Added special handling for UninitializedVals for the transfer function logic
for pointer dereferences.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47340 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/Analysis/GRExprEngine.cpp b/Analysis/GRExprEngine.cpp
index d1a0d4c..ef3664e 100644
--- a/Analysis/GRExprEngine.cpp
+++ b/Analysis/GRExprEngine.cpp
@@ -642,6 +642,17 @@
const RValue& V = GetValue(St, U->getSubExpr());
const LValue& L1 = cast<LValue>(V);
+ if (isa<UninitializedVal>(L1)) {
+ NodeTy* N = Builder->generateNode(U, St, N1);
+
+ if (N) {
+ N->markAsSink();
+ UninitDeref.insert(N);
+ }
+
+ return;
+ }
+
// After a dereference, one of two possible situations arise:
// (1) A crash, because the pointer was NULL.
// (2) The pointer is not NULL, and the dereference works.
@@ -776,6 +787,11 @@
break;
}
+ if (isa<UninitializedVal>(V2)) {
+ Nodify(Dst, B, N2, SetValue(SetValue(St, B, V2), L1, V2));
+ break;
+ }
+
RValue Result = cast<NonLValue>(UnknownVal());
if (Op >= BinaryOperator::AndAssign)
@@ -1232,6 +1248,7 @@
if (GraphPrintCheckerState->isImplicitNullDeref(N) ||
GraphPrintCheckerState->isExplicitNullDeref(N) ||
+ GraphPrintCheckerState->isUninitDeref(N) ||
GraphPrintCheckerState->isUninitStore(N) ||
GraphPrintCheckerState->isUninitControlFlow(N))
return "color=\"red\",style=\"filled\"";
@@ -1268,6 +1285,9 @@
else if (GraphPrintCheckerState->isExplicitNullDeref(N)) {
Out << "\\|Explicit-Null Dereference.\\l";
}
+ else if (GraphPrintCheckerState->isUninitDeref(N)) {
+ Out << "\\|Dereference of uninitialied value.\\l";
+ }
else if (GraphPrintCheckerState->isUninitStore(N)) {
Out << "\\|Store to Uninitialized LValue.";
}