Use the FunctionDecl's result type to know exactly if it returns a reference.

llvm-svn: 91751

2 files changed, 11 insertions, 2 deletions

diff --git a/clang/lib/Analysis/CFRefCount.cpp b/clang/lib/Analysis/CFRefCount.cpp
index cc73841b78e..fb253a3c8ff 100644
--- a/clang/lib/Analysis/CFRefCount.cpp
+++ b/clang/lib/Analysis/CFRefCount.cpp
@@ -2942,6 +2942,16 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
 
       QualType T = Ex->getType();
 
+      // For CallExpr, use the result type to know if it returns a reference.
+      if (const CallExpr *CE = dyn_cast<CallExpr>(Ex)) {
+        const Expr *Callee = CE->getCallee();
+        SVal L = state->getSVal(Callee);
+        
+        const FunctionDecl *FD = L.getAsFunctionDecl();
+        if (FD)
+          T = FD->getResultType();
+      }
+
       if (Loc::IsLocType(T) || (T->isIntegerType() && T->isScalarType())) {
         unsigned Count = Builder.getCurrentBlockCount();
         ValueManager &ValMgr = Eng.getValueManager();
diff --git a/clang/test/Analysis/misc-ps-region-store.cpp b/clang/test/Analysis/misc-ps-region-store.cpp
index 838ac39d5c1..c3e07b26b00 100644
--- a/clang/test/Analysis/misc-ps-region-store.cpp
+++ b/clang/test/Analysis/misc-ps-region-store.cpp
@@ -1,6 +1,5 @@
 // RUN: %clang_cc1 -triple i386-apple-darwin9 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks %s
 // RUN: %clang_cc1 -triple x86_64-apple-darwin9 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -verify -fblocks   -analyzer-opt-analyze-nested-blocks %s
-// XFAIL: *
 
 // Test basic handling of references.
 char &test1_aux();
@@ -8,7 +7,7 @@ char *test1() {
   return &test1_aux();
 }
 
-// This test currently crasehs because test1_aux() evaluates to a 'char' instead of a char& in CFRefCount.cpp.
+// Test test1_aux() evaluates to char &.
 char test1_as_rvalue() {
   return test1_aux();
 }