[analyzer] Fix constraint being dropped when analyzing a program without taint tracki...

Summary:
This patch removes the constraint dropping when taint tracking is disabled.

It also voids the crash reported in D28953 by treating a SymSymExpr with non pointer symbols as an opaque expression.

Updated the regressions and verifying the big projects now; I'll update here when they're done.

Based on the discussion on the mailing list and the patches by @ddcc.

Reviewers: george.karpenkov, NoQ, ddcc, baloghadamsoftware

Reviewed By: george.karpenkov

Subscribers: delcypher, llvm-commits, rnkovacs, xazax.hun, szepet, a.sidorin, ddcc

Differential Revision: https://reviews.llvm.org/D48650

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@337167 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Core/AnalyzerOptions.cpp b/lib/StaticAnalyzer/Core/AnalyzerOptions.cpp
index 75c22a34ea7977e4dc9447b12fbd23649f0d9f97..a4abb82e2af1aad46dbbefb0767834040b86f3ea 100644 (file)
--- a/lib/StaticAnalyzer/Core/AnalyzerOptions.cpp
+++ b/lib/StaticAnalyzer/Core/AnalyzerOptions.cpp
@@ -390,7 +390,7 @@ unsigned AnalyzerOptions::getGraphTrimInterval() {
 
 unsigned AnalyzerOptions::getMaxSymbolComplexity() {
   if (!MaxSymbolComplexity.hasValue())
-    MaxSymbolComplexity = getOptionAsInteger("max-symbol-complexity", 10000);
+    MaxSymbolComplexity = getOptionAsInteger("max-symbol-complexity", 25);
   return MaxSymbolComplexity.getValue();
 }
 

diff --git a/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp b/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp
index 1499d4989961ac806f86b646ddf3c175f3ddd0a2..f99853f0707314d2b39b532932e701dc91b60820 100644 (file)
--- a/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp
+++ b/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp
@@ -52,17 +52,18 @@ ProgramStateRef RangedConstraintManager::assumeSym(ProgramStateRef State,
     assert(BinaryOperator::isComparisonOp(Op));
 
     // For now, we only support comparing pointers.
-    assert(Loc::isLocType(SSE->getLHS()->getType()));
-    assert(Loc::isLocType(SSE->getRHS()->getType()));
-    QualType DiffTy = SymMgr.getContext().getPointerDiffType();
-    SymbolRef Subtraction =
-        SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), DiffTy);
-
-    const llvm::APSInt &Zero = getBasicVals().getValue(0, DiffTy);
-    Op = BinaryOperator::reverseComparisonOp(Op);
-    if (!Assumption)
-      Op = BinaryOperator::negateComparisonOp(Op);
-    return assumeSymRel(State, Subtraction, Op, Zero);
+    if (Loc::isLocType(SSE->getLHS()->getType()) &&
+        Loc::isLocType(SSE->getRHS()->getType())) {
+      QualType DiffTy = SymMgr.getContext().getPointerDiffType();
+      SymbolRef Subtraction =
+          SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), DiffTy);
+
+      const llvm::APSInt &Zero = getBasicVals().getValue(0, DiffTy);
+      Op = BinaryOperator::reverseComparisonOp(Op);
+      if (!Assumption)
+        Op = BinaryOperator::negateComparisonOp(Op);
+      return assumeSymRel(State, Subtraction, Op, Zero);
+    }
   }
 
   // If we get here, there's nothing else we can do but treat the symbol as

diff --git a/lib/StaticAnalyzer/Core/SValBuilder.cpp b/lib/StaticAnalyzer/Core/SValBuilder.cpp
index febe7cdb83ca22ef48bd0b71b6996ef674c84b10..f292dca8e99fd266a23f363b6640ec7894cca82d 100644 (file)
--- a/lib/StaticAnalyzer/Core/SValBuilder.cpp
+++ b/lib/StaticAnalyzer/Core/SValBuilder.cpp
@@ -379,11 +379,9 @@ SVal SValBuilder::makeSymExprValNN(ProgramStateRef State,
                                    BinaryOperator::Opcode Op,
                                    NonLoc LHS, NonLoc RHS,
                                    QualType ResultTy) {
-  if (!State->isTainted(RHS) && !State->isTainted(LHS))
-    return UnknownVal();
-
   const SymExpr *symLHS = LHS.getAsSymExpr();
   const SymExpr *symRHS = RHS.getAsSymExpr();
+
   // TODO: When the Max Complexity is reached, we should conjure a symbol
   // instead of generating an Unknown value and propagate the taint info to it.
   const unsigned MaxComp = StateMgr.getOwningEngine()

