Fix regression in StoreManager::CastRegion() to always treat casts to

'void*' (or 'const void*') as an identity transformation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@77860 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/Store.cpp b/lib/Analysis/Store.cpp
index bfcb0f41ca31627d076543c3f001a50248c9c660..fca69e69cb38530e4e3258c0e3e81179f9e6ffd9 100644 (file)
--- a/lib/Analysis/Store.cpp
+++ b/lib/Analysis/Store.cpp
@@ -71,13 +71,17 @@ StoreManager::CastRegion(const GRState *state, const MemRegion* R,
   // Now assume we are casting from pointer to pointer. Other cases should
   // already be handled.
   QualType PointeeTy = CastToTy->getAs<PointerType>()->getPointeeType();
+  QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
+
+  // Handle casts to void*.  We just pass the region through.
+  if (CanonPointeeTy.getUnqualifiedType() == Ctx.VoidTy)
+    return CastResult(state, R);
   
-  // Handle casts from compatible types or to void*.
+  // Handle casts from compatible types.
   if (R->isBoundable())
     if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) {
       QualType ObjTy = Ctx.getCanonicalType(TR->getValueType(Ctx));
-      QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
-      if (CanonPointeeTy == ObjTy || CanonPointeeTy == Ctx.VoidTy)
+      if (CanonPointeeTy == ObjTy)
         return CastResult(state, R);
     }
 

diff --git a/test/Analysis/misc-ps.m b/test/Analysis/misc-ps.m
index 1b16762c42e8e60b85102e4aef175bde54d659bd..c4fa7a8a1d04f59caee27d7faf2ed1554fdaff09 100644 (file)
--- a/test/Analysis/misc-ps.m
+++ b/test/Analysis/misc-ps.m
@@ -491,3 +491,11 @@ void test_invalidate_cast_int() {
 static NSNumber *test_ivar_offset(id self, SEL _cmd, Ivar inIvar) {
   return [[[NSNumber allocWithZone:((void*)0)] initWithBool:*(_Bool *)((char *)self + ivar_getOffset(inIvar))] autorelease];
 }
+
+// Reduced from a crash in StoreManager::CastRegion involving a divide-by-zero.
+// This resulted from not properly handling region casts to 'const void*'.
+void test_cast_const_voidptr() {
+  char x[10];
+  char *p = &x[1];
+  const void* q = p;
+}