NoQ updated this revision to Diff 179228. NoQ added a comment. Add a few more tests, just in case.
CHANGES SINCE LAST ACTION https://reviews.llvm.org/D55875/new/ https://reviews.llvm.org/D55875 Files: include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h lib/StaticAnalyzer/Core/SVals.cpp lib/StaticAnalyzer/Core/Store.cpp test/Analysis/casts.c
Index: test/Analysis/casts.c =================================================================== --- test/Analysis/casts.c +++ test/Analysis/casts.c @@ -213,3 +213,35 @@ } #endif + +char no_crash_SymbolCast_of_float_type_aux(int *p) { + *p += 1; + return *p; +} + +void no_crash_SymbolCast_of_float_type() { + extern float x; + char (*f)() = no_crash_SymbolCast_of_float_type_aux; + f(&x); +} + +double no_crash_reinterpret_double_as_int(double a) { + *(int *)&a = 1; + return a * a; +} + +double no_crash_reinterpret_double_as_ptr(double a) { + *(void **)&a = 0; + return a * a; +} + +double no_crash_reinterpret_double_as_sym_int(double a, int b) { + *(int *)&a = b; + return a * a; +} + +double no_crash_reinterpret_double_as_sym_ptr(double a, void * b) { + *(void **)&a = b; + return a * a; +} + Index: lib/StaticAnalyzer/Core/Store.cpp =================================================================== --- lib/StaticAnalyzer/Core/Store.cpp +++ lib/StaticAnalyzer/Core/Store.cpp @@ -394,14 +394,29 @@ return UnknownVal(); } +static bool isScalarEnoughToAttemptACast(QualType T) { + return T->isIntegralOrEnumerationType() || Loc::isLocType(T); +} + /// CastRetrievedVal - Used by subclasses of StoreManager to implement /// implicit casts that arise from loads from regions that are reinterpreted /// as another region. SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R, - QualType castTy) { - if (castTy.isNull() || V.isUnknownOrUndef()) + QualType CastTy) { + if (CastTy.isNull() || V.isUnknownOrUndef()) + return V; + + QualType OrigTy = V.detectType(StateMgr.getContext()); + if (OrigTy.isNull()) return V; + if (!isScalarEnoughToAttemptACast(OrigTy) || + !isScalarEnoughToAttemptACast(CastTy)) { + if (OrigTy.getUnqualifiedType() == CastTy.getUnqualifiedType()) + return V; + return UnknownVal(); + } + // When retrieving symbolic pointer and expecting a non-void pointer, // wrap them into element regions of the expected type if necessary. // SValBuilder::dispatchCast() doesn't do that, but it is necessary to @@ -410,13 +425,13 @@ // We might need to do that for non-void pointers as well. // FIXME: We really need a single good function to perform casts for us // correctly every time we need it. - if (castTy->isPointerType() && !castTy->isVoidPointerType()) + if (CastTy->isPointerType() && !CastTy->isVoidPointerType()) if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(V.getAsRegion())) if (SR->getSymbol()->getType().getCanonicalType() != - castTy.getCanonicalType()) - return loc::MemRegionVal(castRegion(SR, castTy)); + CastTy.getCanonicalType()) + return loc::MemRegionVal(castRegion(SR, CastTy)); - return svalBuilder.dispatchCast(V, castTy); + return svalBuilder.dispatchCast(V, CastTy); } SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) { Index: lib/StaticAnalyzer/Core/SVals.cpp =================================================================== --- lib/StaticAnalyzer/Core/SVals.cpp +++ lib/StaticAnalyzer/Core/SVals.cpp @@ -21,6 +21,7 @@ #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h" #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/Optional.h" @@ -185,6 +186,59 @@ return DD; } +namespace { +class TypeDetector : public SValVisitor<TypeDetector, QualType> { + ASTContext &ACtx; + +public: + TypeDetector(ASTContext &ACtx): ACtx(ACtx) {} + + QualType VisitSVal(SVal V) { return QualType(); } + + QualType VisitNonLocSymbolVal(nonloc::SymbolVal V) { + return V.getSymbol()->getType(); + } + + QualType VisitLocMemRegionVal(loc::MemRegionVal V) { + if (const auto *TR = dyn_cast<TypedRegion>(V.getRegion())) + return TR->getLocationType(); + else + return ACtx.VoidPtrTy; + } + + QualType VisitNonLocConcreteInt(nonloc::ConcreteInt V) { + const llvm::APSInt &I = V.getValue(); + return ACtx.getIntTypeForBitwidth(I.getBitWidth(), I.isSigned()); + } + + QualType VisitLocConcreteInt(loc::ConcreteInt V) { + return ACtx.VoidPtrTy; + } + + QualType VisitNonLocLocAsInteger(nonloc::LocAsInteger V) { + // FIXME: This returns an unsigned type because LocAsInteger + // does not remember what is the correct type. + return ACtx.getIntTypeForBitwidth(V.getNumBits(), false); + } + + QualType VisitNonLocCompoundVal(nonloc::CompoundVal V) { + return V.getValue()->getType(); + } + + QualType VisitNonLocLazyCompoundVal(nonloc::LazyCompoundVal V) { + if (const auto *TVR = dyn_cast<TypedValueRegion>(V.getRegion())) + return TVR->getValueType(); + return QualType(); + } + + // TODO: VisitNonLocPointerToMember! +}; +} + +QualType SVal::detectType(ASTContext &ACtx) const { + return TypeDetector(ACtx).Visit(*this); +} + //===----------------------------------------------------------------------===// // Other Iterators. //===----------------------------------------------------------------------===// Index: include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h =================================================================== --- include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h +++ include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h @@ -205,6 +205,8 @@ SymExpr::symbol_iterator symbol_end() const { return SymExpr::symbol_end(); } + + QualType detectType(ASTContext &ACtx) const; }; inline raw_ostream &operator<<(raw_ostream &os, clang::ento::SVal V) { Index: include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h =================================================================== --- include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h +++ include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h @@ -53,6 +53,8 @@ iterator begin() const { return L.begin(); } iterator end() const { return L.end(); } + QualType getType() const { return T; } + static void Profile(llvm::FoldingSetNodeID& ID, QualType T, llvm::ImmutableList<SVal> L);
_______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits