[clang] 22a5bb3 - [analyzer] Limit Store by region-store-binding-limit (#127602)
via cfe-commits
cfe-commits at lists.llvm.org
Mon Feb 24 06:48:11 PST 2025
Author: Balázs Benics
Date: 2025-02-24T15:48:06+01:00
New Revision: 22a5bb32b787443b70476cc1359709b6c888b591
URL: https://github.com/llvm/llvm-project/commit/22a5bb32b787443b70476cc1359709b6c888b591
DIFF: https://github.com/llvm/llvm-project/commit/22a5bb32b787443b70476cc1359709b6c888b591.diff
LOG: [analyzer] Limit Store by region-store-binding-limit (#127602)
In our test pool, the max entry point RT was improved by this change:
1'181 seconds (~19.7 minutes) -> 94 seconds (1.6 minutes)
BTW, the 1.6 minutes is still really bad. But a few orders of magnitude
better than it was before.
This was the most servere RT edge-case as you can see from the numbers.
There are are more known RT bottlenecks, such as:
- Large environment sizes, and `removeDead`. See more about the failed
attempt on improving it at:
https://discourse.llvm.org/t/unsuccessful-attempts-to-fix-a-slow-analysis-case-related-to-removedead-and-environment-size/84650
- Large chunk of time could be spend inside `assume`, to reach a fixed
point. This is something we want to look into a bit later if we have
time.
We have 3'075'607 entry points in our test set.
About 393'352 entry points ran longer than 1 second when measured.
To give a sense of the distribution, if we ignore the slowest 500 entry
points, then the maximum entry point runs for about 14 seconds. These
500 slow entry points are in 332 translation units.
By this patch, out of the slowest 500 entry points, 72 entry points were
improved by at least 10x after this change.
We measured no RT regression on the "usual" entry points.
(The dashed lines represent the maximum of their RT)
CPP-6092
Added:
Modified:
clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def
clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h
clang/lib/StaticAnalyzer/Core/ProgramState.cpp
clang/lib/StaticAnalyzer/Core/RegionStore.cpp
clang/lib/StaticAnalyzer/Core/Store.cpp
clang/test/Analysis/analyzer-config.c
clang/test/Analysis/region-store.cpp
clang/unittests/StaticAnalyzer/StoreTest.cpp
Removed:
################################################################################
diff --git a/clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def b/clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def
index a9b8d0753673b..b087ca8860690 100644
--- a/clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def
+++ b/clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def
@@ -483,6 +483,14 @@ ANALYZER_OPTION(
"behavior, set the option to 0.",
5)
+ANALYZER_OPTION(
+ unsigned, RegionStoreMaxBindingFanOut, "region-store-max-binding-fanout",
+ "This option limits how many sub-bindings a single binding operation can "
+ "scatter into. For example, binding an array would scatter into binding "
+ "each individual element. Setting this to zero means unlimited, but then "
+ "modelling large array initializers may take proportional time to their "
+ "size.", 128)
+
//===----------------------------------------------------------------------===//
// String analyzer options.
//===----------------------------------------------------------------------===//
diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
index 20c446e33ef9a..9fd07ce47175c 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
@@ -659,13 +659,13 @@ class ExprEngine {
SVal Loc, SVal Val,
const LocationContext *LCtx);
+public:
/// A simple wrapper when you only need to notify checkers of pointer-escape
/// of some values.
ProgramStateRef escapeValues(ProgramStateRef State, ArrayRef<SVal> Vs,
PointerEscapeKind K,
const CallEvent *Call = nullptr) const;
-public:
// FIXME: 'tag' should be removed, and a LocationContext should be used
// instead.
// FIXME: Comment on the meaning of the arguments, when 'St' may not
diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
index a20516b003c7d..208b32e376883 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
@@ -126,6 +126,7 @@ class ProgramState : public llvm::FoldingSetNode {
/// makeWithStore - Return a ProgramState with the same values as the current
/// state with the exception of using the specified Store.
ProgramStateRef makeWithStore(const StoreRef &store) const;
+ ProgramStateRef makeWithStore(const BindResult &BindRes) const;
void setStore(const StoreRef &storeRef);
diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h
index 332855a3c9c45..cf7623c7be409 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h
@@ -50,6 +50,14 @@ class SymbolReaper;
using InvalidatedSymbols = llvm::DenseSet<SymbolRef>;
+struct BindResult {
+ StoreRef ResultingStore;
+
+ // If during the bind operation we exhaust the allowed binding budget, we set
+ // this to the beginning of the escaped part of the region.
+ llvm::SmallVector<SVal, 0> FailedToBindValues;
+};
+
class StoreManager {
protected:
SValBuilder &svalBuilder;
@@ -105,17 +113,17 @@ class StoreManager {
/// \return A StoreRef object that contains the same
/// bindings as \c store with the addition of having the value specified
/// by \c val bound to the location given for \c loc.
- virtual StoreRef Bind(Store store, Loc loc, SVal val) = 0;
+ virtual BindResult Bind(Store store, Loc loc, SVal val) = 0;
/// Return a store with the specified value bound to all sub-regions of the
/// region. The region must not have previous bindings. If you need to
/// invalidate existing bindings, consider invalidateRegions().
- virtual StoreRef BindDefaultInitial(Store store, const MemRegion *R,
- SVal V) = 0;
+ virtual BindResult BindDefaultInitial(Store store, const MemRegion *R,
+ SVal V) = 0;
/// Return a store with in which all values within the given region are
/// reset to zero. This method is allowed to overwrite previous bindings.
- virtual StoreRef BindDefaultZero(Store store, const MemRegion *R) = 0;
+ virtual BindResult BindDefaultZero(Store store, const MemRegion *R) = 0;
/// Create a new store with the specified binding removed.
/// \param ST the original store, that is the basis for the new store.
@@ -240,9 +248,8 @@ class StoreManager {
/// enterStackFrame - Let the StoreManager to do something when execution
/// engine is about to execute into a callee.
- StoreRef enterStackFrame(Store store,
- const CallEvent &Call,
- const StackFrameContext *CalleeCtx);
+ BindResult enterStackFrame(Store store, const CallEvent &Call,
+ const StackFrameContext *CalleeCtx);
/// Finds the transitive closure of symbols within the given region.
///
diff --git a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp
index 34ab2388cbd2f..492209d4d2bf0 100644
--- a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp
@@ -116,13 +116,14 @@ ProgramStateRef ProgramState::bindLoc(Loc LV,
const LocationContext *LCtx,
bool notifyChanges) const {
ProgramStateManager &Mgr = getStateManager();
- ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
- LV, V));
+ ExprEngine &Eng = Mgr.getOwningEngine();
+ ProgramStateRef State = makeWithStore(Mgr.StoreMgr->Bind(getStore(), LV, V));
const MemRegion *MR = LV.getAsRegion();
+
if (MR && notifyChanges)
- return Mgr.getOwningEngine().processRegionChange(newState, MR, LCtx);
+ return Eng.processRegionChange(State, MR, LCtx);
- return newState;
+ return State;
}
ProgramStateRef
@@ -130,18 +131,18 @@ ProgramState::bindDefaultInitial(SVal loc, SVal V,
const LocationContext *LCtx) const {
ProgramStateManager &Mgr = getStateManager();
const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
- const StoreRef &newStore = Mgr.StoreMgr->BindDefaultInitial(getStore(), R, V);
- ProgramStateRef new_state = makeWithStore(newStore);
- return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
+ BindResult BindRes = Mgr.StoreMgr->BindDefaultInitial(getStore(), R, V);
+ ProgramStateRef State = makeWithStore(BindRes);
+ return Mgr.getOwningEngine().processRegionChange(State, R, LCtx);
}
ProgramStateRef
ProgramState::bindDefaultZero(SVal loc, const LocationContext *LCtx) const {
ProgramStateManager &Mgr = getStateManager();
const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
- const StoreRef &newStore = Mgr.StoreMgr->BindDefaultZero(getStore(), R);
- ProgramStateRef new_state = makeWithStore(newStore);
- return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
+ BindResult BindRes = Mgr.StoreMgr->BindDefaultZero(getStore(), R);
+ ProgramStateRef State = makeWithStore(BindRes);
+ return Mgr.getOwningEngine().processRegionChange(State, R, LCtx);
}
typedef ArrayRef<const MemRegion *> RegionList;
@@ -232,9 +233,8 @@ SVal ProgramState::wrapSymbolicRegion(SVal Val) const {
ProgramStateRef
ProgramState::enterStackFrame(const CallEvent &Call,
const StackFrameContext *CalleeCtx) const {
- const StoreRef &NewStore =
- getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
- return makeWithStore(NewStore);
+ return makeWithStore(
+ getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx));
}
SVal ProgramState::getSelfSVal(const LocationContext *LCtx) const {
@@ -437,6 +437,18 @@ ProgramStateRef ProgramState::makeWithStore(const StoreRef &store) const {
return getStateManager().getPersistentState(NewSt);
}
+ProgramStateRef ProgramState::makeWithStore(const BindResult &BindRes) const {
+ ExprEngine &Eng = getStateManager().getOwningEngine();
+ ProgramStateRef State = makeWithStore(BindRes.ResultingStore);
+
+ // We must always notify the checkers for failing binds because otherwise they
+ // may keep stale traits for these symbols.
