<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Looks good to me. See a comment below. CC-ing Jordan.<div><br></div><div>Anna.<br><div><div>On Jun 17, 2013, at 11:54 AM, Pavel Labath <<a href="mailto:labath@google.com">labath@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">When processing a call to a function, which got passed less arguments than it<br>expects, the analyzer would crash.<br><br>I've also added a test for that and a analyzer warning which detects these<br>cases.<br><br><a href="http://llvm-reviews.chandlerc.com/D994">http://llvm-reviews.chandlerc.com/D994</a><br><br>Files:<br> lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp<br> lib/StaticAnalyzer/Core/CallEvent.cpp<br> test/Analysis/fewer-args.cpp<br><br>Index: lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp<br>===================================================================<br>--- lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp<br>+++ lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp<br>@@ -40,6 +40,7 @@<br> mutable OwningPtr<BugType> BT_objc_subscript_undef;<br> mutable OwningPtr<BugType> BT_msg_arg;<br> mutable OwningPtr<BugType> BT_msg_ret;<br>+ mutable OwningPtr<BugType> BT_call_few_args;<br>public:<br><br> void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;<br>@@ -280,11 +281,32 @@<br> State = StNonNull;<br> }<br><br>+ const Decl *D = Call.getDecl();<br>+ if (D && isa<FunctionDecl>(D)) {<br>+ // If we have a declaration, we can make sure we pass enough parameters to<br>+ // the function.<br>+ unsigned Params = cast<FunctionDecl>(D)->getNumParams();<br>+ if (Call.getNumArgs() < Params) {<br>+ ExplodedNode *N = C.generateSink();<br>+ if (!N)<br>+ return;<br>+<br>+ LazyInit_BT("Function call with too few arguments", BT_call_few_args);<br></div></blockquote></div><div><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">+<br>+ SmallString<512> Str;<br>+ llvm::raw_svector_ostream os(Str);<br>+ os << "Function taking " << Params << " argument(s) called with less ("<br></div></blockquote><div><br></div>"arguments(s)" -> (Params > 1) ? "arguments" : "argument"</div><div><br></div><div>also a verb is missing:</div><div><br></div><div>"Function taking 5 arguments called with " -> "Function taking 5 arguments is called with "</div><div><br><blockquote type="cite"></blockquote><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">+ << Call.getNumArgs() << ")";<br>+<br>+ BugReport *R = new BugReport(*BT_call_few_args, os.str(), N);<br>+ C.emitReport(R);<br>+ }<br>+ }<br>+<br> // Don't check for uninitialized field values in arguments if the<br> // caller has a body that is available and we have the chance to inline it.<br> // This is a hack, but is a reasonable compromise betweens sometimes warning<br> // and sometimes not depending on if we decide to inline a function.<br>- const Decl *D = Call.getDecl();<br> const bool checkUninitFields =<br> !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody()));<br><br>Index: lib/StaticAnalyzer/Core/CallEvent.cpp<br>===================================================================<br>--- lib/StaticAnalyzer/Core/CallEvent.cpp<br>+++ lib/StaticAnalyzer/Core/CallEvent.cpp<br>@@ -272,8 +272,9 @@<br> CallEvent::param_iterator E) {<br> MemRegionManager &MRMgr = SVB.getRegionManager();<br><br>+ unsigned NumArgs = Call.getNumArgs();<br> unsigned Idx = 0;<br>- for (; I != E; ++I, ++Idx) {<br>+ for (; I != E && Idx < NumArgs; ++I, ++Idx) {<br> const ParmVarDecl *ParamDecl = *I;<br> assert(ParamDecl && "Formal parameter has no decl?");<br><br>Index: test/Analysis/fewer-args.cpp<br>===================================================================<br>--- /dev/null<br>+++ test/Analysis/fewer-args.cpp<br>@@ -0,0 +1,7 @@<br>+// RUN: %clang_cc1 -analyze -analyzer-checker=core %s -verify<br>+<br>+void f(int a) { }<br>+<br>+void g() {<br>+ reinterpret_cast<void (*)()>(f)(); // expected-warning{{Function taking 1 argument(s) called with less (0)}}<br>+}<br><span><D994.1.patch></span>_______________________________________________<br>cfe-commits mailing list<br><a href="mailto:cfe-commits@cs.uiuc.edu">cfe-commits@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-commits</div></blockquote></div><br></div></body></html>