheline + 0);
#   74|         __m128i temp2 = _mm_stream_load_si128(src_cacheline + 1);
#   75|->       __m128i temp3 = _mm_stream_load_si128(src_cacheline + 2);
#   76|         __m128i temp4 = _mm_stream_load_si128(src_cacheline + 3);
#   77|   

Error: COMPILER_WARNING: [#def1413]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/streaming-load-memcpy.c:76:23: note[note]: called from here
#   74|         __m128i temp2 = _mm_stream_load_si128(src_cacheline + 1);
#   75|         __m128i temp3 = _mm_stream_load_si128(src_cacheline + 2);
#   76|->       __m128i temp4 = _mm_stream_load_si128(src_cacheline + 3);
#   77|   
#   78|         _mm_store_si128(dst_cacheline + 0, temp1);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1414]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/string_buffer.h:69:50: warning[-Wanalyzer-null-argument]: use of NULL ‘c’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:110:1: enter_function: entry to ‘remove_line_continuations’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:124:12: branch_false: following ‘false’ branch (when ‘backslash’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:147:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:154:12: branch_true: following ‘true’ branch (when ‘cr’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:165:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:173:20: branch_false: following ‘false’ branch (when ‘collapsed_newlines == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:198:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:198:20: branch_false: following ‘false’ branch (when ‘backslash’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:201:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:173:20: branch_true: following ‘true’ branch (when ‘collapsed_newlines != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:174:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:182:29: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:186:64: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:187:40: branch_true: following ‘true’ branch (when ‘collapsed_newlines != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:188:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:193:42: call_function: calling ‘skip_newline’ from ‘remove_line_continuations’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:193:42: return_function: returning to ‘remove_line_continuations’ from ‘skip_newline’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:198:20: branch_true: following ‘true’ branch (when ‘backslash’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:219:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/pp.c:219:9: call_function: calling ‘_mesa_string_buffer_append’ from ‘remove_line_continuations’
#argument 1 of ‘__builtin_strlen’ must be non-null
#   67|   _mesa_string_buffer_append(struct _mesa_string_buffer *str, const char *c)
#   68|   {
#   69|->    return _mesa_string_buffer_append_len(str, c, strlen(c));
#   70|   }
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1415]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:534:14: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:751:1: enter_function: entry to ‘_util_cpu_detect_once’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:905:10: branch_false: following ‘false’ branch (when ‘<unknown> <= 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:927:7: call_function: inlined call to ‘cpuid’ from ‘_util_cpu_detect_once’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:960:4: call_function: calling ‘check_cpu_caps_override’ from ‘_util_cpu_detect_once’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:960:4: return_function: returning to ‘_util_cpu_detect_once’ from ‘check_cpu_caps_override’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_cpu_detect.c:965:4: call_function: calling ‘get_cpu_topology’ from ‘_util_cpu_detect_once’
#  532|      if (!fail) {
#  533|         for (unsigned i = 0; caps && i < util_cpu_caps.max_cpus; i++) {
#  534|->          if (caps[i] >= big_cap / 2)
#  535|               num_big_cpus++;
#  536|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1416]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_dynarray.h:59:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:530:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:535:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:535:15: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/etnaviv/etnaviv_ml.c:541:4: call_function: inlined call to ‘util_dynarray_init’ from ‘etna_ml_subgraph_create’
#   57|   {
#   58|      memset(buf, 0, sizeof(*buf));
#   59|->    buf->mem_ctx = mem_ctx;
#   60|   }
#   61|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1417]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_dynarray.h:158:7: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
#  156|      unsigned newsize = buf->size + growbytes;
#  157|      void *p = util_dynarray_ensure_cap(buf, newsize);
#  158|->    if (!p)
#  159|         return NULL;
#  160|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1418]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_dynarray.h:161:4: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2187:1: enter_function: entry to ‘gfx_program_precompile_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2193:4: call_function: calling ‘gfx_program_init’ from ‘gfx_program_precompile_job’
#  159|         return NULL;
#  160|   
#  161|->    buf->size = newsize;
#  162|   
#  163|      return p;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1419]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_pack_color.h:99:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
#   97|      case PIPE_FORMAT_B5G6R5_UNORM:
#   98|         {
#   99|->          uc->us = ((r & 0xf8) << 8) | ((g & 0xfc) << 3) | (b >> 3);
#  100|         }
#  101|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1420]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_pack_color.h:104:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
#  102|      case PIPE_FORMAT_B5G5R5X1_UNORM:
#  103|         {
#  104|->          uc->us = ((0x80) << 8) | ((r & 0xf8) << 7) | ((g & 0xf8) << 2) | (b >> 3);
#  105|         }
#  106|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1421]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_pack_color.h:109:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
#  107|      case PIPE_FORMAT_B5G5R5A1_UNORM:
#  108|         {
#  109|->          uc->us = ((a & 0x80) << 8) | ((r & 0xf8) << 7) | ((g & 0xf8) << 2) | (b >> 3);
#  110|         }
#  111|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1422]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_pack_color.h:114:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
#  112|      case PIPE_FORMAT_B4G4R4A4_UNORM:
#  113|         {
#  114|->          uc->us = ((a & 0xf0) << 8) | ((r & 0xf0) << 4) | ((g & 0xf0) << 0) | (b >> 4);
#  115|         }
#  116|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1423]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_pack_color.h:119:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
#  117|      case PIPE_FORMAT_A8_UNORM:
#  118|         {
#  119|->          uc->ub = a;
#  120|         }
#  121|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1424]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_pack_color.h:125:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
#  123|      case PIPE_FORMAT_I8_UNORM:
#  124|         {
#  125|->          uc->ub = r;
#  126|         }
#  127|         return;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1425]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_printf.c:207:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘print_str’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_printf.c:300:6: enter_function: entry to ‘u_printf_ptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_printf.c:303:4: call_function: calling ‘u_printf_impl’ from ‘u_printf_ptr’
#  205|               uint64_t idx;
#  206|               memcpy(&idx, &buffer[buf_pos], 8);
#  207|->             fprintf(out, print_str, &fmt->strings[idx]);
#  208|   
#  209|            /* Never pass a 'n' spec to the host printf */

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1426]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_printf.c:211:29: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘print_str’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_printf.c:300:6: enter_function: entry to ‘u_printf_ptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_printf.c:303:4: call_function: calling ‘u_printf_impl’ from ‘u_printf_ptr’
#argument 1 of ‘__builtin_strchr’ must be non-null
#  209|            /* Never pass a 'n' spec to the host printf */
#  210|            } else if (print_str[spec_pos] != 'n') {
#  211|->             char *vec_pos = strchr(print_str, 'v');
#  212|               char *mod_pos = strpbrk(print_str, "hl");
#  213|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1427]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:325:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:393:1: enter_function: entry to ‘util_queue_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:445:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:448:38: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:449:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:453:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:454:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:454:12: call_function: calling ‘util_queue_create_thread’ from ‘util_queue_init’
#  323|      struct thread_input *input =
#  324|         (struct thread_input *) malloc(sizeof(struct thread_input));
#  325|->    input->queue = queue;
#  326|      input->thread_index = index;
#  327|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1428]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:594:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘jobs’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:577:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:578:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:578:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:578:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:583:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:585:37: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:594:13: danger: ‘jobs + (long unsigned int)num_jobs * 48’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/6)
#  592|   
#  593|            do {
#  594|->             jobs[num_jobs++] = queue->jobs[i];
#  595|               i = (i + 1) % queue->max_jobs;
#  596|            } while (i != queue->write_idx);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1429]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.h:77:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fences’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:697:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:708:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:710:13: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:713:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:714:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:714:7: call_function: inlined call to ‘util_queue_fence_init’ from ‘util_queue_finish’
#   75|   util_queue_fence_init(struct util_queue_fence *fence)
#   76|   {
#   77|->    fence->val = 0;
#   78|   }
#   79|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1430]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.h:108:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1233:1: enter_function: entry to ‘create_linked_separable_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1239:22: call_function: calling ‘gfx_program_create’ from ‘create_linked_separable_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1239:22: return_function: returning to ‘create_linked_separable_job’ from ‘gfx_program_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1239:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1241:4: call_function: inlined call to ‘util_queue_fence_reset’ from ‘create_linked_separable_job’
#  106|   {
#  107|   #ifdef NDEBUG
#  108|->    fence->val = 1;
#  109|   #else
#  110|      uint32_t v = (uint32_t)p_atomic_xchg(&fence->val, 1);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1431]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.h:180:8: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘__atomic_load_4(&*fence.val, 0)’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:685:1: enter_function: entry to ‘util_queue_finish’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:697:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:708:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:713:25: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:718:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:721:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:722:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.c:722:7: call_function: calling ‘util_queue_fence_wait’ from ‘util_queue_finish’
#  178|   util_queue_fence_wait(struct util_queue_fence *fence)
#  179|   {
#  180|->    if (unlikely(!util_queue_fence_is_signalled(fence)))
#  181|         _util_queue_fence_wait(fence);
#  182|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1432]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:118:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘d’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:116:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:118:4: danger: ‘d’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  116|      struct util_sync_provider_drm *d = CALLOC_STRUCT(util_sync_provider_drm);
#  117|   
#  118|->    d->drm_fd = drm_fd;
#  119|      d->base = (struct util_sync_provider) {
#  120|         .create = drm_syncobj_create,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1433]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:141:11: warning[-Wanalyzer-malloc-leak]: leak of ‘d’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:116:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:141:11: danger: ‘d’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  139|      }
#  140|   
#  141|->    return &d->base;
#  142|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1434]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_vector.h:69:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘hs.tex_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:61:24: release_memory: ‘hs.tex_instrs’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:70:4: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: release_memory: ‘hs.tex_instrs’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: call_function: inlined call to ‘nir_instr_worklist_is_empty’ from ‘nir_opt_tex_skip_helpers’
#   67|   u_vector_length(struct u_vector *queue)
#   68|   {
#   69|->    return (queue->head - queue->tail) / queue->element_size;
#   70|   }
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1435]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_vector.h:69:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘hs.worklist’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:61:24: release_memory: ‘hs.worklist’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:61:24: release_memory: ‘hs.worklist’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: release_memory: ‘hs.worklist’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: call_function: inlined call to ‘nir_instr_worklist_is_empty’ from ‘nir_opt_tex_skip_helpers’
#   67|   u_vector_length(struct u_vector *queue)
#   68|   {
#   69|->    return (queue->head - queue->tail) / queue->element_size;
#   70|   }
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1436]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_vector.h:90:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘wl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_optim.c:109:1: enter_function: entry to ‘store_instr_depends_on_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_optim.c:116:20: call_function: calling ‘check_instr_depends_on_tex’ from ‘store_instr_depends_on_tex’
#   88|   u_vector_finish(struct u_vector *queue)
#   89|   {
#   90|->    free(queue->data);
#   91|   }
#   92|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1437]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vl_bitstream.h:85:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffer’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_video.c:2480:1: enter_function: entry to ‘vk_video_encode_h265_slice_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_video.c:2492:4: call_function: calling ‘vl_bitstream_encoder_clear’ from ‘vk_video_encode_h265_slice_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_video.c:2492:4: return_function: returning to ‘vk_video_encode_h265_slice_header’ from ‘vl_bitstream_encoder_clear’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_video.c:2493:4: call_function: calling ‘emit_nalu_h265_header’ from ‘vk_video_encode_h265_slice_header’
#   83|      }
#   84|   
#   85|->    *buffer = val;
#   86|      offset++;
#   87|      enc->offset = offset;

Error: GCC_ANALYZER_WARNING (CWE-126): [#def1438]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vl_vlc.h:101:34: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture_h264_enc.c:781:1: enter_function: entry to ‘vlVaHandleVAEncPackedHeaderDataBufferTypeH264’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/va/picture_h264_enc.c:789:4: call_function: calling ‘vl_vlc_init’ from ‘vlVaHandleVAEncPackedHeaderDataBufferTypeH264’
#   99|      }
#  100|   
#  101|->    vlc->data = (const uint8_t *) vlc->inputs[0];
#  102|      vlc->end = vlc->data + len;
#  103|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1439]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:139:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘high_hole’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:122:7: branch_false: following ‘false’ branch (when ‘waste != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:128:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:128:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:138:38: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:138:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:139:4: danger: ‘high_hole’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  137|       */
#  138|      struct util_vma_hole *high_hole = calloc(1, sizeof(*hole));
#  139|->    high_hole->offset = offset + size;
#  140|      high_hole->size = waste;
#  141|   

Error: GCC_ANALYZER_WARNING (CWE-835): [#def1440]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:307:4: warning[-Wanalyzer-infinite-loop]: infinite loop
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:47:1: enter_function: entry to ‘util_vma_heap_init’
#  305|      /* Find immediately higher and lower holes if they exist. */
#  306|      struct util_vma_hole *high_hole = NULL, *low_hole = NULL;
#  307|->    util_vma_foreach_hole(hole, heap) {
#  308|         if (hole->offset <= offset) {
#  309|            low_hole = hole;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1441]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:341:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘hole’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:307:4: branch_false: following ‘false’ branch (when ‘hole == heap’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:317:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:317:25: branch_false: following ‘false’ branch (when ‘high_hole’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:323:24: branch_false: following ‘false’ branch (when ‘low_hole’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:330:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:330:14: branch_false: following ‘false’ branch (when ‘low_adjacent == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:333:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:333:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:339:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:339:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:341:7: danger: ‘hole’ could be NULL: unchecked value from [(11)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/10)
#  339|         struct util_vma_hole *hole = calloc(1, sizeof(*hole));
#  340|   
#  341|->       hole->offset = offset;
#  342|         hole->size = size;
#  343|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1442]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:353:1: warning[-Wanalyzer-malloc-leak]: leak of ‘hole’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:47:1: enter_function: entry to ‘util_vma_heap_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:52:7: branch_true: following ‘true’ branch (when ‘size != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:53:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/vma.c:53:7: call_function: calling ‘util_vma_heap_free’ from ‘util_vma_heap_init’
#  351|      heap->free_size += size;
#  352|      util_vma_heap_validate(heap);
#  353|-> }
#  354|   
#  355|   uint64_t

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1443]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1306:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1327:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: danger: ‘s’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
# 1330|      }
# 1331|   
# 1332|->    s->vtdev = to_vpipe_device(vdrm);
# 1333|   
# 1334|      return &s->base;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1444]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1334:11: warning[-Wanalyzer-malloc-leak]: leak of ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1306:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1327:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1334:11: danger: ‘s’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 1332|      s->vtdev = to_vpipe_device(vdrm);
# 1333|   
# 1334|->    return &s->base;
# 1335|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1445]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/venus-protocol/vn_protocol_driver_device_memory.h:763:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pnext’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_device_memory.c:617:1: enter_function: entry to ‘vn_GetMemoryFdPropertiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_device_memory.c:628:7: branch_false: following ‘false’ branch (when ‘handleType == 512’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_device_memory.c:632:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_device_memory.c:632:7: call_function: calling ‘vn_get_memory_dma_buf_properties’ from ‘vn_GetMemoryFdPropertiesKHR’
#  761|       while (true) {
#  762|           assert(pnext);
#  763|->         if (pnext->sType == stype)
#  764|               break;
#  765|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1446]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:188:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘local_regions’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:176:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:176:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:176:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:178:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:180:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:188:7: danger: ‘local_regions + (long unsigned int)i * 80’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  186|                                  regions[i].imageExtent);
#  187|   
#  188|->       local_regions[i] = (VkMemoryToImageCopyMESA){
#  189|            .sType = VK_STRUCTURE_TYPE_MEMORY_TO_IMAGE_COPY_MESA,
#  190|            .dataSize = data_size,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1447]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1653:1: warning[-Wanalyzer-malloc-leak]: leak of ‘submit.command.cur’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1669:1: enter_function: entry to ‘vn_remove_signaled_fences’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1672:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1673:57: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1673:25: call_function: calling ‘vn_GetFenceStatus’ from ‘vn_remove_signaled_fences’
# 1651|   
# 1652|      return vn_result(dev->instance, result);
# 1653|-> }
# 1654|   
# 1655|   static VkResult

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1448]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1673:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fences’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1708:1: enter_function: entry to ‘vn_WaitForFences’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1719:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1721:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1724:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1725:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1726:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1726:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1671|      uint32_t cur = 0;
# 1672|      for (uint32_t i = 0; i < *count; i++) {
# 1673|->       VkResult result = vn_GetFenceStatus(device, fences[i]);
# 1674|         if (result != VK_SUCCESS) {
# 1675|            if (result < 0)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1449]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1673:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1708:1: enter_function: entry to ‘vn_WaitForFences’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1719:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1720:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1721:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1724:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1725:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1726:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1726:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1671|      uint32_t cur = 0;
# 1672|      for (uint32_t i = 0; i < *count; i++) {
# 1673|->       VkResult result = vn_GetFenceStatus(device, fences[i]);
# 1674|         if (result != VK_SUCCESS) {
# 1675|            if (result < 0)

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1450]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2157:1: warning[-Wanalyzer-malloc-leak]: leak of ‘submit.command.cur’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2222:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2231:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2232:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2231:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2233:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2234:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2235:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2235:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: following ‘true’ branch (when ‘semaphores’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2237:7: branch_true: following ‘true’ branch (when ‘values’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2237:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2241:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2242:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2242:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2155|                                                   semaphore, pValue);
# 2156|      }
# 2157|-> }
# 2158|   
# 2159|   VkResult

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1451]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:999:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:968:1: enter_function: entry to ‘virtgpu_sync_create_from_syncobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:976:7: branch_true: following ‘true’ branch (when ‘sync_file != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:977:24: call_function: inlined call to ‘virtgpu_ioctl_syncobj_create’ from ‘virtgpu_sync_create_from_syncobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:977:24: call_function: inlined call to ‘virtgpu_ioctl_syncobj_create’ from ‘virtgpu_sync_create_from_syncobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:978:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:980:12: call_function: inlined call to ‘virtgpu_ioctl_syncobj_fd_to_handle’ from ‘virtgpu_sync_create_from_syncobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:980:12: call_function: inlined call to ‘virtgpu_ioctl_syncobj_fd_to_handle’ from ‘virtgpu_sync_create_from_syncobj’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:980:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:990:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:990:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:991:7: branch_false: following ‘false’ branch (when ‘sync’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:996:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:999:4: danger: ‘sync’ leaks here; was allocated at [(43)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/42)
#  997|      sync->base.sync_id = 0; /* TODO */
#  998|   
#  999|->    *out_sync = &sync->base;
# 1000|   
# 1001|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1452]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1043:4: warning[-Wanalyzer-malloc-leak]: leak of ‘sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1005:1: enter_function: entry to ‘virtgpu_sync_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1013:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1019:7: call_function: inlined call to ‘virtgpu_ioctl_syncobj_create’ from ‘virtgpu_sync_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1019:7: call_function: inlined call to ‘virtgpu_ioctl_syncobj_create’ from ‘virtgpu_sync_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1020:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1025:7: call_function: inlined call to ‘virtgpu_ioctl_syncobj_timeline_signal’ from ‘virtgpu_sync_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1025:7: call_function: inlined call to ‘virtgpu_ioctl_syncobj_timeline_signal’ from ‘virtgpu_sync_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1026:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1031:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1031:32: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1032:7: branch_false: following ‘false’ branch (when ‘sync’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1037:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_renderer_virtgpu.c:1043:4: danger: ‘sync’ leaks here; was allocated at [(27)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/26)
# 1041|      sync->base.sync_id = 0;
# 1042|   
# 1043|->    *out_sync = &sync->base;
# 1044|   
# 1045|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1453]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_ring.c:486:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘descs’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_ring.c:750:1: enter_function: entry to ‘vn_ring_wait_roundtrip’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_ring.c:752:4: call_function: calling ‘vn_async_vkWaitVirtqueueSeqnoMESA’ from ‘vn_ring_wait_roundtrip’
#  484|         const struct vn_cs_encoder_buffer *buf = &cs->buffers[i];
#  485|         if (buf->committed_size) {
#  486|->          descs[desc_count++] = (VkCommandStreamDescriptionMESA){
#  487|               .resourceId = buf->shmem->res_id,
#  488|               .offset = buf->offset,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1454]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:561:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:552:17: enter_function: entry to ‘device_select_EnumeratePhysicalDevices’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:556:33: call_function: calling ‘device_select_layer_get_instance’ from ‘device_select_EnumeratePhysicalDevices’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:556:33: return_function: returning to ‘device_select_EnumeratePhysicalDevices’ from ‘device_select_layer_get_instance’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:561:8: danger: dereference of NULL ‘device_select_layer_get_instance(instance)’
#  559|      const char* selection = getenv("MESA_VK_DEVICE_SELECT");
#  560|      bool expose_only_one_dev = false;
#  561|->    if (info->zink && info->xwayland)
#  562|         return info->EnumeratePhysicalDevices(instance, pPhysicalDeviceCount, pPhysicalDevices);
#  563|      VkResult result = info->EnumeratePhysicalDevices(instance, &physical_device_count, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1455]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:646:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:639:17: enter_function: entry to ‘device_select_EnumeratePhysicalDeviceGroups’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:643:33: call_function: calling ‘device_select_layer_get_instance’ from ‘device_select_EnumeratePhysicalDeviceGroups’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:643:33: return_function: returning to ‘device_select_EnumeratePhysicalDeviceGroups’ from ‘device_select_layer_get_instance’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:646:8: danger: dereference of NULL ‘device_select_layer_get_instance(instance)’
#  644|      uint32_t physical_device_group_count = 0;
#  645|      uint32_t selected_physical_device_group_count = 0;
#  646|->    if (info->zink && info->xwayland)
#  647|         return info->EnumeratePhysicalDeviceGroups(instance, pPhysicalDeviceGroupCount, pPhysicalDeviceGroups);
#  648|      VkResult result = info->EnumeratePhysicalDeviceGroups(instance, &physical_device_group_count, NULL);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1456]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:721:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:707:16: enter_function: entry to ‘get_instance_proc_addr’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:715:7: branch_false: following ‘false’ branch (when the strings are non-equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:717:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:717:7: branch_false: following ‘false’ branch (when the strings are non-equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:720:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:720:33: call_function: calling ‘device_select_layer_get_instance’ from ‘get_instance_proc_addr’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:720:33: return_function: returning to ‘get_instance_proc_addr’ from ‘device_select_layer_get_instance’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/device-select-layer/device_select_layer.c:721:11: danger: dereference of NULL ‘device_select_layer_get_instance(instance)’
#  719|   
#  720|      struct instance_info *info = device_select_layer_get_instance(instance);
#  721|->    return info->GetInstanceProcAddr(instance, name);
#  722|   }
#  723|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1457]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/radix_sort/radix_sort_vk.c:238:3: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘rs’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/radix_sort/radix_sort_vk.c:233:37: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/radix_sort/radix_sort_vk.c:238:3: danger: ‘rs’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  236|     // Save the config for layer
#  237|     //
#  238|->   rs->config = config;
#  239|   
#  240|     //

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1458]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/rmv/vk_rmv_common.c:76:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/rmv/vk_rmv_common.c:70:1: enter_function: entry to ‘vk_rmv_emit_token’
 branch_true: following ‘true’ branch (when ‘type <= 9’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/rmv/vk_rmv_common.c:75:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/rmv/vk_rmv_common.c:76:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘vk_rmv_emit_token’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/rmv/vk_rmv_common.c:76:4: return_function: returning to ‘vk_rmv_emit_token’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/rmv/vk_rmv_common.c:76:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*data.tokens, 1, 144)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#   74|      token.timestamp = (uint64_t)os_time_get_nano();
#   75|      memcpy(&token.data, token_data, vk_rmv_token_size_from_type(type));
#   76|->    util_dynarray_append(&data->tokens, struct vk_rmv_token, token);
#   77|   }
#   78|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1459]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1044:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bvh_states’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:998:1: enter_function: entry to ‘vk_cmd_build_acceleration_structures’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1011:35: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1034:25: branch_true: following ‘true’ branch (when ‘i < infoCount’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1040:7: call_function: calling ‘get_scratch_layout’ from ‘vk_cmd_build_acceleration_structures’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1040:7: return_function: returning to ‘vk_cmd_build_acceleration_structures’ from ‘get_scratch_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1042:36: call_function: calling ‘build_config’ from ‘vk_cmd_build_acceleration_structures’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1042:36: return_function: returning to ‘vk_cmd_build_acceleration_structures’ from ‘build_config’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_acceleration_structure.c:1044:7: danger: ‘bvh_states + (long unsigned int)i * 136’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 1042|         struct build_config config = build_config(leaf_node_count, pInfos + i,
# 1043|                                                   device->as_build_ops);
# 1044|->       bvh_states[i].config = config;
# 1045|   
# 1046|         if (config.updateable)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1460]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:43:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘region2s’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:40:4: branch_false: following ‘false’ branch (when ‘regionCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:40:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:40:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:42:25: branch_true: following ‘true’ branch (when ‘r < regionCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:43:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:43:7: danger: ‘region2s + (long unsigned int)r * 40’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#   41|   
#   42|      for (uint32_t r = 0; r < regionCount; r++) {
#   43|->       region2s[r] = (VkBufferCopy2) {
#   44|            .sType      = VK_STRUCTURE_TYPE_BUFFER_COPY_2,
#   45|            .srcOffset  = pRegions[r].srcOffset,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1461]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:81:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘region2s’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:78:4: branch_false: following ‘false’ branch (when ‘regionCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:78:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:78:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:80:25: branch_true: following ‘true’ branch (when ‘r < regionCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:81:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:81:7: danger: ‘region2s + (long unsigned int)r * 88’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#   79|   
#   80|      for (uint32_t r = 0; r < regionCount; r++) {
#   81|->       region2s[r] = (VkImageCopy2) {
#   82|            .sType            = VK_STRUCTURE_TYPE_IMAGE_COPY_2,
#   83|            .srcSubresource   = pRegions[r].srcSubresource,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1462]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:122:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘region2s’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:119:4: branch_false: following ‘false’ branch (when ‘regionCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:119:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:119:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:121:25: branch_true: following ‘true’ branch (when ‘r < regionCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:122:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:122:7: danger: ‘region2s + (long unsigned int)r * 72’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2)
#  120|   
#  121|      for (uint32_t r = 0; r < regionCount; r++) {
#  122|->       region2s[r] = (VkBufferImageCopy2) {
#  123|            .sType               = VK_STRUCTURE_TYPE_BUFFER_IMAGE_COPY_2,
#  124|            .bufferOffset        = pRegions[r].bufferOffset,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1463]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:163:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘region2s’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:160:4: branch_false: following ‘false’ branch (when ‘regionCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:160:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:160:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:162:25: branch_true: following ‘true’ branch (when ‘r < regionCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:163:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:163:7: danger: ‘region2s + (long unsigned int)r * 72’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
#  161|   
#  162|      for (uint32_t r = 0; r < regionCount; r++) {
#  163|->       region2s[r] = (VkBufferImageCopy2) {
#  164|            .sType               = VK_STRUCTURE_TYPE_BUFFER_IMAGE_COPY_2,
#  165|            .bufferOffset        = pRegions[r].bufferOffset,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1464]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:206:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘region2s’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:203:4: branch_false: following ‘false’ branch (when ‘regionCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:203:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:203:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:205:25: branch_true: following ‘true’ branch (when ‘r < regionCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:206:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:206:7: danger: ‘region2s + (long unsigned int)r * 96’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  204|   
#  205|      for (uint32_t r = 0; r < regionCount; r++) {
#  206|->       region2s[r] = (VkImageBlit2) {
#  207|            .sType            = VK_STRUCTURE_TYPE_IMAGE_BLIT_2,
#  208|            .srcSubresource   = pRegions[r].srcSubresource,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1465]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:254:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘region2s’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:251:4: branch_false: following ‘false’ branch (when ‘regionCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:251:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:251:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:253:25: branch_true: following ‘true’ branch (when ‘r < regionCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:254:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_copy.c:254:7: danger: ‘region2s + (long unsigned int)r * 88’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
#  252|   
#  253|      for (uint32_t r = 0; r < regionCount; r++) {
#  254|->       region2s[r] = (VkImageResolve2) {
#  255|            .sType            = VK_STRUCTURE_TYPE_IMAGE_RESOLVE_2,
#  256|            .srcSubresource   = pRegions[r].srcSubresource,

