Page MenuHomePhabricator

[analyzer] Prevent AnalyzerStatsChecker from crash
ClosedPublic

Authored by szepet on Jan 18 2018, 3:27 PM.

Details

Summary

The checker marks the locations where the analyzer creates sinks. However, it can happen that the sink was created because of a loop which does not contain condition statement, only breaks in the body. The exhausted block is the block which should contain the condition but empty, in this case.
This change only emits this marking in order to avoid the undefined behavior.

Diff Detail

Repository
rC Clang

Event Timeline

szepet created this revision.Jan 18 2018, 3:27 PM

This seems reasonable.

Would it make sense to use the last element of the block edge's source for the diagnostic location when the destination block is empty?

Would it make sense to use the last element of the block edge's source for the diagnostic location when the destination block is empty?

I do not think so. In the testfile emptyConditionLoop function is a great counter example since the last element of the source block is the num = 1 which would not make sense (in my opinion). However, in this case the location of the terminator statement could be used (if there is any). If you are OK with that solution, I can update the patch.

NoQ accepted this revision.Feb 16 2018, 7:44 PM
NoQ added a subscriber: george.karpenkov.

LGTM! @george.karpenkov has also tested that when he was gathering statistics about his traversal order improvements and it helped :)

This revision is now accepted and ready to land.Feb 16 2018, 7:44 PM
This revision was automatically updated to reflect the committed changes.