Fix <rdar://problem/6845148>. Signed integers compared against pointers should

implicitly be changed to unsigned values in GRSimpleVals.cpp. This can happen
when the comparison involves logic in specialized transfer functions (e.g.,
OSAtomicCompareAndSwap).

llvm-svn: 71200

1 files changed, 8 insertions, 3 deletions

diff --git a/clang/lib/Analysis/GRSimpleVals.cpp b/clang/lib/Analysis/GRSimpleVals.cpp
index 3d1c76412cf..17e3c381dcf 100644
--- a/clang/lib/Analysis/GRSimpleVals.cpp
+++ b/clang/lib/Analysis/GRSimpleVals.cpp
@@ -267,10 +267,15 @@ SVal GRSimpleVals::EvalBinOp(GRExprEngine& Eng, BinaryOperator::Opcode Op,
   // FIXME: Are all locations guaranteed to have pointer width?
   if (BinaryOperator::isEqualityOp(Op)) {
     if (nonloc::ConcreteInt *RInt = dyn_cast<nonloc::ConcreteInt>(&R)) {
-      const llvm::APSInt &X = RInt->getValue();
+      const llvm::APSInt *X = &RInt->getValue();
       ASTContext &C = Eng.getContext();
-      if (C.getTypeSize(C.VoidPtrTy) == X.getBitWidth())
-        return EvalBinOp(Eng, Op, L, loc::ConcreteInt(X));
+      if (C.getTypeSize(C.VoidPtrTy) == X->getBitWidth()) {
+        // Convert the signedness of the integer (if necessary).
+        if (X->isSigned())
+          X = &Eng.getBasicVals().getValue(*X, true);          
+        
+        return EvalBinOp(Eng, Op, L, loc::ConcreteInt(*X));
+      }
     }
   }