baloghadamsoftware updated this revision to Diff 186470.
baloghadamsoftware marked 3 inline comments as not done.
baloghadamsoftware added a comment.
Herald added a subscriber: jdoerfert.
Function renamed, comment updated.
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D58067/new/
https://reviews.llvm.org/D58067
Files:
lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
test/Analysis/PR40625.cpp
test/Analysis/const_array.cpp
test/Analysis/uninit-vals.m
Index: test/Analysis/uninit-vals.m
===================================================================
--- test/Analysis/uninit-vals.m
+++ test/Analysis/uninit-vals.m
@@ -394,11 +394,11 @@
struct {
int : 4;
int y : 4;
- } a, b, c;
+ } a, b, c; // expected-note{{'c' initialized here}}
a.y = 2;
- b = a; // expected-note{{Value assigned to 'c'}}
+ b = a;
clang_analyzer_eval(b.y == 2); // expected-warning{{TRUE}}
// expected-note@-1{{TRUE}}
@@ -411,11 +411,11 @@
struct {
int x : 4;
int : 4;
- } a, b, c;
+ } a, b, c; // expected-note{{'c' initialized here}}
a.x = 1;
- b = a; // expected-note{{Value assigned to 'c'}}
+ b = a;
clang_analyzer_eval(b.x == 1); // expected-warning{{TRUE}}
// expected-note@-1{{TRUE}}
Index: test/Analysis/const_array.cpp
===================================================================
--- test/Analysis/const_array.cpp
+++ /dev/null
@@ -1,22 +0,0 @@
-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,alpha.core.CallAndMessageUnInitRefArg %s -verify
-
-// expect-no-diagnostics
-
-const int arr[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10};
-
-void f(const int *begin, const int *end) {
- int sum = 0;
- for (const int *p = begin; p != end; ++p) {
- sum += *p;
- }
-}
-
-typedef const int intarray[10];
-
-void g(const intarray &arrr) {
- f(arrr, arrr+sizeof(arrr));
-}
-
-void h() {
- g(arr);
-}
Index: test/Analysis/PR40625.cpp
===================================================================
--- /dev/null
+++ test/Analysis/PR40625.cpp
@@ -0,0 +1,16 @@
+// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,alpha.core.CallAndMessageUnInitRefArg %s -verify
+
+void f(const int *end);
+
+void g(const int (&arrr)[10]) {
+ f(arrr+sizeof(arrr)); // expected-warning{{1st function call argument is a pointer to uninitialized value}}
+ // FIXME: This is a false positive that should be fixed. Until then this
+ // tests the crash fix in FindLastStoreBRVisitor (beside
+ // uninit-vals.m).
+}
+
+void h() {
+ int arr[10];
+
+ g(arr);
+}
Index: lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
===================================================================
--- lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
+++ lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
@@ -153,6 +153,32 @@
return E;
}
+/// Comparing internal representations of symbolic values (via
+/// SVal::operator==()) is a valid way to check if the value was updated,
+/// unless it's a LazyCompoundVal that may have a different internal
+/// representation every time it is loaded from the state. In this function we
+/// do an approximate comparison for lazy compound values, checking that they
+/// are the immediate snapshots of the tracked region's bindings within the
+/// node's respective states but not really checking that these snapshots
+/// actually contain the same set of bindings.
+bool hasVisibleUpdate(const ExplodedNode *LeftNode, SVal LeftVal,
+ const ExplodedNode *RightNode, SVal RightVal) {
+ if (LeftVal == RightVal)
+ return true;
+
+ const auto LLCV = LeftVal.getAs<nonloc::LazyCompoundVal>();
+ if (!LLCV)
+ return false;
+
+ const auto RLCV = RightVal.getAs<nonloc::LazyCompoundVal>();
+ if (!RLCV)
+ return false;
+
+ return LLCV->getRegion() == RLCV->getRegion() &&
+ LLCV->getStore() == LeftNode->getState()->getStore() &&
+ RLCV->getStore() == RightNode->getState()->getStore();
+}
+
//===----------------------------------------------------------------------===//
// Definitions for bug reporter visitors.
//===----------------------------------------------------------------------===//
@@ -1177,7 +1203,7 @@
if (Succ->getState()->getSVal(R) != V)
return nullptr;
- if (Pred->getState()->getSVal(R) == V) {
+ if (hasVisibleUpdate(Pred, Pred->getState()->getSVal(R), Succ, V)) {
Optional<PostStore> PS = Succ->getLocationAs<PostStore>();
if (!PS || PS->getLocationValue() != R)
return nullptr;
@@ -1198,6 +1224,7 @@
// UndefinedVal.)
if (Optional<CallEnter> CE = Succ->getLocationAs<CallEnter>()) {
if (const auto *VR = dyn_cast<VarRegion>(R)) {
+
const auto *Param = cast<ParmVarDecl>(VR->getDecl());
ProgramStateManager &StateMgr = BRC.getStateManager();
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