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1466]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:821:16: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:761:28: enter_function: entry to ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:773:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetInfo’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:774:62: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:808:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:809:118: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:813:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:814:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:818:77: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:818:77: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:820:62: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:821:16: danger: argument 2 (‘<unknown>’) NULL where non-null expected
#argument 2 of ‘__builtin_memcpy’ must be non-null
#  819|                  assert(uniform_data);
#  820|                  VkWriteDescriptorSetInlineUniformBlock *dst = rzalloc(ctx, VkWriteDescriptorSetInlineUniformBlock);
#  821|->                memcpy((void*)dst, uniform_data, sizeof(*uniform_data));
#  822|                  dst->pData = ralloc_size(ctx, uniform_data->dataSize);
#  823|                  memcpy((void*)dst->pData, uniform_data->pData, uniform_data->dataSize);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1467]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:864:83: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:761:28: enter_function: entry to ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:773:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetInfo’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:774:62: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:808:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:809:118: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:813:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:814:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:862:19: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:862:19: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:864:83: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_cmd_enqueue.c:864:83: danger: dereference of NULL ‘<unknown>’
#  862|                     vk_find_struct_const(write->pNext, WRITE_DESCRIPTOR_SET_ACCELERATION_STRUCTURE_KHR);
#  863|   
#  864|->                uint32_t accel_structs_size = sizeof(VkAccelerationStructureKHR) * accel_structs->accelerationStructureCount;
#  865|                  VkWriteDescriptorSetAccelerationStructureKHR *write_accel_structs =
#  866|                     rzalloc_size(ctx, sizeof(VkWriteDescriptorSetAccelerationStructureKHR) + accel_structs_size);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1468]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_debug_utils.c:355:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_debug_utils.c:351:1: enter_function: entry to ‘vk_common_append_debug_label’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_debug_utils.c:355:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘vk_common_append_debug_label’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_debug_utils.c:355:4: return_function: returning to ‘vk_common_append_debug_label’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_debug_utils.c:355:4: danger: argument 1 (‘util_dynarray_grow_bytes(labels, 1, 40)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  353|                                const VkDebugUtilsLabelEXT *pLabelInfo)
#  354|   {
#  355|->    util_dynarray_append(labels, VkDebugUtilsLabelEXT, *pLabelInfo);
#  356|      VkDebugUtilsLabelEXT *current_label =
#  357|         util_dynarray_top_ptr(labels, VkDebugUtilsLabelEXT);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1469]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:598:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mem_reqs2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:587:7: branch_false: following ‘false’ branch (when ‘pSparseMemoryRequirements’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:595:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:595:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:595:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:595:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:597:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:598:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:598:7: danger: ‘mem_reqs2 + (long unsigned int)i * 64’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  596|   
#  597|      for (unsigned i = 0; i < *pSparseMemoryRequirementCount; ++i) {
#  598|->       mem_reqs2[i].sType = VK_STRUCTURE_TYPE_SPARSE_IMAGE_MEMORY_REQUIREMENTS_2;
#  599|         mem_reqs2[i].pNext = NULL;
#  600|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1470]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:636:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘device’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:127:1: enter_function: entry to ‘vk_device_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:181:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:184:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:227:4: branch_false: following ‘false’ branch (when ‘<unknown> == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:227:4: branch_true: following ‘true’ branch (when ‘<unknown> != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:240:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:247:28: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:248:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:14: call_function: calling ‘vk_device_get_timestamp’ from ‘vk_device_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:14: return_function: returning to ‘vk_device_init’ from ‘vk_device_get_timestamp’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:247:63: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:247:28: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:248:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:14: call_function: calling ‘vk_device_get_timestamp’ from ‘vk_device_init’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:14: return_function: returning to ‘vk_device_init’ from ‘vk_device_get_timestamp’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:247:63: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:247:28: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:248:32: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device.c:250:14: call_function: calling ‘vk_device_get_timestamp’ from ‘vk_device_init’
#  634|      if (domain == VK_TIME_DOMAIN_DEVICE_KHR) {
#  635|         assert(device && device->get_timestamp);
#  636|->       return device->get_timestamp(device, timestamp);
#  637|      }
#  638|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def1471]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:170:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:45:1: enter_function: entry to ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:68:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:69:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:70:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:71:14: call_function: inlined call to ‘vk_multialloc_zalloc2’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:73:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:76:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:78:4: release_memory: ‘pc_layouts’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:78:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:170:10: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:170:4: danger: argument 1 (‘*(struct vk_indirect_command_layout *)<unknown>.pc_layouts’) NULL where non-null expected
#  168|      }
#  169|   
#  170|->    qsort(elayout->pc_layouts, elayout->n_pc_layouts,
#  171|            sizeof(elayout->pc_layouts[0]), compare_pc_layout);
#  172|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1472]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:239:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:223:4: branch_false: following ‘false’ branch (when ‘wait_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:223:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:223:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:228:25: branch_true: following ‘true’ branch (when ‘i < wait_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:232:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:239:7: danger: ‘handles + (long unsigned int)j * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  237|         }
#  238|   
#  239|->       handles[j] = to_drm_syncobj(waits[i].sync)->syncobj;
#  240|         wait_values[j] = waits[i].wait_value;
#  241|         j++;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1473]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:240:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘wait_values’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:223:4: branch_false: following ‘false’ branch (when ‘wait_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:223:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:224:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:228:25: branch_true: following ‘true’ branch (when ‘i < wait_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:232:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_drm_syncobj.c:240:7: danger: ‘wait_values + (long unsigned int)j * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#  238|   
#  239|         handles[j] = to_drm_syncobj(waits[i].sync)->syncobj;
#  240|->       wait_values[j] = waits[i].wait_value;
#  241|         j++;
#  242|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1474]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:272:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘waits’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:260:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:263:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:263:7: branch_false: following ‘false’ branch (when ‘fenceCount != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:266:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:268:4: branch_false: following ‘false’ branch (when ‘fenceCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:268:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:268:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:270:25: branch_true: following ‘true’ branch (when ‘i < fenceCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:271:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_fence.c:272:7: danger: ‘waits + (long unsigned int)i * 24’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/6)
#  270|      for (uint32_t i = 0; i < fenceCount; i++) {
#  271|         VK_FROM_HANDLE(vk_fence, fence, pFences[i]);
#  272|->       waits[i] = (struct vk_sync_wait) {
#  273|            .sync = vk_fence_get_active_sync(fence),
#  274|            .stage_mask = ~(VkPipelineStageFlags2)0,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1475]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:50:35: warning[-Wanalyzer-malloc-leak]: leak of ‘cache_key_create(obj_type,  key_data,  key_size)’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:483:1: enter_function: entry to ‘vk_meta_create_compute_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:495:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:498:32: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:498:32: call_function: calling ‘vk_meta_cache_object’ from ‘vk_meta_create_compute_pipeline’
#   48|      assert(key_size <= UINT32_MAX);
#   49|   
#   50|->    struct cache_key *key = malloc(sizeof(*key) + key_size);
#   51|      *key = (struct cache_key) {
#   52|         .obj_type = obj_type,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1476]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:51:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘key’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:240:1: enter_function: entry to ‘vk_meta_create_pipeline_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:251:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:255:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:255:7: call_function: calling ‘vk_meta_cache_object’ from ‘vk_meta_create_pipeline_layout’
#   49|   
#   50|      struct cache_key *key = malloc(sizeof(*key) + key_size);
#   51|->    *key = (struct cache_key) {
#   52|         .obj_type = obj_type,
#   53|         .key_size = key_size,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1477]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:319:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stages’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:311:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:311:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:311:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:319:4: danger: ‘stages’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
#  317|         .nir = vk_meta_draw_rects_vs_nir(meta, use_gs),
#  318|      };
#  319|->    stages[stage_count++] = (VkPipelineShaderStageCreateInfo) {
#  320|         .sType = VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO,
#  321|         .pNext = &vs_nir_info,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1478]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:357:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘dyn_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:311:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:315:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:352:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:352:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:355:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:355:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:355:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:356:25: branch_true: following ‘true’ branch (when ‘i < dyn_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:357:22: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:357:7: danger: ‘dyn_state + (long unsigned int)i * 4’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/6)
#  355|      STACK_ARRAY(VkDynamicState, dyn_state, dyn_count + 2);
#  356|      for (uint32_t i = 0; i < dyn_count; i++)
#  357|->       dyn_state[i] = info->pDynamicState->pDynamicStates[i];
#  358|   
#  359|      dyn_state[dyn_count + 0] = VK_DYNAMIC_STATE_VIEWPORT;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1479]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_object_list.h:30:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:546:1: enter_function: entry to ‘vk_meta_create_buffer_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:556:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:561:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:559:4: call_function: inlined call to ‘vk_meta_object_list_add_handle’ from ‘vk_meta_create_buffer_view’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta.c:559:4: call_function: inlined call to ‘vk_meta_object_list_add_handle’ from ‘vk_meta_create_buffer_view’
#   28|                               struct vk_object_base *obj)
#   29|   {
#   30|->    util_dynarray_append(&mol->arr, struct vk_object_base *, obj);
#   31|   }
#   32|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1480]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:158:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘props2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:148:7: branch_false: following ‘false’ branch (when ‘pQueueFamilyProperties’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:155:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:155:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:155:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:155:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:157:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:158:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:158:7: danger: ‘props2 + (long unsigned int)i * 40’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  156|   
#  157|      for (unsigned i = 0; i < *pQueueFamilyPropertyCount; ++i) {
#  158|->       props2[i].sType = VK_STRUCTURE_TYPE_QUEUE_FAMILY_PROPERTIES_2;
#  159|         props2[i].pNext = NULL;
#  160|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1481]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:270:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘props2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:259:7: branch_false: following ‘false’ branch (when ‘pProperties’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:267:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:267:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:267:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:267:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:269:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:270:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_physical_device.c:270:7: danger: ‘props2 + (long unsigned int)i * 40’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  268|   
#  269|      for (unsigned i = 0; i < *pNumProperties; ++i) {
#  270|->       props2[i].sType = VK_STRUCTURE_TYPE_SPARSE_IMAGE_FORMAT_PROPERTIES_2;
#  271|         props2[i].pNext = NULL;
#  272|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1482]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1960:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pipeline_layout’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1928:1: enter_function: entry to ‘vk_pipeline_compile_compute_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1939:7: branch_false: following ‘false’ branch (when ‘pipeline_layout’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1950:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1950:7: call_function: calling ‘vk_pipeline_to_shader_flags’ from ‘vk_pipeline_compile_compute_stage’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1950:7: return_function: returning to ‘vk_pipeline_compile_compute_stage’ from ‘vk_pipeline_to_shader_flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_pipeline.c:1960:29: danger: dereference of NULL ‘pipeline_layout’
# 1958|      _mesa_blake3_update(&blake3_ctx, &shader_flags, sizeof(shader_flags));
# 1959|   
# 1960|->    for (uint32_t i = 0; i < pipeline_layout->set_count; i++) {
# 1961|         if (pipeline_layout->set_layouts[i] != NULL) {
# 1962|            _mesa_blake3_update(&blake3_ctx,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1483]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1294:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘waits’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1251:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1271:44: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1271:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1274:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1276:7: branch_false: following ‘false’ branch (when ‘wait_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1279:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1279:4: branch_false: following ‘false’ branch (when ‘wait_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1279:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1279:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1281:25: branch_true: following ‘true’ branch (when ‘i < wait_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1282:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1294:7: danger: ‘waits + (long unsigned int)i * 24’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8)
# 1292|         assert(semaphore->type == VK_SEMAPHORE_TYPE_BINARY);
# 1293|   
# 1294|->       waits[i] = (struct vk_sync_wait) {
# 1295|            .sync = vk_semaphore_get_active_sync(semaphore),
# 1296|            .stage_mask = ~(VkPipelineStageFlags2)0,

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1484]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1419:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1382:1: enter_function: entry to ‘vk_common_QueueSubmit2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1391:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1394:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1394:7: branch_false: following ‘false’ branch (when ‘submitCount != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1402:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1403:25: branch_true: following ‘true’ branch (when ‘i < submitCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1404:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1412:19: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1404:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1415:16: call_function: calling ‘vk_queue_submit_create’ from ‘vk_common_QueueSubmit2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1415:16: return_function: returning to ‘vk_common_QueueSubmit2’ from ‘vk_queue_submit_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1416:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1419:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_queue.c:1419:16: danger: use of uninitialized value ‘submit’ here
# 1417|            return result;
# 1418|   
# 1419|->       result = vk_queue_merge_submit(queue, &last_submit, submit);
# 1420|         if (unlikely(result != VK_SUCCESS))
# 1421|            return result;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1485]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:1227:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2425:1: enter_function: entry to ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2448:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2452:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2452:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2550:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2550:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2552:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2553:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2553:43: call_function: calling ‘clone_rp_sample_locations’ from ‘vk_common_CmdBeginRenderPass2’
# 1225|                      sli_in->sampleLocationsCount);
# 1226|   
# 1227|->       new_att_sl[i] = (VkAttachmentSampleLocationsEXT) {
# 1228|            .attachmentIndex = att_sl_in->attachmentIndex,
# 1229|            .sampleLocationsInfo = {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1486]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:1249:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2425:1: enter_function: entry to ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2448:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2452:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2452:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2550:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2550:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2552:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2553:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2553:43: call_function: calling ‘clone_rp_sample_locations’ from ‘vk_common_CmdBeginRenderPass2’
# 1247|                      sli_in->sampleLocationsCount);
# 1248|   
# 1249|->       new_sp_sl[i] = (VkSubpassSampleLocationsEXT) {
# 1250|            .subpassIndex = sp_sl_in->subpassIndex,
# 1251|            .sampleLocationsInfo = {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1487]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:1762:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘color_attachment’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2594:1: enter_function: entry to ‘vk_common_CmdNextSubpass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2602:4: call_function: calling ‘begin_subpass’ from ‘vk_common_CmdNextSubpass2’
# 1760|   
# 1761|         if (sp_att->attachment == VK_ATTACHMENT_UNUSED) {
# 1762|->          *color_attachment = (VkRenderingAttachmentInfo) {
# 1763|               .sType = VK_STRUCTURE_TYPE_RENDERING_ATTACHMENT_INFO,
# 1764|               .imageView = VK_NULL_HANDLE,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1488]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:1775:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘color_attachment’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2594:1: enter_function: entry to ‘vk_common_CmdNextSubpass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2602:4: call_function: calling ‘begin_subpass’ from ‘vk_common_CmdNextSubpass2’
# 1773|            &cmd_buffer->attachments[sp_att->attachment];
# 1774|   
# 1775|->       *color_attachment = (VkRenderingAttachmentInfo) {
# 1776|            .sType = VK_STRUCTURE_TYPE_RENDERING_ATTACHMENT_INFO,
# 1777|            .imageView = vk_image_view_to_handle(att_state->image_view),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1489]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2533:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘att_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2425:1: enter_function: entry to ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2444:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2445:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2445:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2452:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2452:7: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_CmdBeginRenderPass2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2466:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2467:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_render_pass.c:2533:7: danger: ‘att_state’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/3)
# 2531|            assert(util_last_bit(pass_att->view_mask) <= image_view->layer_count);
# 2532|   
# 2533|->       *att_state = (struct vk_attachment_state) {
# 2534|            .image_view = image_view,
# 2535|            .views_loaded = 0,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1490]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:79:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:71:1: enter_function: entry to ‘vk_sampler_border_color_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:74:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:76:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:76:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:76:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:78:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:78:10: branch_true: following ‘true’ branch (when ‘format_out’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:79:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:79:24: danger: dereference of NULL ‘<unknown>’
#   77|                                 SAMPLER_CUSTOM_BORDER_COLOR_CREATE_INFO_EXT);
#   78|         if (format_out)
#   79|->          *format_out = border_color_info->format;
#   80|   
#   81|         return border_color_info->customBorderColor;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1491]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:81:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:71:1: enter_function: entry to ‘vk_sampler_border_color_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:74:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:76:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:76:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:76:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:78:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:78:10: branch_false: following ‘false’ branch (when ‘format_out’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:81:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sampler.c:81:14: danger: dereference of NULL ‘<unknown>’
#   79|            *format_out = border_color_info->format;
#   80|   
#   81|->       return border_color_info->customBorderColor;
#   82|      } else {
#   83|         if (format_out)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1492]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:350:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘waits’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:335:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:338:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:338:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:341:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:344:4: branch_false: following ‘false’ branch (when ‘wait_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:344:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:344:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:346:25: branch_true: following ‘true’ branch (when ‘i < wait_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:347:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_semaphore.c:350:7: danger: ‘waits + (long unsigned int)i * 24’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/6)
#  348|         assert(semaphore->type == VK_SEMAPHORE_TYPE_TIMELINE);
#  349|   
#  350|->       waits[i] = (struct vk_sync_wait) {
#  351|            .sync = vk_semaphore_get_active_sync(semaphore),
#  352|            .stage_mask = ~(VkPipelineStageFlags2)0,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1493]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:606:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stages’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:600:4: branch_false: following ‘false’ branch (when ‘stageCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:600:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:600:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:604:25: branch_true: following ‘true’ branch (when ‘i < stageCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:605:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:606:7: danger: ‘stages + (long unsigned int)i * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  604|      for (uint32_t i = 0; i < stageCount; i++) {
#  605|         vk_stages |= pStages[i];
#  606|->       stages[i] = vk_to_mesa_shader_stage(pStages[i]);
#  607|         shaders[i] = pShaders != NULL ? vk_shader_from_handle(pShaders[i]) : NULL;
#  608|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1494]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:607:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shaders’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:600:4: branch_false: following ‘false’ branch (when ‘stageCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:600:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:601:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:604:25: branch_true: following ‘true’ branch (when ‘i < stageCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:605:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:607:20: branch_false: following ‘false’ branch (when ‘pShaders’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:607:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_shader.c:607:7: danger: ‘shaders + (long unsigned int)i * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
#  605|         vk_stages |= pStages[i];
#  606|         stages[i] = vk_to_mesa_shader_stage(pStages[i]);
#  607|->       shaders[i] = pShaders != NULL ? vk_shader_from_handle(pShaders[i]) : NULL;
#  608|      }
#  609|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1495]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:102:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘timeline_waits’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:97:4: branch_false: following ‘false’ branch (when ‘wait_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:97:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:97:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:99:25: branch_true: following ‘true’ branch (when ‘wait_count > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:100:62: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_sync_binary.c:102:7: danger: ‘timeline_waits + (long unsigned int)i * 24’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  100|         struct vk_sync_binary *binary = to_vk_sync_binary(waits[i].sync);
#  101|   
#  102|->       timeline_waits[i] = (struct vk_sync_wait) {
#  103|            .sync = &binary->timeline,
#  104|            .stage_mask = waits[i].stage_mask,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1496]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:187:28: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘memory_barriers’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:179:4: branch_false: following ‘false’ branch (when ‘memoryBarrierCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:179:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:179:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: branch_true: following ‘true’ branch (when ‘bufferMemoryBarrierCount <= 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: branch_true: following ‘true’ branch (when ‘imageMemoryBarrierCount <= 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:183:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:186:25: branch_true: following ‘true’ branch (when ‘i < memoryBarrierCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:187:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:187:28: danger: ‘memory_barriers + (long unsigned int)i * 48’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  185|   
#  186|      for (uint32_t i = 0; i < memoryBarrierCount; i++) {
#  187|->       memory_barriers[i] = upgrade_memory_barrier(&pMemoryBarriers[i],
#  188|                                                     src_stage_mask2,
#  189|                                                     dst_stage_mask2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1497]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:192:28: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffer_barriers’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:179:4: branch_true: following ‘true’ branch (when ‘memoryBarrierCount <= 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: branch_false: following ‘false’ branch (when ‘bufferMemoryBarrierCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: branch_true: following ‘true’ branch (when ‘imageMemoryBarrierCount <= 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:183:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:186:25: branch_false: following ‘false’ branch (when ‘i >= memoryBarrierCount’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:191:25: branch_true: following ‘true’ branch (when ‘i < bufferMemoryBarrierCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:192:80: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:192:28: danger: ‘buffer_barriers + (long unsigned int)i * 80’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  190|      }
#  191|      for (uint32_t i = 0; i < bufferMemoryBarrierCount; i++) {
#  192|->       buffer_barriers[i] = upgrade_buffer_memory_barrier(&pBufferMemoryBarriers[i],
#  193|                                                            src_stage_mask2,
#  194|                                                            dst_stage_mask2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1498]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:197:27: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘image_barriers’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:179:4: branch_true: following ‘true’ branch (when ‘memoryBarrierCount <= 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:180:4: branch_true: following ‘true’ branch (when ‘bufferMemoryBarrierCount <= 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: branch_false: following ‘false’ branch (when ‘imageMemoryBarrierCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:181:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:186:25: branch_false: following ‘false’ branch (when ‘i >= memoryBarrierCount’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:196:25: branch_true: following ‘true’ branch (when ‘i < imageMemoryBarrierCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:197:77: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:197:27: danger: ‘image_barriers + (long unsigned int)i * 96’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/6)
#  195|      }
#  196|      for (uint32_t i = 0; i < imageMemoryBarrierCount; i++) {
#  197|->       image_barriers[i] = upgrade_image_memory_barrier(&pImageMemoryBarriers[i],
#  198|                                                          src_stage_mask2,
#  199|                                                          dst_stage_mask2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1499]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:305:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘deps’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:288:7: branch_false: following ‘false’ branch (when ‘eventCount != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:291:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:291:4: branch_false: following ‘false’ branch (when ‘eventCount > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:291:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:291:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:304:25: branch_true: following ‘true’ branch (when ‘i < eventCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:305:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_synchronization.c:305:7: danger: ‘deps + (long unsigned int)i * 64’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/4)
#  303|   
#  304|      for (uint32_t i = 0; i < eventCount; i++) {
#  305|->       deps[i] = (VkDependencyInfo) {
#  306|            .sType = VK_STRUCTURE_TYPE_DEPENDENCY_INFO,
#  307|            .memoryBarrierCount = 1,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1500]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:414:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘device’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:488:1: enter_function: entry to ‘vk_texcompress_astc_get_decode_pipeline’
 branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:495:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:495:4: call_function: calling ‘simple_mtx_lock’ from ‘vk_texcompress_astc_get_decode_pipeline’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:495:4: return_function: returning to ‘vk_texcompress_astc_get_decode_pipeline’ from ‘simple_mtx_lock’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:497:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:500:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:500:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:501:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_texcompress_astc.c:501:16: call_function: calling ‘vk_astc_create_shader_module’ from ‘vk_texcompress_astc_get_decode_pipeline’
#  412|      };
#  413|   
#  414|->    return disp->CreateShaderModule(_device, &shader_module_create_info,
#  415|                                      allocator, &astc->shader_module);
#  416|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1501]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.c:102:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘spec_entries’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.c:89:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.c:94:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.c:96:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.c:97:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.c:102:7: danger: ‘spec_entries + (long unsigned int)i * 24’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  100|                (uint8_t *)spec_info->pData + spec_info->dataSize);
#  101|   
#  102|->       spec_entries[i].id = spec_info->pMapEntries[i].constantID;
#  103|         switch (entry.size) {
#  104|         case 8:

Error: GCC_ANALYZER_WARNING (CWE-1335): [#def1502]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/util/vk_util.h:326:35: warning[-Wanalyzer-shift-count-overflow]: shift by count (‘4294967295’) >= precision of type (‘32’)
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:700:1: enter_function: entry to ‘radv_GetPipelineExecutablePropertiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:704:33: call_function: calling ‘radv_get_executable_count’ from ‘radv_GetPipelineExecutablePropertiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:704:33: return_function: returning to ‘radv_GetPipelineExecutablePropertiesKHR’ from ‘radv_get_executable_count’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:706:7: branch_false: following ‘false’ branch (when ‘pProperties’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:711:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:712:38: branch_true: following ‘true’ branch (when ‘executable_idx < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:714:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:714:36: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutablePropertiesKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:714:36: return_function: returning to ‘radv_GetPipelineExecutablePropertiesKHR’ from ‘radv_get_shader_from_executable_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_pipeline.c:716:44: call_function: inlined call to ‘mesa_to_vk_shader_stage’ from ‘radv_GetPipelineExecutablePropertiesKHR’
#  324|   mesa_to_vk_shader_stage(gl_shader_stage mesa_stage)
#  325|   {
#  326|->    return (VkShaderStageFlagBits) (1 << ((uint32_t) mesa_stage));
#  327|   }
#  328|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1503]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1379:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stage_flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1376:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1376:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1376:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1378:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1379:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common.c:1379:7: danger: ‘stage_flags + (long unsigned int)s * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
# 1377|                  MAX2(1, pPresentInfo->waitSemaphoreCount));
# 1378|      for (uint32_t s = 0; s < MAX2(1, pPresentInfo->waitSemaphoreCount); s++)
# 1379|->       stage_flags[s] = VK_PIPELINE_STAGE_ALL_COMMANDS_BIT;
# 1380|   
# 1381|      const VkPresentRegionsKHR *regions =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1504]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:978:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:931:1: enter_function: entry to ‘wsi_display_surface_get_capabilities2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:945:7: call_function: inlined call to ‘__vk_find_struct’ from ‘wsi_display_surface_get_capabilities2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:945:7: call_function: inlined call to ‘__vk_find_struct’ from ‘wsi_display_surface_get_capabilities2’
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:947:7: call_function: inlined call to ‘__vk_find_struct’ from ‘wsi_display_surface_get_capabilities2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:947:7: call_function: inlined call to ‘__vk_find_struct’ from ‘wsi_display_surface_get_capabilities2’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:949:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:949:7: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:953:4: branch_false: following ‘false’ branch (when ‘<unknown> == 0’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:953:4: branch_true: following ‘true’ branch (when ‘ext’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:954:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:975:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:976:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:976:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:978:43: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_display.c:978:43: danger: dereference of NULL ‘<unknown>’
#  976|               if (compat->presentModeCount) {
#  977|                  assert(present_mode);
#  978|->                compat->pPresentModes[0] = present_mode->presentMode;
#  979|                  compat->presentModeCount = 1;
#  980|               }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1505]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:717:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:660:1: enter_function: entry to ‘wsi_create_native_image_mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:695:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:698:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:698:13: call_function: calling ‘wsi_init_image_dmabuf_fd’ from ‘wsi_create_native_image_mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:698:13: return_function: returning to ‘wsi_create_native_image_mem’ from ‘wsi_init_image_dmabuf_fd’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:699:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:702:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:702:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:703:45: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:709:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:712:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:717:27: danger: dereference of NULL ‘<unknown>’
#  715|         const struct VkDrmFormatModifierPropertiesEXT *mod_props =
#  716|            get_modifier_props(info, image->drm_modifier);
#  717|->       image->num_planes = mod_props->drmFormatModifierPlaneCount;
#  718|   
#  719|         for (uint32_t p = 0; p < image->num_planes; p++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1506]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:871:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:927:1: enter_function: entry to ‘wsi_drm_wait_for_explicit_sync_release’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:936:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:959:7: branch_false: following ‘false’ branch (when ‘unacquired_image_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:964:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:964:4: call_function: calling ‘wsi_drm_images_explicit_sync_state’ from ‘wsi_drm_wait_for_explicit_sync_release’
#  869|             * It must be free.
#  870|             */
#  871|->          flags[i] = WSI_ES_STATE_RELEASE_SIGNALLED | WSI_ES_STATE_RELEASE_MATERIALIZED | WSI_ES_STATE_ACQUIRE_SIGNALLED;
#  872|            return;
#  873|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1507]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:880:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘points’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:867:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:866:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:876:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:876:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:876:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:879:16: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:880:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:880:7: danger: ‘points + (long unsigned int)(i * 2) * 8’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/4)
#  878|   
#  879|      for (i = 0; i < count; i++) {
#  880|->       points[i * WSI_ES_COUNT + WSI_ES_ACQUIRE] = 0;
#  881|         points[i * WSI_ES_COUNT + WSI_ES_RELEASE] = 0;
#  882|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1508]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:884:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:867:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:866:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:876:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:876:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:877:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:879:16: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:880:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:884:7: danger: ‘handles + (long unsigned int)(i * 2) * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/4)
#  882|   
#  883|         image = images[indices[i]];
#  884|->       handles[i * WSI_ES_COUNT + WSI_ES_ACQUIRE] = image->explicit_sync[WSI_ES_ACQUIRE].handle;
#  885|         handles[i * WSI_ES_COUNT + WSI_ES_RELEASE] = image->explicit_sync[WSI_ES_RELEASE].handle;
#  886|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1509]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:952:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘handles’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:952:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:952:7: danger: ‘handles + (long unsigned int)unacquired_image_count * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  950|            continue;
#  951|   
#  952|->       handles[unacquired_image_count] = images[i]->explicit_sync[WSI_ES_RELEASE].handle;
#  953|         points[unacquired_image_count] = images[i]->explicit_sync[WSI_ES_RELEASE].timeline;
#  954|         indices[unacquired_image_count] = i;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1510]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:953:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘points’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:934:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:952:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:953:7: danger: ‘points + (long unsigned int)unacquired_image_count * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
#  951|   
#  952|         handles[unacquired_image_count] = images[i]->explicit_sync[WSI_ES_RELEASE].handle;
#  953|->       points[unacquired_image_count] = images[i]->explicit_sync[WSI_ES_RELEASE].timeline;
#  954|         indices[unacquired_image_count] = i;
#  955|         unacquired_image_count++;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1511]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:954:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘indices’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:952:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:954:7: danger: ‘indices + (long unsigned int)unacquired_image_count * 4’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/4)
#  952|         handles[unacquired_image_count] = images[i]->explicit_sync[WSI_ES_RELEASE].handle;
#  953|         points[unacquired_image_count] = images[i]->explicit_sync[WSI_ES_RELEASE].timeline;
#  954|->       indices[unacquired_image_count] = i;
#  955|         unacquired_image_count++;
#  956|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1512]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:976:15: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘flags’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:927:1: enter_function: entry to ‘wsi_drm_wait_for_explicit_sync_release’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:933:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: following ‘false’ branch (when ‘image_count > 8’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:935:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:936:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:948:25: branch_true: following ‘true’ branch (when ‘i < image_count’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:949:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:959:7: branch_false: following ‘false’ branch (when ‘unacquired_image_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:964:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:964:4: call_function: calling ‘wsi_drm_images_explicit_sync_state’ from ‘wsi_drm_wait_for_explicit_sync_release’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:964:4: return_function: returning to ‘wsi_drm_wait_for_explicit_sync_release’ from ‘wsi_drm_images_explicit_sync_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:967:38: branch_true: following ‘true’ branch (when ‘free_level_idx != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:968:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:971:28: branch_true: following ‘true’ branch (when ‘unacquired_image_count > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:976:20: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_drm.c:976:15: danger: ‘flags + (long unsigned int)i * 4’ could be NULL: unchecked value from [(6)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/5)
#  974|             * being totally free the soonest.
#  975|             */
#  976|->          if ((flags[i] & free_level) == free_level &&
#  977|                images[indices[i]]->present_serial < present_serial) {
#  978|               *image_index = indices[i];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1513]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:399:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:379:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:382:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:384:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:385:45: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:391:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:394:29: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_headless.c:399:27: danger: dereference of NULL ‘<unknown>’
#  397|         const struct VkDrmFormatModifierPropertiesEXT *mod_props =
#  398|            get_modifier_props(info, image->drm_modifier);
#  399|->       image->num_planes = mod_props->drmFormatModifierPlaneCount;
#  400|   
#  401|         for (uint32_t p = 0; p < image->num_planes; p++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1514]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1255:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘images’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1748:1: enter_function: entry to ‘x11_acquire_next_image’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1757:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1760:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1760:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1761:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1761:16: call_function: calling ‘x11_wait_for_explicit_sync_release_submission’ from ‘x11_acquire_next_image’
# 1253|      STACK_ARRAY(struct wsi_image*, images, chain->base.image_count);
# 1254|      for (uint32_t i = 0; i < chain->base.image_count; i++)
# 1255|->       images[i] = &chain->images[i].base;
# 1256|   
# 1257|      VkResult result;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1515]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1625:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1950:1: enter_function: entry to ‘x11_manage_present_queue’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1954:10: call_function: calling ‘wsi_x11_get_connection’ from ‘x11_manage_present_queue’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1954:10: return_function: returning to ‘x11_manage_present_queue’ from ‘wsi_x11_get_connection’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1961:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1962:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1971:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1972:19: call_function: inlined call to ‘x11_swapchain_read_status_atomic’ from ‘x11_manage_present_queue’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1973:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1976:39: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:1978:11: call_function: inlined call to ‘x11_needs_wait_for_fences’ from ‘x11_manage_present_queue’
# 1623|                             VkPresentModeKHR present_mode)
# 1624|   {
# 1625|->    if (wsi_conn->is_xwayland && !wsi_device->x11.xwaylandWaitReady) {
# 1626|         return false;
# 1627|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1516]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2284:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘wsi_conn’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2353:1: enter_function: entry to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2361:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: call_function: calling ‘wsi_x11_get_connection’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: return_function: returning to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’ from ‘wsi_x11_get_connection’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2371:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2387:4: call_function: calling ‘wsi_x11_get_dri3_modifiers’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
# 2282|                              const VkAllocationCallbacks *pAllocator)
# 2283|   {
# 2284|->    if (!wsi_conn->has_dri3_modifiers)
# 2285|         goto out;
# 2286|   

