[analyzer] pr38668: RegionStore: Do not attempt to cast loaded values of non-scalar types.

[NoQ]

Summary

It is expected to have the same object (memory region) treated as if it has different types in different program points. Like, the object may be a union or contain a union, or a pointer to it can be reinterpreted as a pointer to a different type. The correct behavior for RegionStore when an object is stored as an object of type T1 but loaded as an object of type T2 is to store the object as if it has type T1 but cast it to T2 during load. This is what CastRetrievedVal is responsible for.

Note that the cast here is some sort of a "reinterpret_cast" (even in C). For instance, if you store a float and load an integer, you won't have your float rounded to an integer; instead, you will have garbage.

Therefore i propose to admit that we cannot perform the cast as long as types we're dealing with are non-trivial (neither integers, nor pointers). Our modeling would still be weird in this case when dealing with integer casts, but so is support for integer casts in general.

Of course, if the cast is not necessary (eg, T1 == T2), we can still load the value just fine. This trivial observation in fact improves our behavior on tests and addresses some old FIXMEs: previously we would have tried to perform the cast and fail. We should probably also teach SValBuilder to perform casts in this case.

Fixes https://bugs.llvm.org/show_bug.cgi?id=38668

[dcoughlin]

These seems reasonable, although it does also seem like there could be quite a few unintended consequences that we haven't discovered yet.

I'm also a bit worried about the change in the analyzer's behavior on copy(). Do you have a sense of how much of an effect this will have and how easy potential false positives from this will be to suppress?

test/Analysis/bstring.cpp

47

This seems like it will be a big analysis policy change from the user's perspective and is likely to generate a bunch of new reports.

Can the user add an assertion that v.size() > 0 to tell the analyzer that the path on which the vector is empty is not feasible?

What are the diagnostic notes look like? Can the user tell that the the analyzer is assuming that begin() == end() on that path?

[NoQ]

test/Analysis/bstring.cpp

47

Ugh! This change is actually due to D55873, i just didn't run the tests properly. Will re-think :o

[NoQ]

Remove the test change that wasn't caused by this patch.

[dcoughlin]

Looks good to me.

[NoQ]

Revert!

lib/StaticAnalyzer/Core/Store.cpp

410

This is entirely incorrect. The whole point of this function is to handle the case when R->getValueType() has nothing to do with the original type of V.

Unfortunately, "type of an SVal" is not a thing, so it's going to be a bit more verbose.

[NoQ]

lib/StaticAnalyzer/Core/Store.cpp

410

Relevant test case:

double no_crash_reinterpret_double_as_int(double a) {
  *(int *)&a = 1;
  return a * a;
}

[NoQ]

lib/StaticAnalyzer/Core/Store.cpp

410

...which crashes after this patch while trying to multiply 1 by 1 and return result as double.

(sry for the noise)

[NoQ]

Attempt to define the notion of "type of SVal".

[NoQ]

Add a few more tests, just in case.

[NoQ]

I'll test this more thoroughly. In case it's still wrong, here's a safer fix.

[NoQ]

Add test case bool_to_nullptr in casts.cpp on which my second attempt crashes but the current code does not.

[NoQ]

// no-crash and a slightly cleaner test.

[george.karpenkov]

Seems good, but a comment explaining why this is necessary and why the crash follows otherwise would be great.

[NoQ]

Add a comment.

I guess it doesn't really matter why does this lead to a crash. The symbol itself is well-formed, but we probably don't support it yet in some place, and hopefully (but not necessarily) CastRetrievedVal is the only place we produce it. The point here is that the old behavior is clearly incorrect (i.e., the code doesn't do the right thing, and due to that the well-formed symbol is in fact not the symbol that we're looking for) and the new behavior is clearly conservative (i.e., returning UnknownVal should be pretty safe).

What we really need is a more direct test. Probably unit tests for SValBuilder, or some of those "denote - express" tests.

[NoQ]

Add a denote - express test.

lib/StaticAnalyzer/Core/Store.cpp

if (const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
     return loc::MemRegionVal(GetElementZeroRegion(SR, TargetType));
   }
 
   // We failed if the region we ended up with has perfect type info.
   Failed = isa<TypedValueRegion>(MR);
   return UnknownVal();
 }
 
+static bool isScalarEnoughToAttemptACast(QualType T) {
+  return T->isIntegralOrEnumerationType() || T->isAnyPointerType() ||
+         T->isReferenceType();
+}
+
 /// CastRetrievedVal - Used by subclasses of StoreManager to implement
 ///  implicit casts that arise from loads from regions that are reinterpreted
 ///  as another region.
 SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R,
-                                    QualType castTy) {
-  if (castTy.isNull() || V.isUnknownOrUndef())
+                                    QualType CastTy) {
+  if (CastTy.isNull() || V.isUnknownOrUndef())
     return V;
 
