silence some scan-build warnings (no bugs indicated), mark a few places with SCANBUILD when the scan-build warning is not actually relevant but it's not easy to silence either

src/duk_api.c

@@ -1822,6 +1822,10 @@ void *duk_to_buffer(duk_context *ctx, int index, size_t *out_size) {
 
 	h_buf = duk_get_hbuffer(ctx, index);
 	DUK_ASSERT(h_buf != NULL);
+	/* SCANBUILD: scan-build produces a NULL pointer dereference warning
+	 * below; it never actually triggers because h_buf is actually never
+	 * NULL.
+	 */
 
 	if (out_size) {
 		*out_size = DUK_HBUFFER_GET_SIZE(h_buf);

src/duk_bi_json.c

@@ -1356,9 +1356,6 @@ static int duk__enc_value1(duk_json_enc_ctx *js_ctx, int idx_holder) {
 
 	DUK_DDDPRINT("value=%!T", duk_get_tval(ctx, -1));
 
-	tv = duk_get_tval(ctx, -1);
-	DUK_ASSERT(tv != NULL);
-
 	if (duk_check_type_mask(ctx, -1, js_ctx->mask_for_undefined)) {
 		/* will result in undefined */
 		DUK_DDDPRINT("-> will result in undefined (type mask check)");

src/duk_heap_stringcache.c

@@ -153,7 +153,7 @@ duk_uint32_t duk_heap_strcache_offset_char2byte(duk_hthread *thr, duk_hstring *h
 	DUK_ASSERT(DUK_HSTRING_GET_CHARLEN(h) >= char_offset);
 	dist_start = char_offset;
 	dist_end = DUK_HSTRING_GET_CHARLEN(h) - char_offset;
-	dist_sce = 0;  /* initialize for debug prints, needed if sce==NULL */
+	dist_sce = 0; DUK_UNREF(dist_sce);  /* initialize for debug prints, needed if sce==NULL */
 
 	p_start = (duk_uint8_t *) DUK_HSTRING_GET_DATA(h);
 	p_end = (duk_uint8_t *) (p_start + DUK_HSTRING_GET_BYTELEN(h));

src/duk_hobject_props.c

@@ -1479,6 +1479,11 @@ static int duk__get_own_property_desc_raw(duk_hthread *thr, duk_hobject *obj, du
 
 			h_val = duk_hobject_get_internal_value_buffer(thr->heap, obj);
 			DUK_ASSERT(h_val);
+			/* SCANBUILD: h_val is known to be non-NULL but scan-build cannot
+			 * know it, so it produces NULL pointer dereference warnings for
+			 * 'h_val'.
+			 */
+
 			if (arr_idx < DUK_HBUFFER_GET_SIZE(h_val)) {
 				DUK_DDDPRINT("-> found, array index inside buffer");
 				if (push_value) {
@@ -3887,18 +3892,24 @@ int duk_hobject_object_define_property(duk_context *ctx) {
 	DUK_DDDPRINT("Object.defineProperty(): thr=%p obj=%!O key=%!O arr_idx=0x%08x desc=%!O",
 	             (void *) thr, (duk_heaphdr *) obj, (duk_heaphdr *) key, (int) arr_idx, (duk_heaphdr *) desc);
 
-	has_enumerable = 0;
-	has_configurable = 0;
-	has_value = 0;
-	has_writable = 0;
-	has_get = 0;
-	has_set = 0;
-	is_enumerable = 0;
-	is_configurable = 0;
-	is_writable = 0;
-	idx_value = -1;
-	get = NULL;
-	set = NULL;
+	/* Many of the above are just assigned over but are given base values to
+	 * avoid warnings with some compilers.  But because the values are unused,
+	 * scan-build will complain about them; silence with DUK_UNREF().
+	 */
+
+	has_enumerable = 0; DUK_UNREF(has_enumerable);
+	has_configurable = 0; DUK_UNREF(has_configurable);
+	has_value = 0; DUK_UNREF(has_value);
+	has_writable = 0; DUK_UNREF(has_writable);
+	has_get = 0; DUK_UNREF(has_get);
+	has_set = 0; DUK_UNREF(has_set);
+	is_enumerable = 0; DUK_UNREF(is_enumerable);
+	is_configurable = 0; DUK_UNREF(is_configurable);
+	is_writable = 0; DUK_UNREF(is_writable);
+	idx_value = -1; DUK_UNREF(idx_value);
+	get = NULL; DUK_UNREF(get);
+	set = NULL; DUK_UNREF(set);
+
 	arridx_new_array_length = 0;
 	pending_write_protect = 0;
 	arrlen_old_len = 0;

src/duk_hthread_stacks.c

@@ -270,6 +270,7 @@ void duk_hthread_callstack_unwind(duk_hthread *thr, int new_top) {
 #ifdef DUK_USE_REFERENCE_COUNTING
 		DUK_HOBJECT_DECREF(thr, tmp);
 		p = &thr->callstack[idx];  /* avoid side effect issues */
+		DUK_UNREF(p);
 #endif
 	}
 

src/duk_js_call.c

@@ -911,8 +911,14 @@ int duk_handle_call(duk_hthread *thr,
 	duk__coerce_effective_this_binding(thr, func, idx_func + 1);
 	DUK_DDDPRINT("effective 'this' binding is: %!T", duk_get_tval(ctx, idx_func + 1));
 
