Author: Gabor Marton Date: 2022-05-26T14:09:46+02:00 New Revision: 88abc50398eb26d536518270b91939ce18687305
URL: https://github.com/llvm/llvm-project/commit/88abc50398eb26d536518270b91939ce18687305 DIFF: https://github.com/llvm/llvm-project/commit/88abc50398eb26d536518270b91939ce18687305.diff LOG: [analyzer][solver] Handle UnarySymExpr in RangeConstraintSolver Fixes https://github.com/llvm/llvm-project/issues/55241 Differential Revision: https://reviews.llvm.org/D125395 Added: clang/test/Analysis/constraint_manager_negate.c clang/test/Analysis/unary-sym-expr-no-crash.c Modified: clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp clang/test/Analysis/constraint_manager_negate_difference.c clang/test/Analysis/unary-sym-expr.c Removed: ################################################################################ diff --git a/clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp b/clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp index 3d8d8aeafaec..bf535a8d0205 100644 --- a/clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp +++ b/clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp @@ -1443,30 +1443,35 @@ class SymbolicRangeInferrer return RangeFactory.deletePoint(Domain, IntType.getZeroValue()); } - // FIXME: Once SValBuilder supports unary minus, we should use SValBuilder to - // obtain the negated symbolic expression instead of constructing the - // symbol manually. This will allow us to support finding ranges of not - // only negated SymSymExpr-type expressions, but also of other, simpler - // expressions which we currently do not know how to negate. Optional<RangeSet> getRangeForNegatedSub(SymbolRef Sym) { - if (const SymSymExpr *SSE = dyn_cast<SymSymExpr>(Sym)) { + // Do not negate if the type cannot be meaningfully negated. + if (!Sym->getType()->isUnsignedIntegerOrEnumerationType() && + !Sym->getType()->isSignedIntegerOrEnumerationType()) + return llvm::None; + + const RangeSet *NegatedRange = nullptr; + SymbolManager &SymMgr = State->getSymbolManager(); + if (const auto *USE = dyn_cast<UnarySymExpr>(Sym)) { + if (USE->getOpcode() == UO_Minus) { + // Just get the operand when we negate a symbol that is already negated. + // -(-a) == a + NegatedRange = getConstraint(State, USE->getOperand()); + } + } else if (const SymSymExpr *SSE = dyn_cast<SymSymExpr>(Sym)) { if (SSE->getOpcode() == BO_Sub) { QualType T = Sym->getType(); - - // Do not negate unsigned ranges - if (!T->isUnsignedIntegerOrEnumerationType() && - !T->isSignedIntegerOrEnumerationType()) - return llvm::None; - - SymbolManager &SymMgr = State->getSymbolManager(); SymbolRef NegatedSym = SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), T); - - if (const RangeSet *NegatedRange = getConstraint(State, NegatedSym)) { - return RangeFactory.negate(*NegatedRange); - } + NegatedRange = getConstraint(State, NegatedSym); } + } else { + SymbolRef NegatedSym = + SymMgr.getUnarySymExpr(Sym, UO_Minus, Sym->getType()); + NegatedRange = getConstraint(State, NegatedSym); } + + if (NegatedRange) + return RangeFactory.negate(*NegatedRange); return llvm::None; } diff --git a/clang/test/Analysis/constraint_manager_negate.c b/clang/test/Analysis/constraint_manager_negate.c new file mode 100644 index 000000000000..d955973e1911 --- /dev/null +++ b/clang/test/Analysis/constraint_manager_negate.c @@ -0,0 +1,113 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=debug.ExprInspection,core.builtin \ +// RUN: -analyzer-config eagerly-assume=false \ +// RUN: -verify %s + +void clang_analyzer_eval(int); +void clang_analyzer_dump(int); + +void exit(int); + +#define UINT_MIN (0U) +#define UINT_MAX (~UINT_MIN) +#define UINT_MID (UINT_MAX / 2 + 1) +#define INT_MAX (UINT_MAX & (UINT_MAX >> 1)) +#define INT_MIN (UINT_MAX & ~(UINT_MAX >> 1)) + +extern void abort() __attribute__((__noreturn__)); +#define