+  QualType OrigTy = R->getValueType();
+
+  if (!isScalarEnoughToAttemptACast(OrigTy) ||
+      !isScalarEnoughToAttemptACast(CastTy)) {
+    if (OrigTy == CastTy)
+      return V;
+    return UnknownVal();
+  }
+
   // When retrieving symbolic pointer and expecting a non-void pointer,
   // wrap them into element regions of the expected type if necessary.
   // SValBuilder::dispatchCast() doesn't do that, but it is necessary to
   // make sure that the retrieved value makes sense, because there's no other
   // cast in the AST that would tell us to cast it to the correct pointer type.
   // We might need to do that for non-void pointers as well.
   // FIXME: We really need a single good function to perform casts for us
   // correctly every time we need it.
-  if (castTy->isPointerType() && !castTy->isVoidPointerType())
+  if (CastTy->isPointerType() && !CastTy->isVoidPointerType())
     if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(V.getAsRegion()))
       if (SR->getSymbol()->getType().getCanonicalType() !=
-          castTy.getCanonicalType())
-        return loc::MemRegionVal(castRegion(SR, castTy));
+          CastTy.getCanonicalType())
+        return loc::MemRegionVal(castRegion(SR, CastTy));
 
-  return svalBuilder.dispatchCast(V, castTy);
+  return svalBuilder.dispatchCast(V, CastTy);
 }
 
 SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
   if (Base.isUnknownOrUndef())
     return Base;
 
   Loc BaseL = Base.castAs<Loc>();
   const SubRegion* BaseR = nullptr;

test/Analysis/bstring.cpp

int *testStdCopyInvalidatesBuffer(std::vector<int> v) {
 
   buf[0] = 66;
 
   // Call to copy should invalidate buf.
   std::copy(v.begin(), v.end(), buf);
 
   int i = buf[0];
 
+  // The TRUE warning shows up on the path on which the vector is empty.
   clang_analyzer_eval(i == 66); // expected-warning {{UNKNOWN}}
+                                // expected-warning@-1 {{TRUE}}
 
   return buf;
 }
 
 int *testStdCopyBackwardInvalidatesBuffer(std::vector<int> v) {
   int n = v.size();
   int *buf = (int *)malloc(n * sizeof(int));
   
   buf[0] = 66;
 
   // Call to copy_backward should invalidate buf.
   std::copy_backward(v.begin(), v.end(), buf + n);
 
   int i = buf[0];
 
+  // The TRUE warning shows up on the path on which the vector is empty.
   clang_analyzer_eval(i == 66); // expected-warning {{UNKNOWN}}
+                                // expected-warning@-1 {{TRUE}}
 
   return buf;
 }
 
 namespace pr34460 {
 short a;
 class b {
   int c;

test/Analysis/casts.c

void no_crash_on_symsym_cast_to_long() {
   #ifdef BIT32
   // expected-warning@-2{{The result of the left shift is undefined due to shifting by '48', which is greater or equal to the width of type 'long'}}
   #else
   // expected-no-diagnostics
   #endif
 }
 
 #endif
+
+char no_crash_SymbolCast_of_float_type_aux(int *p) {
+  *p += 1;
+  return *p;
+}
+
+void no_crash_SymbolCast_of_float_type() {
+  extern float x;
+  char (*f)() = no_crash_SymbolCast_of_float_type_aux;
+  f(&x);
+}

test/Analysis/pointer-to-member.cpp

struct A {
   };
 };
 
 void test() {
   clang_analyzer_eval(&A::x); // expected-warning{{TRUE}}
   clang_analyzer_eval(&A::y); // expected-warning{{TRUE}}
   clang_analyzer_eval(&A::z); // expected-warning{{TRUE}}
 
-  // FIXME: These should be true.
   int A::*l = &A::x, A::*m = &A::y, A::*n = &A::z;
-  clang_analyzer_eval(l); // expected-warning{{UNKNOWN}}
-  clang_analyzer_eval(m); // expected-warning{{UNKNOWN}}
-  clang_analyzer_eval(n); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(l); // expected-warning{{TRUE}}
+  clang_analyzer_eval(m); // expected-warning{{TRUE}}
+  clang_analyzer_eval(n); // expected-warning{{TRUE}}
 
   // FIXME: These should be true as well.
   A a;
   a.x = 1;
   clang_analyzer_eval(a.*l == 1); // expected-warning{{UNKNOWN}}
   a.y = 2;
   clang_analyzer_eval(a.*m == 2); // expected-warning{{UNKNOWN}}
   a.z = 3;
   clang_analyzer_eval(a.*n == 3); // expected-warning{{UNKNOWN}}
 }
 } // end of testAnonymousMember namespace