$ cat /tmp/getElementRegion-crash.cc struct { int *n; bool f(unsigned &p1) { p1 = (long)n - 1; } } b; unsigned a; int c; void g() { b.f(a) && a == c; } $ clang_tidy -checks=-*,clang-analyzer-* /tmp/getElementRegion-crash.cc -- -std=c++11 assert.h assertion failed at llvm/tools/clang/include/clang/AST/Type.h:628 in const clang::ExtQualsTypeCommonBase *clang::QualType::getCommonPtr() const: !isNull() && "Cannot retrieve a NULL type pointer" @ 0x53f0f5a __assert_fail @ 0x5e9065 clang::QualType::getCommonPtr() @ 0x5ddbe9 clang::QualType::getCanonicalType() @ 0x1b4f5cc clang::ASTContext::getCanonicalType() @ 0x2c50612 clang::ento::MemRegionManager::getElementRegion() @ 0x2d07f58 (anonymous namespace)::SimpleSValBuilder::evalBinOpLN() @ 0x2bbbace clang::ento::SValBuilder::evalBinOp() @ 0x2d09ab4 (anonymous namespace)::SimpleSValBuilder::simplifySVal()::Simplifier::VisitSymIntExpr() @ 0x2d09692 clang::ento::SymExprVisitor<>::Visit() @ 0x2d093ea (anonymous namespace)::SimpleSValBuilder::simplifySVal()::Simplifier::VisitNonLocSymbolVal() @ 0x2d08f6b clang::ento::SValVisitor<>::Visit() @ 0x2d0822f (anonymous namespace)::SimpleSValBuilder::simplifySVal() @ 0x2d056cc (anonymous namespace)::SimpleSValBuilder::evalBinOpNN() @ 0x2bbbd92 clang::ento::SValBuilder::evalBinOp() @ 0x2cab136 clang::ento::ExprEngine::evalBinOp() @ 0x2cd8320 clang::ento::ExprEngine::VisitBinaryOperator() @ 0x2ca0a91 clang::ento::ExprEngine::Visit() @ 0x2c9dea4 clang::ento::ExprEngine::ProcessStmt() @ 0x2c9db6a clang::ento::ExprEngine::processCFGElement() @ 0x2ccb526 clang::ento::CoreEngine::HandlePostStmt() @ 0x2ccae23 clang::ento::CoreEngine::dispatchWorkItem() @ 0x2cca9b8 clang::ento::CoreEngine::ExecuteWorkList() @ 0x21227d5 clang::ento::ExprEngine::ExecuteWorkList() @ 0x20cb182 (anonymous namespace)::AnalysisConsumer::ActionExprEngine() @ 0x20caf41 (anonymous namespace)::AnalysisConsumer::RunPathSensitiveChecks() @ 0x20cac05 (anonymous namespace)::AnalysisConsumer::HandleCode() @ 0x20be323 (anonymous namespace)::AnalysisConsumer::HandleDeclsCallGraph() @ 0x20bc5a7 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit() @ 0x29d335e clang::MultiplexConsumer::HandleTranslationUnit()
This started happening after r310887.
Tracking this internally as rdar://problem/34062527
a bit smaller reduced test case: m.cpp: bool f(long x, char *p) { long y = (long)p - 1; return y == x; } clang --analyze -c m.cpp i have an idea what's going on there, but need a bit more time to double check
if i am not mistaken we hit the following FIXME (in ./lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp at the line 368) 359 case nonloc::LocAsIntegerKind: { 360 Loc lhsL = lhs.castAs<nonloc::LocAsInteger>().getLoc(); 361 switch (rhs.getSubKind()) { 362 case nonloc::LocAsIntegerKind: 363 return evalBinOpLL(state, op, lhsL, 364 rhs.castAs<nonloc::LocAsInteger>().getLoc(), 365 resultTy); 366 case nonloc::ConcreteIntKind: { 367 // Transform the integer into a location and compare. 368 // FIXME: This only makes sense for comparisons. If we want to, say, 369 // add 1 to a LocAsInteger, we'd better unpack the Loc and add to it, 370 // then pack it back into a LocAsInteger. 371 llvm::APSInt i = rhs.castAs<nonloc::ConcreteInt>().getValue(); 372 BasicVals.getAPSIntType(Context.VoidPtrTy).apply(i); 373 return evalBinOpLL(state, op, lhsL, makeLoc(i), resultTy); 374 }
Resolved by https://reviews.llvm.org/rL311935 and https://reviews.llvm.org/rL311947 .
Thank you! It looks like the fix has introduced another failure though (or didn't fix all cases, since the stack trace looks suspiciously similar). I'm currently reducing the test case and will file a separate issue.
I've reopened this bug. I guess my old change (where i was fixing a separate issue) has uncovered several new code paths in the static analyzer that's why we see these new crashes.
oh, i see, i didn't read your comment, yeah, many thanks for building reduced test cases, then let's file a separate bug report for that.
The other bug is filed as http://llvm.org/PR34374. Could you also take a look at http://llvm.org/PR34373 ?