If the SymbolicRegion was cast to another type, use that type to create the

ElementRegion.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@73754 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/RegionStore.cpp b/lib/Analysis/RegionStore.cpp
index af8c7c9a9b2dcebb4d7b958a8af4d00a508ee1e7..6f316c9c5921a114bfa7893558263638a3e4d685 100644 (file)
--- a/lib/Analysis/RegionStore.cpp
+++ b/lib/Analysis/RegionStore.cpp
@@ -749,9 +749,15 @@ SVal RegionStoreManager::EvalBinOp(const GRState *state,
   // If the operand is a symbolic or alloca region, create the first element
   // region on it.
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR)) {
-    // Get symbol's type. It should be a pointer type.
-    SymbolRef Sym = SR->getSymbol();
-    QualType T = Sym->getType(getContext());
+    QualType T;
+    // If the SymbolicRegion was cast to another type, use that type.
+    if (const QualType *t = state->get<RegionCasts>(SR)) {
+      T = *t;
+    } else {
+      // Otherwise use the symbol's type.
+      SymbolRef Sym = SR->getSymbol();
+      T = Sym->getType(getContext());
+    }
     QualType EleTy = T->getAsPointerType()->getPointeeType();
 
     SVal ZeroIdx = ValMgr.makeZeroArrayIndex();

diff --git a/test/Analysis/casts.c b/test/Analysis/casts.c
index eac0bd3a0113e0854bc7cf2bf853295b570a26e9..d47184fb5f599c938c10f8c033431d062151395b 100644 (file)
--- a/test/Analysis/casts.c
+++ b/test/Analysis/casts.c
@@ -27,3 +27,12 @@ int f1(struct s **pval) {
   char c = (unsigned char) *tbool; // Should use cast-to type to create symbol.
 }
 
+void f2(const char *str) {
+ unsigned char ch, cl, *p;
+
+ p = (unsigned char *)str;
+ ch = *p++; // use cast-to type 'unsigned char' to create element region.
+ cl = *p++;
+ if(!cl)
+    cl = 'a';
+}