This is an archive of the discontinued LLVM Phabricator instance.

[Static Analyzer] Relaxing a caching out related assert.
ClosedPublic

Authored by xazax.hun on Sep 11 2015, 1:51 PM.

Details

Summary

During the development of the nullability checkers I hit this assert several times. However it is very hard to reproduce it with a minimal example, and hard to come up with a test case. I could not identify any issue with the checkers themselves, and I think it is ok to cache out at this point of execution, when the node was created by a checker.

At some point with an older version of the nullability checkers I could came up with a minimal example (which no longer triggers the caching out issue with the nullability checker):

NSString *getString();
int getInt();

int main() {
    for(int i = 0; i < 2; ++i) {
        NSString *serviceID = getString();
     
        if (!getInt())
            [serviceID isEqualToString: @"literal"];
    }
    return 0;
}

Consider the following two paths:
a, First iteration -> take the branch, store information about the literal. Second iteration -> Take the branch.
b, First iteration -> do not take the branch. Second iteration -> take the branch, and store the same information about the literals that was stored in path a.

At the end of path b, according to the analyzer we see the same state that is at the end of path a. However the predecessor state differs.

Diff Detail

Event Timeline

xazax.hun updated this revision to Diff 34579.Sep 11 2015, 1:51 PM
xazax.hun retitled this revision from to [Static Analyzer] Relaxing a caching out related assert..
xazax.hun updated this object.
xazax.hun added a subscriber: cfe-commits.
xazax.hun updated this object.Sep 11 2015, 4:02 PM
xazax.hun updated this object.
xazax.hun updated this object.
zaks.anna accepted this revision.Sep 14 2015, 11:38 AM
zaks.anna edited edge metadata.
This revision is now accepted and ready to land.Sep 14 2015, 11:38 AM
This revision was automatically updated to reflect the committed changes.