+ // Eg., Malloc checker may report leaks if we failed to bind that symbol.
+ if (BindRes.FailedToBindValues.empty())
+ return State;
+ return Eng.escapeValues(State, BindRes.FailedToBindValues, PSK_EscapeOnBind);
+}
+
ProgramStateRef ProgramState::cloneAsPosteriorlyOverconstrained() const {
ProgramState NewSt(*this);
NewSt.PosteriorlyOverconstrained = true;
diff --git a/clang/lib/StaticAnalyzer/Core/RegionStore.cpp b/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
index 5a5a6948098e7..620fc117c6789 100644
--- a/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -31,6 +31,7 @@
#include "llvm/ADT/STLExtras.h"
#include "llvm/Support/TimeProfiler.h"
#include "llvm/Support/raw_ostream.h"
+#include <limits>
#include <optional>
#include <utility>
@@ -182,25 +183,16 @@ class RegionBindingsRef : public llvm::ImmutableMapRef<const MemRegion *,
RegionBindingsRef(ClusterBindings::Factory &CBFactory,
const RegionBindings::TreeTy *T,
- RegionBindings::TreeTy::Factory *F,
- bool IsMainAnalysis)
- : llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>(T, F),
- CBFactory(&CBFactory), IsMainAnalysis(IsMainAnalysis) {}
+ RegionBindings::TreeTy::Factory *F, bool IsMainAnalysis)
+ : RegionBindingsRef(ParentTy(T, F), CBFactory, IsMainAnalysis) {}
- RegionBindingsRef(const ParentTy &P,
- ClusterBindings::Factory &CBFactory,
+ RegionBindingsRef(const ParentTy &P, ClusterBindings::Factory &CBFactory,
bool IsMainAnalysis)
- : llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>(P),
- CBFactory(&CBFactory), IsMainAnalysis(IsMainAnalysis) {}
-
- RegionBindingsRef add(key_type_ref K, data_type_ref D) const {
- return RegionBindingsRef(static_cast<const ParentTy *>(this)->add(K, D),
- *CBFactory, IsMainAnalysis);
- }
+ : ParentTy(P), CBFactory(&CBFactory), IsMainAnalysis(IsMainAnalysis) {}
- RegionBindingsRef remove(key_type_ref K) const {
- return RegionBindingsRef(static_cast<const ParentTy *>(this)->remove(K),
- *CBFactory, IsMainAnalysis);
+ RegionBindingsRef removeCluster(const MemRegion *BaseRegion) const {
+ return RegionBindingsRef(ParentTy::remove(BaseRegion), *CBFactory,
+ IsMainAnalysis);
}
RegionBindingsRef addBinding(BindingKey K, SVal V) const;
@@ -327,10 +319,87 @@ class RegionBindingsRef : public llvm::ImmutableMapRef<const MemRegion *,
}
LLVM_DUMP_METHOD void dump() const { printJson(llvm::errs()); }
+
+protected:
+ RegionBindingsRef
+ commitBindingsToCluster(const MemRegion *BaseRegion,
+ const ClusterBindings &Bindings) const;
};
} // end anonymous namespace
+/// This class represents the same as \c RegionBindingsRef, but with a limit on
+/// the number of bindings that can be added.
+class LimitedRegionBindingsRef : public RegionBindingsRef {
+public:
+ LimitedRegionBindingsRef(RegionBindingsRef Base,
+ SmallVectorImpl<SVal> &EscapedValuesDuringBind,
+ std::optional<unsigned> BindingsLeft)
+ : RegionBindingsRef(Base),
+ EscapedValuesDuringBind(&EscapedValuesDuringBind),
+ BindingsLeft(BindingsLeft) {}
+
+ bool hasExhaustedBindingLimit() const {
+ return BindingsLeft.has_value() && BindingsLeft.value() == 0;
+ }
+
+ LimitedRegionBindingsRef withValuesEscaped(SVal V) const {
+ EscapedValuesDuringBind->push_back(V);
+ return *this;
+ }
+
+ LimitedRegionBindingsRef
+ withValuesEscaped(nonloc::CompoundVal::iterator Begin,
+ nonloc::CompoundVal::iterator End) const {
+ for (SVal V : llvm::make_range(Begin, End))
+ withValuesEscaped(V);
+ return *this;
+ }
+
+ LimitedRegionBindingsRef
+ addWithoutDecreasingLimit(const MemRegion *BaseRegion,
+ data_type_ref BindingKeyAndValue) const {
+ return LimitedRegionBindingsRef{RegionBindingsRef::commitBindingsToCluster(
+ BaseRegion, BindingKeyAndValue),
+ *EscapedValuesDuringBind, BindingsLeft};
+ }
+
+ LimitedRegionBindingsRef removeCluster(const MemRegion *BaseRegion) const {
+ return LimitedRegionBindingsRef{
+ RegionBindingsRef::removeCluster(BaseRegion), *EscapedValuesDuringBind,
+ BindingsLeft};
+ }
+
+ LimitedRegionBindingsRef addBinding(BindingKey K, SVal V) const {
+ std::optional<unsigned> NewBindingsLeft = BindingsLeft;
+ if (NewBindingsLeft.has_value()) {
+ assert(NewBindingsLeft.value() != 0);
+ NewBindingsLeft.value() -= 1;
+
+ // If we just exhausted the binding limit, highjack
+ // this bind call for the default binding.
+ if (NewBindingsLeft.value() == 0) {
+ withValuesEscaped(V);
+ K = BindingKey::Make(K.getRegion(), BindingKey::Default);
+ V = UnknownVal();
+ }
+ }
+
+ return LimitedRegionBindingsRef{RegionBindingsRef::addBinding(K, V),
+ *EscapedValuesDuringBind, NewBindingsLeft};
+ }
+
+ LimitedRegionBindingsRef addBinding(const MemRegion *R, BindingKey::Kind k,
+ SVal V) const {
+ return addBinding(BindingKey::Make(R, k), V);
+ }
+
+private:
+ SmallVectorImpl<SVal> *EscapedValuesDuringBind; // nonnull
+ std::optional<unsigned> BindingsLeft;
+};
+
typedef const RegionBindingsRef& RegionBindingsConstRef;
+typedef const LimitedRegionBindingsRef &LimitedRegionBindingsConstRef;
std::optional<SVal>
RegionBindingsRef::getDirectBinding(const MemRegion *R) const {
@@ -344,18 +413,22 @@ RegionBindingsRef::getDefaultBinding(const MemRegion *R) const {
return V ? std::optional<SVal>(*V) : std::nullopt;
}
+RegionBindingsRef RegionBindingsRef::commitBindingsToCluster(
+ const MemRegion *BaseRegion, const ClusterBindings &Bindings) const {
+ return RegionBindingsRef(ParentTy::add(BaseRegion, Bindings), *CBFactory,
+ IsMainAnalysis);
+}
+
RegionBindingsRef RegionBindingsRef::addBinding(BindingKey K, SVal V) const {
const MemRegion *Base = K.getBaseRegion();
const ClusterBindings *ExistingCluster = lookup(Base);
- ClusterBindings Cluster =
+ ClusterBindings Bindings =
(ExistingCluster ? *ExistingCluster : CBFactory->getEmptyMap());
-
- ClusterBindings NewCluster = CBFactory->add(Cluster, K, V);
- return add(Base, NewCluster);
+ Bindings = CBFactory->add(Bindings, K, V);
+ return commitBindingsToCluster(Base, Bindings);
}
-
RegionBindingsRef RegionBindingsRef::addBinding(const MemRegion *R,
BindingKey::Kind k,
SVal V) const {
@@ -382,8 +455,8 @@ RegionBindingsRef RegionBindingsRef::removeBinding(BindingKey K) {
ClusterBindings NewCluster = CBFactory->remove(*Cluster, K);
if (NewCluster.isEmpty())
- return remove(Base);
- return add(Base, NewCluster);
+ return removeCluster(Base);
+ return commitBindingsToCluster(Base, NewCluster);
}
RegionBindingsRef RegionBindingsRef::removeBinding(const MemRegion *R,
@@ -417,7 +490,7 @@ class RegionStoreManager : public StoreManager {
///
/// This is controlled by 'region-store-small-struct-limit' option.
