<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hm.</div><div><br></div><div><blockquote type="cite">base{SymRegion{reg_$323<element{SymRegion{conj_$309{const void_cv_type *}},0<br>S32b,void *}>},Tile}->i_</blockquote><br></div><div>Yeah, this doesn't look like a good region. IIRC, a void* region should never have a base region directly wrapping it—there should always be an element region in between representing a cast. When the program tries to figure out where the "Tile" base class is located, there's no way to know, because our most derived class is "void".</div><div><br></div><div>Then again, we're not actually checking for this in MemRegionManager::getCXXBaseObjectRegion. You could try inserting an assertion there that <i>if</i> the base is a symbolic region, it's not void*.</div><div><br></div><div> if (auto symRegion = dyn_cast<SymbolicRegion>(Super))<br> assert(!symRegion->getSymbol()->getType()->isVoidPointerType());<br><br></div><div>This doesn't fire on any of the regression tests in the repository, but I didn't test it against any real projects. It should trip up your case, though, and then the stack trace should include the location where this bad region is formed.</div><div><br></div><div>Jordan</div><div><br></div><br><div><div>On Sep 20, 2013, at 11:50 , Aditya Kumar <<a href="mailto:hiraditya@codeaurora.org">hiraditya@codeaurora.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Yes the program is private, so I have the Memregion::dump(), hope this<br>helps.<br>I was curious if I could figure out the statement/function in the program<br>where this bug occurs. That way I could try to get a minimal test case.<br>Is it possible to see the program code from within the debugger?<br><br>Program received signal SIGSEGV, Segmentation fault.<br>0x0000000000eaaf2e in clang::CXXRecordDecl::data (this=0x0)<br><span class="Apple-tab-span" style="white-space:pre"> </span>at<br>/prj/llvm-arm/home/kaditya/llvm-debug/llvm/tools/clang/lib/CodeGen/../../inc<br>lude/clang/AST/DeclCXX.h:559<br>559 <span class="Apple-tab-span" style="white-space:pre"> </span>return *DefinitionData;<br>(gdb) up<br>#1 0x0000000000f0cc62 in clang::CXXRecordDecl::bases_begin (this=0x0)<br><span class="Apple-tab-span" style="white-space:pre"> </span>at<br>/prj/llvm-arm/home/kaditya/llvm-debug/llvm/tools/clang/lib/CodeGen/../../inc<br>lude/clang/AST/DeclCXX.h:673<br>673 <span class="Apple-tab-span" style="white-space:pre"> </span>base_class_const_iterator bases_begin() const { return<br>data().getBases(); }<br>(gdb)<br>#2 0x000000000177a670 in isImmediateBase (Child=0x0, Base=0x4a55520)<br><span class="Apple-tab-span" style="white-space:pre"> </span>at<br>/prj/llvm-arm/home/kaditya/llvm-debug/llvm/tools/clang/lib/StaticAnalyzer/Co<br>re/MemRegion.cpp:1154<br>1154 <span class="Apple-tab-span" style="white-space:pre"> </span>for (CXXRecordDecl::base_class_const_iterator I =<br>Child->bases_begin(),<br><br>#3 0x000000000177a8be in clang::ento::MemRegion::getAsOffset<br>(this=0x5cda100)<br><span class="Apple-tab-span" style="white-space:pre"> </span>at<br>/prj/llvm-arm/home/kaditya/llvm-debug/llvm/tools/clang/lib/StaticAnalyzer/Co<br>re/MemRegion.cpp:1242<br>1242 <span class="Apple-tab-span" style="white-space:pre"> </span>if (!isImmediateBase(Child, BOR->getDecl()))<br><br>(gdb) p this->dump()<br>base{SymRegion{reg_$323<element{SymRegion{conj_$309{const void_cv_type *}},0<br>S32b,void *}>},Tile}->i_$1 = void<br>(gdb) p this->getString()<br>$2 = {static npos = 