Author: Pavel Skripkin Date: 2024-10-04T16:12:29+03:00 New Revision: 8d661fd9fd50fe4be9a9d5a8cc8f52f23925e7f6
URL: https://github.com/llvm/llvm-project/commit/8d661fd9fd50fe4be9a9d5a8cc8f52f23925e7f6 DIFF: https://github.com/llvm/llvm-project/commit/8d661fd9fd50fe4be9a9d5a8cc8f52f23925e7f6.diff LOG: [analyzer] use `invalidateRegions()` in `VisitGCCAsmStmt` (#109838) Added: Modified: clang/lib/StaticAnalyzer/Core/ExprEngine.cpp clang/test/Analysis/asm.cpp Removed: ################################################################################ diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp index b1919d7027cf4d..43ab646d398b31 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -3811,7 +3811,9 @@ void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, assert(!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. if (std::optional<Loc> LV = X.getAs<Loc>()) - state = state->bindLoc(*LV, UnknownVal(), Pred->getLocationContext()); + state = state->invalidateRegions(*LV, A, currBldrCtx->blockCount(), + Pred->getLocationContext(), + /*CausedByPointerEscape=*/true); } // Do not reason about locations passed inside inline assembly. @@ -3819,7 +3821,9 @@ void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, SVal X = state->getSVal(I, Pred->getLocationContext()); if (std::optional<Loc> LV = X.getAs<Loc>()) - state = state->bindLoc(*LV, UnknownVal(), Pred->getLocationContext()); + state = state->invalidateRegions(*LV, A, currBldrCtx->blockCount(), + Pred->getLocationContext(), + /*CausedByPointerEscape=*/true); } Bldr.generateNode(A, Pred, state); diff --git a/clang/test/Analysis/asm.cpp b/clang/test/Analysis/asm.cpp index e0691dc4d794f5..a795400ebbcaf7 100644 --- a/clang/test/Analysis/asm.cpp +++ b/clang/test/Analysis/asm.cpp @@ -7,11 +7,10 @@ void clang_analyzer_dump_ptr(void *); int global; void testRValueOutput() { - int &ref = global; - ref = 1; + int origVal = global; __asm__("" : "=r"(((int)(global)))); // don't crash on rvalue output operand - clang_analyzer_eval(global == 1); // expected-warning{{UNKNOWN}} - clang_analyzer_eval(ref == 1); // expected-warning{{UNKNOWN}} + int newVal = global; // Value "after" the invalidation. + clang_analyzer_eval(origVal == newVal); // expected-warning{{TRUE}} expected-warning{{FALSE}} } void *MyMemcpy(void *d, const void *s, const int n) { @@ -40,7 +39,20 @@ void testInlineAsmMemcpyUninit(void) { int a[10], b[10] = {}, c; MyMemcpy(&a[1], &b[1], sizeof(b) - sizeof(b[1])); - c = a[0]; // expected-warning{{Assigned value is garbage or undefined}} + c = a[0]; // FIXME: should be warning about uninitialized value, but invalidateRegions() also + // invalidates super region. +} + +void testInlineAsmMemcpyUninitLoop(const void *src, unsigned long len) +{ + int a[10], c; + unsigned long toCopy = sizeof(a) < len ? sizeof(a) : len; + + MyMemcpy(a, src, toCopy); + + // Use index 1, since before use of invalidateRegions in VisitGCCAsmStmt, engine bound unknown SVal only to + // first element. + c = a[1]; // no-warning } void testAsmWithVoidPtrArgument() @@ -49,6 +61,6 @@ void testAsmWithVoidPtrArgument() clang_analyzer_dump(*(int *)globalVoidPtr); // expected-warning-re {{reg_${{[0-9]+}}<int Element{SymRegion{reg_${{[0-9]+}}<void * globalVoidPtr>},0 S64b,int}>}} clang_analyzer_dump_ptr(globalVoidPtr); // expected-warning-re {{&SymRegion{reg_${{[0-9]+}}<void * globalVoidPtr>}}} asm ("" : : "a"(globalVoidPtr)); // no crash - clang_analyzer_dump(*(int *)globalVoidPtr); // expected-warning {{Unknown}} + clang_analyzer_dump(*(int *)globalVoidPtr); // expected-warning {{derived_}} clang_analyzer_dump_ptr(globalVoidPtr); // expected-warning-re {{&SymRegion{reg_${{[0-9]+}}<void * globalVoidPtr>}}} } _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
