SymbolicRegions may also be live roots.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70380 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/RegionStore.cpp b/lib/Analysis/RegionStore.cpp
index 7a78036ec06fa68e1346699b62994afd6cdf9140..aeb8a2ac8f86a9fb04052732fd1294bc9da04e32 100644 (file)
--- a/lib/Analysis/RegionStore.cpp
+++ b/lib/Analysis/RegionStore.cpp
@@ -912,6 +912,10 @@ Store RegionStoreManager::RemoveDeadBindings(const GRState* state, Stmt* Loc,
     if (const VarRegion* VR = dyn_cast<VarRegion>(R)) {
       if (SymReaper.isLive(Loc, VR->getDecl()))
         RegionRoots.push_back(VR); // This is a live "root".
+    } 
+    else if (const SymbolicRegion* SR = dyn_cast<SymbolicRegion>(R)) {
+      if (SymReaper.isLive(SR->getSymbol()))
+        RegionRoots.push_back(SR);
     }
     else {
       // Get the super region for R.

diff --git a/test/Analysis/null-deref-ps-region.c b/test/Analysis/null-deref-ps-region.c
new file mode 100644 (file)
index 0000000..80a5f92
--- /dev/null
+++ b/test/Analysis/null-deref-ps-region.c
@@ -0,0 +1,14 @@
+// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -analyzer-store=region -verify %s
+
+
+// The store for 'a[1]' should not be removed mistakenly. SymbolicRegions may
+// also be live roots.
+void f14(int *a) {
+  int i;
+  a[1] = 1;
+  i = a[1];
+  if (i != 1) {
+    int *p = 0;
+    i = *p; // no-warning
+  }
+}