r327962 - [analyzer] Fix the crash in IteratorChecker.cpp when 'SymbolConjured' has a null Stmt.

[Henry Wong via cfe-commits]

Author: henrywong
Date: Tue Mar 20 02:27:02 2018
New Revision: 327962

URL: http://llvm.org/viewvc/llvm-project?rev=327962&view=rev
Log:
[analyzer] Fix the crash in IteratorChecker.cpp when 'SymbolConjured' has a null Stmt.

When the loop has a null terminator statement and sets 'widen-loops=true', 'invalidateRegions' will constructs the 'SymbolConjured' with null 'Stmt'. And this will lead to a crash in 'IteratorChecker.cpp'. This patch use 'dyn_cast_or_null<>' instead of 'dyn_cast<>' in IteratorChecker.cpp.

Differential Revision: https://reviews.llvm.org/D44606

Modified:
    cfe/trunk/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
    cfe/trunk/test/Analysis/loop-widening.c

Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp?rev=327962&r1=327961&r2=327962&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp Tue Mar 20 02:27:02 2018
@@ -604,7 +604,7 @@ BinaryOperator::Opcode getOpcode(const S
   if (const auto *BSE = dyn_cast<BinarySymExpr>(SE)) {
     return BSE->getOpcode();
   } else if (const auto *SC = dyn_cast<SymbolConjured>(SE)) {
-    const auto *COE = dyn_cast<CXXOperatorCallExpr>(SC->getStmt());
+    const auto *COE = dyn_cast_or_null<CXXOperatorCallExpr>(SC->getStmt());
     if (!COE)
       return BO_Comma; // Extremal value, neither EQ nor NE
     if (COE->getOperator() == OO_EqualEqual) {

Modified: cfe/trunk/test/Analysis/loop-widening.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/loop-widening.c?rev=327962&r1=327961&r2=327962&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/loop-widening.c (original)
+++ cfe/trunk/test/Analysis/loop-widening.c Tue Mar 20 02:27:02 2018
@@ -1,4 +1,5 @@
 // RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify %s
+// RUN: %clang_analyze_cc1 -DTEST_NULL_TERM -analyzer-checker=core,unix.Malloc,debug.ExprInspection,alpha.cplusplus.IteratorRange -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify %s
 
 void clang_analyzer_eval(int);
 void clang_analyzer_warnIfReached();
@@ -188,3 +189,16 @@ void nested_loop_inner_widen() {
   }
   clang_analyzer_eval(i >= 2); // expected-warning {{TRUE}}
 }
+
+#ifdef TEST_NULL_TERM
+void null_terminator_loop_widen(int *a) {
+  int c;
+  // Loop widening will call 'invalidateRegions()' and 'invalidateRegions()'
+  // will construct the SymbolConjured with null Stmt because of the null
+  // terminator statement. Accessing the null Stmt will cause a crash.
+  for (;;) {
+    c = *a; // no-crash
+    a++;
+  }
+}
+#endif