Skip to content

Commit

Permalink
[analyzer] Fix crash analyzing _BitInt() in evalIntegralCast (#66782)
Browse files Browse the repository at this point in the history
evalIntegralCast was using makeIntVal, and when _BitInt() types were
introduced this exposed a crash in evalIntegralCast as a result.

This is a reapply of a previous patch that failed post merge on the arm
buildbots, because arm cannot handle large
BitInts. Pinning the triple for the testcase solves that problem. 

Improve evalIntegralCast to use makeIntVal more efficiently to avoid the
crash exposed by use of _BitInt.

This was caught with our internal randomized testing.

<src-root>/llvm/include/llvm/ADT/APInt.h:1510:
  int64_t llvm::APInt::getSExtValue() const: Assertion
  `getSignificantBits() <= 64 && "Too many bits for int64_t"' failed.a

...
 #9 <address> llvm::APInt::getSExtValue() const
  <src-root>/llvm/include/llvm/ADT/APInt.h:1510:5
  llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>,
  clang::ento::SVal, clang::QualType, clang::QualType)
  <src-root>/clang/lib/StaticAnalyzer/Core/SValBuilder.cpp:607:24
clang::Expr const*, clang::ento::ExplodedNode*,
clang::ento::ExplodedNodeSet&)
  <src-root>/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp:413:61
...

 Fixes: #61960

 Reviewed By: donat.nagy
  • Loading branch information
vabridgers committed Sep 20, 2023
1 parent 522c1d0 commit da26500
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 5 deletions.
8 changes: 3 additions & 5 deletions clang/lib/StaticAnalyzer/Core/SValBuilder.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -598,11 +598,9 @@ SVal SValBuilder::evalIntegralCast(ProgramStateRef state, SVal val,
APSIntType ToType(getContext().getTypeSize(castTy),
castTy->isUnsignedIntegerType());
llvm::APSInt ToTypeMax = ToType.getMaxValue();
NonLoc ToTypeMaxVal =
makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
: ToTypeMax.getSExtValue(),
castTy)
.castAs<NonLoc>();

NonLoc ToTypeMaxVal = makeIntVal(ToTypeMax);

// Check the range of the symbol being casted against the maximum value of the
// target type.
NonLoc FromVal = val.castAs<NonLoc>();
Expand Down
13 changes: 13 additions & 0 deletions clang/test/Analysis/bitint-no-crash.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
// RUN: %clang_analyze_cc1 -analyzer-checker=core \
// RUN: -analyzer-checker=debug.ExprInspection \
// RUN: -triple x86_64-pc-linux-gnu \
// RUN: -verify %s

// Don't crash when using _BitInt(). Pin to the x86_64 triple for now,
// since not all architectures support _BitInt()
// expected-no-diagnostics
_BitInt(256) a;
_BitInt(129) b;
void c() {
b = a;
}

0 comments on commit da26500

Please sign in to comment.