ExprResolveModMask(struct xkb_context *ctx, const ExprDef *expr,
                   enum mod_type mod_type, const struct xkb_mod_set *mods,
                   xkb_mod_mask_t *mask_rtrn)
{
    LookupModMaskPriv priv = { .mods = mods, .mod_type = mod_type };
    return ExprResolveMaskLookup(ctx, expr, mask_rtrn, LookupModMask, &priv);
}

The product dereferences a pointer that it expects to be valid but is NULL.