diff --git a/test/Analysis/PR37855.c b/test/Analysis/PR37855.c
index 24e34c08364ddb355e7dff4e04ea628ecc3c6a05..0779796531fd6b5850e1425599d1e57924267ed9 100644 (file)
--- a/test/Analysis/PR37855.c
+++ b/test/Analysis/PR37855.c
@@ -20,5 +20,5 @@ void k(l, node) {
     nodep = n;
   }
   if (nodep) // expected-warning {{Branch condition evaluates to a garbage value}}
-    n[1].node->s; // expected-warning {{Dereference of undefined pointer value}}
+    n[1].node->s;
 }

diff --git a/test/Analysis/bitwise-ops.c b/test/Analysis/bitwise-ops.c
index 5cdb668867b6afcd0a1218d03a98da42f7b3c222..fcd3d7dbc7cfff3be21eeb89d6437e1ea5eb239f 100644 (file)
--- a/test/Analysis/bitwise-ops.c
+++ b/test/Analysis/bitwise-ops.c
@@ -8,9 +8,8 @@ void testPersistentConstraints(int x, int y) {
   CHECK(x); // expected-warning{{TRUE}}
   CHECK(x & 1); // expected-warning{{TRUE}}
   
-  // False positives due to SValBuilder giving up on certain kinds of exprs.
-  CHECK(1 - x); // expected-warning{{UNKNOWN}}
-  CHECK(x & y); // expected-warning{{UNKNOWN}}
+  CHECK(1 - x); // expected-warning{{TRUE}}
+  CHECK(x & y); // expected-warning{{TRUE}}
 }
 
 int testConstantShifts_PR18073(int which) {

diff --git a/test/Analysis/std-c-library-functions.c b/test/Analysis/std-c-library-functions.c
index 042b035f8bdf09aa4f35451e0d2b36da1c769c96..b8eb3e54bdf0f4352775d78f10680900a6785858 100644 (file)
--- a/test/Analysis/std-c-library-functions.c
+++ b/test/Analysis/std-c-library-functions.c
@@ -57,8 +57,7 @@ void test_fread_fwrite(FILE *fp, int *buf) {
   size_t y = fread(buf, sizeof(int), 10, fp);
   clang_analyzer_eval(y <= 10); // expected-warning{{TRUE}}
   size_t z = fwrite(buf, sizeof(int), y, fp);
-  // FIXME: should be TRUE once symbol-symbol constraint support is improved.
-  clang_analyzer_eval(z <= y); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(z <= y); // expected-warning{{TRUE}}
 }
 
 ssize_t getline(char **, size_t *, FILE *);

diff --git a/test/Analysis/svalbuilder-rearrange-comparisons.c b/test/Analysis/svalbuilder-rearrange-comparisons.c
index 720144c38add7b4fb3d02a2e7021288f0f8d351e..2303ce693ca073e919a672ffba81c7f3cf613d86 100644 (file)
--- a/test/Analysis/svalbuilder-rearrange-comparisons.c
+++ b/test/Analysis/svalbuilder-rearrange-comparisons.c
@@ -560,7 +560,7 @@ void compare_same_symbol_plus_left_int_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(y); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(x == y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) + 1U) == (conj_$2{int})}}
 }
 
 void compare_same_symbol_minus_left_int_equal_unsigned() {
@@ -569,7 +569,7 @@ void compare_same_symbol_minus_left_int_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(y); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(x == y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) - 1U) == (conj_$2{int})}}
 }
 
 void compare_same_symbol_plus_right_int_equal_unsigned() {
@@ -577,7 +577,7 @@ void compare_same_symbol_plus_right_int_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(x == y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{(conj_$2{int}) == ((conj_$2{int}) + 1U)}}
 }
 
 void compare_same_symbol_minus_right_int_equal_unsigned() {
@@ -585,7 +585,7 @@ void compare_same_symbol_minus_right_int_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(x == y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{(conj_$2{int}) == ((conj_$2{int}) - 1U)}}
 }
 
