src: suppress false coverity warning

[mhdawson]

Signed-off-by: Michael Dawson mdawson@devrus.com

[mhdawson]

This is the coverity warning. I believe it is a false positive since the pointer passed is only used as a key
instead of a pointer in the function it is passed to:

void* DebuggingArrayBufferAllocator::Reallocate(void* data,
139                                                size_t old_size,
140                                                size_t size) {
141  Mutex::ScopedLock lock(mutex_);
   	1. freed_arg: Reallocate frees data. [[show details](https://scan9.scan.coverity.com/eventId=8709720-0&modelId=8709720-0&fileInstanceId=93872115&filePath=%2Fsrc%2Fapi%2Fenvironment.cc&fileStart=101&fileEnd=107)]
142  void* ret = NodeArrayBufferAllocator::Reallocate(data, old_size, size);
   	2. Condition ret == NULL, taking true branch.
143  if (ret == nullptr) {
   	3. Condition size == 0, taking true branch.
144    if (size == 0)  // i.e. equivalent to free().
   	
CID 196235 (#1 of 1): Use after free (USE_AFTER_FREE)
4. pass_freed_arg: Passing freed pointer data as an argument to UnregisterPointerInternal.
145      UnregisterPointerInternal(data, old_size);
146    return nullptr;
147  }

[tniessen]

Does this affect any of our own workflows?

If the answer is no, and because coverity is an external commercial and non-open source tool (as far as I am aware), I think I have a slight preference for not adding coverity-specific comments to our source code. As far as I understand it, we can set "Classification" to "False Positive" and/or "Action" to "Ignore" through the web interface:

[mhdawson]

@tniessen we already have 4-5 such comments in the code. I'm also thinking that other static analysis tools may report similar issues and having documented in the code that we believe they are ok will help us if we ever switch tools.

[mhdawson]

@tniessen looking at the remaining failures. There are a good number which are related to not initializing a structure before calling a method to initialize it. Those I think would best be handled by marking them in coverity itself instead of in the code.

For this one I'd still prefer the comment in the code as it might avoid us looking at a similar report in another tool later on.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/43125/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/43152/

[mhdawson]

Landed in d10c717