Author: alexshap Date: Mon Aug 28 14:15:21 2017 New Revision: 311935 URL: http://llvm.org/viewvc/llvm-project?rev=311935&view=rev Log: [analyzer] Fix crash in modeling arithmetic
This diff fixes modeling of arithmetic expressions where pointers are treated as integers (i.e. via C-style / reinterpret casts). For now we return UnknownVal unless the operation is a comparison. Test plan: make check-all Differential revision: https://reviews.llvm.org/D37120 Modified: cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp cfe/trunk/test/Analysis/ptr-arith.cpp Modified: cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp?rev=311935&r1=311934&r2=311935&view=diff ============================================================================== --- cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp (original) +++ cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp Mon Aug 28 14:15:21 2017 @@ -360,10 +360,18 @@ SVal SimpleSValBuilder::evalBinOpNN(Prog Loc lhsL = lhs.castAs<nonloc::LocAsInteger>().getLoc(); switch (rhs.getSubKind()) { case nonloc::LocAsIntegerKind: + // FIXME: at the moment the implementation + // of modeling "pointers as integers" is not complete. + if (!BinaryOperator::isComparisonOp(op)) + return UnknownVal(); return evalBinOpLL(state, op, lhsL, rhs.castAs<nonloc::LocAsInteger>().getLoc(), resultTy); case nonloc::ConcreteIntKind: { + // FIXME: at the moment the implementation + // of modeling "pointers as integers" is not complete. + if (!BinaryOperator::isComparisonOp(op)) + return UnknownVal(); // Transform the integer into a location and compare. // FIXME: This only makes sense for comparisons. If we want to, say, // add 1 to a LocAsInteger, we'd better unpack the Loc and add to it, Modified: cfe/trunk/test/Analysis/ptr-arith.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/ptr-arith.cpp?rev=311935&r1=311934&r2=311935&view=diff ============================================================================== --- cfe/trunk/test/Analysis/ptr-arith.cpp (original) +++ cfe/trunk/test/Analysis/ptr-arith.cpp Mon Aug 28 14:15:21 2017 @@ -105,3 +105,9 @@ unsigned ptrSubtractionNoCrash(char *Beg return 0; return N; } + +// Bug 34309 +bool ptrAsIntegerSubtractionNoCrash(long x, char *p) { + long y = (long)p - 1; + return y == x; +} _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
