[analyzer] GNU __null is a pointer-sized integer, not a pointer. Fixes PR10372.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135294 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Core/ExprEngine.cpp b/lib/StaticAnalyzer/Core/ExprEngine.cpp
index cdf76bfa3ef22009104fef6551855cf403788a0f..ffe5f0b6cdf2b0b9c446a4d53f7c367177dd22e4 100644 (file)
--- a/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -510,7 +510,10 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       break;
 
     case Stmt::GNUNullExprClass: {
-      MakeNode(Dst, S, Pred, GetState(Pred)->BindExpr(S, svalBuilder.makeNull()));
+      // GNU __null is a pointer-width integer, not an actual pointer.
+      const GRState *state = GetState(Pred);
+      state = state->BindExpr(S, svalBuilder.makeIntValWithPtrWidth(0, false));
+      MakeNode(Dst, S, Pred, state);
       break;
     }
 

diff --git a/test/Analysis/nullptr.cpp b/test/Analysis/nullptr.cpp
index b74a5abcdfa4b4942fab89d0dddfcf7345af1b89..6f78baebfe22a48d7d646ea62412f78c5c207424 100644 (file)
--- a/test/Analysis/nullptr.cpp
+++ b/test/Analysis/nullptr.cpp
@@ -39,3 +39,11 @@ void foo4(void) {
     *np = 0;  // no-warning
 }
 
+
+int pr10372(void *& x) {
+  // GNU null is a pointer-sized integer, not a pointer.
+  x = __null;
+  // This used to crash.
+  return __null;
+}
+