[analyzer] Added a test case for PR46264

[ASDenysPetrov]

Summary

It's not able to reproduce the issue (https://bugs.llvm.org/show_bug.cgi?id=46264) for the latest sources. Add a reported test case to try to catch the problem if occures.

Prevent: https://bugs.llvm.org/show_bug.cgi?id=46264

[NoQ]

Thanks!

I guess there might be some value in building an older Clang from around when the bug was reported so that to see if the crash was indeed there and we're not just reproducing it wrong. It would also allow us to understand where we fixed it through bisecting. But I don't insist.

clang/test/Analysis/diagnostics/PR46264.cpp

5

I think you mean this case shall not crash with an assertion failure.

"Warn" exclusively means "display a warning to the user".

[ASDenysPetrov]

@NoQ:

I guess there might be some value in building an older Clang from around when the bug was reported so that to see if the crash was indeed there and we're not just reproducing it wrong. It would also allow us to understand where we fixed it through bisecting. But I don't insist.

Bisecting through a year+ of commits is painful. I thought about this but didn't dare. What I can do is to check the failure on a issue-date commit.

clang/test/Analysis/diagnostics/PR46264.cpp

5

I'll make changes.

[ASDenysPetrov]

Updated due to comments.
Confirm crash on commit 3ed8ebc2f6b8172bed48cc5986d3b7af4cfca1bc from 24.05.2020.
Assertion failed: !T->isVoidType() && "Attempting to dereference a void pointer!", file D:/WORK/LLVM/llvm-project/clang/lib/StaticAnalyzer/Core/RegionStore.cpp, line 1439
@NoQ ?

[NoQ]

Cool, thanks!

clang/test/Analysis/diagnostics/PR46264.cpp

7–8

I'm pretty sure the namespaces can be dropped.

[NoQ]

I bisected. This bug was fixed intentionally by D85817, forgot to close I guess.

[ASDenysPetrov]

In D104381#2838902, @NoQ wrote:

I bisected. This bug was fixed intentionally by D85817, forgot to close I guess.

Wow! Nice! It seems that we've duplicated the test file. I think we should revert this patch then. WDYT?

[ASDenysPetrov]

@NoQ Just a ping

clang/test/Analysis/diagnostics/PR46264.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-output=text -verify %s
+
+// PR46264
+// This case shall not crash with an assertion failure about void* dereferening.
+// The crash has been last seen on commit
+// `3ed8ebc2f6b8172bed48cc5986d3b7af4cfca1bc` from 24.05.2020.
+namespace ns1 {
+namespace a {
+class b {
+public:
+  typedef int b::*c;
+  operator c() { return d ? &b::d : 0; }
+  // expected-note@-1{{'?' condition is true}}
+  // expected-note@-2{{Assuming field 'd' is not equal to 0}}
+  // expected-note@-3{{Returning value, which participates in a condition later}}
+  int d;
+};
+} // namespace a
+using a::b;
+class e {
+  void f();
+  void g();
+  b h;
+};
+void e::f() {
+  e *i;
+  // expected-note@-1{{'i' declared without an initial value}}
+  if (h)
+    // expected-note@-1{{Taking true branch}}
+    // expected-note@-2{{'b::operator int ns1::a::b::*'}}
+    // expected-note@-3{{Returning from 'b::operator int ns1::a::b::*'}}
+    i->g();
+  // expected-note@-1{{Called C++ object pointer is uninitialized}}
+  // expected-warning@-2{{Called C++ object pointer is uninitialized}}
+}
+} // namespace ns1