crash in MallocChecker

[dkrupp]

Summary

Abramo Begnara reported a crash in MallocChecker.cpp
https://www.mail-archive.com/[e-mail]/msg43052.html

For expressions like:
void f(int a, int b)
{

new char[a * b];

}
or
new unsigned[m + n + 1];

This patch includes the fix and the test case.

cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

ProgramStateRef MallocChecker::addExtentSize(CheckerContext &C,
   }
   assert(Region);
 
   // Set the region's extent equal to the Size in Bytes.
   QualType ElementType = NE->getAllocatedType();
   ASTContext &AstContext = C.getASTContext();
   CharUnits TypeSize = AstContext.getTypeSizeInChars(ElementType);
 
-  if (Optional<DefinedOrUnknownSVal> DefinedSize =
-          ElementCount.getAs<DefinedOrUnknownSVal>()) {
+  if (ElementCount.getAs<NonLoc>()) {
     DefinedOrUnknownSVal Extent = Region->getExtent(svalBuilder);
     // size in Bytes = ElementCount*TypeSize
     SVal SizeInBytes = svalBuilder.evalBinOpNN(
         State, BO_Mul, ElementCount.castAs<NonLoc>(),
         svalBuilder.makeArrayIndex(TypeSize.getQuantity()),
         svalBuilder.getArrayIndexType());
     DefinedOrUnknownSVal extentMatchesSize = svalBuilder.evalEQ(
         State, Extent, SizeInBytes.castAs<DefinedOrUnknownSVal>());

cfe/trunk/test/Analysis/out-of-bounds-new.cpp

 }
 
 //Tests over-indexing
 //if the allocated area size is a runtime parameter
 void test_dynamic_size(int s) {
   int *buf = new int[s];
   buf[0] = 1; // no-warning
 }
+//Tests complex arithmetic
+//in new expression
+void test_dynamic_size2(unsigned m,unsigned n){
+  unsigned *U = nullptr;
+  U = new unsigned[m + n + 1];
+}