[cfe-commits] r138372 - in /cfe/trunk: lib/Analysis/CFG.cpp lib/StaticAnalyzer/Core/ExprEngineC.cpp test/Analysis/outofbound-notwork.c test/Analysis/outofbound.c test/Sema/uninit-variables.c
Ted Kremenek
kremenek at apple.com
Tue Aug 23 13:30:50 PDT 2011
Author: kremenek
Date: Tue Aug 23 15:30:50 2011
New Revision: 138372
URL: http://llvm.org/viewvc/llvm-project?rev=138372&view=rev
Log:
Fix regression in -Wuninitialized involving VLAs. It turns out that we were modeling sizeof(VLAs)
incorrectly in the CFG, and also the static analyzer. This patch regresses the analyzer a bit, but
that needs to be followed up with a better solution.
Fixes <rdar://problem/10008112>.
Added:
cfe/trunk/test/Analysis/outofbound-notwork.c
Modified:
cfe/trunk/lib/Analysis/CFG.cpp
cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp
cfe/trunk/test/Analysis/outofbound.c
cfe/trunk/test/Sema/uninit-variables.c
Modified: cfe/trunk/lib/Analysis/CFG.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/CFG.cpp?rev=138372&r1=138371&r2=138372&view=diff
==============================================================================
--- cfe/trunk/lib/Analysis/CFG.cpp (original)
+++ cfe/trunk/lib/Analysis/CFG.cpp Tue Aug 23 15:30:50 2011
@@ -2203,16 +2203,7 @@
for (const VariableArrayType *VA =FindVA(E->getArgumentType().getTypePtr());
VA != 0; VA = FindVA(VA->getElementType().getTypePtr()))
lastBlock = addStmt(VA->getSizeExpr());
- } else {
- // For sizeof(x), where 'x' is a VLA, we should include the computation
- // of the lvalue of 'x'.
- Expr *subEx = E->getArgumentExpr();
- if (subEx->getType()->isVariableArrayType()) {
- assert(subEx->isLValue());
- lastBlock = addStmt(subEx);
- }
}
-
return lastBlock;
}
Modified: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp?rev=138372&r1=138371&r2=138372&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp Tue Aug 23 15:30:50 2011
@@ -503,30 +503,9 @@
if (!T->isIncompleteType() && !T->isConstantSizeType()) {
assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
- // FIXME: Add support for VLA type arguments, not just VLA expressions.
+ // FIXME: Add support for VLA type arguments and VLA expressions.
// When that happens, we should probably refactor VLASizeChecker's code.
- if (Ex->isArgumentType()) {
- Dst.Add(Pred);
- return;
- }
-
- // Get the size by getting the extent of the sub-expression.
- // First, visit the sub-expression to find its region.
- const Expr *Arg = Ex->getArgumentExpr();
- const ProgramState *state = Pred->getState();
- const MemRegion *MR = state->getSVal(Arg).getAsRegion();
-
- // If the subexpression can't be resolved to a region, we don't know
- // anything about its size. Just leave the state as is and continue.
- if (!MR) {
- Dst.Add(Pred);
- return;
- }
-
- // The result is the extent of the VLA.
- SVal Extent = cast<SubRegion>(MR)->getExtent(svalBuilder);
- MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, Extent));
-
+ Dst.Add(Pred);
return;
}
else if (T->getAs<ObjCObjectType>()) {
Added: cfe/trunk/test/Analysis/outofbound-notwork.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/outofbound-notwork.c?rev=138372&view=auto
==============================================================================
--- cfe/trunk/test/Analysis/outofbound-notwork.c (added)
+++ cfe/trunk/test/Analysis/outofbound-notwork.c Tue Aug 23 15:30:50 2011
@@ -0,0 +1,32 @@
+// RUN: %clang_cc1 -Wno-array-bounds -analyze -analyzer-checker=core,experimental.unix,experimental.security.ArrayBound -analyzer-store=region -verify %s
+// XFAIL: *
+
+// Once we better handle modeling of sizes of VLAs, we can pull this back
+// into outofbound.c.
+
+void sizeof_vla(int a) {
+ if (a == 5) {
+ char x[a];
+ int y[sizeof(x)];
+ y[4] = 4; // no-warning
+ y[5] = 5; // expected-warning{{out-of-bound}}
+ }
+}
+
+void sizeof_vla_2(int a) {
+ if (a == 5) {
+ char x[a];
+ int y[sizeof(x) / sizeof(char)];
+ y[4] = 4; // no-warning
+ y[5] = 5; // expected-warning{{out-of-bound}}
+ }
+}
+
+void sizeof_vla_3(int a) {
+ if (a == 5) {
+ char x[a];
+ int y[sizeof(*&*&*&x)];
+ y[4] = 4; // no-warning
+ y[5] = 5; // expected-warning{{out-of-bound}}
+ }
+}
Modified: cfe/trunk/test/Analysis/outofbound.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/outofbound.c?rev=138372&r1=138371&r2=138372&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/outofbound.c (original)
+++ cfe/trunk/test/Analysis/outofbound.c Tue Aug 23 15:30:50 2011
@@ -63,33 +63,6 @@
}
}
-void sizeof_vla(int a) {
- if (a == 5) {
- char x[a];
- int y[sizeof(x)];
- y[4] = 4; // no-warning
- y[5] = 5; // expected-warning{{out-of-bound}}
- }
-}
-
-void sizeof_vla_2(int a) {
- if (a == 5) {
- char x[a];
- int y[sizeof(x) / sizeof(char)];
- y[4] = 4; // no-warning
- y[5] = 5; // expected-warning{{out-of-bound}}
- }
-}
-
-void sizeof_vla_3(int a) {
- if (a == 5) {
- char x[a];
- int y[sizeof(*&*&*&x)];
- y[4] = 4; // no-warning
- y[5] = 5; // expected-warning{{out-of-bound}}
- }
-}
-
void alloca_region(int a) {
if (a == 5) {
char *x = __builtin_alloca(a);
Modified: cfe/trunk/test/Sema/uninit-variables.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Sema/uninit-variables.c?rev=138372&r1=138371&r2=138372&view=diff
==============================================================================
--- cfe/trunk/test/Sema/uninit-variables.c (original)
+++ cfe/trunk/test/Sema/uninit-variables.c Tue Aug 23 15:30:50 2011
@@ -1,5 +1,8 @@
// RUN: %clang_cc1 -fsyntax-only -Wuninitialized -Wconditional-uninitialized -fsyntax-only -fblocks %s -verify
+typedef __typeof(sizeof(int)) size_t;
+void *malloc(size_t);
+
int test1() {
int x; // expected-note{{variable 'x' is declared here}} expected-note{{add initialization to silence this warning}}
return x; // expected-warning{{variable 'x' is uninitialized when used here}}
@@ -372,3 +375,9 @@
*len += new_len; // expected-warning {{variable 'new_len' may be uninitialized when used here}}
}
}
+
+// Test that sizeof(VLA) doesn't trigger a warning.
+void test_vla_sizeof(int x) {
+ double (*memory)[2][x] = malloc(sizeof(*memory)); // no-warning
+}
+
More information about the cfe-commits
mailing list