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1517]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2340:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2353:1: enter_function: entry to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2361:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: call_function: calling ‘wsi_x11_get_connection’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: return_function: returning to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’ from ‘wsi_x11_get_connection’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2371:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2387:4: call_function: calling ‘wsi_x11_get_dri3_modifiers’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
# 2338|   
# 2339|      for (int i = 0; i < n; i++) {
# 2340|->       modifiers_in[i] = modifiers[i];
# 2341|         num_modifiers_in[i] = counts[i];
# 2342|      }

Error: GCC_ANALYZER_WARNING (CWE-126): [#def1518]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2340:25: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2353:1: enter_function: entry to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2361:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: call_function: calling ‘wsi_x11_get_connection’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: return_function: returning to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’ from ‘wsi_x11_get_connection’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2371:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2387:4: call_function: calling ‘wsi_x11_get_dri3_modifiers’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
# 2338|   
# 2339|      for (int i = 0; i < n; i++) {
# 2340|->       modifiers_in[i] = modifiers[i];
# 2341|         num_modifiers_in[i] = counts[i];
# 2342|      }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def1519]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2341:7: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2353:1: enter_function: entry to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2361:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: call_function: calling ‘wsi_x11_get_connection’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: return_function: returning to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’ from ‘wsi_x11_get_connection’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2371:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2387:4: call_function: calling ‘wsi_x11_get_dri3_modifiers’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
# 2339|      for (int i = 0; i < n; i++) {
# 2340|         modifiers_in[i] = modifiers[i];
# 2341|->       num_modifiers_in[i] = counts[i];
# 2342|      }
# 2343|      *num_tranches_in = n;

Error: GCC_ANALYZER_WARNING (CWE-126): [#def1520]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2341:29: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2353:1: enter_function: entry to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2357:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2361:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: call_function: calling ‘wsi_x11_get_connection’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2365:10: return_function: returning to ‘wsi_x11_swapchain_query_dri3_modifiers_changed’ from ‘wsi_x11_get_connection’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2371:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/wsi/wsi_common_x11.c:2387:4: call_function: calling ‘wsi_x11_get_dri3_modifiers’ from ‘wsi_x11_swapchain_query_dri3_modifiers_changed’
# 2339|      for (int i = 0; i < n; i++) {
# 2340|         modifiers_in[i] = modifiers[i];
# 2341|->       num_modifiers_in[i] = counts[i];
# 2342|      }
# 2343|      *num_tranches_in = n;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1521]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2520:12: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(64)’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2506:21: enter_function: entry to ‘glcpp__create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2510:24: call_function: inlined call to ‘glcpp_alloc’ from ‘glcpp__create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2511:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2514:2: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2520:12: danger: ‘malloc(64)’ leaks here; was allocated at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
# 2518|   	 * we need to put in 2 end-of-buffer characters.
# 2519|   	 */
# 2520|-> 	b->yy_ch_buf = (char *) yyalloc( (yy_size_t) (b->yy_buf_size + 2) , yyscanner );
# 2521|   	if ( ! b->yy_ch_buf )
# 2522|   		YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1522]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2562:2: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘b’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2441:10: enter_function: entry to ‘glcpp_restart’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2446:16: call_function: calling ‘glcpp_ensure_buffer_stack’ from ‘glcpp_restart’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2446:16: return_function: returning to ‘glcpp_restart’ from ‘glcpp_ensure_buffer_stack’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2448:27: call_function: calling ‘glcpp__create_buffer’ from ‘glcpp_restart’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2448:27: return_function: returning to ‘glcpp_restart’ from ‘glcpp__create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2451:2: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2451:2: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2451:2: call_function: calling ‘glcpp__init_buffer’ from ‘glcpp_restart’
# 2560|   
# 2561|   	yy_flush_buffer( b , yyscanner);
# 2562|-> 
# 2563|   	b->yy_input_file = file;
# 2564|   	b->yy_fill_buffer = 1;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1523]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2754:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<return-value>’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-lex.l:619:1: enter_function: entry to ‘glcpp_lex_set_source_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-lex.l:621:2: call_function: calling ‘glcpp__scan_string’ from ‘glcpp_lex_set_source_string’
# 2752|   YY_BUFFER_STATE yy_scan_string (const char * yystr , yyscan_t yyscanner)
# 2753|   {
# 2754|->     
# 2755|   	return yy_scan_bytes( yystr, (int) strlen(yystr) , yyscanner);
# 2756|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1524]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2754:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-lex.l:619:1: enter_function: entry to ‘glcpp_lex_set_source_string’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/glcpp/glcpp-lex.l:621:2: call_function: calling ‘glcpp__scan_string’ from ‘glcpp_lex_set_source_string’
# 2752|   YY_BUFFER_STATE yy_scan_string (const char * yystr , yyscan_t yyscanner)
# 2753|   {
# 2754|->     
# 2755|   	return yy_scan_bytes( yystr, (int) strlen(yystr) , yyscanner);
# 2756|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1525]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2780:25: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(n)’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2764:17: enter_function: entry to ‘glcpp__scan_bytes’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2773:24: call_function: inlined call to ‘glcpp_alloc’ from ‘glcpp__scan_bytes’
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2774:12: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/glsl/glcpp/glcpp-lex.c:2782:6: call_function: calling ‘glcpp__scan_buffer’ from ‘glcpp__scan_bytes’
# 2778|   	for ( i = 0; i < _yybytes_len; ++i )
# 2779|   		buf[i] = yybytes[i];
# 2780|-> 
# 2781|   	buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR;
# 2782|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1526]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2018:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:1003:1: enter_function: entry to ‘nir_build_addr_iadd_imm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:1011:11: call_function: calling ‘nir_imm_intN_t’ from ‘nir_build_addr_iadd_imm’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:1011:11: return_function: returning to ‘nir_build_addr_iadd_imm’ from ‘nir_imm_intN_t’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_io.c:1011:11: call_function: calling ‘nir_build_addr_iadd’ from ‘nir_build_addr_iadd_imm’
# 2016|   nir_u2u32(nir_builder *build, nir_def *src0)
# 2017|   {
# 2018|->    if (src0->bit_size == 32)
# 2019|         return src0;
# 2020|      return nir_build_alu1(build, nir_op_u2u32, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1527]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2018:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:204:1: enter_function: entry to ‘agx_nir_lower_sample_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:207:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_sample_intrinsics’
# 2016|   nir_u2u32(nir_builder *build, nir_def *src0)
# 2017|   {
# 2018|->    if (src0->bit_size == 32)
# 2019|         return src0;
# 2020|      return nir_build_alu1(build, nir_op_u2u32, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1528]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2025:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2312:1: enter_function: entry to ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2339:23: call_function: inlined call to ‘nir_channel’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2339:23: call_function: inlined call to ‘nir_channel’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2340:22: call_function: inlined call to ‘nir_imul_imm’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2340:22: call_function: inlined call to ‘nir_imul_imm’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2341:20: call_function: inlined call to ‘nir_imm_int’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2341:20: call_function: inlined call to ‘nir_imm_int’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2341:20: call_function: calling ‘_nir_build_load_push_constant’ from ‘build_copy_buffer_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2341:20: return_function: returning to ‘build_copy_buffer_shader’ from ‘_nir_build_load_push_constant’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_meta_copy_fill_update.c:2345:13: call_function: inlined call to ‘nir_u2u64’ from ‘build_copy_buffer_shader’
# 2023|   nir_u2u64(nir_builder *build, nir_def *src0)
# 2024|   {
# 2025|->    if (src0->bit_size == 64)
# 2026|         return src0;
# 2027|      return nir_build_alu1(build, nir_op_u2u64, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1529]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2025:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:100:1: enter_function: entry to ‘load_dynamic_buffer_start’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:119:14: call_function: inlined call to ‘nir_imm_int’ from ‘load_dynamic_buffer_start’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:119:14: call_function: inlined call to ‘nir_imm_int’ from ‘load_dynamic_buffer_start’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:119:14: call_function: calling ‘load_root’ from ‘load_dynamic_buffer_start’
# 2023|   nir_u2u64(nir_builder *build, nir_def *src0)
# 2024|   {
# 2025|->    if (src0->bit_size == 64)
# 2026|         return src0;
# 2027|      return nir_build_alu1(build, nir_op_u2u64, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1530]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2025:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2155:1: enter_function: entry to ‘asahi_fast_link’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2166:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2167:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2167:16: call_function: calling ‘agx_build_meta_shader_internal’ from ‘asahi_fast_link’
# 2023|   nir_u2u64(nir_builder *build, nir_def *src0)
# 2024|   {
# 2025|->    if (src0->bit_size == 64)
# 2026|         return src0;
# 2027|      return nir_build_alu1(build, nir_op_u2u64, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1531]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:5118:53: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_lower_subgroups.c:629:1: enter_function: entry to ‘lower_scan_reduce’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_lower_subgroups.c:639:21: call_function: calling ‘nir_build_imm’ from ‘lower_scan_reduce’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_lower_subgroups.c:639:21: return_function: returning to ‘lower_scan_reduce’ from ‘nir_build_imm’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_lower_subgroups.c:663:9: branch_true: following ‘true’ branch (when ‘max_brcst_cluster_size >= brcst_cluster_size’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_lower_subgroups.c:664:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_lower_subgroups.c:664:24: call_function: calling ‘_nir_build_brcst_active_ir3’ from ‘lower_scan_reduce’
# 5116|         build->shader, nir_intrinsic_brcst_active_ir3);
# 5117|   
# 5118|->       nir_def_init(&intrin->instr, &intrin->def, 1, src0->bit_size);
# 5119|      intrin->src[0] = nir_src_for_ssa(src0);
# 5120|      intrin->src[1] = nir_src_for_ssa(src1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1532]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:5903:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:855:1: enter_function: entry to ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:868:22: call_function: inlined call to ‘nir_imm_int’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:868:22: call_function: inlined call to ‘nir_imm_int’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:869:7: call_function: inlined call to ‘nir_ishl_imm’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:869:7: call_function: inlined call to ‘nir_ishl_imm’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:876:10: call_function: calling ‘_nir_build_export_amd’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:876:10: return_function: returning to ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’ from ‘_nir_build_export_amd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:884:10: call_function: inlined call to ‘nir_imm_ivec4’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:884:10: call_function: inlined call to ‘nir_imm_ivec4’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:884:10: call_function: calling ‘_nir_build_export_amd’ from ‘ac_nir_ngg_alloc_vertices_fully_culled_workaround’
# 5901|         build->shader, nir_intrinsic_export_amd);
# 5902|   
# 5903|->    intrin->num_components = src0->num_components;
# 5904|      intrin->src[0] = nir_src_for_ssa(src0);
# 5905|      if (!indices.write_mask)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1533]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:7033:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:780:1: enter_function: entry to ‘ac_nir_repack_invocations_in_workgroup’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:805:7: branch_false: following ‘false’ branch (when ‘max_num_waves != 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:826:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:833:25: call_function: calling ‘nir_undef’ from ‘ac_nir_repack_invocations_in_workgroup’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:833:25: return_function: returning to ‘ac_nir_repack_invocations_in_workgroup’ from ‘nir_undef’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:836:25: call_function: calling ‘nir_imm_intN_t’ from ‘ac_nir_repack_invocations_in_workgroup’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:836:25: return_function: returning to ‘ac_nir_repack_invocations_in_workgroup’ from ‘nir_imm_intN_t’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir.c:836:25: call_function: calling ‘_nir_build_inverse_ballot’ from ‘ac_nir_repack_invocations_in_workgroup’
# 7031|         build->shader, nir_intrinsic_inverse_ballot);
# 7032|   
# 7033|->    intrin->num_components = src0->num_components;
# 7034|         nir_def_init(&intrin->instr, &intrin->def, 1, bit_size);
# 7035|      intrin->src[0] = nir_src_for_ssa(src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1534]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:12805:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src1’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_lower_shading_rate.c:68:1: enter_function: entry to ‘nir_lower_primitive_shading_rate’
mesa-25.1.0-rc2/redhat-linux-build/../src/freedreno/ir3/ir3_nir_lower_shading_rate.c:80:27: call_function: calling ‘create_lut’ from ‘nir_lower_primitive_shading_rate’
#12803|         build->shader, nir_intrinsic_store_deref);
#12804|   
#12805|->    intrin->num_components = src1->num_components;
#12806|      intrin->src[0] = nir_src_for_ssa(src0);
#12807|      intrin->src[1] = nir_src_for_ssa(src1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1535]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:13014:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:253:1: enter_function: entry to ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:258:4: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:258:4: return_function: returning to ‘agx_nir_lower_tes’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:261:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:262:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:261:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:261:8: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:261:8: branch_true: following ‘true’ branch (when ‘to_hw_vs != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:264:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:264:33: call_function: calling ‘nir_shader_get_entrypoint’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:264:33: return_function: returning to ‘agx_nir_lower_tes’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:265:23: call_function: calling ‘nir_after_impl’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:265:23: return_function: returning to ‘agx_nir_lower_tes’ from ‘nir_after_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:267:7: call_function: inlined call to ‘nir_imm_int’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:267:7: call_function: inlined call to ‘nir_imm_int’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:267:7: call_function: inlined call to ‘nir_imm_float’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:267:7: call_function: inlined call to ‘nir_imm_float’ from ‘agx_nir_lower_tes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_tess.c:267:7: call_function: calling ‘_nir_build_store_output’ from ‘agx_nir_lower_tes’
#13012|         build->shader, nir_intrinsic_store_output);
#13013|   
#13014|->    intrin->num_components = src0->num_components;
#13015|      intrin->src[0] = nir_src_for_ssa(src0);
#13016|      intrin->src[1] = nir_src_for_ssa(src1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1536]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:13148:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:486:1: enter_function: entry to ‘nak_nir_lower_cf’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:490:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:490:4: branch_true: following ‘true’ branch (when ‘func’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:491:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_cf.c:491:11: call_function: calling ‘lower_cf_func’ from ‘nak_nir_lower_cf’
#13146|         build->shader, nir_intrinsic_store_reg);
#13147|   
#13148|->    intrin->num_components = src0->num_components;
#13149|      intrin->src[0] = nir_src_for_ssa(src0);
#13150|      intrin->src[1] = nir_src_for_ssa(src1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1537]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:13218:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_tess_io_to_mem.c:1229:1: enter_function: entry to ‘ac_nir_lower_hs_outputs_to_mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_tess_io_to_mem.c:1260:4: call_function: calling ‘hs_finale’ from ‘ac_nir_lower_hs_outputs_to_mem’
#13216|         build->shader, nir_intrinsic_store_shared);
#13217|   
#13218|->    intrin->num_components = src0->num_components;
#13219|      intrin->src[0] = nir_src_for_ssa(src0);
#13220|      intrin->src[1] = nir_src_for_ssa(src1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1538]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:13293:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1506:1: enter_function: entry to ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1512:7: call_function: inlined call to ‘nir_imm_int’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1512:7: call_function: inlined call to ‘nir_imm_int’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1512:7: call_function: calling ‘_nir_build_vulkan_resource_index’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1512:7: return_function: returning to ‘get_reset_occlusion_query_cs’ from ‘_nir_build_vulkan_resource_index’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1521:21: call_function: inlined call to ‘nir_channel’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1521:21: call_function: inlined call to ‘nir_channel’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1524:7: call_function: inlined call to ‘nir_imm_int’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1524:7: call_function: inlined call to ‘nir_imm_int’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1524:7: call_function: calling ‘_nir_build_load_push_constant’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1524:7: return_function: returning to ‘get_reset_occlusion_query_cs’ from ‘_nir_build_load_push_constant’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1527:7: call_function: inlined call to ‘nir_imm_int’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1527:7: call_function: inlined call to ‘nir_imm_int’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1527:7: call_function: calling ‘_nir_build_load_push_constant’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1527:7: return_function: returning to ‘get_reset_occlusion_query_cs’ from ‘_nir_build_load_push_constant’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1531:4: call_function: calling ‘nir_imm_intN_t’ from ‘get_reset_occlusion_query_cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1531:4: return_function: returning to ‘get_reset_occlusion_query_cs’ from ‘nir_imm_intN_t’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_query.c:1531:4: call_function: calling ‘nir_set_query_availability’ from ‘get_reset_occlusion_query_cs’
#13291|         build->shader, nir_intrinsic_store_ssbo);
#13292|   
#13293|->    intrin->num_components = src0->num_components;
#13294|      intrin->src[0] = nir_src_for_ssa(src0);
#13295|      intrin->src[1] = nir_src_for_ssa(src1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1539]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:13726:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:949:1: enter_function: entry to ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:951:21: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:951:21: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:953:4: branch_true: following ‘true’ branch (when ‘__dword != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:954:15: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:954:15: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:954:15: call_function: calling ‘_nir_build_write_invocation_amd’ from ‘write_values_to_lanes’
#13724|         build->shader, nir_intrinsic_write_invocation_amd);
#13725|   
#13726|->    intrin->num_components = src0->num_components;
#13727|         nir_def_init(&intrin->instr, &intrin->def, intrin->num_components, src0->bit_size);
#13728|      intrin->src[0] = nir_src_for_ssa(src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1540]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:16342:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src1’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ps_early.c:550:1: enter_function: entry to ‘ac_nir_lower_ps_early’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ps_early.c:553:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘ac_nir_lower_ps_early’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ps_early.c:553:30: return_function: returning to ‘ac_nir_lower_ps_early’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ps_early.c:563:4: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘ac_nir_lower_ps_early’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ps_early.c:563:4: return_function: returning to ‘ac_nir_lower_ps_early’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_lower_ps_early.c:577:20: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘ac_nir_lower_ps_early’
#16340|   nir_ieq_imm(nir_builder *build, nir_def *src1, uint64_t src2)
#16341|   {
#16342|->    return nir_ieq(build, src1, nir_imm_intN_t(build, src2, src1->bit_size));
#16343|   }
#16344|   static inline nir_def *

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1541]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:16347:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src1’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_rt.c:373:1: enter_function: entry to ‘brw_nir_lower_combined_intersection_any_hit’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_nir_rt.c:382:4: call_function: calling ‘lower_ray_walk_intrinsics’ from ‘brw_nir_lower_combined_intersection_any_hit’
#16345|   nir_ine_imm(nir_builder *build, nir_def *src1, uint64_t src2)
#16346|   {
#16347|->    return nir_ine(build, src1, nir_imm_intN_t(build, src2, src1->bit_size));
#16348|   }
#16349|   static inline nir_def *

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1542]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:16352:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src1’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:210:1: enter_function: entry to ‘nir_clear_shared_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:217:7: branch_false: following ‘false’ branch (when ‘shared_size != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:220:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:220:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_clear_shared_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:220:30: return_function: returning to ‘nir_clear_shared_memory’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:221:20: call_function: calling ‘nir_after_impl’ from ‘nir_clear_shared_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:221:20: return_function: returning to ‘nir_clear_shared_memory’ from ‘nir_after_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:234:28: call_function: inlined call to ‘nir_imul_imm’ from ‘nir_clear_shared_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:234:28: call_function: inlined call to ‘nir_imul_imm’ from ‘nir_clear_shared_memory’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:243:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:247:28: branch_true: following ‘true’ branch (when ‘iterations > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:248:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:250:13: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:251:59: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_lower_variable_initializers.c:251:13: call_function: calling ‘nir_ult_imm’ from ‘nir_clear_shared_memory’
#16350|   nir_ult_imm(nir_builder *build, nir_def *src1, uint64_t src2)
#16351|   {
#16352|->    return nir_ult(build, src1, nir_imm_intN_t(build, src2, src1->bit_size));
#16353|   }
#16354|   static inline nir_def *

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1543]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_intrinsics_indices.h:56:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:408:1: enter_function: entry to ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_combine_stores’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: return_function: returning to ‘nir_opt_combine_stores’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:421:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_combine_stores.c:422:19: call_function: calling ‘combine_stores_impl’ from ‘nir_opt_combine_stores’
#   54|   nir_intrinsic_write_mask(const nir_intrinsic_instr *instr)
#   55|   {
#   56|->    const nir_intrinsic_info *info = &nir_intrinsic_infos[instr->intrinsic];
#   57|      assert(info->index_map[NIR_INTRINSIC_WRITE_MASK] > 0);
#   58|      return (unsigned)instr->const_index[info->index_map[NIR_INTRINSIC_WRITE_MASK] - 1];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1544]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_intrinsics_indices.h:272:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/pan_collect_varyings.c:176:1: enter_function: entry to ‘collect_noperspective_varyings_fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/pan_collect_varyings.c:186:7: branch_false: following ‘false’ branch (when ‘<unknown> > 31’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/pan_collect_varyings.c:189:38: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘collect_noperspective_varyings_fs’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/util/pan_collect_varyings.c:191:8: call_function: inlined call to ‘nir_intrinsic_interp_mode’ from ‘collect_noperspective_varyings_fs’
#  270|   nir_intrinsic_interp_mode(const nir_intrinsic_instr *instr)
#  271|   {
#  272|->    const nir_intrinsic_info *info = &nir_intrinsic_infos[instr->intrinsic];
#  273|      assert(info->index_map[NIR_INTRINSIC_INTERP_MODE] > 0);
#  274|      return (unsigned)instr->const_index[info->index_map[NIR_INTRINSIC_INTERP_MODE] - 1];

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1545]
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3923:5: warning[-Wanalyzer-malloc-leak]: leak of ‘*b.yy_ch_buf’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3856:12: enter_function: entry to ‘yy_get_next_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3863:5: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3867:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3867:5: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3889:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3894:5: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3903:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3905:11: branch_true: following ‘true’ branch (when ‘num_to_read <= 0’)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3909:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3925:41: call_function: inlined call to ‘ir3_yyrealloc’ from ‘yy_get_next_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3932:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3936:19: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3905:11: branch_true: following ‘true’ branch (when ‘num_to_read <= 0’)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3909:41: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3914:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3916:48: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3925:41: call_function: inlined call to ‘ir3_yyrealloc’ from ‘yy_get_next_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:3923:5: danger: ‘*b.yy_ch_buf’ leaks here; was allocated at [(11)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/10)
# 3921|   				else
# 3922|   					b->yy_buf_size *= 2;
# 3923|-> 
# 3924|   				b->yy_ch_buf = (char *)
# 3925|   					/* Include room in for 2 EOB chars. */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1546]
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4245:12: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(64)’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4231:21: enter_function: entry to ‘ir3_yy_create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4235:24: call_function: inlined call to ‘ir3_yyalloc’ from ‘ir3_yy_create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4236:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4239:2: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4245:12: danger: ‘malloc(64)’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 4243|   	 * we need to put in 2 end-of-buffer characters.
# 4244|   	 */
# 4245|-> 	b->yy_ch_buf = (char *) yyalloc( (yy_size_t) (b->yy_buf_size + 2)  );
# 4246|   	if ( ! b->yy_ch_buf )
# 4247|   		YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1547]
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4499:25: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(n)’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4483:17: enter_function: entry to ‘ir3_yy_scan_bytes’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4492:24: call_function: inlined call to ‘ir3_yyalloc’ from ‘ir3_yy_scan_bytes’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4493:12: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_lexer.c:4501:6: call_function: calling ‘ir3_yy_scan_buffer’ from ‘ir3_yy_scan_bytes’
# 4497|   	for ( i = 0; i < _yybytes_len; ++i )
# 4498|   		buf[i] = yybytes[i];
# 4499|-> 
# 4500|   	buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR;
# 4501|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1548]
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3256:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘yyss’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3214:6: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3220:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3243:10: branch_false: following ‘false’ branch (when ‘yystacksize <= 9999’)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3245:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3254:12: branch_false: following ‘false’ branch (when ‘yyptr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3256:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3256:9: danger: use of uninitialized value ‘yyss’ here
# 3254|           if (! yyptr)
# 3255|             YYNOMEM;
# 3256|->         YYSTACK_RELOCATE (yyss_alloc, yyss);
# 3257|           YYSTACK_RELOCATE (yyvs_alloc, yyvs);
# 3258|   #  undef YYSTACK_RELOCATE

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1549]
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3383:3: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3214:6: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3278:6: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3278:6: branch_false: following ‘false’ branch (when ‘yystate != 3’)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3281:3: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3293:6: branch_true: following ‘true’ branch (when ‘yyn == -1090’)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3294:5: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3363:6: branch_false: following ‘false’ branch (when ‘yyn != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3365:3: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/freedreno/ir3/ir3_parser.c:3383:3: danger: use of uninitialized value ‘*<unknown>’ here
# 3381|        unconditionally makes the parser a bit smaller, and it avoids a
# 3382|        GCC warning that YYVAL may be used uninitialized.  */
# 3383|->   yyval = yyvsp[1-yylen];
# 3384|   
# 3385|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1550]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:64:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
#   62|         enc_val = val;
#   63|         assert(enc_val < (1ULL << 4));
#   64|->       bin[0] &= 0xf;
#   65|         bin[0] |= (enc_val & 0xf) << 4;
#   66|         return 4;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1551]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:398:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
#  396|         enc_val = val;
#  397|         assert(enc_val < (1ULL << 1));
#  398|->       bin[0] &= 0x7f;
#  399|         bin[0] |= (enc_val & 0x1) << 7;
#  400|         return 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1552]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:1664:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
# 1662|         enc_val = val;
# 1663|         assert(pco_main_op_valid(enc_val));
# 1664|->       bin[0] &= 0x1f;
# 1665|         bin[0] |= (enc_val & 0x7) << 5;
# 1666|         return 3;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1553]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:2871:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
# 2869|         enc_val = val;
# 2870|         assert(pco_backend_op_valid(enc_val));
# 2871|->       bin[0] &= 0x1f;
# 2872|         bin[0] |= (enc_val & 0x7) << 5;
# 2873|         return 3;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1554]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:4316:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
# 4314|         enc_val = val;
# 4315|         assert(enc_val < (1ULL << 1));
# 4316|->       bin[0] &= 0x7f;
# 4317|         bin[0] |= (enc_val & 0x1) << 7;
# 4318|         return 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1555]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:4761:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
# 4759|         assert(enc_val < (1ULL << 8));
# 4760|         bin[0] &= 0x0;
# 4761|->       bin[0] |= (enc_val & 0xff);
# 4762|         return 8;
# 4763|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1556]
mesa-25.1.0-rc2/redhat-linux-build/src/imagination/pco/pco_isa.h:4792:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bin’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:115:6: enter_function: entry to ‘pco_encode_ir’
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:122:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:123:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:124:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:125:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/imagination/pco/pco_binary.c:126:30: call_function: calling ‘pco_encode_igrp’ from ‘pco_encode_ir’
# 4790|         assert(enc_val < (1ULL << 8));
# 4791|         bin[0] &= 0x0;
# 4792|->       bin[0] |= (enc_val & 0xff);
# 4793|         return 8;
# 4794|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1557]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3022:12: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(64)’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3008:21: enter_function: entry to ‘_mesa_program_lexer__create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3012:24: call_function: inlined call to ‘_mesa_program_lexer_alloc’ from ‘_mesa_program_lexer__create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3013:12: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3016:2: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3022:12: danger: ‘malloc(64)’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 3020|   	 * we need to put in 2 end-of-buffer characters.
# 3021|   	 */
# 3022|-> 	b->yy_ch_buf = (char *) yyalloc( (yy_size_t) (b->yy_buf_size + 2) , yyscanner );
# 3023|   	if ( ! b->yy_ch_buf )
# 3024|   		YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1558]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3064:2: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘b’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2943:10: enter_function: entry to ‘_mesa_program_lexer_restart’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2948:16: call_function: calling ‘_mesa_program_lexer_ensure_buffer_stack’ from ‘_mesa_program_lexer_restart’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2948:16: return_function: returning to ‘_mesa_program_lexer_restart’ from ‘_mesa_program_lexer_ensure_buffer_stack’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2950:27: call_function: calling ‘_mesa_program_lexer__create_buffer’ from ‘_mesa_program_lexer_restart’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2950:27: return_function: returning to ‘_mesa_program_lexer_restart’ from ‘_mesa_program_lexer__create_buffer’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2953:2: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2953:2: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:2953:2: call_function: calling ‘_mesa_program_lexer__init_buffer’ from ‘_mesa_program_lexer_restart’
# 3062|   
# 3063|   	yy_flush_buffer( b , yyscanner);
# 3064|-> 
# 3065|   	b->yy_input_file = file;
# 3066|   	b->yy_fill_buffer = 1;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1559]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3282:25: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(n)’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3266:17: enter_function: entry to ‘_mesa_program_lexer__scan_bytes’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3275:24: call_function: inlined call to ‘_mesa_program_lexer_alloc’ from ‘_mesa_program_lexer__scan_bytes’
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3276:12: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3284:6: call_function: calling ‘_mesa_program_lexer__scan_buffer’ from ‘_mesa_program_lexer__scan_bytes’
# 3280|   	for ( i = 0; i < _yybytes_len; ++i )
# 3281|   		buf[i] = yybytes[i];
# 3282|-> 
# 3283|   	buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR;
# 3284|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1560]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3293:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<return-value>’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:478:1: enter_function: entry to ‘_mesa_program_lexer_ctor’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:482:4: call_function: calling ‘_mesa_program_lexer__scan_bytes’ from ‘_mesa_program_lexer_ctor’
# 3291|   	 */
# 3292|   	b->yy_is_our_buffer = 1;
# 3293|-> 
# 3294|   	return b;
# 3295|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1561]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/lex.yy.c:3293:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:478:1: enter_function: entry to ‘_mesa_program_lexer_ctor’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_lexer.l:482:4: call_function: calling ‘_mesa_program_lexer__scan_bytes’ from ‘_mesa_program_lexer_ctor’
# 3291|   	 */
# 3292|   	b->yy_is_our_buffer = 1;
# 3293|-> 
# 3294|   	return b;
# 3295|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1562]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/program_parse.tab.c:2088:11: warning[-Wanalyzer-malloc-leak]: leak of ‘yyptr’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2540:1: enter_function: entry to ‘_mesa_parse_arb_program’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2557:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2565:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2593:4: call_function: calling ‘yyparse’ from ‘_mesa_parse_arb_program’
# 2086|           yy_state_t *yyss1 = yyss;
# 2087|           union yyalloc *yyptr =
# 2088|->           YY_CAST (union yyalloc *,
# 2089|                      YYSTACK_ALLOC (YY_CAST (YYSIZE_T, YYSTACK_BYTES (yystacksize))));
# 2090|           if (! yyptr)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1563]
mesa-25.1.0-rc2/redhat-linux-build/src/mesa/program/program_parse.tab.c:2092:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘yyss’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2540:1: enter_function: entry to ‘_mesa_parse_arb_program’
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2557:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2565:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/mesa/program/program_parse.y:2593:4: call_function: calling ‘yyparse’ from ‘_mesa_parse_arb_program’
# 2090|           if (! yyptr)
# 2091|             YYNOMEM;
# 2092|->         YYSTACK_RELOCATE (yyss_alloc, yyss);
# 2093|           YYSTACK_RELOCATE (yyvs_alloc, yyvs);
# 2094|           YYSTACK_RELOCATE (yyls_alloc, yyls);