assert(expr) ((expr) ? (void)(0) : abort()) + +void negate_positive_range(int a) { + assert(-a > 0); + // -a: [1, INT_MAX] + // a: [INT_MIN + 1, -1] + clang_analyzer_eval(a < 0); // expected-warning{{TRUE}} + clang_analyzer_eval(a > INT_MIN); // expected-warning{{TRUE}} +} + +void negate_positive_range2(int a) { + assert(a > 0); + // a: [1, INT_MAX] + // -a: [INT_MIN + 1, -1] + clang_analyzer_eval(-a < 0); // expected-warning{{TRUE}} + clang_analyzer_eval(-a > INT_MIN); // expected-warning{{TRUE}} +} + +// INT_MIN equals 0b100...00. +// Its two's compelement is 0b011...11 + 1 = 0b100...00 (itself). +_Static_assert(INT_MIN == -INT_MIN, ""); +void negate_int_min(int a) { + assert(a == INT_MIN); + clang_analyzer_eval(-a == INT_MIN); // expected-warning{{TRUE}} +} + +void negate_mixed(int a) { + assert(a > 0 || a == INT_MIN); + clang_analyzer_eval(-a <= 0); // expected-warning{{TRUE}} +} + +void effective_range(int a) { + assert(a >= 0); + assert(-a >= 0); + clang_analyzer_eval(a == 0); // expected-warning{{TRUE}} + clang_analyzer_eval(-a == 0); // expected-warning{{TRUE}} +} + +_Static_assert(-INT_MIN == INT_MIN, ""); +void effective_range_2(int a) { + assert(a <= 0); + assert(-a <= 0); + clang_analyzer_eval(a == 0 || a == INT_MIN); // expected-warning{{TRUE}} +} + +void negate_symexpr(int a, int b) { + assert(3 <= a * b && a * b <= 5); + clang_analyzer_eval(-(a * b) >= -5); // expected-warning{{TRUE}} + clang_analyzer_eval(-(a * b) <= -3); // expected-warning{{TRUE}} +} + +void negate_unsigned_min(unsigned a) { + assert(a == UINT_MIN); + clang_analyzer_eval(-a == UINT_MIN); // expected-warning{{TRUE}} + clang_analyzer_eval(-a != UINT_MIN); // expected-warning{{FALSE}} + clang_analyzer_eval(-a > UINT_MIN); // expected-warning{{FALSE}} + clang_analyzer_eval(-a < UINT_MIN); // expected-warning{{FALSE}} +} + +_Static_assert(7u - 3u != 3u - 7u, ""); +_Static_assert(-4u == UINT_MAX - 3u, ""); +void negate_unsigned_4(unsigned a) { + assert(a == 4u); + clang_analyzer_eval(-a == 4u); // expected-warning{{FALSE}} + clang_analyzer_eval(-a != 4u); // expected-warning{{TRUE}} + clang_analyzer_eval(-a == UINT_MAX - 3u); // expected-warning{{TRUE}} +} + +// UINT_MID equals 0b100...00. +// Its two's compelement is 0b011...11 + 1 = 0b100...00 (itself). +_Static_assert(UINT_MID == -UINT_MID, ""); +void negate_unsigned_mid(unsigned a) { + assert(a == UINT_MID); + clang_analyzer_eval(-a == UINT_MID); // expected-warning{{TRUE}} + clang_analyzer_eval(-a != UINT_MID); // expected-warning{{FALSE}} +} + +void negate_unsigned_mid2(unsigned a) { + assert(UINT_MIN < a && a < UINT_MID); + // a: [UINT_MIN+1, UINT_MID-1] + // -a: [UINT_MID+1, UINT_MAX] + clang_analyzer_eval(-a > UINT_MID); // expected-warning{{TRUE}} + clang_analyzer_eval(-a <= UINT_MAX); // expected-warning{{TRUE}} +} + +_Static_assert(1u - 2u == UINT_MAX, ""); +_Static_assert(2u - 1u == 1, ""); +void negate_unsigned_max(unsigned a) { + assert(a == UINT_MAX); + clang_analyzer_eval(-a == 1); // expected-warning{{TRUE}} + clang_analyzer_eval(-a != 1); // expected-warning{{FALSE}} +} +void negate_unsigned_one(unsigned a) { + assert(a == 1); + clang_analyzer_eval(-a == UINT_MAX); // expected-warning{{TRUE}} + clang_analyzer_eval(-a < UINT_MAX); // expected-warning{{FALSE}} +} diff --git a/clang/test/Analysis/constraint_manager_negate_ diff erence.c b/clang/test/Analysis/constraint_manager_negate_ diff erence.c index a33c5ca81c26..0cac576a31ec 100644 --- a/clang/test/Analysis/constraint_manager_negate_ diff erence.c +++ b/clang/test/Analysis/constraint_manager_negate_ diff erence.c @@ -1,4 +1,6 @@ -// RUN: %clang_analyze_cc1 -analyzer-checker=debug.ExprInspection,core.builtin -analyzer-config aggressive-binary-operation-simplification=true -verify %s +// RUN: %clang_analyze_cc1 -analyzer-checker=debug.ExprInspection,core.builtin \ +// RUN: -analyzer-config eagerly-assume=false \ +// RUN: -verify %s void clang_analyzer_eval(int); @@ -10,11 +12,8 @@ void exit(int); #define INT_MAX (UINT_MAX & (UINT_MAX >> 1)) #define INT_MIN (UINT_MAX & ~(UINT_MAX >> 1)) -extern void __assert_fail (__const char *__assertion, __const char *__file, - unsigned int __line, __const char *__function) - __attribute__ ((__noreturn__)); -#define assert(expr) \ - ((expr) ? (void)(0) : __assert_fail (#expr, __FILE__, __LINE__, __func__)) +extern void abort() __attribute__((__noreturn__)); +#define assert(expr) ((expr) ? (void)(0) : abort()) void assert_in_range(int x) { assert(x <= ((int)INT_MAX / 4)); @@ -33,69 +32,60 @@ void assert_in_range_2(int m, int n) { void equal(int m, int n) { assert_in_range_2(m, n); - if (m != n) - return; + assert(m == n); assert_in_wide_range(m - n); clang_analyzer_eval(n == m); // expected-warning{{TRUE}} } void non_equal(int m, int n) { assert_in_range_2(m, n); - if (m == n) - return; + assert(m != n); assert_in_wide_range(m - n); clang_analyzer_eval(n != m); // expected-warning{{TRUE}} } void less_or_equal(int m, int n) { assert_in_range_2(m, n); - if (m < n) - return; + assert(m >= n); assert_in_wide_range(m - n); clang_analyzer_eval(n <= m); // expected-warning{{TRUE}} } void less(int m, int n) { assert_in_range_2(m, n); - if (m <= n) - return; + assert(m > n); assert_in_wide_range(m - n); clang_analyzer_eval(n < m); // expected-warning{{TRUE}} } void greater_or_equal(int m, int n) { assert_in_range_2(m, n); - if (m > n) - return; + assert(m <= n); assert_in_wide_range(m - n); clang_analyzer_eval(n >= m); // expected-warning{{TRUE}} } void greater(int m, int n) { assert_in_range_2(m, n); - if (m >= n) - return; + assert(m < n); assert_in_wide_range(m - n); clang_analyzer_eval(n > m); // expected-warning{{TRUE}} } void negate_positive_range(int m, int n) { - if (m - n <= 0) - return; + assert(m - n > 0); clang_analyzer_eval(n - m < 0); // expected-warning{{TRUE}} clang_analyzer_eval(n - m > INT_MIN); // expected-warning{{TRUE}} - clang_analyzer_eval(n - m == INT_MIN); // expected-warning{{FALSE}} } +_Static_assert(INT_MIN == -INT_MIN, ""); void negate_int_min(int m, int n) { - if (m - n != INT_MIN) - return; + assert(m - n == INT_MIN); clang_analyzer_eval(n - m == INT_MIN); // expected-warning{{TRUE}} } void negate_mixed(int m, int n) { - if (m -n > INT_MIN && m - n <= 0) - return; + assert(m - n > 0 || m - n == INT_MIN); clang_analyzer_eval(n - m <= 0); // expected-warning{{TRUE}} } @@ -106,54 +96,59 @@ void effective_range(int m, int n) { clang_analyzer_eval(n - m == 0); // expected-warning{{TRUE}} } +_Static_assert(INT_MIN == -INT_MIN, ""); void effective_range_2(int m, int n) { assert(m - n <= 0); assert(n - m <= 0); - clang_analyzer_eval(m - n == 0); // expected-warning{{TRUE}} expected-warning{{FALSE}} - clang_analyzer_eval(n - m == 0); // expected-warning{{TRUE}} expected-warning{{FALSE}} + clang_analyzer_eval(m - n == 0 || m - n == INT_MIN); // expected-warning{{TRUE}} } void negate_unsigned_min(unsigned m, unsigned n) { - if (m - n == UINT_MIN) { - clang_analyzer_eval(n - m == UINT_MIN); // expected-warning{{TRUE}} - clang_analyzer_eval(n - m != UINT_MIN); // expected-warning{{FALSE}} - clang_analyzer_eval(n - m > UINT_MIN); // expected-warning{{FALSE}} - clang_analyzer_eval(n - m < UINT_MIN); // expected-warning{{FALSE}} - } + assert(m - n == UINT_MIN); + clang_analyzer_eval(n - m == UINT_MIN); // expected-warning{{TRUE}} + clang_analyzer_eval(n - m != UINT_MIN); // expected-warning{{FALSE}} + clang_analyzer_eval(n - m > UINT_MIN); // expected-warning{{FALSE}} + clang_analyzer_eval(n - m < UINT_MIN); // expected-warning{{FALSE}} } +_Static_assert(7u - 3u != 3u - 7u, ""); +void negate_unsigned_4(unsigned m, unsigned n) { + assert(m - n == 4u); + clang_analyzer_eval(n - m == 