r177137 - [analyzer] Teach trackNullOrUndef to look through ternary operators

[Anna Zaks]

Author: zaks
Date: Thu Mar 14 20:15:12 2013
New Revision: 177137

URL: http://llvm.org/viewvc/llvm-project?rev=177137&view=rev
Log:
[analyzer] Teach trackNullOrUndef to look through ternary operators

Allows the suppression visitors trigger more often.

Modified:
    cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
    cfe/trunk/test/Analysis/inlining/false-positive-suppression.c

Modified: cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp?rev=177137&r1=177136&r2=177137&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp Thu Mar 14 20:15:12 2013
@@ -772,16 +772,27 @@ static const MemRegion *getLocationRegio
   return 0;
 }
 
-bool bugreporter::trackNullOrUndefValue(const ExplodedNode *ErrorNode,
+bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N,
                                         const Stmt *S,
                                         BugReport &report, bool IsArg) {
-  if (!S || !ErrorNode)
+  if (!S || !N)
     return false;
 
+  // Peel off OpaqueValueExpr.
   if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(S))
     S = OVE->getSourceExpr();
 
-  const ExplodedNode *N = ErrorNode;
+  // Peel off the ternary operator.
+  if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(S)) {
+    ProgramStateRef State = N->getState();
+    SVal CondVal = State->getSVal(CO->getCond(), N->getLocationContext());
+    if (State->isNull(CondVal).isConstrainedTrue()) {
+      S = CO->getTrueExpr();
+    } else {
+      assert(State->isNull(CondVal).isConstrainedFalse());
+      S =  CO->getFalseExpr();
+    }
+  }
 
   const Expr *Inner = 0;
   if (const Expr *Ex = dyn_cast<Expr>(S)) {

Modified: cfe/trunk/test/Analysis/inlining/false-positive-suppression.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/inlining/false-positive-suppression.c?rev=177137&r1=177136&r2=177137&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/inlining/false-positive-suppression.c (original)
+++ cfe/trunk/test/Analysis/inlining/false-positive-suppression.c Thu Mar 14 20:15:12 2013
@@ -191,3 +191,39 @@ void testAlwaysReturnNull(void *input) {
 #endif
 }
 
+int derefArg(int *p) {
+	return *p;
+#ifndef SUPPRESSED
+  // expected-warning at -2 {{Dereference of null pointer}}
+#endif
+}
+void ternaryArg(char cond) {
+	static int x;
+	derefArg(cond ? &x : getNull());
+}
+
+int derefAssignment(int *p) {
+	return *p;
+#ifndef SUPPRESSED
+  // expected-warning at -2 {{Dereference of null pointer}}
+#endif
+}
+void ternaryAssignment(char cond) {
+  static int x;
+  int *p = cond ? &x : getNull();
+  derefAssignment(p);
+}
+
+int *retNull(char cond) {
+  static int x;
+  return cond ? &x : getNull();
+}
+int ternaryRetNull(char cond) {
+  int *p = retNull(cond);
+  return *p;
+#ifndef SUPPRESSED
+  // expected-warning at -2 {{Dereference of null pointer}}
+#endif
+}
+
+