[cfe-commits] r155615 - in /cfe/trunk: lib/StaticAnalyzer/Core/RegionStore.cpp test/Analysis/malloc.c

[Ted Kremenek]

Author: kremenek
Date: Thu Apr 26 00:08:26 2012
New Revision: 155615

URL: http://llvm.org/viewvc/llvm-project?rev=155615&view=rev
Log:
[analyzer] check lazy bindings in RegionStore first before looking for default values.  Fixes <rdar://problem/11269741>.

Modified:
    cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp
    cfe/trunk/test/Analysis/malloc.c

Modified: cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp?rev=155615&r1=155614&r2=155615&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/RegionStore.cpp Thu Apr 26 00:08:26 2012
@@ -1274,7 +1274,15 @@
   // At this point we have already checked in either getBindingForElement or
   // getBindingForField if 'R' has a direct binding.
   RegionBindings B = GetRegionBindings(store);
+
+  // Lazy binding?
+  Store lazyBindingStore = NULL;
+  const MemRegion *lazyBindingRegion = NULL;
+  llvm::tie(lazyBindingStore, lazyBindingRegion) = GetLazyBinding(B, R, R);
   
+  if (lazyBindingRegion)
+    return getLazyBinding(lazyBindingRegion, lazyBindingStore);
+
   // Record whether or not we see a symbolic index.  That can completely
   // be out of scope of our lookup.
   bool hasSymbolicIndex = false;
@@ -1299,14 +1307,6 @@
     break;
   }
 
-  // Lazy binding?
-  Store lazyBindingStore = NULL;
-  const MemRegion *lazyBindingRegion = NULL;
-  llvm::tie(lazyBindingStore, lazyBindingRegion) = GetLazyBinding(B, R, R);
-
-  if (lazyBindingRegion)
-    return getLazyBinding(lazyBindingRegion, lazyBindingStore);
-
   if (R->hasStackNonParametersStorage()) {
     if (isa<ElementRegion>(R)) {
       // Currently we don't reason specially about Clang-style vectors.  Check

Modified: cfe/trunk/test/Analysis/malloc.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/malloc.c?rev=155615&r1=155614&r2=155615&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/malloc.c (original)
+++ cfe/trunk/test/Analysis/malloc.c Thu Apr 26 00:08:26 2012
@@ -760,6 +760,22 @@
     return;
 }
 
+// <rdar://problem/11269741> Previously this triggered a false positive
+// because malloc() is known to return uninitialized memory and the binding
+// of 'o' to 'p->n' was not getting propertly handled.  Now we report a leak.
+struct rdar11269741_a_t {
+  struct rdar11269741_b_t {
+    int m;
+  } n;
+};
+
+int rdar11269741(struct rdar11269741_b_t o)
+{
+  struct rdar11269741_a_t *p = (struct rdar11269741_a_t *) malloc(sizeof(*p));
+  p->n = o;
+  return p->n.m; // expected-warning {{leak}}
+}
+
 // ----------------------------------------------------------------------------
 // Below are the known false positives.