[PATCH] D59901: [analyzer] PR41239: Fix a crash on invalid source location in NoStoreFuncVisitor.
Artem Dergachev via Phabricator via cfe-commits
cfe-commits at lists.llvm.org
Wed Mar 27 13:42:52 PDT 2019
NoQ created this revision.
NoQ added reviewers: dcoughlin, xazax.hun, a_sidorin, rnkovacs, mikhail.ramalho, Szelethus, baloghadamsoftware, Charusso, alexfh.
Herald added subscribers: cfe-commits, dkrupp, donat.nagy, a.sidorin, szepet, kristof.beyls, javed.absar.
Herald added a project: clang.
It turns out that `SourceManager::isInSystemHeader()` crashes when an invalid source location is passed into it. Invalid source locations are relatively common: not only they come from body farms, but also, say, any function in C that didn't come with a forward declaration would have an implicit forward declaration with invalid source locations.
Not sure if this deserves to be fixed in `SourceManager`, but there's anyway a more comfy API for us to use in the Static Analyzer: `CallEvent::isInSystemHeader()`, so i just used that.
Repository:
rC Clang
https://reviews.llvm.org/D59901
Files:
clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
clang/test/Analysis/diagnostics/no-store-func-path-notes.c
Index: clang/test/Analysis/diagnostics/no-store-func-path-notes.c
===================================================================
--- clang/test/Analysis/diagnostics/no-store-func-path-notes.c
+++ clang/test/Analysis/diagnostics/no-store-func-path-notes.c
@@ -1,4 +1,5 @@
-// RUN: %clang_analyze_cc1 -x c -analyzer-checker=core -analyzer-output=text -verify %s
+// RUN: %clang_analyze_cc1 -w -x c -analyzer-checker=core -analyzer-output=text\
+// RUN: -verify %s
typedef __typeof(sizeof(int)) size_t;
void *memset(void *__s, int __c, size_t __n);
@@ -244,3 +245,12 @@
return z; // expected-warning{{Undefined or garbage value returned to caller}}
// expected-note at -1{{Undefined or garbage value returned to caller}}
}
+
+void test_implicit_function_decl(int *x) {
+ if (x) {} // expected-note{{Assuming 'x' is null}}
+ // expected-note at -1{{Taking false branch}}
+ implicit_function(x);
+ *x = 4; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
+ // expected-note at -1{{Dereference of null pointer (loaded from variable 'x')}}
+}
+int implicit_function(int *y) {}
Index: clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
===================================================================
--- clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
+++ clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
@@ -322,7 +322,7 @@
CallEventRef<> Call =
BR.getStateManager().getCallEventManager().getCaller(SCtx, State);
- if (SM.isInSystemHeader(Call->getDecl()->getSourceRange().getBegin()))
+ if (Call->isInSystemHeader())
return nullptr;
// Region of interest corresponds to an IVar, exiting a method
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D59901.192512.patch
Type: text/x-patch
Size: 1717 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20190327/164eaec7/attachment-0001.bin>
More information about the cfe-commits
mailing list