Skip to content

Commit 6171e4b

Browse files
authored
Revert "[Clang][analyzer] replace Stmt* with ConstCFGElementRef in SymbolConjured" (#137304)
Reverts #128251 ASAN bots reported some errors: https://lab.llvm.org/buildbot/#/builders/55/builds/10398 Reverting for investigation. ``` Failed Tests (6): Clang :: Analysis/loop-widening-ignore-static-methods.cpp Clang :: Analysis/loop-widening-notes.cpp Clang :: Analysis/loop-widening-preserve-reference-type.cpp Clang :: Analysis/loop-widening.c Clang :: Analysis/loop-widening.cpp Clang :: Analysis/this-pointer.cpp Testing Time: 411.55s Total Discovered Tests: 118563 Skipped : 33 (0.03%) Unsupported : 2015 (1.70%) Passed : 116291 (98.08%) Expectedly Failed: 218 (0.18%) Failed : 6 (0.01%) FAILED: CMakeFiles/check-all /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/CMakeFiles/check-all cd /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan && /usr/bin/python3 /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/./bin/llvm-lit -sv --param USE_Z3_SOLVER=0 /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/utils/mlgo-utils /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/tools/lld/test /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/tools/mlir/test /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/tools/clang/test /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/utils/lit /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/test ninja: build stopped: subcommand failed. ``` ``` /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/bin/clang -cc1 -internal-isystem /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/lib/clang/21/include -nostdsysteminc -analyze -analyzer-constraints=range -setup-static-analyzer -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/test/Analysis/loop-widening.c # RUN: at line 1 + /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/bin/clang -cc1 -internal-isystem /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/lib/clang/21/include -nostdsysteminc -analyze -analyzer-constraints=range -setup-static-analyzer -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/test/Analysis/loop-widening.c PLEASE submit a bug report to https://github.com./llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script. Stack dump: 0. Program arguments: /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/bin/clang -cc1 -internal-isystem /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/lib/clang/21/include -nostdsysteminc -analyze -analyzer-constraints=range -setup-static-analyzer -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/test/Analysis/loop-widening.c 1. <eof> parser at end of file 2. While analyzing stack: #0 Calling nested_loop_inner_widen #0 0x0000c894cca289cc llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/lib/Support/Unix/Signals.inc:804:13 #1 0x0000c894cca23324 llvm::sys::RunSignalHandlers() /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/lib/Support/Signals.cpp:106:18 #2 0x0000c894cca29bbc SignalHandler(int, siginfo_t*, void*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/lib/Support/Unix/Signals.inc:0:3 #3 0x0000f6898da4a8f8 (linux-vdso.so.1+0x8f8) #4 0x0000f6898d377608 (/lib/aarch64-linux-gnu/libc.so.6+0x87608) #5 0x0000f6898d32cb3c raise (/lib/aarch64-linux-gnu/libc.so.6+0x3cb3c) #6 0x0000f6898d317e00 abort (/lib/aarch64-linux-gnu/libc.so.6+0x27e00) #7 0x0000c894c5e77fec __sanitizer::Atexit(void (*)()) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp:168:10 #8 0x0000c894c5e76680 __sanitizer::Die() /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp:52:5 #9 0x0000c894c5e69650 Unlock /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/../sanitizer_common/sanitizer_mutex.h:250:16 #10 0x0000c894c5e69650 ~GenericScopedLock /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/../sanitizer_common/sanitizer_mutex.h:386:51 #11 0x0000c894c5e69650 __hwasan::ScopedReport::~ScopedReport() /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/hwasan_report.cpp:54:5 #12 0x0000c894c5e68de0 __hwasan::(anonymous namespace)::BaseReport::~BaseReport() /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/hwasan_report.cpp:476:7 #13 0x0000c894c5e66b74 __hwasan::ReportTagMismatch(__sanitizer::StackTrace*, unsigned long, unsigned long, bool, bool, unsigned long*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/hwasan_report.cpp:1091:1 #14 0x0000c894c5e52cf8 Destroy /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/../sanitizer_common/sanitizer_common.h:532:31 #15 0x0000c894c5e52cf8 ~InternalMmapVector /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/../sanitizer_common/sanitizer_common.h:642:56 #16 0x0000c894c5e52cf8 __hwasan::HandleTagMismatch(__hwasan::AccessInfo, unsigned long, unsigned long, void*, unsigned long*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/hwasan.cpp:245:1 #17 0x0000c894c5e551c8 __hwasan_tag_mismatch4 /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/hwasan/hwasan.cpp:764:1 #18 0x0000c894c5e6a2f8 __interception::InterceptFunction(char const*, unsigned long*, unsigned long, unsigned long) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/compiler-rt/lib/interception/interception_linux.cpp:60:0 #19 0x0000c894d166f664 getBlock /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:217:45 #20 0x0000c894d166f664 getCFGElementRef /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h:230:59 #21 0x0000c894d166f664 clang::ento::ExprEngine::processCFGBlockEntrance(clang::BlockEdge const&, clang::ento::NodeBuilderWithSinks&, clang::ento::ExplodedNode*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:2570:45 #22 0x0000c894d15f3a1c hasGeneratedNodes /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:333:37 #23 0x0000c894d15f3a1c clang::ento::CoreEngine::HandleBlockEdge(clang::BlockEdge const&, clang::ento::ExplodedNode*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:319:20 #24 0x0000c894d15f2c34 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:220:7 #25 0x0000c894d15f2398 operator-> /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/libcxx_install_hwasan/include/c++/v1/__memory/unique_ptr.h:267:101 #26 0x0000c894d15f2398 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>)::$_0::operator()(unsigned int) const /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:140:12 #27 0x0000c894d15f14b4 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:165:7 #28 0x0000c894d0ebb9dc release /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:232:9 #29 0x0000c894d0ebb9dc ~IntrusiveRefCntPtr /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:196:27 #30 0x0000c894d0ebb9dc ExecuteWorkList /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h:192:5 #31 0x0000c894d0ebb9dc RunPathSensitiveChecks /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:772:7 #32 0x0000c894d0ebb9dc (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl*, unsigned int, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*, void>>*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:741:5 #33 0x0000c894d0eb6ee4 begin /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/include/llvm/ADT/DenseMap.h:0:0 #34 0x0000c894d0eb6ee4 begin /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/include/llvm/ADT/DenseSet.h:187:45 #35 0x0000c894d0eb6ee4 HandleDeclsCallGraph /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:516:29 #36 0x0000c894d0eb6ee4 runAnalysisOnTranslationUnit /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:584:5 #37 0x0000c894d0eb6ee4 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:647:3 #38 0x0000c894d18a7a38 clang::ParseAST(clang::Sema&, bool, bool) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/Parse/ParseAST.cpp:0:13 #39 0x0000c894ce81ed70 clang::FrontendAction::Execute() /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/Frontend/FrontendAction.cpp:1231:10 #40 0x0000c894ce6f2144 getPtr /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/include/llvm/Support/Error.h:278:42 #41 0x0000c894ce6f2144 operator bool /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/llvm/include/llvm/Support/Error.h:241:16 #42 0x0000c894ce6f2144 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/Frontend/CompilerInstance.cpp:1058:23 #43 0x0000c894cea718cc operator-> /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/libcxx_install_hwasan/include/c++/v1/__memory/shared_ptr.h:635:12 #44 0x0000c894cea718cc getFrontendOpts /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/include/clang/Frontend/CompilerInstance.h:307:12 #45 0x0000c894cea718cc clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:301:14 #46 0x0000c894c5e9cf28 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/tools/driver/cc1_main.cpp:294:15 #47 0x0000c894c5e92a9c ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/tools/driver/driver.cpp:223:12 #48 0x0000c894c5e902ac clang_main(int, char**, llvm::ToolContext const&) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/tools/driver/driver.cpp:0:12 #49 0x0000c894c5eb2e34 main /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/tools/clang/tools/driver/clang-driver.cpp:17:3 #50 0x0000f6898d3184c4 (/lib/aarch64-linux-gnu/libc.so.6+0x284c4) #51 0x0000f6898d318598 __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28598) #52 0x0000c894c5e52a30 _start (/home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/bin/clang+0x6512a30) /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/tools/clang/test/Analysis/Output/loop-widening.c.script: line 2: 2870204 Aborted /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/bin/clang -cc1 -internal-isystem /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm_build_hwasan/lib/clang/21/include -nostdsysteminc -analyze -analyzer-constraints=range -setup-static-analyzer -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false /home/b/sanitizer-aarch64-linux-bootstrap-hwasan/build/llvm-project/clang/test/Analysis/loop-widening.c ```
1 parent 0670675 commit 6171e4b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+407
-496
lines changed

clang/include/clang/Analysis/CFG.h

+1-9
Original file line numberDiff line numberDiff line change
@@ -122,8 +122,7 @@ class CFGElement {
122122
return (Kind) x;
123123
}
124124

