[llvm-bugs] [Bug 25426] New: Static analyzer crashes

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=25426

            Bug ID: 25426
           Summary: Static analyzer crashes
           Product: clang
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Static Analyzer
          Assignee: kremenek at apple.com
          Reporter: alexfh at google.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

$ cat sa4.cc
struct x0 {
  typedef int &x1;
};
class x2 {
public:
  x0::x1 operator[](unsigned);
};
class x3 {
  int x4();
  x2 x5;
};
struct x6 {
  char x7;
};
struct x8 : x6 {};
int x9;
int x3::x4() {
  x8 &x10 = reinterpret_cast<x8 &>(x5[x9]);
  x10.x7 = 2;
}
$ clang-tidy -checks=-*,clang-analyzer*,-clang-analyzer-alpha* sa4.cc --
-std=c++11
*** SIGSEGV (@0x80) received by PID 19053 (TID 19053); stack trace: ***
PC: @           0x9a730e  (unknown)  clang::LazyDefinitionDataPtr<>::update()
    @          0x19f930d        928  FailureSignalHandler()
    @     0x7fca4e275390       1520  __restore_rt
    @           0x9a6bf9         48  clang::CXXRecordDecl::bases()
    @          0x1366b3e        112  clang::ento::MemRegion::getAsOffset()
    @          0x1348b66       1232  (anonymous
namespace)::RegionStoreManager::removeSubRegionBindings()
    @          0x134787d        240  (anonymous
namespace)::RegionStoreManager::bind()
    @          0x1341058        128  (anonymous
namespace)::RegionStoreManager::Bind()
    @          0x1354012        160  clang::ento::ProgramState::bindLoc()
    @          0x1391715        512  clang::ento::ExprEngine::evalBind()
    @          0x1397149        224  clang::ento::ExprEngine::evalStore()
    @          0x13a83e8        816 
clang::ento::ExprEngine::VisitBinaryOperator()
    @          0x1391070       1248  clang::ento::ExprEngine::Visit()
    @          0x138d877        400  clang::ento::ExprEngine::ProcessStmt()
    @          0x138d50c         96 
clang::ento::ExprEngine::processCFGElement()
    @          0x139e89e        160 
clang::ento::CoreEngine::dispatchWorkItem()
    @          0x139e49a        192  clang::ento::CoreEngine::ExecuteWorkList()
    @           0xb45452       1120  (anonymous
namespace)::AnalysisConsumer::ActionExprEngine()
    @           0xb44f61        288  (anonymous
namespace)::AnalysisConsumer::HandleCode()
    @           0xb38274        480  (anonymous
namespace)::AnalysisConsumer::HandleTranslationUnit()
    @           0xd3b24c         48 
clang::MultiplexConsumer::HandleTranslationUnit()
    @           0xe43f82        144  clang::ParseAST()
    @           0xd3eeff         48  clang::FrontendAction::Execute()
    @           0xc7e282         96  clang::CompilerInstance::ExecuteAction()
    @           0xc36da5        352 
clang::tooling::FrontendActionFactory::runInvocation()
    @           0xc36bee         64 
clang::tooling::ToolInvocation::runInvocation()
    @           0xc366fa       1440  clang::tooling::ToolInvocation::run()
    @           0xc37c9a       1040  clang::tooling::ClangTool::run()
    @           0xa1a355       1952  clang::tidy::runClangTidy()
    @           0x435aa0       1344  main
    @     0x7fca4dcc8ce8        208  __libc_start_main
    @           0x434a69  (unknown)  _start
Segmentation fault (core dumped)

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20151106/a07959e7/attachment.html>