/// To disable all small-struct-dependent behavior, set the option to "0".
- unsigned SmallStructLimit;
+ const unsigned SmallStructLimit;
/// The largest number of element an array can have and still be
/// considered "small".
@@ -427,7 +500,13 @@ class RegionStoreManager : public StoreManager {
///
/// This is controlled by 'region-store-small-struct-limit' option.
/// To disable all small-struct-dependent behavior, set the option to "0".
- unsigned SmallArrayLimit;
+ const unsigned SmallArrayLimit;
+
+ /// The number of bindings a single bind operation can scatter into.
+ /// For example, binding the initializer-list of an array would recurse and
+ /// bind all the individual array elements, potentially causing scalability
+ /// issues. Nullopt if the limit is disabled.
+ const std::optional<unsigned> RegionStoreMaxBindingFanOutPlusOne;
/// A helper used to populate the work list with the given set of
/// regions.
@@ -435,21 +514,30 @@ class RegionStoreManager : public StoreManager {
ArrayRef<SVal> Values,
InvalidatedRegions *TopLevelRegions);
+ const AnalyzerOptions &getOptions() {
+ return StateMgr.getOwningEngine().getAnalysisManager().options;
+ }
+
public:
RegionStoreManager(ProgramStateManager &mgr)
: StoreManager(mgr), RBFactory(mgr.getAllocator()),
- CBFactory(mgr.getAllocator()), SmallStructLimit(0), SmallArrayLimit(0) {
- ExprEngine &Eng = StateMgr.getOwningEngine();
- AnalyzerOptions &Options = Eng.getAnalysisManager().options;
- SmallStructLimit = Options.RegionStoreSmallStructLimit;
- SmallArrayLimit = Options.RegionStoreSmallArrayLimit;
- }
+ CBFactory(mgr.getAllocator()),
+ SmallStructLimit(getOptions().RegionStoreSmallStructLimit),
+ SmallArrayLimit(getOptions().RegionStoreSmallArrayLimit),
+ RegionStoreMaxBindingFanOutPlusOne([&]() -> std::optional<unsigned> {
+ unsigned FanOut = getOptions().RegionStoreMaxBindingFanOut;
+ assert(FanOut != std::numeric_limits<unsigned>::max());
+ if (FanOut == 0)
+ return std::nullopt;
+ return FanOut + 1 /*for the default binding*/;
+ }()) {}
/// setImplicitDefaultValue - Set the default binding for the provided
/// MemRegion to the value implicitly defined for compound literals when
/// the value is not specified.
- RegionBindingsRef setImplicitDefaultValue(RegionBindingsConstRef B,
- const MemRegion *R, QualType T);
+ LimitedRegionBindingsRef
+ setImplicitDefaultValue(LimitedRegionBindingsConstRef B, const MemRegion *R,
+ QualType T);
/// ArrayToPointer - Emulates the "decay" of an array to a pointer
/// type. 'Array' represents the lvalue of the array being decayed
@@ -465,9 +553,11 @@ class RegionStoreManager : public StoreManager {
bool IsMainAnalysis = false;
if (const auto *FD = dyn_cast<FunctionDecl>(InitLoc->getDecl()))
IsMainAnalysis = FD->isMain() && !Ctx.getLangOpts().CPlusPlus;
- return StoreRef(RegionBindingsRef(
- RegionBindingsRef::ParentTy(RBFactory.getEmptyMap(), RBFactory),
- CBFactory, IsMainAnalysis).asStore(), *this);
+ return StoreRef(RegionBindingsRef(RegionBindingsRef::ParentTy(
+ RBFactory.getEmptyMap(), RBFactory),
+ CBFactory, IsMainAnalysis)
+ .asStore(),
+ *this);
}
//===-------------------------------------------------------------------===//
@@ -489,8 +579,8 @@ class RegionStoreManager : public StoreManager {
bool scanReachableSymbols(Store S, const MemRegion *R,
ScanReachableSymbols &Callbacks) override;
- RegionBindingsRef removeSubRegionBindings(RegionBindingsConstRef B,
- const SubRegion *R);
+ LimitedRegionBindingsRef
+ removeSubRegionBindings(LimitedRegionBindingsConstRef B, const SubRegion *R);
std::optional<SVal>
getConstantValFromConstArrayInitializer(RegionBindingsConstRef B,
const ElementRegion *R);
@@ -502,29 +592,34 @@ class RegionStoreManager : public StoreManager {
QualType ElemT);
public: // Part of public interface to class.
-
- StoreRef Bind(Store store, Loc LV, SVal V) override {
- return StoreRef(bind(getRegionBindings(store), LV, V).asStore(), *this);
+ BindResult Bind(Store store, Loc LV, SVal V) override {
+ llvm::SmallVector<SVal, 0> EscapedValuesDuringBind;
+ LimitedRegionBindingsRef BoundedBindings =
+ getRegionBindings(store, EscapedValuesDuringBind);
+ return BindResult{StoreRef(bind(BoundedBindings, LV, V).asStore(), *this),
+ std::move(EscapedValuesDuringBind)};
}
- RegionBindingsRef bind(RegionBindingsConstRef B, Loc LV, SVal V);
+ LimitedRegionBindingsRef bind(LimitedRegionBindingsConstRef B, Loc LV,
+ SVal V);
// BindDefaultInitial is only used to initialize a region with
// a default value.
- StoreRef BindDefaultInitial(Store store, const MemRegion *R,
- SVal V) override {
+ BindResult BindDefaultInitial(Store store, const MemRegion *R,
+ SVal V) override {
RegionBindingsRef B = getRegionBindings(store);
// Use other APIs when you have to wipe the region that was initialized
// earlier.
assert(!(B.getDefaultBinding(R) || B.getDirectBinding(R)) &&
"Double initialization!");
B = B.addBinding(BindingKey::Make(R, BindingKey::Default), V);
- return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this);
+ return BindResult{
+ StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this), {}};
}
// BindDefaultZero is used for zeroing constructors that may accidentally
// overwrite existing bindings.
- StoreRef BindDefaultZero(Store store, const MemRegion *R) override {
+ BindResult BindDefaultZero(Store store, const MemRegion *R) override {
// FIXME: The offsets of empty bases can be tricky because of
// of the so called "empty base class optimization".
// If a base class has been optimized out
@@ -536,13 +631,17 @@ class RegionStoreManager : public StoreManager {
// As a temporary mitigation we don't create bindings for empty bases.
if (const auto *BR = dyn_cast<CXXBaseObjectRegion>(R))
if (BR->getDecl()->isEmpty())
- return StoreRef(store, *this);
+ return BindResult{StoreRef(store, *this), {}};
- RegionBindingsRef B = getRegionBindings(store);
+ llvm::SmallVector<SVal, 0> EscapedValuesDuringBind;
+ LimitedRegionBindingsRef B =
+ getRegionBindings(store, EscapedValuesDuringBind);
SVal V = svalBuilder.makeZeroVal(Ctx.CharTy);
B = removeSubRegionBindings(B, cast<SubRegion>(R));
B = B.addBinding(BindingKey::Make(R, BindingKey::Default), V);
- return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this);
+ return BindResult{
+ StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this),
+ std::move(EscapedValuesDuringBind)};
}
/// Attempt to extract the fields of \p LCV and bind them to the struct region
@@ -555,31 +654,29 @@ class RegionStoreManager : public StoreManager {
///
/// \returns The updated store bindings, or \c std::nullopt if binding
/// non-lazily would be too expensive.
