]> granicus.if.org Git - clang/commit
[analyzer] Don't crash if we cache out while evaluating an ObjC message.
authorJordan Rose <jordan_rose@apple.com>
Thu, 6 Sep 2012 23:44:36 +0000 (23:44 +0000)
committerJordan Rose <jordan_rose@apple.com>
Thu, 6 Sep 2012 23:44:36 +0000 (23:44 +0000)
commit5601c9aac3bf7be5e1ea8a76149090933d2d3c78
tree1e389640b021f6e2fef1758e659d40b60321c2a0
parent1edeed3b0fe01fb07a769bd1acc2ce2dc9ec431d
[analyzer] Don't crash if we cache out while evaluating an ObjC message.

A bizarre series of coincidences led us to generate a previously-seen
node in the middle of processing an Objective-C message, where we assume
the receiver is non-nil. We were assuming that such an assumption would
never "cache out" like this, and blithely went on using a null ExplodedNode
as the predecessor for the next step in evaluation.

Although the test case committed here is complicated, this could in theory
happen in other ways as well, so the correct fix is just to test if the
non-nil assumption results in an ExplodedNode we've seen before.

<rdar://problem/12243648>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163361 91177308-0d34-0410-b5e6-96231b3b80d8
lib/StaticAnalyzer/Core/ExprEngineObjC.cpp
test/Analysis/retain-release-crashes.m [new file with mode: 0644]