4u); // expected-warning{{FALSE}} + clang_analyzer_eval(n - m != 4u); // expected-warning{{TRUE}} +} + +_Static_assert(UINT_MID == -UINT_MID, ""); void negate_unsigned_mid(unsigned m, unsigned n) { - if (m - n == UINT_MID) { - clang_analyzer_eval(n - m == UINT_MID); // expected-warning{{TRUE}} - clang_analyzer_eval(n - m != UINT_MID); // expected-warning{{FALSE}} - } + assert(m - n == UINT_MID); + clang_analyzer_eval(n - m == UINT_MID); // expected-warning{{TRUE}} + clang_analyzer_eval(n - m != UINT_MID); // expected-warning{{FALSE}} } void negate_unsigned_mid2(unsigned m, unsigned n) { - if (m - n < UINT_MID && m - n > UINT_MIN) { - clang_analyzer_eval(n - m > UINT_MID); // expected-warning{{TRUE}} - clang_analyzer_eval(n - m < UINT_MID); // expected-warning{{FALSE}} - } + assert(UINT_MIN < m - n && m - n < UINT_MID); + clang_analyzer_eval(n - m > UINT_MID); // expected-warning{{TRUE}} + clang_analyzer_eval(n - m <= UINT_MAX); // expected-warning{{TRUE}} } +_Static_assert(1u - 2u == UINT_MAX, ""); +_Static_assert(2u - 1u == 1, ""); void negate_unsigned_max(unsigned m, unsigned n) { - if (m - n == UINT_MAX) { - clang_analyzer_eval(n - m == 1); // expected-warning{{TRUE}} - clang_analyzer_eval(n - m != 1); // expected-warning{{FALSE}} - } + assert(m - n == UINT_MAX); + clang_analyzer_eval(n - m == 1); // expected-warning{{TRUE}} + clang_analyzer_eval(n - m != 1); // expected-warning{{FALSE}} } void negate_unsigned_one(unsigned m, unsigned n) { - if (m - n == 1) { - clang_analyzer_eval(n - m == UINT_MAX); // expected-warning{{TRUE}} - clang_analyzer_eval(n - m < UINT_MAX); // expected-warning{{FALSE}} - } + assert(m - n == 1); + clang_analyzer_eval(n - m == UINT_MAX); // expected-warning{{TRUE}} + clang_analyzer_eval(n - m < UINT_MAX); // expected-warning{{FALSE}} } // The next code is a repro for the bug PR41588 void negated_unsigned_range(unsigned x, unsigned y) { - clang_analyzer_eval(x - y != 0); // expected-warning{{FALSE}} expected-warning{{TRUE}} - clang_analyzer_eval(y - x != 0); // expected-warning{{FALSE}} expected-warning{{TRUE}} + clang_analyzer_eval(x - y != 0); // expected-warning{{UNKNOWN}} + clang_analyzer_eval(y - x != 0); // expected-warning{{UNKNOWN}} // expected no assertion on the next line - clang_analyzer_eval(x - y != 0); // expected-warning{{FALSE}} expected-warning{{TRUE}} + clang_analyzer_eval(x - y != 0); // expected-warning{{UNKNOWN}} } diff --git a/clang/test/Analysis/unary-sym-expr-no-crash.c b/clang/test/Analysis/unary-sym-expr-no-crash.c new file mode 100644 index 000000000000..5a4e0f943b9c --- /dev/null +++ b/clang/test/Analysis/unary-sym-expr-no-crash.c @@ -0,0 +1,23 @@ +// RUN: %clang_analyze_cc1 %s \ +// RUN: -analyzer-checker=core,debug.ExprInspection \ +// RUN: -analyzer-config eagerly-assume=false \ +// RUN: -analyzer-config support-symbolic-integer-casts=false \ +// RUN: -verify + +// RUN: %clang_analyze_cc1 %s \ +// RUN: -analyzer-checker=core,debug.ExprInspection \ +// RUN: -analyzer-config eagerly-assume=false \ +// RUN: -analyzer-config support-symbolic-integer-casts=true \ +// RUN: -verify + +// expected-no-diagnostics + +void clang_analyzer_eval(int); +void clang_analyzer_dump(int); + +void crash(int b, long c) { + b = c; + if (b > 0) + if(-b) // should not crash here + ; +} diff --git a/clang/test/Analysis/unary-sym-expr.c b/clang/test/Analysis/unary-sym-expr.c index 14b3219de372..7c4774f3cca8 100644 --- a/clang/test/Analysis/unary-sym-expr.c +++ b/clang/test/Analysis/unary-sym-expr.c @@ -36,3 +36,12 @@ void test_svalbuilder_simplification(int x, int y) { // FIXME Commutativity is not supported yet. clang_analyzer_eval(-(y + x) == -3); // expected-warning{{UNKNOWN}} } + +int test_fp(int flag) { + int value; + if (flag == 0) + value = 1; + if (-flag == 0) + return value; // no-warning + return 42; +} _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