125-
void dumpToStream(llvm::raw_ostream &OS,
126-
bool TerminateWithNewLine = true) const;
125+
void dumpToStream(llvm::raw_ostream &OS) const;
127126

128127
void dump() const {
129128
dumpToStream(llvm::errs());
@@ -696,11 +695,6 @@ class CFGBlock {
696695
void dump() const {
697696
dumpToStream(llvm::errs());
698697
}
699-
700-
void Profile(llvm::FoldingSetNodeID &ID) const {
701-
ID.AddPointer(Parent);
702-
ID.AddInteger(Index);
703-
}
704698
};
705699

706700
template <bool IsReverse, bool IsConst> class ElementRefIterator {
@@ -1196,8 +1190,6 @@ class CFGBlock {
11961190
}
11971191
};
11981192

1199-
using ConstCFGElementRef = CFGBlock::ConstCFGElementRef;
1200-
12011193
/// CFGCallback defines methods that should be called when a logical
12021194
/// operator error is found when building the CFG.
12031195
class CFGCallback {

clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h

+1-10
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
#include "clang/AST/DeclCXX.h"
2020
#include "clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h"
2121
#include "llvm/ADT/StringExtras.h"
22-
#include "llvm/Support/raw_ostream.h"
2322

2423
namespace clang {
2524

@@ -30,13 +29,6 @@ class SValExplainer : public FullSValVisitor<SValExplainer, std::string> {
3029
ASTContext &ACtx;
3130
ProgramStateRef State;
3231

33-
std::string printCFGElementRef(ConstCFGElementRef Elem) {
34-
std::string Str;
35-
llvm::raw_string_ostream OS(Str);
36-
Elem->dumpToStream(OS, /*TerminateWithNewLine=*/false);
37-
return Str;
38-
}
39-
4032
std::string printStmt(const Stmt *S) {
4133
std::string Str;
4234
llvm::raw_string_ostream OS(Str);
@@ -122,8 +114,7 @@ class SValExplainer : public FullSValVisitor<SValExplainer, std::string> {
122114

123115
std::string VisitSymbolConjured(const SymbolConjured *S) {
124116
return "symbol of type '" + S->getType().getAsString() +
125-
"' conjured at CFG element '" +
126-
printCFGElementRef(S->getCFGElementRef()) + "'";
117+
"' conjured at statement '" + printStmt(S->getStmt()) + "'";
127118
}
128119

129120
std::string VisitSymbolDerived(const SymbolDerived *S) {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h

-2
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,6 @@ class CheckerContext {
151151
return Pred->getSVal(S);
152152
}
153153

154-
ConstCFGElementRef getCFGElementRef() const { return Eng.getCFGElementRef(); }
155-
156154
/// Returns true if the value of \p E is greater than or equal to \p
157155
/// Val under unsigned comparison.
158156
bool isGreaterOrEqual(const Expr *E, unsigned long long Val);

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ class ExprEngine {
226226
return (*G.roots_begin())->getLocation().getLocationContext();
227227
}
228228

229-
ConstCFGElementRef getCFGElementRef() const {
229+
CFGBlock::ConstCFGElementRef getCFGElementRef() const {
230230
const CFGBlock *blockPtr = currBldrCtx ? currBldrCtx->getBlock() : nullptr;
231231
return {blockPtr, currStmtIdx};
232232
}

clang/include/clang/StaticAnalyzer/Core/PathSensitive/LoopWidening.h

+1-2
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,7 @@ namespace ento {
2727
/// by the loop body in any iteration.
2828
ProgramStateRef getWidenedLoopState(ProgramStateRef PrevState,
2929
const LocationContext *LCtx,
30-
unsigned BlockCount,
31-
ConstCFGElementRef Elem);
30+
unsigned BlockCount, const Stmt *LoopStmt);
3231

