r177205 - [analyzer] BugReporterVisitors: handle the case where a ternary operator is wrapped in a cast.

[Anna Zaks]

Author: zaks
Date: Fri Mar 15 18:34:25 2013
New Revision: 177205

URL: http://llvm.org/viewvc/llvm-project?rev=177205&view=rev
Log:
[analyzer] BugReporterVisitors: handle the case where a ternary operator is wrapped in a cast.

Modified:
    cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
    cfe/trunk/test/Analysis/inlining/false-positive-suppression.c

Modified: cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp?rev=177205&r1=177204&r2=177205&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp Fri Mar 15 18:34:25 2013
@@ -787,14 +787,17 @@ bool bugreporter::trackNullOrUndefValue(
     S = OVE->getSourceExpr();
 
   // Peel off the ternary operator.
-  if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(S)) {
-    ProgramStateRef State = N->getState();
-    SVal CondVal = State->getSVal(CO->getCond(), N->getLocationContext());
-    if (State->isNull(CondVal).isConstrainedTrue()) {
-      S = CO->getTrueExpr();
-    } else {
-      assert(State->isNull(CondVal).isConstrainedFalse());
-      S =  CO->getFalseExpr();
+  if (const Expr *Ex = dyn_cast<Expr>(S)) {
+    Ex = Ex->IgnoreParenCasts();
+    if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(Ex)) {
+      ProgramStateRef State = N->getState();
+      SVal CondVal = State->getSVal(CO->getCond(), N->getLocationContext());
+      if (State->isNull(CondVal).isConstrainedTrue()) {
+        S = CO->getTrueExpr();
+      } else {
+        assert(State->isNull(CondVal).isConstrainedFalse());
+        S =  CO->getFalseExpr();
+      }
     }
   }
 

Modified: cfe/trunk/test/Analysis/inlining/false-positive-suppression.c
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/inlining/false-positive-suppression.c?rev=177205&r1=177204&r2=177205&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/inlining/false-positive-suppression.c (original)
+++ cfe/trunk/test/Analysis/inlining/false-positive-suppression.c Fri Mar 15 18:34:25 2013
@@ -202,6 +202,17 @@ void ternaryArg(char cond) {
 	derefArg(cond ? &x : getNull());
 }
 
+int derefArgCast(char *p) {
+	return *p;
+#ifndef SUPPRESSED
+  // expected-warning at -2 {{Dereference of null pointer}}
+#endif
+}
+void ternaryArgCast(char cond) {
+	static int x;
+	derefArgCast((char*)((unsigned)cond ? &x : getNull()));
+}
+
 int derefAssignment(int *p) {
 	return *p;
 #ifndef SUPPRESSED