Author: dergachev Date: Wed Aug 17 10:37:52 2016 New Revision: 278937 URL: http://llvm.org/viewvc/llvm-project?rev=278937&view=rev Log: [analyzer] Add LocationContext information to SymbolMetadata.
Like SymbolConjured, SymbolMetadata also needs to be uniquely identified by the moment of its birth. Such moments are coded by the (Statement, LocationContext, Block count) triples. Each such triple represents the moment of analyzing a statement with a certain call backtrace, with corresponding CFG block having been entered a given amount of times during analysis of the current code body. The LocationContext information was accidentally omitted for SymbolMetadata, which leads to reincarnation of SymbolMetadata upon re-entering a code body with a different backtrace; the new symbol is incorrectly unified with the old symbol, which leads to unsound assumptions. Patch by Alexey Sidorin! Differential Revision: https://reviews.llvm.org/D21978 Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h cfe/trunk/lib/StaticAnalyzer/Checkers/CStringChecker.cpp cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp cfe/trunk/lib/StaticAnalyzer/Core/SymbolManager.cpp cfe/trunk/test/Analysis/string.c Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h?rev=278937&r1=278936&r2=278937&view=diff ============================================================================== --- cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h (original) +++ cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h Wed Aug 17 10:37:52 2016 @@ -198,9 +198,11 @@ public: DefinedOrUnknownSVal getDerivedRegionValueSymbolVal( SymbolRef parentSymbol, const TypedValueRegion *region); - DefinedSVal getMetadataSymbolVal( - const void *symbolTag, const MemRegion *region, - const Expr *expr, QualType type, unsigned count); + DefinedSVal getMetadataSymbolVal(const void *symbolTag, + const MemRegion *region, + const Expr *expr, QualType type, + const LocationContext *LCtx, + unsigned count); DefinedSVal getFunctionPointer(const FunctionDecl *func); Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h?rev=278937&r1=278936&r2=278937&view=diff ============================================================================== --- cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h (original) +++ cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h Wed Aug 17 10:37:52 2016 @@ -186,15 +186,18 @@ class SymbolMetadata : public SymbolData const MemRegion* R; const Stmt *S; QualType T; + const LocationContext *LCtx; unsigned Count; const void *Tag; public: SymbolMetadata(SymbolID sym, const MemRegion* r, const Stmt *s, QualType t, - unsigned count, const void *tag) - : SymbolData(SymbolMetadataKind, sym), R(r), S(s), T(t), Count(count), Tag(tag) {} + const LocationContext *LCtx, unsigned count, const void *tag) + : SymbolData(SymbolMetadataKind, sym), R(r), S(s), T(t), LCtx(LCtx), + Count(count), Tag(tag) {} const MemRegion *getRegion() const { return R; } const Stmt *getStmt() const { return S; } + const LocationContext *getLocationContext() const { return LCtx; } unsigned getCount() const { return Count; } const void *getTag() const { return Tag; } @@ -203,18 +206,19 @@ public: void dumpToStream(raw_ostream &os) const override; static void Profile(llvm::FoldingSetNodeID& profile, const MemRegion *R, - const Stmt *S, QualType T, unsigned Count, - const void *Tag) { + const Stmt *S, QualType T, const LocationContext *LCtx, + unsigned Count, const void *Tag) { profile.AddInteger((unsigned) SymbolMetadataKind); profile.AddPointer(R); profile.AddPointer(S); profile.Add(T); + profile.AddPointer(LCtx); profile.AddInteger(Count); profile.AddPointer(Tag); } void Profile(llvm::FoldingSetNodeID& profile) override { - Profile(profile, R, S, T, Count, Tag); + Profile(profile, R, S, T, LCtx, Count, Tag); } // Implement isa<T> support. @@ -435,7 +439,9 @@ public: /// VisitCount can be used to differentiate regions corresponding to /// different loop iterations, thus, making the symbol path-dependent. const SymbolMetadata *getMetadataSymbol(const MemRegion *R, const Stmt *S, - QualType T, unsigned VisitCount, + QualType T, + const LocationContext *LCtx, + unsigned VisitCount, const void *SymbolTag = nullptr); const SymbolCast* getCastSymbol(const SymExpr *Operand, Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/CStringChecker.