Fixed a horribly insidious bit-masking bug in the implementation of
ExplodedNode that would occasionally result in heap corruption.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47956 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/Analysis/ExplodedGraph.cpp b/Analysis/ExplodedGraph.cpp
index 69d190d..274565b 100644
--- a/Analysis/ExplodedGraph.cpp
+++ b/Analysis/ExplodedGraph.cpp
@@ -23,18 +23,28 @@
}
void ExplodedNodeImpl::NodeGroup::addNode(ExplodedNodeImpl* N) {
+
+ assert ((reinterpret_cast<uintptr_t>(N) & Mask) == 0x0);
+
if (getKind() == Size1) {
if (ExplodedNodeImpl* NOld = getNode()) {
std::vector<ExplodedNodeImpl*>* V = new std::vector<ExplodedNodeImpl*>();
+ assert ((reinterpret_cast<uintptr_t>(V) & Mask) == 0x0);
V->push_back(NOld);
V->push_back(N);
P = reinterpret_cast<uintptr_t>(V) | SizeOther;
+ assert (getPtr() == (void*) V);
+ assert (getKind() == SizeOther);
}
- else
+ else {
P = reinterpret_cast<uintptr_t>(N);
+ assert (getKind() == Size1);
+ }
}
- else
+ else {
+ assert (getKind() == SizeOther);
getVector(getPtr()).push_back(N);
+ }
}
bool ExplodedNodeImpl::NodeGroup::empty() const {
@@ -62,7 +72,7 @@
if (getKind() == Size1)
return (ExplodedNodeImpl**) (P ? &P+1 : &P);
else
- return const_cast<ExplodedNodeImpl**>(&*(getVector(getPtr()).rbegin())+1);
+ return const_cast<ExplodedNodeImpl**>(&*(getVector(getPtr()).end()));
}
ExplodedNodeImpl::NodeGroup::~NodeGroup() {