[PATCH] [analyzer] Fix handling of "empty" structs with base classes

[Pavel Labath]

Hi jordan_rose,

RegionStoreManager had an optimization which references to empty structs with
UnknownVal. Unfortunately, this check didn't take into account possible field
members in base classes.

To address this, I changed this test to "is empty and has no base classes". I
don't consider it worth the trouble to go through base classes and check if all
of them are empty.

http://llvm-reviews.chandlerc.com/D1547

Files:
  lib/StaticAnalyzer/Core/RegionStore.cpp
  test/Analysis/array-struct-region.cpp

Index: lib/StaticAnalyzer/Core/RegionStore.cpp
===================================================================
--- lib/StaticAnalyzer/Core/RegionStore.cpp
+++ lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -1832,10 +1832,18 @@
   return svalBuilder.makeLazyCompoundVal(StoreRef(B.asStore(), *this), R);
 }
 
+static bool isRecordEmpty(const RecordDecl *RD) {
+  if (!RD->field_empty())
+    return false;
+  if (const CXXRecordDecl *CRD = dyn_cast<CXXRecordDecl>(RD))
+    return CRD->getNumBases() == 0;
+  return true;
+}
+
 SVal RegionStoreManager::getBindingForStruct(RegionBindingsConstRef B,
                                              const TypedValueRegion *R) {
   const RecordDecl *RD = R->getValueType()->castAs<RecordType>()->getDecl();
-  if (RD->field_empty())
+  if (isRecordEmpty(RD))
     return UnknownVal();
 
   return createLazyBinding(B, R);
Index: test/Analysis/array-struct-region.cpp
===================================================================
--- test/Analysis/array-struct-region.cpp
+++ test/Analysis/array-struct-region.cpp
@@ -173,4 +173,27 @@
   clang_analyzer_eval(getConstrainedFieldRefOp(getS()) == 42); // expected-warning{{TRUE}}
 }
 
+namespace EmptyClass {
+  struct Base {
+    int& x;
+
+    Base(int& x) : x(x) {}
+  };
+
+  struct Derived : public Base {
+    Derived(int& x) : Base(x) {}
+
+    void operator=(int a) { x = a; }
+  };
+
+  Derived ref(int& a) { return Derived(a); }
+
+  // There used to be a warning here, because analyzer treated Derived as empty.
+  int test() {
+    int a;
+    ref(a) = 42;
+    return a; // no warning
+  }
+}
+
 #endif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D1547.1.patch
Type: text/x-patch
Size: 1612 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20130829/6eee3a46/attachment.bin>