[cfe-commits] [PATCH] Fix for PR7218, and analyzer support for calloc()

[Zhongxing Xu]

On Mon, May 31, 2010 at 6:03 AM, Ted Kremenek <kremenek at apple.com> wrote:

>
> On May 30, 2010, at 12:46 AM, Jordy Rose wrote:
>
> > Binding a symbolic region whose type is a reference shows up when the
> > reference is an argument, like so:
> >
> > char t3 (char& r) {
> >  r = 'c';
> >  if (r) return r;
> >  return '0';
> > }
> >
> > The reason for the SymbolicRegion section in canHaveDirectBinding(),
> > though, was originally more about having a way to set default values by
> > taking advantages of a fact about SymbolicRegions (if you're accessing
> them
> > directly, it's either *p or a reference, or an explicit call to Bind()),
> > not enforcing a rule.
>
> I don't binding directly to the SymbolicRegion is the right way to handle
> references.  In this case, I'd expect 'r' to evaluate to:
>
>  ElementRegion(SymbolicRegion, "char", 0)
>
> and then the binding at:
>
>  r = 'c'
>
> binds to the ElementRegion.  There's no reason to special case references.
>  Indeed, we should be treating them just as pointers.  Consider:
>
>  int *p = 0;
>  int &q = *p;
>  q = 1;
>
> At the assignment to 'q' we still need do a null check, an out-of-bounds
> check, etc.
>
>
>
I agree to this reasoning.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20100531/fe268cbe/attachment.html>