3332
} // end namespace ento
3433
} // end namespace clang

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

+7-8
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,7 @@ class ProgramState : public llvm::FoldingSetNode {
313313
/// be triggered by this event.
314314
///
315315
/// \param Regions the set of regions to be invalidated.
316-
/// \param Elem The CFG Element that caused the invalidation.
316+
/// \param E the expression that caused the invalidation.
317317
/// \param BlockCount The number of times the current basic block has been
318318
/// visited.
319319
/// \param CausesPointerEscape the flag is set to true when the invalidation
@@ -325,17 +325,16 @@ class ProgramState : public llvm::FoldingSetNode {
325325
/// \param ITraits information about special handling for particular regions
326326
/// or symbols.
327327
[[nodiscard]] ProgramStateRef
328-
invalidateRegions(ArrayRef<const MemRegion *> Regions,
329-
ConstCFGElementRef Elem, unsigned BlockCount,
330-
const LocationContext *LCtx, bool CausesPointerEscape,
331-
InvalidatedSymbols *IS = nullptr,
328+
invalidateRegions(ArrayRef<const MemRegion *> Regions, const Stmt *S,
329+
unsigned BlockCount, const LocationContext *LCtx,
330+
bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
332331
const CallEvent *Call = nullptr,
333332
RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
334333

335334
[[nodiscard]] ProgramStateRef
336-
invalidateRegions(ArrayRef<SVal> Values, ConstCFGElementRef Elem,
337-
unsigned BlockCount, const LocationContext *LCtx,
338-
bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
335+
invalidateRegions(ArrayRef<SVal> Values, const Stmt *S, unsigned BlockCount,
336+
const LocationContext *LCtx, bool CausesPointerEscape,
337+
InvalidatedSymbols *IS = nullptr,
339338
const CallEvent *Call = nullptr,
340339
RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
341340

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

+27-10
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
#include "clang/AST/Expr.h"
2020
#include "clang/AST/ExprObjC.h"
2121
#include "clang/AST/Type.h"
22-
#include "clang/Analysis/CFG.h"
2322
#include "clang/Basic/LLVM.h"
2423
#include "clang/Basic/LangOptions.h"
2524
#include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h"
@@ -172,11 +171,19 @@ class SValBuilder {
172171

173172
// Forwarding methods to SymbolManager.
174173

175-
const SymbolConjured *conjureSymbol(ConstCFGElementRef Elem,
174+
const SymbolConjured* conjureSymbol(const Stmt *stmt,
176175
const LocationContext *LCtx,
177-
QualType type, unsigned visitCount,
176+
QualType type,
177+
unsigned visitCount,
178178
const void *symbolTag = nullptr) {
179-
return SymMgr.conjureSymbol(Elem, LCtx, type, visitCount, symbolTag);
179+
return SymMgr.conjureSymbol(stmt, LCtx, type, visitCount, symbolTag);
180+
}
181+
182+
const SymbolConjured* conjureSymbol(const Expr *expr,
183+
const LocationContext *LCtx,
184+
unsigned visitCount,
185+
const void *symbolTag = nullptr) {
186+
return SymMgr.conjureSymbol(expr, LCtx, visitCount, symbolTag);
180187
}
181188

182189
/// Construct an SVal representing '0' for the specified type.
@@ -192,19 +199,29 @@ class SValBuilder {
192199
/// preserve the relation between related(or even equivalent) expressions, so
193200
/// conjured symbols should be used sparingly.
194201
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
195-
ConstCFGElementRef elem,
202+
const Expr *expr,
196203
const LocationContext *LCtx,
197204
unsigned count);
198-
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
199-
ConstCFGElementRef elem,
205+
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Stmt *S,
200206
const LocationContext *LCtx,
201207
QualType type, unsigned count);
202-
DefinedOrUnknownSVal conjureSymbolVal(ConstCFGElementRef elem,
208+
DefinedOrUnknownSVal conjureSymbolVal(const Stmt *stmt,
203209
const LocationContext *LCtx,
204-
QualType type, unsigned visitCount);
210+
QualType type,
211+
unsigned visitCount);
205212

