choller wrote:
I looked into Tom's bug report and I hit the following assertion in a debug
build:
```
clang:
/srv/repos/llvm-project/clang/lib/StaticAnalyzer/Core/DynamicType.cpp:134:
clang::ento::ProgramStateRef
clang::ento::setDynamicTypeAndCastInfo(clang::ento::ProgramStateRef, const
cla
steakhal wrote:
Thanks for the replies.
I'll come back to this PR once I have some time; maybe during the holidays.
Both assertions directly relate to this PR for sure.
> I looked into Tom's bug report and I hit the following assertion in a debug
> build:
>
> ```
> clang:
> /srv/repos/llvm-pr
tomrittervg wrote:
Hm, testing these patches on the original testcase in #62663 (the one where we
use statements 1B and 2B) - I don't think this patchset solves that scenario...
https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing l
@@ -492,11 +492,13 @@ void check_required_cast() {
void check_cast_behavior(OSObject *obj) {
OSArray *arr1 = OSDynamicCast(OSArray, obj);
- clang_analyzer_eval(arr1 == obj); // expected-warning{{TRUE}}
-// expected-note@-1{{TRUE}}
-
https://github.com/steakhal created
https://github.com/llvm/llvm-project/pull/69057
When doing a base to derived cast, and we should add a cast info recording that
fact.
This information will be then used for example inside
`CXXInstanceCall::getRuntimeDefinition` (CallEvent.cpp), where for vir
llvmbot wrote:
@llvm/pr-subscribers-clang
Author: Balazs Benics (steakhal)
Changes
When doing a base to derived cast, and we should add a cast info recording that
fact.
This information will be then used for example inside
`CXXInstanceCall::getRuntimeDefinition` (CallEvent.cpp), where fo
https://github.com/Xazax-hun edited
https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const
CallEvent &Call,
}
}
-/// TODO: Handle explicit casts.
-/// Handle C++ casts.
-///
-/// Precondition: the cast is between ObjCObjectPointers.
ExplodedNode *DynamicTypePropagation::dynamicTypePropa
@@ -609,9 +617,13 @@ storeWhenMoreInformative(ProgramStateRef &State, SymbolRef
Sym,
/// symbol and the destination type of the cast are unrelated, report an error.
void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
Checke
https://github.com/Xazax-hun approved this pull request.
Added some nits inline, overall, it looks good to me.
https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailma
Xazax-hun wrote:
This patch makes me think whether we actually respect final on methods/classes
to avoid unnecessary bifurcation on virtual calls. We probably do not.
https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing list
cfe-co
https://github.com/DonatNagyE edited
https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
https://github.com/DonatNagyE commented:
The only thing that I know about the dynamic type handling is that it's not too
reliable; it would be great if you could improve it.
https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing list
@@ -0,0 +1,105 @@
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN: -analyzer-checker=core \
+// RUN: -analyzer-checker=alpha.security.taint.TaintPropagation \
+// RUN: -analyzer-checker=debug.ExprInspection
+
+// See issue https://github.com/llvm/llvm-project/issues/62663
+
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const
CallEvent &Call,
}
}
-/// TODO: Handle explicit casts.
-/// Handle C++ casts.
-///
-/// Precondition: the cast is between ObjCObjectPointers.
ExplodedNode *DynamicTypePropagation::dynamicTypePropa
@@ -0,0 +1,105 @@
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN: -analyzer-checker=core \
+// RUN: -analyzer-checker=alpha.security.taint.TaintPropagation \
+// RUN: -analyzer-checker=debug.ExprInspection
+
+// See issue https://github.com/llvm/llvm-project/issues/62663
+
@@ -0,0 +1,105 @@
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN: -analyzer-checker=core \
+// RUN: -analyzer-checker=alpha.security.taint.TaintPropagation \
+// RUN: -analyzer-checker=debug.ExprInspection
+
+// See issue https://github.com/llvm/llvm-project/issues/62663
+
https://github.com/steakhal updated
https://github.com/llvm/llvm-project/pull/69057
>From 8ed4effd114ebd83d4ceaa37655ffd9b7105b28e Mon Sep 17 00:00:00 2001
From: Balazs Benics
Date: Sat, 14 Oct 2023 15:51:42 +0200
Subject: [PATCH 1/3] [analyzer] Trust base to derived casts for dynamic types
Wh
https://github.com/steakhal updated
https://github.com/llvm/llvm-project/pull/69057
>From 8ed4effd114ebd83d4ceaa37655ffd9b7105b28e Mon Sep 17 00:00:00 2001
From: Balazs Benics
Date: Sat, 14 Oct 2023 15:51:42 +0200
Subject: [PATCH 1/4] [analyzer] Trust base to derived casts for dynamic types
Wh
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const
CallEvent &Call,
}
}
-/// TODO: Handle explicit casts.
-/// Handle C++ casts.
-///
-/// Precondition: the cast is between ObjCObjectPointers.
ExplodedNode *DynamicTypePropagation::dynamicTypePropa
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const
CallEvent &Call,
}
}
-/// TODO: Handle explicit casts.
-/// Handle C++ casts.
-///
-/// Precondition: the cast is between ObjCObjectPointers.
ExplodedNode *DynamicTypePropagation::dynamicTypePropa
@@ -609,9 +617,13 @@ storeWhenMoreInformative(ProgramStateRef &State, SymbolRef
Sym,
/// symbol and the destination type of the cast are unrelated, report an error.
void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
Checke
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const
CallEvent &Call,
}
}
-/// TODO: Handle explicit casts.
-/// Handle C++ casts.
-///
-/// Precondition: the cast is between ObjCObjectPointers.
ExplodedNode *DynamicTypePropagation::dynamicTypePropa
@@ -492,11 +492,13 @@ void check_required_cast() {
void check_cast_behavior(OSObject *obj) {
OSArray *arr1 = OSDynamicCast(OSArray, obj);
- clang_analyzer_eval(arr1 == obj); // expected-warning{{TRUE}}
-// expected-note@-1{{TRUE}}
-
https://github.com/haoNoQ edited https://github.com/llvm/llvm-project/pull/69057
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
@@ -492,11 +492,13 @@ void check_required_cast() {
void check_cast_behavior(OSObject *obj) {
OSArray *arr1 = OSDynamicCast(OSArray, obj);
- clang_analyzer_eval(arr1 == obj); // expected-warning{{TRUE}}
-// expected-note@-1{{TRUE}}
-
tomrittervg wrote:
This sounds crazy, but I think I found a bug in this patchset. I applied it on
top of the 17.0.2 tag, and then ran the whole analysis on mozilla-central. I
got segfaults on about 4000 executions, all with the same stack trace:
```
1. parser at end of file
2. Whi
steakhal wrote:
To illustrate the case of my previous argument, here are two examples:
https://godbolt.org/z/5vWadfPM9
```c++
// base.h BEGIN:
class Base {
public:
virtual int fun() const = 0;
};
class Derived1 final : public Base {
public:
int fun() const override { return 1; }
};
// base.h
tomrittervg wrote:
> However, what should we do if multiple (N) classes implement Base? Trying
> each N, and basically splitting the state to (N+1) ways is not going to
> scale. Unless N is of course really small, like 2 or 3 at most.
That's kind of what I imagined - try them all. The Analyze
29 matches
Mail list logo
