[analyzer] loop unrolling crash #121201
Labels
Comments
|
@llvm/issue-subscribers-clang-tidy Author: JOSTAR (shenjunjiekoda)
Found a crash when using analyzer from project `libfmt` 's file `test/std-test.cc`.
After reduce the case: template <bool, typename T, typename> using conditional_t = T;
class basic_format_arg;
template <typename> struct formatter;
template <typename Context> struct value {
template <typename T> value(T) {
using value_type = T;
format_custom_arg<value_type,
typename Context::template formatter_type<value_type>>;
}
template <typename, typename Formatter> static void format_custom_arg() {
Context ctx;
auto f = Formatter();
f.format(0, ctx);
}
};
struct context {
template <typename T> using formatter_type = formatter<T>;
};
enum { max_packed_args };
template <typename Context, long>
using arg_t = conditional_t<max_packed_args, value<Context>, basic_format_arg>;
template <int NUM_ARGS> struct format_arg_store {
arg_t<context, NUM_ARGS> args;
};
template <typename... T, long NUM_ARGS = sizeof...(T)>
auto make_format_args(T... args) -> format_arg_store<NUM_ARGS> {
return {args...};
}
template <typename F> void write_padded(context, F write) { write(0); };
template <typename... T> void format(T... args) { make_format_args(args...); }
template <int> struct bitset {
bitset(long);
};
template <long N> struct formatter<bitset<N>> {
struct writer {
bitset<N> bs;
template <typename OutputIt> void operator()(OutputIt) {
for (auto pos = N; pos > 0; --pos)
;
}
};
template <typename FormatContext>
void format(bitset<N> bs, FormatContext ctx) {
write_padded(ctx, writer{bs});
}
};
bitset<6> TestBody_bs = (2);
void TestBody() { format(TestBody_bs); }
$ clang-tidy "-checks=-*,clang-analyzer-core.*" "/path/to/file" "--" "-Xclang" "-analyzer-config" "-Xclang" "unroll-loops=true"crash msg I see the reason may be in the static bool shouldCompletelyUnroll(const Stmt *LoopStmt, ASTContext &ASTCtx,
ExplodedNode *Pred, unsigned &maxStep) {
// ....
if (InitNum.getBitWidth() != BoundNum.getBitWidth()) {
InitNum = InitNum.zext(BoundNum.getBitWidth());
BoundNum = BoundNum.zext(InitNum.getBitWidth());
} |
|
@llvm/issue-subscribers-clang-static-analyzer Author: JOSTAR (shenjunjiekoda)
Found a crash when using analyzer from project `libfmt` 's file `test/std-test.cc`.
After reduce the case: template <bool, typename T, typename> using conditional_t = T;
class basic_format_arg;
template <typename> struct formatter;
template <typename Context> struct value {
template <typename T> value(T) {
using value_type = T;
format_custom_arg<value_type,
typename Context::template formatter_type<value_type>>;
}
template <typename, typename Formatter> static void format_custom_arg() {
Context ctx;
auto f = Formatter();
f.format(0, ctx);
}
};
struct context {
template <typename T> using formatter_type = formatter<T>;
};
enum { max_packed_args };
template <typename Context, long>
using arg_t = conditional_t<max_packed_args, value<Context>, basic_format_arg>;
template <int NUM_ARGS> struct format_arg_store {
arg_t<context, NUM_ARGS> args;
};
template <typename... T, long NUM_ARGS = sizeof...(T)>
auto make_format_args(T... args) -> format_arg_store<NUM_ARGS> {
return {args...};
}
template <typename F> void write_padded(context, F write) { write(0); };
template <typename... T> void format(T... args) { make_format_args(args...); }
template <int> struct bitset {
bitset(long);
};
template <long N> struct formatter<bitset<N>> {
struct writer {
bitset<N> bs;
template <typename OutputIt> void operator()(OutputIt) {
for (auto pos = N; pos > 0; --pos)
;
}
};
template <typename FormatContext>
void format(bitset<N> bs, FormatContext ctx) {
write_padded(ctx, writer{bs});
}
};
bitset<6> TestBody_bs = (2);
void TestBody() { format(TestBody_bs); }
$ clang-tidy "-checks=-*,clang-analyzer-core.*" "/path/to/file" "--" "-Xclang" "-analyzer-config" "-Xclang" "unroll-loops=true"crash msg I see the reason may be in the static bool shouldCompletelyUnroll(const Stmt *LoopStmt, ASTContext &ASTCtx,
ExplodedNode *Pred, unsigned &maxStep) {
// ....
if (InitNum.getBitWidth() != BoundNum.getBitWidth()) {
InitNum = InitNum.zext(BoundNum.getBitWidth());
BoundNum = BoundNum.zext(InitNum.getBitWidth());
} |
|
Confirmed that it crashes currently on main: https://godbolt.org/z/sdnea1qv6 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Found a crash when using analyzer from project
libfmt's filetest/std-test.cc.After reduce the case:
crash msg
I see the reason may be in the
clang/lib/StaticAnalyzer/Core/LoopUnrolling.cppThe text was updated successfully, but these errors were encountered: