[all-commits] [llvm/llvm-project] df5801: [analyzer] Get direct binding for specific punned ...

[vabridgers via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: df5801806d03c22099c85942134ca3004776016b
      https://github.com/llvm/llvm-project/commit/df5801806d03c22099c85942134ca3004776016b
  Author: einvbri <vince.a.bridgers at ericsson.com>
  Date:   2022-05-05 (Thu, 05 May 2022)

  Changed paths:
    M clang/lib/StaticAnalyzer/Core/RegionStore.cpp
    A clang/test/Analysis/array-punned-region.c

  Log Message:
  -----------
  [analyzer] Get direct binding for specific punned case

Region store was not able to see through this case to the actual
initialized value of STRUCT ff. This change addresses this case by
getting the direct binding. This was found and debugged in a downstream
compiler, with debug guidance from @steakhal. A positive and negative
test case is added.

The specific case where this issue was exposed.

  typedef struct {
    int a:1;
    int b[2];
  } STRUCT;

  int main() {
    STRUCT ff = {0};
    STRUCT* pff = &ff;
    int a = ((int)pff + 1);
    return a;
  }

Reviewed By: steakhal, martong

Differential Revision: https://reviews.llvm.org/D124349