- std::optional<RegionBindingsRef>
- tryBindSmallStruct(RegionBindingsConstRef B, const TypedValueRegion *R,
+ std::optional<LimitedRegionBindingsRef>
+ tryBindSmallStruct(LimitedRegionBindingsConstRef B, const TypedValueRegion *R,
const RecordDecl *RD, nonloc::LazyCompoundVal LCV);
/// BindStruct - Bind a compound value to a structure.
- RegionBindingsRef bindStruct(RegionBindingsConstRef B,
- const TypedValueRegion* R, SVal V);
+ LimitedRegionBindingsRef bindStruct(LimitedRegionBindingsConstRef B,
+ const TypedValueRegion *R, SVal V);
/// BindVector - Bind a compound value to a vector.
- RegionBindingsRef bindVector(RegionBindingsConstRef B,
- const TypedValueRegion* R, SVal V);
+ LimitedRegionBindingsRef bindVector(LimitedRegionBindingsConstRef B,
+ const TypedValueRegion *R, SVal V);
- std::optional<RegionBindingsRef>
- tryBindSmallArray(RegionBindingsConstRef B, const TypedValueRegion *R,
+ std::optional<LimitedRegionBindingsRef>
+ tryBindSmallArray(LimitedRegionBindingsConstRef B, const TypedValueRegion *R,
const ArrayType *AT, nonloc::LazyCompoundVal LCV);
- RegionBindingsRef bindArray(RegionBindingsConstRef B,
- const TypedValueRegion* R,
- SVal V);
+ LimitedRegionBindingsRef bindArray(LimitedRegionBindingsConstRef B,
+ const TypedValueRegion *R, SVal V);
/// Clears out all bindings in the given region and assigns a new value
/// as a Default binding.
- RegionBindingsRef bindAggregate(RegionBindingsConstRef B,
- const TypedRegion *R,
- SVal DefaultVal);
+ LimitedRegionBindingsRef bindAggregate(LimitedRegionBindingsConstRef B,
+ const TypedRegion *R, SVal DefaultVal);
/// Create a new store with the specified binding removed.
/// \param ST the original store, that is the basis for the new store.
@@ -703,11 +800,17 @@ class RegionStoreManager : public StoreManager {
RegionBindingsRef getRegionBindings(Store store) const {
llvm::PointerIntPair<Store, 1, bool> Ptr;
Ptr.setFromOpaqueValue(const_cast<void *>(store));
- return RegionBindingsRef(
- CBFactory,
- static_cast<const RegionBindings::TreeTy *>(Ptr.getPointer()),
- RBFactory.getTreeFactory(),
- Ptr.getInt());
+ return {CBFactory,
+ static_cast<const RegionBindings::TreeTy *>(Ptr.getPointer()),
+ RBFactory.getTreeFactory(), Ptr.getInt()};
+ }
+
+ LimitedRegionBindingsRef
+ getRegionBindings(Store store,
+ SmallVectorImpl<SVal> &EscapedValuesDuringBind) const {
+ return LimitedRegionBindingsRef(
+ getRegionBindings(store), EscapedValuesDuringBind,
+ /*BindingsLeft=*/RegionStoreMaxBindingFanOutPlusOne);
}
void printJson(raw_ostream &Out, Store S, const char *NL = "\n",
@@ -996,15 +1099,15 @@ collectSubRegionBindings(SmallVectorImpl<BindingPair> &Bindings,
IncludeAllDefaultBindings);
}
-RegionBindingsRef
-RegionStoreManager::removeSubRegionBindings(RegionBindingsConstRef B,
+LimitedRegionBindingsRef
+RegionStoreManager::removeSubRegionBindings(LimitedRegionBindingsConstRef B,
const SubRegion *Top) {
BindingKey TopKey = BindingKey::Make(Top, BindingKey::Default);
const MemRegion *ClusterHead = TopKey.getBaseRegion();
if (Top == ClusterHead) {
// We can remove an entire cluster's bindings all in one go.
- return B.remove(Top);
+ return B.removeCluster(Top);
}
const ClusterBindings *Cluster = B.lookup(ClusterHead);
@@ -1037,8 +1140,8 @@ RegionStoreManager::removeSubRegionBindings(RegionBindingsConstRef B,
}
if (Result.isEmpty())
- return B.remove(ClusterHead);
- return B.add(ClusterHead, Result.asImmutableMap());
+ return B.removeCluster(ClusterHead);
+ return B.addWithoutDecreasingLimit(ClusterHead, Result.asImmutableMap());
}
namespace {
@@ -1123,7 +1226,7 @@ void InvalidateRegionsWorker::VisitCluster(const MemRegion *baseR,
// Invalidate regions contents.
if (!PreserveRegionsContents)
- B = B.remove(baseR);
+ B = B.removeCluster(baseR);
}
if (const auto *TO = dyn_cast<TypedValueRegion>(baseR)) {
@@ -2406,18 +2509,23 @@ bool RegionStoreManager::includedInBindings(Store store,
StoreRef RegionStoreManager::killBinding(Store ST, Loc L) {
if (std::optional<loc::MemRegionVal> LV = L.getAs<loc::MemRegionVal>())
if (const MemRegion* R = LV->getRegion())
- return StoreRef(getRegionBindings(ST).removeBinding(R)
- .asImmutableMap()
- .getRootWithoutRetain(),
+ return StoreRef(getRegionBindings(ST)
+ .removeBinding(R)
+ .asImmutableMap()
+ .getRootWithoutRetain(),
*this);
return StoreRef(ST, *this);
}
-RegionBindingsRef
-RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
+LimitedRegionBindingsRef
+RegionStoreManager::bind(LimitedRegionBindingsConstRef B, Loc L, SVal V) {
llvm::TimeTraceScope TimeScope("RegionStoreManager::bind",
[&L]() { return locDescr(L); });
+
+ if (B.hasExhaustedBindingLimit())
+ return B.withValuesEscaped(V);
+
// We only care about region locations.
auto MemRegVal = L.getAs<loc::MemRegionVal>();
if (!MemRegVal)
@@ -2451,7 +2559,7 @@ RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
"'this' pointer is not an l-value and is not assignable");
// Clear out bindings that may overlap with this binding.
- RegionBindingsRef NewB = removeSubRegionBindings(B, cast<SubRegion>(R));
+ auto NewB = removeSubRegionBindings(B, cast<SubRegion>(R));
// LazyCompoundVals should be always bound as 'default' bindings.
auto KeyKind = isa<nonloc::LazyCompoundVal>(V) ? BindingKey::Default
@@ -2459,10 +2567,9 @@ RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
return NewB.addBinding(BindingKey::Make(R, KeyKind), V);
}
-RegionBindingsRef
-RegionStoreManager::setImplicitDefaultValue(RegionBindingsConstRef B,
- const MemRegion *R,
- QualType T) {
+LimitedRegionBindingsRef
+RegionStoreManager::setImplicitDefaultValue(LimitedRegionBindingsConstRef B,
+ const MemRegion *R, QualType T) {
SVal V;
if (Loc::isLocType(T))
@@ -2486,9 +2593,9 @@ RegionStoreManager::setImplicitDefaultValue(RegionBindingsConstRef B,
return B.addBinding(R, BindingKey::Default, V);
}
-std::optional<RegionBindingsRef> RegionStoreManager::tryBindSmallArray(
- RegionBindingsConstRef B, const TypedValueRegion *R, const ArrayType *AT,
- nonloc::LazyCompoundVal LCV) {
+std::optional<LimitedRegionBindingsRef> RegionStoreManager::tryBindSmallArray(
+ LimitedRegionBindingsConstRef B, const TypedValueRegion *R,
+ const ArrayType *AT, nonloc::LazyCompoundVal LCV) {
auto CAT = dyn_cast<ConstantArrayType>(AT);
@@ -2505,7 +2612,7 @@ std::optional<RegionBindingsRef> RegionStoreManager::tryBindSmallArray(
if (ArrSize > SmallArrayLimit)
return std::nullopt;
- RegionBindingsRef NewB = B;
+ LimitedRegionBindingsRef NewB = B;
for (uint64_t i = 0; i < ArrSize; ++i) {
auto Idx = svalBuilder.makeArrayIndex(i);
@@ -2520,10 +2627,9 @@ std::optional<RegionBindingsRef> RegionStoreManager::tryBindSmallArray(
return NewB;
}
-RegionBindingsRef
-RegionStoreManager::bindArray(RegionBindingsConstRef B,
- const TypedValueRegion* R,
- SVal Init) {
+LimitedRegionBindingsRef
+RegionStoreManager::bindArray(LimitedRegionBindingsConstRef B,
+ const TypedValueRegion *R, SVal Init) {
llvm::TimeTraceScope TimeScope("RegionStoreManager::bindArray",
[R]() { return R->getDescriptiveName(); });
@@ -2543,10 +2649,8 @@ RegionStoreManager::bindArray(RegionBindingsConstRef B,
}
// Handle lazy compound values.