 void compare_same_symbol_plus_left_plus_right_int_equal_unsigned() {
@@ -603,7 +603,7 @@ void compare_same_symbol_plus_left_minus_right_int_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(x == y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) + 1U) == ((conj_$2{int}) - 1U)}}
 }
 
 void compare_same_symbol_minus_left_plus_right_int_equal_unsigned() {
@@ -612,7 +612,7 @@ void compare_same_symbol_minus_left_plus_right_int_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(x == y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) - 1U) == ((conj_$2{int}) + 1U)}}
 }
 
 void compare_same_symbol_minus_left_minus_right_int_equal_unsigned() {
@@ -710,7 +710,7 @@ void compare_same_symbol_plus_left_int_less_or_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(y); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(x <= y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) + 1U) <= (conj_$2{int})}}
 }
 
 void compare_same_symbol_minus_left_int_less_or_equal_unsigned() {
@@ -719,7 +719,7 @@ void compare_same_symbol_minus_left_int_less_or_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(y); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(x <= y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) - 1U) <= (conj_$2{int})}}
 }
 
 void compare_same_symbol_plus_right_int_less_or_equal_unsigned() {
@@ -727,7 +727,7 @@ void compare_same_symbol_plus_right_int_less_or_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(x <= y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{(conj_$2{int}) <= ((conj_$2{int}) + 1U)}}
 }
 
 void compare_same_symbol_minus_right_int_less_or_equal_unsigned() {
@@ -735,7 +735,7 @@ void compare_same_symbol_minus_right_int_less_or_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(x <= y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{(conj_$2{int}) <= ((conj_$2{int}) - 1U)}}
 }
 
 void compare_same_symbol_plus_left_plus_right_int_less_or_equal_unsigned() {
@@ -753,7 +753,7 @@ void compare_same_symbol_plus_left_minus_right_int_less_or_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(x <= y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) + 1U) <= ((conj_$2{int}) - 1U)}}
 }
 
 void compare_same_symbol_minus_left_plus_right_int_less_or_equal_unsigned() {
@@ -762,7 +762,7 @@ void compare_same_symbol_minus_left_plus_right_int_less_or_equal_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(x <= y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) - 1U) <= ((conj_$2{int}) + 1U)}}
 }
 
 void compare_same_symbol_minus_left_minus_right_int_less_or_equal_unsigned() {
@@ -860,7 +860,7 @@ void compare_same_symbol_plus_left_int_less_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(y); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(x < y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) + 1U) < (conj_$2{int})}}
 }
 
 void compare_same_symbol_minus_left_int_less_unsigned() {
@@ -869,7 +869,7 @@ void compare_same_symbol_minus_left_int_less_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(y); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(x < y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) - 1U) < (conj_$2{int})}}
 }
 
 void compare_same_symbol_plus_right_int_less_unsigned() {
@@ -877,7 +877,7 @@ void compare_same_symbol_plus_right_int_less_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(x < y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{(conj_$2{int}) < ((conj_$2{int}) + 1U)}}
 }
 
 void compare_same_symbol_minus_right_int_less_unsigned() {
@@ -885,7 +885,7 @@ void compare_same_symbol_minus_right_int_less_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{conj_$2{int}}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(x < y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{(conj_$2{int}) < ((conj_$2{int}) - 1U)}}
 }
 
 void compare_same_symbol_plus_left_plus_right_int_less_unsigned() {
@@ -903,7 +903,7 @@ void compare_same_symbol_plus_left_minus_right_int_less_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(x < y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) + 1U) < ((conj_$2{int}) - 1U)}}
 }
 
 void compare_same_symbol_minus_left_plus_right_int_less_unsigned() {
@@ -912,7 +912,7 @@ void compare_same_symbol_minus_left_plus_right_int_less_unsigned() {
   clang_analyzer_dump(x); // expected-warning{{(conj_$2{int}) - 1}}
   clang_analyzer_dump(y); // expected-warning{{(conj_$2{int}) + 1}}
   clang_analyzer_dump(x < y);
-  // expected-warning@-1{{Unknown}} // FIXME: Can this be simplified?
+  // expected-warning@-1{{((conj_$2{int}) - 1U) < ((conj_$2{int}) + 1U)}}
 }
 
 void compare_same_symbol_minus_left_minus_right_int_less_unsigned() {