[clang] [clang][analyzer] Fix false positive in StdLibraryFunctionsChecker for mmap with MAP_ANON (PR #219568)

[Balázs Benics via cfe-commits]

================
@@ -2950,16 +2951,32 @@ void StdLibraryFunctionsChecker::initFunctionSummaries(
     // void *mmap(void *addr, size_t length, int prot, int flags, int fd,
     // off_t offset);
     // FIXME: Improve for errno modeling.
-    addToFunctionSummaryMap(
-        "mmap",
-        Signature(
-            ArgTypes{VoidPtrTy, SizeTyCanonTy, IntTy, IntTy, IntTy, Off_tTy},
-            RetType{VoidPtrTy}),
-        Summary(NoEvalCall)
-            .ArgConstraint(ArgumentCondition(1, WithinRange, Range(1, SizeMax)))
-            .ArgConstraint(
-                ArgumentCondition(4, WithinRange, Range(-1, IntMax))));
-
+    if (ACtx.getTargetInfo().getTriple().isOSDarwin()) {
+        // On Darwin, MAP_ANON + VM_MAKE_TAG(tag) uses argument 4 (len) for
+        // the tag, which looks like a large negative signed integer. The
+        // valid range for fd is not expressible as a simple union of ranges
+        // so omit the constraint.
+        addToFunctionSummaryMap(
+            "mmap",
+            Signature(ArgTypes{VoidPtrTy, SizeTyCanonTy, IntTy, IntTy,
+                               IntTy, Off_tTy},
+                      RetType{VoidPtrTy}),
+            Summary(NoEvalCall)
+            .ArgConstraint(ArgumentCondition(1, WithinRange,
+                                             Range(1, SizeMax))));
+    } else {
+        addToFunctionSummaryMap(
+            "mmap",
+            Signature(ArgTypes{VoidPtrTy, SizeTyCanonTy, IntTy, IntTy,
+                               IntTy, Off_tTy},
+                      RetType{VoidPtrTy}),
+            Summary(NoEvalCall)
+            .ArgConstraint(ArgumentCondition(1, WithinRange,
+                                             Range(1, SizeMax)))
+            .ArgConstraint(ArgumentCondition(4, WithinRange,
+                                             Range(-1, IntMax))));
+    }
----------------
steakhal wrote:

I don't really like the duplication here. Have you explored the options for reducing the duplication among these summaries?

The least we could do is to hoist the `Signature` variable out and apply the arg constraint. Then use the captured mutable reference and conditionally also apply the additional arg constraint. This way we could save on the duplicated parts. I'm open for alternatives too.

https://github.com/llvm/llvm-project/pull/219568