r269572 - Warn when a reference is bound to an empty l-value (dereferenced null pointer).

[Nick Lewycky via cfe-commits]

Hans Wennborg wrote:
> On Sat, May 14, 2016 at 10:44 AM, Nick Lewycky via cfe-commits
> <cfe-commits at lists.llvm.org>  wrote:
>>
>> Author: nicholas
>> Date: Sat May 14 12:44:14 2016
>> New Revision: 269572
>>
>> URL: http://llvm.org/viewvc/llvm-project?rev=269572&view=rev
>> Log:
>> Warn when a reference is bound to an empty l-value (dereferenced null pointer).
>
> Could this be made to handle return values too? The warning fired on
> some code in pdfium, and nearby I found this:
>
>    TYPE&  ElementAt(int nIndex) {
>      if (nIndex<  0 || nIndex>= m_nSize) {
>        return *(TYPE*)NULL;<-- Ooops
>      }
>      return ((TYPE*)m_pData)[nIndex];
>    }
>
> where the warning doesn't fire.

That looks like a bug, we should already catch that case:

   int &test1() {
     return *(int*)nullptr;
   }
   struct TYPE {};
   TYPE &test2() {
     return *(TYPE*)nullptr;
   }

   clang ref.cc -std=c++11
   ref.cc:2:10: warning: binding dereferenced null pointer to reference has
         undefined behavior [-Wnull-dereference]
     return *(int*)nullptr;
            ^~~~~~~~~~~~~~
   ref.cc:6:10: warning: binding dereferenced null pointer to reference has
       undefined behavior [-Wnull-dereference]
     return *(TYPE*)nullptr;
            ^~~~~~~~~~~~~~~
   2 warnings generated.

Could you produce a testcase for it?

Nick