From 2b1dc179197955bfa79583b13bedb1dc8bcdf25d Mon Sep 17 00:00:00 2001
From: Zhongxing Xu <xuzhongxing@gmail.com>
Date: Wed, 11 Mar 2009 07:43:49 +0000
Subject: [PATCH] Fix crash when LHS of pointer arithmetic is not
 ElementRegion.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66649 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Analysis/RegionStore.cpp | 18 +++++++++++++++---
 test/Analysis/ptr-arith.c    |  7 +++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/lib/Analysis/RegionStore.cpp b/lib/Analysis/RegionStore.cpp
index 6253e6182f..883821128a 100644
--- a/lib/Analysis/RegionStore.cpp
+++ b/lib/Analysis/RegionStore.cpp
@@ -620,9 +620,21 @@ SVal RegionStoreManager::EvalBinOp(BinaryOperator::Opcode Op, Loc L, NonLoc R) {
   if (!isa<loc::MemRegionVal>(L))
     return UnknownVal();
 
-  const MemRegion* MR = cast<loc::MemRegionVal>(L).getRegion();
+  const TypedRegion* TR 
+    = cast<TypedRegion>(cast<loc::MemRegionVal>(L).getRegion());
+
+  const ElementRegion* ER = dyn_cast<ElementRegion>(TR);
+  
+  if (!ER) {
+    // If the region is not element region, create one with index 0. This can
+    // happen in the following example:
+    // char *p = foo();
+    // p += 3;
+    // Note that p binds to a TypedViewRegion(SymbolicRegion).
+    nonloc::ConcreteInt Idx(getBasicVals().getZeroWithPtrWidth(false));
+    ER = MRMgr.getElementRegion(Idx, TR);
+  }
 
-  const ElementRegion* ER = cast<ElementRegion>(MR);
   SVal Idx = ER->getIndex();
 
   nonloc::ConcreteInt* Base = dyn_cast<nonloc::ConcreteInt>(&Idx);
@@ -632,7 +644,7 @@ SVal RegionStoreManager::EvalBinOp(BinaryOperator::Opcode Op, Loc L, NonLoc R) {
   if (Base && Offset) {
     // For now, convert the signedness of offset in case it doesn't match.
     const llvm::APSInt &I =
-      getBasicVals().ConvertSignedness(Base->getValue(), Offset->getValue());    
+      getBasicVals().ConvertSignedness(Base->getValue(), Offset->getValue());
     nonloc::ConcreteInt OffsetConverted(I);
     
     SVal NewIdx = Base->EvalBinOp(getBasicVals(), Op, OffsetConverted);
diff --git a/test/Analysis/ptr-arith.c b/test/Analysis/ptr-arith.c
index a8d03eb3d8..7b66b2f8fe 100644
--- a/test/Analysis/ptr-arith.c
+++ b/test/Analysis/ptr-arith.c
@@ -5,3 +5,10 @@ void f1() {
   int *p = a;
   ++p;
 }
+
+char* foo();
+
+void f2() {
+  char *p = foo();
+  ++p;
+}
-- 
2.40.0