- if (std::optional<nonloc::LazyCompoundVal> LCV =
- Init.getAs<nonloc::LazyCompoundVal>()) {
- if (std::optional<RegionBindingsRef> NewB =
- tryBindSmallArray(B, R, AT, *LCV))
+ if (std::optional LCV = Init.getAs<nonloc::LazyCompoundVal>()) {
+ if (std::optional NewB = tryBindSmallArray(B, R, AT, *LCV))
return *NewB;
return bindAggregate(B, R, Init);
@@ -2560,12 +2664,14 @@ RegionStoreManager::bindArray(RegionBindingsConstRef B,
nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
uint64_t i = 0;
- RegionBindingsRef NewB(B);
+ LimitedRegionBindingsRef NewB = B;
for (; Size ? i < *Size : true; ++i, ++VI) {
// The init list might be shorter than the array length.
if (VI == VE)
break;
+ if (NewB.hasExhaustedBindingLimit())
+ return NewB.withValuesEscaped(VI, VE);
NonLoc Idx = svalBuilder.makeArrayIndex(i);
const ElementRegion *ER = MRMgr.getElementRegion(ElementTy, Idx, R, Ctx);
@@ -2587,9 +2693,9 @@ RegionStoreManager::bindArray(RegionBindingsConstRef B,
return NewB;
}
-RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
- const TypedValueRegion* R,
- SVal V) {
+LimitedRegionBindingsRef
+RegionStoreManager::bindVector(LimitedRegionBindingsConstRef B,
+ const TypedValueRegion *R, SVal V) {
llvm::TimeTraceScope TimeScope("RegionStoreManager::bindVector",
[R]() { return R->getDescriptiveName(); });
QualType T = R->getValueType();
@@ -2610,7 +2716,7 @@ RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
nonloc::CompoundVal CV = V.castAs<nonloc::CompoundVal>();
nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
unsigned index = 0, numElements = VT->getNumElements();
- RegionBindingsRef NewB(B);
+ LimitedRegionBindingsRef NewB = B;
for ( ; index != numElements ; ++index) {
if (VI == VE)
@@ -2645,13 +2751,13 @@ RegionStoreManager::getUniqueDefaultBinding(RegionBindingsConstRef B,
std::optional<SVal>
RegionStoreManager::getUniqueDefaultBinding(nonloc::LazyCompoundVal LCV) const {
- RegionBindingsConstRef B = getRegionBindings(LCV.getStore());
+ auto B = getRegionBindings(LCV.getStore());
return getUniqueDefaultBinding(B, LCV.getRegion());
}
-std::optional<RegionBindingsRef> RegionStoreManager::tryBindSmallStruct(
- RegionBindingsConstRef B, const TypedValueRegion *R, const RecordDecl *RD,
- nonloc::LazyCompoundVal LCV) {
+std::optional<LimitedRegionBindingsRef> RegionStoreManager::tryBindSmallStruct(
+ LimitedRegionBindingsConstRef B, const TypedValueRegion *R,
+ const RecordDecl *RD, nonloc::LazyCompoundVal LCV) {
// If we try to copy a Conjured value representing the value of the whole
// struct, don't try to element-wise copy each field.
// That would unnecessarily bind Derived symbols slicing off the subregion for
@@ -2698,7 +2804,7 @@ std::optional<RegionBindingsRef> RegionStoreManager::tryBindSmallStruct(
Fields.push_back(FD);
}
- RegionBindingsRef NewB = B;
+ LimitedRegionBindingsRef NewB = B;
for (const FieldDecl *Field : Fields) {
const FieldRegion *SourceFR = MRMgr.getFieldRegion(Field, LCV.getRegion());
@@ -2711,9 +2817,9 @@ std::optional<RegionBindingsRef> RegionStoreManager::tryBindSmallStruct(
return NewB;
}
-RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
- const TypedValueRegion *R,
- SVal V) {
+LimitedRegionBindingsRef
+RegionStoreManager::bindStruct(LimitedRegionBindingsConstRef B,
+ const TypedValueRegion *R, SVal V) {
llvm::TimeTraceScope TimeScope("RegionStoreManager::bindStruct",
[R]() { return R->getDescriptiveName(); });
QualType T = R->getValueType();
@@ -2728,8 +2834,7 @@ RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
// Handle lazy compound values and symbolic values.
if (std::optional<nonloc::LazyCompoundVal> LCV =
V.getAs<nonloc::LazyCompoundVal>()) {
- if (std::optional<RegionBindingsRef> NewB =
- tryBindSmallStruct(B, R, RD, *LCV))
+ if (std::optional NewB = tryBindSmallStruct(B, R, RD, *LCV))
return *NewB;
return bindAggregate(B, R, V);
}
@@ -2761,7 +2866,7 @@ RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
const nonloc::CompoundVal& CV = V.castAs<nonloc::CompoundVal>();
nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
- RegionBindingsRef NewB(B);
+ LimitedRegionBindingsRef NewB = B;
// In C++17 aggregates may have base classes, handle those as well.
// They appear before fields in the initializer list / compound value.
@@ -2782,6 +2887,8 @@ RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
if (VI == VE)
break;
+ if (NewB.hasExhaustedBindingLimit())
+ return NewB.withValuesEscaped(VI, VE);
QualType BTy = B.getType();
assert(BTy->isStructureOrClassType() && "Base classes must be classes!");
@@ -2805,6 +2912,9 @@ RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
if (VI == VE)
break;
+ if (NewB.hasExhaustedBindingLimit())
+ return NewB.withValuesEscaped(VI, VE);
+
// Skip any unnamed bitfields to stay in sync with the initializers.
if (FI->isUnnamedBitField())
continue;
@@ -2830,10 +2940,9 @@ RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
return NewB;
}
-RegionBindingsRef
-RegionStoreManager::bindAggregate(RegionBindingsConstRef B,
- const TypedRegion *R,
- SVal Val) {
+LimitedRegionBindingsRef
+RegionStoreManager::bindAggregate(LimitedRegionBindingsConstRef B,
+ const TypedRegion *R, SVal Val) {
llvm::TimeTraceScope TimeScope("RegionStoreManager::bindAggregate",
[R]() { return R->getDescriptiveName(); });
// Remove the old bindings, using 'R' as the root of all regions
@@ -3002,7 +3111,7 @@ StoreRef RegionStoreManager::removeDeadBindings(Store store,
// If the cluster has been visited, we know the region has been marked.
// Otherwise, remove the dead entry.