Error: CPPCHECK_WARNING (CWE-562): [#def1564]
mesa-25.1.0-rc2/src/amd/addrlib/src/r800/ciaddrlib.cpp:778: error[autoVariables]: Address of local auto-variable assigned to a function parameter.
#  776|       if (pOut->pTileInfo == NULL)
#  777|       {
#  778|->         pOut->pTileInfo = &tileInfo;
#  779|       }
#  780|   

Error: CPPCHECK_WARNING (CWE-562): [#def1565]
mesa-25.1.0-rc2/src/amd/addrlib/src/r800/egbaddrlib.cpp:3307: error[autoVariables]: Address of local auto-variable assigned to a function parameter.
# 3305|       if (pOut->pTileInfo == NULL)
# 3306|       {
# 3307|->         pOut->pTileInfo = &tileInfo;
# 3308|       }
# 3309|   

Error: CPPCHECK_WARNING (CWE-562): [#def1566]
mesa-25.1.0-rc2/src/amd/addrlib/src/r800/egbaddrlib.cpp:3813: error[autoVariables]: Address of local auto-variable assigned to a function parameter.
# 3811|           if (pOut->pTileInfo == NULL)
# 3812|           {
# 3813|->             pOut->pTileInfo = &tileInfo;
# 3814|           }
# 3815|   

Error: CPPCHECK_WARNING (CWE-476): [#def1567]
mesa-25.1.0-rc2/src/amd/common/ac_ib_parser.c:50: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: ib
#   48|         uint32_t *ib = (uint32_t*)malloc(size);
#   49|   
#   50|->       if (fread(ib, size, 1, f) != 1) {
#   51|            fprintf(stderr, "Can't read IB: %s\n", filename);
#   52|            fclose(f);

Error: COMPILER_WARNING (CWE-563): [#def1568]
mesa-25.1.0-rc2/src/amd/common/nir/ac_nir_meta_cs_blit.c: scope_hint: In function ‘ac_prepare_compute_blit’
mesa-25.1.0-rc2/src/amd/common/nir/ac_nir_meta_cs_blit.c:775:38: warning[-Wunused-variable]: unused variable ‘max_lane_size’
#  775 |    static const union ac_cs_blit_key max_lane_size = {
#      |                                      ^~~~~~~~~~~~~
#  773|   
#  774|      /* Check that the lane size fits into the shader key. */
#  775|->    static const union ac_cs_blit_key max_lane_size = {
#  776|         .log_lane_width = ~0,
#  777|         .log_lane_height = ~0,

Error: COMPILER_WARNING (CWE-563): [#def1569]
mesa-25.1.0-rc2/src/amd/llvm/ac_nir_to_llvm.c: scope_hint: In function ‘visit_load’
mesa-25.1.0-rc2/src/amd/llvm/ac_nir_to_llvm.c:2629:12: warning[-Wunused-variable]: unused variable ‘offset’
# 2629 |    nir_src offset = *nir_get_io_offset_src(instr);
#      |            ^~~~~~
# 2627|      unsigned component = nir_intrinsic_component(instr);
# 2628|      unsigned count = instr->def.num_components;
# 2629|->    nir_src offset = *nir_get_io_offset_src(instr);
# 2630|   
# 2631|      assert(instr->def.bit_size == 16 || instr->def.bit_size == 32);

Error: COMPILER_WARNING (CWE-563): [#def1570]
mesa-25.1.0-rc2/src/amd/vulkan/meta/radv_meta_clear.c: scope_hint: In function ‘radv_clear_htile’
mesa-25.1.0-rc2/src/amd/vulkan/meta/radv_meta_clear.c:1076:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 1076 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
# 1074|   {
# 1075|      struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 1076|->    const struct radv_physical_device *pdev = radv_device_physical(device);
# 1077|      uint32_t level_count = vk_image_subresource_level_count(&image->vk, range);
# 1078|      uint32_t flush_bits = 0;

Error: COMPILER_WARNING (CWE-563): [#def1571]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_userdata_address’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:962:39: warning[-Wunused-variable]: unused variable ‘pdev’
#  962 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
#  960|                              int idx, uint64_t va)
#  961|   {
#  962|->    const struct radv_physical_device *pdev = radv_device_physical(device);
#  963|      const uint32_t offset = radv_get_user_sgpr_loc(shader, idx);
#  964|   

Error: COMPILER_WARNING (CWE-563): [#def1572]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_descriptors_per_stage’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:992:39: warning[-Wunused-variable]: unused variable ‘pdev’
#  992 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
#  990|                                   const struct radv_shader *shader, const struct radv_descriptor_state *descriptors_state)
#  991|   {
#  992|->    const struct radv_physical_device *pdev = radv_device_physical(device);
#  993|      const uint32_t indirect_descriptor_sets_offset = radv_get_user_sgpr_loc(shader, AC_UD_INDIRECT_DESCRIPTOR_SETS);
#  994|   

Error: COMPILER_WARNING (CWE-563): [#def1573]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_ps_epilog_state’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:1963:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 1963 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
# 1961|   {
# 1962|      struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 1963|->    const struct radv_physical_device *pdev = radv_device_physical(device);
# 1964|      struct radv_shader *ps_shader = cmd_buffer->state.shaders[MESA_SHADER_FRAGMENT];
# 1965|   

Error: COMPILER_WARNING (CWE-563): [#def1574]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_fragment_shading_rate’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:3350:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 3350 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
# 3348|   {
# 3349|      struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 3350|->    const struct radv_physical_device *pdev = radv_device_physical(device);
# 3351|      const struct radv_dynamic_state *d = &cmd_buffer->state.dynamic;
# 3352|   

Error: COMPILER_WARNING (CWE-563): [#def1575]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_streamout_buffers’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:5989:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 5989 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
# 5987|      uint32_t streamout_buffers_offset = radv_get_user_sgpr_loc(last_vgt_shader, AC_UD_STREAMOUT_BUFFERS);
# 5988|      struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 5989|->    const struct radv_physical_device *pdev = radv_device_physical(device);
# 5990|   
# 5991|      if (!streamout_buffers_offset)

Error: COMPILER_WARNING (CWE-563): [#def1576]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_streamout_state’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:6010:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 6010 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
# 6008|   {
# 6009|      const struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 6010|->    const struct radv_physical_device *pdev = radv_device_physical(device);
# 6011|      const struct radv_shader *last_vgt_shader = cmd_buffer->state.last_vgt_shader;
# 6012|      const uint32_t streamout_state_offset = radv_get_user_sgpr_loc(last_vgt_shader, AC_UD_STREAMOUT_STATE);

Error: COMPILER_WARNING (CWE-563): [#def1577]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_emit_streamout_enable_state’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:10680:39: warning[-Wunused-variable]: unused variable ‘pdev’
#10680 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
#10678|   {
#10679|      struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#10680|->    const struct radv_physical_device *pdev = radv_device_physical(device);
#10681|      const struct radv_streamout_state *so = &cmd_buffer->state.streamout;
#10682|      const bool streamout_enabled = radv_is_streamout_enabled(cmd_buffer);

Error: COMPILER_WARNING (CWE-563): [#def1578]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_CmdTraceRaysIndirectKHR’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:12820:24: warning[-Wunused-variable]: unused variable ‘device’
#12820 |    struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#      |                        ^~~~~~
#12818|   {
#12819|      VK_FROM_HANDLE(radv_cmd_buffer, cmd_buffer, commandBuffer);
#12820|->    struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#12821|   
#12822|      assert(device->use_global_bo_list);

Error: COMPILER_WARNING (CWE-563): [#def1579]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_CmdTraceRaysIndirect2KHR’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:12845:24: warning[-Wunused-variable]: unused variable ‘device’
#12845 |    struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#      |                        ^~~~~~
#12843|   {
#12844|      VK_FROM_HANDLE(radv_cmd_buffer, cmd_buffer, commandBuffer);
#12845|->    struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#12846|   
#12847|      assert(device->use_global_bo_list);

Error: COMPILER_WARNING (CWE-563): [#def1580]
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c: scope_hint: In function ‘radv_init_streamout_state’
mesa-25.1.0-rc2/src/amd/vulkan/radv_cmd_buffer.c:13802:39: warning[-Wunused-variable]: unused variable ‘pdev’
#13802 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
#13800|   {
#13801|      const struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#13802|->    const struct radv_physical_device *pdev = radv_device_physical(device);
#13803|      struct radv_streamout_state *so = &cmd_buffer->state.streamout;
#13804|      unsigned offset;

Error: COMPILER_WARNING (CWE-563): [#def1581]
mesa-25.1.0-rc2/src/vulkan/runtime/vk_device_generated_commands.h:28: included_from: Included from here.
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.h:14: included_from: Included from here.
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c:7: included_from: Included from here.
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c: scope_hint: In function ‘radv_CmdPreprocessGeneratedCommandsEXT’
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c:2793:49: warning[-Wunused-variable]: unused variable ‘layout’
# 2793 |    VK_FROM_HANDLE(radv_indirect_command_layout, layout, pGeneratedCommandsInfo->indirectCommandsLayout);
#      |                                                 ^~~~~~
mesa-25.1.0-rc2/src/vulkan/runtime/vk_object.h:230:26: note: in definition of macro ‘VK_FROM_HANDLE’
#  230 |    struct __driver_type *__name = __driver_type ## _from_handle(__handle)
#      |                          ^~~~~~
# 2791|      VK_FROM_HANDLE(radv_cmd_buffer, state_cmd_buffer, stateCommandBuffer);
# 2792|      VK_FROM_HANDLE(radv_cmd_buffer, cmd_buffer, commandBuffer);
# 2793|->    VK_FROM_HANDLE(radv_indirect_command_layout, layout, pGeneratedCommandsInfo->indirectCommandsLayout);
# 2794|   
# 2795|      assert(layout->vk.usage & VK_INDIRECT_COMMANDS_LAYOUT_USAGE_EXPLICIT_PREPROCESS_BIT_EXT);

Error: COMPILER_WARNING (CWE-563): [#def1582]
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c: scope_hint: In function ‘radv_prepare_dgc’
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c:2973:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 2973 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
# 2971|      VK_FROM_HANDLE(radv_indirect_execution_set, ies, pGeneratedCommandsInfo->indirectExecutionSet);
# 2972|      struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 2973|->    const struct radv_physical_device *pdev = radv_device_physical(device);
# 2974|      struct radv_meta_saved_state saved_state;
# 2975|      unsigned upload_offset, upload_size = 0;

Error: COMPILER_WARNING (CWE-563): [#def1583]
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c: scope_hint: In function ‘radv_CreateIndirectExecutionSetEXT’
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c:3255:37: warning[-Wunused-variable]: unused variable ‘pipeline’
# 3255 |       VK_FROM_HANDLE(radv_pipeline, pipeline, pipeline_info->initialPipeline);
#      |                                     ^~~~~~~~
mesa-25.1.0-rc2/src/vulkan/runtime/vk_object.h:230:26: note: in definition of macro ‘VK_FROM_HANDLE’
#  230 |    struct __driver_type *__name = __driver_type ## _from_handle(__handle)
#      |                          ^~~~~~
# 3253|      case VK_INDIRECT_EXECUTION_SET_INFO_TYPE_PIPELINES_EXT: {
# 3254|         const VkIndirectExecutionSetPipelineInfoEXT *pipeline_info = pCreateInfo->info.pPipelineInfo;
# 3255|->       VK_FROM_HANDLE(radv_pipeline, pipeline, pipeline_info->initialPipeline);
# 3256|   
# 3257|         assert(pipeline->type == RADV_PIPELINE_COMPUTE);

Error: COMPILER_WARNING (CWE-563): [#def1584]
mesa-25.1.0-rc2/src/amd/vulkan/radv_dgc.c:3263:42: warning[-Wunused-variable]: unused variable ‘shader_object’
# 3263 |       VK_FROM_HANDLE(radv_shader_object, shader_object, shaders_info->pInitialShaders[0]);
#      |                                          ^~~~~~~~~~~~~
mesa-25.1.0-rc2/src/vulkan/runtime/vk_object.h:230:26: note: in definition of macro ‘VK_FROM_HANDLE’
#  230 |    struct __driver_type *__name = __driver_type ## _from_handle(__handle)
#      |                          ^~~~~~
# 3261|      case VK_INDIRECT_EXECUTION_SET_INFO_TYPE_SHADER_OBJECTS_EXT: {
# 3262|         const VkIndirectExecutionSetShaderInfoEXT *shaders_info = pCreateInfo->info.pShaderInfo;
# 3263|->       VK_FROM_HANDLE(radv_shader_object, shader_object, shaders_info->pInitialShaders[0]);
# 3264|   
# 3265|         assert(shader_object->stage == MESA_SHADER_COMPUTE);

Error: COMPILER_WARNING (CWE-563): [#def1585]
mesa-25.1.0-rc2/src/amd/vulkan/radv_query.c: scope_hint: In function ‘radv_alloc_shader_query_buf’
mesa-25.1.0-rc2/src/amd/vulkan/radv_query.c:963:39: warning[-Wunused-variable]: unused variable ‘pdev’
#  963 |    const struct radv_physical_device *pdev = radv_device_physical(device);
#      |                                       ^~~~
#  961|   {
#  962|      const struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
#  963|->    const struct radv_physical_device *pdev = radv_device_physical(device);
#  964|      unsigned offset;
#  965|      void *ptr;

Error: COMPILER_WARNING (CWE-563): [#def1586]
mesa-25.1.0-rc2/src/amd/vulkan/radv_shader_info.c: scope_hint: In function ‘radv_get_legacy_gs_info’
mesa-25.1.0-rc2/src/amd/vulkan/radv_shader_info.c:816:19: warning[-Wunused-variable]: unused variable ‘max_prims_per_subgroup’
#  816 |    const uint32_t max_prims_per_subgroup = gs_inst_prims_in_subgroup * gs_info->gs.vertices_out;
#      |                   ^~~~~~~~~~~~~~~~~~~~~~
#  814|      const uint32_t gs_prims_per_subgroup = gs_prims;
#  815|      const uint32_t gs_inst_prims_in_subgroup = gs_prims * gs_num_invocations;
#  816|->    const uint32_t max_prims_per_subgroup = gs_inst_prims_in_subgroup * gs_info->gs.vertices_out;
#  817|      const uint32_t lds_granularity = pdev->info.lds_encode_granularity;
#  818|      const uint32_t total_lds_bytes = align(esgs_lds_size * 4, lds_granularity);

Error: COMPILER_WARNING (CWE-563): [#def1587]
mesa-25.1.0-rc2/src/amd/vulkan/radv_video_enc.c: scope_hint: In function ‘radv_enc_slice_header’
mesa-25.1.0-rc2/src/amd/vulkan/radv_video_enc.c:633:8: warning[-Wunused-variable]: unused variable ‘slice_count’
#  633 |    int slice_count = h264_picture_info->naluSliceEntryCount;
#      |        ^~~~~~~~~~~
#  631|      const struct VkVideoEncodeH264PictureInfoKHR *h264_picture_info =
#  632|         vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
#  633|->    int slice_count = h264_picture_info->naluSliceEntryCount;
#  634|      const StdVideoEncodeH264PictureInfo *pic = h264_picture_info->pStdPictureInfo;
#  635|      const StdVideoH264SequenceParameterSet *sps =

Error: COMPILER_WARNING (CWE-563): [#def1588]
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c: scope_hint: In function ‘agx_emit_intrinsic’
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c:1302:20: warning[-Wunused-variable]: unused variable ‘stage’
# 1302 |    gl_shader_stage stage = b->shader->stage;
#      |                    ^~~~~
# 1300|                         ? agx_def_index(&instr->def)
# 1301|                         : agx_null();
# 1302|->    gl_shader_stage stage = b->shader->stage;
# 1303|   
# 1304|      switch (instr->intrinsic) {

Error: COMPILER_WARNING (CWE-563): [#def1589]
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c: scope_hint: In function ‘agx_alu_src_index’
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c:1729:13: warning[-Wunused-variable]: unused variable ‘comps’
# 1729 |    unsigned comps = nir_src_num_components(src.src);
#      |             ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1727|      /* Check well-formedness of the input NIR */
# 1728|      ASSERTED unsigned bitsize = nir_src_bit_size(src.src);
# 1729|->    unsigned comps = nir_src_num_components(src.src);
# 1730|      unsigned channel = src.swizzle[0];
# 1731|   

Error: COMPILER_WARNING (CWE-563): [#def1590]
mesa-25.1.0-rc2/src/asahi/compiler/agx_lower_spill.c: scope_hint: In function ‘spill_fill’
mesa-25.1.0-rc2/src/asahi/compiler/agx_lower_spill.c:44:13: warning[-Wunused-variable]: unused variable ‘stack_offs_end_B’
#   44 |    unsigned stack_offs_end_B = stack_offs_B + (effective_chans * format_size_B);
#      |             ^~~~~~~~~~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#   42|      /* Calculate stack offset in bytes. IR registers are 2-bytes each. */
#   43|      unsigned stack_offs_B = b->shader->spill_base_B + (mem.value * 2) + offset_B;
#   44|->    unsigned stack_offs_end_B = stack_offs_B + (effective_chans * format_size_B);
#   45|   
#   46|      assert(stack_offs_end_B <= b->shader->scratch_size_B &&

Error: COMPILER_WARNING (CWE-563): [#def1591]
mesa-25.1.0-rc2/src/asahi/compiler/agx_register_allocate.c: scope_hint: In function ‘agx_insert_parallel_copies’
mesa-25.1.0-rc2/src/asahi/compiler/agx_register_allocate.c:1229:9: warning[-Wunused-but-set-variable]: variable ‘any_succ’ set but not used
# 1229 |    bool any_succ = false;
#      |         ^~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1227|   agx_insert_parallel_copies(agx_context *ctx, agx_block *block)
# 1228|   {
# 1229|->    bool any_succ = false;
# 1230|      unsigned nr_phi = 0;
# 1231|   

Error: COMPILER_WARNING (CWE-563): [#def1592]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc: scope_hint: In function ‘void ail_detile(void*, void*, const ail_layout*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)’
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:146:13: warning[-Wunused-variable]: unused variable ‘width_px’
#  146 |    unsigned width_px = u_minify(tiled_layout->width_px, level);
#      |             ^~~~~~~~
#  144|              unsigned sy_px, unsigned swidth_px, unsigned sheight_px)
#  145|   {
#  146|->    unsigned width_px = u_minify(tiled_layout->width_px, level);
#  147|      unsigned height_px = u_minify(tiled_layout->height_px, level);
#  148|      unsigned blocksize_B = util_format_get_blocksize(tiled_layout->format);

Error: COMPILER_WARNING (CWE-563): [#def1593]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:147:13: warning[-Wunused-variable]: unused variable ‘height_px’
#  147 |    unsigned height_px = u_minify(tiled_layout->height_px, level);
#      |             ^~~~~~~~~
#  145|   {
#  146|      unsigned width_px = u_minify(tiled_layout->width_px, level);
#  147|->    unsigned height_px = u_minify(tiled_layout->height_px, level);
#  148|      unsigned blocksize_B = util_format_get_blocksize(tiled_layout->format);
#  149|   

Error: COMPILER_WARNING (CWE-563): [#def1594]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc: scope_hint: In function ‘void ail_tile(void*, void*, const ail_layout*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)’
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:164:13: warning[-Wunused-variable]: unused variable ‘width_px’
#  164 |    unsigned width_px = u_minify(tiled_layout->width_px, level);
#      |             ^~~~~~~~
#  162|            unsigned sy_px, unsigned swidth_px, unsigned sheight_px)
#  163|   {
#  164|->    unsigned width_px = u_minify(tiled_layout->width_px, level);
#  165|      unsigned height_px = u_minify(tiled_layout->height_px, level);
#  166|      unsigned blocksize_B = ail_get_blocksize_B(tiled_layout);

Error: COMPILER_WARNING (CWE-563): [#def1595]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:165:13: warning[-Wunused-variable]: unused variable ‘height_px’
#  165 |    unsigned height_px = u_minify(tiled_layout->height_px, level);
#      |             ^~~~~~~~~
#  163|   {
#  164|      unsigned width_px = u_minify(tiled_layout->width_px, level);
#  165|->    unsigned height_px = u_minify(tiled_layout->height_px, level);
#  166|      unsigned blocksize_B = ail_get_blocksize_B(tiled_layout);
#  167|   

Error: COMPILER_WARNING (CWE-563): [#def1596]
mesa-25.1.0-rc2/src/asahi/lib/agx_device.c: scope_hint: In function ‘agx_bo_export’
mesa-25.1.0-rc2/src/asahi/lib/agx_device.c:379:14: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  379 |          int ret = drmSyncobjExportSyncFile(
#      |              ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  377|         if (writer) {
#  378|            int out_sync_fd = -1;
#  379|->          int ret = drmSyncobjExportSyncFile(
#  380|               dev->fd, agx_bo_writer_syncobj(writer), &out_sync_fd);
#  381|            assert(ret >= 0);

Error: COMPILER_WARNING (CWE-563): [#def1597]
mesa-25.1.0-rc2/src/asahi/lib/agx_nir_lower_vbo.c: scope_hint: In function ‘pass’
mesa-25.1.0-rc2/src/asahi/lib/agx_nir_lower_vbo.c:134:9: warning[-Wunused-variable]: unused variable ‘is_float’
#  134 |    bool is_float = desc->channel[chan].type == UTIL_FORMAT_TYPE_FLOAT;
#      |         ^~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  132|      assert(chan >= 0);
#  133|   
#  134|->    bool is_float = desc->channel[chan].type == UTIL_FORMAT_TYPE_FLOAT;
#  135|      bool is_unsigned = desc->channel[chan].type == UTIL_FORMAT_TYPE_UNSIGNED;
#  136|      bool is_signed = desc->channel[chan].type == UTIL_FORMAT_TYPE_SIGNED;

Error: COMPILER_WARNING (CWE-563): [#def1598]
mesa-25.1.0-rc2/src/asahi/lib/decode.c: scope_hint: In function ‘agxdecode_track_alloc’
mesa-25.1.0-rc2/src/asahi/lib/decode.c:987:12: warning[-Wunused-variable]: unused variable ‘match’
#  987 |       bool match = (it->handle == alloc->handle);
#      |            ^~~~~
#  985|   {
#  986|      util_dynarray_foreach(&ctx->mmap_array, struct agx_bo, it) {
#  987|->       bool match = (it->handle == alloc->handle);
#  988|         assert(!match && "tried to alloc already allocated BO");
#  989|      }

Error: COMPILER_WARNING (CWE-563): [#def1599]
mesa-25.1.0-rc2/src/asahi/lib/decode.c: scope_hint: In function ‘agxdecode_track_free’
mesa-25.1.0-rc2/src/asahi/lib/decode.c:997:9: warning[-Wunused-but-set-variable]: variable ‘found’ set but not used
#  997 |    bool found = false;
#      |         ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  995|   agxdecode_track_free(struct agxdecode_ctx *ctx, struct agx_bo *bo)
#  996|   {
#  997|->    bool found = false;
#  998|   
#  999|      util_dynarray_foreach(&ctx->mmap_array, struct agx_bo, it) {

Error: COMPILER_WARNING (CWE-563): [#def1600]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c: scope_hint: In function ‘hk_CmdBeginRendering’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c:695:45: warning[-Wunused-variable]: unused variable ‘desc’
#  695 |       const struct util_format_description *desc =
#      |                                             ^~~~
#  693|         unsigned first_layer = view->vk.base_array_layer;
#  694|   
#  695|->       const struct util_format_description *desc =
#  696|            util_format_description(hk_format_to_pipe_format(view->vk.format));
#  697|   

Error: COMPILER_WARNING (CWE-563): [#def1601]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c: scope_hint: In function ‘hk_flush_gfx_state’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c:3200:22: warning[-Wunused-variable]: unused variable ‘dev’
# 3200 |    struct hk_device *dev = hk_cmd_buffer_device(cmd);
#      |                      ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 3198|                      struct agx_draw draw)
# 3199|   {
# 3200|->    struct hk_device *dev = hk_cmd_buffer_device(cmd);
# 3201|      struct hk_graphics_state *gfx = &cmd->state.gfx;
# 3202|      struct hk_descriptor_state *desc = &gfx->descriptors;

Error: COMPILER_WARNING (CWE-563): [#def1602]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_meta.c: scope_hint: In function ‘aspect_format’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_meta.c:211:9: warning[-Wunused-variable]: unused variable ‘depth’
#  211 |    bool depth = (aspect & VK_IMAGE_ASPECT_DEPTH_BIT);
#      |         ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  209|   aspect_format(VkFormat fmt, VkImageAspectFlags aspect)
#  210|   {
#  211|->    bool depth = (aspect & VK_IMAGE_ASPECT_DEPTH_BIT);
#  212|      bool stencil = (aspect & VK_IMAGE_ASPECT_STENCIL_BIT);
#  213|   

Error: COMPILER_WARNING (CWE-563): [#def1603]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_device_memory.c: scope_hint: In function ‘hk_AllocateMemory’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_device_memory.c:182:19: warning[-Wunused-variable]: unused variable ‘flags’
#  182 |    const unsigned flags = hk_memory_type_flags(type, handle_types);
#      |                   ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  180|         handle_types |= fd_info->handleType;
#  181|   
#  182|->    const unsigned flags = hk_memory_type_flags(type, handle_types);
#  183|   
#  184|      uint32_t alignment = 16384; /* Apple page size */

Error: COMPILER_WARNING (CWE-563): [#def1604]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_image.c: scope_hint: In function ‘hk_copy_image_to_image_cpu’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_image.c:1651:19: warning[-Wunused-variable]: unused variable ‘dst_size’
# 1651 |          uint32_t dst_size =
#      |                   ^~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1649|            uint32_t src_size =
# 1650|               ail_get_level_size_B(src_layout, info->srcSubresource.mipLevel);
# 1651|->          uint32_t dst_size =
# 1652|               ail_get_level_size_B(dst_layout, info->dstSubresource.mipLevel);
# 1653|   

Error: COMPILER_WARNING (CWE-563): [#def1605]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c: scope_hint: In function ‘hk_sparse_image_bind_memory’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c:671:16: warning[-Wunused-variable]: unused variable ‘size_B’
#  671 |       unsigned size_B = tilesize_el.width_el * tilesize_el.height_el *
#      |                ^~~~~~
#  669|         /* Hardware tiles are exactly one page (16K) */
#  670|         struct ail_tile tilesize_el = layout->tilesize_el[level];
#  671|->       unsigned size_B = tilesize_el.width_el * tilesize_el.height_el *
#  672|                           ail_get_blocksize_B(layout);
#  673|   

Error: COMPILER_WARNING (CWE-563): [#def1606]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c: scope_hint: In function ‘hk_queue_init’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c:940:31: warning[-Wunused-variable]: unused variable ‘pdev’
#  940 |    struct hk_physical_device *pdev = hk_device_physical(dev);
#      |                               ^~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  938|                 uint32_t index_in_family)
#  939|   {
#  940|->    struct hk_physical_device *pdev = hk_device_physical(dev);
#  941|      VkResult result;
#  942|   

Error: COMPILER_WARNING (CWE-563): [#def1607]
mesa-25.1.0-rc2/src/broadcom/perfcntrs/v3dx_counter.c: scope_hint: In function ‘v3d42_perfcounters_get’
mesa-25.1.0-rc2/src/broadcom/perfcntrs/v3dx_counter.c:31:24: warning[-Wunused-variable]: unused variable ‘max_perfcnt’
#   31 |         const unsigned max_perfcnt = perfcounters->max_perfcnt;
#      |                        ^~~~~~~~~~~
#   29|   v3dX(perfcounters_get)(struct v3d_perfcntrs *perfcounters, unsigned index)
#   30|   {
#   31|->         const unsigned max_perfcnt = perfcounters->max_perfcnt;
#   32|           struct v3d_perfcntr_desc *counter;
#   33|   

Error: COMPILER_WARNING (CWE-563): [#def1608]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_cmd_buffer.c: scope_hint: In function ‘job_destroy_cloned_gpu_cl_resources’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_cmd_buffer.c:153:28: warning[-Wunused-variable]: unused variable ‘cmd_buffer’
#  153 |    struct v3dv_cmd_buffer *cmd_buffer = job->cmd_buffer;
#      |                            ^~~~~~~~~~
#  151|      assert(job->type == V3DV_JOB_TYPE_GPU_CL);
#  152|   
#  153|->    struct v3dv_cmd_buffer *cmd_buffer = job->cmd_buffer;
#  154|      if (job->clone_owns_bcl) {
#  155|         /* For suspending jobs in command buffers with the simultaneous use flag

Error: COMPILER_WARNING (CWE-563): [#def1609]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_device.c: scope_hint: In function ‘v3dv_setup_dynamic_framebuffer’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_device.c:2850:29: warning[-Wunused-variable]: unused variable ‘pass’
# 2850 |    struct v3dv_render_pass *pass = &cmd_buffer->state.dynamic_pass;
#      |                             ^~~~
# 2848|      fb->layers = info->viewMask == 0 ? info->layerCount : 1;
# 2849|   
# 2850|->    struct v3dv_render_pass *pass = &cmd_buffer->state.dynamic_pass;
# 2851|      assert(pass->subpass_count == 1 && pass->subpasses);
# 2852|      assert(pass->subpasses[0].color_count == info->colorAttachmentCount);

Error: COMPILER_WARNING (CWE-563): [#def1610]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_meta_copy.c: scope_hint: In function ‘copy_image_linear_texel_buffer’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_meta_copy.c:1633:12: warning[-Wunused-variable]: unused variable ‘dst_plane’
# 1633 |    uint8_t dst_plane =
#      |            ^~~~~~~~~
# 1631|      uint8_t src_plane =
# 1632|         v3dv_plane_from_aspect(region->srcSubresource.aspectMask);
# 1633|->    uint8_t dst_plane =
# 1634|         v3dv_plane_from_aspect(region->dstSubresource.aspectMask);
# 1635|   

