[analyzer] Don't try to simplify mixed Loc/NonLoc expressions.

This fix is similar to r337769 and addresses a regression caused by r337167.

When an operation between a nonloc::LocAsInteger and a non-pointer symbol
is performed, the LocAsInteger-specific part of information is lost.
When the non-pointer symbol is collapsing into a constant, we cannot easily
re-evaluate the result, because we need to recover the missing
LocAsInteger-specific information (eg., integer type, or the very fact that
this pointer was at some point converted to an integer).

Add one more defensive check to prevent crashes on trying to simplify a
SymSymExpr with different Loc-ness of operands.

Differential Revision: 


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@338420 91177308-0d34-0410-b5e6-96231b3b80d8

2 files changed, 18 insertions, 0 deletions

diff --git a/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp b/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
index dbbb516441..6509ec30ee 100644
--- a/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
+++ b/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
@@ -1291,6 +1291,17 @@ SVal SimpleSValBuilder::simplifySVal(ProgramStateRef State, SVal V) {
       if (I != Cached.end())
         return I->second;
 
+      // For now don't try to simplify mixed Loc/NonLoc expressions
+      // because they often appear from LocAsInteger operations
+      // and we don't know how to combine a LocAsInteger
+      // with a concrete value.
+      if (Loc::isLocType(S->getLHS()->getType()) !=
+          Loc::isLocType(S->getRHS()->getType())) {
+        SVal V = SVB.makeSymbolVal(S);
+        Cached[S] = V;
+        return V;
+      }
+
       SVal LHS = Visit(S->getLHS());
       SVal RHS = Visit(S->getRHS());
       if (isUnchanged(S->getLHS(), LHS) && isUnchanged(S->getRHS(), RHS)) {
diff --git a/test/Analysis/casts.c b/test/Analysis/casts.c
index eccb67812a..86fb7da58e 100644
--- a/test/Analysis/casts.c
+++ b/test/Analysis/casts.c
@@ -175,3 +175,10 @@ void testCastVoidPtrToIntPtrThroughUIntTypedAssignment() {
 void testLocNonLocSymbolAssume(int a, int *b) {
   if ((int)b < a) {} // no-crash
 }
+
+void testLocNonLocSymbolRemainder(int a, int *b) {
+  int c = ((int)b) % a;
+  if (a == 1) {
+    c += 1;
+  }
+}