Having RegionStore lower field bindings to raw offsets, just like ElementRegions...

disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values
as structs.  Fixes <rdar://problem/11405978>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156428 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Core/RegionStore.cpp b/lib/StaticAnalyzer/Core/RegionStore.cpp
index bf79b9da0b760d4cdd9565957e538f592ee93e4d..8b1371d28f1aa0a18e10b68455c4d82a32da333d 100644 (file)
--- a/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -81,14 +81,9 @@ public:
 } // end anonymous namespace
 
 BindingKey BindingKey::Make(const MemRegion *R, Kind k) {
-  if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
-    const RegionRawOffset &O = ER->getAsArrayOffset();
-
-    // FIXME: There are some ElementRegions for which we cannot compute
-    // raw offsets yet, including regions with symbolic offsets. These will be
-    // ignored by the store.
-    return BindingKey(O.getRegion(), O.getOffset().getQuantity(), k);
-  }
+  const RegionOffset &RO = R->getAsOffset();
+  if (RO.getRegion())
+    return BindingKey(RO.getRegion(), RO.getOffset(), k);
 
   return BindingKey(R, 0, k);
 }
@@ -648,7 +643,7 @@ void invalidateRegionsWorker::VisitBinding(SVal V) {
 
     for (RegionBindings::iterator RI = B.begin(), RE = B.end(); RI != RE; ++RI){
       const SubRegion *baseR = dyn_cast<SubRegion>(RI.getKey().getRegion());
-      if (baseR && baseR->isSubRegionOf(LazyR))
+      if (baseR && (baseR == LazyR || baseR->isSubRegionOf(LazyR)))
         VisitBinding(RI.getData());
     }
 

diff --git a/test/Analysis/misc-ps-arm.m b/test/Analysis/misc-ps-arm.m
new file mode 100644 (file)
index 0000000..a909ef1
--- /dev/null
+++ b/test/Analysis/misc-ps-arm.m
@@ -0,0 +1,18 @@
+// RUN: %clang_cc1 -triple thumbv7-apple-ios0.0.0 -analyze -analyzer-checker=core -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks -Wno-objc-root-class %s
+
+// <rdar://problem/11405978> - Handle casts of vectors to structs, and loading
+// a value.
+typedef float float32_t;
+typedef __attribute__((neon_vector_type(2))) float32_t float32x2_t;
+
+typedef struct
+{
+    float x, y;
+} Rdar11405978Vec;
+    
+float32x2_t rdar11405978_bar();
+float32_t rdar11405978() {
+  float32x2_t v = rdar11405978_bar();
+  Rdar11405978Vec w = *(Rdar11405978Vec *)&v;
+  return w.x; // no-warning
+}

diff --git a/test/Analysis/taint-tester.c b/test/Analysis/taint-tester.c
index 377333505e183790f6250462187dfdaf0f2fcca1..a83ee32baca893f6a83e5df5c63ef0d6b9004fd8 100644 (file)
--- a/test/Analysis/taint-tester.c
+++ b/test/Analysis/taint-tester.c
@@ -40,7 +40,7 @@ void taintTracking(int x) {
   // FIXME: We fail to propagate the taint here because RegionStore does not
   // handle ElementRegions with symbolic indexes.
   int addrDeref = *addr; // expected-warning + {{tainted}}
-  int _addrDeref = addrDeref;
+  int _addrDeref = addrDeref; // expected-warning + {{tainted}}
 
   // Tainted struct address, casts.
   struct XYStruct *xyPtr = 0;