Error: COMPILER_WARNING (CWE-563): [#def1611]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_meta_copy.c: scope_hint: In function ‘copy_buffer_to_image_shader’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_meta_copy.c:3164:9: warning[-Wunused-variable]: unused variable ‘is_plane_aspect’
# 3164 |    bool is_plane_aspect = aspect & any_plane_aspect;
#      |         ^~~~~~~~~~~~~~~
# 3162|         VK_IMAGE_ASPECT_PLANE_2_BIT;
# 3163|   
# 3164|->    bool is_plane_aspect = aspect & any_plane_aspect;
# 3165|   
# 3166|      /* Generally, the bpp of the data in the buffer matches that of the

Error: COMPILER_WARNING (CWE-563): [#def1612]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c: scope_hint: In function ‘pipeline_populate_v3d_fs_key’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c:1161:24: warning[-Wunused-variable]: unused variable ‘device’
# 1161 |    struct v3dv_device *device = p_stage->pipeline->device;
#      |                        ^~~~~~
# 1159|      memset(key, 0, sizeof(*key));
# 1160|   
# 1161|->    struct v3dv_device *device = p_stage->pipeline->device;
# 1162|      assert(device);
# 1163|   

Error: COMPILER_WARNING (CWE-563): [#def1613]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c: scope_hint: In function ‘pipeline_populate_v3d_gs_key’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c:1246:24: warning[-Wunused-variable]: unused variable ‘device’
# 1246 |    struct v3dv_device *device = p_stage->pipeline->device;
#      |                        ^~~~~~
# 1244|             p_stage->stage == BROADCOM_SHADER_GEOMETRY_BIN);
# 1245|   
# 1246|->    struct v3dv_device *device = p_stage->pipeline->device;
# 1247|      assert(device);
# 1248|   

Error: COMPILER_WARNING (CWE-563): [#def1614]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c: scope_hint: In function ‘pipeline_populate_v3d_vs_key’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c:1290:24: warning[-Wunused-variable]: unused variable ‘device’
# 1290 |    struct v3dv_device *device = p_stage->pipeline->device;
#      |                        ^~~~~~
# 1288|             p_stage->stage == BROADCOM_SHADER_VERTEX_BIN);
# 1289|   
# 1290|->    struct v3dv_device *device = p_stage->pipeline->device;
# 1291|      assert(device);
# 1292|   

Error: COMPILER_WARNING (CWE-563): [#def1615]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c: scope_hint: In function ‘pipeline_populate_graphics_key’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c:1958:24: warning[-Wunused-variable]: unused variable ‘device’
# 1958 |    struct v3dv_device *device = pipeline->device;
#      |                        ^~~~~~
# 1956|                                  const VkGraphicsPipelineCreateInfo *pCreateInfo)
# 1957|   {
# 1958|->    struct v3dv_device *device = pipeline->device;
# 1959|      assert(device);
# 1960|   

Error: COMPILER_WARNING (CWE-563): [#def1616]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c: scope_hint: In function ‘pipeline_populate_compute_key’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dv_pipeline.c:2043:24: warning[-Wunused-variable]: unused variable ‘device’
# 2043 |    struct v3dv_device *device = pipeline->device;
#      |                        ^~~~~~
# 2041|                                 const VkComputePipelineCreateInfo *pCreateInfo)
# 2042|   {
# 2043|->    struct v3dv_device *device = pipeline->device;
# 2044|      assert(device);
# 2045|   

Error: COMPILER_WARNING (CWE-563): [#def1617]
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dvx_cmd_buffer.c: scope_hint: In function ‘v3d71_cmd_buffer_emit_depth_bias’
mesa-25.1.0-rc2/src/broadcom/vulkan/v3dvx_cmd_buffer.c:1503:26: warning[-Wunused-variable]: unused variable ‘pipeline’
# 1503 |    struct v3dv_pipeline *pipeline = cmd_buffer->state.gfx.pipeline;
#      |                          ^~~~~~~~
# 1501|   v3dX(cmd_buffer_emit_depth_bias)(struct v3dv_cmd_buffer *cmd_buffer)
# 1502|   {
# 1503|->    struct v3dv_pipeline *pipeline = cmd_buffer->state.gfx.pipeline;
# 1504|      assert(pipeline);
# 1505|      struct vk_dynamic_graphics_state *dyn = &cmd_buffer->vk.dynamic_graphics_state;

Error: COMPILER_WARNING (CWE-252): [#def1618]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c: scope_hint: In function ‘main’
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:127:7: warning[-Wunused-result]: ignoring return value of ‘fread’ declared with attribute ‘warn_unused_result’
#  127 |       fread(map, 1, len, fp);
#      |       ^~~~~~~~~~~~~~~~~~~~~~
#  125|         }
#  126|   
#  127|->       fread(map, 1, len, fp);
#  128|         map[len] = 0;
#  129|         fclose(fp);

Error: CPPCHECK_WARNING (CWE-476): [#def1619]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:172: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: fp
#  170|   
#  171|      FILE *fp = fopen(outfile, "w");
#  172|->    fwrite(final_spirv.data, final_spirv.size, 1, fp);
#  173|      fclose(fp);
#  174|   

Error: CPPCHECK_WARNING (CWE-476): [#def1620]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:173: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: fp
#  171|      FILE *fp = fopen(outfile, "w");
#  172|      fwrite(final_spirv.data, final_spirv.size, 1, fp);
#  173|->    fclose(fp);
#  174|   
#  175|      if (depfile) {

Error: CPPCHECK_WARNING (CWE-476): [#def1621]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:177: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: fp
#  175|      if (depfile) {
#  176|         FILE *fp = fopen(depfile, "w");
#  177|->       fprintf(fp, "%s:", outfile);
#  178|         set_foreach(deps, ent) {
#  179|            fprintf(fp, " %s", (const char *)ent->key);

Error: CPPCHECK_WARNING (CWE-476): [#def1622]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:179: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: fp
#  177|         fprintf(fp, "%s:", outfile);
#  178|         set_foreach(deps, ent) {
#  179|->          fprintf(fp, " %s", (const char *)ent->key);
#  180|         }
#  181|         fprintf(fp, "\n");

Error: CPPCHECK_WARNING (CWE-476): [#def1623]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:181: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: fp
#  179|            fprintf(fp, " %s", (const char *)ent->key);
#  180|         }
#  181|->       fprintf(fp, "\n");
#  182|         fclose(fp);
#  183|      }

Error: CPPCHECK_WARNING (CWE-476): [#def1624]
mesa-25.1.0-rc2/src/compiler/clc/mesa_clc.c:182: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: fp
#  180|         }
#  181|         fprintf(fp, "\n");
#  182|->       fclose(fp);
#  183|      }
#  184|   

Error: COMPILER_WARNING (CWE-252): [#def1625]
mesa-25.1.0-rc2/redhat-linux-build/src/etnaviv/isa/etnaviv-isa.c:4638: included_from: Included from here.
mesa-25.1.0-rc2/src/compiler/isaspec/isaspec_decode_impl.c: scope_hint: In function ‘decode_error’
mesa-25.1.0-rc2/src/compiler/isaspec/isaspec_decode_impl.c:196:9: warning[-Wunused-result]: ignoring return value of ‘vasprintf’ declared with attribute ‘warn_unused_result’
#  196 |         vasprintf(&state->errors[state->num_errors++], fmt, ap);
#      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#  194|   	va_list ap;
#  195|   	va_start(ap, fmt);
#  196|-> 	vasprintf(&state->errors[state->num_errors++], fmt, ap);
#  197|   	va_end(ap);
#  198|   }

Error: COMPILER_WARNING: [#def1626]
mesa-25.1.0-rc2/src/compiler/nir/nir_opt_shrink_vectors.c: scope_hint: In function ‘shrink_dest_to_read_mask’
mesa-25.1.0-rc2/src/compiler/nir/nir_opt_shrink_vectors.c:139:36: warning[-Wstringop-overflow=]: writing 16 bytes into a region of size 15
#  139 |             swizzle[first_bit + i] = i;
#      |             ~~~~~~~~~~~~~~~~~~~~~~~^~~
mesa-25.1.0-rc2/src/compiler/nir/nir_opt_shrink_vectors.c:137:18: note: at offset [1, 15] into destination object ‘swizzle’ of size 16
#  137 |          uint8_t swizzle[NIR_MAX_VEC_COMPONENTS] = { 0 };
#      |                  ^~~~~~~
#  137|            uint8_t swizzle[NIR_MAX_VEC_COMPONENTS] = { 0 };
#  138|            for (unsigned i = 0; i < comps; ++i) {
#  139|->             swizzle[first_bit + i] = i;
#  140|            }
#  141|   

Error: COMPILER_WARNING (CWE-252): [#def1627]
mesa-25.1.0-rc2/src/compiler/spirv/vtn_bindgen2.c: scope_hint: In function ‘main’
mesa-25.1.0-rc2/src/compiler/spirv/vtn_bindgen2.c:313:4: warning[-Wunused-result]: ignoring return value of ‘fread’ declared with attribute ‘warn_unused_result’
#  313 |    fread(map, 1, len, fin);
#      |    ^~~~~~~~~~~~~~~~~~~~~~~
#  311|      }
#  312|   
#  313|->    fread(map, 1, len, fin);
#  314|      fclose(fin);
#  315|   

Error: COMPILER_WARNING (CWE-563): [#def1628]
mesa-25.1.0-rc2/src/egl/drivers/dri2/platform_wayland.c: scope_hint: In function ‘dri2_wl_swrast_query_buffer_age’
mesa-25.1.0-rc2/src/egl/drivers/dri2/platform_wayland.c:2808:29: warning[-Wunused-variable]: unused variable ‘dri2_dpy’
# 2808 |    struct dri2_egl_display *dri2_dpy = dri2_egl_display(disp);
#      |                             ^~~~~~~~
# 2806|   dri2_wl_swrast_query_buffer_age(_EGLDisplay *disp, _EGLSurface *surface)
# 2807|   {
# 2808|->    struct dri2_egl_display *dri2_dpy = dri2_egl_display(disp);
# 2809|      struct dri2_egl_surface *dri2_surf = dri2_egl_surface(surface);
# 2810|   

Error: COMPILER_WARNING (CWE-563): [#def1629]
mesa-25.1.0-rc2/src/freedreno/fdl/fd6_tiled_memcpy.cc: scope_hint: In function ‘void fdl6_memcpy_linear_to_tiled(uint32_t, uint32_t, uint32_t, uint32_t, char*, const char*, const fdl_layout*, unsigned int, uint32_t, const fdl_ubwc_config*)’
mesa-25.1.0-rc2/src/freedreno/fdl/fd6_tiled_memcpy.cc:860:13: warning[-Wunused-variable]: unused variable ‘block_size’
#  860 |    uint32_t block_size = 256;
#      |             ^~~~~~~~~~
#  858|      uint32_t block_stride =
#  859|         fdl_pitch(dst_layout, dst_miplevel) / (block_width * dst_layout->cpp);
#  860|->    uint32_t block_size = 256;
#  861|      assert(block_size == block_width * block_height * dst_layout->cpp);
#  862|      assert(config->macrotile_mode != FDL_MACROTILE_INVALID);

Error: COMPILER_WARNING (CWE-563): [#def1630]
mesa-25.1.0-rc2/src/freedreno/fdl/fd6_tiled_memcpy.cc: scope_hint: In function ‘void fdl6_memcpy_tiled_to_linear(uint32_t, uint32_t, uint32_t, uint32_t, char*, const char*, const fdl_layout*, unsigned int, uint32_t, const fdl_ubwc_config*)’
mesa-25.1.0-rc2/src/freedreno/fdl/fd6_tiled_memcpy.cc:923:13: warning[-Wunused-variable]: unused variable ‘block_size’
#  923 |    uint32_t block_size = 256;
#      |             ^~~~~~~~~~
#  921|      uint32_t block_stride =
#  922|         fdl_pitch(src_layout, src_miplevel) / (block_width * src_layout->cpp);
#  923|->    uint32_t block_size = 256;
#  924|      assert(block_size == block_width * block_height * src_layout->cpp);
#  925|      assert(config->macrotile_mode != FDL_MACROTILE_INVALID);

Error: COMPILER_WARNING (CWE-563): [#def1631]
mesa-25.1.0-rc2/src/freedreno/ir3/ir3_compiler_nir.c: scope_hint: In function ‘emit_predicated_branch’
mesa-25.1.0-rc2/src/freedreno/ir3/ir3_compiler_nir.c:4515:22: warning[-Wunused-variable]: unused variable ‘else_block’
# 4515 |    struct ir3_block *else_block = get_block(ctx, nir_if_first_else_block(nif));
#      |                      ^~~~~~~~~~
# 4513|   
# 4514|      struct ir3_block *then_block = get_block(ctx, nir_if_first_then_block(nif));
# 4515|->    struct ir3_block *else_block = get_block(ctx, nir_if_first_else_block(nif));
# 4516|      assert(list_is_empty(&then_block->instr_list) &&
# 4517|             list_is_empty(&else_block->instr_list));

Error: COMPILER_WARNING (CWE-563): [#def1632]
mesa-25.1.0-rc2/src/freedreno/ir3/ir3_nir_opt_preamble.c: scope_hint: In function ‘emit_descriptor_prefetch’
mesa-25.1.0-rc2/src/freedreno/ir3/ir3_nir_opt_preamble.c:603:11: warning[-Wunused-variable]: unused variable ‘texture_index’
#  603 |       int texture_index =
#      |           ^~~~~~~~~~~~~
#  601|         int sampler_index =
#  602|            nir_tex_instr_src_index(tex, nir_tex_src_sampler_handle);
#  603|->       int texture_index =
#  604|            nir_tex_instr_src_index(tex, nir_tex_src_texture_handle);
#  605|   

Error: COMPILER_WARNING (CWE-252): [#def1633]
mesa-25.1.0-rc2/src/freedreno/perfcntrs/freedreno_dt.c: scope_hint: In function ‘readdt’
mesa-25.1.0-rc2/src/freedreno/perfcntrs/freedreno_dt.c:49:10: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’
#   49 |    (void)asprintf(&path, "%s/%s", dev.dtnode, node);
#      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   47|      size_t sz;
#   48|   
#   49|->    (void)asprintf(&path, "%s/%s", dev.dtnode, node);
#   50|      buf = os_read_file(path, &sz);
#   51|      free(path);

Error: COMPILER_WARNING (CWE-252): [#def1634]
mesa-25.1.0-rc2/src/freedreno/perfcntrs/freedreno_dt.c: scope_hint: In function ‘find_freqs’
mesa-25.1.0-rc2/src/freedreno/perfcntrs/freedreno_dt.c:82:10: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’
#   82 |    (void)asprintf(&path, "%s/%s", dev.dtnode, "qcom,gpu-pwrlevels");
#      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   80|      dev.max_freq = 0;
#   81|   
#   82|->    (void)asprintf(&path, "%s/%s", dev.dtnode, "qcom,gpu-pwrlevels");
#   83|   
#   84|      nftw(path, find_freqs_fn, 64, 0);

Error: COMPILER_WARNING (CWE-252): [#def1635]
mesa-25.1.0-rc2/src/gallium/auxiliary/gallivm/lp_bld_debug.cpp: scope_hint: In function ‘void lp_function_add_debug_info(gallivm_state*, LLVMValueRef, LLVMTypeRef)’
mesa-25.1.0-rc2/src/gallium/auxiliary/gallivm/lp_bld_debug.cpp:381:15: warning[-Wunused-result]: ignoring return value of ‘int asprintf(char**, const char*, ...)’ declared with attribute ‘warn_unused_result’
#  381 |       asprintf(&gallivm->file_name, "%s/%u.nir", LP_NIR_SHADER_DUMP_DIR, shader_index);
#      |       ~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#  379|         std::filesystem::create_directory(LP_NIR_SHADER_DUMP_DIR);
#  380|   
#  381|->       asprintf(&gallivm->file_name, "%s/%u.nir", LP_NIR_SHADER_DUMP_DIR, shader_index);
#  382|   
#  383|         gallivm->file = LLVMDIBuilderCreateFile(gallivm->di_builder, gallivm->file_name, strlen(gallivm->file_name), ".", 1);

Error: COMPILER_WARNING (CWE-563): [#def1636]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_batch_init’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:159:11: warning[-Wunused-variable]: unused variable ‘ret’
#  159 |       int ret = drmSyncobjCreate(dev->fd, 0, &batch->syncobj);
#      |           ^~~
#  157|   
#  158|      if (!batch->syncobj) {
#  159|->       int ret = drmSyncobjCreate(dev->fd, 0, &batch->syncobj);
#  160|         assert(!ret && batch->syncobj);
#  161|      }

Error: COMPILER_WARNING (CWE-563): [#def1637]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_get_in_sync’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:599:11: warning[-Wunused-variable]: unused variable ‘ret’
#  599 |       int ret =
#      |           ^~~
#  597|   
#  598|      if (ctx->in_sync_fd >= 0) {
#  599|->       int ret =
#  600|            drmSyncobjImportSyncFile(dev->fd, ctx->in_sync_obj, ctx->in_sync_fd);
#  601|         assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def1638]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_batch_submit’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:714:14: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  714 |          int ret = drmSyncobjCreate(dev->fd, 0, &sync_handle);
#      |              ^~~
#  712|            /* Create a new syncobj */
#  713|            uint32_t sync_handle;
#  714|->          int ret = drmSyncobjCreate(dev->fd, 0, &sync_handle);
#  715|            assert(ret >= 0);
#  716|   

Error: COMPILER_WARNING (CWE-563): [#def1639]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:905:11: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  905 |       int ret = drmSyncobjExportSyncFile(dev->fd, batch->syncobj, &out_sync_fd);
#      |           ^~~
#  903|         /* Convert our handle to a sync file */
#  904|         int out_sync_fd = -1;
#  905|->       int ret = drmSyncobjExportSyncFile(dev->fd, batch->syncobj, &out_sync_fd);
#  906|         assert(ret >= 0);
#  907|         assert(out_sync_fd >= 0);

Error: COMPILER_WARNING (CWE-563): [#def1640]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:957:11: warning[-Wunused-variable]: unused variable ‘ret’
#  957 |       int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
#      |           ^~~
#  955|   
#  956|         /* Wait so we can get errors reported back */
#  957|->       int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
#  958|         assert(!ret);
#  959|   

Error: COMPILER_WARNING (CWE-563): [#def1641]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_sync_batch’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:1011:8: warning[-Wunused-variable]: unused variable ‘ret’
# 1011 |    int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
#      |        ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1009|   
# 1010|      assert(batch->syncobj);
# 1011|->    int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
# 1012|      assert(!ret);
# 1013|      agx_batch_cleanup(ctx, batch, false);

Error: COMPILER_WARNING (CWE-563): [#def1642]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c: scope_hint: In function ‘agx_fence_get_fd’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c:66:8: warning[-Wunused-variable]: unused variable ‘ret’
#   66 |    int ret = drmSyncobjExportSyncFile(dev->fd, f->syncobj, &fd);
#      |        ^~~
#   64|      int fd = -1;
#   65|   
#   66|->    int ret = drmSyncobjExportSyncFile(dev->fd, f->syncobj, &fd);
#   67|      assert(ret >= 0);
#   68|      assert(fd >= 0);

Error: COMPILER_WARNING (CWE-563): [#def1643]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c: scope_hint: In function ‘agx_fence_server_sync’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c:154:17: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  154 |    int fd = -1, ret;
#      |                 ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  152|      struct agx_device *dev = agx_device(pctx->screen);
#  153|      struct agx_context *ctx = agx_context(pctx);
#  154|->    int fd = -1, ret;
#  155|   
#  156|      ret = drmSyncobjExportSyncFile(dev->fd, f->syncobj, &fd);

Error: COMPILER_WARNING (CWE-563): [#def1644]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c: scope_hint: In function ‘agx_create_context’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c:1735:8: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
# 1735 |    int ret;
#      |        ^~~
# 1733|      struct agx_context *ctx = rzalloc(NULL, struct agx_context);
# 1734|      struct pipe_context *pctx = &ctx->base;
# 1735|->    int ret;
# 1736|   
# 1737|      if (!ctx)

Error: COMPILER_WARNING (CWE-563): [#def1645]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c: scope_hint: In function ‘agx_screen_create’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c:2426:8: warning[-Wunused-variable]: unused variable ‘ret’
# 2426 |    int ret =
#      |        ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 2424|         agx_screen->dev.debug |= AGX_DBG_NO16;
# 2425|   
# 2426|->    int ret =
# 2427|         drmSyncobjCreate(agx_device(screen)->fd, 0, &agx_screen->flush_syncobj);
# 2428|      assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def1646]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_query.c: scope_hint: In function ‘agx_get_query_result_resource_cpu’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_query.c:443:12: warning[-Wunused-variable]: unused variable ‘ready’
#  443 |       bool ready =
#      |            ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  441|         result.u64 = !is_query_busy(ctx, query);
#  442|      } else {
#  443|->       bool ready =
#  444|            agx_get_query_result(&ctx->base, (void *)query, true, &result);
#  445|   

Error: COMPILER_WARNING (CWE-563): [#def1647]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_state.c: scope_hint: In function ‘agx_create_vertex_elements’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_state.c:1396:16: warning[-Wunused-variable]: unused variable ‘chan_size’
# 1396 |       unsigned chan_size = desc->channel[0].size / 8;
#      |                ^~~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1394|         const struct util_format_description *desc =
# 1395|            util_format_description(ve.src_format);
# 1396|->       unsigned chan_size = desc->channel[0].size / 8;
# 1397|         assert((ve.src_offset & (chan_size - 1)) == 0);
# 1398|   

Error: COMPILER_WARNING (CWE-563): [#def1648]
mesa-25.1.0-rc2/src/gallium/drivers/freedreno/a6xx/fd6_texture.cc: scope_hint: In function ‘fd6_texture_state* fd6_texture_state(fd_context*, pipe_shader_type)’
mesa-25.1.0-rc2/src/gallium/drivers/freedreno/a6xx/fd6_texture.cc:779:19: warning[-Wunused-variable]: unused variable ‘seqno’
#  779 |          uint16_t seqno = tex->textures[i] ?
#      |                   ^~~~~
#  777|         state = (struct fd6_texture_state *)entry->data;
#  778|         for (unsigned i = 0; i < tex->num_textures; i++) {
#  779|->          uint16_t seqno = tex->textures[i] ?
#  780|                  fd_resource(tex->textures[i]->texture)->seqno : 0;
#  781|   

Error: COMPILER_WARNING (CWE-563): [#def1649]
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_program.c: scope_hint: In function ‘iris_fill_cs_push_const_buffer’
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_program.c:3140:25: warning[-Wunused-variable]: unused variable ‘cs_data’
# 3140 |    struct iris_cs_data *cs_data = iris_cs_data(shader);
#      |                         ^~~~~~~
# 3138|                                  uint32_t *dst)
# 3139|   {
# 3140|->    struct iris_cs_data *cs_data = iris_cs_data(shader);
# 3141|      assert(iris_cs_push_const_total_size(shader, threads) > 0);
# 3142|      assert(cs_data->push.cross_thread.size == 0);

Error: COMPILER_WARNING (CWE-563): [#def1650]
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_resource.c: scope_hint: In function ‘map_aux_addresses’
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_resource.c:643:18: warning[-Wunused-variable]: unused variable ‘mapped’
#  643 |       const bool mapped =
#      |                  ^~~~~~
#  641|         const uint64_t format_bits =
#  642|            intel_aux_map_format_bits(res->surf.tiling, format, plane);
#  643|->       const bool mapped =
#  644|            intel_aux_map_add_mapping(aux_map_ctx,
#  645|                                      res->bo->address + res->offset,

Error: COMPILER_WARNING (CWE-563): [#def1651]
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_state.c: scope_hint: In function ‘fill_surf_for_tex2d_from_buffer’
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_state.c:2923:15: warning[-Wunused-variable]: unused variable ‘isl_surf_created_successfully’
# 2923 |    const bool isl_surf_created_successfully =
#      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 2921|      };
# 2922|   
# 2923|->    const bool isl_surf_created_successfully =
# 2924|         isl_surf_init_s(isl_dev, surf, &init_info);
# 2925|   

Error: COMPILER_WARNING (CWE-563): [#def1652]
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_state.c: scope_hint: In function ‘iris_store_cs_state’
mesa-25.1.0-rc2/src/gallium/drivers/iris/iris_state.c:5389:25: warning[-Wunused-variable]: unused variable ‘cs_data’
# 5389 |    struct iris_cs_data *cs_data = iris_cs_data(shader);
#      |                         ^~~~~~~
# 5387|                       struct iris_compiled_shader *shader)
# 5388|   {
# 5389|->    struct iris_cs_data *cs_data = iris_cs_data(shader);
# 5390|      void *map = shader->derived_data;
# 5391|   

Error: COMPILER_WARNING (CWE-563): [#def1653]
mesa-25.1.0-rc2/src/gallium/drivers/llvmpipe/lp_texture_handle.c: scope_hint: In function ‘llvmpipe_create_texture_handle’
mesa-25.1.0-rc2/src/gallium/drivers/llvmpipe/lp_texture_handle.c:69:12: warning[-Wunused-but-set-variable]: variable ‘found’ set but not used
#   69 |       bool found = false;
#      |            ^~~~~
#   67|         llvmpipe_register_texture(ctx, &state, true);
#   68|   
#   69|->       bool found = false;
#   70|         for (uint32_t i = 0; i < matrix->texture_count; i++) {
#   71|            if (!memcmp(&matrix->textures[i]->state, &state, sizeof(struct lp_static_texture_state))) {

Error: COMPILER_WARNING (CWE-563): [#def1654]
mesa-25.1.0-rc2/src/gallium/drivers/llvmpipe/lp_texture_handle.c:86:12: warning[-Wunused-but-set-variable]: variable ‘found’ set but not used
#   86 |       bool found = false;
#      |            ^~~~~
#   84|         llvmpipe_register_sampler(ctx, &state);
#   85|   
#   86|->       bool found = false;
#   87|         for (uint32_t i = 0; i < matrix->sampler_count; i++) {
#   88|            if (!memcmp(matrix->samplers + i, &state, sizeof(struct lp_static_sampler_state))) {

Error: COMPILER_WARNING (CWE-563): [#def1655]
mesa-25.1.0-rc2/src/gallium/drivers/llvmpipe/lp_texture_handle.c: scope_hint: In function ‘llvmpipe_create_image_handle’
mesa-25.1.0-rc2/src/gallium/drivers/llvmpipe/lp_texture_handle.c:133:9: warning[-Wunused-but-set-variable]: variable ‘found’ set but not used
#  133 |    bool found = false;
#      |         ^~~~~
#  131|      llvmpipe_register_texture(ctx, &state, false);
#  132|   
#  133|->    bool found = false;
#  134|      for (uint32_t i = 0; i < matrix->texture_count; i++) {
#  135|         if (!memcmp(&matrix->textures[i]->state, &state, sizeof(struct lp_static_texture_state))) {

Error: COMPILER_WARNING (CWE-563): [#def1656]
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_cmdstream.c: scope_hint: In function ‘panfrost_emit_blend’
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_cmdstream.c:362:40: warning[-Wunused-variable]: unused variable ‘fs’
#  362 |       struct panfrost_compiled_shader *fs = ctx->prog[PIPE_SHADER_FRAGMENT];
#      |                                        ^~
#  360|   
#  361|   #if PAN_ARCH >= 6
#  362|->       struct panfrost_compiled_shader *fs = ctx->prog[PIPE_SHADER_FRAGMENT];
#  363|         struct mali_internal_blend_packed *internal_blend_packed =
#  364|            (struct mali_internal_blend_packed *)&packed->opaque[2];

Error: COMPILER_WARNING (CWE-563): [#def1657]
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_context.c: scope_hint: In function ‘panfrost_fence_server_sync’
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_context.c:991:17: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  991 |    int fd = -1, ret;
#      |                 ^~~
#  989|      struct panfrost_device *dev = pan_device(pctx->screen);
#  990|      struct panfrost_context *ctx = pan_context(pctx);
#  991|->    int fd = -1, ret;
#  992|   
#  993|      ret = drmSyncobjExportSyncFile(panfrost_device_fd(dev), f->syncobj, &fd);

Error: COMPILER_WARNING (CWE-563): [#def1658]
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_submit_wait_and_dump’
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_csf.c:571:11: warning[-Wunused-variable]: unused variable ‘ret’
#  571 |       int ret =
#      |           ^~~
#  569|      /* Wait so we can get errors reported back */
#  570|      if (wait) {
#  571|->       int ret =
#  572|            drmSyncobjTimelineWait(panfrost_device_fd(dev), &vm_sync_handle,
#  573|                                   &vm_sync_signal_point, 1, INT64_MAX, 0, NULL);

Error: COMPILER_WARNING (CWE-563): [#def1659]
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_emit_draw_state’
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_csf.c:1089:9: warning[-Wunused-variable]: unused variable ‘idvs’
# 1089 |    bool idvs = vs->info.vs.idvs;
#      |         ^~~~
# 1087|      struct panfrost_compiled_shader *fs = ctx->prog[PIPE_SHADER_FRAGMENT];
# 1088|   
# 1089|->    bool idvs = vs->info.vs.idvs;
# 1090|      bool fs_required = panfrost_fs_required(
# 1091|         fs, ctx->blend, &ctx->pipe_framebuffer, ctx->depth_stencil);

Error: COMPILER_WARNING (CWE-563): [#def1660]
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_cleanup_context_v10’
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_csf.c:1616:8: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
# 1616 |    int ret;
#      |        ^~~
# 1614|         .handle = ctx->csf.heap.handle,
# 1615|      };
# 1616|->    int ret;
# 1617|   
# 1618|      /* Make sure all jobs are done before destroying the heap. */

Error: COMPILER_WARNING (CWE-563): [#def1661]
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_jm.c: scope_hint: In function ‘jm_emit_tiler_desc’
mesa-25.1.0-rc2/src/gallium/drivers/panfrost/pan_jm.c:424:13: warning[-Wunused-variable]: unused variable ‘max_levels’
#  424 |    unsigned max_levels = dev->tiler_features.max_levels;
#      |             ^~~~~~~~~~
#  422|   
#  423|      uint64_t heap = t.gpu;
#  424|->    unsigned max_levels = dev->tiler_features.max_levels;
#  425|      assert(max_levels >= 2);
#  426|   

Error: CPPCHECK_WARNING (CWE-476): [#def1662]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/memory_pool.c:45: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: newblock
#   43|   
#   44|      newblock = malloc(blocksize);
#   45|->    newblock->next = pool->blocks;
#   46|      pool->blocks = newblock;
#   47|   

