From: Devin Coughlin <dcoughlin@apple.com>
Date: Wed, 22 Jun 2016 00:20:00 +0000 (+0000)
Subject: [analyzer] Teach trackNullOrUndefValue() about class property accessors.
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=83b8ce1cb4dc03ae3d9bf499e827dc282da95336;p=clang

[analyzer] Teach trackNullOrUndefValue() about class property accessors.

Teach trackNullOrUndefValue() how to properly look through PseudoObjectExprs
to find the underlying semantic method call for property getters. This fixes a
crash when looking through class property getters that I introduced in r265839.

rdar://problem/26796666

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@273340 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp b/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
index 657d33fa7a..85a0b47896 100644
--- a/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
+++ b/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
@@ -914,7 +914,10 @@ static const Expr *peelOffOuterExpr(const Expr *Ex,
   if (auto *POE = dyn_cast<PseudoObjectExpr>(Ex)) {
     auto *PropRef = dyn_cast<ObjCPropertyRefExpr>(POE->getSyntacticForm());
     if (PropRef && PropRef->isMessagingGetter()) {
-      return peelOffOuterExpr(POE->getSemanticExpr(1), N);
+      const Expr *GetterMessageSend =
+          POE->getSemanticExpr(POE->getNumSemanticExprs() - 1);
+      assert(isa<ObjCMessageExpr>(GetterMessageSend));
+      return peelOffOuterExpr(GetterMessageSend, N);
     }
   }
 
diff --git a/test/Analysis/inlining/false-positive-suppression.m b/test/Analysis/inlining/false-positive-suppression.m
index d9678206c7..1a5ff662c1 100644
--- a/test/Analysis/inlining/false-positive-suppression.m
+++ b/test/Analysis/inlining/false-positive-suppression.m
@@ -49,6 +49,12 @@ __attribute__((objc_root_class))
 
 @end
 
+@interface SubOfSomeClass : SomeClass
+@end
+
+@implementation SubOfSomeClass
+@end
+
 @implementation SomeClass
 -(int *)methodReturningNull {
   return 0;
@@ -57,6 +63,10 @@ __attribute__((objc_root_class))
 -(int *)propertyReturningNull {
   return 0;
 }
+
++(int *)classPropertyReturningNull {
+  return 0;
+}
 @end
 
 void testMethodReturningNull(SomeClass *sc) {
@@ -75,6 +85,24 @@ void testPropertyReturningNull(SomeClass *sc) {
 #endif
 }
 
+@implementation SubOfSomeClass (ForTestOfSuperProperty)
+-(void)testSuperPropertyReturningNull {
+  int *result = super.propertyReturningNull;
+  *result = 1;
+#ifndef SUPPRESSED
+  // expected-warning@-2 {{Dereference of null pointer}}
+#endif
+}
+@end
+
+void testClassPropertyReturningNull() {
+  int *result = SomeClass.classPropertyReturningNull;
+  *result = 1;
+#ifndef SUPPRESSED
+  // expected-warning@-2 {{Dereference of null pointer}}
+#endif
+}
+
 void testSynthesizedPropertyReturningNull(SomeClass *sc) {
   if (sc.synthesizedProperty)
     return;