<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Hello, Aitor. I'm afraid you're still getting SVals, symbols, and MemRegions somewhat mixed up. They are not interchangeable. Have you watched our presentation on writing a checker yet? (Linked here: <a href="http://clang-analyzer.llvm.org/checker_dev_manual.html">http://clang-analyzer.llvm.org/checker_dev_manual.html</a>) I'm sorry it's not really incorporated into the rest of the Checker Development Manual, but the video is probably still the clearest introduction to analyzer core concepts that we have.</div><div><br></div><div><br></div><div><blockquote type="cite"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;"><div dir="ltr">1) To test if Loc is a MemRegionVal I use the following, but there's something wrong I can't figure out (it doesn't compile), and I'm stuck (as far as I know, MemRegionVal is a subclass of SVal):<br><br><span style="font-family: 'courier new', monospace;">if (clang::isa<loc::MemRegionVal></span><span style="font-family: 'courier new', monospace;">(Loc)) ...</span><span style="font-family: arial, helvetica, sans-serif;"><br></span><span style="font-family: 'courier new', monospace;"></span></div></blockquote></div></div></blockquote><div><br></div><div><div>This is a bit mundane—you can only use isa<> on pointers and references, but SVals are passed around by value. As you discovered, you can use getAs.</div></div><div><br></div><div><blockquote type="cite"><div dir="ltr"><div><div><span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;">SymbolRef sym = L->getAsLocSymbol();<br></span></span></div><span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;"></span></span><span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;">SymbolRef sym = VLoc.getAsLocSymbol();<br></span></span></div><span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;"></span></span><span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;">SymbolRef sym = VLoc.getAsSymbol()</span></span>;<br><div></div></div></blockquote></div><div><br></div><div>The second one will handle everything the first one handles, as well as locations cast to integer values (like "(intptr_t)&x"). The last one will also give you back symbols for non-location values. But not all memory regions are based on symbols (a local variable does not need a symbol), and of course not all symbolic values are memory regions (the result of random() is an integer).</div><div><br></div><br><blockquote type="cite"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;"><div dir="ltr"><span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;">2) ElementRegion doesn't belong to the SVal class hierarchy</span></span>. <span style="font-family: 'courier new', monospace;"><span style="font-family: arial, helvetica, sans-serif;">How can I know if Loc is an ElementRegin?</span></span></div></blockquote></div></div></blockquote><br></div><div>That's not really a good question. What you really want to know is if a given location is within a constant string region. That's a much simpler question.</div><div><br></div><div>// Does this value represent the address of a region?</div><div>const MemRegion *MR = V.getAsRegion();</div><div>if (!MR)</div><div> return;</div><div><br></div><div>bool isString = isa<StringRegion>(MR->getBaseRegion());</div><div><br></div><div>This isn't going to cover <i>all</i> use cases, but it does cover this one much more nicely than trying to pattern-match on ElementRegion.</div><div><br></div><div>(Finally, of course, -fconst-strings is a much safer way to handle this kind of issue, but that doesn't help if you have an existing codebase.)</div><div><br></div><div>Jordan</div><div><br></div></body></html>