Error: CPPCHECK_WARNING (CWE-682): [#def1663]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/memory_pool.c:48: error[nullPointerArithmeticOutOfMemory]: If memory allocation fail: pointer addition with NULL pointer.
#   46|      pool->blocks = newblock;
#   47|   
#   48|->    pool->head = (unsigned char *)(newblock + 1);
#   49|      pool->end = ((unsigned char *)newblock) + blocksize;
#   50|      pool->total_allocated += blocksize;

Error: CPPCHECK_WARNING (CWE-682): [#def1664]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/memory_pool.c:49: error[nullPointerArithmeticOutOfMemory]: If memory allocation fail: pointer addition with NULL pointer.
#   47|   
#   48|      pool->head = (unsigned char *)(newblock + 1);
#   49|->    pool->end = ((unsigned char *)newblock) + blocksize;
#   50|      pool->total_allocated += blocksize;
#   51|   }

Error: CPPCHECK_WARNING (CWE-476): [#def1665]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/memory_pool.c:74: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: block
#   72|         struct memory_block *block = malloc(bytes + sizeof(struct memory_block));
#   73|   
#   74|->       block->next = pool->blocks;
#   75|         pool->blocks = block;
#   76|   

Error: CPPCHECK_WARNING (CWE-682): [#def1666]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/memory_pool.c:77: error[nullPointerArithmeticOutOfMemory]: If memory allocation fail: pointer addition with NULL pointer.
#   75|         pool->blocks = block;
#   76|   
#   77|->       return (block + 1);
#   78|      }
#   79|   }

Error: COMPILER_WARNING (CWE-563): [#def1667]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/r300_nir.c: scope_hint: In function ‘have_too_many_ubos’
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/r300_nir.c:101:11: warning[-Wunused-variable]: unused variable ‘ubo’
#  101 |       int ubo = var->data.driver_location;
#      |           ^~~
#   99|   
#  100|      nir_foreach_variable_with_modes (var, s, nir_var_mem_ubo) {
#  101|->       int ubo = var->data.driver_location;
#  102|         assert(ubo == 0);
#  103|   

Error: CPPCHECK_WARNING (CWE-476): [#def1668]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_code.c:53: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: newlist
#   51|   
#   52|         newlist = malloc(sizeof(struct rc_constant) * c->_Reserved);
#   53|->       memcpy(newlist, c->Constants, sizeof(struct rc_constant) * c->Count);
#   54|   
#   55|         free(c->Constants);

Error: COMPILER_WARNING (CWE-457): [#def1669]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_code.c: scope_hint: In function ‘rc_constants_add_immediate_scalar’
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_code.c:122:20: warning[-Wmaybe-uninitialized]: ‘free_comp’ may be used uninitialized
#  122 |    unsigned index, free_comp;
#      |                    ^~~~~~~~~
#  120|   rc_constants_add_immediate_scalar(struct rc_constant_list *c, float data, unsigned *swizzle)
#  121|   {
#  122|->    unsigned index, free_comp;
#  123|      int free_index = -1;
#  124|      struct rc_constant constant;

Error: CPPCHECK_WARNING (CWE-823): [#def1670]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_remove_constants.c:129: error[arrayIndexOutOfBounds]: Array 's->inv_remap_table[i].index[4]' accessed at index 4, which is out of bounds.
#  127|               s->remap_table[j].index[chan] = i;
#  128|               s->remap_table[j].swizzle[chan] = swizzle;
#  129|->             s->inv_remap_table[i].index[swizzle] = j;
#  130|               s->inv_remap_table[i].swizzle[swizzle] = chan;
#  131|               s->are_externals_remapped = true;

Error: CPPCHECK_WARNING (CWE-823): [#def1671]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_remove_constants.c:130: error[arrayIndexOutOfBounds]: Array 's->inv_remap_table[i].swizzle[4]' accessed at index 4, which is out of bounds.
#  128|               s->remap_table[j].swizzle[chan] = swizzle;
#  129|               s->inv_remap_table[i].index[swizzle] = j;
#  130|->             s->inv_remap_table[i].swizzle[swizzle] = chan;
#  131|               s->are_externals_remapped = true;
#  132|               s->is_identity = false;

Error: COMPILER_WARNING (CWE-563): [#def1672]
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_variable.c: scope_hint: In function ‘rc_get_variables’
mesa-25.1.0-rc2/src/gallium/drivers/r300/compiler/radeon_variable.c:356:42: warning[-Wunused-variable]: unused variable ‘opcode’
#  356 |             const struct rc_opcode_info *opcode = rc_get_opcode_info(inst->U.I.Opcode);
#      |                                          ^~~~~~
#  354|                * the DCE.
#  355|                */
#  356|->             const struct rc_opcode_info *opcode = rc_get_opcode_info(inst->U.I.Opcode);
#  357|               assert(c->type == RC_FRAGMENT_PROGRAM || !opcode->HasDstReg ||
#  358|                      inst->U.I.DstReg.File == RC_FILE_OUTPUT ||

Error: COMPILER_WARNING (CWE-563): [#def1673]
mesa-25.1.0-rc2/src/gallium/drivers/r600/sfn/sfn_assembler.cpp: scope_hint: In member function ‘r600::VirtualValue* r600::AssamblerVisitor::copy_src(r600_bytecode_alu_src&, const r600::VirtualValue&)’
mesa-25.1.0-rc2/src/gallium/drivers/r600/sfn/sfn_assembler.cpp:1249:11: warning[-Wunused-variable]: unused variable ‘clidx’
# 1249 |       int clidx = 4 * (s.sel() - g_clause_local_start) + s.chan();
#      |           ^~~~~
# 1247|      if (s.sel() >= g_clause_local_start && s.sel() < g_clause_local_end ) {
# 1248|         assert(m_bc->cf_last);
# 1249|->       int clidx = 4 * (s.sel() - g_clause_local_start) + s.chan();
# 1250|         /* Ensure that the clause local register was already written */
# 1251|         assert(m_bc->cf_last->clause_local_written & (1 << clidx));

Error: COMPILER_WARNING (CWE-563): [#def1674]
mesa-25.1.0-rc2/src/gallium/drivers/r600/sfn/sfn_shader.cpp: scope_hint: In member function ‘virtual void r600::RegisterWriteHandler::visit(r600::Register&)’
mesa-25.1.0-rc2/src/gallium/drivers/r600/sfn/sfn_shader.cpp:1107:8: warning[-Wunused-variable]: unused variable ‘writemask’
# 1107 |    int writemask = nir_intrinsic_write_mask(ir);
#      |        ^~~~~~~~~
# 1105|   void RegisterWriteHandler::visit(Register& dest)
# 1106|   {
# 1107|->    int writemask = nir_intrinsic_write_mask(ir);
# 1108|      assert(writemask == 1);
# 1109|      auto src = sh.value_factory().src(ir->src[0], 0);

Error: COMPILER_WARNING (CWE-563): [#def1675]
mesa-25.1.0-rc2/src/gallium/drivers/r600/sfn/sfn_valuefactory.cpp: scope_hint: In member function ‘r600::Register* r600::ValueFactory::dest_from_string(const std::string&)’
mesa-25.1.0-rc2/src/gallium/drivers/r600/sfn/sfn_valuefactory.cpp:635:9: warning[-Wunused-variable]: unused variable ‘is_ssa’
#  635 |    bool is_ssa = s[0] == 'S';
#      |         ^~~~~~
#  633|      }
#  634|   
#  635|->    bool is_ssa = s[0] == 'S';
#  636|   
#  637|      RegisterKey key(sel, chan, pool);

Error: COMPILER_WARNING (CWE-563): [#def1676]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_cp_utils.c: scope_hint: In function ‘si_cp_acquire_mem_pws’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_cp_utils.c:99:9: warning[-Wunused-variable]: unused variable ‘cs_done’
#   99 |    bool cs_done = event_type == V_028A90_CS_DONE;
#      |         ^~~~~~~
#   97|      assert(sctx->gfx_level >= GFX11 && sctx->has_graphics);
#   98|      bool ts = is_ts_event(event_type);
#   99|->    bool cs_done = event_type == V_028A90_CS_DONE;
#  100|      bool ps = event_type == V_028A90_PS_DONE;
#  101|   

Error: COMPILER_WARNING (CWE-563): [#def1677]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:129:12: warning[-Wunused-variable]: unused variable ‘has_attribute_ring_address’
#  129 |       bool has_attribute_ring_address = s->shader->selector->screen->info.gfx_level >= GFX11;
#      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~
#  127|         out[3] = nir_imm_float(b, 1);
#  128|      } else {
#  129|->       bool has_attribute_ring_address = s->shader->selector->screen->info.gfx_level >= GFX11;
#  130|   
#  131|         /* Color or texture coordinates: */

Error: COMPILER_WARNING (CWE-563): [#def1678]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c: scope_hint: In function ‘load_vs_input_from_blit_sgpr’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:134:16: warning[-Wunused-variable]: unused variable ‘vs_blit_property’
#  134 |       unsigned vs_blit_property = b->shader->info.vs.blit_sgprs_amd;
#      |                ^~~~~~~~~~~~~~~~
#  132|         assert(input_index == 1);
#  133|   
#  134|->       unsigned vs_blit_property = b->shader->info.vs.blit_sgprs_amd;
#  135|         assert(vs_blit_property == SI_VS_BLIT_SGPRS_POS_TEXCOORD + has_attribute_ring_address);
#  136|   

Error: COMPILER_WARNING (CWE-563): [#def1679]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_build_pm4.h:14: included_from: Included from here.
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_state_draw.cpp:7: included_from: Included from here.
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_pipe.h: scope_hint: In function ‘bool vi_tc_compat_htile_enabled(si_texture*, unsigned int, unsigned int)’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_pipe.h:1957:22: warning[-Wunused-variable]: unused variable ‘sscreen’
# 1957 |    struct si_screen *sscreen = si_screen(tex->buffer.b.b.screen);
#      |                      ^~~~~~~
# 1955|                                                 unsigned zs_mask)
# 1956|   {
# 1957|->    struct si_screen *sscreen = si_screen(tex->buffer.b.b.screen);
# 1958|   
# 1959|      /* Gfx12 should never call this. */

Error: COMPILER_WARNING (CWE-563): [#def1680]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader.c: scope_hint: In function ‘si_nir_assign_param_offsets’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader.c:1880:31: warning[-Wunused-variable]: unused variable ‘sel’
# 1880 |    struct si_shader_selector *sel = shader->selector;
#      |                               ^~~
# 1878|                                           int8_t slot_remap[NUM_TOTAL_VARYING_SLOTS])
# 1879|   {
# 1880|->    struct si_shader_selector *sel = shader->selector;
# 1881|      struct si_shader_binary_info *info = &shader->info;
# 1882|   

Error: COMPILER_WARNING (CWE-563): [#def1681]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader.c:3532:13: warning[-Wunused-variable]: unused variable ‘spi_ps_input_ena’
# 3532 |    unsigned spi_ps_input_ena = shader->config.spi_ps_input_ena;
#      |             ^~~~~~~~~~~~~~~~
# 3530|   
# 3531|      /* Make sure spi_ps_input_addr bits is superset of spi_ps_input_ena. */
# 3532|->    unsigned spi_ps_input_ena = shader->config.spi_ps_input_ena;
# 3533|      unsigned spi_ps_input_addr = shader->config.spi_ps_input_addr;
# 3534|      assert((spi_ps_input_ena & spi_ps_input_addr) == spi_ps_input_ena);

Error: COMPILER_WARNING (CWE-563): [#def1682]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader.c: scope_hint: In function ‘si_shader_select_ps_parts’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader.c:3533:13: warning[-Wunused-variable]: unused variable ‘spi_ps_input_addr’
# 3533 |    unsigned spi_ps_input_addr = shader->config.spi_ps_input_addr;
#      |             ^~~~~~~~~~~~~~~~~
# 3531|      /* Make sure spi_ps_input_addr bits is superset of spi_ps_input_ena. */
# 3532|      unsigned spi_ps_input_ena = shader->config.spi_ps_input_ena;
# 3533|->    unsigned spi_ps_input_addr = shader->config.spi_ps_input_addr;
# 3534|      assert((spi_ps_input_ena & spi_ps_input_addr) == spi_ps_input_ena);
# 3535|   

Error: COMPILER_WARNING (CWE-563): [#def1683]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader_aco.c: scope_hint: In function ‘si_aco_resolve_symbols’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_shader_aco.c:184:31: warning[-Wunused-variable]: unused variable ‘key’
#  184 |    const union si_shader_key *key = &shader->key;
#      |                               ^~~
#  182|      const struct aco_symbol *symbols = (struct aco_symbol *)shader->binary.symbols;
#  183|      const struct si_shader_selector *sel = shader->selector;
#  184|->    const union si_shader_key *key = &shader->key;
#  185|   
#  186|      for (int i = 0; i < shader->binary.num_symbols; i++) {

Error: COMPILER_WARNING (CWE-563): [#def1684]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_state.c: scope_hint: In function ‘gfx11_dgpu_emit_framebuffer_state’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_state.c:3089:9: warning[-Wunused-variable]: unused variable ‘is_msaa_resolve’
# 3089 |    bool is_msaa_resolve = state->nr_cbufs == 2 &&
#      |         ^~~~~~~~~~~~~~~
# 3087|      struct si_texture *tex = NULL;
# 3088|      struct si_surface *cb = NULL;
# 3089|->    bool is_msaa_resolve = state->nr_cbufs == 2 &&
# 3090|                             state->cbufs[0] && state->cbufs[0]->texture->nr_samples > 1 &&
# 3091|                             state->cbufs[1] && state->cbufs[1]->texture->nr_samples <= 1;

Error: COMPILER_WARNING (CWE-563): [#def1685]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_state.c: scope_hint: In function ‘gfx12_emit_framebuffer_state’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_state.c:3238:9: warning[-Wunused-variable]: unused variable ‘is_msaa_resolve’
# 3238 |    bool is_msaa_resolve = state->nr_cbufs == 2 &&
#      |         ^~~~~~~~~~~~~~~
# 3236|      struct si_texture *tex = NULL;
# 3237|      struct si_surface *cb = NULL;
# 3238|->    bool is_msaa_resolve = state->nr_cbufs == 2 &&
# 3239|                             state->cbufs[0] && state->cbufs[0]->texture->nr_samples > 1 &&
# 3240|                             state->cbufs[1] && state->cbufs[1]->texture->nr_samples <= 1;

Error: COMPILER_WARNING (CWE-563): [#def1686]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_texture.c: scope_hint: In function ‘si_copy_multi_plane_texture’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_texture.c:77:23: warning[-Wunused-variable]: unused variable ‘dst_tex’
#   77 |    struct si_texture *dst_tex = (struct si_texture *)dst;
#      |                       ^~~~~~~
#   75|      unsigned i, dx, dy;
#   76|      struct si_texture *src_tex = (struct si_texture *)src;
#   77|->    struct si_texture *dst_tex = (struct si_texture *)dst;
#   78|      struct pipe_box sbox;
#   79|   

Error: COMPILER_WARNING (CWE-563): [#def1687]
mesa-25.1.0-rc2/src/gallium/frontends/clover/llvm/codegen/common.cpp: scope_hint: In function ‘llvm::Type* {anonymous}::ptr_arg_to_llvm_type(const llvm::Module&, std::string)’
mesa-25.1.0-rc2/src/gallium/frontends/clover/llvm/codegen/common.cpp:159:11: warning[-Wunused-variable]: unused variable ‘len’
#  159 |       int len = type_name.length();
#      |           ^~~
#  157|      ::llvm::Type *
#  158|      ptr_arg_to_llvm_type(const Module &mod, std::string type_name) {
#  159|->       int len = type_name.length();
#  160|         assert (type_name[len-1] == '*');
#  161|         ::llvm::Type *base_type = NULL;

Error: COMPILER_WARNING (CWE-563): [#def1688]
mesa-25.1.0-rc2/src/gallium/frontends/lavapipe/lvp_image.c: scope_hint: In function ‘lvp_image_create’
mesa-25.1.0-rc2/src/gallium/frontends/lavapipe/lvp_image.c:48:21: warning[-Wunused-variable]: unused variable ‘pipe_format’
#   48 |    enum pipe_format pipe_format = lvp_vk_format_to_pipe_format(pCreateInfo->format);
#      |                     ^~~~~~~~~~~
#   46|   #ifdef HAVE_LIBDRM
#   47|      unsigned num_layouts = 1;
#   48|->    enum pipe_format pipe_format = lvp_vk_format_to_pipe_format(pCreateInfo->format);
#   49|      const VkImageDrmFormatModifierExplicitCreateInfoEXT *modinfo = (void*)vk_find_struct_const(pCreateInfo->pNext,
#   50|                                                                     IMAGE_DRM_FORMAT_MODIFIER_EXPLICIT_CREATE_INFO_EXT);

Error: COMPILER_WARNING (CWE-563): [#def1689]
mesa-25.1.0-rc2/src/gallium/winsys/nouveau/drm/nouveau.c: scope_hint: In function ‘nouveau_object_channel_del’
mesa-25.1.0-rc2/src/gallium/winsys/nouveau/drm/nouveau.c:223:8: warning[-Wunused-variable]: unused variable ‘ret’
#  223 |    int ret = drmCommandWrite(drm->fd, DRM_NOUVEAU_CHANNEL_FREE, &req, sizeof(req));
#      |        ^~~
#  221|      };
#  222|   
#  223|->    int ret = drmCommandWrite(drm->fd, DRM_NOUVEAU_CHANNEL_FREE, &req, sizeof(req));
#  224|      assert(!ret);
#  225|   }

Error: CPPCHECK_WARNING (CWE-571): [#def1690]
mesa-25.1.0-rc2/src/glx/eval.c:22: error[pointerArithBool]: Converting pointer arithmetic result to bool. The bool is always true unless there is undefined behaviour.
#   20|      if (stride == k) {
#   21|         /* Just copy the data */
#   22|->       __GLX_PUT_FLOAT_ARRAY(0, points, order * k);
#   23|      }
#   24|      else {

Error: CPPCHECK_WARNING (CWE-571): [#def1691]
mesa-25.1.0-rc2/src/glx/eval.c:28: error[pointerArithBool]: Converting pointer arithmetic result to bool. The bool is always true unless there is undefined behaviour.
#   26|   
#   27|         for (i = 0; i < order; i++) {
#   28|->          __GLX_PUT_FLOAT_ARRAY(0, points, k);
#   29|            points += stride;
#   30|            pc += k * __GLX_SIZE_FLOAT32;

Error: CPPCHECK_WARNING (CWE-571): [#def1692]
mesa-25.1.0-rc2/src/glx/eval.c:41: error[pointerArithBool]: Converting pointer arithmetic result to bool. The bool is always true unless there is undefined behaviour.
#   39|      if (stride == k) {
#   40|         /* Just copy the data */
#   41|->       __GLX_PUT_DOUBLE_ARRAY(0, points, order * k);
#   42|      }
#   43|      else {

Error: CPPCHECK_WARNING (CWE-571): [#def1693]
mesa-25.1.0-rc2/src/glx/eval.c:46: error[pointerArithBool]: Converting pointer arithmetic result to bool. The bool is always true unless there is undefined behaviour.
#   44|         GLint i;
#   45|         for (i = 0; i < order; i++) {
#   46|->          __GLX_PUT_DOUBLE_ARRAY(0, points, k);
#   47|            points += stride;
#   48|            pc += k * __GLX_SIZE_FLOAT64;

Error: CPPCHECK_WARNING (CWE-476): [#def1694]
mesa-25.1.0-rc2/src/glx/glx_query.c:60: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: buf
#   58|      uint32_t len = xcb_glx_query_server_string_string_length(reply);
#   59|      char *buf = malloc(len);
#   60|->    memcpy(buf, xcb_glx_query_server_string_string(reply), len);
#   61|      free(reply);
#   62|   

Error: CPPCHECK_WARNING (CWE-476): [#def1695]
mesa-25.1.0-rc2/src/glx/glx_query.c:87: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: buf
#   85|      uint32_t len = xcb_glx_get_string_string_length(reply);
#   86|      char *buf = malloc(len);
#   87|->    memcpy(buf, xcb_glx_get_string_string(reply), len);
#   88|      free(reply);
#   89|   

Error: CPPCHECK_WARNING (CWE-457): [#def1696]
mesa-25.1.0-rc2/src/glx/glxglvnddispatchfuncs.h:33: warning[uninitvar]: Uninitialized variable: r
#   31|           }
#   32|       }
#   33|->     return r;
#   34|   }
#   35|   

Error: CPPCHECK_WARNING (CWE-562): [#def1697]
mesa-25.1.0-rc2/src/gtest/include/gtest/gtest-matchers.h:754: error[returnReference]: Reference to local variable returned.
#  752|     template <typename T>
#  753|     static const T& Unwrap(std::reference_wrapper<T> v) {
#  754|->     return v;
#  755|     }
#  756|   

Error: CPPCHECK_WARNING (CWE-664): [#def1698]
mesa-25.1.0-rc2/src/gtest/include/gtest/internal/gtest-param-util.h:155: error[mismatchingContainers]: Iterators of different containers 'impl_' and 'other.impl_' are used together.
#  153|     }
#  154|     bool operator==(const ParamIterator& other) const {
#  155|->     return impl_.get() == other.impl_.get() || impl_->Equals(*other.impl_);
#  156|     }
#  157|     bool operator!=(const ParamIterator& other) const {

Error: COMPILER_WARNING (CWE-563): [#def1699]
mesa-25.1.0-rc2/src/imagination/pco/pco_ra.c: scope_hint: In function ‘pco_ra_func’
mesa-25.1.0-rc2/src/imagination/pco/pco_ra.c:231:9: warning[-Wunused-variable]: unused variable ‘allocated’
#  231 |    bool allocated = ra_allocate(ra_graph);
#      |         ^~~~~~~~~
#  229|      }
#  230|   
#  231|->    bool allocated = ra_allocate(ra_graph);
#  232|      assert(allocated);
#  233|      /* TODO: spilling. */

Error: COMPILER_WARNING (CWE-563): [#def1700]
mesa-25.1.0-rc2/src/imagination/pco/pco_trans_nir.c: scope_hint: In function ‘trans_load_input_fs’
mesa-25.1.0-rc2/src/imagination/pco/pco_trans_nir.c:262:18: warning[-Wunused-variable]: unused variable ‘offset’
#  262 |    const nir_src offset = intr->src[0];
#      |                  ^~~~~~
#  260|      unsigned chans = pco_ref_get_chans(dest);
#  261|   
#  262|->    const nir_src offset = intr->src[0];
#  263|      assert(nir_src_as_uint(offset) == 0);
#  264|   

Error: COMPILER_WARNING (CWE-563): [#def1701]
mesa-25.1.0-rc2/src/imagination/vulkan/pds/pvr_pipeline_pds.c:1584:28: warning[-Wunused-variable]: unused variable ‘current_addr_literal_destination’
# 1584 |             const uint32_t current_addr_literal_destination =
#      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 1582|             */
# 1583|            if (i > 0) {
# 1584|->             const uint32_t current_addr_literal_destination =
# 1585|                  input_program->addr_literals[i].destination;
# 1586|               const uint32_t previous_addr_literal_destination =

Error: COMPILER_WARNING (CWE-563): [#def1702]
mesa-25.1.0-rc2/src/imagination/vulkan/pds/pvr_pipeline_pds.c: scope_hint: In function ‘pvr_pds_generate_descriptor_upload_program’
mesa-25.1.0-rc2/src/imagination/vulkan/pds/pvr_pipeline_pds.c:1586:28: warning[-Wunused-variable]: unused variable ‘previous_addr_literal_destination’
# 1586 |             const uint32_t previous_addr_literal_destination =
#      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 1584|               const uint32_t current_addr_literal_destination =
# 1585|                  input_program->addr_literals[i].destination;
# 1586|->             const uint32_t previous_addr_literal_destination =
# 1587|                  input_program->addr_literals[i - 1].destination;
# 1588|   

Error: COMPILER_WARNING (CWE-563): [#def1703]
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_cmd_buffer.c: scope_hint: In function ‘pvr_CmdSetViewport’
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_cmd_buffer.c:2572:19: warning[-Wunused-variable]: unused variable ‘total_count’
# 2572 |    const uint32_t total_count = firstViewport + viewportCount;
#      |                   ^~~~~~~~~~~
# 2570|   {
# 2571|      PVR_FROM_HANDLE(pvr_cmd_buffer, cmd_buffer, commandBuffer);
# 2572|->    const uint32_t total_count = firstViewport + viewportCount;
# 2573|   
# 2574|      assert(firstViewport < PVR_MAX_VIEWPORTS && viewportCount > 0);

Error: COMPILER_WARNING (CWE-563): [#def1704]
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_cmd_buffer.c: scope_hint: In function ‘pvr_compute_flat_pad_workgroup_size’
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_cmd_buffer.c:4410:34: warning[-Wunused-variable]: unused variable ‘dev_info’
# 4410 |    const struct pvr_device_info *dev_info = &pdevice->dev_info;
#      |                                  ^~~~~~~~
# 4408|      const struct pvr_device_runtime_info *dev_runtime_info =
# 4409|         &pdevice->dev_runtime_info;
# 4410|->    const struct pvr_device_info *dev_info = &pdevice->dev_info;
# 4411|      uint32_t max_avail_coeff_regs =
# 4412|         dev_runtime_info->cdm_max_local_mem_size_regs;

Error: COMPILER_WARNING (CWE-563): [#def1705]
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_job_context.c: scope_hint: In function ‘pvr_pds_sr_fence_terminate_program_create_and_upload’
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_job_context.c:932:42: warning[-Wunused-variable]: unused variable ‘dev_runtime_info’
#  932 |    const struct pvr_device_runtime_info *dev_runtime_info =
#      |                                          ^~~~~~~~~~~~~~~~
#  930|      const uint32_t pds_data_alignment =
#  931|         ROGUE_VDMCTRL_PDS_STATE0_PDS_DATA_SIZE_UNIT_SIZE / 4U;
#  932|->    const struct pvr_device_runtime_info *dev_runtime_info =
#  933|         &device->pdevice->dev_runtime_info;
#  934|      ASSERTED const struct pvr_device_info *dev_info = &device->pdevice->dev_info;

Error: COMPILER_WARNING (CWE-563): [#def1706]
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_job_transfer.c: scope_hint: In function ‘pvr_isp_primitive_block’
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_job_transfer.c:3734:13: warning[-Wunused-but-set-variable]: variable ‘stream_size_in_bytes’ set but not used
# 3734 |    uint32_t stream_size_in_bytes;
#      |             ^~~~~~~~~~~~~~~~~~~~
# 3732|      uint32_t tsp_comp_format_in_dw;
# 3733|      bool color_fill = src == NULL;
# 3734|->    uint32_t stream_size_in_bytes;
# 3735|      uint32_t *cs_ptr_start;
# 3736|      VkResult result;

Error: COMPILER_WARNING (CWE-563): [#def1707]
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_job_transfer.c: scope_hint: In function ‘pvr_get_custom_mapping’
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_job_transfer.c:5153:13: warning[-Wunused-variable]: unused variable ‘rect’
# 5153 |    VkRect2D rect = transfer_cmd->scissor;
#      |             ^~~~
# 5151|      }
# 5152|   
# 5153|->    VkRect2D rect = transfer_cmd->scissor;
# 5154|      assert(
# 5155|         (rect.offset.x + rect.extent.width) <= custom_mapping->max_clip_size &&

Error: COMPILER_WARNING (CWE-563): [#def1708]
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_pipeline.c: scope_hint: In function ‘pvr_alloc_fs_varyings’
mesa-25.1.0-rc2/src/imagination/vulkan/pvr_pipeline.c:1888:16: warning[-Wunused-variable]: unused variable ‘count’
# 1888 |       unsigned count = glsl_get_components(var->type);
#      |                ^~~~~
# 1886|      if (var) {
# 1887|         assert(!var->data.location_frac);
# 1888|->       unsigned count = glsl_get_components(var->type);
# 1889|         assert(count == 2);
# 1890|   

Error: COMPILER_WARNING (CWE-563): [#def1709]
mesa-25.1.0-rc2/src/intel/blorp/blorp_blit.c: scope_hint: In function ‘blorp_copy_get_formats’
mesa-25.1.0-rc2/src/intel/blorp/blorp_blit.c:2879:36: warning[-Wunused-variable]: unused variable ‘src_fmtl’
# 2879 |    const struct isl_format_layout *src_fmtl =
#      |                                    ^~~~~~~~
# 2877|                          enum isl_format *dst_view_format)
# 2878|   {
# 2879|->    const struct isl_format_layout *src_fmtl =
# 2880|         isl_format_get_layout(src_surf->format);
# 2881|      const struct isl_format_layout *dst_fmtl =

Error: COMPILER_WARNING (CWE-563): [#def1710]
mesa-25.1.0-rc2/src/intel/blorp/blorp_clear.c: scope_hint: In function ‘convert_rt_from_3d_to_2d’
mesa-25.1.0-rc2/src/intel/blorp/blorp_clear.c:420:9: warning[-Wunused-variable]: unused variable ‘ok’
#  420 |    bool ok = isl_surf_init(isl_dev, &info->surf,
#      |         ^~
#  418|      uint32_t array_pitch_el_rows = info->surf.array_pitch_el_rows;
#  419|      uint64_t size_B = info->surf.size_B;
#  420|->    bool ok = isl_surf_init(isl_dev, &info->surf,
#  421|                              .dim = ISL_SURF_DIM_2D,
#  422|                              .format = info->surf.format,

Error: COMPILER_WARNING (CWE-563): [#def1711]
mesa-25.1.0-rc2/src/intel/compiler/brw_compile_mesh.cpp: scope_hint: In function ‘void brw_compute_mue_layout(const brw_compiler*, std::__cxx11::list<attr_desc>*, uint64_t, nir_shader*, bool*, bool*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_compile_mesh.cpp:735:12: warning[-Wunused-but-set-variable]: variable ‘inserted_back’ set but not used
#  735 |       bool inserted_back = false;
#      |            ^~~~~~~~~~~~~
#  733|         holes[found].pop_back();
#  734|   
#  735|->       bool inserted_back = false;
#  736|   
#  737|         for (auto it = order->begin(); it != order->end(); ++it) {

