[llvm-bugs] [Bug 50179] New: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:596: clang::ento::loc::MemRegionVal::MemRegionVal(const clang::ento::MemRegion *): Assertion `r' failed.

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=50179

            Bug ID: 50179
           Summary: clang/include/clang/StaticAnalyzer/Core/PathSensitive/
                    SVals.h:596:
                    clang::ento::loc::MemRegionVal::MemRegionVal(const
                    clang::ento::MemRegion *): Assertion `r' failed.
           Product: clang
           Version: unspecified
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: normal
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: vince.a.bridgers at gmail.com
                CC: dcoughlin at apple.com, llvm-bugs at lists.llvm.org

This crash seems to have been introduced by
https://bugs.llvm.org/show_bug.cgi?id=49007. 

Trimmed crash ... 

$ clang --analyze case.c
clang: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:596:
clang::ento::loc::MemRegionVal::MemRegionVal(const clang::ento::MemRegion *):
Assertion `r' failed.

Stack dump:
0.      Program arguments: clang --analyze case.c
1.      <eof> parser at end of file
2.      While analyzing stack: 
        #0 Calling getTaskJob
3.      case.c:12:17: Error evaluating statement
4.      case.c:12:17: Error evaluating statement
#11 0x00000000077ae64c
clang::ento::loc::MemRegionVal::MemRegionVal(clang::ento::MemRegion const*)
clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:597:3
#12 0x00000000082e2f7a
clang::ento::SValBuilder::evalCastSubKind(clang::ento::loc::MemRegionVal,
clang::QualType, clang::QualType)
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:773:18
#13 0x00000000082e228f clang::ento::SValBuilder::evalCastKind(clang::ento::Loc,
clang::QualType, clang::QualType)
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:612:12
#14 0x00000000082dfb4c clang::ento::SValBuilder::evalCast(clang::ento::SVal,
clang::QualType, clang::QualType)
clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:587:12
#15 0x00000000082a2b48 (anonymous
namespace)::RegionStoreManager::getBinding((anonymous
namespace)::RegionBindingsRef const&, clang::ento::Loc, clang::QualType)
clang/lib/StaticAnalyzer/Core/RegionStore.cpp:1510:24

reproducer ... 
clang --analyze case.c
typedef struct taskS {
  void * pJob;
}  taskS;

typedef struct workS {
  taskS * pTaskList;
} workS;

void * getTaskJob ( unsigned jobId , workS *pWork, unsigned taskId)
{
  const taskS * pTask = pWork->pTaskList + taskId;
  taskS task = *pTask;
  return task.pJob;
}

anticipated fix (to be submitted)
@@ -761,8 +761,8 @@ SVal SValBuilder::evalCastSubKind(loc::MemRegionVal V,
QualType CastTy,
       // Next fixes pointer dereference using type different from its initial
       // one. See PR37503 and PR49007 for details.
       if (const auto *ER = dyn_cast<ElementRegion>(R)) {
-        R = StateMgr.getStoreManager().castRegion(ER, CastTy);
-        return loc::MemRegionVal(R);
+        if ((R = StateMgr.getStoreManager().castRegion(ER, CastTy)))
+          return loc::MemRegionVal(R);
       }

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20210430/6b707588/attachment-0001.html>