Fix crash ElementRegion::getRValueType() when the RvalueType of the ArrayRegion is...

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62909 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/MemRegion.cpp b/lib/Analysis/MemRegion.cpp
index 2724ed0ada2283fe74d67ac40059c0dc6b6a7247..55c6935b8e85e9d82e2fbe0e6c8252d530854b1b 100644 (file)
--- a/lib/Analysis/MemRegion.cpp
+++ b/lib/Analysis/MemRegion.cpp
@@ -108,17 +108,14 @@ void ElementRegion::Profile(llvm::FoldingSetNodeID& ID) const {
 }
 
 QualType ElementRegion::getRValueType(ASTContext& C) const {
-  QualType T = getArrayRegion()->getRValueType(C);
+  // Strip off typedefs from the ArrayRegion's RvalueType.
+  QualType T = getArrayRegion()->getRValueType(C)->getDesugaredType();
 
-  if (isa<ArrayType>(T.getTypePtr())) {
-    ArrayType* AT = cast<ArrayType>(T.getTypePtr());
+  if (ArrayType* AT = dyn_cast<ArrayType>(T.getTypePtr()))
     return AT->getElementType();
-  }
-  else {
-    PointerType* PtrT = cast<PointerType>(T.getTypePtr());
-    QualType PTy = PtrT->getPointeeType();
-    return C.getCanonicalType(PTy);
-  }
+
+  PointerType* PtrT = cast<PointerType>(T.getTypePtr());
+  return C.getCanonicalType(PtrT->getPointeeType());
 }
 
 //===----------------------------------------------------------------------===//

diff --git a/test/Analysis/exercise-ps.c b/test/Analysis/exercise-ps.c
index 6d58e92c31f2e16e18d78c1ba9ae8b63ce2a2bb7..4aaba8e8dd053c2c97bc6998491cdfccf937085a 100644 (file)
--- a/test/Analysis/exercise-ps.c
+++ b/test/Analysis/exercise-ps.c
@@ -2,7 +2,8 @@
 // RUN: clang -analyze -checker-cfref -analyzer-store-basic -verify %s &&
 // RUN: clang -analyze -checker-cfref -analyzer-store-region -verify %s
 //
-// Just exercise the analyzer (no assertions).
+// Just exercise the analyzer on code that has at one point caused issues
+// (i.e., no assertions or crashes).
 
 
 static const char * f1(const char *x, char *y) {
@@ -10,3 +11,14 @@ static const char * f1(const char *x, char *y) {
     *y++ = *x++;
   }
 }
+
+// This following case checks that we properly handle typedefs when getting
+// the RvalueType of an ElementRegion.
+typedef struct F12_struct {} F12_typedef;
+typedef void* void_typedef;
+void_typedef f2_helper();
+static void f2(void *buf) {
+  F12_typedef* x;
+  x = f2_helper();
+  memcpy((&x[1]), (buf), 1);
+}