maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[analyzer] Fix the crash in IteratorChecker.cpp when 'SymbolConjured' has a null Stmt. 

When the loop has a null terminator statement and sets 'widen-loops=true', 'invalidateRegions' will constructs the 'SymbolConjured' with null 'Stmt'. And this will lead to a crash in 'IteratorChecker.cpp'. This patch use 'dyn_cast_or_null<>' instead of 'dyn_cast<>' in IteratorChecker.cpp.

Differential Revision: https://reviews.llvm.org/D44606

llvm-svn: 327962
This commit is contained in:
Henry Wong 2018-03-20 09:27:02 +00:00
parent bf3213e485
commit 073d5f023c
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
View File

@ -604,7 +604,7 @@ BinaryOperator::Opcode getOpcode(const SymExpr *SE) {
if (const auto *BSE = dyn_cast<BinarySymExpr>(SE)) {
return BSE->getOpcode();
} else if (const auto *SC = dyn_cast<SymbolConjured>(SE)) {
const auto *COE = dyn_cast<CXXOperatorCallExpr>(SC->getStmt());
const auto *COE = dyn_cast_or_null<CXXOperatorCallExpr>(SC->getStmt());
if (!COE)
return BO_Comma; // Extremal value, neither EQ nor NE
if (COE->getOperator() == OO_EqualEqual) {

14
clang/test/Analysis/loop-widening.c
View File

@ -1,4 +1,5 @@
// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify %s
// RUN: %clang_analyze_cc1 -DTEST_NULL_TERM -analyzer-checker=core,unix.Malloc,debug.ExprInspection,alpha.cplusplus.IteratorRange -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify %s
void clang_analyzer_eval(int);
void clang_analyzer_warnIfReached();
@ -188,3 +189,16 @@ void nested_loop_inner_widen() {
}
clang_analyzer_eval(i >= 2); // expected-warning {{TRUE}}
}
#ifdef TEST_NULL_TERM
void null_terminator_loop_widen(int *a) {
int c;
// Loop widening will call 'invalidateRegions()' and 'invalidateRegions()'
// will construct the SymbolConjured with null Stmt because of the null
// terminator statement. Accessing the null Stmt will cause a crash.
for (;;) {
c = *a; // no-crash
a++;
}
}
#endif