[analyzer] Admit that we can't simplify the newly produced mixed Loc/NonLoc expressions.

[NoQ]

Summary

Add one more defensive check to prevent crashes on trying to simplify a SymSymExpr with different Loc-ness of operands. This fix is similar to D49703 and addresses a regression caused by D48650.

When an operation between a nonloc::LocAsInteger and a non-pointer symbol is performed, the LocAsInteger-specific part of information is lost. When the non-pointer symbol is collapsing into a constant, we cannot easily re-evaluate the result, because we need to recover the missing LocAsInteger-specific information (eg., integer type, or the very fact that this pointer was at some point converted to an integer).

[george.karpenkov]

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

1300

could we eliminate the code duplication with lines 1308-1310?

[mikhail.ramalho]

It fixes Xerces verification. Thanks.

[NoQ]

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

1300

Moved to D49826 because it's much larger than this patch.

[NoQ]

Committed in rC338425 but i accidentally screwed the revision link.

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

SVal VisitSymIntExpr(const SymIntExpr *S) {
       return V;
     }
 
     SVal VisitSymSymExpr(const SymSymExpr *S) {
       auto I = Cached.find(S);
       if (I != Cached.end())
         return I->second;
 
+      // For now don't try to simplify mixed Loc/NonLoc expressions
+      // because they often appear from LocAsInteger operations
+      // and we don't know how to combine a LocAsInteger
+      // with a concrete value.
+      if (Loc::isLocType(S->getLHS()->getType()) !=
+          Loc::isLocType(S->getRHS()->getType())) {
+        SVal V = SVB.makeSymbolVal(S);
+        Cached[S] = V;
+        return V;
+      }
+
       SVal LHS = Visit(S->getLHS());
       SVal RHS = Visit(S->getRHS());
       if (isUnchanged(S->getLHS(), LHS) && isUnchanged(S->getRHS(), RHS)) {
         SVal V = SVB.makeSymbolVal(S);
         Cached[S] = V;
         return V;
       }
       SVal V = SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType());

test/Analysis/casts.c

void testCastVoidPtrToIntPtrThroughUIntTypedAssignment() {
   int *x;
   (*((int *)(&x))) = (int)(unsigned *)getVoidPtr();
   *x = 1; // no-crash
 }
 
 void testLocNonLocSymbolAssume(int a, int *b) {
   if ((int)b < a) {}
 }
+
+void testLocNonLocSymbolRemainder(int a, int *b) {
+  int c = ((int)b) % a;
+  if (a == 1) {
+    c += 1;
+  }
+}