Skip to content

[analyzer] RangeConstraint: deduce subtraction from equality #66065

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[analyzer] RangeConstraint: deduce subtraction from equality #66065

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1589,6 +1589,14 @@ class SymbolicRangeInferrer
}
// Opposite combinations result in false.
return getFalseRange(Sym->getType());
} else if (Sym->getOpcode() == BO_Sub) {
QualType CondTy =
State->getStateManager().getSValBuilder().getConditionType();
const SymSymExpr *SSE = State->getSymbolManager().getSymSymExpr(
Sym->getRHS(), BO_NE, Sym->getLHS(), CondTy);
if (auto Constraint = getRangeForComparisonSymbol(SSE))
return Constraint->encodesFalseRange() ? getFalseRange(Sym->getType())
: getTrueRange(Sym->getType());
}

return std::nullopt;
Expand Down
4 changes: 2 additions & 2 deletions clang/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,8 @@ ProgramStateRef RangedConstraintManager::assumeSym(ProgramStateRef State,

// We convert equality operations for pointers only.
if (Loc::isLocType(SSE->getLHS()->getType()) &&
Loc::isLocType(SSE->getRHS()->getType())) {
Loc::isLocType(SSE->getRHS()->getType()) &&
BinaryOperator::isEqualityOp(Op)) {
// Translate "a != b" to "(b - a) != 0".
// We invert the order of the operands as a heuristic for how loop
// conditions are usually written ("begin != end") as compared to length
Expand All @@ -66,7 +67,6 @@ ProgramStateRef RangedConstraintManager::assumeSym(ProgramStateRef State,
SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), DiffTy);

const llvm::APSInt &Zero = getBasicVals().getValue(0, DiffTy);
Op = BinaryOperator::reverseComparisonOp(Op);
if (!Assumption)
Op = BinaryOperator::negateComparisonOp(Op);
return assumeSymRel(State, Subtraction, Op, Zero);
Expand Down
24 changes: 24 additions & 0 deletions clang/test/Analysis/constraint_manager_diff_negate.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
// RUN: %clang_analyze_cc1 -analyzer-checker=debug.ExprInspection -verify -analyzer-config eagerly-assume=false %s

void clang_analyzer_eval(int);

void top(int b, int c) {
if (c >= b) {
clang_analyzer_eval(c >= b); // expected-warning{{TRUE}}
clang_analyzer_eval(b <= c); // expected-warning{{TRUE}}
clang_analyzer_eval((b - 0) <= (c + 0)); // expected-warning{{TRUE}}
clang_analyzer_eval(b + 0 <= c + 0); // expected-warning{{TRUE}}
}
}

void comparisons_imply_size(unsigned long lhs, unsigned long rhs) {
clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}

if (lhs > rhs) {
clang_analyzer_eval(rhs == lhs); // expected-warning{{FALSE}}
clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
clang_analyzer_eval(lhs != rhs); // expected-warning{{TRUE}}
clang_analyzer_eval(lhs - rhs == 0); // expected-warning{{FALSE}}
clang_analyzer_eval(rhs - lhs == 0); // expected-warning{{FALSE}}
}
}
24 changes: 24 additions & 0 deletions clang/test/Analysis/constraint_manager_ptr_conditions.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
// RUN: %clang_analyze_cc1 -analyzer-checker=debug.ExprInspection -verify -analyzer-config eagerly-assume=false %s

void clang_analyzer_eval(int);

void top(int *b, int *c) {
if (c >= b) {
clang_analyzer_eval(c >= b); // expected-warning{{TRUE}}
clang_analyzer_eval(b <= c); // expected-warning{{TRUE}}
clang_analyzer_eval((b - 0) <= (c + 0)); // expected-warning{{TRUE}}
clang_analyzer_eval(b + 0 <= c + 0); // expected-warning{{TRUE}}
}
}

void comparisons_imply_size(int *lhs, int *rhs) {
clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}

if (lhs > rhs) {
clang_analyzer_eval(rhs == lhs); // expected-warning{{FALSE}}
clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
clang_analyzer_eval(lhs != rhs); // expected-warning{{TRUE}}
clang_analyzer_eval(lhs - rhs == 0); // expected-warning{{FALSE}}
clang_analyzer_eval(rhs - lhs == 0); // expected-warning{{FALSE}}
}
}
17 changes: 0 additions & 17 deletions clang/test/Analysis/ptr-arith.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,12 +214,7 @@ void comparisons_imply_size(int *lhs, int *rhs) {
}

clang_analyzer_eval(lhs <= rhs); // expected-warning{{TRUE}}
// FIXME: In Z3ConstraintManager, ptrdiff_t is mapped to signed bitvector. However, this does not directly imply the unsigned comparison.
#ifdef ANALYZER_CM_Z3
clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{UNKNOWN}}
#else
clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{TRUE}}
#endif
clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}

if (lhs >= rhs) {
Expand All @@ -229,11 +224,7 @@ void comparisons_imply_size(int *lhs, int *rhs) {

clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
clang_analyzer_eval(lhs < rhs); // expected-warning{{TRUE}}
#ifdef ANALYZER_CM_Z3
clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}
#else
clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{TRUE}}
#endif
}

void size_implies_comparison(int *lhs, int *rhs) {
Expand All @@ -244,11 +235,7 @@ void size_implies_comparison(int *lhs, int *rhs) {
return;
}

#ifdef ANALYZER_CM_Z3
clang_analyzer_eval(lhs <= rhs); // expected-warning{{UNKNOWN}}
#else
clang_analyzer_eval(lhs <= rhs); // expected-warning{{TRUE}}
#endif
clang_analyzer_eval((rhs - lhs) >= 0); // expected-warning{{TRUE}}
clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{UNKNOWN}}

Expand All @@ -258,11 +245,7 @@ void size_implies_comparison(int *lhs, int *rhs) {
}

clang_analyzer_eval(lhs == rhs); // expected-warning{{FALSE}}
#ifdef ANALYZER_CM_Z3
clang_analyzer_eval(lhs < rhs); // expected-warning{{UNKNOWN}}
#else
clang_analyzer_eval(lhs < rhs); // expected-warning{{TRUE}}
#endif
clang_analyzer_eval((rhs - lhs) > 0); // expected-warning{{TRUE}}
}

Expand Down