llvmbot wrote:
<!--LLVM PR SUMMARY COMMENT--> @llvm/pr-subscribers-clang Author: Vinay Deshmukh (vinay-deshmukh) <details> <summary>Changes</summary> Resolves #<!-- -->100762 Gist of the change: 1. All the symbol analysis, constraint manager and expression parsing logic was already present, but the previous code didn't "visit" the expressions within `assume()` by parsing those expressions, all of the code "just works" by evaluating the SVals, and hence leaning on the same logic that makes the code with `__builtin_assume` work --- Full diff: https://github.com/llvm/llvm-project/pull/116462.diff 5 Files Affected: - (modified) clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h (+4) - (modified) clang/lib/Analysis/CFG.cpp (+43) - (modified) clang/lib/StaticAnalyzer/Core/ExprEngine.cpp (+7-1) - (modified) clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp (+27) - (modified) clang/test/Analysis/out-of-bounds-new.cpp (+16) ``````````diff diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h index 8c7493e27fcaa6..078a1d840d0516 100644 --- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h +++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h @@ -498,6 +498,10 @@ class ExprEngine { void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst); + /// VisitAttributedStmt - Transfer function logic for AttributedStmt + void VisitAttributedStmt(const AttributedStmt *A, ExplodedNode *Pred, + ExplodedNodeSet &Dst); + /// VisitLogicalExpr - Transfer function logic for '&&', '||' void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred, ExplodedNodeSet &Dst); diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp index f678ac6f2ff36a..fab10f51cf5cfc 100644 --- a/clang/lib/Analysis/CFG.cpp +++ b/clang/lib/Analysis/CFG.cpp @@ -456,6 +456,36 @@ reverse_children::reverse_children(Stmt *S) { IE->getNumInits()); return; } + case Stmt::AttributedStmtClass: { + AttributedStmt *attrStmt = cast<AttributedStmt>(S); + assert(attrStmt); + + { + // for an attributed stmt, the "children()" returns only the NullStmt + // (;) but semantically the "children" are supposed to be the + // expressions _within_ i.e. the two square brackets i.e. [[ HERE ]] + // so we add the subexpressions first, _then_ add the "children" + + for (const Attr *attr : attrStmt->getAttrs()) { + + // i.e. one `assume()` + CXXAssumeAttr const *assumeAttr = llvm::dyn_cast<CXXAssumeAttr>(attr); + if (!assumeAttr) { + continue; + } + // Only handles [[ assume(<assumption>) ]] right now + Expr *assumption = assumeAttr->getAssumption(); + childrenBuf.push_back(assumption); + } + + // children() for an AttributedStmt is NullStmt(;) + llvm::append_range(childrenBuf, attrStmt->children()); + + // This needs to be done *after* childrenBuf has been populated. + children = childrenBuf; + } + return; + } default: break; } @@ -2475,6 +2505,14 @@ static bool isFallthroughStatement(const AttributedStmt *A) { return isFallthrough; } +static bool isCXXAssumeAttr(const AttributedStmt *A) { + bool hasAssumeAttr = hasSpecificAttr<CXXAssumeAttr>(A->getAttrs()); + + assert((!hasAssumeAttr || isa<NullStmt>(A->getSubStmt())) && + "expected [[assume]] not to have children"); + return hasAssumeAttr; +} + CFGBlock *CFGBuilder::VisitAttributedStmt(AttributedStmt *A, AddStmtChoice asc) { // AttributedStmts for [[likely]] can have arbitrary statements as children, @@ -2490,6 +2528,11 @@ CFGBlock *CFGBuilder::VisitAttributedStmt(AttributedStmt *A, appendStmt(Block, A); } + if (isCXXAssumeAttr(A) && asc.alwaysAdd(*this, A)) { + autoCreateBlock(); + appendStmt(Block, A); + } + return VisitChildren(A); } diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp index 22eab9f66418d4..cbc83f1dbda145 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -1946,7 +1946,6 @@ void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, // to be explicitly evaluated. case Stmt::PredefinedExprClass: case Stmt::AddrLabelExprClass: - case Stmt::AttributedStmtClass: case Stmt::IntegerLiteralClass: case Stmt::FixedPointLiteralClass: case Stmt::CharacterLiteralClass: @@ -1977,6 +1976,13 @@ void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, break; } + case Stmt::AttributedStmtClass: { + Bldr.takeNodes(Pred); + VisitAttributedStmt(cast<AttributedStmt>(S), Pred, Dst); + Bldr.addNodes(Dst); + break; + } + case Stmt::CXXDefaultArgExprClass: case Stmt::CXXDefaultInitExprClass: { Bldr.takeNodes(Pred); diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp index f7020da2e6da20..1a211d1adc44f7 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp @@ -1200,3 +1200,30 @@ void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, // FIXME: Move all post/pre visits to ::Visit(). getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this); } + +void ExprEngine::VisitAttributedStmt(const AttributedStmt *A, + ExplodedNode *Pred, ExplodedNodeSet &Dst) { + + ExplodedNodeSet CheckerPreStmt; + getCheckerManager().runCheckersForPreStmt(CheckerPreStmt, Pred, A, *this); + + ExplodedNodeSet EvalSet; + StmtNodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx); + + { + for (const auto *attr : A->getAttrs()) { + + CXXAssumeAttr const *assumeAttr = llvm::dyn_cast<CXXAssumeAttr>(attr); + if (!assumeAttr) { + continue; + } + Expr *AssumeExpr = assumeAttr->getAssumption(); + + for (auto *node : CheckerPreStmt) { + Visit(AssumeExpr, node, EvalSet); + } + } + } + + getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, A, *this); +} diff --git a/clang/test/Analysis/out-of-bounds-new.cpp b/clang/test/Analysis/out-of-bounds-new.cpp index f541bdf810d79c..4db351b10055b1 100644 --- a/clang/test/Analysis/out-of-bounds-new.cpp +++ b/clang/test/Analysis/out-of-bounds-new.cpp @@ -180,3 +180,19 @@ int test_reference_that_might_be_after_the_end(int idx) { return ref; } +// From: https://github.com/llvm/llvm-project/issues/100762 +extern int arr[10]; +void using_builtin(int x) { + __builtin_assume(x > 101); // CallExpr + arr[x] = 404; // expected-warning{{Out of bound access to memory}} +} + +void using_assume_attr(int ax) { + [[assume(ax > 100)]]; // NullStmt with an attribute + arr[ax] = 405; // expected-warning{{Out of bound access to memory}} +} + +void using_many_assume_attr(int yx) { + [[assume(yx > 104), assume(yx > 200), assume(yx < 300)]]; // NullStmt with an attribute + arr[yx] = 406; // expected-warning{{Out of bound access to memory}} +} `````````` </details> https://github.com/llvm/llvm-project/pull/116462 _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
