Author: Kinuko Yasuda Date: 2023-09-08T10:24:08-04:00 New Revision: 8e1d2f2f12243d284b729174fc0720052ea5518c
URL: https://github.com/llvm/llvm-project/commit/8e1d2f2f12243d284b729174fc0720052ea5518c DIFF: https://github.com/llvm/llvm-project/commit/8e1d2f2f12243d284b729174fc0720052ea5518c.diff LOG: [clang][dataflow] Don't crash when BlockToState is called from unreachable path (#65732) When we call `getEnvironment`, `BlockToState[BlockId]` for the block can return null even if CFCtx.isBlockReachable(B) returns true if it is called from a particular block that is marked unreachable to the block. Added: Modified: clang/lib/Analysis/FlowSensitive/Transfer.cpp clang/unittests/Analysis/FlowSensitive/TransferTest.cpp Removed: ################################################################################ diff --git a/clang/lib/Analysis/FlowSensitive/Transfer.cpp b/clang/lib/Analysis/FlowSensitive/Transfer.cpp index 67d8be392ae6053..b46c947c691b9b9 100644 --- a/clang/lib/Analysis/FlowSensitive/Transfer.cpp +++ b/clang/lib/Analysis/FlowSensitive/Transfer.cpp @@ -43,7 +43,20 @@ const Environment *StmtToEnvMap::getEnvironment(const Stmt &S) const { if (!CFCtx.isBlockReachable(*BlockIt->getSecond())) return nullptr; const auto &State = BlockToState[BlockIt->getSecond()->getBlockID()]; - assert(State); + if (!(State)) { + LLVM_DEBUG({ + // State can be null when this block is unreachable from the block that + // called this method. + bool hasUnreachableEdgeFromPred = false; + for (auto B : BlockIt->getSecond()->preds()) + if (!B) { + hasUnreachableEdgeFromPred = true; + break; + } + assert(hasUnreachableEdgeFromPred); + }); + return nullptr; + } return &State->Env; } diff --git a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp index 177970ac52a67eb..ec07555d7f33b3b 100644 --- a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp +++ b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp @@ -5853,4 +5853,24 @@ TEST(TransferTest, AnonymousStructWithReferenceField) { }); } +TEST(TransferTest, EvaluateBlockWithUnreachablePreds) { + // This is a crash repro. + // `false` block may not have been processed when we try to evalute the `||` + // after visiting `true`, because it is not necessary (and therefore the edge + // is marked unreachable). Trying to get the analysis state via + // `getEnvironment` for the subexpression still should not crash. + std::string Code = R"( + int cast(int i) { + if ((i < 0 && true) || false) { + return 0; + } + return 0; + } + )"; + runDataflow( + Code, + [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results, + ASTContext &ASTCtx) {}); +} + } // namespace _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
