================
@@ -1027,23 +1022,21 @@ void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE,
ExplodedNode *Pred,
// If the array is list initialized, we bind the initializer list to the
// memory region here, otherwise we would lose it.
if (isInitList) {
- Bldr.takeNodes(Pred);
- Pred = Bldr.generateNode(CNE, Pred, State);
+ Pred = Engine.makePostStmtNode(CNE, State, Pred);
SVal V = State->getSVal(Init, SF);
ExplodedNodeSet evaluated;
evalBind(evaluated, CNE, Pred, Result, V, true);
- Bldr.takeNodes(Pred);
- Bldr.addNodes(evaluated);
+ Dst.insert(evaluated);
----------------
NagyDonat wrote:
The code after this point clearly assumes that `evaluated` contains exactly one
element and will erase that element from `Dst`, so there is no need to insert
`evaluated` into `Dst` but it would be nice to check this assumption with an
assertion:
```suggestion
assert(evaluated.size() == 1);
```
Also please check the source code of `evalBind` to see whether this assertion
is justified, and if not, refactor the logic to gracefully handle other
`size()` as well.
(In particular think about the possibility of a corner case where we generate a
`PosteriorlyOverconstrained` node which is a sink and therefore isn't inserted
into a node set -- and determine whether `*evaluated.begin()` could crash in
that case.)
https://github.com/llvm/llvm-project/pull/212186
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
