Fix PR7218. Patch by Jordy Rose.

llvm-svn: 105097

2 files changed, 23 insertions, 3 deletions

diff --git a/clang/lib/Checker/RegionStore.cpp b/clang/lib/Checker/RegionStore.cpp
index c4072fd8030..c25d2095b13 100644
--- a/clang/lib/Checker/RegionStore.cpp
+++ b/clang/lib/Checker/RegionStore.cpp
@@ -213,6 +213,11 @@ public:
 
   RegionStoreSubRegionMap *getRegionStoreSubRegionMap(Store store);
 
+  /// canHaveDirectBinding - Disallow direct bindings for certain types,
+  ///  like arrays. This lets us distinguish between x and x[0], which was
+  ///  causing PR7218 "Assigning to buf[0] makes buf[1] valid".
+  bool canHaveDirectBinding (const MemRegion *R);
+
   Optional<SVal> getBinding(RegionBindings B, const MemRegion *R);
   Optional<SVal> getDirectBinding(RegionBindings B, const MemRegion *R);
   /// getDefaultBinding - Returns an SVal* representing an optional default
@@ -944,11 +949,20 @@ SVal RegionStoreManager::EvalBinOp(BinaryOperator::Opcode Op, Loc L, NonLoc R,
 //===----------------------------------------------------------------------===//
 // Loading values from regions.
 //===----------------------------------------------------------------------===//
+bool RegionStoreManager::canHaveDirectBinding (const MemRegion *R) {
+  // Arrays can't have direct binding -- must bind to elements
+  if (const TypedRegion *TR = dyn_cast<TypedRegion>(R))    
+    if (TR->getValueType(getContext())->isArrayType())   
+      return false;
+  
+  return true;
+}
 
 Optional<SVal> RegionStoreManager::getDirectBinding(RegionBindings B,
-                                                 const MemRegion *R) {
-  if (const SVal *V = Lookup(B, R, BindingKey::Direct))
-    return *V;
+                                                    const MemRegion *R) {
+  if (canHaveDirectBinding(R))
+    if (const SVal *V = Lookup(B, R, BindingKey::Direct))
+      return *V;
 
   return Optional<SVal>();
 }
diff --git a/clang/test/Analysis/PR7218.c b/clang/test/Analysis/PR7218.c
new file mode 100644
index 00000000000..635e56f053e
--- /dev/null
+++ b/clang/test/Analysis/PR7218.c
@@ -0,0 +1,6 @@
+// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-store region -verify %s
+char PR7218(char a) {
+    char buf[2];
+    buf[0] = a;
+    return buf[1]; // expected-warning {{Undefined or garbage value returned to caller}}
+}