This revision was automatically updated to reflect the committed changes.
Closed by commit rGa6816b957d28: [analyzer][solver] Fix assertion on (NonLoc,
Op, Loc) expressions (authored by steakhal).
Herald added a project: clang.
Herald added a subscriber: cfe-commits.
Repository:
rG LLVM Github Monorepo
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D115149/new/
https://reviews.llvm.org/D115149
Files:
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp
clang/test/Analysis/symbol-simplification-nonloc-loc.cpp
Index: clang/test/Analysis/symbol-simplification-nonloc-loc.cpp
===================================================================
--- /dev/null
+++ clang/test/Analysis/symbol-simplification-nonloc-loc.cpp
@@ -0,0 +1,77 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core %s \
+// RUN: -triple x86_64-pc-linux-gnu -verify
+
+#define BINOP(OP) [](auto x, auto y) { return x OP y; }
+
+template <typename BinOp>
+void nonloc_OP_loc(int *p, BinOp op) {
+ long p_as_integer = (long)p;
+ if (op(12, p_as_integer) != 11)
+ return;
+
+ // Perfectly constrain 'p', thus 'p_as_integer', and trigger a simplification
+ // of the previously recorded constraint.
+ if (p) {
+ // no-crash
+ }
+ if (p == (int *)0x404) {
+ // no-crash
+ }
+}
+
+// Same as before, but the operands are swapped.
+template <typename BinOp>
+void loc_OP_nonloc(int *p, BinOp op) {
+ long p_as_integer = (long)p;
+ if (op(p_as_integer, 12) != 11)
+ return;
+
+ if (p) {
+ // no-crash
+ }
+ if (p == (int *)0x404) {
+ // no-crash
+ }
+}
+
+void instantiate_tests_for_nonloc_OP_loc(int *p) {
+ // Multiplicative and additive operators:
+ nonloc_OP_loc(p, BINOP(*));
+ nonloc_OP_loc(p, BINOP(/)); // no-crash
+ nonloc_OP_loc(p, BINOP(%)); // no-crash
+ nonloc_OP_loc(p, BINOP(+));
+ nonloc_OP_loc(p, BINOP(-)); // no-crash
+
+ // Bitwise operators:
+ // expected-warning@+2 {{The result of the left shift is undefined due to shifting by '1028', which is greater or equal to the width of type 'int' [core.UndefinedBinaryOperatorResult]}}
+ // expected-warning@+2 {{The result of the right shift is undefined due to shifting by '1028', which is greater or equal to the width of type 'int' [core.UndefinedBinaryOperatorResult]}}
+ nonloc_OP_loc(p, BINOP(<<)); // no-crash
+ nonloc_OP_loc(p, BINOP(>>)); // no-crash
+ nonloc_OP_loc(p, BINOP(&));
+ nonloc_OP_loc(p, BINOP(^));
+ nonloc_OP_loc(p, BINOP(|));
+}
+
+void instantiate_tests_for_loc_OP_nonloc(int *p) {
+ // Multiplicative and additive operators:
+ loc_OP_nonloc(p, BINOP(*));
+ loc_OP_nonloc(p, BINOP(/));
+ loc_OP_nonloc(p, BINOP(%));
+ loc_OP_nonloc(p, BINOP(+));
+ loc_OP_nonloc(p, BINOP(-));
+
+ // Bitwise operators:
+ loc_OP_nonloc(p, BINOP(<<));
+ loc_OP_nonloc(p, BINOP(>>));
+ loc_OP_nonloc(p, BINOP(&));
+ loc_OP_nonloc(p, BINOP(^));
+ loc_OP_nonloc(p, BINOP(|));
+}
+
+// from: nullptr.cpp
+void zoo1backwards() {
+ char **p = nullptr;
+ // expected-warning@+1 {{Dereference of null pointer [core.NullDereference]}}
+ *(0 + p) = nullptr; // warn
+ **(0 + p) = 'a'; // no-warning: this should be unreachable
+}
Index: clang/lib/StaticAnalyzer/Core/SValBuilder.cpp
===================================================================
--- clang/lib/StaticAnalyzer/Core/SValBuilder.cpp
+++ clang/lib/StaticAnalyzer/Core/SValBuilder.cpp
@@ -459,13 +459,23 @@
return evalBinOpLN(state, op, *LV, rhs.castAs<NonLoc>(), type);
}
- if (Optional<Loc> RV = rhs.getAs<Loc>()) {
- // Support pointer arithmetic where the addend is on the left
- // and the pointer on the right.
- assert(op == BO_Add);
+ if (const Optional<Loc> RV = rhs.getAs<Loc>()) {
+ const auto IsCommutative = [](BinaryOperatorKind Op) {
+ return Op == BO_Mul || Op == BO_Add || Op == BO_And || Op == BO_Xor ||
+ Op == BO_Or;
+ };
+
+ if (IsCommutative(op)) {
+ // Swap operands.
+ return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
+ }
- // Commute the operands.
- return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
+ // If the right operand is a concrete int location then we have nothing
+ // better but to treat it as a simple nonloc.
+ if (auto RV = rhs.getAs<loc::ConcreteInt>()) {
+ const nonloc::ConcreteInt RhsAsLoc = makeIntVal(RV->getValue());
+ return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), RhsAsLoc, type);
+ }
}
return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), rhs.castAs<NonLoc>(),
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
