<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Jun 19, 2013, at 5:00 AM, Pavel Labath <<a href="mailto:labath@google.com">labath@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">When doing a reinterpret+dynamic cast from an incomplete type, the analyzer<br>would crash (bug #16308). This fix makes the dynamic cast evaluator ignore<br>incomplete types, as they can never be used in a dynamic_cast. Also adding a<br>regression test.<br><br><a href="http://llvm-reviews.chandlerc.com/D1006">http://llvm-reviews.chandlerc.com/D1006</a><br><br>Files:<br> lib/StaticAnalyzer/Core/Store.cpp<br> test/Analysis/derived-to-base.cpp<br><br>Index: lib/StaticAnalyzer/Core/Store.cpp<br>===================================================================<br>--- lib/StaticAnalyzer/Core/Store.cpp<br>+++ lib/StaticAnalyzer/Core/Store.cpp<br>@@ -325,7 +325,9 @@<br> if (MRClass == TargetClass)<br> return loc::MemRegionVal(MR);<br><br>- if (!TargetType->isVoidType()) {<br>+ // We skip over incomplete types. They must be the result of an earlier<br>+ // reinterpret_cast, as one cannot dynamically cast from an incomplete type.<br>+ if (!TargetType->isVoidType() && MRClass->isCompleteDefinition()) {<br></div></blockquote><div><br></div><div>Using CXXrecordDecl::hasDefinition() might be more appropriate in this check.</div><div><br></div>From Decl.h:</div><div><div style="margin: 0px; font-size: 14px; font-family: Menlo; color: rgb(0, 132, 0);"> /// 'isDefinition' indicates</div><div style="margin: 0px; font-size: 14px; font-family: Menlo; color: rgb(0, 132, 0);"><span style="color: #000000"> </span>/// whether or not a specific TagDecl is defining declaration, not</div><div style="margin: 0px; font-size: 14px; font-family: Menlo; color: rgb(0, 132, 0);"><span style="color: #000000"> </span>/// whether or not the struct/union/class/enum type is defined.</div><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> // Static upcasts are marked as DerivedToBase casts by Sema, so this will<br> // only happen when multiple or virtual inheritance is involved.<br> CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,<br>Index: test/Analysis/derived-to-base.cpp<br>===================================================================<br>--- test/Analysis/derived-to-base.cpp<br>+++ test/Analysis/derived-to-base.cpp<br>@@ -450,3 +450,28 @@<br> }<br>};<br><br>+namespace Bug16309 {<br>+ struct Incomplete;<br>+<br>+ struct Base { virtual ~Base(); };<br>+<br>+ struct Derived : public Base { int x; };<br>+<br>+ void* f(Incomplete *i) {<br>+ Base *b = reinterpret_cast<Base *>(i);<br>+ // This used to crash because of the reinterpret_cast above.<br>+ Derived *d = dynamic_cast<Derived *>(b);<br>+ return d;<br>+ }<br>+<br>+ // And check that reinterpret+dynamic casts work correctly after the fix.<br>+ void g() {<br>+ Derived d;<br>+ d.x = 47;<br>+ Base *b = &d;<br>+ Incomplete *i = reinterpret_cast<Incomplete *>(b);<br>+ Base *b2 = reinterpret_cast<Base *>(i);<br>+ Derived *d2 = dynamic_cast<Derived *>(b2);<br>+ clang_analyzer_eval(d2->x == 47); // expected-warning{{TRUE}}<br>+ }<br>+}<br><span><D1006.1.patch></span>_______________________________________________<br>cfe-commits mailing list<br><a href="mailto:cfe-commits@cs.uiuc.edu">cfe-commits@cs.uiuc.edu</a><br><a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-commits">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-commits</a></div></blockquote></div><br></body></html>