[Analyzer] Infer 0 value when the divisible is 0 (bug fix)

[martong]

Summary

Currently, we infer 0 if the divisible of the modulo op is 0:

int a = x < 0; // a can be 0
int b = a % y; // b is either 1 % sym or 0

However, we don't when the op is / :

int a = x < 0; // a can be 0
int b = a / y; // b is either 1 / sym or 0 / sym

This commit fixes the discrepancy.

[martong]

clang/test/Analysis/zero-operands.c

44

Note, this is the test that fails without this fix.

The preceding tests are here to demonstrate the current functionality with the other multiplicative operands and will be good for regression testing.

[vsavchenko]

Looks great!

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

655

I think we should either add: // 0 / x == 0 or modify the comment for BO_Rem

[martong]

Thanks for the review!

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

655

Okay, I added the new comment.

[vsavchenko]

Awesome! Thanks!

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

case nonloc::ConcreteIntKind: {
         if (LHSValue.isAllOnesValue() && LHSValue.isSigned())
           return evalCastFromNonLoc(lhs, resultTy);
         LLVM_FALLTHROUGH;
       case BO_Shl:
         // 0<<a and 0>>a
         if (LHSValue == 0)
           return evalCastFromNonLoc(lhs, resultTy);
         return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
+      case BO_Div:
+        // 0 / x == 0
       case BO_Rem:
         // 0 % x == 0
         if (LHSValue == 0)
           return makeZeroVal(resultTy);
         LLVM_FALLTHROUGH;
       default:
         return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
       }

clang/test/Analysis/zero-operands.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core \
+// RUN:   -analyzer-checker=debug.ExprInspection \
+// RUN:   -verify %s
+
+void clang_analyzer_dump(int);
+
+void test_0_multiplier1(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning@-2{{1 S32b}}
+
+  int b = a * y;
+  clang_analyzer_dump(b);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning-re@-2{{reg_${{[[:digit:]]+}}<int y>}}
+}
+
+void test_0_multiplier2(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning@-2{{1 S32b}}
+
+  int b = y * a;
+  clang_analyzer_dump(b);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning-re@-2{{reg_${{[[:digit:]]+}}<int y>}}
+}
+
+void test_0_modulo(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning@-2{{1 S32b}}
+
+  int b = a % y;
+  clang_analyzer_dump(b);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning-re@-2{{1 % (reg_${{[[:digit:]]+}}<int y>)}}
+}
+
+void test_0_divisible(int x, int y) {
+  int a = x < 0; // Eagerly bifurcate.
+  clang_analyzer_dump(a);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning@-2{{1 S32b}}
+
+  int b = a / y;
+  clang_analyzer_dump(b);
+  // expected-warning@-1{{0 S32b}}
+  // expected-warning-re@-2{{1 / (reg_${{[[:digit:]]+}}<int y>)}}
+}