Add corner case logic to BasicStoreManager and GRSimpleVals::EvalBinOp to enable
reasoning about OSCompareAndSwap32Barrier/OSCompareAndSwap64Barrier. Essentially
the address of reference to a region (pointer-to-pointer) can be casted to
(int32_t*), and we need to handle the logic to convert the involved locations
back and forth from nonloc::LocAsInteger, nonloc::ConcreteInt, to Loc and
loc::ConcreteInt respectively. This adds some potentially suspect logic to
BasicStoreManager that allows the analyzer to reason about abuses of the C type
system. This should probably be refined, be ported over to RegionStoreManager,
and extended with "path-sensitive type checking" to flag bugs in clearly
incoherent code.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70382 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Analysis/BasicStore.cpp b/lib/Analysis/BasicStore.cpp
index 616c4b5..c9bf9ea 100644
--- a/lib/Analysis/BasicStore.cpp
+++ b/lib/Analysis/BasicStore.cpp
@@ -251,7 +251,7 @@
return UnknownVal();
}
-static bool isHigherOrderVoidPtr(QualType T, ASTContext &C) {
+static bool isHigherOrderRawPtr(QualType T, ASTContext &C) {
bool foundPointer = false;
while (1) {
const PointerType *PT = T->getAsPointerType();
@@ -259,6 +259,10 @@
if (!foundPointer)
return false;
+ // intptr_t* or intptr_t**, etc?
+ if (T->isIntegerType() && C.getTypeSize(T) == C.getTypeSize(C.VoidPtrTy))
+ return true;
+
QualType X = C.getCanonicalType(T).getUnqualifiedType();
return X == C.VoidTy;
}
@@ -267,7 +271,7 @@
T = PT->getPointeeType();
}
}
-
+
SVal BasicStoreManager::Retrieve(const GRState* state, Loc loc, QualType T) {
if (isa<UnknownVal>(loc))
@@ -281,12 +285,12 @@
const MemRegion* R = cast<loc::MemRegionVal>(loc).getRegion();
if (const TypedViewRegion *TR = dyn_cast<TypedViewRegion>(R)) {
- // Just support void**, void***, etc., for now. This is needed
- // to handle OSCompareAndSwapPtr().
+ // Just support void**, void***, intptr_t*, intptr_t**, etc., for now.
+ // This is needed to handle OSCompareAndSwapPtr() and friends.
ASTContext &Ctx = StateMgr.getContext();
QualType T = TR->getLValueType(Ctx);
- if (!isHigherOrderVoidPtr(T, Ctx))
+ if (!isHigherOrderRawPtr(T, Ctx))
return UnknownVal();
// Otherwise, strip the views.
@@ -321,6 +325,33 @@
case loc::MemRegionKind: {
const MemRegion* R = cast<loc::MemRegionVal>(loc).getRegion();
+ // Special case: handle store of pointer values (Loc) to pointers via
+ // a cast to intXX_t*, void*, etc. This is needed to handle
+ // OSCompareAndSwap32Barrier/OSCompareAndSwap64Barrier.
+ if (isa<Loc>(V) || isa<nonloc::LocAsInteger>(V))
+ if (const TypedViewRegion *TR = dyn_cast<TypedViewRegion>(R)) {
+ ASTContext &C = StateMgr.getContext();
+ QualType T = TR->getLValueType(C);
+
+ if (isHigherOrderRawPtr(T, C)) {
+ R = TR->removeViews();
+
+ if (nonloc::LocAsInteger *X = dyn_cast<nonloc::LocAsInteger>(&V)) {
+ // Only convert 'V' to a location iff the underlying region type
+ // is a location as well.
+ // FIXME: We are allowing a store of an arbitrary location to
+ // a pointer. We may wish to flag a type error here if the types
+ // are incompatible. This may also cause lots of breakage
+ // elsewhere. Food for thought.
+ if (const TypedRegion *TyR = dyn_cast<TypedRegion>(R)) {
+ if (TyR->isBoundable(C) &&
+ Loc::IsLocType(TyR->getRValueType(C)))
+ V = X->getLoc();
+ }
+ }
+ }
+ }
+
if (!(isa<VarRegion>(R) || isa<ObjCIvarRegion>(R)))
return store;