[clang] 015c398 - [Analyzer] Infer 0 value when the divisible is 0 (bug fix)

[Gabor Marton via cfe-commits]

Author: Gabor Marton
Date: 2021-03-25T18:25:06+01:00
New Revision: 015c39882ebc1771713a7523ae76903ebae83288

URL: https://github.com/llvm/llvm-project/commit/015c39882ebc1771713a7523ae76903ebae83288
DIFF: https://github.com/llvm/llvm-project/commit/015c39882ebc1771713a7523ae76903ebae83288.diff

LOG: [Analyzer] Infer 0 value when the divisible is 0 (bug fix)

Currently, we infer 0 if the divisible of the modulo op is 0:
  int a = x < 0; // a can be 0
  int b = a % y; // b is either 1 % sym or 0
However, we don't when the op is / :
  int a = x < 0; // a can be 0
  int b = a / y; // b is either 1 / sym or 0 / sym

This commit fixes the discrepancy.

Differential Revision: https://reviews.llvm.org/D99343

Added: 
    clang/test/Analysis/zero-operands.c

Modified: 
    clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp b/clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
index facadaf1225f8..872616fedb4eb 100644
--- a/clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
+++ b/clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
@@ -652,6 +652,8 @@ SVal SimpleSValBuilder::evalBinOpNN(ProgramStateRef state,
         if (LHSValue == 0)
           return evalCastFromNonLoc(lhs, resultTy);
         return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
+      case BO_Div:
+        // 0 / x == 0
       case BO_Rem:
         // 0 % x == 0
         if (LHSValue == 0)

diff  --git a/clang/test/Analysis/zero-operands.c b/clang/test/Analysis/zero-operands.c
new file mode 100644
index 0000000000000..3311c524f8146
--- /dev/null
+++ b/clang/test/Analysis/zero-operands.c
@@ -0,0 +1,53 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core \
+// RUN:   -analyzer-checker=debug.ExprInspection \
+// RUN:   -verify %s
+
+void clang_analyzer_dump(int);
+
+void test_0_multiplier1(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning at -2{{1 S32b}}
+
+  int b = a * y;
+  clang_analyzer_dump(b);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning-re at -2{{reg_${{[[:digit:]]+}}<int y>}}
+}
+
+void test_0_multiplier2(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning at -2{{1 S32b}}
+
+  int b = y * a;
+  clang_analyzer_dump(b);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning-re at -2{{reg_${{[[:digit:]]+}}<int y>}}
+}
+
+void test_0_modulo(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning at -2{{1 S32b}}
+
+  int b = a % y;
+  clang_analyzer_dump(b);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning-re at -2{{1 % (reg_${{[[:digit:]]+}}<int y>)}}
+}
+
+void test_0_divisible(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning at -2{{1 S32b}}
+
+  int b = a / y;
+  clang_analyzer_dump(b);
+  // expected-warning at -1{{0 S32b}}
+  // expected-warning-re at -2{{1 / (reg_${{[[:digit:]]+}}<int y>)}}
+}