[PATCH] D82185: [Analyzer][WIP] Handle pointer implemented as iterators in iterator checkers

[Balogh, Ádám via Phabricator via cfe-commits]

baloghadamsoftware marked an inline comment as done.
baloghadamsoftware added inline comments.


================
Comment at: clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp:256
+  SVal SubVal = State->getSVal(UO->getSubExpr(), C.getLocationContext());
+  SVal Result = State->getSVal(UO, C.getLocationContext());
+
----------------
baloghadamsoftware wrote:
> This is the problematic point which is not working. I left the comments intentionally in the code.
> 
> The problem is that in `postStmt` we are //after//  the operation. Thus the value of the operand (`SubExpr`) is not `i` anymore, but the //former value// of `i` (a pointer to a symbolic region initially). Instead, the result is `i` in case of prefix operators, but also the former value in case of postfix operators. This is correct, of course, because here, after the call the value of `i` was changed, thus it is not equal to the parameter. However, we need the region of `i` here and/or the new value bound to it (e.g. the pointer to an element region which is usually the result of a `++` or `--` on a pointer to a symbolic region). How to reach that? Of course, in `preStmt` the operand is `i` as it should be. The same is true for binary operators `+=` and `-=`. 
Of course, I know it is all wrong to increment the //former// value. This is also not the goal, probably I cannot reuse `handleIncrement()` and the like here. The question is how to get the region of the variable or even better the //new// region (e.g. the pointer to element region) bound to it? In the prefix case I have the variable, but is there a generic way to get the region bound to it? By generic I mean that I hope that I do not have to branch on all possible lvalue expressions.


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D82185/new/

https://reviews.llvm.org/D82185