if (!W.isVisited(Base))
- B = B.remove(Base);
+ B = B.removeCluster(Base);
}
return StoreRef(B.asStore(), *this);
diff --git a/clang/lib/StaticAnalyzer/Core/Store.cpp b/clang/lib/StaticAnalyzer/Core/Store.cpp
index b436dd746d21f..5f30fae4b7047 100644
--- a/clang/lib/StaticAnalyzer/Core/Store.cpp
+++ b/clang/lib/StaticAnalyzer/Core/Store.cpp
@@ -29,6 +29,7 @@
#include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
#include "llvm/ADT/APSInt.h"
+#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/ErrorHandling.h"
@@ -43,18 +44,21 @@ StoreManager::StoreManager(ProgramStateManager &stateMgr)
: svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
-StoreRef StoreManager::enterStackFrame(Store OldStore,
- const CallEvent &Call,
- const StackFrameContext *LCtx) {
- StoreRef Store = StoreRef(OldStore, *this);
+BindResult StoreManager::enterStackFrame(Store OldStore, const CallEvent &Call,
+ const StackFrameContext *LCtx) {
+ BindResult Result{StoreRef(OldStore, *this), {}};
SmallVector<CallEvent::FrameBindingTy, 16> InitialBindings;
Call.getInitialStackFrameContents(LCtx, InitialBindings);
- for (const auto &I : InitialBindings)
- Store = Bind(Store.getStore(), I.first.castAs<Loc>(), I.second);
+ for (const auto &[Location, Val] : InitialBindings) {
+ Store S = Result.ResultingStore.getStore();
+ BindResult Curr = Bind(S, Location.castAs<Loc>(), Val);
+ Result.ResultingStore = Curr.ResultingStore;
+ llvm::append_range(Result.FailedToBindValues, Curr.FailedToBindValues);
+ }
- return Store;
+ return Result;
}
const ElementRegion *StoreManager::MakeElementRegion(const SubRegion *Base,
diff --git a/clang/test/Analysis/analyzer-config.c b/clang/test/Analysis/analyzer-config.c
index f6a49680917ac..06378b9814886 100644
--- a/clang/test/Analysis/analyzer-config.c
+++ b/clang/test/Analysis/analyzer-config.c
@@ -116,6 +116,7 @@
// CHECK-NEXT: osx.NumberObjectConversion:Pedantic = false
// CHECK-NEXT: osx.cocoa.RetainCount:TrackNSCFStartParam = false
// CHECK-NEXT: prune-paths = true
+// CHECK-NEXT: region-store-max-binding-fanout = 128
// CHECK-NEXT: region-store-small-array-limit = 5
// CHECK-NEXT: region-store-small-struct-limit = 2
// CHECK-NEXT: report-in-main-source-file = false
diff --git a/clang/test/Analysis/region-store.cpp b/clang/test/Analysis/region-store.cpp
index ab179ceb1acc8..9e80a2e688575 100644
--- a/clang/test/Analysis/region-store.cpp
+++ b/clang/test/Analysis/region-store.cpp
@@ -1,5 +1,15 @@
-// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix -verify %s
-// expected-no-diagnostics
+// DEFINE: %{analyzer} = %clang_analyze_cc1 -Wno-array-bounds %s \
+// DEFINE: -analyzer-checker=core,cplusplus,unix,debug.ExprInspection
+
+// RUN: %{analyzer} -verify=default
+// RUN: %{analyzer} -analyzer-config region-store-max-binding-fanout=10 -verify=limit10
+// RUN: %{analyzer} -analyzer-config region-store-max-binding-fanout=0 -verify=unlimited
+
+template <class T> void clang_analyzer_dump(T);
+void clang_analyzer_eval(bool);
+
+template <class... Ts> void escape(Ts...);
+bool coin();
class Loc {
int x;
@@ -26,3 +36,353 @@ int radar13445834(Derived *Builder, Loc l) {
return Builder->accessBase();
}
+
+void boundedNumberOfBindings() {
+ int array[] {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22};
+ clang_analyzer_dump(array[0]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{0 S32b}}
+ clang_analyzer_dump(array[1]); // default-warning {{1 S32b}} unlimited-warning {{1 S32b}} limit10-warning {{1 S32b}}
+ clang_analyzer_dump(array[2]); // default-warning {{2 S32b}} unlimited-warning {{2 S32b}} limit10-warning {{2 S32b}}
+ clang_analyzer_dump(array[3]); // default-warning {{3 S32b}} unlimited-warning {{3 S32b}} limit10-warning {{3 S32b}}
+ clang_analyzer_dump(array[4]); // default-warning {{4 S32b}} unlimited-warning {{4 S32b}} limit10-warning {{4 S32b}}
+ clang_analyzer_dump(array[5]); // default-warning {{5 S32b}} unlimited-warning {{5 S32b}} limit10-warning {{5 S32b}}
+ clang_analyzer_dump(array[6]); // default-warning {{6 S32b}} unlimited-warning {{6 S32b}} limit10-warning {{6 S32b}}
+ clang_analyzer_dump(array[7]); // default-warning {{7 S32b}} unlimited-warning {{7 S32b}} limit10-warning {{7 S32b}}
+ clang_analyzer_dump(array[8]); // default-warning {{8 S32b}} unlimited-warning {{8 S32b}} limit10-warning {{8 S32b}}
+ clang_analyzer_dump(array[9]); // default-warning {{9 S32b}} unlimited-warning {{9 S32b}} limit10-warning {{9 S32b}}
+ clang_analyzer_dump(array[10]); // default-warning {{10 S32b}} unlimited-warning {{10 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[11]); // default-warning {{11 S32b}} unlimited-warning {{11 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[12]); // default-warning {{12 S32b}} unlimited-warning {{12 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[13]); // default-warning {{13 S32b}} unlimited-warning {{13 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[14]); // default-warning {{14 S32b}} unlimited-warning {{14 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[15]); // default-warning {{15 S32b}} unlimited-warning {{15 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[16]); // default-warning {{16 S32b}} unlimited-warning {{16 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[17]); // default-warning {{17 S32b}} unlimited-warning {{17 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[18]); // default-warning {{18 S32b}} unlimited-warning {{18 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[19]); // default-warning {{19 S32b}} unlimited-warning {{19 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[20]); // default-warning {{20 S32b}} unlimited-warning {{20 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[21]); // default-warning {{21 S32b}} unlimited-warning {{21 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[22]); // default-warning {{22 S32b}} unlimited-warning {{22 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[23]); // see below see below limit10-warning {{Unknown}}
+ // default-warning at -1 {{1st function call argument is an uninitialized value}}
+ // unlimited-warning at -2 {{1st function call argument is an uninitialized value}}
+ // FIXME: The last dump at index 23 should be Undefined due to out of bounds access.
+}
+
+void incompleteInitList() {
+ int array[23] {0,1,2,3,4,5,6,7,8,9,10,11 /*rest are zeroes*/ };
+ clang_analyzer_dump(array[0]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{0 S32b}}
+ clang_analyzer_dump(array[1]); // default-warning {{1 S32b}} unlimited-warning {{1 S32b}} limit10-warning {{1 S32b}}
+ clang_analyzer_dump(array[2]); // default-warning {{2 S32b}} unlimited-warning {{2 S32b}} limit10-warning {{2 S32b}}
+ clang_analyzer_dump(array[3]); // default-warning {{3 S32b}} unlimited-warning {{3 S32b}} limit10-warning {{3 S32b}}
+ clang_analyzer_dump(array[4]); // default-warning {{4 S32b}} unlimited-warning {{4 S32b}} limit10-warning {{4 S32b}}
+ clang_analyzer_dump(array[5]); // default-warning {{5 S32b}} unlimited-warning {{5 S32b}} limit10-warning {{5 S32b}}
+ clang_analyzer_dump(array[6]); // default-warning {{6 S32b}} unlimited-warning {{6 S32b}} limit10-warning {{6 S32b}}
+ clang_analyzer_dump(array[7]); // default-warning {{7 S32b}} unlimited-warning {{7 S32b}} limit10-warning {{7 S32b}}
+ clang_analyzer_dump(array[8]); // default-warning {{8 S32b}} unlimited-warning {{8 S32b}} limit10-warning {{8 S32b}}
+ clang_analyzer_dump(array[9]); // default-warning {{9 S32b}} unlimited-warning {{9 S32b}} limit10-warning {{9 S32b}}
+ clang_analyzer_dump(array[10]); // default-warning {{10 S32b}} unlimited-warning {{10 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[11]); // default-warning {{11 S32b}} unlimited-warning {{11 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[12]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[13]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[14]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[15]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[16]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[17]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[18]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[19]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[20]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[21]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[22]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(array[23]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{Unknown}}
+ // FIXME: The last dump at index 23 should be Undefined due to out of bounds access.
