Fix: <rdar://problem/7249340> [RegionStore] model stores to symbolic parameter regions
The issue was a discrepancy between how RegionStoreManager::Bind() and
RegionStoreManager::Retrieve() derived the "key" for the first element
of a symbolic region.
llvm-svn: 82680
diff --git a/clang/lib/Analysis/RegionStore.cpp b/clang/lib/Analysis/RegionStore.cpp
index b54fa272..31f52a5 100644
--- a/clang/lib/Analysis/RegionStore.cpp
+++ b/clang/lib/Analysis/RegionStore.cpp
@@ -315,6 +315,9 @@
const GRState *state,
const TypedRegion *R);
+ const ElementRegion *GetElementZeroRegion(const SymbolicRegion *SR,
+ QualType T);
+
//===------------------------------------------------------------------===//
// State pruning.
//===------------------------------------------------------------------===//
@@ -857,6 +860,16 @@
return true;
}
+const ElementRegion *
+RegionStoreManager::GetElementZeroRegion(const SymbolicRegion *SR, QualType T) {
+ ASTContext &Ctx = getContext();
+ SVal idx = ValMgr.makeZeroArrayIndex();
+ assert(!T.isNull());
+ return MRMgr.getElementRegion(T, idx, SR, Ctx);
+}
+
+
+
SValuator::CastResult
RegionStoreManager::Retrieve(const GRState *state, Loc L, QualType T) {
@@ -879,12 +892,8 @@
if (isa<AllocaRegion>(MR))
return SValuator::CastResult(state, UnknownVal());
- if (isa<SymbolicRegion>(MR)) {
- ASTContext &Ctx = getContext();
- SVal idx = ValMgr.makeZeroArrayIndex();
- assert(!T.isNull());
- MR = MRMgr.getElementRegion(T, idx, MR, Ctx);
- }
+ if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
+ MR = GetElementZeroRegion(SR, T);
if (isa<CodeTextRegion>(MR))
return SValuator::CastResult(state, UnknownVal());
@@ -1309,6 +1318,13 @@
}
}
}
+ else if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
+ // Binding directly to a symbolic region should be treated as binding
+ // to element 0.
+ QualType T = SR->getSymbol()->getType(getContext());
+ T = cast<PointerType>(T)->getPointeeType();
+ R = GetElementZeroRegion(SR, T);
+ }
// Perform the binding.
RegionBindings B = GetRegionBindings(state->getStore());