[cfe-commits] r161051 - in /cfe/trunk: lib/StaticAnalyzer/Core/ExprEngine.cpp test/Analysis/reference.cpp
Jordan Rose
jordan_rose at apple.com
Tue Jul 31 09:34:07 PDT 2012
Author: jrose
Date: Tue Jul 31 11:34:07 2012
New Revision: 161051
URL: http://llvm.org/viewvc/llvm-project?rev=161051&view=rev
Log:
[analyzer] Getting an lvalue for a reference field still requires a load.
This was causing a crash in our array-to-pointer logic, since the region
was clearly not an array.
PR13440 / <rdar://problem/11977113>
Modified:
cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp
cfe/trunk/test/Analysis/reference.cpp
Modified: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp?rev=161051&r1=161050&r2=161051&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp Tue Jul 31 11:34:07 2012
@@ -1522,10 +1522,17 @@
// For all other cases, compute an lvalue.
SVal L = state->getLValue(field, baseExprVal);
- if (M->isGLValue())
+ if (M->isGLValue()) {
+ if (field->getType()->isReferenceType()) {
+ if (const MemRegion *R = L.getAsRegion())
+ L = state->getSVal(R);
+ else
+ L = UnknownVal();
+ }
+
Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, L), false, 0,
ProgramPoint::PostLValueKind);
- else {
+ } else {
Bldr.takeNodes(Pred);
evalLoad(Dst, M, M, Pred, state, L);
Bldr.addNodes(Dst);
Modified: cfe/trunk/test/Analysis/reference.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/reference.cpp?rev=161051&r1=161050&r2=161051&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/reference.cpp (original)
+++ cfe/trunk/test/Analysis/reference.cpp Tue Jul 31 11:34:07 2012
@@ -1,4 +1,6 @@
-// RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.core -analyzer-store=region -analyzer-constraints=range -verify -Wno-null-dereference %s
+// RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.core,debug.ExprInspection -analyzer-store=region -analyzer-constraints=range -verify -Wno-null-dereference %s
+
+void clang_analyzer_eval(bool);
typedef typeof(sizeof(int)) size_t;
void malloc (size_t);
@@ -55,3 +57,36 @@
if (*p) return *p;
return *(char*)0; // no-warning
}
+
+
+// PR13440 / <rdar://problem/11977113>
+// Test that the array-to-pointer decay works for array references as well.
+// More generally, when we want an lvalue for a reference field, we still need
+// to do one level of load.
+namespace PR13440 {
+ typedef int T[1];
+ struct S {
+ T &x;
+
+ int *m() { return x; }
+ };
+
+ struct S2 {
+ int (&x)[1];
+
+ int *m() { return x; }
+ };
+
+ void test() {
+ int a[1];
+ S s = { a };
+ S2 s2 = { a };
+
+ if (s.x != a) return;
+ if (s2.x != a) return;
+
+ a[0] = 42;
+ clang_analyzer_eval(s.x[0] == 42); // expected-warning{{TRUE}}
+ clang_analyzer_eval(s2.x[0] == 42); // expected-warning{{TRUE}}
+ }
+}
More information about the cfe-commits
mailing list