[llvm-bugs] [Bug 30616] New: clang: clang/AST/Expr.h: Assertion `Arg < NumArgs && "Arg access out of range!"' failed.

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=30616

            Bug ID: 30616
           Summary: clang: clang/AST/Expr.h: Assertion `Arg < NumArgs &&
                    "Arg access out of range!"' failed.
           Product: clang
           Version: 3.9
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Static Analyzer
          Assignee: kremenek at apple.com
          Reporter: markus at oberhumer.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

The following simple C program triggers an assertion with scan-build-3.9:


char alloca();
int main(int ac, char *av[]) {
    alloca();
    if (ac > 1000) {
        return *av[0];
    }
    return 0;
}


Assertion failed:

clang-3.9:
/home/hosts/cc-i386-linux/build/llvm/llvm-3.9-git/src/llvm/tools/clang/include/clang/AST/Expr.h:2222:
const clang::Expr *clang::CallExpr::getArg(unsigned int) const: Assertion `Arg
< NumArgs && "Arg access out of range!"' failed.

Command line:

0.      Program arguments:
/opt/cc-i386-linux/llvm/llvm-3.9/clang-3.9.0-20160902-pristine/bin/clang-3.9
-cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -main-file-name
scan_build_crash.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks
-analyzer-eagerly-assume -analyzer-checker=core -analyzer-checker=unix
-analyzer-checker=deadcode
-analyzer-checker=security.insecureAPI.UncheckedReturn
-analyzer-checker=security.insecureAPI.getpw
-analyzer-checker=security.insecureAPI.gets
-analyzer-checker=security.insecureAPI.mktemp
-analyzer-checker=security.insecureAPI.mkstemp
-analyzer-checker=security.insecureAPI.vfork
-analyzer-checker=nullability.NullPassedToNonnull
-analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w
-mrelocation-model static -mthread-model posix -mdisable-fp-elim -fmath-errno
-masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array
-target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -resource-dir
/opt/cc-i386-linux/llvm/llvm-3.9/clang-3.9.0-20160902-pristine/bin/../lib/clang/3.9.0
-internal-isystem /usr/local/include -internal-isystem
/opt/cc-i386-linux/llvm/llvm-3.9/clang-3.9.0-20160902-pristine/bin/../lib/clang/3.9.0/include
-internal-externc-isystem /include -internal-externc-isystem /usr/include
-fdebug-compilation-dir /home/mfx/pp/bugs/llvm-bugs/scan-build-crash
-ferror-limit 19 -fmessage-length 0 -fobjc-runtime=gcc
-fdiagnostics-show-option -analyzer-display-progress -analyzer-output=html -o
/tmp/scan-build-2016-10-05-103146-24994-1 -x c scan_build_crash.c 


Stack trace:

[...]
#5 0x00002b2a9bf9b227 __assert_fail_base (/lib64/libc.so.6+0x2d227)
#6 0x00002b2a9bf9b2d2 (/lib64/libc.so.6+0x2d2d2)
#7 0x0000000001308a6a void
clang::ento::check::PostStmt<clang::CallExpr>::_checkStmt<(anonymous
namespace)::MallocChecker>(void*, clang::Stmt const*,
clang::ento::CheckerContext&)
(/opt/cc-i386-linux/llvm/llvm-3.9/clang-3.9.0-20160902-pristine/bin/clang-3.9+0x1308a6a)
#8 0x00000000013d8528 clang::ento::CheckerManager::runCheckersForStmt(bool,
clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNodeSet const&, clang::Stmt
const*, clang::ento::ExprEngine&, bool)
(/opt/cc-i386-linux/llvm/llvm-3.9/clang-3.9.0-20160902-pristine/bin/clang-3.9+0x13d8528)
#9 0x000000000140afa4 clang::ento::ExprEngine::VisitCallExpr(clang::CallExpr
const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&)
(/opt/cc-i386-linux/llvm/llvm-3.9/clang-3.9.0-20160902-pristine/bin/clang-3.9+0x140afa4
[...]

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20161005/6f5c5e6a/attachment.html>