[PATCH] D124349: [analyzer] Get direct binding for specific punned case

[Gabor Marton via Phabricator via cfe-commits]

martong added a comment.

Can we have a test for this, got idea from here (https://stackoverflow.com/questions/4129961/how-is-the-size-of-a-struct-with-bit-fields-determined-measured)

  typedef struct
  {
          unsigned int a:1;
          unsigned int x:31;
          unsigned int c:1;
          int b[2];
  } mystruct;
  ...
  ff.b[0] = 3;
  clang_analyzer_eval(*((int *)pff + 2) == 3); // expected-warning{{TRUE}}  // Or should this be `pff + 3` ???



================
Comment at: clang/test/Analysis/array-struct-region.c:1
 // RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core,debug.ExprInspection -verify -analyzer-config eagerly-assume=false %s
 
----------------
Should we pin the target, shouldn't we?


================
Comment at: clang/test/Analysis/array-struct-region.c:365
+  BITFIELD_CAST *pff = &ff;
+  clang_analyzer_eval(*((int *)pff + 1) == 0); // expected-warning{{TRUE}}
+  ff.b[0] = 3;
----------------
My gut feeling is that we should pin the target  for these arithmetics.


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D124349/new/

https://reviews.llvm.org/D124349