Assertion failed: (V.isUnknown()), function ProcessIndirectGoto, file GRExprEngine.cpp, line 767

[llvmbot]

Bugzilla Link	4033
Resolution	FIXED
Resolved on	Feb 22, 2010 12:51
Version	unspecified
OS	MacOS X
Attachments	Preprocessed file
Reporter	LLVM Bugzilla Contributor
CC	@tkremenek,@xuzhongxing

Extended Description

Using the current trunk of unladen-swallow (r499 from http://unladen-swallow.googlecode.com/svn/trunk) the analyzer will fail with an assertion failure on Python/ceval.c:

ANALYZE: Python/ceval.c PyEval_GetCallStats
ANALYZE: Python/ceval.c PyEval_ThreadsInitialized
ANALYZE: Python/ceval.c PyEval_InitThreads
ANALYZE: Python/ceval.c PyEval_AcquireLock
ANALYZE: Python/ceval.c PyEval_ReleaseLock
ANALYZE: Python/ceval.c PyEval_AcquireThread
ANALYZE: Python/ceval.c PyEval_ReleaseThread
ANALYZE: Python/ceval.c PyEval_ReInitThreads
ANALYZE: Python/ceval.c PyEval_SaveThread
ANALYZE: Python/ceval.c PyEval_RestoreThread
ANALYZE: Python/ceval.c Py_AddPendingCall
ANALYZE: Python/ceval.c Py_MakePendingCalls
ANALYZE: Python/ceval.c Py_GetRecursionLimit
ANALYZE: Python/ceval.c Py_SetRecursionLimit
ANALYZE: Python/ceval.c _Py_CheckRecursiveCall
ANALYZE: Python/ceval.c printarg_Cell
ANALYZE: Python/ceval.c printarg_i
ANALYZE: Python/ceval.c printarg_a
ANALYZE: Python/ceval.c PyEval_EvalCode
ANALYZE: Python/ceval.c PyEval_EvalFrame
ANALYZE: Python/ceval.c PyEval_EvalFrameEx
Assertion failed: (V.isUnknown()), function ProcessIndirectGoto, file GRExprEngine.cpp, line 767.
0 clang-cc 0x00c36ae8 _mh_execute_header + 12802792
1 clang-cc 0x00c37279 _mh_execute_header + 12804729
2 libSystem.B.dylib 0x924532bb _sigtramp + 43
3 libSystem.B.dylib 0xffffffff _sigtramp + 1840958831
4 libSystem.B.dylib 0x924c723a raise + 26
5 libSystem.B.dylib 0x924d3679 abort + 73
6 libSystem.B.dylib 0x924c83db __assert_rtn + 101
7 clang-cc 0x0016eac9 _mh_execute_header + 1497801
8 clang-cc 0x001884b1 _mh_execute_header + 1602737
9 clang-cc 0x0016d3c9 _mh_execute_header + 1491913
10 clang-cc 0x0016d6f5 _mh_execute_header + 1492725
11 clang-cc 0x0016da3c _mh_execute_header + 1493564
12 clang-cc 0x0000e844 _mh_execute_header + 55364
13 clang-cc 0x0000cbfa _mh_execute_header + 48122
14 clang-cc 0x0000e248 _mh_execute_header + 53832
15 clang-cc 0x001d636b _mh_execute_header + 1921899
16 clang-cc 0x0005df3b _mh_execute_header + 380731
17 clang-cc 0x000615d5 _mh_execute_header + 394709
18 clang-cc 0x00001b36 _mh_execute_header + 2870
19 clang-cc 0x00000018 _mh_execute_header + 18446744073709547544
Stack dump:
0. Program arguments: /Users/chris/Development/checker-0.187/libexec/clang-cc -DIBOutlet=attribute((iboutlet)) -x c -analyzer-store=basic -analyzer-constraints=range -analyzer-output=html -DNDEBUG -I. -IInclude -I. -I./Include -DPy_BUILD_CORE Python/ceval.c -analyze -analyzer-display-progress -disable-free -analyzer-eagerly-assume -warn-objc-unused-ivars -warn-objc-methodsigs -checker-cfref -warn-dead-stores -o /var/folders/8V/8VV6lq5WFuqxNTncCxLgm++++TI/-Tmp-/scan-build-2009-04-22-2

1. Python/ceval.c:1204:1: current parser token 'PyObject'

[llvmbot]

assigned to @tkremenek

[tkremenek]

Reduced test case:

typedef void *Opcode;
Opcode pr_4033_getOpcode();
void pr_4033(void) {
next_opcode:
{
Opcode op = pr_4033_getOpcode();
if (op) goto *op;
}
}

[tkremenek]

The problem (in the reduced test case) is that 'op' has a symbolic pointer value, represented by loc::MemRegionVal(SymRegion). ProcessIndirectGoto doesn't know how to handle this.

For now, I will change the assertion to treat symbolic pointer values as UnknownVal. This will remove the crash:

http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20090420/016144.html

This fix will go into checker-0.188.

The "complete" solution is to:

1. Change loc::GotoLabel to be modeled using regions (just like we did with loc::FuncVal).
2. Allow symbolic regions to alias real regions. That is, model a possible alias set for symbolic regions.
3. Dispatch in the computed goto to all possible labels based on the alias set.