Error: COMPILER_WARNING (CWE-563): [#def1712]
mesa-25.1.0-rc2/src/intel/compiler/brw_eu_compact.c: scope_hint: In function ‘brw_compact_instructions’
mesa-25.1.0-rc2/src/intel/compiler/brw_eu_compact.c:2370:19: warning[-Wunused-variable]: unused variable ‘saved’
# 2370 |       brw_eu_inst saved = inst;
#      |                   ^~~~~
# 2368|   
# 2369|         brw_eu_inst inst = precompact(p->isa, *src);
# 2370|->       brw_eu_inst saved = inst;
# 2371|   
# 2372|         if (try_compact_instruction(&c, dst, &inst)) {

Error: COMPILER_WARNING (CWE-563): [#def1713]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘brw_reg emit_work_group_id_setup(nir_to_brw_state&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:174:16: warning[-Wunused-variable]: unused variable ‘s’
#  174 |    brw_shader &s = ntb.s;
#      |                ^
#  172|   emit_work_group_id_setup(nir_to_brw_state &ntb)
#  173|   {
#  174|->    brw_shader &s = ntb.s;
#  175|      const brw_builder &bld = ntb.bld.scalar_group();
#  176|   

Error: COMPILER_WARNING (CWE-563): [#def1714]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:2148:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’
# 2148 |    const struct brw_wm_prog_data *wm_prog_data =
#      |                                   ^~~~~~~~~~~~
# 2146|   
# 2147|      const brw_fs_thread_payload &payload = shader->fs_payload();
# 2148|->    const struct brw_wm_prog_data *wm_prog_data =
# 2149|         brw_wm_prog_data(shader->prog_data);
# 2150|   

Error: COMPILER_WARNING (CWE-563): [#def1715]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:2278:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’
# 2278 |    const struct brw_wm_prog_data *wm_prog_data =
#      |                                   ^~~~~~~~~~~~
# 2276|   {
# 2277|      const brw_fs_thread_payload &payload = bld.shader->fs_payload();
# 2278|->    const struct brw_wm_prog_data *wm_prog_data =
# 2279|         brw_wm_prog_data(bld.shader->prog_data);
# 2280|      const brw_builder ubld = bld.exec_all().group(16, 0);

Error: COMPILER_WARNING (CWE-563): [#def1716]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void brw_from_nir_emit_vs_intrinsic(nir_to_brw_state&, nir_intrinsic_instr*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:2869:16: warning[-Wunused-variable]: unused variable ‘s’
# 2869 |    brw_shader &s = ntb.s;
#      |                ^
# 2867|   {
# 2868|      const brw_builder &bld = ntb.bld;
# 2869|->    brw_shader &s = ntb.s;
# 2870|      assert(s.stage == MESA_SHADER_VERTEX);
# 2871|   

Error: COMPILER_WARNING (CWE-563): [#def1717]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void emit_barrier(nir_to_brw_state&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:3031:16: warning[-Wunused-variable]: unused variable ‘s’
# 3031 |    brw_shader &s = ntb.s;
#      |                ^
# 3029|      const brw_builder ubld = bld.exec_all();
# 3030|      const brw_builder hbld = ubld.group(8 * reg_unit(devinfo), 0);
# 3031|->    brw_shader &s = ntb.s;
# 3032|   
# 3033|      /* We are getting the barrier ID from the compute shader header */

Error: COMPILER_WARNING (CWE-563): [#def1718]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘brw_reg emit_shading_rate_setup(nir_to_brw_state&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:4074:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 4074 |    const intel_device_info *devinfo = ntb.devinfo;
#      |                             ^~~~~~~
# 4072|   emit_shading_rate_setup(nir_to_brw_state &ntb)
# 4073|   {
# 4074|->    const intel_device_info *devinfo = ntb.devinfo;
# 4075|      const brw_builder &bld = ntb.bld;
# 4076|   

Error: COMPILER_WARNING (CWE-563): [#def1719]
mesa-25.1.0-rc2/src/intel/compiler/brw_lower.cpp: scope_hint: In function ‘bool brw_lower_send_gather_inst(brw_shader&, brw_inst*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_lower.cpp:798:19: warning[-Wunused-variable]: unused variable ‘num_payload_sources’
#  798 |    const unsigned num_payload_sources = inst->sources - 3;
#      |                   ^~~~~~~~~~~~~~~~~~~
#  796|      uint8_t regs[16] = {};
#  797|   
#  798|->    const unsigned num_payload_sources = inst->sources - 3;
#  799|      assert(num_payload_sources > 0);
#  800|   

Error: COMPILER_WARNING (CWE-563): [#def1720]
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_logical_sends.cpp: scope_hint: In function ‘void lower_lsc_memory_fence_and_interlock(const brw_builder&, brw_inst*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_logical_sends.cpp:2441:15: warning[-Wunused-variable]: unused variable ‘commit_enable’
# 2441 |    const bool commit_enable = inst->src[1].ud;
#      |               ^~~~~~~~~~~~~
# 2439|   
# 2440|      assert(inst->src[1].file == IMM);
# 2441|->    const bool commit_enable = inst->src[1].ud;
# 2442|      assert(commit_enable); /* always used */
# 2443|   

Error: COMPILER_WARNING (CWE-563): [#def1721]
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_regioning.cpp: scope_hint: In function ‘void {anonymous}::lower_src_conversion(brw_shader*, brw_inst*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_regioning.cpp:734:32: warning[-Wunused-variable]: unused variable ‘devinfo’
#  734 |       const intel_device_info *devinfo = v->devinfo;
#      |                                ^~~~~~~
#  732|      lower_src_conversion(brw_shader *v, brw_inst *inst)
#  733|      {
#  734|->       const intel_device_info *devinfo = v->devinfo;
#  735|         const brw_builder ibld = brw_builder(inst).scalar_group();
#  736|   

Error: COMPILER_WARNING (CWE-563): [#def1722]
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_regioning.cpp:741:17: warning[-Wunused-variable]: unused variable ‘mov’
#  741 |       brw_inst *mov = ibld.MOV(tmp, inst->src[0]);
#      |                 ^~~
#  739|   
#  740|         brw_reg tmp = ibld.vgrf(brw_type_with_size(inst->src[0].type, 32));
#  741|->       brw_inst *mov = ibld.MOV(tmp, inst->src[0]);
#  742|   
#  743|         inst->src[0] = component(tmp, 0);

Error: COMPILER_WARNING (CWE-563): [#def1723]
mesa-25.1.0-rc2/src/intel/compiler/brw_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_unary_op’
mesa-25.1.0-rc2/src/intel/compiler/brw_nir_lower_cooperative_matrix.c:418:19: warning[-Wunused-variable]: unused variable ‘src_packing_factor’
#  418 |    const unsigned src_packing_factor =
#      |                   ^~~~~~~~~~~~~~~~~~
#  416|         get_packing_factor(dst_desc, dst_slice->type);
#  417|   
#  418|->    const unsigned src_packing_factor =
#  419|         get_packing_factor(src_desc, src_slice->type);
#  420|   

Error: COMPILER_WARNING (CWE-563): [#def1724]
mesa-25.1.0-rc2/src/intel/compiler/brw_nir_lower_ray_queries.c: scope_hint: In function ‘register_opaque_var’
mesa-25.1.0-rc2/src/intel/compiler/brw_nir_lower_ray_queries.c:67:23: warning[-Wunused-variable]: unused variable ‘entry’
#   67 |    struct hash_entry *entry = _mesa_hash_table_search(state->queries, opaque_var);
#      |                       ^~~~~
#   65|   register_opaque_var(nir_variable *opaque_var, struct lowering_state *state)
#   66|   {
#   67|->    struct hash_entry *entry = _mesa_hash_table_search(state->queries, opaque_var);
#   68|      assert(entry == NULL);
#   69|   

Error: COMPILER_WARNING (CWE-563): [#def1725]
mesa-25.1.0-rc2/src/intel/compiler/brw_opt_cse.cpp: scope_hint: In function ‘bool brw_opt_cse_defs(brw_shader&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_opt_cse.cpp:467:21: warning[-Wunused-variable]: unused variable ‘ops_must_match’
#  467 |                bool ops_must_match = operands_match(inst, match, &negate);
#      |                     ^~~~~~~~~~~~~~
#  465|                   inst->dst.type == BRW_TYPE_F) {
#  466|                  /* Determine whether inst is actually negate(match) */
#  467|->                bool ops_must_match = operands_match(inst, match, &negate);
#  468|                  assert(ops_must_match);
#  469|               }

Error: COMPILER_WARNING (CWE-563): [#def1726]
mesa-25.1.0-rc2/src/intel/compiler/brw_workaround.cpp: scope_hint: In function ‘bool brw_workaround_source_arf_before_eot(brw_shader&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_workaround.cpp:343:11: warning[-Wunused-variable]: unused variable ‘eot_count’
#  343 |       int eot_count = 0;
#      |           ^~~~~~~~~
#  341|   
#  342|      if (flags_unread) {
#  343|->       int eot_count = 0;
#  344|   
#  345|         foreach_block_and_inst_safe(block, brw_inst, inst, s.cfg)

Error: COMPILER_WARNING: [#def1727]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:647:23: warning[-Wunused-const-variable=]: ‘gfx11_datatype_table’ defined but not used
#  647 | static const uint32_t gfx11_datatype_table[32] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~
#  645|   };
#  646|   
#  647|-> static const uint32_t gfx11_datatype_table[32] = {
#  648|      0b001000000000000000001,
#  649|      0b001000000000001000000,

Error: COMPILER_WARNING: [#def1728]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:682:23: warning[-Wunused-const-variable=]: ‘gfx12_control_index_table’ defined but not used
#  682 | static const uint32_t gfx12_control_index_table[32] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~~~~~~
#  680|   };
#  681|   
#  682|-> static const uint32_t gfx12_control_index_table[32] = {
#  683|      0b000000000000000000100, /* 	       (16|M0)                            */
#  684|      0b000000000000000000011, /* 	       (8|M0)                             */

Error: COMPILER_WARNING: [#def1729]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:717:23: warning[-Wunused-const-variable=]: ‘gfx12_datatype_table’ defined but not used
#  717 | static const uint32_t gfx12_datatype_table[32] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~
#  715|   };
#  716|   
#  717|-> static const uint32_t gfx12_datatype_table[32] = {
#  718|      0b11010110100101010100, /* grf<1>:f  grf:f  grf:f  */
#  719|      0b00000110100101010100, /* grf<1>:f  grf:f  arf:ub */

Error: COMPILER_WARNING: [#def1730]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:752:23: warning[-Wunused-const-variable=]: ‘gfx12_subreg_table’ defined but not used
#  752 | static const uint16_t gfx12_subreg_table[32] = {
#      |                       ^~~~~~~~~~~~~~~~~~
#  750|   };
#  751|   
#  752|-> static const uint16_t gfx12_subreg_table[32] = {
#  753|      0b000000000000000, /* .0  .0  .0  */
#  754|      0b100000000000000, /* .0  .0  .16 */

Error: COMPILER_WARNING: [#def1731]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:787:23: warning[-Wunused-const-variable=]: ‘gfx12_src0_index_table’ defined but not used
#  787 | static const uint16_t gfx12_src0_index_table[16] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~~~
#  785|   };
#  786|   
#  787|-> static const uint16_t gfx12_src0_index_table[16] = {
#  788|      0b010001100100, /*       r<8;8,1>  */
#  789|      0b000000000000, /*       r<0;1,0>  */

Error: COMPILER_WARNING: [#def1732]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:806:23: warning[-Wunused-const-variable=]: ‘gfx12_src1_index_table’ defined but not used
#  806 | static const uint16_t gfx12_src1_index_table[16] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~~~
#  804|   };
#  805|   
#  806|-> static const uint16_t gfx12_src1_index_table[16] = {
#  807|      0b000100011001, /*       r<8;8,1> */
#  808|      0b000000000000, /*       r<0;1,0> */

Error: COMPILER_WARNING: [#def1733]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:825:23: warning[-Wunused-const-variable=]: ‘xehp_src0_index_table’ defined but not used
#  825 | static const uint16_t xehp_src0_index_table[16] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~~
#  823|   };
#  824|   
#  825|-> static const uint16_t xehp_src0_index_table[16] = {
#  826|      0b000100000000, /*       r<1;1,0>  */
#  827|      0b000000000000, /*       r<0;1,0>  */

Error: COMPILER_WARNING: [#def1734]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:844:23: warning[-Wunused-const-variable=]: ‘xehp_src1_index_table’ defined but not used
#  844 | static const uint16_t xehp_src1_index_table[16] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~~
#  842|   };
#  843|   
#  844|-> static const uint16_t xehp_src1_index_table[16] = {
#  845|      0b000001000000, /*       r<1;1,0>    */
#  846|      0b000000000000, /*       r<0;1,0>    */

Error: COMPILER_WARNING: [#def1735]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:863:23: warning[-Wunused-const-variable=]: ‘xe2_control_index_table’ defined but not used
#  863 | static const uint32_t xe2_control_index_table[32] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~~~~
#  861|   };
#  862|   
#  863|-> static const uint32_t xe2_control_index_table[32] = {
#  864|      0b000000000000000100, /* (16|M0)               */
#  865|      0b000000100000000000, /* (W) (1|M0)            */

Error: COMPILER_WARNING: [#def1736]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:898:23: warning[-Wunused-const-variable=]: ‘xe2_datatype_table’ defined but not used
#  898 | static const uint32_t xe2_datatype_table[32] = {
#      |                       ^~~~~~~~~~~~~~~~~~
#  896|   };
#  897|   
#  898|-> static const uint32_t xe2_datatype_table[32] = {
#  899|      0b11010110100101010100, /* grf<1>:f grf:f grf:f    */
#  900|      0b11010100100101010100, /* arf<1>:f grf:f grf:f    */

Error: COMPILER_WARNING: [#def1737]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:933:23: warning[-Wunused-const-variable=]: ‘xe2_subreg_table’ defined but not used
#  933 | static const uint16_t xe2_subreg_table[16] = {
#      |                       ^~~~~~~~~~~~~~~~
#  931|   };
#  932|   
#  933|-> static const uint16_t xe2_subreg_table[16] = {
#  934|      0b000000000000, /* .0 .0  */
#  935|      0b000010000000, /* .0 .4  */

Error: COMPILER_WARNING: [#def1738]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:952:23: warning[-Wunused-const-variable=]: ‘xe2_src0_index_table’ defined but not used
#  952 | static const uint16_t xe2_src0_index_table[8] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~
#  950|   };
#  951|   
#  952|-> static const uint16_t xe2_src0_index_table[8] = {
#  953|      0b00100000000, /* r<1;1,0>      */
#  954|      0b00000000000, /* r<0;1,0>      */

Error: COMPILER_WARNING: [#def1739]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_eu_compact.c:963:23: warning[-Wunused-const-variable=]: ‘xe2_src1_index_table’ defined but not used
#  963 | static const uint16_t xe2_src1_index_table[16] = {
#      |                       ^~~~~~~~~~~~~~~~~~~~
#  961|   };
#  962|   
#  963|-> static const uint16_t xe2_src1_index_table[16] = {
#  964|      0b0000100000000000, /* r<1;1,0>.0  */
#  965|      0b0000000000000000, /* r<0;1,0>.0  */

Error: COMPILER_WARNING (CWE-563): [#def1740]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘elk_fs_reg emit_work_group_id_setup(nir_to_elk_state&)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:163:20: warning[-Wunused-variable]: unused variable ‘s’
#  163 |    elk_fs_visitor &s = ntb.s;
#      |                    ^
#  161|   emit_work_group_id_setup(nir_to_elk_state &ntb)
#  162|   {
#  163|->    elk_fs_visitor &s = ntb.s;
#  164|      const fs_builder &bld = ntb.bld;
#  165|   

Error: COMPILER_WARNING (CWE-563): [#def1741]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘void fs_nir_emit_vs_intrinsic(nir_to_elk_state&, nir_intrinsic_instr*)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:2545:20: warning[-Wunused-variable]: unused variable ‘s’
# 2545 |    elk_fs_visitor &s = ntb.s;
#      |                    ^
# 2543|   {
# 2544|      const fs_builder &bld = ntb.bld;
# 2545|->    elk_fs_visitor &s = ntb.s;
# 2546|      assert(s.stage == MESA_SHADER_VERTEX);
# 2547|   

Error: COMPILER_WARNING (CWE-563): [#def1742]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘elk_fs_reg emit_samplepos_setup(nir_to_elk_state&)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:3424:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 3424 |    const intel_device_info *devinfo = ntb.devinfo;
#      |                             ^~~~~~~
# 3422|   emit_samplepos_setup(nir_to_elk_state &ntb)
# 3423|   {
# 3424|->    const intel_device_info *devinfo = ntb.devinfo;
# 3425|      const fs_builder &bld = ntb.bld;
# 3426|      elk_fs_visitor &s = ntb.s;

Error: COMPILER_WARNING (CWE-563): [#def1743]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘elk_fs_reg emit_samplemaskin_setup(nir_to_elk_state&)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:3604:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 3604 |    const intel_device_info *devinfo = ntb.devinfo;
#      |                             ^~~~~~~
# 3602|   emit_samplemaskin_setup(nir_to_elk_state &ntb)
# 3603|   {
# 3604|->    const intel_device_info *devinfo = ntb.devinfo;
# 3605|      const fs_builder &bld = ntb.bld;
# 3606|      elk_fs_visitor &s = ntb.s;

Error: COMPILER_WARNING (CWE-563): [#def1744]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘void fs_nir_emit_cs_intrinsic(nir_to_elk_state&, nir_intrinsic_instr*)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:4019:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 4019 |    const intel_device_info *devinfo = ntb.devinfo;
#      |                             ^~~~~~~
# 4017|                            nir_intrinsic_instr *instr)
# 4018|   {
# 4019|->    const intel_device_info *devinfo = ntb.devinfo;
# 4020|      const fs_builder &bld = ntb.bld;
# 4021|      elk_fs_visitor &s = ntb.s;

Error: COMPILER_WARNING (CWE-563): [#def1745]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘elk_fs_reg get_timestamp(const elk::fs_builder&)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:4584:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 4584 |    const intel_device_info *devinfo = s.devinfo;
#      |                             ^~~~~~~
# 4582|   {
# 4583|      elk_fs_visitor &s = *bld.shader;
# 4584|->    const intel_device_info *devinfo = s.devinfo;
# 4585|   
# 4586|      assert(devinfo->ver >= 7);

Error: COMPILER_WARNING (CWE-563): [#def1746]
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp: scope_hint: In function ‘void fs_nir_emit_surface_atomic(nir_to_elk_state&, const elk::fs_builder&, nir_intrinsic_instr*, elk_fs_reg, bool)’
mesa-25.1.0-rc2/src/intel/compiler/elk/elk_fs_nir.cpp:6233:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 6233 |    const intel_device_info *devinfo = ntb.devinfo;
#      |                             ^~~~~~~
# 6231|                              bool bindless)
# 6232|   {
# 6233|->    const intel_device_info *devinfo = ntb.devinfo;
# 6234|      elk_fs_visitor &s = ntb.s;
# 6235|   

Error: COMPILER_WARNING (CWE-563): [#def1747]
mesa-25.1.0-rc2/src/intel/isl/isl_tiled_memcpy_normal.c:33: included_from: Included from here.
mesa-25.1.0-rc2/src/intel/isl/isl_tiled_memcpy.c: scope_hint: In function ‘linear_to_tile4’
mesa-25.1.0-rc2/src/intel/isl/isl_tiled_memcpy.c:669:19: warning[-Wunused-variable]: unused variable ‘tile4_blkh’
#  669 |    const uint32_t tile4_blkh = 4;
#      |                   ^~~~~~~~~~
#  667|       */
#  668|      const uint32_t column_width = ytile_span;
#  669|->    const uint32_t tile4_blkh = 4;
#  670|   
#  671|      assert(ytile_span * tile4_blkh == 64);

Error: COMPILER_WARNING (CWE-563): [#def1748]
mesa-25.1.0-rc2/src/intel/isl/isl_tiled_memcpy.c: scope_hint: In function ‘tile4_to_linear’
mesa-25.1.0-rc2/src/intel/isl/isl_tiled_memcpy.c:1089:19: warning[-Wunused-variable]: unused variable ‘tile4_blkh’
# 1089 |    const uint32_t tile4_blkh = 4;
#      |                   ^~~~~~~~~~
# 1087|   
# 1088|      const uint32_t column_width = ytile_span;
# 1089|->    const uint32_t tile4_blkh = 4;
# 1090|   
# 1091|      assert(ytile_span * tile4_blkh == 64);

Error: COMPILER_WARNING (CWE-563): [#def1749]
mesa-25.1.0-rc2/src/intel/perf/intel_perf.c: scope_hint: In function ‘get_passes_mask’
mesa-25.1.0-rc2/src/intel/perf/intel_perf.c:882:12: warning[-Wunused-but-set-variable]: variable ‘found’ set but not used
#  882 |       bool found = false;
#      |            ^~~~~
#  880|          * counter.
#  881|          */
#  882|->       bool found = false;
#  883|         for (uint32_t w = 0; w < BITSET_WORDS(INTEL_PERF_MAX_METRIC_SETS); w++) {
#  884|            if (!counter_info->query_mask[w])

Error: COMPILER_WARNING (CWE-563): [#def1750]
mesa-25.1.0-rc2/src/intel/perf/xe/intel_perf.c: scope_hint: In function ‘xe_perf_stream_set_metrics_id’
mesa-25.1.0-rc2/src/intel/perf/xe/intel_perf.c:269:11: warning[-Wunused-but-set-variable]: variable ‘ret2’ set but not used
#  269 |       int ret2;
#      |           ^~~~
#  267|         struct drm_xe_sync xe_syncs[3] = {};
#  268|         uint32_t syncobj;
#  269|->       int ret2;
#  270|   
#  271|         oa_prop_set(prop, &index, DRM_XE_OA_PROPERTY_NUM_SYNCS, ARRAY_SIZE(xe_syncs));

Error: COMPILER_WARNING (CWE-563): [#def1751]
mesa-25.1.0-rc2/src/intel/vulkan/anv_descriptor_set.c: scope_hint: In function ‘anv_push_descriptor_set_init’
mesa-25.1.0-rc2/src/intel/vulkan/anv_descriptor_set.c:2074:35: warning[-Wunused-variable]: unused variable ‘pdevice’
# 2074 |       struct anv_physical_device *pdevice = cmd_buffer->device->physical;
#      |                                   ^~~~~~~
# 2072|          (push_set->set_used_on_gpu ||
# 2073|           set->desc_sampler_mem.alloc_size < layout->descriptor_buffer_sampler_size)) {
# 2074|->       struct anv_physical_device *pdevice = cmd_buffer->device->physical;
# 2075|         assert(!pdevice->indirect_descriptors);
# 2076|         struct anv_state_stream *push_stream = &cmd_buffer->dynamic_state_stream;

Error: COMPILER_WARNING (CWE-563): [#def1752]
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c: scope_hint: In function ‘add_aux_surface_if_supported’
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c:715:23: warning[-Wunused-variable]: unused variable ‘aspect’
#  715 |    VkImageAspectFlags aspect = plane_format.aspect;
#      |                       ^~~~~~
#  713|                                uint64_t aux_state_offset)
#  714|   {
#  715|->    VkImageAspectFlags aspect = plane_format.aspect;
#  716|      VkResult result;
#  717|      bool ok;

Error: COMPILER_WARNING (CWE-563): [#def1753]
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c: scope_hint: In function ‘add_all_surfaces_explicit_layout’
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c:1327:16: warning[-Wunused-variable]: unused variable ‘n_mod_planes’
# 1327 |       uint32_t n_mod_planes =
#      |                ^~~~~~~~~~~~
# 1325|          * Most validation of plane layout occurs in add_surface().
# 1326|          */
# 1327|->       uint32_t n_mod_planes =
# 1328|            isl_drm_modifier_get_plane_count(devinfo,
# 1329|                                             drm_info->drmFormatModifier,

Error: COMPILER_WARNING (CWE-563): [#def1754]
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c: scope_hint: In function ‘anv_get_image_subresource_layout’
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c:2961:15: warning[-Wunused-variable]: unused variable ‘ok’
# 2961 |          bool ok =
#      |               ^~
# 2959|             */
# 2960|            struct isl_surf lin_surf;
# 2961|->          bool ok =
# 2962|               isl_surf_init(&device->physical->isl_dev, &lin_surf,
# 2963|                             .dim          = isl_surf->dim,

Error: COMPILER_WARNING (CWE-563): [#def1755]
mesa-25.1.0-rc2/src/intel/vulkan/anv_queue.c: scope_hint: In function ‘anv_queue_init’
mesa-25.1.0-rc2/src/intel/vulkan/anv_queue.c:72:32: warning[-Wunused-variable]: unused variable ‘pdevice’
#   72 |    struct anv_physical_device *pdevice = device->physical;
#      |                                ^~~~~~~
#   70|                  uint32_t index_in_family)
#   71|   {
#   72|->    struct anv_physical_device *pdevice = device->physical;
#   73|      assert(queue->vk.queue_family_index < pdevice->queue.family_count);
#   74|      struct anv_queue_family *queue_family =

Error: COMPILER_WARNING (CWE-563): [#def1756]
mesa-25.1.0-rc2/src/intel/vulkan/genX_blorp_exec.c: scope_hint: In function ‘blorp_exec_on_blitter’
mesa-25.1.0-rc2/src/intel/vulkan/genX_blorp_exec.c:467:27: warning[-Wunused-variable]: unused variable ‘cmd_buffer’
#  467 |    struct anv_cmd_buffer *cmd_buffer = batch->driver_batch;
#      |                           ^~~~~~~~~~
#  465|      assert(batch->flags & BLORP_BATCH_USE_BLITTER);
#  466|   
#  467|->    struct anv_cmd_buffer *cmd_buffer = batch->driver_batch;
#  468|      assert(anv_cmd_buffer_is_blitter_queue(cmd_buffer));
#  469|   

Error: COMPILER_WARNING (CWE-563): [#def1757]
mesa-25.1.0-rc2/src/intel/vulkan/genX_cmd_buffer.c: scope_hint: In function ‘add_pending_pipe_bits_for_color_aux_op’
mesa-25.1.0-rc2/src/intel/vulkan/genX_cmd_buffer.c:2885:11: warning[-Wunused-variable]: unused variable ‘ret’
# 2885 |       int ret = snprintf(flush_reason, sizeof(flush_reason),
#      |           ^~~
# 2883|      if (INTEL_DEBUG(DEBUG_PIPE_CONTROL) ||
# 2884|          u_trace_enabled(&cmd_buffer->device->ds.trace_context)) {
# 2885|->       int ret = snprintf(flush_reason, sizeof(flush_reason),
# 2886|                            "color aux-op: %s -> %s",
# 2887|                            isl_aux_op_to_name(last_aux_op),

Error: COMPILER_WARNING (CWE-563): [#def1758]
mesa-25.1.0-rc2/src/intel/vulkan/genX_simple_shader.c: scope_hint: In function ‘gfx125_emit_simpler_shader_init_compute’
mesa-25.1.0-rc2/src/intel/vulkan/genX_simple_shader.c:396:35: warning[-Wunused-variable]: unused variable ‘prog_data’
#  396 |    const struct brw_cs_prog_data *prog_data =
#      |                                   ^~~~~~~~~
#  394|   #if GFX_VERx10 >= 125
#  395|      struct anv_shader_bin *cs_bin = state->kernel;
#  396|->    const struct brw_cs_prog_data *prog_data =
#  397|         (const struct brw_cs_prog_data *) cs_bin->prog_data;
#  398|      /* Currently our simple shaders are simple enough that they never spill. */

Error: COMPILER_WARNING (CWE-563): [#def1759]
mesa-25.1.0-rc2/src/intel/vulkan/i915/anv_batch_chain.c: scope_hint: In function ‘i915_queue_exec_locked’
mesa-25.1.0-rc2/src/intel/vulkan/i915/anv_batch_chain.c:981:30: warning[-Wunused-variable]: unused variable ‘companion_rcs_cmd_buffer’
#  981 |       struct anv_cmd_buffer *companion_rcs_cmd_buffer =
#      |                              ^~~~~~~~~~~~~~~~~~~~~~~~
#  979|      if (cmd_buffer_count != 0 && cmd_buffers[0]->companion_rcs_cmd_buffer &&
#  980|          result == VK_SUCCESS) {
#  981|->       struct anv_cmd_buffer *companion_rcs_cmd_buffer =
#  982|            cmd_buffers[0]->companion_rcs_cmd_buffer;
#  983|         assert(companion_rcs_cmd_buffer->is_companion_rcs_cmd_buffer);

Error: COMPILER_WARNING (CWE-563): [#def1760]
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/anv_image.c: scope_hint: In function ‘check_drm_format_mod’
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/anv_image.c:923:40: warning[-Wunused-variable]: unused variable ‘isl_mod_info’
#  923 |    const struct isl_drm_modifier_info *isl_mod_info =
#      |                                        ^~~~~~~~~~~~
#  921|         return VK_SUCCESS;
#  922|   
#  923|->    const struct isl_drm_modifier_info *isl_mod_info =
#  924|         isl_drm_modifier_get_info(image->vk.drm_format_mod);
#  925|   

Error: COMPILER_WARNING (CWE-563): [#def1761]
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/anv_image.c: scope_hint: In function ‘anv_layout_to_aux_state’
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/anv_image.c:1959:9: warning[-Wunused-but-set-variable]: variable ‘aux_supported’ set but not used
# 1959 |    bool aux_supported = true;
#      |         ^~~~~~~~~~~~~
# 1957|         vk_image_layout_to_usage_flags(layout, aspect) & image_aspect_usage;
# 1958|   
# 1959|->    bool aux_supported = true;
# 1960|      bool clear_supported = isl_aux_usage_has_fast_clears(aux_usage);
# 1961|   

Error: COMPILER_WARNING (CWE-563): [#def1762]
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/anv_pipeline.c: scope_hint: In function ‘anv_pipeline_compile_cs’
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/anv_pipeline.c:1438:43: warning[-Wunused-variable]: unused variable ‘sinfo’
# 1438 |    const VkPipelineShaderStageCreateInfo *sinfo = &info->stage;
#      |                                           ^~~~~
# 1436|                           const VkComputePipelineCreateInfo *info)
# 1437|   {
# 1438|->    const VkPipelineShaderStageCreateInfo *sinfo = &info->stage;
# 1439|      assert(sinfo->stage == VK_SHADER_STAGE_COMPUTE_BIT);
# 1440|   

Error: COMPILER_WARNING (CWE-563): [#def1763]
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/genX_cmd_buffer.c:926:40: warning[-Wunused-variable]: unused variable ‘isl_mod_info’
#  926 |    const struct isl_drm_modifier_info *isl_mod_info =
#      |                                        ^~~~~~~~~~~~
#  924|             (final_layout != VK_IMAGE_LAYOUT_UNDEFINED &&
#  925|              final_layout != VK_IMAGE_LAYOUT_PREINITIALIZED));
#  926|->    const struct isl_drm_modifier_info *isl_mod_info =
#  927|         image->vk.tiling == VK_IMAGE_TILING_DRM_FORMAT_MODIFIER_EXT
#  928|         ? isl_drm_modifier_get_info(image->vk.drm_format_mod)

