https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/218462
From ed77e7714c206755dde461fa4929f29feebe4765 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= <[email protected]> Date: Mon, 24 Aug 2026 18:05:40 +0200 Subject: [PATCH 1/3] Use makeNode in processCallEnter --- clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp index e0139484b2b48..88b40aed9b4e4 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp @@ -53,14 +53,10 @@ void ExprEngine::processCallEnter(CallEnter CE, ExplodedNode *Pred) { // Construct an edge representing the starting location in the callee. BlockEdge Loc(Entry, Succ, CE.getCalleeStackFrame()); - ProgramStateRef state = Pred->getState(); - // Construct a new node, notify checkers that analysis of the function has // begun, and add the resultant nodes to the worklist. - bool isNew; - ExplodedNode *Node = G.getNode(Loc, state, false, &isNew); - Node->addPredecessor(Pred, G); - if (isNew) { + ExplodedNode *Node = Engine.makeNode(Loc, Pred->getState(), Pred); + if (Node) { // FIXME: In the `processBeginOfFunction` callback // `ExprEngine::getCurrStackFrame()` can be different from the // `StackFrame` queried from e.g. the `ExplodedNode`s. I'm not From 5c05d7f6f7f773aaf5f68fa532b3512354459aea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= <[email protected]> Date: Mon, 24 Aug 2026 18:11:37 +0200 Subject: [PATCH 2/3] Use makeNode in inlineCall Note that `ExplodedGraph::getNode` always returns a non-null `ExplodedNode *` (that points to either an old node or the freshly created node); it was pointless paranoia checked the whether it returns a nullpointer. --- clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp index 88b40aed9b4e4..3ff75fa3167c5 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp @@ -541,12 +541,8 @@ void ExprEngine::inlineCall(WorkList *WList, const CallEvent &Call, // formal arguments. State = State->enterStackFrame(Call, CalleeSF); - bool isNew; - if (ExplodedNode *N = G.getNode(Loc, State, false, &isNew)) { - N->addPredecessor(Pred, G); - if (isNew) - WList->enqueue(N); - } + if (ExplodedNode *N = Engine.makeNode(Loc, State, Pred)) + WList->enqueue(N); NumInlinedCalls++; Engine.FunctionSummaries->bumpNumTimesInlined(D); From 043b57b99811c8329a9ff32004069afbd8921986 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= <[email protected]> Date: Thu, 27 Aug 2026 23:50:22 +0200 Subject: [PATCH 3/3] Add a warning comment --- clang/lib/StaticAnalyzer/Core/ExprEngine.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp index e6349eb4eba2a..d15d8fcf152bc 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -2379,6 +2379,9 @@ bool ExprEngine::replayWithoutInlining(ExplodedNode *N, ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); // We cached out at this point. Caching out is common due to us backtracking // from the inlined function, which might spawn several paths. + // NOTE: We must return before the `addPredecessor()` call, otherwise the + // node vectors `NewNode->Preds` and `BeforeProcessingCall->Succs` would + // end up containing multiple copies of `BeforeProcessingCall` / `NewNode`. if (!IsNew) return true; _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
