From 17eb65f1bfcc33d2a9ecefe32368cb374155dbdc Mon Sep 17 00:00:00 2001
From: Anna Zaks <ganna@apple.com>
Date: Thu, 24 May 2012 17:31:57 +0000
Subject: [PATCH] [analyzer] Treat cast of array to reference in the same way
 as array to pointer.

Fixes one of the crashes reported in PR12874.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157401 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/StaticAnalyzer/Core/SValBuilder.cpp |  2 +-
 test/Analysis/cxx11-crashes.cpp         | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/lib/StaticAnalyzer/Core/SValBuilder.cpp b/lib/StaticAnalyzer/Core/SValBuilder.cpp
index d005c2af96..765ae48c73 100644
--- a/lib/StaticAnalyzer/Core/SValBuilder.cpp
+++ b/lib/StaticAnalyzer/Core/SValBuilder.cpp
@@ -325,7 +325,7 @@ SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
 
     // Are we casting from an array to a pointer?  If so just pass on
     // the decayed value.
-    if (castTy->isPointerType())
+    if (castTy->isPointerType() || castTy->isReferenceType())
       return val;
 
     // Are we casting from an array to an integer?  If so, cast the decayed
diff --git a/test/Analysis/cxx11-crashes.cpp b/test/Analysis/cxx11-crashes.cpp
index 2dc9b55293..8c68734da4 100644
--- a/test/Analysis/cxx11-crashes.cpp
+++ b/test/Analysis/cxx11-crashes.cpp
@@ -36,3 +36,24 @@ void radar11487541() {
 void testFloatInitializer() {
   const float ysize={0.015}, xsize={0.01};
 }
+
+
+// PR12874, radar://11487525
+template<class T> struct addr_impl_ref {
+  T & v_;
+  inline addr_impl_ref( T & v ): v_( v ) {
+  }
+  inline operator T& () const {return v_;}
+};
+template<class T> struct addressof_impl {
+  static inline T * f( T & v, long )     {
+    return reinterpret_cast<T*>(&const_cast<char&>(reinterpret_cast<const volatile char &>(v)));
+  }
+};
+template<class T> T * addressof( T & v ) {
+  return addressof_impl<T>::f( addr_impl_ref<T>( v ), 0 );
+}
+void testRadar11487525_1(){
+  bool s[25];
+  addressof(s);
+}
-- 
2.50.1