Skip to content

Commit 985e399

Browse files
committed
[analyzer] Fix assertion on casting SVal to NonLoc inside the IteratorRange checker
The checker assumed that it could safely cast an SVal to Nonloc. This surfaced because, with std::ranges, we can unintentionally match on other APIs as well, thus increasing the likelihood of violating checker assumptions about the context it's invoked. https://godbolt.org/z/13vEb3K76 See the discourse post on CallDescriptions and std::ranges here. https://discourse.llvm.org/t/calldescriptions-should-not-skip-the-ranges-part-in-std-names-when-matching/73076 Fixes #65009 Differential Revision: https://reviews.llvm.org/D158968
1 parent b91b4ec commit 985e399

File tree

2 files changed

+12
-1
lines changed

2 files changed

+12
-1
lines changed

clang/lib/StaticAnalyzer/Checkers/IteratorRangeChecker.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ void IteratorRangeChecker::verifyRandomIncrOrDecr(CheckerContext &C,
228228
Value = State->getRawSVal(*ValAsLoc);
229229
}
230230

231-
if (Value.isUnknownOrUndef())
231+
if (Value.isUnknownOrUndef() || !isa<NonLoc>(Value))
232232
return;
233233

234234
// Incremention or decremention by 0 is never a bug.

clang/test/Analysis/iterator-range.cpp

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -946,3 +946,14 @@ int uninit_var(int n) {
946946
// expected-warning@-1 {{The right operand of '-' is a garbage value}}
947947
// expected-note@-2 {{The right operand of '-' is a garbage value}}
948948
}
949+
950+
namespace std {
951+
namespace ranges {
952+
template <class InOutIter, class Sentinel>
953+
InOutIter next(InOutIter, Sentinel);
954+
} // namespace ranges
955+
} // namespace std
956+
957+
void gh65009__no_crash_on_ranges_next(int **begin, int **end) {
958+
(void)std::ranges::next(begin, end); // no-crash
959+
}

0 commit comments

Comments
 (0)