[analyzer] Fix Bug34144-[MallocChecker] MallocChecker::MallocUpdateRefState(): Assertion `Sym' failed.

[MTC]

Summary

Dear All,
I would like to propose a patch to fix the Bug34144[https://bugs.llvm.org/show_bug.cgi?id=34144].

Bug34144 mainly because MallocChecker assumes that the pointer returned by CXXNewExpr can't be null.
However, in some cases, c++ allocator may return a Null pointer, and when 'c++-allocator-inlining'
config option sets true, the CXXNewExpr may bind a Null Pointer. This will trigger an assertion failure
in MallocChecker::MallocUpdateRefState().
Given the below code sippet:

#include <new>
void *operator new(std::size_t, const std::nothrow_t&) noexcept
{
  return 0;
}
int main()
{
  int *i = new(std::nothrow) int(1);
  delete i;
  return 0;
}

Please let me know if this is an acceptable change.

Regards,
Henry Wong

[NoQ]

Totally makes sense, thanks!

I think the better place for the test would be NewDelete-custom.cpp, not sure it'd be easy to stick another operator new in there, could you have a look?

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1282

I think that within this branch we can/should assert that E is indeed a custom operator new call.

[MTC]

In D36708#841768, @NoQ wrote:

Totally makes sense, thanks!

I think the better place for the test would be NewDelete-custom.cpp, not sure it'd be easy to stick another operator new in there, could you have a look?

Hi NoQ,
Thank you for your reply, NewDelete-custom.cpp is really a better a choice. But I have encounter another assertion failure about inlining operater new[].

Code sippet from NewDelete-custom.cpp:

// clang --analyze -Xanalyzer -analyzer-checker=unix.Malloc -Xanalyzer -analyzer-config -Xanalyzer c++-allocator-inlining=true NewDelete-custom.cpp
void *allocator(size_t);
void *operator new[](size_t size) { return allocator(size); }
void testNewExprArray() {
  int *p = new int[0];
}

At the end of the operator new[] inline, analyzer will bind a conjured symbol to operator new[], that is, operator new[] will return a symbolic region.
When CXXNewExpr is an array version, MallocChecker::addExtentSize() requires an ElementRegion, so this will trigger an assertion failure. So I think
c ++ - allocator-inlining still has some problems to solve, and I'll to give a new patch.

[NoQ]

Aha, right, makes sense. Yeah, there must be more problems with this mode. Which doesn't make the current patch less useful :)

I'd approve this if the assert is partially brought back, as i mentioned in the inline comment. If you like, you can make a new test file - there'd anyway be many test files for many possible definitions of the single global operator new().

[MTC]

a. Fix Bug34144-[MallocChecker] MallocChecker::MallocUpdateRefState(): Assertion 'Sym' failed.
b. Like Bug34144, inline the custom operator new[] will trigger a assertion failure of MallocChecker::addExtentsize. This is just a temporary solution, the final solution still requires the analyzer can fully simulate the CXXNewAllocator.
c. When the custom operator new/new[] is inlined, MallocChecker:: checkPostStmt (const, CallExpr, *CE,...) will be returned directly, leading to false negative about memory leaks. Therefore, I do special handling of operator new/new[].

[MTC]

In D36708#844449, @NoQ wrote:

Aha, right, makes sense. Yeah, there must be more problems with this mode. Which doesn't make the current patch less useful :)

I'd approve this if the assert is partially brought back, as i mentioned in the inline comment. If you like, you can make a new test file - there'd anyway be many test files for many possible definitions of the single global operator new().

Hi, NoQ.
Appreciate for your reply! I have updated the diff and look forward to your comments.

[MTC]

Correct a careless mistake by adding 'return nullptr' to MallocChecker :: addExtentSize().

[MTC]

Update comments.

[zaks.anna]

Hi MTC,

Could you please split out the fix (b) into it's separate patch? We would like to have the patches be as incremental as possible.

Thanks for working on this!

[MTC]

This comment was removed by MTC.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1282

Hi NoQ, thanks for your patience. I've updated the code！

[MTC]

Because the way I submit the diff is not reasonable, the same diff corresponds to multiple purposes. This diff is primarily to address Bug34144.

[MTC]

In D36708#853442, @zaks.anna wrote:

Hi MTC,

Could you please split out the fix (b) into it's separate patch? We would like to have the patches be as incremental as possible.

Thanks for working on this!

Hi Anna,
Thanks for your correction. I put (b)'s patch on the D37189, another point to note that I did not add the test for the D36708. NewDelete-custom.cpp is a suitable place for the test case, but when I add 'c++-allocator-inlining=true' option to the lit command, an assertion failure will occur(see D37189). What's your suggestion, please?

[NoQ]

We can probably land D37189 first, and then land this patch with a test?

[NoQ]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1285–1286

A null symbol doesn't necessarily mean a null pointer. A non-null concrete pointer or a pointer to a specific variable would also be a non-symbol.

[MTC]

In D36708#854060, @NoQ wrote:

We can probably land D37189 first, and then land this patch with a test?

