[PATCH] D48324: [analyzer] Fix wrong comparison generation of the ranges generated by the refutation manager

[Phabricator via Phabricator via llvm-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rL335926: [analyzer] Fix wrong comparison generation of the ranges generated by the… (authored by mramalho, committed by ).
Herald added a subscriber: llvm-commits.

Changed prior to commit:
  https://reviews.llvm.org/D48324?vs=152763&id=153396#toc

Repository:
  rL LLVM

https://reviews.llvm.org/D48324

Files:
  cfe/trunk/lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp
  cfe/trunk/test/PR37855.c


Index: cfe/trunk/test/PR37855.c
===================================================================
--- cfe/trunk/test/PR37855.c
+++ cfe/trunk/test/PR37855.c
@@ -0,0 +1,24 @@
+// RUN: %clang_cc1 -analyze -analyzer-eagerly-assume -analyzer-checker=core -w -DNO_CROSSCHECK -verify %s
+// RUN: %clang_cc1 -analyze -analyzer-eagerly-assume -analyzer-checker=core -w -analyzer-config crosscheck-with-z3=true -verify %s
+// REQUIRES: z3
+
+typedef struct o p;
+struct o {
+  struct {
+  } s;
+};
+
+void q(*r, p2) { r < p2; }
+
+void k(l, node) {
+  struct {
+    p *node;
+  } * n, *nodep, path[sizeof(void)];
+  path->node = l;
+  for (n = path; node != l;) {
+    q(node, n->node);
+    nodep = n;
+  }
+  if (nodep) // expected-warning {{Branch condition evaluates to a garbage value}}
+    n[1].node->s; // expected-warning {{Dereference of undefined pointer value}}
+}
Index: cfe/trunk/lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp
@@ -1414,9 +1414,8 @@
 
     // If the two operands are pointers and the operation is a subtraction, the
     // result is of type ptrdiff_t, which is signed
-    if (LTy->isAnyPointerType() && LTy == RTy && Op == BO_Sub) {
-      ASTContext &Ctx = getBasicVals().getContext();
-      *RetTy = Ctx.getIntTypeForBitwidth(Ctx.getTypeSize(LTy), true);
+    if (LTy->isAnyPointerType() && RTy->isAnyPointerType() && Op == BO_Sub) {
+      *RetTy = getBasicVals().getContext().getPointerDiffType();
     }
   }
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D48324.153396.patch
Type: text/x-patch
Size: 1634 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180628/b40ec1a1/attachment.bin>