<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>So, Anna brought up that the check as implemented is very nearly path-independent, i.e. it only depends on flow-sensitive properties of the CFG. The path-sensitivity is buying us very little; it catches this case:</div><div><br></div><div></div><blockquote type="cite"><div>int y = x;</div><div>int div = z / y;</div><div>if (x) { ...}</div></blockquote><div><br></div><div>But also warns here, which doesn't necessarily make sense:</div><div><br></div><div></div><blockquote type="cite"><div>int foo(int x, int y, int z) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>int div = z / y;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>if (x) return div;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>return 0;</div><div>}</div><div><br></div><div>foo(a, a, b); // only coincidentally the same symbol</div></blockquote><div><br></div><div>What would you think about turning this (and/or the null dereference check) into a CFG-based check instead? We lose the first example (and cases where inlining would help), but fix the second, and very possibly speed up analysis. CFG analysis is also more capable of proving that something happens on <i>all</i> paths rather than just some, since that's just propagating information along the graph.</div><div><br></div><div>Jordan</div><div><br></div><br><div><div>On Jul 10, 2014, at 9:55 , Anders Rönnholm <<a href="mailto:Anders.Ronnholm@evidente.se">Anders.Ronnholm@evidente.se</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Great, no problem. I'll move forward with my dereference then check patch now that this one is commited, which will be pretty similar.<br><br>//Anders<br><br>.......................................................................................................................<br>Anders Rönnholm Senior Engineer<br>Evidente ES East AB Warfvinges väg 34 SE-112 51 Stockholm Sweden<br><br>Mobile: +46 (0)70 912 42 54<br>E-mail: <a href="mailto:Anders.Ronnholm@evidente.se">Anders.Ronnholm@evidente.se</a><br><br><a href="http://www.evidente.se">www.evidente.se</a><br><br>________________________________________<br>Från: Jordan Rose [jordan_rose@apple.com]<br>Skickat: den 10 juli 2014 18:20<br>Till: Anders Rönnholm<br>Cc: cfe-commits@cs.uiuc.edu; Daniel Marjamäki<br>Ämne: Re: [PATCH] Division by zero<br><br>Thank you for going through so many rounds of review on this. Committed in r212731! (The one change I made was to reset the test in isZero to use assume instead of assumeDual, now that my confusion has been fixed.)<br><br>Jordan<br></blockquote></div><br></body></html>