[Analyzer] Iterator Checkers - Fix for Crash on Iterator Differences

[baloghadamsoftware]

Summary

Iterators differences were mistakenly handled as random decrements which
causes an assertion. This patch fixes this.

[baloghadamsoftware]

This is an emergency patch. Please someone review this patch as soon as possible.

[NoQ]

Fair enough!

[Szelethus]

Cool!

[baloghadamsoftware]

Closed by commit: [[ https://reviews.llvm.org/rG8557f17d887a | https://reviews.llvm.org/rG8557f17d887a: [Analyzer] Iterator Checkers - Fix for Crash on Iterator Differences ]]

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

if (ChecksEnabled[CK_IteratorRangeChecker]) {
         } else {
           if (Call.getNumArgs() >= 1) {
             verifyDecrement(C, Call.getArgSVal(0));
           }
         }
       } else if (isRandomIncrOrDecrOperator(Func->getOverloadedOperator())) {
         if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
           // Check for out-of-range incrementions and decrementions
-          if (Call.getNumArgs() >= 1) {
+          if (Call.getNumArgs() >= 1 &&
+              Call.getArgExpr(0)->getType()->isIntegralOrEnumerationType()) {
             verifyRandomIncrOrDecr(C, Func->getOverloadedOperator(),
                                    InstCall->getCXXThisVal(),
                                    Call.getArgSVal(0));
           }
         } else {
-          if (Call.getNumArgs() >= 2) {
+          if (Call.getNumArgs() >= 2 &&
+              Call.getArgExpr(1)->getType()->isIntegralOrEnumerationType()) {
             verifyRandomIncrOrDecr(C, Func->getOverloadedOperator(),
                                    Call.getArgSVal(0), Call.getArgSVal(1));
           }
         }
       } else if (isDereferenceOperator(Func->getOverloadedOperator())) {
         // Check for dereference of out-of-range iterators
         if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
           verifyDereference(C, InstCall->getCXXThisVal());
if (isAssignmentOperator(Op)) {
         return;
       }
 
       handleComparison(C, OrigExpr, Call.getReturnValue(), Call.getArgSVal(0),
                          Call.getArgSVal(1), Op);
       return;
     } else if (isRandomIncrOrDecrOperator(Func->getOverloadedOperator())) {
       if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
-        if (Call.getNumArgs() >= 1) {
+        if (Call.getNumArgs() >= 1 &&
+              Call.getArgExpr(0)->getType()->isIntegralOrEnumerationType()) {
           handleRandomIncrOrDecr(C, Func->getOverloadedOperator(),
                                  Call.getReturnValue(),
                                  InstCall->getCXXThisVal(), Call.getArgSVal(0));
           return;
         }
       } else {
-        if (Call.getNumArgs() >= 2) {
+        if (Call.getNumArgs() >= 2 &&
+              Call.getArgExpr(1)->getType()->isIntegralOrEnumerationType()) {
           handleRandomIncrOrDecr(C, Func->getOverloadedOperator(),
                                  Call.getReturnValue(), Call.getArgSVal(0),
                                  Call.getArgSVal(1));
           return;
         }
       }
     } else if (isIncrementOperator(Func->getOverloadedOperator())) {
       if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {

test/Analysis/Inputs/system-header-simulator-cxx.h

template <typename T, typename Ptr, typename Ref> struct __vector_iterator {
   }
   __vector_iterator<T, Ptr, Ref> operator+=(difference_type n) {
     return ptr += n;
   }
   __vector_iterator<T, Ptr, Ref> operator-=(difference_type n) {
     return ptr -= n;
   }
 
+  template<typename U, typename Ptr2, typename Ref2>
+  difference_type operator-(const __vector_iterator<U, Ptr2, Ref2> &rhs);
+
   Ref operator*() const { return *ptr; }
   Ptr operator->() const { return *ptr; }
 
   bool operator==(const iterator &rhs) const { return ptr == rhs.ptr; }
   bool operator==(const const_iterator &rhs) const { return ptr == rhs.ptr; }
 
   bool operator!=(const iterator &rhs) const { return ptr != rhs.ptr; }
   bool operator!=(const const_iterator &rhs) const { return ptr != rhs.ptr; }

test/Analysis/diagnostics/explicit-suppression.cpp

class C {
   // The virtual function is to make C not trivially copy assignable so that we call the
   // variant of std::copy() that does not defer to memmove().
   virtual int f();
 };
 
 void testCopyNull(C *I, C *E) {
   std::copy(I, E, (C *)0);
 #ifndef SUPPRESSED
-  // expected-warning@../Inputs/system-header-simulator-cxx.h:677 {{Called C++ object pointer is null}}
+  // expected-warning@../Inputs/system-header-simulator-cxx.h:680 {{Called C++ object pointer is null}}
 #endif
 }

test/Analysis/iterator-range.cpp

 
 void good_derived(simple_container c) {
   auto i0 = c.end();
   if (i0 != c.end()) {
     clang_analyzer_warnIfReached();
     *i0; // no-warning
   }
 }
+
+void iter_diff(std::vector<int> &V) {
+  auto i0 = V.begin(), i1 = V.end();
+  ptrdiff_t len = i1 - i0; // no-crash
+}