llvm-project/clang/test/Analysis/solver-sym-simplification-no-crash.c
Gabor Marton 0646e36254 [Analyzer][solver] Fix crashes during symbol simplification
Consider the code
```
  void f(int a0, int b0, int c)
  {
      int a1 = a0 - b0;
      int b1 = (unsigned)a1 + c;
      if (c == 0) {
          int d = 7L / b1;
      }
  }
```
At the point of divisiion by `b1` that is considered to be non-zero,
which results in a new constraint for `$a0 - $b0 + $c`. The type
of this sym is unsigned, however, the simplified sym is `$a0 -
$b0` and its type is signed. This is probably the result of the
inherent improper handling of casts. Anyway, Range assignment
for constraints use this type information. Therefore, we must
make sure that first we simplify the symbol and only then we
assign the range.

Differential Revision: https://reviews.llvm.org/D104844
2021-06-25 11:49:26 +02:00

27 lines
455 B
C

// RUN: %clang_analyze_cc1 %s \
// RUN: -analyzer-checker=core \
// RUN: -analyzer-checker=debug.ExprInspection \
// RUN: -verify
// Here, we test that symbol simplification in the solver does not produce any
// crashes.
// expected-no-diagnostics
static int a, b;
static long c;
static void f(int i, int j)
{
(void)(j <= 0 && i ? i : j);
}
static void g(void)
{
int d = a - b | (c < 0);
for (;;)
{
f(d ^ c, c);
}
}