206213
/// Conjure a symbol representing heap allocated memory region.
207-
DefinedSVal getConjuredHeapSymbolVal(ConstCFGElementRef elem,
214+
///
215+
/// Note, the expression should represent a location.
216+
DefinedSVal getConjuredHeapSymbolVal(const Expr *E,
217+
const LocationContext *LCtx,
218+
unsigned Count);
219+
220+
/// Conjure a symbol representing heap allocated memory region.
221+
///
222+
/// Note, now, the expression *doesn't* need to represent a location.
223+
/// But the type need to!
224+
DefinedSVal getConjuredHeapSymbolVal(const Expr *E,
208225
const LocationContext *LCtx,
209226
QualType type, unsigned Count);
210227

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h

+4-4
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@
1414
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_STORE_H
1515

1616
#include "clang/AST/Type.h"
17-
#include "clang/Basic/LLVM.h"
1817
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
1918
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
2019
#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
2120
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
2221
#include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
2322
#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
23+
#include "clang/Basic/LLVM.h"
2424
#include "llvm/ADT/ArrayRef.h"
2525
#include "llvm/ADT/DenseSet.h"
2626
#include "llvm/ADT/SmallVector.h"
@@ -223,7 +223,7 @@ class StoreManager {
223223
///
224224
/// \param[in] store The initial store.
225225
/// \param[in] Values The values to invalidate.
226-
/// \param[in] Elem The current CFG Element being evaluated. Used to conjure
226+
/// \param[in] S The current statement being evaluated. Used to conjure
227227
/// symbols to mark the values of invalidated regions.
228228
/// \param[in] Count The current block count. Used to conjure
229229
/// symbols to mark the values of invalidated regions.
@@ -241,8 +241,8 @@ class StoreManager {
241241
/// even if they do not currently have bindings. Pass \c NULL if this
242242
/// information will not be used.
243243
virtual StoreRef invalidateRegions(
244-
Store store, ArrayRef<SVal> Values, ConstCFGElementRef Elem,
245-
unsigned Count, const LocationContext *LCtx, const CallEvent *Call,
244+
Store store, ArrayRef<SVal> Values, const Stmt *S, unsigned Count,
245+
const LocationContext *LCtx, const CallEvent *Call,
246246
InvalidatedSymbols &IS, RegionAndSymbolInvalidationTraits &ITraits,
247247
InvalidatedRegions *TopLevelRegions, InvalidatedRegions *Invalidated) = 0;
248248

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

+22-49
Original file line numberDiff line numberDiff line change
@@ -80,62 +80,29 @@ class SymbolRegionValue : public SymbolData {
8080
/// A symbol representing the result of an expression in the case when we do
8181
/// not know anything about what the expression is.
8282
class SymbolConjured : public SymbolData {
83-
ConstCFGElementRef Elem;
83+
const Stmt *S;
8484
QualType T;
8585
unsigned Count;
8686
const LocationContext *LCtx;
8787
const void *SymbolTag;
8888

8989
friend class SymExprAllocator;
90-
SymbolConjured(SymbolID sym, ConstCFGElementRef elem,
91-
const LocationContext *lctx, QualType t, unsigned count,
92-
const void *symbolTag)
93-
: SymbolData(SymbolConjuredKind, sym), Elem(elem), T(t), Count(count),
90+
SymbolConjured(SymbolID sym, const Stmt *s, const LocationContext *lctx,
91+
QualType t, unsigned count, const void *symbolTag)
92+
: SymbolData(SymbolConjuredKind, sym), S(s), T(t), Count(count),
9493
LCtx(lctx), SymbolTag(symbolTag) {
94+
// FIXME: 's' might be a nullptr if we're conducting invalidation
95+
// that was caused by a destructor call on a temporary object,
96+
// which has no statement associated with it.
97+
// Due to this, we might be creating the same invalidation symbol for
98+
// two different invalidation passes (for two different temporaries).
9599
assert(lctx);
96100
assert(isValidTypeForSymbol(t));
97101
}
98102

