[cfe-commits] r75521 - in /cfe/trunk: lib/Analysis/SimpleSValuator.cpp test/Analysis/misc-ps-basic-store.m test/Analysis/misc-ps-region-store.m test/Analysis/misc-ps.m

[Ted Kremenek]

Author: kremenek
Date: Mon Jul 13 16:55:12 2009
New Revision: 75521

URL: http://llvm.org/viewvc/llvm-project?rev=75521&view=rev
Log:
Enhance SimpleSValuator::EvalBinOpNN to recognize the trivial case
where we are comparing a symbolic value against itself, regardless of
the nature of that symbolic value.

This enhancement identified a case where RegionStoreManager is not
correctly symbolicating the values of the pointees of parameters.  The
failing test is now in 'test/Analysis/misc-ps-region-store.m', with
that test file now (temporarily) marked XFAIL.

Modified:
    cfe/trunk/lib/Analysis/SimpleSValuator.cpp
    cfe/trunk/test/Analysis/misc-ps-basic-store.m
    cfe/trunk/test/Analysis/misc-ps-region-store.m
    cfe/trunk/test/Analysis/misc-ps.m

Modified: cfe/trunk/lib/Analysis/SimpleSValuator.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/SimpleSValuator.cpp?rev=75521&r1=75520&r2=75521&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/SimpleSValuator.cpp (original)
+++ cfe/trunk/lib/Analysis/SimpleSValuator.cpp Mon Jul 13 16:55:12 2009
@@ -176,7 +176,26 @@
 
 SVal SimpleSValuator::EvalBinOpNN(BinaryOperator::Opcode op,
                                   NonLoc lhs, NonLoc rhs,
-                                  QualType resultTy)  {  
+                                  QualType resultTy)  {
+
+  assert(!lhs.isUnknownOrUndef());
+  assert(!rhs.isUnknownOrUndef());
+
+  // Handle trivial case where left-side and right-side are the same.
+  if (lhs == rhs)
+    switch (op) {
+      default:
+        break;
+      case BinaryOperator::EQ:
+      case BinaryOperator::LE:
+      case BinaryOperator::GE:
+        return ValMgr.makeTruthVal(true, resultTy);
+      case BinaryOperator::LT:
+      case BinaryOperator::GT:
+      case BinaryOperator::NE:
+        return ValMgr.makeTruthVal(false, resultTy);
+    }
+  
   while (1) {
     switch (lhs.getSubKind()) {
     default:

Modified: cfe/trunk/test/Analysis/misc-ps-basic-store.m
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/misc-ps-basic-store.m?rev=75521&r1=75520&r2=75521&view=diff

==============================================================================
--- cfe/trunk/test/Analysis/misc-ps-basic-store.m (original)
+++ cfe/trunk/test/Analysis/misc-ps-basic-store.m Mon Jul 13 16:55:12 2009
@@ -20,3 +20,17 @@
       ).__i))) & 0xff00) >> 8) == 1)
         ret = 1;
 }
+
+// BasicStore handles this case incorrectly because it doesn't reason about
+// the value pointed to by 'x' and thus creates different symbolic values
+// at the declarations of 'a' and 'b' respectively.  See the companion test
+// in 'misc-ps-region-store.m'.
+void test_trivial_symbolic_comparison_pointer_parameter(int *x) {
+  int a = *x;
+  int b = *x;
+  if (a != b) {
+    int *p = 0;
+    *p = 0xDEADBEEF;     // expected-warning{{null}}
+  }
+}
+

Modified: cfe/trunk/test/Analysis/misc-ps-region-store.m
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/misc-ps-region-store.m?rev=75521&r1=75520&r2=75521&view=diff

==============================================================================
--- cfe/trunk/test/Analysis/misc-ps-region-store.m (original)
+++ cfe/trunk/test/Analysis/misc-ps-region-store.m Mon Jul 13 16:55:12 2009
@@ -1,4 +1,5 @@
 // RUN: clang-cc -analyze -checker-cfref --analyzer-store=region --verify -fblocks %s
+// XFAIL
 
 typedef struct objc_selector *SEL;
 typedef signed char BOOL;
@@ -68,3 +69,17 @@
   return 'a';
 }
 
+// *** THIS TEST IS CURRENTLY FAILING ***
+// BasicStore handles this case incorrectly because it doesn't reason about
+// the value pointed to by 'x' and thus creates different symbolic values
+// at the declarations of 'a' and 'b' respectively.  RegionStore handles
+// it correctly. See the companion test in 'misc-ps-basic-store.m'.
+void test_trivial_symbolic_comparison_pointer_parameter(int *x) {
+  int a = *x;
+  int b = *x;
+  if (a != b) {
+    int *p = 0;
+    *p = 0xDEADBEEF;     // no-warning
+  }
+}
+

Modified: cfe/trunk/test/Analysis/misc-ps.m
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/misc-ps.m?rev=75521&r1=75520&r2=75521&view=diff

==============================================================================
--- cfe/trunk/test/Analysis/misc-ps.m (original)
+++ cfe/trunk/test/Analysis/misc-ps.m Mon Jul 13 16:55:12 2009
@@ -371,3 +371,20 @@
   }
 }
 
+void test_trivial_symbolic_comparison(int *x) {
+  int test_trivial_symbolic_comparison_aux();
+  int a = test_trivial_symbolic_comparison_aux();
+  int b = a;
+  if (a != b) {
+    int *p = 0;
+    *p = 0xDEADBEEF;     // no-warning
+  }
+  
+  a = a == 1;
+  b = b == 1;
+  if (a != b) {
+    int *p = 0;
+    *p = 0xDEADBEEF;     // no-warning
+  }
+}
+