[cfe-dev] [analyzer] What do I need to pay attention to when I convert 'CastToStructChecker' from AST-based check to path-sensitive check?

[Henry Wong via cfe-dev]

Answer myself.

I have encountered some problems in the process of implementation, one of the problems comes from CastExpr with 'CK_BaseToDerived' kind.

For the 'CK_BaseToDerived', analyzer try dynamic cast first, then return if successful, otherwise fall back to the conservative approach.
-----------------------------------------------------------------
Base B;
Derived *D = (Derived*)&B; // dynamic cast fail, conjure a symbol
// should emit a warning
D->mem = 0; // checkLocation() can't track the original region from 'SymRegion{conj_$0{struct Derived *} '
-----------------------------------------------------------------

Henry Wong
Qihoo 360 Codesafe Team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20180509/ef679947/attachment.html>