[analyzer] ExprEngine should not depend on checkers for not crashing.

llvm-svn: 126622

2 files changed, 19 insertions, 4 deletions

diff --git a/clang/lib/StaticAnalyzer/Checkers/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
index fc33639a862..004be0c1b15 100644
--- a/clang/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
@@ -1322,7 +1322,7 @@ void ExprEngine::processBranch(const Stmt* Condition, const Stmt* Term,
   const GRState* PrevState = builder.getState();
   SVal X = PrevState->getSVal(Condition);
 
-  if (X.isUnknown()) {
+  if (X.isUnknownOrUndef()) {
     // Give it a chance to recover from unknown.
     if (const Expr *Ex = dyn_cast<Expr>(Condition)) {
       if (Ex->getType()->isIntegerType()) {
@@ -1340,7 +1340,7 @@ void ExprEngine::processBranch(const Stmt* Condition, const Stmt* Term,
       }
     }
     // If the condition is still unknown, give up.
-    if (X.isUnknown()) {
+    if (X.isUnknownOrUndef()) {
       builder.generateNode(MarkBranch(PrevState, Term, true), true);
       builder.generateNode(MarkBranch(PrevState, Term, false), false);
       return;
@@ -1858,7 +1858,8 @@ void ExprEngine::evalStore(ExplodedNodeSet& Dst, const Expr *AssignE,
   if (Tmp.empty())
     return;
 
-  assert(!location.isUndef());
+  if (location.isUndef())
+    return;
 
   SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind,
                                                    ProgramPoint::PostStoreKind);
@@ -1918,7 +1919,8 @@ void ExprEngine::evalLoadCommon(ExplodedNodeSet& Dst, const Expr *Ex,
   if (Tmp.empty())
     return;
 
-  assert(!location.isUndef());
+  if (location.isUndef())
+    return;
 
   SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind);
 
diff --git a/clang/lib/StaticAnalyzer/Core/FlatStore.cpp b/clang/lib/StaticAnalyzer/Core/FlatStore.cpp
index 99a5eadaca2..7bdca6b7f17 100644
--- a/clang/lib/StaticAnalyzer/Core/FlatStore.cpp
+++ b/clang/lib/StaticAnalyzer/Core/FlatStore.cpp
@@ -90,6 +90,19 @@ StoreManager *ento::CreateFlatStoreManager(GRStateManager &StMgr) {
 }
 
 SVal FlatStoreManager::Retrieve(Store store, Loc L, QualType T) {
+  // For access to concrete addresses, return UnknownVal.  Checks
+  // for null dereferences (and similar errors) are done by checkers, not
+  // the Store.
+  // FIXME: We can consider lazily symbolicating such memory, but we really
+  // should defer this when we can reason easily about symbolicating arrays
+  // of bytes.
+  if (isa<loc::ConcreteInt>(L)) {
+    return UnknownVal();
+  }
+  if (!isa<loc::MemRegionVal>(L)) {
+    return UnknownVal();
+  }
+
   const MemRegion *R = cast<loc::MemRegionVal>(L).getRegion();
   RegionInterval RI = RegionToInterval(R);
   // FIXME: FlatStore should handle regions with unknown intervals.