[analyzer] Do not crash when processing binary "?:" in C++

When computing the value of ?: expression, we rely on the last expression in
the previous basic block to be the resulting value of the expression. This is
not the case for binary "?:" operator (GNU extension) in C++. As the last
basic block has the expression for the condition subexpression, which is an
R-value, whereas the true subexpression is the L-value.

Note the operator evaluation just happens to work in C since the true
subexpression is an R-value (like the condition subexpression). CFG is the
same in C and C++ case, but the AST nodes are different, which the LValue to
Rvalue conversion happening after the BinaryConditionalOperator evaluation.

Changed the logic to only use the last expression from the predecessor only
if it matches either true or false subexpression. Note, the logic needed
fortification anyway: L and R were passed but not even used by the function.

Also, change the conjureSymbolVal to correctly compute the type, when the
expression is an LG-value.

llvm-svn: 179574

1 files changed, 17 insertions, 0 deletions

diff --git a/clang/test/Analysis/conditional-operator.cpp b/clang/test/Analysis/conditional-operator.cpp
new file mode 100644
index 00000000000..5a3c325b91d
--- /dev/null
+++ b/clang/test/Analysis/conditional-operator.cpp
@@ -0,0 +1,17 @@
+// RUN: %clang -cc1 -analyze -analyzer-checker=core,debug.ExprInspection %s -analyzer-output=text -verify
+
+void clang_analyzer_eval(bool);
+
+// Test that the analyzer does not crash on GNU extension operator "?:".
+void NoCrashTest(int x, int y) {
+	int w = x ?: y;
+}
+
+void OperatorEvaluationTest(int y) {
+  int x = 1;
+	int w = x ?: y;  // expected-note {{'?' condition is true}}
+	
+	// TODO: We are not precise when processing the "?:" operator in C++.
+  clang_analyzer_eval(w == 1); // expected-warning{{UNKNOWN}}
+                               // expected-note@-1{{UNKNOWN}}
+}
\ No newline at end of file