-	nargs = 0;
-	nregs = 0;
+	/* These base values are never used, but if the compiler doesn't know
+	 * that DUK_ERROR() won't return, these are needed to silence warnings.
+	 * On the other hand, scan-build will warn about the values not being
+	 * used, so add a DUK_UNREF.
+	 */
+	nargs = 0; DUK_UNREF(nargs);
+	nregs = 0; DUK_UNREF(nregs);
+
 	if (DUK_HOBJECT_IS_COMPILEDFUNCTION(func)) {
 		nargs = ((duk_hcompiledfunction *) func)->nargs;
 		nregs = ((duk_hcompiledfunction *) func)->nregs;
@@ -1883,6 +1889,7 @@ void duk_handle_ecma_call_setup(duk_hthread *thr,
 		             thr->callstack_top - 1);
 
 		act = thr->callstack + thr->callstack_top - 1;
+		DUK_UNREF(act);  /* unreferenced unless assertions used */
 
 		DUK_ASSERT(!DUK_HOBJECT_HAS_BOUND(func));
 		DUK_ASSERT(!DUK_HOBJECT_HAS_NATIVEFUNCTION(func));
@@ -1960,7 +1967,7 @@ void duk_handle_ecma_call_setup(duk_hthread *thr,
 			 */
 			duk_remove(ctx, 0);
 		}
-		idx_func = 0;  /* really 'not applicable' anymore, should not be referenced after this */
+		idx_func = 0; DUK_UNREF(idx_func);  /* really 'not applicable' anymore, should not be referenced after this */
 		idx_args = 0;
 
 		/* [ ... this_new | arg1 ... argN ] */

src/duk_js_compiler.c

@@ -2188,6 +2188,7 @@ static void duk__add_label(duk_compiler_ctx *comp_ctx, duk_hstring *h_label, int
 	/* relookup after possible realloc */
 	p = (char *) DUK_HBUFFER_DYNAMIC_GET_CURR_DATA_PTR(comp_ctx->curr_func.h_labelinfos);
 	li_start = (duk_labelinfo *) p;
+	DUK_UNREF(li_start);  /* silence scan-build warning */
 	li = (duk_labelinfo *) (p + DUK_HBUFFER_GET_SIZE(comp_ctx->curr_func.h_labelinfos));
 	li--;
 

src/duk_js_executor.c

@@ -588,6 +588,7 @@ static void duk__handle_catch_or_finally(duk_hthread *thr, int cat_idx, int is_f
 		DUK_ASSERT(act->lex_env != NULL);
 		DUK_ASSERT(act->var_env != NULL);
 		DUK_ASSERT(act->func != NULL);
+		DUK_UNREF(act);  /* unreferenced without assertions */
 
 		act = thr->callstack + thr->callstack_top - 1;
 		act_lex_env = act->lex_env;

src/duk_js_var.c

@@ -1589,6 +1589,10 @@ static int duk__declvar_helper(duk_hthread *thr,
 		}
 		DUK_ASSERT(holder != NULL);
 		DUK_ASSERT(e_idx >= 0);
+		/* SCANBUILD: scan-build produces a NULL pointer dereference warning
+		 * below; it never actually triggers because holder is actually never
+		 * NULL.
+		 */
 
 		/* ref.holder is global object, holder is the object with the
 		 * conflicting property.

src/duk_lexer.c

@@ -1671,6 +1671,7 @@ void duk_lexer_parse_re_ranges(duk_lexer_ctx *lex_ctx, duk_re_range_callback gen
 		DUK__ADVANCE(lex_ctx, 1);
 
 		ch = -1;  /* not strictly necessary, but avoids "uninitialized variable" warnings */
+		DUK_UNREF(ch);
 
 		if (x < 0) {
 			DUK_ERROR(lex_ctx->thr, DUK_ERR_SYNTAX_ERROR,

src/duk_regexp_compiler.c

@@ -396,6 +396,7 @@ static void duk__parse_disjunction(duk_re_compiler_ctx *re_ctx, int expect_eof,
 					offset += duk__insert_u32(re_ctx, offset, qmax);
 					offset += duk__insert_jump_offset(re_ctx, offset, atom_code_length);
 				}
+				DUK_UNREF(offset);  /* silence scan-build warning */
 			} else {
 				/*
 				 *  Complex atom

src/duk_unicode_support.c

@@ -874,7 +874,7 @@ void duk_unicode_case_convert_string(duk_hthread *thr, duk_small_int_t uppercase
 	p_end = p_start + DUK_HSTRING_GET_BYTELEN(h_input);
 	p = p_start;
 
-	prev = -1;
+	prev = -1; DUK_UNREF(prev);
 	curr = -1;
 	next = -1;
 	for (;;) {