[cfe-commits] r161051 - in /cfe/trunk: lib/StaticAnalyzer/Core/ExprEngine.cpp test/Analysis/reference.cpp

[Jordan Rose]

>>   // For all other cases, compute an lvalue.    
>>   SVal L = state->getLValue(field, baseExprVal);
>> -  if (M->isGLValue())
>> +  if (M->isGLValue()) {
>> +    if (field->getType()->isReferenceType()) {
>> +      if (const MemRegion *R = L.getAsRegion())
>> +        L = state->getSVal(R);
>> +      else
>> +        L = UnknownVal();
>> +    }
> 
> This could be factored out somewhere. There other places where we add same special handling of references. Ex in the same source file:
> // For references, the 'lvalue' is the pointer address stored in the
>     // reference region.
>     if (VD->getType()->isReferenceType()) {
>       if (const MemRegion *R = V.getAsRegion())
>         V = state->getSVal(R);
>       else
>         V = UnknownVal();
>     }

That's where I got it from. ;-) The part that makes this particularly odd is really in both cases we should probably be doing an evalLoad (to check the validity of the reference location, not its contents) and we aren't. I'll check back on this today.

Jordan