[cfe-commits] r44822 - in /cfe/trunk: AST/CFG.cpp include/clang/Analysis/ExprDeclBitVector.h

[Ted Kremenek]

Author: kremenek
Date: Mon Dec 10 17:58:39 2007
New Revision: 44822

URL: http://llvm.org/viewvc/llvm-project?rev=44822&view=rev
Log:
Fixed bug in CFG::PopulateBlkExprMap where the ordering
between fetching the size of the expression map (for use as
the next integer id for an Expr*) and the creation of the
entry in the map could be non-deterministic.  This could
cause the size of the map to be incremented prior to the
index being determine.

On Linux the map entry would be created first, causing the
map to the "size" to be incremented prior to it being
queried. On Mac OS X we had the reverse behavior. Now the
size is always queried prior to the new id being inserted
into the map.

This was the real cause of the bit-overrun triggered in
PR 1847:

  http://llvm.org/bugs/show_bug.cgi?id=1847
  
Also reverted the change in patch 44813, which was a bogus
fix to this problem:

  http://llvm.org/viewvc/llvm-project?rev=44813&view=rev

Modified:
    cfe/trunk/AST/CFG.cpp
    cfe/trunk/include/clang/Analysis/ExprDeclBitVector.h

Modified: cfe/trunk/AST/CFG.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/AST/CFG.cpp?rev=44822&r1=44821&r2=44822&view=diff

==============================================================================
--- cfe/trunk/AST/CFG.cpp (original)
+++ cfe/trunk/AST/CFG.cpp Mon Dec 10 17:58:39 2007
@@ -969,8 +969,10 @@
   
   for (CFG::iterator I=cfg.begin(), E=cfg.end(); I != E; ++I)
     for (CFGBlock::iterator BI=I->begin(), EI=I->end(); BI != EI; ++BI)
-      if (const Expr* E = dyn_cast<Expr>(*BI))
-        (*M)[E] = M->size();
+      if (const Expr* E = dyn_cast<Expr>(*BI)) {
+        unsigned x = M->size();
+        (*M)[E] = x;
+      }
   
   return M;
 }

Modified: cfe/trunk/include/clang/Analysis/ExprDeclBitVector.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/ExprDeclBitVector.h?rev=44822&r1=44821&r2=44822&view=diff

==============================================================================
--- cfe/trunk/include/clang/Analysis/ExprDeclBitVector.h (original)
+++ cfe/trunk/include/clang/Analysis/ExprDeclBitVector.h Mon Dec 10 17:58:39 2007
@@ -73,7 +73,7 @@
   public:
     
     void resetValues(AnalysisDataTy& AD) {
-      DeclBV.resize(AD.getNumDecls()+1); 
+      DeclBV.resize(AD.getNumDecls()); 
       DeclBV.reset();
     }
     
@@ -172,7 +172,7 @@
     
     void resetValues(AnalysisDataTy& AD) {
       ParentRef(*this).resetValues(AD);
-      ExprBV.resize(AD.getNumExprs()+1);
+      ExprBV.resize(AD.getNumExprs());
       ExprBV.reset();
     }