Fix crash in StoreManager::NewCastRegion regarding handling casts to void*,

void**, void***, etc.  Such casts should just pass the region through.

llvm-svn: 75281

1 files changed, 24 insertions, 3 deletions

diff --git a/clang/lib/Analysis/Store.cpp b/clang/lib/Analysis/Store.cpp
index d7633a46ac9..ad6bd7e4f66 100644
--- a/clang/lib/Analysis/Store.cpp
+++ b/clang/lib/Analysis/Store.cpp
@@ -45,6 +45,24 @@ static bool IsCompleteType(ASTContext &Ctx, QualType Ty) {
   return true;
 }
 
+static bool isVoidOrHigherOrderVoidPtr(ASTContext &Ctx, QualType Ty) {
+  while (true) {
+    Ty = Ctx.getCanonicalType(Ty);
+    
+    if (Ty->isVoidType())
+      return true;    
+
+    if (const PointerType *PT = Ty->getAsPointerType()) {
+      Ty = PT->getPointeeType();
+      continue;
+    }
+    
+    break;
+  }
+  
+  return false;
+}
+
 StoreManager::CastResult
 StoreManager::NewCastRegion(const GRState *state, const MemRegion* R,
                             QualType CastToTy) {
@@ -64,6 +82,10 @@ StoreManager::NewCastRegion(const GRState *state, const MemRegion* R,
   // already be handled.
   QualType PointeeTy = CastToTy->getAsPointerType()->getPointeeType();
   
+  // Casts to 'void*', 'void**', 'void***', etc., should just pass through.
+  if (isVoidOrHigherOrderVoidPtr(Ctx, PointeeTy))
+    return CastResult(state, R);
+  
   // Process region cast according to the kind of the region being cast.
   switch (R->getKind()) {
     case MemRegion::BEG_TYPED_REGIONS:
@@ -78,9 +100,8 @@ StoreManager::NewCastRegion(const GRState *state, const MemRegion* R,
       
     case MemRegion::CodeTextRegionKind: {
       // CodeTextRegion should be cast to only function pointer type.
-      assert(CastToTy->isFunctionPointerType() || CastToTy->isBlockPointerType()
-             || (CastToTy->isPointerType() &&
-                 CastToTy->getAsPointerType()->getPointeeType()->isVoidType()));
+      assert(CastToTy->isFunctionPointerType() || 
+             CastToTy->isBlockPointerType());
       break;
     }