<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:596: clang::ento::loc::MemRegionVal::MemRegionVal(const clang::ento::MemRegion *): Assertion `r' failed."
href="https://bugs.llvm.org/show_bug.cgi?id=50179">50179</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:596: clang::ento::loc::MemRegionVal::MemRegionVal(const clang::ento::MemRegion *): Assertion `r' failed.
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Static Analyzer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>dcoughlin@apple.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>vince.a.bridgers@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>dcoughlin@apple.com, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>This crash seems to have been introduced by
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - clang-tidy crash with vulkan-cereal/.../VulkanStream.cpp"
href="show_bug.cgi?id=49007">https://bugs.llvm.org/show_bug.cgi?id=49007</a>.
Trimmed crash ...
$ clang --analyze case.c
clang: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:596:
clang::ento::loc::MemRegionVal::MemRegionVal(const clang::ento::MemRegion *):
Assertion `r' failed.
Stack dump:
0. Program arguments: clang --analyze case.c
1. <eof> parser at end of file
2. While analyzing stack:
#0 Calling getTaskJob
3. case.c:12:17: Error evaluating statement
4. case.c:12:17: Error evaluating statement
#11 0x00000000077ae64c
clang::ento::loc::MemRegionVal::MemRegionVal(clang::ento::MemRegion const*)
clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:597:3
#12 0x00000000082e2f7a
clang::ento::SValBuilder::evalCastSubKind(clang::ento::loc::MemRegionVal,
clang::QualType, clang::QualType)
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:773:18
#13 0x00000000082e228f clang::ento::SValBuilder::evalCastKind(clang::ento::Loc,
clang::QualType, clang::QualType)
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:612:12
#14 0x00000000082dfb4c clang::ento::SValBuilder::evalCast(clang::ento::SVal,
clang::QualType, clang::QualType)
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:587:12
#15 0x00000000082a2b48 (anonymous
namespace)::RegionStoreManager::getBinding((anonymous
namespace)::RegionBindingsRef const&, clang::ento::Loc, clang::QualType)
clang/lib/StaticAnalyzer/Core/RegionStore.cpp:1510:24
reproducer ...
clang --analyze case.c
typedef struct taskS {
void * pJob;
} taskS;
typedef struct workS {
taskS * pTaskList;
} workS;
void * getTaskJob ( unsigned jobId , workS *pWork, unsigned taskId)
{
const taskS * pTask = pWork->pTaskList + taskId;
taskS task = *pTask;
return task.pJob;
}
anticipated fix (to be submitted)
@@ -761,8 +761,8 @@ SVal SValBuilder::evalCastSubKind(loc::MemRegionVal V,
QualType CastTy,
// Next fixes pointer dereference using type different from its initial
// one. See PR37503 and PR49007 for details.
if (const auto *ER = dyn_cast<ElementRegion>(R)) {
- R = StateMgr.getStoreManager().castRegion(ER, CastTy);
- return loc::MemRegionVal(R);
+ if ((R = StateMgr.getStoreManager().castRegion(ER, CastTy)))
+ return loc::MemRegionVal(R);
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>