[clang][static analyzer] Crash when program contains __builtin_bit_cast

[ormris]

The static analyzer crashes when passed a small program containing __builtin_bit_cast.

$ cat test.cpp
int *a;
char b[4];
void c() { a[__builtin_bit_cast(int, b)]; }
$ clang++ --version |& grep version
clang version 19.0.0git (git@github.com:llvm/llvm-project.git dd82fd4744397e0510c8204f1a6031441e21858e)
$ clang++ --analyze test.cpp
clang++: <HOME>/llvm-project/llvm/include/llvm/Support/Casting.h:566: decltype(auto) llvm::cast(const From &) [To = clang::ento::NonLoc, From = clang::ento::SVal]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace, preprocessed source, and associated run script.
...
$

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Matthew Voss (ormris)

The static analyzer crashes when passed a small program containing __builtin_bit_cast. ``` $ cat test.cpp int *a; char b[4]; void c() { a[__builtin_bit_cast(int, b)]; } $ clang++ --version |& grep version clang version 19.0.0git (git@github.com:llvm/llvm-project.git dd82fd4) $ clang++ --analyze test.cpp clang++: <HOME>/llvm-project/llvm/include/llvm/Support/Casting.h:566: decltype(auto) llvm::cast(const From &) [To = clang::ento::NonLoc, From = clang::ento::SVal]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed. PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace, preprocessed source, and associated run script. ... $ ```

[mustartt]

Stack trace on debug build

Cased by casting to NonLoc SValue:

  // Pointer of any type can be cast and used as array base.
  const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);

  // Convert the offset to the appropriate size and signedness.
  Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();

  if (!ElemR) {
    // If the base region is not an ElementRegion, create one.
    // This can happen in the following example:
    //

