From f510f5cd57fa9b7ea6f6e103c65c0df95a55d986 Mon Sep 17 00:00:00 2001
From: Anna Zaks <ganna@apple.com>
Date: Fri, 15 Mar 2013 23:34:25 +0000
Subject: [PATCH] [analyzer] BugReporterVisitors: handle the case where a
 ternary operator is wrapped in a cast.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177205 91177308-0d34-0410-b5e6-96231b3b80d8
---
 .../Core/BugReporterVisitors.cpp              | 19 +++++++++++--------
 .../inlining/false-positive-suppression.c     | 11 +++++++++++
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp b/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
index d5b4714451..6e5f6b8f2c 100644
--- a/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
+++ b/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
@@ -787,14 +787,17 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N,
     S = OVE->getSourceExpr();
 
   // Peel off the ternary operator.
-  if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(S)) {
-    ProgramStateRef State = N->getState();
-    SVal CondVal = State->getSVal(CO->getCond(), N->getLocationContext());
-    if (State->isNull(CondVal).isConstrainedTrue()) {
-      S = CO->getTrueExpr();
-    } else {
-      assert(State->isNull(CondVal).isConstrainedFalse());
-      S =  CO->getFalseExpr();
+  if (const Expr *Ex = dyn_cast<Expr>(S)) {
+    Ex = Ex->IgnoreParenCasts();
+    if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(Ex)) {
+      ProgramStateRef State = N->getState();
+      SVal CondVal = State->getSVal(CO->getCond(), N->getLocationContext());
+      if (State->isNull(CondVal).isConstrainedTrue()) {
+        S = CO->getTrueExpr();
+      } else {
+        assert(State->isNull(CondVal).isConstrainedFalse());
+        S =  CO->getFalseExpr();
+      }
     }
   }
 
diff --git a/test/Analysis/inlining/false-positive-suppression.c b/test/Analysis/inlining/false-positive-suppression.c
index fbdb1650ff..31ad891762 100644
--- a/test/Analysis/inlining/false-positive-suppression.c
+++ b/test/Analysis/inlining/false-positive-suppression.c
@@ -202,6 +202,17 @@ void ternaryArg(char cond) {
 	derefArg(cond ? &x : getNull());
 }
 
+int derefArgCast(char *p) {
+	return *p;
+#ifndef SUPPRESSED
+  // expected-warning@-2 {{Dereference of null pointer}}
+#endif
+}
+void ternaryArgCast(char cond) {
+	static int x;
+	derefArgCast((char*)((unsigned)cond ? &x : getNull()));
+}
+
 int derefAssignment(int *p) {
 	return *p;
 #ifndef SUPPRESSED
-- 
2.40.0