Fix #12861 Hang in valueFlowCondition() with huge array

Author: clock999

lib/token.cpp

@@ -1451,7 +1451,9 @@ void Token::astOperand1(Token *tok)
         mImpl->mAstOperand1->astParent(nullptr);
     // goto parent operator
     if (tok) {
-        tok = tok->astTop();
+        while (tok->mImpl->mAstParent) {
+            tok = tok->mImpl->mAstParent;
+        }
         tok->astParent(this);
     }
     mImpl->mAstOperand1 = tok;
@@ -1463,7 +1465,9 @@ void Token::astOperand2(Token *tok)
         mImpl->mAstOperand2->astParent(nullptr);
     // goto parent operator
     if (tok) {
-        tok = tok->astTop();
+        while (tok->mImpl->mAstParent) {
+            tok = tok->mImpl->mAstParent;
+        }
         tok->astParent(this);
     }
     mImpl->mAstOperand2 = tok;

lib/token.h

@@ -117,6 +117,7 @@ class CPPCHECKLIB Token {
         Token* mAstOperand1{};
         Token* mAstOperand2{};
         Token* mAstParent{};
+        Token* mAstTop{};
 
         // symbol database information
         const Scope* mScope{};
@@ -400,6 +401,9 @@ class CPPCHECKLIB Token {
                                         mTokType == eBoolean || mTokType == eLiteral || mTokType == eEnumerator);
         setFlag(fIsLiteral, memoizedIsLiteral);
     }
+    bool isTopSet() const {
+        return mImpl->mAstTop != nullptr;
+    }
     bool isKeyword() const {
         return mTokType == eKeyword;
     }
@@ -1557,6 +1561,11 @@ class CPPCHECKLIB Token {
      * @throws InternalError thrown on cyclic dependency
      */
     void astParent(Token* tok);
+    void astTop(Token * tok) {
+        if (tok) {
+            mImpl->mAstTop = tok;
+        }
+    }
 
     Token * astOperand1() {
         return mImpl->mAstOperand1;
@@ -1597,13 +1606,19 @@ class CPPCHECKLIB Token {
 
     }
     RET_NONNULL Token *astTop() {
+        if (mImpl->mAstTop) {
+            return mImpl->mAstTop;
+        }
         Token *ret = this;
         while (ret->mImpl->mAstParent)
             ret = ret->mImpl->mAstParent;
         return ret;
     }
 
     RET_NONNULL const Token *astTop() const {
+        if (mImpl->mAstTop) {
+            return mImpl->mAstTop;
+        }
         const Token *ret = this;
         while (ret->mImpl->mAstParent)
             ret = ret->mImpl->mAstParent;

lib/tokenlist.cpp

@@ -1745,8 +1745,13 @@ static Token * createAstAtToken(Token *tok)
             semicolon1->astOperand2(state2.op.top());
         }
 
-        if (init != semicolon1)
-            semicolon1->astOperand1(init->astTop());
+        if (init != semicolon1) {
+            Token * top = init;
+            while (top->astParent()) {
+                top = top->astParent();
+            }
+            semicolon1->astOperand1(top);
+        }
         tok->next()->astOperand1(tok);
         tok->next()->astOperand2(semicolon1);
 
@@ -1860,6 +1865,36 @@ void TokenList::createAst() const
             throw InternalError(tok, "Syntax Error: Infinite loop when creating AST.", InternalError::AST);
         tok = nextTok;
     }
+    for (Token *tok = mTokensFrontBack->front; tok; tok = tok ? tok->next() : nullptr) {
+        if ((tok->astOperand1() || tok->astOperand2()) && (!tok->isTopSet())) {
+            Token * top = tok;
+            while (top->astParent()) {
+                top = top->astParent();
+            }
+            std::list<Token *> current_list;
+            std::list<Token *> back_list;
+            current_list.push_back(top);
+
+            for (auto it = current_list.begin(); it != current_list.end();) {
+                Token * op1 = (*it)->astOperand1();
+                Token * op2 = (*it)->astOperand2();
+                if (op1) {
+                    back_list.push_back(op1);
+                    op1->astTop(top);
+                }
+                if (op2) {
+                    back_list.push_back(op2);
+                    op2->astTop(top);
+                }
+                ++it;
+                if (it == current_list.end() && back_list.size() > 0) {
+                    current_list = back_list;
+                    it = current_list.begin();
+                    back_list.clear();
+                }
+            }
+        }
+    }
 }
 
 namespace {