[PATCH] Avoid double edges when constructing CFGs

[Pavel Labath]

Hi jordan_rose,

If a noreturn destructor is executed while returning a value from a function,
the resulting CFG has had two edges to the exit block. This crashed the analyzer,
because it expects that blocks with no terminators have only one outgoing edge.
I added code to avoid creating the second edge in this case.

PS: The crashes did not manifest themselves always, as usually the
NoReturnFunctionChecker would stop program evaluation before the analyzer hit
the assertion, but in the case of lifetime extended temporaries, the checker
failed to do that (which is a separate bug in itself).

http://llvm-reviews.chandlerc.com/D1513

Files:
  lib/Analysis/CFG.cpp
  test/Analysis/cfg.cpp

Index: lib/Analysis/CFG.cpp
===================================================================
--- lib/Analysis/CFG.cpp
+++ lib/Analysis/CFG.cpp
@@ -1891,9 +1891,12 @@
   // Create the new block.
   Block = createBlock(false);
 
-  // The Exit block is the only successor.
   addAutomaticObjDtors(ScopePos, LocalScope::const_iterator(), R);
-  addSuccessor(Block, &cfg->getExit());
+
+  // If the one of the destructors does not return, we already have the Exit
+  // block as a successor.
+  if (!Block->hasNoReturnElement())
+    addSuccessor(Block, &cfg->getExit());
 
   // Add the return statement to the block.  This may create new blocks if R
   // contains control-flow (short-circuit operations).
Index: test/Analysis/cfg.cpp
===================================================================
--- test/Analysis/cfg.cpp
+++ test/Analysis/cfg.cpp
@@ -98,3 +98,39 @@
   extern int *dummy();
   (void)__builtin_object_size(dummy(), 0);
 }
+
+namespace NoReturnSingleSuccessor {
+  struct A {
+    A();
+    ~A();
+  };
+
+  struct B : public A {
+    B();
+    ~B() __attribute__((noreturn));
+  };
+
+// CHECK: ENTRY
+// CHECK: 1: 1
+// CHECK-NEXT: 2: return
+// CHECK-NEXT: ~B() (Implicit destructor)
+// CHECK-NEXT: Preds (1)
+// CHECK-NEXT: Succs (1): B0
+  int test1(int *x) {
+    B b;
+    if (x)
+      return 1;
+  }
+
+// CHECK: ENTRY
+// CHECK: 1: 1
+// CHECK-NEXT: 2: return
+// CHECK-NEXT: destructor
+// CHECK-NEXT: Preds (1)
+// CHECK-NEXT: Succs (1): B0
+  int test2(int *x) {
+    const A& a = B();
+    if (x)
+      return 1;
+  }
+}
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D1513.1.patch
Type: text/x-patch
Size: 1560 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20130826/6a0c386a/attachment.bin>