From 1fe45f93473d64e67e056f3eab1de59fd3e6886a Mon Sep 17 00:00:00 2001 From: Adam Balogh Date: Fri, 30 Nov 2018 10:37:44 +0000 Subject: [PATCH] lyzer] [HOTFIX!] SValBuilder crash when `aggressive-binary-operation-simplification` enabled During the review of D41938 a condition check with an early exit accidentally slipped into a branch, leaving the other branch unprotected. This may result in an assertion later on. This hotfix moves this contition check outside of the branch. Differential Revision: https://reviews.llvm.org/D55051 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@347981 91177308-0d34-0410-b5e6-96231b3b80d8 --- lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp | 7 ++++--- .../svalbuilder-rearrange-comparisons.c | 17 +++++++++++++++++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp b/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp index 5cd9320d65..19d71253eb 100644 --- a/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp +++ b/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp @@ -475,9 +475,6 @@ static Optional tryRearrange(ProgramStateRef State, SingleTy = ResultTy; if (LSym->getType() != SingleTy) return None; - // Substracting unsigned integers is a nightmare. - if (!SingleTy->isSignedIntegerOrEnumerationType()) - return None; } else { // Don't rearrange other operations. return None; @@ -485,6 +482,10 @@ static Optional tryRearrange(ProgramStateRef State, assert(!SingleTy.isNull() && "We should have figured out the type by now!"); + // Rearrange signed symbolic expressions only + if (!SingleTy->isSignedIntegerOrEnumerationType()) + return None; + SymbolRef RSym = Rhs.getAsSymbol(); if (!RSym || RSym->getType() != SingleTy) return None; diff --git a/test/Analysis/svalbuilder-rearrange-comparisons.c b/test/Analysis/svalbuilder-rearrange-comparisons.c index daf17b66b2..9e9bf0a9db 100644 --- a/test/Analysis/svalbuilder-rearrange-comparisons.c +++ b/test/Analysis/svalbuilder-rearrange-comparisons.c @@ -979,3 +979,20 @@ int mixed_integer_types(int x, int y) { short a = x - 1U; return a - y; } + +unsigned gu(); +unsigned fu() { + unsigned x = gu(); + // Assert that no overflows occur in this test file. + // Assuming that concrete integers are also within that range. + assert(x <= ((unsigned)UINT_MAX / 4)); + return x; +} + +void unsigned_concrete_int_no_crash() { + unsigned x = fu() + 1U, y = fu() + 1U; + clang_analyzer_denote(x - 1U, "$x"); + clang_analyzer_denote(y - 1U, "$y"); + clang_analyzer_express(y); // expected-warning {{$y}} + clang_analyzer_express(x == y); // expected-warning {{$x + 1U == $y + 1U}} +} -- 2.50.1