================
@@ -1027,23 +1022,21 @@ void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE,
ExplodedNode *Pred,
// If the array is list initialized, we bind the initializer list to the
// memory region here, otherwise we would lose it.
if (isInitList) {
- Bldr.takeNodes(Pred);
- Pred = Bldr.generateNode(CNE, Pred, State);
+ Pred = Engine.makePostStmtNode(CNE, State, Pred);
SVal V = State->getSVal(Init, SF);
ExplodedNodeSet evaluated;
evalBind(evaluated, CNE, Pred, Result, V, true);
- Bldr.takeNodes(Pred);
- Bldr.addNodes(evaluated);
+ Dst.insert(evaluated);
----------------
NagyDonat wrote:
We discussed with @tigbr in person that `evalBind` invokes `check::Bind`
checkers which in theory could very easily split the state, so it is logically
incorrect that this code assumes that `evaluated` always contains exactly one
element. However, as this is old code and we don't know about crashes/bugs
caused by it, it is very likely that there are no `checkBind` checkers that
actually split the state (which is not surprising -- I don't see an obvious
reason why I would want to separate two states after observing a binding).
Still, it is inelegant to assume that `evaluated` always contains exactly one
element (e.g. it would crash on a `PosteriorlyOverconstrained` node that does
not appear in the `ExplodedNodeSet` because `ExplodedNodeSet::insert` does not
insert sink nodes). Either I or @tigbr will create non-NFC follow-up commit
that will fix this bad logic.
https://github.com/llvm/llvm-project/pull/212186
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
