Skip to content

fix(reader): correct null-page guard operator in render callback slots - #399

Open
pengfeixx wants to merge 1 commit into
linuxdeepin:masterfrom
pengfeixx:agent/pms-bug-bot/c421248a3b1e
Open

pengfeixx wants to merge 1 commit into
linuxdeepin:masterfrom
pengfeixx:agent/pms-bug-bot/c421248a3b1e

Conversation

@pengfeixx

@pengfeixx pengfeixx commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

fix(reader): correct null-page guard operator in render callback slots

  1. Five async render callback slots used nullptr != task.page && !existPage(task.page)
    as the guard, which short-circuits to false when task.page is null, falling through
    to dereference the null pointer
  2. Change the operator from && to || so the guard returns early when task.page is
    null OR the page has been destroyed, preventing null-pointer dereference
  3. Affected functions: onDocPageNormalImageTaskFinished, onDocPageSliceImageTaskFinished,
    onDocPageBigImageTaskFinished, onDocPageWordTaskFinished, onDocPageAnnotationTaskFinished
  4. Adapt _002 series unit tests: add existPage stub returning true and set non-null
    placeholder page pointer so stubbed handlers are still invoked

Log: Fix null-page guard operator in PageRenderThread render callback slots
Influence: Prevents crash when async render callback delivers to a null page

Summary by Sourcery

Guard asynchronous render callbacks against null or destroyed pages before invoking page handlers.

Bug Fixes:

  • Prevent null-pointer dereferences when asynchronous render callbacks target a null or destroyed page.

Tests:

  • Update render callback unit tests to use valid placeholder pages and stub page-existence checks under the corrected guard.

1. Five async render callback slots used `nullptr != task.page && !existPage(task.page)`
   as the guard, which short-circuits to false when task.page is null, falling through
   to dereference the null pointer
2. Change the operator from `&&` to `||` so the guard returns early when task.page is
   null OR the page has been destroyed, preventing null-pointer dereference
3. Affected functions: onDocPageNormalImageTaskFinished, onDocPageSliceImageTaskFinished,
   onDocPageBigImageTaskFinished, onDocPageWordTaskFinished, onDocPageAnnotationTaskFinished
4. Adapt _002 series unit tests: add existPage stub returning true and set non-null
   placeholder page pointer so stubbed handlers are still invoked

Log: Fix null-page guard operator in PageRenderThread render callback slots
Influence: Prevents crash when async render callback delivers to a null page
@deepin-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pengfeixx

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @pengfeixx, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 11 hours by commenting @sourcery-ai review. Upgrade to get a review now.

@sourcery-ai

sourcery-ai Bot commented Sep 18, 2026

Copy link
Copy Markdown

Reviewer's Guide

Fixes a null-pointer crash in asynchronous render callbacks by returning when the task page is null or no longer exists, and adapts the affected unit tests to exercise handler invocation with stubbed, non-null pages.

Sequence diagram for safe asynchronous render callback handling

sequenceDiagram
    participant Render as PageRenderThread
    participant Sheet as DocSheet
    participant Page as BrowserPage

    Render->>Sheet: existSheet(task.sheet)
    alt sheet exists
        Render->>Page: existPage(task.page)
        alt task.page is null or page does not exist
            Render-->>Render: return
        else page is valid
            Render->>Page: handleRenderFinished(...)
        end
    end
Loading

File-Level Changes

Change Details Files
Correct null-page handling in all asynchronous render completion callbacks to prevent dereferencing invalid page pointers.
  • Replace the faulty conjunction with an early-return condition that rejects null or destroyed pages.
  • Apply the guard consistently to normal-image, slice-image, big-image, word, and annotation callbacks.
reader/browser/PageRenderThread.cpp
Update callback unit tests to reflect the corrected guard while continuing to verify handler dispatch.
  • Stub page-existence checks to return true.
  • Use a non-null placeholder page for tests whose browser-page handlers are stubbed.
tests/browser/ut_pagerenderthread.cpp

