Added DCHECK() to prevent webwidget_->isInputThrottled() from being called when webwidget_ is NULL.

content/renderer/render_widget.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_widget.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
@@ skipping 526 matching lines @@
   TRACE_EVENT0("renderer", "RenderWidget::OnHandleInputEvent");
   PickleIterator iter(message);
 
   const char* data;
   int data_length;
   handling_input_event_ = true;
   if (!message.ReadData(&iter, &data, &data_length)) {
     handling_input_event_ = false;
     return;
   }
+  DCHECK(webwidget_);
 
   const WebInputEvent* input_event =
       reinterpret_cast<const WebInputEvent*>(data);
 
   bool is_keyboard_shortcut = false;
   // is_keyboard_shortcut flag is only available for RawKeyDown events.
   if (input_event->type == WebInputEvent::RawKeyDown)
     message.ReadBool(&iter, &is_keyboard_shortcut);
 
   bool prevent_default = false;
   if (WebInputEvent::isMouseEventType(input_event->type)) {
     const WebMouseEvent& mouse_event =
         *static_cast<const WebMouseEvent*>(input_event);
     TRACE_EVENT2("renderer", "HandleMouseMove",
                  "x", mouse_event.x, "y", mouse_event.y);
     prevent_default = WillHandleMouseEvent(mouse_event);
   }
 
   bool processed = prevent_default;
   if (input_event->type != WebInputEvent::Char || !suppress_next_char_events_) {
     suppress_next_char_events_ = false;
     if (!processed && webwidget_)

[Tyler Breisacher (Chromium), 2012/07/26 18:32:15]

I think you misread what Coverity is saying. This line implies that webwidget_
could be null in some cases. Your DCHECK implies that it should never be null.
Which one is right? I don't know. This is another case where you probably want
to talk to the owner or original author of the code and find out which states
are possible and which ones should be impossible. Maybe webwidget_ should
actually never be null in which case you can just change this line to

    if (!processed)

but I don't know without looking at the code a lot more carefully.

[Kyle Horimoto, 2012/07/26 18:40:57]

Line 587 dereferences webwidget_. If it is indeed NULL, we will segfault (there
are no return statements between my DCHECK() and line 587). So that line implies
that webwidget_ should never be NULL. I'll add in the author of this file to
check.

[nduca, 2012/07/26 19:27:11]

Just say webwidget_ ? webwidget_xxx : yyy where needed, where throttled can be
false.

[Kyle Horimoto, 2012/07/26 21:58:52]

Sorry, I'm don't understand exactly you're saying here. Could you explain a
little more? (I didn't work at all on this code; I'm only fixing this because
the code analysis tool found this error.)

       processed = webwidget_->handleInputEvent(*input_event);
   }
 
   // If this RawKeyDown event corresponds to a browser keyboard shortcut and
   // it's not processed by webkit, then we need to suppress the upcoming Char
   // events.
   if (!processed && is_keyboard_shortcut)
     suppress_next_char_events_ = true;
 
   IPC::Message* response =
@@ skipping 1194 matching lines @@
   Send(new ViewHostMsg_BeginSmoothScroll(routing_id_, down, scroll_far));
 }
 
 bool RenderWidget::WillHandleMouseEvent(const WebKit::WebMouseEvent& event) {
   return false;
 }
 
 bool RenderWidget::WebWidgetHandlesCompositorScheduling() const {
   return false;
 }