Handle 'long x = 0; char *y = (char *) x;' by layering an
'ElementRegion' on top of the VarRegion for 'x'. This causes the test
case xfail_wine_crash.c to now pass for BasicStoreManager. It doesn't
crash for RegionStoreManager either, but reports a bogus unintialized
value warning.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70832 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Analysis/Store.cpp b/lib/Analysis/Store.cpp
index 65e90de..e9b8f6a 100644
--- a/lib/Analysis/Store.cpp
+++ b/lib/Analysis/Store.cpp
@@ -23,7 +23,7 @@
StoreManager::CastResult
StoreManager::CastRegion(const GRState* state, const MemRegion* R,
- QualType CastToTy) {
+ QualType CastToTy) {
ASTContext& Ctx = StateMgr.getContext();
@@ -38,10 +38,11 @@
return CastResult(state, R);
}
- // Check if we are casting to 'void*'.
- // FIXME: Handle arbitrary upcasts.
- if (const PointerType* PTy = dyn_cast<PointerType>(ToTy.getTypePtr()))
- if (PTy->getPointeeType()->isVoidType()) {
+ if (const PointerType* PTy = dyn_cast<PointerType>(ToTy.getTypePtr())) {
+ // Check if we are casting to 'void*'.
+ // FIXME: Handle arbitrary upcasts.
+ QualType Pointee = PTy->getPointeeType();
+ if (Pointee->isVoidType()) {
// Casts to void* only removes TypedViewRegion. If there is no
// TypedViewRegion, leave the region untouched. This happens when:
@@ -58,6 +59,20 @@
return CastResult(state, R);
}
+ else if (Pointee->isIntegerType()) {
+ // FIXME: At some point, it stands to reason that this 'dyn_cast' should
+ // become a 'cast' and that 'R' will always be a TypedRegion.
+ if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) {
+ // Check if we are casting to a region with an integer type. We now
+ // the types aren't the same, so we construct an ElementRegion.
+ // FIXME: We should have a standard query function to get the size
+ // of the array index.
+ SVal Idx = ValMgr.makeZeroVal(ValMgr.getContext().VoidPtrTy);
+ ElementRegion* ER = MRMgr.getElementRegion(Pointee, Idx, TR);
+ return CastResult(state, ER);
+ }
+ }
+ }
// FIXME: Need to handle arbitrary downcasts.
// FIXME: Handle the case where a TypedViewRegion (layering a SymbolicRegion