[LLVMbugs] [Bug 15893] New: False positive null reference warning in C++ code

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=15893

            Bug ID: 15893
           Summary: False positive null reference warning in C++ code
           Product: clang
           Version: trunk
          Hardware: Macintosh
                OS: MacOS X
            Status: NEW
          Severity: normal
          Priority: P
         Component: Static Analyzer
          Assignee: kremenek at apple.com
          Reporter: bugzilla at jwwalker.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

Overview:

The static analyzer says that a null reference is being returned.  As far as I
can tell, the code cannot do that, though it could throw an exception.


Steps to reproduce:

Analyze this code:

-------------------------
typedef int MySizeType;

class MyArray
{
public:
                    MyArray();
                    ~MyArray();

    int&            operator[]( int index ) { return mArray[ index ]; }

    MySizeType        size() const { return mSize; }
    MySizeType        capacity() const { return mCapacity; }
    void            grow( MySizeType newSize );

private:
    int*            mArray;
    MySizeType        mSize;
    MySizeType        mCapacity;
};

MyArray::MyArray()
    : mArray( NULL )
    , mSize( 0 )
    , mCapacity( 0 )
{
}

MyArray::~MyArray()
{
    delete [] mArray;
}

void    MyArray::grow( MySizeType newSize )
{
    mSize = newSize;
    if (mSize > mCapacity)
    {
        mCapacity = mSize;
        delete [] mArray;
        mArray = new int[ mCapacity ];
    }
}


static void foo( MyArray& outFaces )
{
    outFaces.grow( 4 );

    for ( unsigned int i = 0; i < 4; ++i )
    {
        outFaces[ 0 ] = 1;
    }
}

static void bar()
{
    MyArray xFaces;
    MyArray    facesWithCopies;

    foo( facesWithCopies );

    const unsigned int kNumFaces = facesWithCopies.size();

    xFaces.grow( kNumFaces );

    if (kNumFaces > 0)
    {
        xFaces[0] = 0;
    }
}
-------------------------


Actual results:

warning: Returning null reference
pointing to the line of code xFaces[0] = 0.


Expected results:

No warning.


Build date:

clang version 3.3 (trunk 180897)
Target: x86_64-apple-darwin11.4.2
Thread model: posix


Additional information:

If I change the first line to

typedef unsigned int MySizeType;

then the warning goes away.  I can see that it's probably a good idea to
represent a size with an unsigned type, but I don't understand what Clang is
complaining about in this particular case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130502/e09f0d47/attachment.html>