necto wrote:
While you are thinking about it, here is a bug I discovered when enabled
`aggressive-binary-operation-simplification` on our test suite:
```
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection \
// RUN: -analyzer-config aggressive-binary-operation-simplification=true \
// RUN: -analyzer-config eagerly-assume=false \
// RUN: -verify=rearrange %s
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection \
// RUN: -analyzer-config aggressive-binary-operation-simplification=false \
// RUN: -analyzer-config eagerly-assume=false \
// RUN: -verify=no-rearrange %s
// tryRearrange decomposes both operands into "$x + n" and "$x + m". When the
// two symbols are the same, it folds just the constants, which is only right
// for comparisons and subtraction: "($x + n) + ($x + m)" is "2 * $x + n + m",
// not "n + m".
void clang_analyzer_eval(int);
int f(void);
void add_shifted_same_symbol(void) {
int x = f();
clang_analyzer_eval((x + 1) + (x + 2) == 3); //
no-rearrange-warning{{UNKNOWN}} rearrange-warning{{TRUE}}
clang_analyzer_eval((x + 1) + x == 1); //
no-rearrange-warning{{UNKNOWN}} rearrange-warning{{TRUE}}
clang_analyzer_eval((x - 1) + (x + 1) == 0); //
no-rearrange-warning{{UNKNOWN}} rearrange-warning{{TRUE}}
}
void add_shifted_same_symbol_constrained(void) {
int x = f();
if (x < 1 || x > 1000)
return;
// 2 * x + 1 is in [3, 2001].
clang_analyzer_eval((x + 1) + x == 1); // no-rearrange-warning{{FALSE}}
rearrange-warning{{TRUE}}
clang_analyzer_eval((x + 1) + x > 2); // no-rearrange-warning{{TRUE}}
rearrange-warning{{FALSE}}
}
```
In case that helps you come up with a more efficient and more correct
implementation.
https://github.com/llvm/llvm-project/pull/236565
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
