<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Dec 14, 2008, at 11:30 AM, Zhongxing Xu wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><blockquote class="gmail_quote" style="border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); margin-top: 0pt; margin-right: 0pt; margin-bottom: 0pt; margin-left: 0.8ex; padding-left: 1ex; "><br>- // Add a RegionView to base region.<br>- return std::make_pair(AddRegionView(St, TR, AR), loc::MemRegionVal(ER));<br>+StoreManager::CastResult<br>+RegionStoreManager::CastRegion(const GRState* state, const MemRegion* R,<br>+ QualType CastToTy) {<br>+<br>+ // Return the same region if the region types are compatible.<br>+ if (const TypedRegion* TR = dyn_cast<TypedRegion>(R)) {<br>+ ASTContext& Ctx = StateMgr.getContext();<br>+ QualType Ta = Ctx.getCanonicalType(TR->getLValueType(Ctx));<br>+ QualType Tb = Ctx.getCanonicalType(CastToTy);<br>+<br>+ if (Ta == Tb)<br>+ return CastResult(state, R);<br> }<br>-<br>- // Default case.<br>- return std::make_pair(St, UnknownVal());<br>+<br>+ const MemRegion* ViewR = MRMgr.getAnonTypedRegion(CastToTy, R);<br>+ return CastResult(AddRegionView(state, ViewR, R), ViewR);<br> }<br></blockquote><div><br>Hi Ted,<br><br>Here we still wish to return an ElementRegion instead of a raw AnonTypedRegion. Consider this code:<br><br>char* p = alloca(10); // after this expression, p is expected to be a pointer to the first element of the array.<br>p[0] = 'a';<br><br>p is expected to have ElementRegion location value in RegionStoreManager::getLValueElement().<span class="Apple-converted-space"> </span><br></div></span><br class="Apple-interchange-newline"></blockquote></div><br><div>I'm not convinced. Fundamentally why should an untyped region be assumed to a be a pointer to an array before the moment it is actually *used* as an array? An untyped pointer could easily be a pointer to a single object.</div><div><br></div><div>Consider:</div><div><br></div><div><div> void* p = alloca(4);</div><div> ((int*) p)[0] = 4;</div><div><br></div><div>The ast dump for these two statements is:</div><div><br></div><div><div>(CompoundStmt 0x1027263a0 <stack-addr-ps.c:44:21, line:47:1></div><div> (DeclStmt 0x1027260c0 <line:45:3></div><div> 0x102725fa0 "void *p =</div><div> (CallExpr 0x1027261a0 </usr/include/alloca.h:44:24, col:45> 'void *'</div><div> (ImplicitCastExpr 0x102726090 <col:24> 'void *(*)(unsigned long)'</div><div> (DeclRefExpr 0x102725ed0 <col:24> 'void *(unsigned long)' FunctionDecl='__builtin_alloca' 0x102725bc0))</div><div> (ImplicitCastExpr 0x1027261d0 <stack-addr-ps.c:45:20> 'unsigned long'</div><div> (IntegerLiteral 0x102726050 <col:20> 'int' 4)))"</div><div> (BinaryOperator 0x102726360 <line:46:3, col:19> 'int' '='</div><div> (ArraySubscriptExpr 0x1027262e0 <col:3, col:15> 'int'</div><div> (ParenExpr 0x102726270 <col:3, col:12> 'int *'</div><div> (CStyleCastExpr 0x102726230 <col:4, col:11> 'int *'</div><div> (DeclRefExpr 0x102726200 <col:11> 'void *' Var='p' 0x102725fa0)))</div><div> (IntegerLiteral 0x1027262a0 <col:14> 'int' 0))</div><div> (IntegerLiteral 0x102726320 <col:19> 'int' 4)))</div><div><br></div><div>It seems to me that when handling 'ArraySubscriptExpr' we can layer an 'ElementRegion' at the zero-index for the base. The logic in GRExprEngine that handles ArraySubscriptExpr can call a "ConvertPointerToArray" in StoreManager to "convert" the base to whatever the StoreManager desires for handling arrays.</div><div><br></div><div>Having a callout function for this also allows the StoreManager to know what is going on (i.e., a pointer is now being used as an array) and do some extra checking for finding bugs.</div></div></div></body></html>