I can take it on if necessary

clang: /home/hjiang/workspace/llvm-community/llvm/include/llvm/Support/Casting.h:566: decltype(auto) llvm::cast(const From &) [To = clang::ento::NonLoc, From = clang::ento::SVal]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /home/hjiang/workspace/llvm-community/build/Debug/bin/clang --analyze 94496.cpp
1.	<eof> parser at end of file
2.	While analyzing stack: 
	#0 Calling c()
3.	94496.cpp:5:5: Error evaluating statement
4.	94496.cpp:5:5: Error evaluating statement
 #0 0x000055722b271cfd llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/hjiang/workspace/llvm-community/llvm/lib/Support/Unix/Signals.inc:723:11
 #1 0x000055722b2721eb PrintStackTraceSignalHandler(void*) /home/hjiang/workspace/llvm-community/llvm/lib/Support/Unix/Signals.inc:798:1
 #2 0x000055722b270276 llvm::sys::RunSignalHandlers() /home/hjiang/workspace/llvm-community/llvm/lib/Support/Signals.cpp:105:5
 #3 0x000055722b27158e llvm::sys::CleanupOnSignal(unsigned long) /home/hjiang/workspace/llvm-community/llvm/lib/Support/Unix/Signals.inc:368:1
 #4 0x000055722b1917e7 (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long) /home/hjiang/workspace/llvm-community/llvm/lib/Support/CrashRecoveryContext.cpp:0:7
 #5 0x000055722b191b85 CrashRecoverySignalHandler(int) /home/hjiang/workspace/llvm-community/llvm/lib/Support/CrashRecoveryContext.cpp:391:1
 #6 0x00007f574ae2ccf0 __restore_rt (/lib64/libpthread.so.0+0x12cf0)
 #7 0x00007f57498acacf raise (/lib64/libc.so.6+0x4eacf)
 #8 0x00007f574987fea5 abort (/lib64/libc.so.6+0x21ea5)
 #9 0x00007f574987fd79 _nl_load_domain.cold.0 (/lib64/libc.so.6+0x21d79)
#10 0x00007f57498a5426 (/lib64/libc.so.6+0x47426)
#11 0x000055722ee648c8 decltype(auto) llvm::cast<clang::ento::NonLoc, clang::ento::SVal>(clang::ento::SVal const&) /home/hjiang/workspace/llvm-community/llvm/include/llvm/Support/Casting.h:567:43
#12 0x000055722ee645e5 clang::ento::NonLoc clang::ento::SVal::castAs<clang::ento::NonLoc>() const /home/hjiang/workspace/llvm-community/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h:82:51
#13 0x000055722fa6dc32 clang::ento::StoreManager::getLValueElement(clang::QualType, clang::ento::NonLoc, clang::ento::SVal) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/Store.cpp:475:52
#14 0x000055722f1c50a8 clang::ento::ProgramState::getLValue(clang::QualType, clang::ento::SVal, clang::ento::SVal) const /home/hjiang/workspace/llvm-community/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h:789:40
#15 0x000055722f966a04 clang::ento::ExprEngine::VisitArraySubscriptExpr(clang::ArraySubscriptExpr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:3340:23
#16 0x000055722f9617af clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:2065:12
#17 0x000055722f95e8c9 clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*, clang::ento::ExplodedNode*) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:1132:9
#18 0x000055722f95e5dd clang::ento::ExprEngine::processCFGElement(clang::CFGElement, clang::ento::ExplodedNode*, unsigned int, clang::ento::NodeBuilderContext*) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:976:7
#19 0x000055722f92a27f clang::ento::CoreEngine::HandlePostStmt(clang::CFGBlock const*, unsigned int, clang::ento::ExplodedNode*) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:486:1
#20 0x000055722f929a40 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:223:1
#21 0x000055722f9296b7 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>)::$_0::operator()(unsigned int) const /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:140:5
#22 0x000055722f9293c3 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:163:29
#23 0x000055722edbf824 clang::ento::ExprEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int) /home/hjiang/workspace/llvm-community/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h:192:19
#24 0x000055722edb6fb3 (anonymous namespace)::AnalysisConsumer::RunPathSensitiveChecks(clang::Decl*, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*, void>>*) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:729:7
#25 0x000055722edb6afe (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl*, unsigned int, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*, void>>*) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:700:15
#26 0x000055722ed38e08 (anonymous namespace)::AnalysisConsumer::HandleDeclsCallGraph(unsigned int) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:490:31
#27 0x000055722ed37adc (anonymous namespace)::AnalysisConsumer::runAnalysisOnTranslationUnit(clang::ASTContext&) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:0:5
#28 0x000055722ed3758e (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) /home/hjiang/workspace/llvm-community/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:613:3
#29 0x000055722faadeb9 clang::ParseAST(clang::Sema&, bool, bool) /home/hjiang/workspace/llvm-community/clang/lib/Parse/ParseAST.cpp:183:12
#30 0x000055722c7376e1 clang::ASTFrontendAction::ExecuteAction() /home/hjiang/workspace/llvm-community/clang/lib/Frontend/FrontendAction.cpp:1194:1
#31 0x000055722c7370fc clang::FrontendAction::Execute() /home/hjiang/workspace/llvm-community/clang/lib/Frontend/FrontendAction.cpp:1082:7
#32 0x000055722c65560a clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /home/hjiang/workspace/llvm-community/clang/lib/Frontend/CompilerInstance.cpp:1061:23
#33 0x000055722c910107 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /home/hjiang/workspace/llvm-community/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:280:8
#34 0x00005572274f1d91 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /home/hjiang/workspace/llvm-community/clang/tools/driver/cc1_main.cpp:232:13
#35 0x00005572274e49b2 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) /home/hjiang/workspace/llvm-community/clang/tools/driver/driver.cpp:215:5
#36 0x00005572274e545d clang_main(int, char**, llvm::ToolContext const&)::$_0::operator()(llvm::SmallVectorImpl<char const*>&) const /home/hjiang/workspace/llvm-community/clang/tools/driver/driver.cpp:355:7
#37 0x00005572274e542d int llvm::function_ref<int (llvm::SmallVectorImpl<char const*>&)>::callback_fn<clang_main(int, char**, llvm::ToolContext const&)::$_0>(long, llvm::SmallVectorImpl<char const*>&) /home/hjiang/workspace/llvm-community/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:5
#38 0x000055722c4d9f71 llvm::function_ref<int (llvm::SmallVectorImpl<char const*>&)>::operator()(llvm::SmallVectorImpl<char const*>&) const /home/hjiang/workspace/llvm-community/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:5
#39 0x000055722c4d6c48 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::$_0::operator()() const /home/hjiang/workspace/llvm-community/clang/lib/Driver/Job.cpp:440:34
#40 0x000055722c4d6c15 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::$_0>(long) /home/hjiang/workspace/llvm-community/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:5
#41 0x0000557229f3cb79 llvm::function_ref<void ()>::operator()() const /home/hjiang/workspace/llvm-community/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:5
#42 0x000055722b1915da llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) /home/hjiang/workspace/llvm-community/llvm/lib/Support/CrashRecoveryContext.cpp:427:3
#43 0x000055722c4d65ab clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const /home/hjiang/workspace/llvm-community/clang/lib/Driver/Job.cpp:440:7
#44 0x000055722c472e4a clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const /home/hjiang/workspace/llvm-community/clang/lib/Driver/Compilation.cpp:199:15
#45 0x000055722c473057 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const /home/hjiang/workspace/llvm-community/clang/lib/Driver/Compilation.cpp:253:13
#46 0x000055722c48d5d2 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) /home/hjiang/workspace/llvm-community/clang/lib/Driver/Driver.cpp:1942:7
#47 0x00005572274e448b clang_main(int, char**, llvm::ToolContext const&) /home/hjiang/workspace/llvm-community/clang/tools/driver/driver.cpp:391:9
#48 0x0000557227516195 main /home/hjiang/workspace/llvm-community/build/Debug/tools/clang/tools/driver/clang-driver.cpp:17:3
#49 0x00007f5749898d85 __libc_start_main (/lib64/libc.so.6+0x3ad85)
#50 0x00005572274e31ae _start (/home/hjiang/workspace/llvm-community/build/Debug/bin/clang+0x82011ae)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)
clang version 19.0.0git (git@github.com:mustartt/llvm-project.git 53061eecdbd9ffc77a43f85b6c4e145a242a27a4)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/hjiang/workspace/llvm-community/build/Debug/bin
Build config: +unoptimized, +assertions

