Page MenuHomePhabricator

[analyzer] Fix crash when returning C++ objects from ObjC messages-to-nil.

Authored by NoQ on Apr 22 2019, 6:19 PM.



This is an Objective-C++ specific fix to a problem that's similar to D59573 and D59622 (i.e., hitting the same assertion i added in D59054).

This time, surprisingly, the assertion is in fact incorrect: there is a cornercase in Objective-C++ in which a C++ object is not constructed with a constructor, but only zero-initialized. Namely, this happens when an Objective-C message is sent to a nil and it is supposed to return a C++ object.

I made sure that the assertion is only relaxed for Objective-C++ but it's hard to relax it in a more specific way with the amount of information that RegionStore receives. The alternative solution was to conjure a LazyCompoundValue specifically for this case instead, but implementing this cornercase in SValBuilder::makeZeroVal() is hard because there's no good region to use as the base of that LazyCompoundVal, and in the checker (this modeling currently belongs to CallAndMessageChecker) it's even uglier and is bad for checker APIs.

Diff Detail

rC Clang

Event Timeline

NoQ created this revision.Apr 22 2019, 6:19 PM
Herald added a project: Restricted Project. · View Herald TranscriptApr 22 2019, 6:19 PM

Looks good to me. This is a really interesting corner of Objective-C++!

dcoughlin accepted this revision.Apr 23 2019, 9:28 PM
This revision is now accepted and ready to land.Apr 23 2019, 9:28 PM
This revision was automatically updated to reflect the committed changes.