[analyzer] Handle zeroing constructors for fields of structs with empty bases.

RegionStore tries to protect against accidentally initializing the same
region twice, but it doesn't take subregions into account very well. If
the outer region being initialized is a struct with an empty base class,
the offset of the first field in the struct will be 0. When we initialize
the base class, we may invalidate the contents of the struct by providing
a default value of Unknown (or some new symbol). We then go to initialize
the member with a zeroing constructor, only to find that the region at
that offset in the struct already has a value. The best we can do here is
to invalidate that value and continue; neither the old default value nor
the new 0 is correct for the entire struct after the member constructor call.

The correct solution for this is to track region extents in the store.

<rdar://problem/14914316>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@190530 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Core/RegionStore.cpp b/lib/StaticAnalyzer/Core/RegionStore.cpp
index dd416f636666ce60823d6dc97cad2df3f3df6b56..50186fbaa5a6ca8ebc0535c549d76fda6a7a8d27 100644 (file)
--- a/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -422,11 +422,20 @@ public: // Part of public interface to class.
   // BindDefault is only used to initialize a region with a default value.
   StoreRef BindDefault(Store store, const MemRegion *R, SVal V) {
     RegionBindingsRef B = getRegionBindings(store);
-    assert(!B.lookup(R, BindingKey::Default));
     assert(!B.lookup(R, BindingKey::Direct));
-    return StoreRef(B.addBinding(R, BindingKey::Default, V)
-                     .asImmutableMap()
-                     .getRootWithoutRetain(), *this);
+
+    BindingKey Key = BindingKey::Make(R, BindingKey::Default);
+    if (B.lookup(Key)) {
+      const SubRegion *SR = cast<SubRegion>(R);
+      assert(SR->getAsOffset().getOffset() ==
+             SR->getSuperRegion()->getAsOffset().getOffset() &&
+             "A default value must come from a super-region");
+      B = removeSubRegionBindings(B, SR);
+    } else {
+      B = B.addBinding(Key, V);
+    }
+
+    return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this);
   }
 
   /// Attempt to extract the fields of \p LCV and bind them to the struct region

diff --git a/test/Analysis/ctor.mm b/test/Analysis/ctor.mm
index a5e5b48bfaade47e1a16499eac06f5f6b4530804..77c87905e1f74b70284075ce4a3d81a253b955d5 100644 (file)
--- a/test/Analysis/ctor.mm
+++ b/test/Analysis/ctor.mm
@@ -626,6 +626,30 @@ namespace ZeroInitialization {
       // initialized twice.
     }
   };
+
+  class Empty {
+  public:
+    Empty();
+  };
+
+  class PairContainer : public Empty {
+    raw_pair p;
+  public:
+    PairContainer() : Empty(), p() {
+      // This previously caused a crash because the empty base class looked
+      // like an initialization of 'p'.
+    }
+    PairContainer(int) : Empty(), p() {
+      // Test inlining something else here.
+    }
+  };
+
+  class PairContainerContainer {
+    int padding;
+    PairContainer pc;
+  public:
+    PairContainerContainer() : pc(1) {}
+  };
 }
 
 namespace InitializerList {