[analyzer] Fix crash on modeling of pointer arithmetic

[alexander-shaposhnikov]

Summary

This patch attempts to fix analyzer's crash on the newly added test case (see also https://bugs.llvm.org/show_bug.cgi?id=34374).
Pointer subtraction appears to be modeled incorrectly in the following example:

char* p;
long n = p - reinterpret_cast<char*>((unsigned long)1);

In this case the analyzer (built without this patch) tries to create a symbolic value for the difference
treating reinterpret_cast<char*>((unsigned long)1) as an integer, that is not correct.

Test plan: make check-all

[NoQ]

Looks good!

I guess the accurate thing to do would be to return LocAsInteger of type intptr_t of an ElementRegion with index -1 from SymbolicRegion around p. But i'm totally fine with another UnknownVal placeholder until this becomes an actual problem.

[alexfh]

Thanks for the fix!

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

case loc::ConcreteIntKind: {
     // Comparing an arbitrary integer to a region or label address is
     // completely unknowable.
     return UnknownVal();
   }
   case loc::MemRegionValKind: {
     if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) {
       // If one of the operands is a symbol and the other is a constant,
       // build an expression for use by the constraint manager.
-      if (SymbolRef lSym = lhs.getAsLocSymbol(true))
+      if (SymbolRef lSym = lhs.getAsLocSymbol(true)) {
+        if (BinaryOperator::isComparisonOp(op))
           return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy);
-
+        return UnknownVal();
+      }
       // Special case comparisons to NULL.
       // This must come after the test if the LHS is a symbol, which is used to
       // build constraints. The address of any non-symbolic region is guaranteed
       // to be non-NULL.
       if (rInt->isZeroConstant()) {
         if (op == BO_Sub)
           return evalCastFromLoc(lhs, resultTy);
 

test/Analysis/ptr-arith.cpp

unsigned ptrSubtractionNoCrash(char *Begin, char *End) {
   return N;
 }
 
 // Bug 34309
 bool ptrAsIntegerSubtractionNoCrash(__UINTPTR_TYPE__ x, char *p) {
   __UINTPTR_TYPE__ y = (__UINTPTR_TYPE__)p - 1;
   return y == x;
 }
+
+// Bug 34374
+bool integerAsPtrSubtractionNoCrash(char *p, __UINTPTR_TYPE__ m) {
+  auto n = p - reinterpret_cast<char*>((__UINTPTR_TYPE__)1);
+  return n == m;
+}