[cfe-commits] r163269 - in /cfe/trunk: include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp lib/StaticAnalyzer/Core/BugReporterVisitors.cpp test/Analysis/diagnostics/deref-track-symbolic-region.cpp

[Anna Zaks]

Author: zaks
Date: Wed Sep  5 18:41:54 2012
New Revision: 163269

URL: http://llvm.org/viewvc/llvm-project?rev=163269&view=rev
Log:
[analyzer] Enhance the member expr tracking to account for references.

As per Jordan's suggestion. (Came out of code review for r163261.)

Added:
    cfe/trunk/test/Analysis/diagnostics/deref-track-symbolic-region.cpp
Modified:
    cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h
    cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
    cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h?rev=163269&r1=163268&r2=163269&view=diff
==============================================================================
--- cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h (original)
+++ cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h Wed Sep  5 18:41:54 2012
@@ -256,6 +256,8 @@
 const Stmt *GetDerefExpr(const ExplodedNode *N);
 const Stmt *GetDenomExpr(const ExplodedNode *N);
 const Stmt *GetRetValExpr(const ExplodedNode *N);
+bool isDeclRefExprToReference(const Expr *E);
+
 
 } // end namespace clang
 } // end namespace ento

Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp?rev=163269&r1=163268&r2=163269&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp Wed Sep  5 18:41:54 2012
@@ -130,7 +130,7 @@
   }
   case Stmt::MemberExprClass: {
     const MemberExpr *M = cast<MemberExpr>(S);
-    if (M->isArrow()) {
+    if (M->isArrow() || bugreporter::isDeclRefExprToReference(M->getBase())) {
       llvm::raw_svector_ostream os(buf);
       os << "Access to field '" << M->getMemberNameInfo()
          << "' results in a dereference of a null pointer";

Modified: cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp?rev=163269&r1=163268&r2=163269&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp Wed Sep  5 18:41:54 2012
@@ -31,6 +31,13 @@
 // Utility functions.
 //===----------------------------------------------------------------------===//
 
+bool bugreporter::isDeclRefExprToReference(const Expr *E) {
+  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) {
+    return DRE->getDecl()->getType()->isReferenceType();
+  }
+  return false;
+}
+
 const Stmt *bugreporter::GetDerefExpr(const ExplodedNode *N) {
   // Pattern match for a few useful cases (do something smarter later):
   //   a[0], p->f, *p
@@ -54,7 +61,7 @@
         return U->getSubExpr()->IgnoreParenCasts();
     }
     else if (const MemberExpr *ME = dyn_cast<MemberExpr>(S)) {
-      if (ME->isArrow()) {
+      if (ME->isArrow() || isDeclRefExprToReference(ME->getBase())) {
         return ME->getBase()->IgnoreParenCasts();
       }
     }

Added: cfe/trunk/test/Analysis/diagnostics/deref-track-symbolic-region.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/diagnostics/deref-track-symbolic-region.cpp?rev=163269&view=auto
==============================================================================
--- cfe/trunk/test/Analysis/diagnostics/deref-track-symbolic-region.cpp (added)
+++ cfe/trunk/test/Analysis/diagnostics/deref-track-symbolic-region.cpp Wed Sep  5 18:41:54 2012
@@ -0,0 +1,16 @@
+// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-output=text -verify %s
+
+struct S {
+  int *x;
+  int y;
+};
+
+S &getSomeReference();
+void test(S *p) {
+  S &r = *p;   //expected-note {{Variable 'r' initialized here}}
+  if (p) return;
+               //expected-note at -1{{Taking false branch}}
+               //expected-note at -2{{Assuming pointer value is null}}
+  r.y = 5; // expected-warning {{Access to field 'y' results in a dereference of a null pointer (loaded from variable 'r')}}
+           // expected-note at -1{{Access to field 'y' results in a dereference of a null pointer (loaded from variable 'r')}}
+}