[analyzer] LoopUnrolling: check the bitwidth of the used numbers (pr34943)

[szepet]

Summary

The loop unrolling feature aims to track the maximum possible steps a loop can make. In order to implement this, it investigates the initial value of the counter variable and the bound number. (There has to be known.)
These numbers are used as llvm::APInts, however, it was not checked if their bitwidths are the same which lead to some crashes.
This revision solves this problem by extending the "shorter" one (to the length of the "longer" one).
For the detailed bug report, see: https://bugs.llvm.org/show_bug.cgi?id=34943

[xazax.hun]

LGTM!

[dcoughlin]

Thanks for fixing this!

cfe/trunk/lib/StaticAnalyzer/Core/LoopUnrolling.cpp

bool shouldCompletelyUnroll(const Stmt *LoopStmt, ASTContext &ASTCtx,
 
   // TODO: Match the cases where the bound is not a concrete literal but an
   // integer with known value
   auto Matches = match(forLoopMatcher(), *LoopStmt, ASTCtx);
   if (Matches.empty())
     return false;
 
   auto CounterVar = Matches[0].getNodeAs<VarDecl>("initVarName");
-  auto BoundNum = Matches[0].getNodeAs<IntegerLiteral>("boundNum")->getValue();
-  auto InitNum = Matches[0].getNodeAs<IntegerLiteral>("initNum")->getValue();
+  llvm::APInt BoundNum =
+      Matches[0].getNodeAs<IntegerLiteral>("boundNum")->getValue();
+  llvm::APInt InitNum =
+      Matches[0].getNodeAs<IntegerLiteral>("initNum")->getValue();
   auto CondOp = Matches[0].getNodeAs<BinaryOperator>("conditionOperator");
+  if (InitNum.getBitWidth() != BoundNum.getBitWidth()) {
+    InitNum = InitNum.zextOrSelf(BoundNum.getBitWidth());
+    BoundNum = BoundNum.zextOrSelf(InitNum.getBitWidth());
+  }
+
   if (CondOp->getOpcode() == BO_GE || CondOp->getOpcode() == BO_LE)
     maxStep = (BoundNum - InitNum + 1).abs().getZExtValue();
   else
     maxStep = (BoundNum - InitNum).abs().getZExtValue();
 
   // Check if the counter of the loop is not escaped before.
   return !isPossiblyEscaped(CounterVar->getCanonicalDecl(), Pred);
 }

cfe/trunk/test/Analysis/loop-unrolling.cpp

for (int i = 0; i < getNum(); i++) {
     clang_analyzer_numTimesReached(); // expected-warning {{1}}
     for (int j = 0; j < 33; j++) {
       clang_analyzer_numTimesReached(); // expected-warning {{4}}
     }
   }
   return 0;
 }
 
+
+void pr34943() {
+  for (int i = 0; i < 6L; ++i) {
+    clang_analyzer_numTimesReached(); // expected-warning {{6}}
+  }
+}