+}
+
+struct Inner {
+ int first;
+ int second;
+};
+struct Outer {
+ Inner upper;
+ Inner lower;
+};
+
+void nestedStructInitLists() {
+ Outer array[]{ // 7*4: 28 values
+ {{00, 01}, {02, 03}},
+ {{10, 11}, {12, 13}},
+ {{20, 21}, {22, 23}},
+ {{30, 31}, {32, 33}},
+ {{40, 41}, {42, 43}},
+ {{50, 51}, {52, 53}},
+ {{60, 61}, {62, 63}},
+ };
+
+ int *p = (int*)array;
+ clang_analyzer_dump(p[0]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{0 S32b}}
+ clang_analyzer_dump(p[1]); // default-warning {{1 S32b}} unlimited-warning {{1 S32b}} limit10-warning {{1 S32b}}
+ clang_analyzer_dump(p[2]); // default-warning {{2 S32b}} unlimited-warning {{2 S32b}} limit10-warning {{2 S32b}}
+ clang_analyzer_dump(p[3]); // default-warning {{3 S32b}} unlimited-warning {{3 S32b}} limit10-warning {{3 S32b}}
+ clang_analyzer_dump(p[4]); // default-warning {{10 S32b}} unlimited-warning {{10 S32b}} limit10-warning {{10 S32b}}
+ clang_analyzer_dump(p[5]); // default-warning {{11 S32b}} unlimited-warning {{11 S32b}} limit10-warning {{11 S32b}}
+ clang_analyzer_dump(p[6]); // default-warning {{12 S32b}} unlimited-warning {{12 S32b}} limit10-warning {{12 S32b}}
+ clang_analyzer_dump(p[7]); // default-warning {{13 S32b}} unlimited-warning {{13 S32b}} limit10-warning {{13 S32b}}
+ clang_analyzer_dump(p[8]); // default-warning {{20 S32b}} unlimited-warning {{20 S32b}} limit10-warning {{20 S32b}}
+ clang_analyzer_dump(p[9]); // default-warning {{21 S32b}} unlimited-warning {{21 S32b}} limit10-warning {{21 S32b}}
+ clang_analyzer_dump(p[10]); // default-warning {{22 S32b}} unlimited-warning {{22 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[11]); // default-warning {{23 S32b}} unlimited-warning {{23 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[12]); // default-warning {{30 S32b}} unlimited-warning {{30 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[13]); // default-warning {{31 S32b}} unlimited-warning {{31 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[14]); // default-warning {{32 S32b}} unlimited-warning {{32 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[15]); // default-warning {{33 S32b}} unlimited-warning {{33 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[16]); // default-warning {{40 S32b}} unlimited-warning {{40 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[17]); // default-warning {{41 S32b}} unlimited-warning {{41 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[18]); // default-warning {{42 S32b}} unlimited-warning {{42 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[19]); // default-warning {{43 S32b}} unlimited-warning {{43 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[20]); // default-warning {{50 S32b}} unlimited-warning {{50 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[21]); // default-warning {{51 S32b}} unlimited-warning {{51 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[22]); // default-warning {{52 S32b}} unlimited-warning {{52 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[23]); // default-warning {{53 S32b}} unlimited-warning {{53 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[24]); // default-warning {{60 S32b}} unlimited-warning {{60 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[25]); // default-warning {{61 S32b}} unlimited-warning {{61 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[26]); // default-warning {{62 S32b}} unlimited-warning {{62 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[27]); // default-warning {{63 S32b}} unlimited-warning {{63 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(p[28]); // see below see below limit10-warning {{Unknown}}
+ // default-warning at -1 {{1st function call argument is an uninitialized value}}
+ // unlimited-warning at -2 {{1st function call argument is an uninitialized value}}
+ // FIXME: The last dump at index 28 should be Undefined due to out of bounds access.
+}
+
+void expectNoLeaksInWidenedInitLists() {
+ int *p[] {
+ new int(0),
+ new int(1),
+ new int(2),
+ new int(3),
+ new int(4),
+ new int(5),
+ new int(6),
+ new int(7),
+ new int(8),
+ new int(9),
+ new int(10),
+ new int(11),
+ new int(12),
+ new int(13),
+ new int(14),
+ new int(15),
+ new int(16),
+ new int(17),
+ new int(18),
+ new int(19),
+ new int(20),
+ new int(21),
+ new int(22),
+ new int(23),
+ new int(24),
+ };
+ clang_analyzer_dump(*p[0]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{0 S32b}}
+ clang_analyzer_dump(*p[12]); // default-warning {{12 S32b}} unlimited-warning {{12 S32b}} limit10-warning {{Unknown}}
+ escape(p); // no-leaks
+}
+
+void rawArrayWithSelfReference() {
+ // If a pointer to some object escapes, that pointed object should escape too.
+ // Consequently, if the 22th initializer would escape, then the p[6] should also escape - clobbering any loads from that location later.
+ int *p[25] = {
+ new int(0),
+ new int(1),
+ new int(2),
+ new int(3),
+ new int(4),
+ new int(5),
+ new int(6),
+ new int(7),
+ p[5], // Should be a pointer to the 6th array element, but we get Undefined as the analyzer thinks that "p" is not yet initialized, thus loading from index 5 is UB. This is wrong.
+ new int(9),
+ new int(10),
+ new int(11),
+ new int(12),
+ new int(13),
+ new int(14),
+ new int(15),
+ new int(16),
+ new int(17),
+ new int(18),
+ new int(19),
+ new int(20),
+ new int(21),
+ p[6], // Should be a pointer to the 6th array element, but we get Undefined as the analyzer thinks that "p" is not yet initialized, thus loading from index 5 is UB. This is wrong.
+ new int(23),
+ new int(24),
+ };
+ clang_analyzer_dump(*p[5]); // default-warning {{5 S32b}} unlimited-warning {{5 S32b}} limit10-warning {{5 S32b}}
+ clang_analyzer_dump(*p[6]); // default-warning {{6 S32b}} unlimited-warning {{6 S32b}} limit10-warning {{6 S32b}}
+
+ if (coin()) {
+ clang_analyzer_dump(*p[8]);
+ // default-warning at -1 {{Dereference of undefined pointer value}}
+ // unlimited-warning at -2 {{Dereference of undefined pointer value}}
+ // limit10-warning at -3 {{Dereference of undefined pointer value}}
+ }
+
+ clang_analyzer_dump(*p[12]); // default-warning {{12 S32b}} unlimited-warning {{12 S32b}} limit10-warning {{Unknown}}
+
+ if (coin()) {
+ clang_analyzer_dump(*p[22]);
+ // default-warning at -1 {{Dereference of undefined pointer value}}
+ // unlimited-warning at -2 {{Dereference of undefined pointer value}}
+ // limit10-warning at -3 {{Unknown}}
+ }
+
+ clang_analyzer_dump(*p[23]); // default-warning {{23 S32b}} unlimited-warning {{23 S32b}} limit10-warning {{Unknown}}
+
+ escape(p); // no-leaks
+}
+
+template <class T, unsigned Size> struct BigArray {
+ T array[Size];
+};
+
+void fieldArrayWithSelfReference() {
+ // Similar to "rawArrayWithSelfReference", but using an aggregate object and assignment operator to achieve the element-wise binds.
+ BigArray<int *, 25> p;
+ p = {
+ new int(0),
+ new int(1),
+ new int(2),
+ new int(3),
+ new int(4),
+ new int(5),
+ new int(6),
+ new int(7),
+ p.array[5], // Pointer to the 6th array element.
+ new int(9),
+ new int(10),
+ new int(11),
+ new int(12),
+ new int(13),
+ new int(14),
+ new int(15),
+ new int(16),
+ new int(17),
+ new int(18),
+ new int(19),
+ new int(20),
+ new int(21),
+ p.array[6], // Pointer to the 7th array element.
+ new int(23),
+ new int(24),
+ };
+ clang_analyzer_dump(*p.array[5]); // default-warning {{5 S32b}} unlimited-warning {{5 S32b}} limit10-warning {{5 S32b}}
+ clang_analyzer_dump(*p.array[6]); // default-warning {{6 S32b}} unlimited-warning {{6 S32b}} limit10-warning {{6 S32b}}
+
+ if (coin()) {
+ clang_analyzer_dump(*p.array[8]);
+ // default-warning at -1 {{Unknown}}
+ // unlimited-warning at -2 {{Unknown}}
+ // limit10-warning at -3 {{Unknown}}
+ }
+
+ clang_analyzer_dump(*p.array[12]); // default-warning {{12 S32b}} unlimited-warning {{12 S32b}} limit10-warning {{Unknown}}
+
+ if (coin()) {
+ clang_analyzer_dump(*p.array[22]);
+ // default-warning at -1 {{Unknown}}
+ // unlimited-warning at -2 {{Unknown}}
+ // limit10-warning at -3 {{Unknown}}
+ }
+
+ clang_analyzer_dump(*p.array[23]); // default-warning {{23 S32b}} unlimited-warning {{23 S32b}} limit10-warning {{Unknown}}
+
+ escape(p); // no-leaks
+}
+
+struct PtrHolderBase {
+ int *ptr;
+};
+struct BigStruct : BigArray<int, 1000>, PtrHolderBase {};
+void largeBaseClasses() {
+ BigStruct D{{0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24}, {new int(25)}};
+ (void)D; // no-leak here, the PtrHolderBase subobject is properly escaped.
