Summary:
See https://bugs.llvm.org/show_bug.cgi?id=46128. The checker does not
yet comprehend constraints involving multiple symbols, so it's possible
to calculate a VLA size that's negative or 0. A LIT is added to catch
regressions, and this change simply bails if a VLA size of 0 or less is
calculated.
Reviewers: balazske, NoQ, martong, baloghadamsoftware, Szelethus, gamesh411
Reviewed By: balazske, NoQ, Szelethus
Subscribers: xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, Charusso, ASDenysPetrov, cfe-commits, dkrupp
Tags: #clang
Differential Revision: https://reviews.llvm.org/D80903
// Size overflow check does not work with symbolic expressions because a
// overflow situation can not be detected easily.
uint64_t IndexL = IndexLVal->getZExtValue();
- assert(IndexL > 0 && "Index length should have been checked for zero.");
+ // FIXME: See https://reviews.llvm.org/D80903 for discussion of
+ // some difference in assume and getKnownValue that leads to
+ // unexpected behavior. Just bail on IndexL == 0 at this point.
+ if (IndexL == 0)
+ return nullptr;
+
if (KnownSize <= SizeMax / IndexL) {
KnownSize *= IndexL;
} else {
clang_analyzer_eval(clang_analyzer_getExtent(&vla3m) == 2 * x * 4 * sizeof(int));
// expected-warning@-1{{TRUE}}
}
+
+// https://bugs.llvm.org/show_bug.cgi?id=46128
+// analyzer doesn't handle more than simple symbolic expressions.
+// Just don't crash.
+extern void foo(void);
+int a;
+void b() {
+ int c = a + 1;
+ for (;;) {
+ int d[c];
+ for (; 0 < c;)
+ foo();
+ }
+} // no-crash