https://github.com/mzyKi updated https://github.com/llvm/llvm-project/pull/83585
>From 6a9f7a996c127462fa787a2626bc0676d4e04ff3 Mon Sep 17 00:00:00 2001 From: miaozhiyuan <miaozhiy...@feysh.com> Date: Fri, 1 Mar 2024 22:45:20 +0800 Subject: [PATCH 1/2] [clang][ExprEngineCXX] Fix crash on dereference invalid return value of getAdjustedParameterIndex() --- clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp | 9 +++++++-- .../Analysis/engine/expr-engine-cxx-crash.cpp | 15 +++++++++++++++ 2 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 clang/test/Analysis/engine/expr-engine-cxx-crash.cpp diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp index 504fd7f05e0f99..dc72945d68d56f 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp @@ -354,8 +354,13 @@ SVal ExprEngine::computeObjectUnderConstruction( // Operator arguments do not correspond to operator parameters // because this-argument is implemented as a normal argument in // operator call expressions but not in operator declarations. - const TypedValueRegion *TVR = Caller->getParameterLocation( - *Caller->getAdjustedParameterIndex(Idx), BldrCtx->blockCount()); + std::optional<unsigned int> Index = + Caller->getAdjustedParameterIndex(Idx); + if (!Index) { + return std::nullopt; + } + const TypedValueRegion *TVR = + Caller->getParameterLocation(*Index, BldrCtx->blockCount()); if (!TVR) return std::nullopt; diff --git a/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp new file mode 100644 index 00000000000000..a7d2e32db6eb6a --- /dev/null +++ b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp @@ -0,0 +1,15 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=core.DivideZero -std=c++23 -verify %s +// expected-no-diagnostics + +struct S +{ + constexpr auto operator==(this auto, S) + { + return true; + } +}; + +int main() +{ + return S {} == S {}; +} >From a0276047adc5697e6d6c6668b8545f55b1ff1e64 Mon Sep 17 00:00:00 2001 From: miaozhiyuan <miaozhiy...@feysh.com> Date: Tue, 5 Mar 2024 23:24:07 +0800 Subject: [PATCH 2/2] fix testcase and fix root reason about crash with tomasz-kaminski-sonarsource's help --- clang/lib/StaticAnalyzer/Core/CallEvent.cpp | 2 +- .../lib/StaticAnalyzer/Core/ExprEngineCXX.cpp | 9 ++------- .../Analysis/engine/expr-engine-cxx-crash.cpp | 18 +++++++----------- 3 files changed, 10 insertions(+), 19 deletions(-) diff --git a/clang/lib/StaticAnalyzer/Core/CallEvent.cpp b/clang/lib/StaticAnalyzer/Core/CallEvent.cpp index 0ac1d91b79beb5..bc14aea27f6736 100644 --- a/clang/lib/StaticAnalyzer/Core/CallEvent.cpp +++ b/clang/lib/StaticAnalyzer/Core/CallEvent.cpp @@ -1409,7 +1409,7 @@ CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State, if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) { const FunctionDecl *DirectCallee = OpCE->getDirectCallee(); if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee)) - if (MD->isInstance()) + if (MD->isImplicitObjectMemberFunction()) return create<CXXMemberOperatorCall>(OpCE, State, LCtx, ElemRef); } else if (CE->getCallee()->getType()->isBlockPointerType()) { diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp index dc72945d68d56f..504fd7f05e0f99 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp @@ -354,13 +354,8 @@ SVal ExprEngine::computeObjectUnderConstruction( // Operator arguments do not correspond to operator parameters // because this-argument is implemented as a normal argument in // operator call expressions but not in operator declarations. - std::optional<unsigned int> Index = - Caller->getAdjustedParameterIndex(Idx); - if (!Index) { - return std::nullopt; - } - const TypedValueRegion *TVR = - Caller->getParameterLocation(*Index, BldrCtx->blockCount()); + const TypedValueRegion *TVR = Caller->getParameterLocation( + *Caller->getAdjustedParameterIndex(Idx), BldrCtx->blockCount()); if (!TVR) return std::nullopt; diff --git a/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp index a7d2e32db6eb6a..2dfeac8392266a 100644 --- a/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp +++ b/clang/test/Analysis/engine/expr-engine-cxx-crash.cpp @@ -1,15 +1,11 @@ -// RUN: %clang_analyze_cc1 -analyzer-checker=core.DivideZero -std=c++23 -verify %s +// RUN: %clang_analyze_cc1 -analyzer-checker=core -std=c++23 -verify %s // expected-no-diagnostics -struct S -{ - constexpr auto operator==(this auto, S) - { - return true; - } +struct S { + bool operator==(this auto, S) { + return true; + } }; - -int main() -{ - return S {} == S {}; +int use_deducing_this() { + return S{} == S{}; } _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits