[cfe-dev] [PATCH] GRExprEngine bug

[Zhongxing Xu]

The patch is simple:

Index: lib/Analysis/GRExprEngine.cpp
===================================================================
--- lib/Analysis/GRExprEngine.cpp    （版本 51366）
+++ lib/Analysis/GRExprEngine.cpp    （工作副本）
@@ -1596,7 +1596,7 @@
         if (asLVal)
           MakeNode(Dst, U, *I, SetRVal(St, U, location));
         else
-          EvalLoad(Dst, Ex, *I, St, location);
+          EvalLoad(Dst, U, *I, St, location);
       }

       return;

Test case:

int foo(void) {
  int i;
  int *p = &i;
  if (*p > 0)
    return 0;
  else
    return 1;
}

Before patch:
no warning

After patch:
ANALYZE: 2.c foo
2.c:4:3: warning: [CHECKER] Branch condition evaluates to an uninitialized
value.
  if (*p > 0)
  ^   ~~
1 diagnostic generated.

Reason:
The loaded value should be set to the UnaryOperator *p, but not its subexpr
p.

Note:
This patch is very likely incomplete. GRExprEngine::EvalLoad() might also be
modified. Ted should do better than me.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20080521/d9f2c0fe/attachment.html>