18446744073709551615,<br> _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>><br>= {<No data fields>}, <No data fields>},<br><span class="Apple-tab-span" style="white-space:pre"> </span>_M_p = 0x59f8bc8<br>"base{SymRegion{reg_$323<element{SymRegion{conj_$309{const void_cv_type<br>*}},0 S32b,void *}>},Tile}->i_"}}<br><br><br>Thanks<br>-Aditya<br><br><blockquote type="cite">-----Original Message-----<br>From: Jordan Rose [mailto:jordan_rose@<a href="http://apple.com">apple.com</a>]<br>Sent: Thursday, September 19, 2013 7:22 PM<br>To: Aditya Kumar<br>Cc: 'Clang Dev'<br>Subject: Re: [cfe-dev] [StaticAnalyzer] Potential bug in MemRegion.cpp?<br><br>If it's not a private program you can create a bug at<br></blockquote><a href="http://llvm.org/bugs/">http://llvm.org/bugs/</a> and<br><blockquote type="cite">attach the preprocessed file. If it is a private program (corporate or<br>something) well...you could at least report where the caller is and what<br></blockquote>the<br><blockquote type="cite">original MemRegion is (using MemRegion::dump) and I can try to figure it<br></blockquote>out<br><blockquote type="cite">from that.<br><br>Jordan<br><br><br>On Sep 19, 2013, at 17:15 , Aditya Kumar <<a href="mailto:hiraditya@codeaurora.org">hiraditya@codeaurora.org</a>> wrote:<br><br><blockquote type="cite">I was compiling a program when I hit this segmentation fault. The<br>program is kind of big and I don't know how to reduce it to a minimal<br></blockquote></blockquote>test<br><blockquote type="cite">case.<br><blockquote type="cite"><br><br><br><blockquote type="cite">-----Original Message-----<br>From: Jordan Rose [mailto:jordan_rose@<a href="http://apple.com">apple.com</a>]<br>Sent: Thursday, September 19, 2013 11:13 AM<br>To: Aditya Kumar<br>Cc: 'Clang Dev'<br>Subject: Re: [cfe-dev] [StaticAnalyzer] Potential bug in MemRegion.cpp?<br><br>I think the bug here is that "Child" should never be NULL. How are<br>you getting into this situation?<br><br>Jordan<br><br>On Sep 19, 2013, at 8:15 , Aditya Kumar <<a href="mailto:hiraditya@codeaurora.org">hiraditya@codeaurora.org</a>><br></blockquote></blockquote>wrote:<br><blockquote type="cite"><blockquote type="cite"><br><blockquote type="cite">When the following function is called by (RegionOffset<br>MemRegion::getAsOffset() const:1257), and the first parameter<br>(Child) is a NULL pointer I get a segmentation fault.<br><br>@file: MemRegion.cpp<br>01164 static bool isImmediateBase(const CXXRecordDecl *Child,<br>01165 const CXXRecordDecl *Base) {<br>01166 // Note that we do NOT canonicalize the base class here,<br></blockquote></blockquote></blockquote></blockquote>because<br><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">01167 // ASTRecordLayout doesn't either. If that leads us down the<br></blockquote></blockquote>wrong<br><blockquote type="cite"><blockquote type="cite">path,<br>01168 // so be it; at least we won't crash.<br>01169 for (CXXRecordDecl::base_class_const_iterator I =<br>Child->bases_begin(),<br>01170 E =<br>Child->bases_end();<br>01171 I != E; ++I) {<br>01172 if (I->getType()->getAsCXXRecordDecl() == Base)<br>01173 return true;<br>01174 }<br>01175<br>01176 return false;<br>01177 }<br><br>For now I just return `false' when `Child' pointer is NULL. Is this<br>fix okay or there is something else required to be done?<br><br><br>Thanks,<br>-Aditya<br><br><br>_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></blockquote><br><br></blockquote></blockquote><br><br></blockquote></div><br></body></html>