Skip to content
Snippets Groups Projects
  • Anna Zaks's avatar
    d8eeac5b
    [analyzer] Do not crash when processing binary "?:" in C++ · d8eeac5b
    Anna Zaks authored
    When computing the value of ?: expression, we rely on the last expression in
    the previous basic block to be the resulting value of the expression. This is
    not the case for binary "?:" operator (GNU extension) in C++. As the last
    basic block has the expression for the condition subexpression, which is an
    R-value, whereas the true subexpression is the L-value.
    
    Note the operator evaluation just happens to work in C since the true
    subexpression is an R-value (like the condition subexpression). CFG is the
    same in C and C++ case, but the AST nodes are different, which the LValue to
    Rvalue conversion happening after the BinaryConditionalOperator evaluation.
    
    Changed the logic to only use the last expression from the predecessor only
    if it matches either true or false subexpression. Note, the logic needed
    fortification anyway: L and R were passed but not even used by the function.
    
    Also, change the conjureSymbolVal to correctly compute the type, when the
    expression is an LG-value.
    
    git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179574 91177308-0d34-0410-b5e6-96231b3b80d8
    d8eeac5b
    History
    [analyzer] Do not crash when processing binary "?:" in C++
    Anna Zaks authored
    When computing the value of ?: expression, we rely on the last expression in
    the previous basic block to be the resulting value of the expression. This is
    not the case for binary "?:" operator (GNU extension) in C++. As the last
    basic block has the expression for the condition subexpression, which is an
    R-value, whereas the true subexpression is the L-value.
    
    Note the operator evaluation just happens to work in C since the true
    subexpression is an R-value (like the condition subexpression). CFG is the
    same in C and C++ case, but the AST nodes are different, which the LValue to
    Rvalue conversion happening after the BinaryConditionalOperator evaluation.
    
    Changed the logic to only use the last expression from the predecessor only
    if it matches either true or false subexpression. Note, the logic needed
    fortification anyway: L and R were passed but not even used by the function.
    
    Also, change the conjureSymbolVal to correctly compute the type, when the
    expression is an LG-value.
    
    git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179574 91177308-0d34-0410-b5e6-96231b3b80d8
Code owners
Assign users and groups as approvers for specific file changes. Learn more.