StoreManager::CastRegion:

- Don't layer TypedViewRegions on top of any region except
  SymbolicRegions and AllocaRegions.  This follows from my offline
  discussion within Zhongxing about how TypedViewRegions really only
  represent memory getting re-appropriated for a new purpose.

Fallout	from this change:
- Move test case from xfail_rdar_6440393.m to misc-ps-64.m
  (it now passes).

- test/Analysis/fields.c now fails for region store (crash).
  Marking XFAIL.

- test/Analysis/rdar-6441136-region.c now fails (only runs with region store).
  Marking XFAIL.

  Diagnosis: The analyzer now correctly identifies an early out-of-bounds memory
   access then the one flagged:

  rdar-6541136-region.c:17:3: warning: Load or store into an out-of-bound memory position.
    *p = 1;
    ^~

  Changing the line:
   char *p = (void*) &wonky[1];
  to
   char *p = (void*) &wonky[0];

  (which should delay the buffer overrun) causes region store to crash, probably
  because it expects a TypedViewRegion.

- test/Analysis/casts.c (region store) now fails (crash).
  Marking XFAIL.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70565 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/Store.cpp b/lib/Analysis/Store.cpp
index 6464c57df0506b279cc32c5578ba96e981775a26..65e90dec33d591f330beb7dd3957baabe0be22dd 100644 (file)
--- a/lib/Analysis/Store.cpp
+++ b/lib/Analysis/Store.cpp
@@ -59,9 +59,15 @@ StoreManager::CastRegion(const GRState* state, const MemRegion* R,
       return CastResult(state, R);
     }
 
-  // FIXME: We don't want to layer region views.  Need to handle
-  // arbitrary downcasts.
+  // FIXME: Need to handle arbitrary downcasts.
+  // FIXME: Handle the case where a TypedViewRegion (layering a SymbolicRegion
+  //         or an AllocaRegion is cast to another view, thus causing the memory
+  //         to be re-used for a different purpose.
 
-  const MemRegion* ViewR = MRMgr.getTypedViewRegion(CastToTy, R);  
-  return CastResult(AddRegionView(state, ViewR, R), ViewR);
+  if (isa<SymbolicRegion>(R) || isa<AllocaRegion>(R)) {
+    const MemRegion* ViewR = MRMgr.getTypedViewRegion(CastToTy, R);  
+    return CastResult(AddRegionView(state, ViewR, R), ViewR);
+  }
+  
+  return CastResult(state, R);
 }

diff --git a/test/Analysis/casts.c b/test/Analysis/casts.c
index 94a1eac0a316a84d81874d0959ce6cf3ad2a29a5..fa41961a45954d979632506b98055340c777c67c 100644 (file)
--- a/test/Analysis/casts.c
+++ b/test/Analysis/casts.c
@@ -2,6 +2,7 @@
 
 // Test if the 'storage' region gets properly initialized after it is cast to
 // 'struct sockaddr *'. 
+// XFAIL
 
 #include <sys/socket.h>
 void f(int sock) {

diff --git a/test/Analysis/fields.c b/test/Analysis/fields.c
index d6bf73f9af14313bc7899614b79456e98e9b8d62..8b88578a0e9f5e41aec5b49766fa4ca89343ece2 100644 (file)
--- a/test/Analysis/fields.c
+++ b/test/Analysis/fields.c
@@ -1,6 +1,6 @@
 // RUN: clang-cc -analyze -checker-cfref %s --analyzer-store=basic -verify &&
-// RUN: clang-cc -analyze -checker-cfref %s --analyzer-store=region -verify &&
-// RUN: clang-cc -analyze -checker-simple %s -verify
+// RUN: clang-cc -analyze -checker-cfref %s --analyzer-store=region -verify
+// XFAIL
 
 unsigned foo();
 typedef struct bf { unsigned x:2; } bf;

diff --git a/test/Analysis/xfail_rdar_6440393.m b/test/Analysis/misc-ps-64.m
similarity index 54%
rename from test/Analysis/xfail_rdar_6440393.m
rename to test/Analysis/misc-ps-64.m
index a3e91428c6520a563c8cebcf61ca3885869e69a1..c95998fd36fe963669028877443295173fdc8144 100644 (file)
--- a/test/Analysis/xfail_rdar_6440393.m
+++ b/test/Analysis/misc-ps-64.m
@@ -1,9 +1,7 @@
-// RUN: clang-cc -analyze -checker-cfref -analyzer-store=basic %s &&
-// RUN: clang-cc -analyze -checker-cfref -analyzer-store=region %s
-// XFAIL
-
-// *** These tests will be migrated to other test files once these failures
-//     are resolved.
+// RUN: clang-cc -triple x86_64-apple-darwin9 -analyze -checker-cfref --analyzer-store=basic -analyzer-constraints=basic --verify -fblocks %s &&
+// RUN: clang-cc -triple x86_64-apple-darwin9 -analyze -checker-cfref --analyzer-store=basic -analyzer-constraints=range --verify -fblocks %s &&
+// RUN: clang-cc -triple x86_64-apple-darwin9 -analyze -checker-cfref --analyzer-store=region -analyzer-constraints=basic --verify -fblocks %s &&
+// RUN: clang-cc -triple x86_64-apple-darwin9 -analyze -checker-cfref --analyzer-store=region -analyzer-constraints=range --verify -fblocks %s
 
 // <rdar://problem/6440393> - A bunch of misc. failures involving evaluating
 //  these expressions and building CFGs.  These tests are here to prevent
@@ -24,3 +22,4 @@ void rdar_6440393_1(NSDictionary *dict) {
     return;
   shazam(x, &bufptr);
 }
+

diff --git a/test/Analysis/rdar-6541136-region.c b/test/Analysis/rdar-6541136-region.c
index 90960dd4f617910beab6172dd1b6c719ef8582da..9f256bfd73fbaab3f82a53664ca0572d1557b7e1 100644 (file)
--- a/test/Analysis/rdar-6541136-region.c
+++ b/test/Analysis/rdar-6541136-region.c
@@ -1,4 +1,5 @@
 // RUN: clang-cc -verify -analyze -checker-cfref -analyzer-store=region %s
+// XFAIL
 
 struct tea_cheese { unsigned magic; };
 typedef struct tea_cheese kernel_tea_cheese_t;