Fixed bug in CFG::PopulateBlkExprMap where the ordering

between fetching the size of the expression map (for use as
the next integer id for an Expr*) and the creation of the
entry in the map could be non-deterministic.  This could
cause the size of the map to be incremented prior to the
index being determine.

On Linux the map entry would be created first, causing the
map to the "size" to be incremented prior to it being
queried. On Mac OS X we had the reverse behavior. Now the
size is always queried prior to the new id being inserted
into the map.

This was the real cause of the bit-overrun triggered in
PR 1847:

  http://llvm.org/bugs/show_bug.cgi?id=1847

Also reverted the change in patch 44813, which was a bogus
fix to this problem:

  http://llvm.org/viewvc/llvm-project?rev=44813&view=rev

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@44822 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/AST/CFG.cpp b/AST/CFG.cpp
index 0c8589b058ea97db0df20c493a41c50df1087bba..b93d77e3fa06117cc0a91da9d41684bf1a532744 100644 (file)
--- a/AST/CFG.cpp
+++ b/AST/CFG.cpp
@@ -969,8 +969,10 @@ static BlkExprMapTy* PopulateBlkExprMap(CFG& cfg) {
   
   for (CFG::iterator I=cfg.begin(), E=cfg.end(); I != E; ++I)
     for (CFGBlock::iterator BI=I->begin(), EI=I->end(); BI != EI; ++BI)
-      if (const Expr* E = dyn_cast<Expr>(*BI))
-        (*M)[E] = M->size();
+      if (const Expr* E = dyn_cast<Expr>(*BI)) {
+        unsigned x = M->size();
+        (*M)[E] = x;
+      }
   
   return M;
 }

diff --git a/include/clang/Analysis/ExprDeclBitVector.h b/include/clang/Analysis/ExprDeclBitVector.h
index 2ddd985f4c4e2a6fa867fb84f7cadbb3203d4673..4cd9faa260b729db42887ac08a3ba389909a0d3d 100644 (file)
--- a/include/clang/Analysis/ExprDeclBitVector.h
+++ b/include/clang/Analysis/ExprDeclBitVector.h
@@ -73,7 +73,7 @@ struct DeclBitVector_Types {
   public:
     
     void resetValues(AnalysisDataTy& AD) {
-      DeclBV.resize(AD.getNumDecls()+1); 
+      DeclBV.resize(AD.getNumDecls()); 
       DeclBV.reset();
     }
     
@@ -172,7 +172,7 @@ struct ExprDeclBitVector_Types {
     
     void resetValues(AnalysisDataTy& AD) {
       ParentRef(*this).resetValues(AD);
-      ExprBV.resize(AD.getNumExprs()+1);
+      ExprBV.resize(AD.getNumExprs());
       ExprBV.reset();
     }