Author: alexshap Date: Mon Sep 25 12:32:33 2017 New Revision: 314141 URL: http://llvm.org/viewvc/llvm-project?rev=314141&view=rev Log: [analyzer] Fix crash on modeling of pointer arithmetic
This patch fixes analyzer's crash on the newly added test case (see also https://bugs.llvm.org/show_bug.cgi?id=34374). Pointers subtraction appears to be modeled incorrectly in the following example: char* p; auto n = p - reinterpret_cast<char*>((unsigned long)1); In this case the analyzer (built without this patch) tries to create a symbolic value for the difference treating reinterpret_cast<char*>((unsigned long)1) as an integer, that is not correct. Differential revision: https://reviews.llvm.org/D38214 Test plan: make check-all Modified: cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp cfe/trunk/test/Analysis/ptr-arith.cpp Modified: cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp?rev=314141&r1=314140&r2=314141&view=diff ============================================================================== --- cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp (original) +++ cfe/trunk/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp Mon Sep 25 12:32:33 2017 @@ -726,9 +726,11 @@ SVal SimpleSValBuilder::evalBinOpLL(Prog if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) { // If one of the operands is a symbol and the other is a constant, // build an expression for use by the constraint manager. - if (SymbolRef lSym = lhs.getAsLocSymbol(true)) - return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy); - + if (SymbolRef lSym = lhs.getAsLocSymbol(true)) { + if (BinaryOperator::isComparisonOp(op)) + return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy); + return UnknownVal(); + } // Special case comparisons to NULL. // This must come after the test if the LHS is a symbol, which is used to // build constraints. The address of any non-symbolic region is guaranteed Modified: cfe/trunk/test/Analysis/ptr-arith.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/ptr-arith.cpp?rev=314141&r1=314140&r2=314141&view=diff ============================================================================== --- cfe/trunk/test/Analysis/ptr-arith.cpp (original) +++ cfe/trunk/test/Analysis/ptr-arith.cpp Mon Sep 25 12:32:33 2017 @@ -111,3 +111,9 @@ bool ptrAsIntegerSubtractionNoCrash(__UI __UINTPTR_TYPE__ y = (__UINTPTR_TYPE__)p - 1; return y == x; } + +// Bug 34374 +bool integerAsPtrSubtractionNoCrash(char *p, __UINTPTR_TYPE__ m) { + auto n = p - reinterpret_cast<char*>((__UINTPTR_TYPE__)1); + return n == m; +} _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
