Crash in static analyzer on template with optional constructor parameter

[llvmbot]

Bugzilla Link	15832
Resolution	FIXED
Resolved on	Apr 24, 2013 19:48
Version	trunk
OS	MacOS X
Attachments	source (not preprocessed) showing bug, preprocessed source
Reporter	LLVM Bugzilla Contributor
CC	@AnnaZaks

Extended Description

Overview: When I run the static analyzer on a certain C++ file, clang crashes with a bad instruction error.

Steps to reproduce: Run the analyzer on the attached file.

Actual results: Crash (bad instruction error), with a log beginning: Assertion failed: (Val && "isa<> used on a null pointer"), function doit, file /open-source/llvm/include/llvm/Support/Casting.h, line 97.0

Expect results:

Maybe some analyzer warnings.

Build Date & Platform:

$ /opt/bin/clang --version clang version 3.3 (trunk 180122) (llvm/trunk 180121) Target: x86_64-apple-darwin11.4.2 Thread model: posix

Additional Information:

If I change the line defining the variable str1 to str1(NULL), the crash goes away.

Mac OS crash log:

Process: clang [49444] Path: /opt/bin/clang Identifier: clang Version: 3.3 (???) Code Type: X86-64 (Native) Parent Process: clang [49443]

Date/Time: 2013-04-23 16:39:39.796 -0700 OS Version: Mac OS X 10.7.5 (11G63) Report Version: 9

Interval Since Last Report: 88475 sec Crashes Since Last Report: 75 Per-App Crashes Since Last Report: 74 Anonymous UUID: C6540820-F0A3-4E61-82D4-3424027652A3

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_INSTRUCTION (SIGILL) Exception Codes: 0x0000000000000001, 0x0000000000000000

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 clang 0x000000010358a850 0x101d73000 + 25262160 1 clang 0x000000010358a821 0x101d73000 + 25262113 2 clang 0x0000000102489ce5 0x101d73000 + 7433445 3 clang 0x000000010248702f 0x101d73000 + 7421999 4 clang 0x0000000102491f8f 0x101d73000 + 7466895 5 clang 0x0000000102492655 0x101d73000 + 7468629 6 clang 0x00000001024cf37d 0x101d73000 + 7717757 7 clang 0x00000001024e1a68 0x101d73000 + 7793256 8 clang 0x00000001024f9596 0x101d73000 + 7890326 9 clang 0x00000001024e86ba 0x101d73000 + 7820986 10 clang 0x00000001024d7336 0x101d73000 + 7750454 11 clang 0x00000001024d6f48 0x101d73000 + 7749448 12 clang 0x00000001024d6b52 0x101d73000 + 7748434 13 clang 0x00000001023e8184 0x101d73000 + 6771076 14 clang 0x00000001023e7925 0x101d73000 + 6768933 15 clang 0x00000001023e588e 0x101d73000 + 6760590 16 clang 0x000000010204e774 0x101d73000 + 2996084 17 clang 0x0000000101dd6957 0x101d73000 + 407895 18 clang 0x0000000101db282d 0x101d73000 + 260141 19 clang 0x0000000101d7d1ca 0x101d73000 + 41418 20 clang 0x0000000101d74370 0x101d73000 + 4976 21 clang 0x0000000101d7a4e9 0x101d73000 + 29929 22 clang 0x0000000101d74034 0x101d73000 + 4148

Thread 0 crashed with X86 Thread State (64-bit): rax: 0x0000000000000000 rbx: 0x0000000103f3aef0 rcx: 0x00007fff8be70e42 rdx: 0xffffffffffffffff rdi: 0x000000000000003c rsi: 0x0000000000000000 rbp: 0x00007fff6196ebb0 rsp: 0x00007fff6196ebb0 r8: 0x0000000000000000 r9: 0x00000000000f4240 r10: 0x0000000000000001 r11: 0x00007fff73920228 r12: 0x0000000000000001 r13: 0x00007fdce3c5b7a0 r14: 0x0000000000000000 r15: 0x00007fdce3c506a8 rip: 0x000000010358a850 rfl: 0x0000000000010206 cr2: 0x00007fdce3a60008 Logical CPU: 2

[0f73b9cf-134f-41af-a8b1-14d9f305ee95]

Fixed in r180234. Thanks for the reduced test case!

[llvmbot]

crash source 2 Never mind what I said about optional parameters, I am adding a similar source that has no optional parameter but produces the same crash.

[belkadan]

cloned to rdar://problem/13722286

[llvmbot]

run script

[belkadan]

Symbolicated backtrace (from my machine, original source):

11 clang 0x0000000105a62cc5 bool llvm::isa<clang::ObjCMessageExpr, clang::Stmt const>(clang::Stmt const const&) + 21 12 clang 0x0000000106a46578 llvm::enable_if<llvm::is_same<clang::Stmt const, llvm::simplify_type::SimpleType>, llvm::cast_retty<clang::ObjCMessageExpr, clang::Stmt const>::ret_type>::type llvm::dyn_cast<clang::ObjCMessageExpr, clang::Stmt const>(clang::Stmt const) + 24 13 clang 0x0000000106a38242 GetAllocationSite(clang::ento::ProgramStateManager&, clang::ento::ExplodedNode const, clang::ento::SymExpr const) + 610 14 clang 0x0000000106a37bdf (anonymous namespace)::CFRefLeakReport::CFRefLeakReport((anonymous namespace)::CFRefBug&, clang::LangOptions const&, bool, llvm::DenseMap<clang::ento::ExplodedNode const, (anonymous namespace)::RetainSummary const, llvm::DenseMapInfo<clang::ento::ExplodedNode const> > const&, clang::ento::ExplodedNode, clang::ento::SymExpr const, clang::ento::CheckerContext&, bool) + 287 15 clang 0x0000000106a34ec3 (anonymous namespace)::CFRefLeakReport::CFRefLeakReport((anonymous namespace)::CFRefBug&, clang::LangOptions const&, bool, llvm::DenseMap<clang::ento::ExplodedNode const, (anonymous namespace)::RetainSummary const, llvm::DenseMapInfo<clang::ento::ExplodedNode const> > const&, clang::ento::ExplodedNode, clang::ento::SymExpr const, clang::ento::CheckerContext&, bool) + 147 16 clang 0x0000000106a44527 (anonymous namespace)::RetainCountChecker::processLeaks(llvm::IntrusiveRefCntPtr, llvm::SmallVectorImpl<clang::ento::SymExpr const>&, clang::ento::CheckerContext&, clang::ento::ExplodedNode) const + 551 17 clang 0x0000000106a44c4f (anonymous namespace)::RetainCountChecker::checkDeadSymbols(clang::ento::SymbolReaper&, clang::ento::CheckerContext&) const + 1007

[llvmbot]

assigned to @tkremenek