Fix bug in BasicStore::getLValueElement where if the base of an array subscript expression was an ElementRegion we stacked another ElementRegion on top of that.
This fixes PR 3422.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63110 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Analysis/BasicStore.cpp b/lib/Analysis/BasicStore.cpp
index a36a239..2feea59 100644
--- a/lib/Analysis/BasicStore.cpp
+++ b/lib/Analysis/BasicStore.cpp
@@ -203,7 +203,6 @@
SVal BasicStoreManager::getLValueElement(const GRState* St, SVal Base,
SVal Offset) {
-
if (Base.isUnknownOrUndef())
return Base;
@@ -233,6 +232,17 @@
case loc::MemRegionKind: {
const MemRegion *R = cast<loc::MemRegionVal>(BaseL).getRegion();
+
+ if (isa<ElementRegion>(R)) {
+ // Basic example:
+ // char buf[100];
+ // char *q = &buf[1]; // p points to ElementRegion(buf,Unknown)
+ // &q[10]
+ assert(cast<ElementRegion>(R)->getIndex().isUnknown());
+ return Base;
+ }
+
+
if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) {
BaseR = TR;
break;
@@ -244,7 +254,7 @@
break;
}
-
+
case loc::ConcreteIntKind:
// While these seem funny, this can happen through casts.
// FIXME: What we should return is the field offset. For example,
diff --git a/test/Analysis/misc-ps.m b/test/Analysis/misc-ps.m
index f221f8b..4e7f0ad 100644
--- a/test/Analysis/misc-ps.m
+++ b/test/Analysis/misc-ps.m
@@ -100,3 +100,11 @@
*p = 1; // no-warning
}
+// PR 3422
+void pr3422_helper(char *p);
+void pr3422() {
+ char buf[100];
+ char *q = &buf[10];
+ pr3422_helper(&q[1]);
+}
+