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@deepin-ci-robot

Copy link
Copy Markdown

deepin pr auto review

🤖 AI 代码审查报告

总体评分: 100 分 (通过阈值: 70分)

Pass


📊 总体评价

项目 结果
审查结论 代码审查通过
评分详情 本次提交修复了5个异步渲染回调函数中的空指针解引用缺陷,将条件守卫运算符从 && 改为

🔍 详细分析

1. 语法逻辑 ✅

评分: 25/25 分

评价: 语法正确,逻辑清晰

潜在问题:
✅ 未发现明显问题

详细分析:

本次修改将5个异步渲染回调函数中的空指针守卫条件从 nullptr != task.page && !BrowserPage::existPage(task.page) 修改为 nullptr == task.page || !BrowserPage::existPage(task.page)

原始代码存在逻辑缺陷:当 task.page 为 nullptr 时,nullptr != task.page 为 false,由于 && 短路求值,整个条件为 false,函数不会提前返回,导致后续代码解引用空指针(如 task.page->setImageObjectRectstask.page->handleRenderFinished 等)。

修改后的代码使用 || 运算符,当 task.page 为 nullptr 时,nullptr == task.page 为 true,短路求值使整个条件为 true,函数提前返回,正确避免了空指针解引用。

涉及的5个函数:

  1. onDocPageNormalImageTaskFinished (第917行)
  2. onDocPageSliceImageTaskFinished (第929行)
  3. onDocPageBigImageTaskFinished (第940行)
  4. onDocPageWordTaskFinished (第952行)
  5. onDocPageAnnotationTaskFinished (第963行)

测试代码同步适配:新增 existPage_true_stub 桩函数返回 true,将 task.page 从 nullptr 改为 reinterpret_cast<BrowserPage *>(0x1) 非空占位指针,确保新的守卫条件通过后桩函数能被正确调用。


2. 代码质量 ✅

评分: 25/25 分

评价: 代码结构清晰,注释完整

潜在问题:
✅ 未发现明显问题

详细分析:

修改范围精准,仅涉及必要的运算符替换和注释更新。注释从"页面已析构,丢弃残留回包"更新为"页面为空或已析构,丢弃残留回包",准确反映了新的守卫逻辑。测试代码新增了 existPage_true_stub 桩函数,并附有清晰的注释说明其用途。每个测试用例中 task.page 的修改也配有行内注释"non-null placeholder; handler methods are stubbed"。

5处修改分别位于5个不同的回调函数中,属于相似但独立的守卫逻辑,不属于重复代码。无残留调试代码,无敏感信息泄露。


3. 代码性能 ✅

评分: 20/20 分

评价: 性能良好,资源使用合理

潜在问题:
✅ 未发现明显问题

详细分析:

运算符从 && 改为 || 对性能无负面影响。短路求值仍然有效:当 task.page 为 nullptr 时,existPage 不会被调用,避免了不必要的函数调用。无额外内存分配,无算法复杂度变化。


4. 代码安全 🔒

评分: 30/30 分

评价: 存在0个安全漏洞

🔐 存在 0 个安全漏洞

漏洞对比统计: 新增漏洞 0 个,减少漏洞 0 个,持平 0 个

安全漏洞详情:
✅ 未发现安全漏洞

详细分析:

本次修改修复了潜在的空指针解引用漏洞(可导致程序崩溃/拒绝服务),属于安全增强。修改本身未引入任何新的安全漏洞。测试代码中使用的 reinterpret_cast<BrowserPage *>(0x1) 仅在测试环境中使用,且所有解引用该指针的方法均已桩化,不存在安全风险。


📋 审查信息

项目 内容
平台 GitHub
项目 linuxdeepin/deepin-reader
PR #399
提交 21bd6f1
分析模式 全量分析
修改文件 reader/browser/PageRenderThread.cpp, tests/browser/ut_pagerenderthread.cpp

本报告由 AI 代码审查工具自动生成

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants