<html><head><meta http-equiv="Content-Type" content="text/html charset=GB2312"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi, Arthur.</div><br><div><div>On Jul 16, 2013, at 6:23 , Arthur Yoo <<a href="mailto:phjy007@gmail.com">phjy007@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Hi Jordan,<div><br></div><div>I created a new SVal with the SValBuilder and then replaced the old SVal with the new one. </div><div><br></div><div>Now I have another question about MemRegion. Can I get the offset of a SubRegion to its SuperRegion? For an example, here is a struct object:</div>
<div>struct LayerOne {</div><div> int a;</div><div> char b;</div><div> int c;</div><div>} obj;</div><div>It's obvious that the obj.a's SuperRegion is obj. And so are obj.c's and obj.b's. More importantly, I know that the offset of obj.a to its SuperRegion(obj) equals 0, the offset of obj.b to its SuperRegion(obj) equals 4 and the offset of obj.c to its SuperRegion(obj) equals 8. So I wonder in Clang Static Analyzer, is there any functions or methods which developer can use to calculate the offsets of SubRegions to their SuperRegions? In other words, we can assume regionObjDotB is a MemRegion Object which stands for obj.b, is there any functions or methods like "regionObjDotB.getOffset()"? If no, how can I get the offsets of SubRegions to their SuperRegions? </div>
<div></div></div></blockquote><div><br></div><div>If you want to know the offset from the base region, you can use the MemRegion::getAsOffset method. However, I would guess this isn't actually the best way to solve whatever you're trying to do; most of the analyzer is set up deliberately so that you <i>don't</i> have to think about offsets (and in some cases should not). What <i>are</i> you trying to do?</div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div>In addition, I found a strange situation. Here are the codes.</div><div><div> 1<span style="white-space:pre-wrap"> </span>struct LayerOne {</div><div> 2<span style="white-space:pre-wrap"> </span> int a;</div>
<div> 3<span style="white-space:pre-wrap"> </span> int b;</div><div> 4<span style="white-space:pre-wrap"> </span>};</div><div> 5<span style="white-space:pre-wrap"> </span></div><div> 6<span style="white-space:pre-wrap"> </span>void func() {</div>
<div> 7<span style="white-space:pre-wrap"> </span> struct LayerOne obj;</div><div> 8<span style="white-space:pre-wrap"> </span> obj.a = 1;</div><div> 9<span style="white-space:pre-wrap"> </span> obj.b = 2;</div>
<div> 10<span style="white-space:pre-wrap"> </span> void* p = &obj;</div><div> 11<span style="white-space:pre-wrap"> </span> p = p + 4;</div><div> 12<span style="white-space:pre-wrap"> </span> *((int*)p) = 200; // here p points to obj.b actually</div>
<div> 13<span style="white-space:pre-wrap"> </span> p = p + 4;</div><div> 14<span style="white-space:pre-wrap"> </span> *((int*)p) = 99999; // here the area pointed by p is outside of obj! </div><div>
15<span style="white-space:pre-wrap"> </span>}</div></div><div><br></div><div>After the analyzer analyzed the BinaryOperator(assignment operator) in line 12, I got the dump information:</div><div><div>BinaryOperator 0x4d1b0d0 'int' '='</div>
<div>|-UnaryOperator 0x4d1b090 'int' lvalue prefix '*'</div><div>| `-ParenExpr 0x4d1b070 'int *'</div><div>| `-CStyleCastExpr 0x4d1b048 'int *' <BitCast></div><div>| `-ImplicitCastExpr 0x4d1b030 'void *' <LValueToRValue></div>
<div>| `-DeclRefExpr 0x4d1afc0 'void *' lvalue Var 0x4d1adc0 'p' 'void *'</div><div>`-IntegerLiteral 0x4d1b0b0 'int' 200</div><div>LHS_sval: &element{obj,0 S32b,int}</div><div>LHS_region: element{obj,0 S32b,int}</div>
<div>sval: 200 S32b</div><div>size: 4 S32b</div><div>space: StackLocalsSpaceRegion</div><div>Base_Region: obj</div><div>Super_Region: obj</div></div><div><br></div><div>From the dump information above, I can know that obj.b has been assigned a value of 200. Does S32b mean signed-32bit? And since the obj.b's offset is 4, why LHS_region is element{obj,0 S32b,int} rather than element{obj,4 S32b,int}?</div></div></blockquote><div><br></div><div>I would guess the analyzer doesn't bother to handle pointer arithmetic on type void*, which is technically illegal. Clang-the-compiler follows GCC's lead in treating it like char*, though, so we should probably do that. Please file a bug.</div><div><br></div><div>Citations for legality: C11 6.5.6p2 ("one operand shall be a pointer to a complete object type") and 6.2.5p19 ("[void] is an incomplete object type").</div><div><br></div><div>(And yes, S32b means "signed 32-bit".)</div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div>After the analyzer analyzed the BinaryOperator(assignment operator) in line 14, I got the dump information:BinaryOperator 0x4d1b2b0 'int' '='</div><div><div>BinaryOperator 0x4d1b2b0 'int' '='</div>
<div>|-UnaryOperator 0x4d1b270 'int' lvalue prefix '*'</div><div>| `-ParenExpr 0x4d1b250 'int *'</div><div>| `-CStyleCastExpr 0x4d1b228 'int *' <BitCast></div><div>| `-ImplicitCastExpr 0x4d1b210 'void *' <LValueToRValue></div>
<div>| `-DeclRefExpr 0x4d1b1d0 'void *' lvalue Var 0x4d1adc0 'p' 'void *'</div><div>`-IntegerLiteral 0x4d1b290 'int' 99999</div><div>lhs_sval: &element{obj,0 S32b,int}</div><div>
lhs_region: element{obj,0 S32b,int}</div>
<div>sval: 99999 S32b</div><div>size: 4 S32b</div><div>space: StackLocalsSpaceRegion</div><div>Base_Region: obj</div><div>Super_Region: obj</div></div><div><br></div><div>Here, my first question is similar, since the pointer p's offset is 8 at that moment, why LHS_region is element{obj,0 S32b,int} rather than element{obj,8 S32b,int}? What makes me more confused is that in line 14, the destination pointed by p is outside of obj, but the dump information still shows "Super_Region: obj". </div>
<div><span style="font-family:arial,sans-serif;font-size:14px">Am I doing something stupid here?</span><br></div></div></blockquote><br></div><div>No, apparently we are. ;-) Thanks for finding this.</div><div><br></div><div>Jordan</div><br></body></html>