[analyzer] pr37152: Fix operator delete[] array-type-sub-expression handling.

[NoQ]

Summary

When operator delete[] receives a sub-expression of array type, it destroys the array correctly. Even if it's multi-dimensional, simply because in this case it's an array of array-type objects and destroying such array would mean properly destroying each object, where the object itself is an array, so properly destroying it means destroying its objects, etc.

In this case the AST is saying that the destroyed type is an array type - and we weren't prepared for that.

For now there's no actual calling multiple destructors; at least we're trying not to crash.

[alexfh]

lib/StaticAnalyzer/Core/ExprEngine.cpp

1089–1091 ↗

(On Diff #144212)

Maybe add a FIXME to model multiple destructor calls?

[NoQ]

lib/StaticAnalyzer/Core/ExprEngine.cpp

1089–1091 ↗

(On Diff #144212)

Yep, we already have one a few lines above, for all kinds of destructors. The new code is not about supporting array delete in general; it's about supporting the situation when the sub-expression of the delete operator is of an array type, so there's nothing new here with respect to actually calling multiple destructors.

cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp

void ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor,
 
   EvalCallOptions CallOpts;
   const MemRegion *ArgR = ArgVal.getAsRegion();
   if (DE->isArrayForm()) {
     // FIXME: We need to run the same destructor on every element of the array.
     // This workaround will just run the first destructor (which will still
     // invalidate the entire array).
     CallOpts.IsArrayCtorOrDtor = true;
+    // Yes, it may even be a multi-dimensional array.
+    while (const auto *AT = getContext().getAsArrayType(DTy))
+      DTy = AT->getElementType();
     if (ArgR)
       ArgR = getStoreManager().GetElementZeroRegion(cast<SubRegion>(ArgR), DTy);
   }
 
-  VisitCXXDestructor(DE->getDestroyedType(), ArgR, DE, /*IsBase=*/false,
-                     Pred, Dst, CallOpts);
+  VisitCXXDestructor(DTy, ArgR, DE, /*IsBase=*/false, Pred, Dst, CallOpts);
 }
 
 void ExprEngine::ProcessBaseDtor(const CFGBaseDtor D,
                                  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
   const LocationContext *LCtx = Pred->getLocationContext();
 
   const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->getDecl());
   Loc ThisPtr = getSValBuilder().getCXXThis(CurDtor,

cfe/trunk/test/Analysis/new.cpp

 
 //Deleting a non-class pointer should not crash/warn
 void test_var_delete() {
   int *v = new int;
   delete v;  // no crash/warn
   clang_analyzer_eval(true); // expected-warning{{TRUE}}
 }
 
+void test_array_delete() {
+  class C {
+  public:
+    ~C() {}
+  };
+
+  auto c1 = new C[2][3];
+  delete[] c1; // no-crash // no-warning
+
+  C c2[4];
+  // FIXME: Should warn.
+  delete[] &c2; // no-crash
+
+  C c3[7][6];
+  // FIXME: Should warn.
+  delete[] &c3; // no-crash
+}
+
 void testDeleteNull() {
   NoReturnDtor *foo = 0;
   delete foo; // should not call destructor, checked below
   clang_analyzer_eval(true); // expected-warning{{TRUE}}
 }
 
 void testNullAssigneddtor() {
   NoReturnDtor *p = 0;