Fix PR 5857. When casting from a symbolic region to an integer back to a pointer value, we were not correctly layering the correct ElementRegion on the original SymbolicRegion.

llvm-svn: 91981

1 files changed, 9 insertions, 8 deletions

diff --git a/clang/lib/Analysis/SValuator.cpp b/clang/lib/Analysis/SValuator.cpp
index ac727b0ac69..49bc0c4c598 100644
--- a/clang/lib/Analysis/SValuator.cpp
+++ b/clang/lib/Analysis/SValuator.cpp
@@ -72,10 +72,14 @@ SValuator::CastResult SValuator::EvalCast(SVal val, const GRState *state,
   // Check for casts from integers to pointers.
   if (Loc::IsLocType(castTy) && originalTy->isIntegerType()) {
     if (nonloc::LocAsInteger *LV = dyn_cast<nonloc::LocAsInteger>(&val)) {
-      // Just unpackage the lval and return it.
+      if (const MemRegion *R = LV->getLoc().getAsRegion()) {
+        StoreManager &storeMgr = ValMgr.getStateManager().getStoreManager();
+        R = storeMgr.CastRegion(R, castTy);
+        return R ? CastResult(state, loc::MemRegionVal(R))
+                 : CastResult(state, UnknownVal());
+      }
       return CastResult(state, LV->getLoc());
     }
-
     goto DispatchCast;
   }
 
@@ -136,15 +140,12 @@ SValuator::CastResult SValuator::EvalCast(SVal val, const GRState *state,
     // different type.  If the MemRegion* returned is NULL, this expression
     // evaluates to UnknownVal.
     R = storeMgr.CastRegion(R, castTy);
-
-    if (R)
-      return CastResult(state, loc::MemRegionVal(R));
-
-    return CastResult(state, UnknownVal());
+    return R ? CastResult(state, loc::MemRegionVal(R))
+             : CastResult(state, UnknownVal());
   }
 
-  // All other cases.
 DispatchCast:
+  // All other cases.
   return CastResult(state,
                     isa<Loc>(val) ? EvalCastL(cast<Loc>(val), castTy)
                                   : EvalCastNL(cast<NonLoc>(val), castTy));