[PATCH] Fix for LValueReference cast segfault in Consumed.cpp

[Chris Wailes]

Hi dblaikie, delesley, aaron.ballman,

Fix for bugs 17632 and 17724.

The isLValueReferenceType function checks to see if the QualType's canonical type is an LValueReferenceType, and not if the QualType itself is an LValueReferenceType.  This caused a segfault when trying to cast the QualType's Type to a LValueReferenceType.  This is now fixed by casting the result of getCanonicalType().

In addition, a test was added to isConsumableType to prevent segfaults when a type being tested by the analysis is a reference to a pointer or a pointer to a reference.

Link to bugs:
http://llvm.org/bugs/show_bug.cgi?id=17632
http://llvm.org/bugs/show_bug.cgi?id=17724

http://llvm-reviews.chandlerc.com/D2065

Files:
  lib/Analysis/Consumed.cpp

Index: lib/Analysis/Consumed.cpp
===================================================================
--- lib/Analysis/Consumed.cpp
+++ lib/Analysis/Consumed.cpp
@@ -142,10 +142,13 @@
 }
 
 static bool isConsumableType(const QualType &QT) {
+  if (QT->isPointerType() || QT->isReferenceType())
+    return false;
+  
   if (const CXXRecordDecl *RD = QT->getAsCXXRecordDecl())
     return RD->hasAttr<ConsumableAttr>();
-  else
-    return false;
+  
+  return false;
 }
 
 static bool isKnownState(ConsumedState State) {
@@ -163,7 +166,8 @@
 static bool isRValueRefish(QualType ParamType) {
   return ParamType->isRValueReferenceType() ||
         (ParamType->isLValueReferenceType() &&
-         !cast<LValueReferenceType>(*ParamType).isSpelledAsLValue());
+         !cast<LValueReferenceType>(
+           ParamType.getCanonicalType())->isSpelledAsLValue());
 }
 
 static bool isTestingFunction(const FunctionDecl *FunDecl) {
@@ -864,7 +868,7 @@
     const ParamTypestateAttr *PTAttr = Param->getAttr<ParamTypestateAttr>();
     ParamState = mapParamTypestateAttrState(PTAttr);
     
-  } else if (isValueType(ParamType) && isConsumableType(ParamType)) {
+  } else if (isConsumableType(ParamType)) {
     ParamState = mapConsumableAttrState(ParamType);
     
   } else if (isRValueRefish(ParamType) &&
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D2065.1.patch
Type: text/x-patch
Size: 1303 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20131030/bf743214/attachment.bin>