Author: dergachev Date: Wed Nov 8 09:27:58 2017 New Revision: 317700 URL: http://llvm.org/viewvc/llvm-project?rev=317700&view=rev Log: [analyzer] Fix a crash on logical operators with vectors.
Do not crash when trying to compute x && y or x || y where x and y are of a vector type. For now we do not seem to properly model operations with vectors. In particular, operations && and || on a pair of vectors are not short-circuit, unlike regular logical operators, so even our CFG is incorrect. Avoid the crash, add respective FIXME tests for later. Differential Revision: https://reviews.llvm.org/D39682 rdar://problem/34317663 Added: cfe/trunk/test/Analysis/vector.c Modified: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp Modified: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp?rev=317700&r1=317699&r2=317700&view=diff ============================================================================== --- cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp (original) +++ cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp Wed Nov 8 09:27:58 2017 @@ -626,6 +626,16 @@ void ExprEngine::VisitLogicalExpr(const StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef state = Pred->getState(); + if (B->getType()->isVectorType()) { + // FIXME: We do not model vector arithmetic yet. When adding support for + // that, note that the CFG-based reasoning below does not apply, because + // logical operators on vectors are not short-circuit. Currently they are + // modeled as short-circuit in Clang CFG but this is incorrect. + // Do not set the value for the expression. It'd be UnknownVal by default. + Bldr.generateNode(B, Pred, state); + return; + } + ExplodedNode *N = Pred; while (!N->getLocation().getAs<BlockEntrance>()) { ProgramPoint P = N->getLocation(); Added: cfe/trunk/test/Analysis/vector.c URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/vector.c?rev=317700&view=auto ============================================================================== --- cfe/trunk/test/Analysis/vector.c (added) +++ cfe/trunk/test/Analysis/vector.c Wed Nov 8 09:27:58 2017 @@ -0,0 +1,28 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify %s + +typedef int __attribute__((ext_vector_type(2))) V; + +void clang_analyzer_numTimesReached(); +void clang_analyzer_eval(int); + +int flag; + +V pass_through_and_set_flag(V v) { + flag = 1; + return v; +} + +V dont_crash_and_dont_split_state(V x, V y) { + flag = 0; + V z = x && pass_through_and_set_flag(y); + clang_analyzer_eval(flag); // expected-warning{{TRUE}} + // FIXME: For now we treat vector operator && as short-circuit, + // but in fact it is not. It should always evaluate + // pass_through_and_set_flag(). It should not split state. + // Now we also get FALSE on the other path. + // expected-warning@-5{{FALSE}} + + // FIXME: Should be 1 since we should not split state. + clang_analyzer_numTimesReached(); // expected-warning{{2}} + return z; +} _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