99103
public:
100-
ConstCFGElementRef getCFGElementRef() const { return Elem; }
101-
102-
// It might return null.
103-
const Stmt *getStmt() const {
104-
switch (Elem->getKind()) {
105-
case CFGElement::Initializer:
106-
return Elem->castAs<CFGInitializer>().getInitializer()->getInit();
107-
case CFGElement::ScopeBegin:
108-
return Elem->castAs<CFGScopeBegin>().getTriggerStmt();
109-
case CFGElement::ScopeEnd:
110-
return Elem->castAs<CFGScopeEnd>().getTriggerStmt();
111-
case CFGElement::NewAllocator:
112-
return Elem->castAs<CFGNewAllocator>().getAllocatorExpr();
113-
case CFGElement::LifetimeEnds:
114-
return Elem->castAs<CFGLifetimeEnds>().getTriggerStmt();
115-
case CFGElement::LoopExit:
116-
return Elem->castAs<CFGLoopExit>().getLoopStmt();
117-
case CFGElement::Statement:
118-
return Elem->castAs<CFGStmt>().getStmt();
119-
case CFGElement::Constructor:
120-
return Elem->castAs<CFGConstructor>().getStmt();
121-
case CFGElement::CXXRecordTypedCall:
122-
return Elem->castAs<CFGCXXRecordTypedCall>().getStmt();
123-
case CFGElement::AutomaticObjectDtor:
124-
return Elem->castAs<CFGAutomaticObjDtor>().getTriggerStmt();
125-
case CFGElement::DeleteDtor:
126-
return Elem->castAs<CFGDeleteDtor>().getDeleteExpr();
127-
case CFGElement::BaseDtor:
128-
return nullptr;
129-
case CFGElement::MemberDtor:
130-
return nullptr;
131-
case CFGElement::TemporaryDtor:
132-
return Elem->castAs<CFGTemporaryDtor>().getBindTemporaryExpr();
133-
case CFGElement::CleanupFunction:
134-
return nullptr;
135-
}
136-
return nullptr;
137-
}
138-
104+
/// It might return null.
105+
const Stmt *getStmt() const { return S; }
139106
unsigned getCount() const { return Count; }
140107
/// It might return null.
141108
const void *getTag() const { return SymbolTag; }
@@ -146,19 +113,19 @@ class SymbolConjured : public SymbolData {
146113

147114
void dumpToStream(raw_ostream &os) const override;
148115

149-
static void Profile(llvm::FoldingSetNodeID &profile, ConstCFGElementRef Elem,
116+
static void Profile(llvm::FoldingSetNodeID &profile, const Stmt *S,
150117
const LocationContext *LCtx, QualType T, unsigned Count,
151118
const void *SymbolTag) {
152119
profile.AddInteger((unsigned)SymbolConjuredKind);
153-
profile.Add(Elem);
120+
profile.AddPointer(S);
154121
profile.AddPointer(LCtx);
155122
profile.Add(T);
156123
profile.AddInteger(Count);
157124
profile.AddPointer(SymbolTag);
158125
}
159126

160127
void Profile(llvm::FoldingSetNodeID& profile) override {
161-
Profile(profile, Elem, LCtx, T, Count, SymbolTag);
128+
Profile(profile, S, LCtx, T, Count, SymbolTag);
162129
}
163130

164131
// Implement isa<T> support.
@@ -566,12 +533,18 @@ class SymbolManager {
566533
template <typename SymExprT, typename... Args>
567534
const SymExprT *acquire(Args &&...args);
568535

569-
const SymbolConjured *conjureSymbol(ConstCFGElementRef Elem,
536+
const SymbolConjured *conjureSymbol(const Stmt *E,
570537
const LocationContext *LCtx, QualType T,
571538
unsigned VisitCount,
572539
const void *SymbolTag = nullptr) {
540+
return acquire<SymbolConjured>(E, LCtx, T, VisitCount, SymbolTag);
541+
}
573542

574-
return acquire<SymbolConjured>(Elem, LCtx, T, VisitCount, SymbolTag);
543+
const SymbolConjured* conjureSymbol(const Expr *E,
544+
const LocationContext *LCtx,
545+
unsigned VisitCount,
546+
const void *SymbolTag = nullptr) {
547+
return conjureSymbol(E, LCtx, E->getType(), VisitCount, SymbolTag);
575548
}
576549

577550
QualType getType(const SymExpr *SE) const {

0 commit comments

Comments
 (0)