<div dir="ltr">I'm not sure of the test case but the problem seems to be in MemRegion::getAsOffset(). <div>In switch case case CXXBaseObjectRegionKind:<div>if we cannot compute the offset of the base class we need to continue in the loop instead of moving further down-</div>
</div><div><br></div><div><div>Index: lib/StaticAnalyzer/Core/MemRegion.cpp</div><div>===================================================================</div><div>--- lib/StaticAnalyzer/Core/MemRegion.cpp<span class="" style="white-space:pre"> </span>(revision 190992)</div>
<div>+++ lib/StaticAnalyzer/Core/MemRegion.cpp<span class="" style="white-space:pre"> </span>(working copy)</div><div>@@ -1244,6 +1244,7 @@</div><div> if (!Child) {</div><div> // We cannot compute the offset of the base class.</div>
<div> SymbolicOffsetBase = R;</div><div>+ continue;</div><div> }</div><div> </div><div> if (RootIsSymbolic) {</div></div><div><br></div><div>What do you think Jordan?</div><div><br></div><div>Regards</div>
<div>Karthik Bhat</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Sep 20, 2013 at 5:51 AM, Jordan Rose <span dir="ltr"><<a href="mailto:jordan_rose@apple.com" target="_blank">jordan_rose@apple.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If it's not a private program you can create a bug at <a href="http://llvm.org/bugs/" target="_blank">http://llvm.org/bugs/</a> and attach the preprocessed file. If it is a private program (corporate or something) well...you could at least report where the caller is and what the original MemRegion is (using MemRegion::dump) and I can try to figure it out from that.<br>
<span class="HOEnZb"><font color="#888888"><br>
Jordan<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
On Sep 19, 2013, at 17:15 , Aditya Kumar <<a href="mailto:hiraditya@codeaurora.org">hiraditya@codeaurora.org</a>> wrote:<br>
<br>
> I was compiling a program when I hit this segmentation fault. The program is<br>
> kind of big and I don't know how to reduce it to a minimal test case.<br>
><br>
><br>
><br>
>> -----Original Message-----<br>
>> From: Jordan Rose [mailto:<a href="mailto:jordan_rose@apple.com">jordan_rose@apple.com</a>]<br>
>> Sent: Thursday, September 19, 2013 11:13 AM<br>
>> To: Aditya Kumar<br>
>> Cc: 'Clang Dev'<br>
>> Subject: Re: [cfe-dev] [StaticAnalyzer] Potential bug in MemRegion.cpp?<br>
>><br>
>> I think the bug here is that "Child" should never be NULL. How are you<br>
>> getting into this situation?<br>
>><br>
>> Jordan<br>
>><br>
>> On Sep 19, 2013, at 8:15 , Aditya Kumar <<a href="mailto:hiraditya@codeaurora.org">hiraditya@codeaurora.org</a>> wrote:<br>
>><br>
>>> When the following function is called by (RegionOffset<br>
>>> MemRegion::getAsOffset() const:1257), and the first parameter (Child)<br>
>>> is a NULL pointer I get a segmentation fault.<br>
>>><br>
>>> @file: MemRegion.cpp<br>
>>> 01164 static bool isImmediateBase(const CXXRecordDecl *Child,<br>
>>> 01165 const CXXRecordDecl *Base) {<br>
>>> 01166 // Note that we do NOT canonicalize the base class here, because<br>
>>> 01167 // ASTRecordLayout doesn't either. If that leads us down the<br>
> wrong<br>
>>> path,<br>
>>> 01168 // so be it; at least we won't crash.<br>
>>> 01169 for (CXXRecordDecl::base_class_const_iterator I =<br>
>>> Child->bases_begin(),<br>
>>> 01170 E =<br>
>>> Child->bases_end();<br>
>>> 01171 I != E; ++I) {<br>
>>> 01172 if (I->getType()->getAsCXXRecordDecl() == Base)<br>
>>> 01173 return true;<br>
>>> 01174 }<br>
>>> 01175<br>
>>> 01176 return false;<br>
>>> 01177 }<br>
>>><br>
>>> For now I just return `false' when `Child' pointer is NULL. Is this<br>
>>> fix okay or there is something else required to be done?<br>
>>><br>
>>><br>
>>> Thanks,<br>
>>> -Aditya<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> cfe-dev mailing list<br>
>>> <a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>
>>> <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
><br>
><br>
<br>
_______________________________________________<br>
cfe-dev mailing list<br>
<a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>
<a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
</div></div></blockquote></div><br></div>