[analyzer] MacOSKeychainAPIChecker: Retrieve the memory region which we are tracking even when it's no longer a SymbolicRegion, for example, when it is cast to char*.

llvm-svn: 138415

1 files changed, 8 insertions, 2 deletions

diff --git a/clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp
index 551aea50214..7ffbc7fc4f7 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp
@@ -167,8 +167,14 @@ unsigned MacOSKeychainAPIChecker::getTrackedFunctionIndex(StringRef Name,
 
 static SymbolRef getSymbolForRegion(CheckerContext &C,
                                    const MemRegion *R) {
-  if (!isa<SymbolicRegion>(R))
-    return 0;
+  if (!isa<SymbolicRegion>(R)) {
+    // Implicit casts (ex: void* -> char*) can turn Symbolic region into element
+    // region, if that is the case, get the underlining region.
+    if (const ElementRegion *ER = dyn_cast<ElementRegion>(R))
+      R = ER->getAsArrayOffset().getRegion();
+    else
+      return 0;
+  }
   return cast<SymbolicRegion>(R)->getSymbol();
 }