[ormris]

@mustartt Thanks! Would appreciate a fix for this, if you have the time. I'm really not familiar with this tool at all.

[steakhal]

The reinterpret cast crashes can be tricky. I remember we have a couple of cases in the backlog already.
I'll try to get back to this problem later this week.

[pskrgag]

From my analysis, this is caused by the fact that whole array is used as index. In such case, Offset in getLValueElement has type NonLocLazyCompoundValKind.
During evaluating array subscript, Offset gets passed to evalCast(val, ArrayIndexTy, QualType{}); which ends up in VisitLazyCompoundVal, which returns UnknownVal. And then UnknownVal casts to NoLoc which is obviously invalid.

This lazy value is created at RegionStoreManager::getBindingForArray while evaluating BuiltinBitCastExpr.

Since we cannot model array -> int casts, I think, the best we could do is to catch such cases and return UnknownVal directly

diff --git a/clang/lib/StaticAnalyzer/Core/Store.cpp b/clang/lib/StaticAnalyzer/Core/Store.cpp
index 67ca61bb56ba..01c4ee8252f2 100644
--- a/clang/lib/StaticAnalyzer/Core/Store.cpp
+++ b/clang/lib/StaticAnalyzer/Core/Store.cpp
@@ -472,7 +472,19 @@ SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
   const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);
 
   // Convert the offset to the appropriate size and signedness.
-  Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
+  auto Off = svalBuilder.convertToArrayIndex(Offset).getAs<NonLoc>();
+  if (!Off) {
+    // Handle cases when LazyCompoundVal is used for an array index.
+    // Such case is possible when doing:
+    //
+    //   char b[4];
+    //   __builtin_bitcast(int, b);
+    //
+    // Return UnknownVal, since we cannot model it.
+    return UnknownVal();
+  }
+
+  Offset = Off.value();
 
   if (!ElemR) {
     // If the base region is not an ElementRegion, create one.

[steakhal]

From my analysis, this is caused by the fact that whole array is used as index. In such case, Offset in getLValueElement has type NonLocLazyCompoundValKind.
During evaluating array subscript, Offset gets passed to evalCast(val, ArrayIndexTy, QualType{}); which ends up in VisitLazyCompoundVal, which returns UnknownVal. And then UnknownVal casts to NoLoc which is obviously invalid.

This lazy value is created at RegionStoreManager::getBindingForArray while evaluating BuiltinBitCastExpr.

Since we cannot model array -> int casts, I think, the best we could do is to catch such cases and return UnknownVal directly

diff --git a/clang/lib/StaticAnalyzer/Core/Store.cpp b/clang/lib/StaticAnalyzer/Core/Store.cpp
index 67ca61bb56ba..01c4ee8252f2 100644
--- a/clang/lib/StaticAnalyzer/Core/Store.cpp
+++ b/clang/lib/StaticAnalyzer/Core/Store.cpp
@@ -472,7 +472,19 @@ SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
   const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);
 
   // Convert the offset to the appropriate size and signedness.
-  Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
+  auto Off = svalBuilder.convertToArrayIndex(Offset).getAs<NonLoc>();
+  if (!Off) {
+    // Handle cases when LazyCompoundVal is used for an array index.
+    // Such case is possible when doing:
+    //
+    //   char b[4];
+    //   __builtin_bitcast(int, b);
+    //
+    // Return UnknownVal, since we cannot model it.
+    return UnknownVal();
+  }
+
+  Offset = Off.value();
 
   if (!ElemR) {
     // If the base region is not an ElementRegion, create one.

It makes sense to me. Good job on tracking this down.