+
+ clang_analyzer_dump(*D.ptr); // default-warning {{25 S32b}} unlimited-warning {{25 S32b}} limit10-warning {{Unknown}}
+ escape(D);
+}
+
+struct List {
+ int* ptr;
+ BigArray<int, 30> head;
+ List *tail;
+};
+void tempObjectMayEscapeArgumentsInAssignment() {
+ // This will be leaked after the assignment. However, we should not diagnose
+ // this because in the RHS of the assignment the temporary couldn't be really
+ // materialized due to the number of bindings, thus the address of `l` will
+ // escape there.
+ List l{new int(404)};
+
+ // ExprWithCleanups wraps the assignment operator call, which assigns a MaterializeTemporaryExpr.
+ l = List{new int(42), {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24}, &l};
+ (void)l;
+ // default-warning at -1 {{Potential memory leak}} We detect the leak with the default settings.
+ // unlimited-warning at -2 {{Potential memory leak}} We detect the leak with the default settings.
+ // limit10 is missing! It's because in that case we escape `&l`, thus we assume freed. This is good.
+
+ clang_analyzer_dump(*l.ptr); // default-warning {{42 S32b}} unlimited-warning {{42 S32b}} limit10-warning {{42 S32b}}
+ escape(l);
+}
+
+void tempObjNotMaterializedThusDoesntEscapeAnything() {
+ List l{new int(404)};
+ // We have no ExprWithCleanups or MaterializeTemporaryExpr here, so `&l` is never escaped. This is good.
+ (void)List{new int(42), {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24}, &l};
+ (void)l;
+ // default-warning at -1 {{Potential memory leak}} We detect the leak with the default settings.
+ // limit10-warning at -2 {{Potential memory leak}} We detect the leak with the default settings.
+ // unlimited-warning at -3 {{Potential memory leak}} We detect the leak with the default settings.
+
+ clang_analyzer_dump(*l.ptr); // default-warning {{404 S32b}} unlimited-warning {{404 S32b}} limit10-warning {{404 S32b}}
+ escape(l);
+}
+
+void theValueOfTheEscapedRegionRemainsTheSame() {
+ int *p = new int(404);
+ List l{p};
+ List l2{new int(42), {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24}, &l};
+
+ // The value of l.ptr shouldn't be clobbered after a failing to copy `&l`.
+ clang_analyzer_eval(p == l.ptr); // default-warning {{TRUE}} unlimited-warning {{TRUE}} limit10-warning {{TRUE}}
+
+ // If the bindings fit, we will know that it aliases with `p`. Otherwise, it's unknown. This is good.
+ clang_analyzer_dump(*l2.tail->ptr); // default-warning {{404 S32b}} unlimited-warning {{404 S32b}} limit10-warning {{Unknown}}
+
+ escape(l, l2);
+}
+
+void calleeWithManyParms(BigArray<int, 7> arr7, BigArray<int, 100> arr100) {
+ clang_analyzer_dump(arr7.array[0]); // default-warning {{0 S32b}} unlimited-warning {{0 S32b}} limit10-warning {{0 S32b}}
+ clang_analyzer_dump(arr7.array[6]); // default-warning {{6 S32b}} unlimited-warning {{6 S32b}} limit10-warning {{6 S32b}}
+
+ clang_analyzer_dump(arr100.array[0]); // default-warning {{10 S32b}} unlimited-warning {{10 S32b}} limit10-warning {{10 S32b}}
+ clang_analyzer_dump(arr100.array[6]); // default-warning {{16 S32b}} unlimited-warning {{16 S32b}} limit10-warning {{16 S32b}}
+
+ clang_analyzer_dump(arr100.array[8]); // default-warning {{18 S32b}} unlimited-warning {{18 S32b}} limit10-warning {{18 S32b}}
+ clang_analyzer_dump(arr100.array[9]); // default-warning {{19 S32b}} unlimited-warning {{19 S32b}} limit10-warning {{19 S32b}}
+ clang_analyzer_dump(arr100.array[10]); // default-warning {{20 S32b}} unlimited-warning {{20 S32b}} limit10-warning {{Unknown}}
+ clang_analyzer_dump(arr100.array[99]); // default-warning {{19 S32b}} unlimited-warning {{19 S32b}} limit10-warning {{Unknown}}
+}
+
+void tooManyFnArgumentsWhenInlining() {
+ calleeWithManyParms({0,1,2,3,4,5,6}, {
+ 10,11,12,13,14,15,16,17,18,19,
+ 20,21,22,23,24,25,26,27,28,29,
+ 30,31,32,33,34,35,36,37,38,39,
+ 40,41,42,43,44,45,46,47,48,49,
+ 50,51,52,53,54,55,56,57,58,59,
+ 60,61,62,63,64,65,66,67,68,69,
+ 70,71,72,73,74,75,76,77,78,79,
+ 80,81,82,83,84,85,86,87,88,89,
+ 90,91,92,93,94,95,96,97,98,99,
+ 10,11,12,13,14,15,16,17,18,19,
+ });
+}
diff --git a/clang/unittests/StaticAnalyzer/StoreTest.cpp b/clang/unittests/StaticAnalyzer/StoreTest.cpp
index 17b64ce622f89..1448c2b411fdb 100644
--- a/clang/unittests/StaticAnalyzer/StoreTest.cpp
+++ b/clang/unittests/StaticAnalyzer/StoreTest.cpp
@@ -69,17 +69,18 @@ class VariableBindConsumer : public StoreTestConsumer {
SVal NarrowZero = Builder.makeZeroVal(ASTCtxt.CharTy);
// Bind(Zero)
- Store StX0 = SManager.Bind(StInit, LX0, Zero).getStore();
+ Store StX0 = SManager.Bind(StInit, LX0, Zero).ResultingStore.getStore();
EXPECT_EQ(Zero, SManager.getBinding(StX0, LX0, ASTCtxt.IntTy));
// BindDefaultInitial(Zero)
- Store StY0 =
- SManager.BindDefaultInitial(StInit, LY0.getAsRegion(), Zero).getStore();
+ Store StY0 = SManager.BindDefaultInitial(StInit, LY0.getAsRegion(), Zero)
+ .ResultingStore.getStore();
EXPECT_EQ(Zero, SManager.getBinding(StY0, LY0, ASTCtxt.IntTy));
EXPECT_EQ(Zero, *SManager.getDefaultBinding(StY0, LY0.getAsRegion()));
// BindDefaultZero()
- Store StZ0 = SManager.BindDefaultZero(StInit, LZ0.getAsRegion()).getStore();
+ Store StZ0 = SManager.BindDefaultZero(StInit, LZ0.getAsRegion())
+ .ResultingStore.getStore();
// BindDefaultZero wipes the region with '0 S8b', not with out Zero.
// Direct load, however, does give us back the object of the type
// that we specify for loading.
@@ -87,12 +88,12 @@ class VariableBindConsumer : public StoreTestConsumer {
EXPECT_EQ(NarrowZero, *SManager.getDefaultBinding(StZ0, LZ0.getAsRegion()));
// Bind(One)
- Store StX1 = SManager.Bind(StInit, LX1, One).getStore();
+ Store StX1 = SManager.Bind(StInit, LX1, One).ResultingStore.getStore();
EXPECT_EQ(One, SManager.getBinding(StX1, LX1, ASTCtxt.IntTy));
// BindDefaultInitial(One)
- Store StY1 =
- SManager.BindDefaultInitial(StInit, LY1.getAsRegion(), One).getStore();
+ Store StY1 = SManager.BindDefaultInitial(StInit, LY1.getAsRegion(), One)
+ .ResultingStore.getStore();
EXPECT_EQ(One, SManager.getBinding(StY1, LY1, ASTCtxt.IntTy));
EXPECT_EQ(One, *SManager.getDefaultBinding(StY1, LY1.getAsRegion()));
}
@@ -134,7 +135,8 @@ class LiteralCompoundConsumer : public StoreTestConsumer {
Store StInit = SManager.getInitialStore(SFC).getStore();
// Let's bind constant 1 to 'test[0]'
SVal One = Builder.makeIntVal(1, Int);
- Store StX = SManager.Bind(StInit, ZeroElement, One).getStore();
+ Store StX =
+ SManager.Bind(StInit, ZeroElement, One).ResultingStore.getStore();
// And make sure that we can read this binding back as it was
EXPECT_EQ(One, SManager.getBinding(StX, ZeroElement, Int));
More information about the cfe-commits
mailing list