<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 30, 2010, at 3:03 PM, Ted Kremenek wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><br>On May 30, 2010, at 12:46 AM, Jordy Rose wrote:<br><br><blockquote type="cite">Binding a symbolic region whose type is a reference shows up when the<br></blockquote><blockquote type="cite">reference is an argument, like so:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">char t3 (char& r) {<br></blockquote><blockquote type="cite"> r = 'c';<br></blockquote><blockquote type="cite"> if (r) return r;<br></blockquote><blockquote type="cite"> return '0';<br></blockquote><blockquote type="cite">}<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">The reason for the SymbolicRegion section in canHaveDirectBinding(),<br></blockquote><blockquote type="cite">though, was originally more about having a way to set default values by<br></blockquote><blockquote type="cite">taking advantages of a fact about SymbolicRegions (if you're accessing them<br></blockquote><blockquote type="cite">directly, it's either *p or a reference, or an explicit call to Bind()),<br></blockquote><blockquote type="cite">not enforcing a rule.<br></blockquote><br>I don't binding directly to the SymbolicRegion is the right way to handle references. In this case, I'd expect 'r' to evaluate to:<br><br> ElementRegion(SymbolicRegion, "char", 0)<br><br>and then the binding at:<br><br> r = 'c'<br><br>binds to the ElementRegion. There's no reason to special case references. Indeed, we should be treating them just as pointers. Consider:<br><br> int *p = 0;<br> int &q = *p;<br> q = 1;<br><br>At the assignment to 'q' we still need do a null check, an out-of-bounds check, etc.<br><br><br></div></blockquote></div><br><div>I should add that I'm originally the one who added the code that did the wrong thing:</div><div><br></div><div> <a href="http://llvm.org/viewvc/llvm-project?view=rev&revision=91501">http://llvm.org/viewvc/llvm-project?view=rev&revision=91501</a></div><div><br></div><div>As for the code snippet in PR 7218:</div><div><span class="Apple-style-span" style="font-family: Verdana, sans-serif; font-size: small; -webkit-border-horizontal-spacing: 1px; -webkit-border-vertical-spacing: 1px; "><pre class="bz_comment_text" id="comment_text_0" style="font-size: medium; font-family: monospace; white-space: pre-wrap; width: 50em; "> char broken (char a) {
char buf[2];
buf[0] = a;
return buf[1]; // should warn but does not
}</pre><pre class="bz_comment_text" id="comment_text_0" style="font-size: medium; font-family: monospace; white-space: pre-wrap; width: 50em; ">This should be fixed by detecting if we are going outside the bounds of the memory block. I don't think this requires changing the binding model in RegionStoreManager.</pre></span><div><br></div></div></body></html>