[cfe-commits] r163066 - in /cfe/trunk: include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h lib/StaticAnalyzer/Core/RegionStore.cpp lib/StaticAnalyzer/Core/SymbolManager.cpp test/Analysis/array-struct-region.cpp test/Analysis/reference.cpp

[Ted Kremenek]

On Sep 1, 2012, at 10:39 AM, Jordan Rose <jordan_rose at apple.com> wrote:

> Author: jrose
> Date: Sat Sep  1 12:39:09 2012
> New Revision: 163066
> 
> URL: http://llvm.org/viewvc/llvm-project?rev=163066&view=rev
> Log:
> [analyzer] Treat all struct values as regions (even rvalues).
> 
> This allows us to correctly symbolicate the fields of structs returned by
> value, as well as get the proper 'this' value for when methods are called
> on structs returned by value.
> 
> This does require a moderately ugly hack in the StoreManager: if we assign
> a "struct value" to a struct region, that now appears as a Loc value being
> bound to a region of struct type. We handle this by simply "dereferencing"
> the struct value region, which should create a LazyCompoundVal.
> 
> This should fix recent crashes analyzing LLVM and on our internal buildbot.
> 
> <rdar://problem/12137950>
> 

<snip>

> Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h
> URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h?rev=163066&r1=163065&r2=163066&view=diff
> ==============================================================================
> --- cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h (original)
> +++ cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h Sat Sep  1 12:39:09 2012
> @@ -246,8 +246,16 @@
>   }
> 
>   static inline bool isLocType(QualType T) {
> +    // Why are record types included here? Because we want to make sure a
> +    // record, even a record rvalue, is always represented with a region.
> +    // This is especially necessary in C++, where you can call methods on
> +    // struct prvalues, which then need to have a valid 'this' pointer.
> +    //
> +    // This necessitates a bit of extra hackery in the Store to deal with
> +    // the case of binding a "struct value" into a struct region; in
> +    // practice it just means "dereferencing" the value before binding.
>     return T->isAnyPointerType() || T->isBlockPointerType() || 
> -           T->isReferenceType();
> +           T->isReferenceType() || T->isRecordType();
>   }
> };

Should this also include union types?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20120904/a4dc1df8/attachment.html>