[PATCH] D37120: [analyzer] Fix modeling arithmetic
Artem Dergachev via Phabricator via cfe-commits
cfe-commits at lists.llvm.org
Fri Aug 25 04:28:00 PDT 2017
NoQ added a comment.
I guess we'd need more assertions to catch invalid symbols, will have a look.
Comment at: lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp:371-373
+ return makeSymExprValNN(
+ state, op, lhs.castAs<nonloc::LocAsInteger>(),
+ rhs.castAs<nonloc::ConcreteInt>(), resultTy);
For now this code would return `UnknownVal` in most cases (pointer is not tainted, or not symbolic, or contains an offset), and still construct an invalid symbol in the rest of the cases (`makeSymExprValNN` would add the number to the pointer symbol, instead of modelling an offset within the pointed-to region).
Once D35450 finally lands (sorry for the delays...), it'd return `UnknownVal` less often and crash more often.
Comment at: lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp:375-377
// FIXME: This only makes sense for comparisons. If we want to, say,
// add 1 to a LocAsInteger, we'd better unpack the Loc and add to it,
// then pack it back into a LocAsInteger.
I guess you're trying to address this FIXME i recently added. This is probably the way to go: just take the `Loc` behind the `LocAsInteger`, cast it to `char *` (because pointer type shouldn't affect how much bytes of offset are added, anymore), add your integer to it, pack back into `LocAsInteger`.
More information about the cfe-commits