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/CStringChecker.cpp?rev=278937&r1=278936&r2=278937&view=diff ============================================================================== --- cfe/trunk/lib/StaticAnalyzer/Checkers/CStringChecker.cpp (original) +++ cfe/trunk/lib/StaticAnalyzer/Checkers/CStringChecker.cpp Wed Aug 17 10:37:52 2016 @@ -685,6 +685,7 @@ SVal CStringChecker::getCStringLengthFor QualType sizeTy = svalBuilder.getContext().getSizeType(); SVal strLength = svalBuilder.getMetadataSymbolVal(CStringChecker::getTag(), MR, Ex, sizeTy, + C.getLocationContext(), C.blockCount()); if (!hypothetical) { Modified: cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp?rev=278937&r1=278936&r2=278937&view=diff ============================================================================== --- cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp (original) +++ cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp Wed Aug 17 10:37:52 2016 @@ -182,11 +182,12 @@ SValBuilder::getConjuredHeapSymbolVal(co DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, + const LocationContext *LCtx, unsigned count) { assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type"); SymbolRef sym = - SymMgr.getMetadataSymbol(region, expr, type, count, symbolTag); + SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); Modified: cfe/trunk/lib/StaticAnalyzer/Core/SymbolManager.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/SymbolManager.cpp?rev=278937&r1=278936&r2=278937&view=diff ============================================================================== --- cfe/trunk/lib/StaticAnalyzer/Core/SymbolManager.cpp (original) +++ cfe/trunk/lib/StaticAnalyzer/Core/SymbolManager.cpp Wed Aug 17 10:37:52 2016 @@ -216,17 +216,18 @@ SymbolManager::getExtentSymbol(const Sub return cast<SymbolExtent>(SD); } -const SymbolMetadata* +const SymbolMetadata * SymbolManager::getMetadataSymbol(const MemRegion* R, const Stmt *S, QualType T, + const LocationContext *LCtx, unsigned Count, const void *SymbolTag) { llvm::FoldingSetNodeID profile; - SymbolMetadata::Profile(profile, R, S, T, Count, SymbolTag); + SymbolMetadata::Profile(profile, R, S, T, LCtx, Count, SymbolTag); void *InsertPos; SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos); if (!SD) { SD = (SymExpr*) BPAlloc.Allocate<SymbolMetadata>(); - new (SD) SymbolMetadata(SymbolCounter, R, S, T, Count, SymbolTag); + new (SD) SymbolMetadata(SymbolCounter, R, S, T, LCtx, Count, SymbolTag); DataSet.InsertNode(SD, InsertPos); ++SymbolCounter; } Modified: cfe/trunk/test/Analysis/string.c URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/string.c?rev=278937&r1=278936&r2=278937&view=diff ============================================================================== --- cfe/trunk/test/Analysis/string.c (original) +++ cfe/trunk/test/Analysis/string.c Wed Aug 17 10:37:52 2016 @@ -154,6 +154,23 @@ void strlen_liveness(const char *x) { clang_analyzer_eval(strlen(x) < 5); // expected-warning{{FALSE}} } + +size_t strlenWrapper(const char *str) { + return strlen(str); +} + +extern void invalidate(char *s); + +void testStrlenCallee() { + char str[42]; + invalidate(str); + size_t lenBefore = strlenWrapper(str); + invalidate(str); + size_t lenAfter = strlenWrapper(str); + clang_analyzer_eval(lenBefore == lenAfter); // expected-warning{{UNKNOWN}} +} + + //===----------------------------------------------------------------------=== // strnlen() //===----------------------------------------------------------------------=== _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
