r269572 - Warn when a reference is bound to an empty l-value (dereferenced null pointer).

[Hans Wennborg via cfe-commits]

On Mon, May 16, 2016 at 10:03 AM, Nick Lewycky <nicholas at mxc.ca> wrote:
> Hans Wennborg wrote:
>>
>> On Sat, May 14, 2016 at 10:44 AM, Nick Lewycky via cfe-commits
>> <cfe-commits at lists.llvm.org>  wrote:
>>>
>>>
>>> Author: nicholas
>>> Date: Sat May 14 12:44:14 2016
>>> New Revision: 269572
>>>
>>> URL: http://llvm.org/viewvc/llvm-project?rev=269572&view=rev
>>> Log:
>>> Warn when a reference is bound to an empty l-value (dereferenced null
>>> pointer).
>>
>>
>> Could this be made to handle return values too? The warning fired on
>> some code in pdfium, and nearby I found this:
>>
>>    TYPE&  ElementAt(int nIndex) {
>>      if (nIndex<  0 || nIndex>= m_nSize) {
>>        return *(TYPE*)NULL;<-- Ooops
>>      }
>>      return ((TYPE*)m_pData)[nIndex];
>>    }
>>
>> where the warning doesn't fire.
>
>
> That looks like a bug, we should already catch that case:
>
>   int &test1() {
>     return *(int*)nullptr;
>   }
>   struct TYPE {};
>   TYPE &test2() {
>     return *(TYPE*)nullptr;
>   }
>
>   clang ref.cc -std=c++11
>   ref.cc:2:10: warning: binding dereferenced null pointer to reference has
>         undefined behavior [-Wnull-dereference]
>     return *(int*)nullptr;
>            ^~~~~~~~~~~~~~
>   ref.cc:6:10: warning: binding dereferenced null pointer to reference has
>       undefined behavior [-Wnull-dereference]
>     return *(TYPE*)nullptr;
>            ^~~~~~~~~~~~~~~
>   2 warnings generated.
>
> Could you produce a testcase for it?

D'oh, the code I was looking at is a template. As it turns out, it's
never actually used, which I suppose is why there was no diagnostic.
If I instantiate it, the warning works fine.

 - Hans