Error: COMPILER_WARNING (CWE-563): [#def1764]
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/genX_cmd_buffer.c: scope_hint: In function ‘transition_color_buffer’
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/genX_cmd_buffer.c:1124:23: warning[-Wunused-but-set-variable]: variable ‘final_aux_usage’ set but not used
# 1124 |    enum isl_aux_usage final_aux_usage =
#      |                       ^~~~~~~~~~~~~~~
# 1122|      enum isl_aux_usage initial_aux_usage =
# 1123|         anv_layout_to_aux_usage(devinfo, image, aspect, 0, initial_layout);
# 1124|->    enum isl_aux_usage final_aux_usage =
# 1125|         anv_layout_to_aux_usage(devinfo, image, aspect, 0, final_layout);
# 1126|      enum anv_fast_clear_type initial_fast_clear =

Error: COMPILER_WARNING (CWE-563): [#def1765]
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/genX_pipeline.c: scope_hint: In function ‘emit_vertex_input’
mesa-25.1.0-rc2/src/intel/vulkan_hasvk/genX_pipeline.c:159:16: warning[-Wunused-variable]: unused variable ‘binding’
#  159 |       uint32_t binding = vi->attributes[a].binding;
#      |                ^~~~~~~
#  157|         assume(format < ISL_NUM_FORMATS);
#  158|   
#  159|->       uint32_t binding = vi->attributes[a].binding;
#  160|         assert(binding < MAX_VBS);
#  161|   

Error: COMPILER_WARNING (CWE-563): [#def1766]
mesa-25.1.0-rc2/src/mesa/state_tracker/st_nir_unlower_io_to_vars.c: scope_hint: In function ‘create_vars’
mesa-25.1.0-rc2/src/mesa/state_tracker/st_nir_unlower_io_to_vars.c:279:22: warning[-Wunused-but-set-variable]: variable ‘component’ set but not used
#  279 |             unsigned component, decl_size;
#      |                      ^~~~~~~~~
#  277|            /* Varyings. */
#  278|            if (desc.is_compact) {
#  279|->             unsigned component, decl_size;
#  280|   
#  281|               switch (desc.sem.location) {

Error: COMPILER_WARNING: [#def1767]
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104_sim.c:113:32: warning[-Warray-bounds=]: array subscript 4294967295 is above array bounds of ‘const uint16_t[2]’ {aka ‘const short unsigned int[2]’}
#  113 |       return (int16_t)inst->imm[imm_idx];
#      |                       ~~~~~~~~~^~~~~~~~~
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104.h: scope_hint: In function ‘mme_tu104_sim_core’
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104.h:162:13: note: while referencing ‘imm’
#  162 |    uint16_t imm[2];
#      |             ^~~
#  111|         assert(imm_idx < 2);
#  112|         /* Immediates are treated as signed for ALU ops */
#  113|->       return (int16_t)inst->imm[imm_idx];
#  114|      case MME_TU104_REG_IMMPAIR:
#  115|         assert(imm_idx < 2);

Error: COMPILER_WARNING: [#def1768]
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104_sim.c:117:32: warning[-Warray-bounds=]: array subscript 2 is above array bounds of ‘const uint16_t[2]’ {aka ‘const short unsigned int[2]’}
#  117 |       return (int16_t)inst->imm[1 - imm_idx];
#      |                       ~~~~~~~~~^~~~~~~~~~~~~
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104_sim.c:9: included_from: Included from here.
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104.h: scope_hint: In function ‘mme_tu104_sim_core’
mesa-25.1.0-rc2/src/nouveau/mme/mme_tu104.h:162:13: note: while referencing ‘imm’
#  162 |    uint16_t imm[2];
#      |             ^~~
#  115|         assert(imm_idx < 2);
#  116|         /* Immediates are treated as signed for ALU ops */
#  117|->       return (int16_t)inst->imm[1 - imm_idx];
#  118|      case MME_TU104_REG_IMM32:
#  119|         return ((uint32_t)inst->imm[0] << 16) | inst->imm[1];

Error: COMPILER_WARNING (CWE-563): [#def1769]
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_copy.c: scope_hint: In function ‘to_90b5_remap_comp_size’
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_copy.c:143:25: warning[-Wunused-variable]: unused variable ‘to_90b5’
#  143 |    static const uint8_t to_90b5[] = {
#      |                         ^~~~~~~
#  141|   to_90b5_remap_comp_size(uint8_t comp_size)
#  142|   {
#  143|->    static const uint8_t to_90b5[] = {
#  144|         [1] = NV90B5_SET_REMAP_COMPONENTS_COMPONENT_SIZE_ONE,
#  145|         [2] = NV90B5_SET_REMAP_COMPONENTS_COMPONENT_SIZE_TWO,

Error: COMPILER_WARNING (CWE-563): [#def1770]
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_copy.c: scope_hint: In function ‘to_90b5_remap_num_comps’
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_copy.c:159:25: warning[-Wunused-variable]: unused variable ‘to_90b5’
#  159 |    static const uint8_t to_90b5[] = {
#      |                         ^~~~~~~
#  157|   to_90b5_remap_num_comps(uint8_t num_comps)
#  158|   {
#  159|->    static const uint8_t to_90b5[] = {
#  160|         [1] = NV90B5_SET_REMAP_COMPONENTS_NUM_SRC_COMPONENTS_ONE,
#  161|         [2] = NV90B5_SET_REMAP_COMPONENTS_NUM_SRC_COMPONENTS_TWO,

Error: COMPILER_WARNING (CWE-563): [#def1771]
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_draw.c: scope_hint: In function ‘nvk_mme_set_shading_rate_control_test_check’
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_draw.c:2353:9: warning[-Wunused-variable]: unused variable ‘enable’
# 2353 |    bool enable = (results[0].data & 3) == 3;
#      |         ^~~~~~
# 2351|   
# 2352|      assert(results[0].mthd == NVK_SET_MME_SCRATCH(SHADING_RATE_CONTROL));
# 2353|->    bool enable = (results[0].data & 3) == 3;
# 2354|   
# 2355|      for (uint32_t i = 0; i < 16; i++) {

Error: COMPILER_WARNING (CWE-563): [#def1772]
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_draw.c:3646:19: warning[-Wunused-variable]: unused variable ‘vb_idx’
# 3646 |    const uint32_t vb_idx = test->params[0];
#      |                   ^~~~~~
# 3644|                              const struct nvk_mme_mthd_data *results)
# 3645|   {
# 3646|->    const uint32_t vb_idx = test->params[0];
# 3647|      const uint32_t addr_hi = test->params[1];
# 3648|      const uint32_t addr_lo = test->params[2];

Error: COMPILER_WARNING (CWE-563): [#def1773]
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_draw.c: scope_hint: In function ‘nvk_mme_bind_vb_test_check’
mesa-25.1.0-rc2/src/nouveau/vulkan/nvk_cmd_draw.c:3673:22: warning[-Wunused-variable]: unused variable ‘limit’
# 3673 |       const uint64_t limit = (addr + size_B) - 1;
#      |                      ^~~~~
# 3671|         assert(results[1].data == (uint32_t)addr);
# 3672|   
# 3673|->       const uint64_t limit = (addr + size_B) - 1;
# 3674|         assert(results[2].mthd == NV9097_SET_VERTEX_STREAM_LIMIT_A_A(3));
# 3675|         assert(results[3].mthd == NV9097_SET_VERTEX_STREAM_LIMIT_A_B(3));

Error: COMPILER_WARNING (CWE-563): [#def1774]
mesa-25.1.0-rc2/src/nouveau/winsys/nouveau_context.c: scope_hint: In function ‘nouveau_ws_channel_dealloc’
mesa-25.1.0-rc2/src/nouveau/winsys/nouveau_context.c:119:8: warning[-Wunused-variable]: unused variable ‘ret’
#  119 |    int ret = drmCommandWrite(fd, DRM_NOUVEAU_CHANNEL_FREE, &req, sizeof(req));
#      |        ^~~
#  117|      };
#  118|   
#  119|->    int ret = drmCommandWrite(fd, DRM_NOUVEAU_CHANNEL_FREE, &req, sizeof(req));
#  120|      assert(!ret);
#  121|   }

Error: COMPILER_WARNING (CWE-563): [#def1775]
mesa-25.1.0-rc2/src/panfrost/compiler/bifrost_compile.c: scope_hint: In function ‘bi_emit_image_store’
mesa-25.1.0-rc2/src/panfrost/compiler/bifrost_compile.c:1753:17: warning[-Wunused-variable]: unused variable ‘T’
# 1753 |    nir_alu_type T = nir_intrinsic_src_type(instr);
#      |                 ^
# 1751|       * not work for 16-bit stores, but those are not available in OpenCL.
# 1752|       */
# 1753|->    nir_alu_type T = nir_intrinsic_src_type(instr);
# 1754|      assert(nir_alu_type_get_type_size(T) == 32);
# 1755|   

Error: COMPILER_WARNING (CWE-563): [#def1776]
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘get_tiler_desc’
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:839:16: warning[-Wunused-variable]: unused variable ‘max_levels’
#  839 |       unsigned max_levels = tiler_features.max_levels;
#      |                ^~~~~~~~~~
#  837|   
#  838|      pan_pack(&tiler_tmpl, TILER_CONTEXT, cfg) {
#  839|->       unsigned max_levels = tiler_features.max_levels;
#  840|         assert(max_levels >= 2);
#  841|   

Error: COMPILER_WARNING (CWE-563): [#def1777]
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘prepare_draw’
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:1882:9: warning[-Wunused-variable]: unused variable ‘idvs’
# 1882 |    bool idvs = vs->info.vs.idvs;
#      |         ^~~~
# 1880|      const struct panvk_shader *fs = get_fs(cmdbuf);
# 1881|      struct panvk_descriptor_state *desc_state = &cmdbuf->state.gfx.desc_state;
# 1882|->    bool idvs = vs->info.vs.idvs;
# 1883|      VkResult result;
# 1884|   

Error: COMPILER_WARNING (CWE-563): [#def1778]
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘panvk_v10_CmdBeginRendering’
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:2450:37: warning[-Wunused-variable]: unused variable ‘state’
# 2450 |    struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx;
#      |                                     ^~~~~
# 2448|   {
# 2449|      VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
# 2450|->    struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx;
# 2451|      bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT;
# 2452|   

Error: COMPILER_WARNING (CWE-563): [#def1779]
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_queue.c: scope_hint: In function ‘panvk_queue_submit_process_signals’
mesa-25.1.0-rc2/src/panfrost/vulkan/csf/panvk_vX_queue.c:1080:8: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
# 1080 |    int ret;
#      |        ^~~
# 1078|      struct panvk_device *dev = submit->dev;
# 1079|      struct panvk_queue *queue = submit->queue;
# 1080|->    int ret;
# 1081|   
# 1082|      if (!submit->needs_signals)

Error: COMPILER_WARNING (CWE-563): [#def1780]
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_queue_submit_batch’
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c:43:8: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#   43 |    int ret;
#      |        ^~~
#   41|         to_panvk_instance(dev->vk.physical->instance);
#   42|      unsigned debug = instance->debug_flags;
#   43|->    int ret;
#   44|   
#   45|      /* Reset the batch if it's already been issued */

Error: COMPILER_WARNING (CWE-563): [#def1781]
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_queue_transfer_sync’
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c:141:8: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  141 |    int ret;
#      |        ^~~
#  139|   {
#  140|      struct panvk_device *dev = to_panvk_device(queue->vk.base.device);
#  141|->    int ret;
#  142|   
#  143|      struct drm_syncobj_handle handle = {

Error: COMPILER_WARNING (CWE-563): [#def1782]
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_signal_event_syncobjs’
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c:200:14: warning[-Wunused-variable]: unused variable ‘ret’
#  200 |          int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET,
#      |              ^~~
#  198|               .count_handles = 1};
#  199|   
#  200|->          int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET,
#  201|                                     &objs);
#  202|            assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def1783]
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_v6_QueueWaitIdle’
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c:351:8: warning[-Wunused-variable]: unused variable ‘ret’
#  351 |    int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1,
#      |        ^~~
#  349|         return VK_ERROR_DEVICE_LOST;
#  350|   
#  351|->    int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1,
#  352|                               INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL, NULL);
#  353|      assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def1784]
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘get_img_index’
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:816:54: warning[-Wunused-variable]: unused variable ‘bind_layout’
#  816 |    const struct panvk_descriptor_set_binding_layout *bind_layout =
#      |                                                      ^~~~~~~~~~~
#  814|                                 &max_idx);
#  815|   
#  816|->    const struct panvk_descriptor_set_binding_layout *bind_layout =
#  817|         get_binding_layout(set, binding, ctx);
#  818|      assert(bind_layout->type == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE ||

Error: COMPILER_WARNING (CWE-563): [#def1785]
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1121:13: warning[-Wunused-variable]: unused variable ‘desc_stride’
# 1121 |    uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
#      |             ^~~~~~~~~~~
# 1119|         &set_layout->bindings[binding];
# 1120|      uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 1121|->    uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 1122|      uint32_t max_desc_stride = MAX2(
# 1123|         binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1);

Error: COMPILER_WARNING (CWE-563): [#def1786]
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘record_binding’
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1122:13: warning[-Wunused-variable]: unused variable ‘max_desc_stride’
# 1122 |    uint32_t max_desc_stride = MAX2(
#      |             ^~~~~~~~~~~~~~~
# 1120|      uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 1121|      uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 1122|->    uint32_t max_desc_stride = MAX2(
# 1123|         binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1);
# 1124|   

Error: CPPCHECK_WARNING (CWE-457): [#def1787]
mesa-25.1.0-rc2/src/util/blake3/blake3.c:186: warning[uninitvar]: Uninitialized variable: chunks_array
#  184|     }
#  185|   
#  186|->   blake3_hash_many(chunks_array, chunks_array_len,
#  187|                      BLAKE3_CHUNK_LEN / BLAKE3_BLOCK_LEN, key, chunk_counter,
#  188|                      true, flags, CHUNK_START, CHUNK_END, out);

Error: CPPCHECK_WARNING (CWE-457): [#def1788]
mesa-25.1.0-rc2/src/util/blake3/blake3.c:229: warning[uninitvar]: Uninitialized variable: parents_array
#  227|     }
#  228|   
#  229|->   blake3_hash_many(parents_array, parents_array_len, 1, key,
#  230|                      0, // Parents always use counter 0.
#  231|                      false, flags | PARENT,

Error: CPPCHECK_WARNING (CWE-758): [#def1789]
mesa-25.1.0-rc2/src/util/softfloat.c:138: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  136|               e = 0x7ff;
#  137|               m = 0;
#  138|->             result.u = (s << 63) + (e << 52) + m;
#  139|               result.u -= 1;
#  140|               return result.f;

Error: CPPCHECK_WARNING (CWE-758): [#def1790]
mesa-25.1.0-rc2/src/util/softfloat.c:148: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  146|           e = 0;
#  147|   
#  148|->     result.u = (s << 63) + (e << 52) + m;
#  149|       return result.f;
#  150|   }

Error: CPPCHECK_WARNING (CWE-758): [#def1791]
mesa-25.1.0-rc2/src/util/softfloat.c:168: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
#  166|               e = 0xff;
#  167|               m = 0;
#  168|->             result.u = (s << 31) + (e << 23) + m;
#  169|               result.u -= !round_increment;
#  170|               return result.f;

Error: CPPCHECK_WARNING (CWE-758): [#def1792]
mesa-25.1.0-rc2/src/util/softfloat.c:181: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
#  179|           e = 0;
#  180|   
#  181|->     result.u = (s << 31) + (e << 23) + m;
#  182|       return result.f;
#  183|   }

Error: CPPCHECK_WARNING (CWE-758): [#def1793]
mesa-25.1.0-rc2/src/util/softfloat.c:546: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  544|       if ((10 <= shift_dist) && ((unsigned) e < 0x7fd)) {
#  545|           di_type result;
#  546|->         result.u = (s << 63) + ((m ? e : 0) << 52) + (m << (shift_dist - 10));
#  547|           return result.f;
#  548|       } else {

Error: CPPCHECK_WARNING (CWE-758): [#def1794]
mesa-25.1.0-rc2/src/util/softfloat.c:694: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  692|               di_type result;
#  693|               e = 0x7ff;
#  694|->             result.u = (s << 63) + (e << 52) + 0x1;
#  695|               return result.f;
#  696|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1795]
mesa-25.1.0-rc2/src/util/softfloat.c:722: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  720|   
#  721|           di_type result;
#  722|->         result.u = (s << 63) + (e << 52) + (m_diff << shift_dist);
#  723|           return result.f;
#  724|       } else if (exp_diff < 0) {

Error: CPPCHECK_WARNING (CWE-758): [#def1796]
mesa-25.1.0-rc2/src/util/softfloat.c:837: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  835|               di_type result;
#  836|               e = 0x7ff;
#  837|->             result.u = (s << 63) + (e << 52) + 0x1;
#  838|               return result.f;
#  839|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1797]
mesa-25.1.0-rc2/src/util/softfloat.c:843: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  841|           di_type result;
#  842|           e = 0x7ff;
#  843|->         result.u = (s << 63) + (e << 52) + 0;
#  844|           return result.f;
#  845|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1798]
mesa-25.1.0-rc2/src/util/softfloat.c:856: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  854|               di_type result;
#  855|               e = 0x7ff;
#  856|->             result.u = (s << 63) + (e << 52) + 0x1;
#  857|               return result.f;
#  858|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1799]
mesa-25.1.0-rc2/src/util/softfloat.c:862: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  860|           di_type result;
#  861|           e = 0x7ff;
#  862|->         result.u = (s << 63) + (e << 52) + 0;
#  863|           return result.f;
#  864|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1800]
mesa-25.1.0-rc2/src/util/softfloat.c:870: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  868|               /* 'a' is zero. Return zero */
#  869|               di_type result;
#  870|->             result.u = (s << 63) + 0;
#  871|               return result.f;
#  872|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1801]
mesa-25.1.0-rc2/src/util/softfloat.c:879: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  877|               /* 'b' is zero. Return zero */
#  878|               di_type result;
#  879|->             result.u = (s << 63) + 0;
#  880|               return result.f;
#  881|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1802]
mesa-25.1.0-rc2/src/util/softfloat.c:951: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  949|               di_type result;
#  950|               e = 0x7ff;
#  951|->             result.u = (s << 63) + (e << 52) + 0x1;
#  952|               return result.f;
#  953|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1803]
mesa-25.1.0-rc2/src/util/softfloat.c:959: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  957|               di_type result;
#  958|               e = 0x7ff;
#  959|->             result.u = (s << 63) + (e << 52) + 0x1;
#  960|               return result.f;
#  961|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1804]
mesa-25.1.0-rc2/src/util/softfloat.c:966: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  964|           di_type result;
#  965|           e = 0x7ff;
#  966|->         result.u = (s << 63) + (e << 52) + 0;
#  967|           return result.f;
#  968|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1805]
mesa-25.1.0-rc2/src/util/softfloat.c:983: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  981|               di_type result;
#  982|               e = 0x7ff;
#  983|->             result.u = (s << 63) + (e << 52) + 0x1;
#  984|               return result.f;
#  985|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1806]
mesa-25.1.0-rc2/src/util/softfloat.c:991: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  989|               di_type result;
#  990|               e = 0x7ff;
#  991|->             result.u = (s << 63) + (e << 52) + 0x1;
#  992|               return result.f;
#  993|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1807]
mesa-25.1.0-rc2/src/util/softfloat.c:998: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
#  996|           di_type result;
#  997|           e = 0x7ff;
#  998|->         result.u = (s << 63) + (e << 52) + 0;
#  999|           return result.f;
# 1000|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1808]
mesa-25.1.0-rc2/src/util/softfloat.c:1123: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour
# 1121|                   /* Return zero */
# 1122|                   di_type result;
# 1123|->                 result.u = (s << 63) + 0;
# 1124|                   return result.f;
# 1125|               }

Error: CPPCHECK_WARNING (CWE-758): [#def1809]
mesa-25.1.0-rc2/src/util/softfloat.c:1216: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1214|               fi_type result;
# 1215|               e = 0xff;
# 1216|->             result.u = (s << 31) + (e << 23) + 0x1;
# 1217|               return result.f;
# 1218|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1810]
mesa-25.1.0-rc2/src/util/softfloat.c:1224: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1222|               fi_type result;
# 1223|               e = 0xff;
# 1224|->             result.u = (s << 31) + (e << 23) + 0x1;
# 1225|               return result.f;
# 1226|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1811]
mesa-25.1.0-rc2/src/util/softfloat.c:1231: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1229|           fi_type result;
# 1230|           e = 0xff;
# 1231|->         result.u = (s << 31) + (e << 23) + 0;
# 1232|           return result.f;
# 1233|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1812]
mesa-25.1.0-rc2/src/util/softfloat.c:1248: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1246|               fi_type result;
# 1247|               e = 0xff;
# 1248|->             result.u = (s << 31) + (e << 23) + 0x1;
# 1249|               return result.f;
# 1250|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1813]
mesa-25.1.0-rc2/src/util/softfloat.c:1256: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1254|               fi_type result;
# 1255|               e = 0xff;
# 1256|->             result.u = (s << 31) + (e << 23) + 0x1;
# 1257|               return result.f;
# 1258|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1814]
mesa-25.1.0-rc2/src/util/softfloat.c:1263: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1261|           fi_type result;
# 1262|           e = 0xff;
# 1263|->         result.u = (s << 31) + (e << 23) + 0;
# 1264|           return result.f;
# 1265|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1815]
mesa-25.1.0-rc2/src/util/softfloat.c:1337: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1335|                   /* Return zero */
# 1336|                   fi_type result;
# 1337|->                 result.u = (s << 31) + 0;
# 1338|                   return result.f;
# 1339|               }

Error: CPPCHECK_WARNING (CWE-758): [#def1816]
mesa-25.1.0-rc2/src/util/softfloat.c:1384: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1382|               e = 0xff;
# 1383|               m = 0x1;
# 1384|->             result.u = (s << 31) + (e << 23) + m;
# 1385|               return result.f;
# 1386|           }

Error: CPPCHECK_WARNING (CWE-758): [#def1817]
mesa-25.1.0-rc2/src/util/softfloat.c:1391: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1389|           fi_type result;
# 1390|           e = 0xff;
# 1391|->         result.u = (s << 31) + (e << 23) + m;
# 1392|           return result.f;
# 1393|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1818]
mesa-25.1.0-rc2/src/util/softfloat.c:1399: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1397|           fi_type result;
# 1398|           e = 0;
# 1399|->         result.u = (s << 31) + (e << 23) + m;
# 1400|           return result.f;
# 1401|       }

Error: CPPCHECK_WARNING (CWE-758): [#def1819]
mesa-25.1.0-rc2/src/util/softfloat.c:1408: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1406|           fi_type result;
# 1407|           e = 0;
# 1408|->         result.u = (s << 31) + (e << 23) + m;
# 1409|           return result.f;
# 1410|       }

Error: CPPCHECK_WARNING (CWE-476): [#def1820]
mesa-25.1.0-rc2/src/util/u_queue.c:325: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: input
#  323|      struct thread_input *input =
#  324|         (struct thread_input *) malloc(sizeof(struct thread_input));
#  325|->    input->queue = queue;
#  326|      input->thread_index = index;
#  327|   

Error: CPPCHECK_WARNING (CWE-476): [#def1821]
mesa-25.1.0-rc2/src/util/u_queue.c:326: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: input
#  324|         (struct thread_input *) malloc(sizeof(struct thread_input));
#  325|      input->queue = queue;
#  326|->    input->thread_index = index;
#  327|   
#  328|      if (thrd_success != u_thread_create(queue->threads + index, util_queue_thread_func, input)) {

Error: CPPCHECK_WARNING (CWE-476): [#def1822]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:76: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#   74|      left = size;
#   75|      do {
#   76|->       ret = write(vtdev->sock_fd, ptr, left);
#   77|         if (ret < 0)
#   78|            return -errno;

Error: CPPCHECK_WARNING (CWE-476): [#def1823]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:796: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  794|      vtdev = calloc(1, sizeof(*vtdev));
#  795|   
#  796|->    vtdev->sock_fd = sock_fd;
#  797|      simple_mtx_init(&vtdev->lock, mtx_plain);
#  798|   

Error: CPPCHECK_WARNING (CWE-476): [#def1824]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:804: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  802|      simple_mtx_lock(&vtdev->lock);
#  803|      send_init(vtdev);
#  804|->    vtdev->protocol_version = negotiate_version(vtdev);
#  805|   
#  806|      /* Version 1 is deprecated. */

Error: CPPCHECK_WARNING (CWE-476): [#def1825]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:807: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  805|   
#  806|      /* Version 1 is deprecated. */
#  807|->    if (vtdev->protocol_version == 1)
#  808|         vtdev->protocol_version = 0;
#  809|   

Error: CPPCHECK_WARNING (CWE-476): [#def1826]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:812: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  810|      // TODO minimum protocol version?
#  811|   
#  812|->    mesa_logd("vpipe connected, protocol version %d", vtdev->protocol_version);
#  813|   
#  814|      vdev = &vtdev->base;

Error: CPPCHECK_WARNING (CWE-758): [#def1827]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1052: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1050|   
# 1051|      if (timeout_nsec > os_time_get_nano())
# 1052|->       flags |= DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD;
# 1053|   
# 1054|      vpipe_hdr[VTEST_CMD_LEN] = VCMD_DRM_SYNC_WAIT_SIZE;

Error: CPPCHECK_WARNING (CWE-758): [#def1828]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1070: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1068|      assert(vpipe_hdr[VTEST_CMD_ID] == VCMD_DRM_SYNC_WAIT);
# 1069|   
# 1070|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1071|         assert(vpipe_hdr[VTEST_CMD_LEN] == 0);
# 1072|         wait_fd = vpipe_receive_fd(vp->vtdev);

Error: CPPCHECK_WARNING (CWE-758): [#def1829]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1084: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1082|      simple_mtx_unlock(&vp->vtdev->lock);
# 1083|   
# 1084|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1085|         vpipe_read_fd(wait_fd, &ret, sizeof(ret));
# 1086|         if (first_signaled)

Error: CPPCHECK_WARNING (CWE-758): [#def1830]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1187: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1185|   
# 1186|      if (timeout_nsec > os_time_get_nano())
# 1187|->       flags |= DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD;
# 1188|   
# 1189|      vpipe_hdr[VTEST_CMD_LEN] = VCMD_DRM_SYNC_TIMELINE_WAIT_SIZE;

Error: CPPCHECK_WARNING (CWE-758): [#def1831]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1206: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1204|      assert(vpipe_hdr[VTEST_CMD_ID] == VCMD_DRM_SYNC_WAIT);
# 1205|   
# 1206|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1207|         assert(vpipe_hdr[VTEST_CMD_LEN] == 0);
# 1208|         wait_fd = vpipe_receive_fd(vp->vtdev);

Error: CPPCHECK_WARNING (CWE-758): [#def1832]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1220: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1218|      simple_mtx_unlock(&vp->vtdev->lock);
# 1219|   
# 1220|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1221|         vpipe_read_fd(wait_fd, &ret, sizeof(ret));
# 1222|         if (first_signaled)

Error: CPPCHECK_WARNING (CWE-476): [#def1833]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1312: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: s
# 1310|      struct vpipe_sync_provider *s = calloc(1, sizeof(*s));
# 1311|   
# 1312|->    s->base = (struct util_sync_provider){
# 1313|         .create = vpipe_drm_sync_create,
# 1314|         .destroy = vpipe_drm_sync_destroy,

Error: CPPCHECK_WARNING (CWE-476): [#def1834]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1332: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: s
# 1330|      }
# 1331|   
# 1332|->    s->vtdev = to_vpipe_device(vdrm);
# 1333|   
# 1334|      return &s->base;

Error: COMPILER_WARNING (CWE-563): [#def1835]
mesa-25.1.0-rc2/src/virtio/vulkan/vn_queue.c: scope_hint: In function ‘vn_GetFenceFdKHR’
mesa-25.1.0-rc2/src/virtio/vulkan/vn_queue.c:1834:15: warning[-Wunused-variable]: unused variable ‘sync_file’
# 1834 |    const bool sync_file =
#      |               ^~~~~~~~~
# 1832|      struct vn_device *dev = vn_device_from_handle(device);
# 1833|      struct vn_fence *fence = vn_fence_from_handle(pGetFdInfo->fence);
# 1834|->    const bool sync_file =
# 1835|         pGetFdInfo->handleType == VK_EXTERNAL_FENCE_HANDLE_TYPE_SYNC_FD_BIT;
# 1836|      struct vn_sync_payload *payload = fence->payload;

Error: COMPILER_WARNING (CWE-563): [#def1836]
mesa-25.1.0-rc2/src/virtio/vulkan/vn_queue.c: scope_hint: In function ‘vn_GetSemaphoreFdKHR’
mesa-25.1.0-rc2/src/virtio/vulkan/vn_queue.c:2302:15: warning[-Wunused-variable]: unused variable ‘sync_file’
# 2302 |    const bool sync_file =
#      |               ^~~~~~~~~
# 2300|      struct vn_device *dev = vn_device_from_handle(device);
# 2301|      struct vn_semaphore *sem = vn_semaphore_from_handle(pGetFdInfo->semaphore);
# 2302|->    const bool sync_file =
# 2303|         pGetFdInfo->handleType == VK_EXTERNAL_SEMAPHORE_HANDLE_TYPE_SYNC_FD_BIT;
# 2304|      struct vn_sync_payload *payload = sem->payload;

Error: COMPILER_WARNING (CWE-563): [#def1837]
mesa-25.1.0-rc2/src/virtio/vulkan/vn_wsi.c: scope_hint: In function ‘vn_wsi_create_image’
mesa-25.1.0-rc2/src/virtio/vulkan/vn_wsi.c:124:56: warning[-Wunused-variable]: unused variable ‘modifier_info’
#  124 |       const VkImageDrmFormatModifierListCreateInfoEXT *modifier_info =
#      |                                                        ^~~~~~~~~~~~~
#  122|   
#  123|      if (VN_PERF(NO_TILED_WSI_IMAGE)) {
#  124|->       const VkImageDrmFormatModifierListCreateInfoEXT *modifier_info =
#  125|            vk_find_struct_const(
#  126|               create_info->pNext,