Thanks a lot, it's a practical way.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1285–1286

Thanks for your reply, and I will correct the error message of this assert.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

 }
 
 void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const {
-  if (C.wasInlined)
-    return;
-
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD)
     return;
 
+  if (C.wasInlined && FD->getDeclName().getCXXOverloadedOperator() != OO_New &&
+      FD->getDeclName().getCXXOverloadedOperator() != OO_Array_New)
+    return;
+
   ProgramStateRef State = C.getState();
   bool ReleasedAllocatedMemory = false;
 

                  ->getAs<SubRegion>()
                  ->getSuperRegion()
                  ->getAs<SubRegion>();
+    // FIXME: Since 'ExprEngine::VisitCXXNewAllocator' has not yet been fully
+    // implemented, the custom operator new[] may return Non-ElementRegion after
+    // its inline call. When 'ExprEngine::VisitCXXNewAllocator' is fully
+    // implemented, the following 'if' statement should be deleted.
+    if (!Region) {
+      assert(NE->isArray() &&
+             !C.getSourceManager().isInSystemHeader(
+                 NE->getOperatorNew()->getLocStart()) &&
+             "The operator new[] can return non-ElementRegion only when it is "
+             "a custom version and is inlined.");
+    }
   } else {
     ElementCount = svalBuilder.makeIntVal(1, true);
     Region = (State->getSVal(NE, LCtx)).getAsRegion()->getAs<SubRegion>();

 
   // Get the return value.
   SVal retVal = State->getSVal(E, C.getLocationContext());
 
   // We expect the malloc functions to return a pointer.
   if (!retVal.getAs<Loc>())
     return nullptr;
 
   SymbolRef Sym = retVal.getAsLocSymbol();
-  assert(Sym);
-
+  // Special case when the 'c++-allocator-inlining' config option sets true and
+  // the c++ allocator return a Null pointer.
+  if (!Sym) {
+    assert(cosnt CXXNewExpr *CNE = dyn_cast<CXXNewExpr>(E) &&
+           !C.getSourceManager().isInSystemHeader(
+               CNE->getOperatorNew()->getLocStart()) &&
+           "Only custom operator new call can be inlined and return a Null "
+           "pointer!");
+    return nullptr;
+  }
   // Set the symbol's state to Allocated.
   return State->set<RegionState>(Sym, RefState::getAllocated(Family, E));
 }

 
   R = R->StripCasts();
 
-  // Blocks might show up as heap data, but should not be free()d
+  // Blocks might show up as heap data, but should not be freed
   if (isa<BlockDataRegion>(R)) {
     ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
     return nullptr;

test/Analysis/Inputs/system-header-simulator-cxx.h

 
 }
 
+void* operator new(std::size_t) throw(std::bad_alloc);
+void* operator new[](std::size_t) throw(std::bad_alloc);
 void* operator new(std::size_t, const std::nothrow_t&) throw();
 void* operator new[](std::size_t, const std::nothrow_t&) throw();
 void operator delete(void*, const std::nothrow_t&) throw();

test/Analysis/NewDelete-custom.cpp

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,cplusplus.NewDelete,unix.Malloc -std=c++11 -fblocks -verify %s
-// RUN: %clang_analyze_cc1 -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks,unix.Malloc -std=c++11 -DLEAKS -fblocks -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,cplusplus.NewDelete,unix.Malloc -std=c++11 -fcxx-exceptions -fblocks -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks,unix.Malloc -fcxx-exceptions -std=c++11 -DLEAKS -fblocks -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks,unix.Malloc -fcxx-exceptions -std=c++11 -analyzer-config c++-allocator-inlining=true -DLEAKS -fblocks -verify %s
 #include "Inputs/system-header-simulator-cxx.h"
 
 #ifndef LEAKS

 
 void *allocator(std::size_t size);
 
-void *operator new[](std::size_t size) throw() { return allocator(size); }
-void *operator new(std::size_t size) throw() { return allocator(size); }
-void *operator new(std::size_t size, std::nothrow_t& nothrow) throw() { return allocator(size); }
+void *operator new[](std::size_t size) throw(std::bad_alloc) { return allocator(size); }
+void *operator new(std::size_t size) throw(std::bad_alloc) { return allocator(size); }
+void *operator new[](std::size_t size, const std::nothrow_t &nothrow) throw() {
+  void *p = 0;
+  try {
+    p = allocator(size);
+  } catch (...) {
+  }
+  return p;
+}
+void *operator new(std::size_t size, const std::nothrow_t &nothrow) throw() {
+  void *p = 0;
+  try {
+    p = allocator(size);
+  } catch (...) {
+  }
+  return p;
+}
 void *operator new(std::size_t, double d);
 
 class C {

 #endif
 
 void testOpNewArray() {
-  void *p = operator new[](0); // call is inlined, no warn
+  void *p = operator new[](0);
 }
+#ifdef LEAKS
+// expected-warning@-2{{Potential leak of memory pointed to by 'p'}}
+#endif
 
 void testNewExprArray() {
   int *p = new int[0];

 
 //----- Custom non-placement operators
 void testOpNew() {
-  void *p = operator new(0); // call is inlined, no warn
+  void *p = operator new(0);
 }
+#ifdef LEAKS
+// expected-warning@-2{{Potential leak of memory pointed to by 'p'}}
+#endif
 
 void testNewExpr() {
   int *p = new int;