[analyzer] Support modeling no-op BaseToDerived casts in ExprEngine.

Introduce a new MemRegion sub-class, CXXDerivedObjectRegion, which is
the opposite of CXXBaseObjectRegion, to represent such casts. Such region is
a bit weird because it is by design bigger than its super-region.
But it's not harmful when it is put on top of a SymbolicRegion
that has unknown extent anyway.

Offset computation for CXXDerivedObjectRegion and proper modeling of casts
still remains to be implemented.

Differential Revision: https://reviews.llvm.org/D51191

llvm-svn: 340984

1 files changed, 32 insertions, 1 deletions

diff --git a/clang/test/Analysis/casts.cpp b/clang/test/Analysis/casts.cpp
index 757eb6da662..9b3e294c779 100644
--- a/clang/test/Analysis/casts.cpp
+++ b/clang/test/Analysis/casts.cpp
@@ -1,4 +1,6 @@
-// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-store=region -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-store=region -verify %s
+
+void clang_analyzer_eval(bool);
 
 bool PR14634(int x) {
   double y = (double)x;
@@ -41,3 +43,32 @@ bool retrievePointerFromBoolean(int *p) {
   *reinterpret_cast<int **>(&q) = p;
   return q;
 }
+
+namespace base_to_derived {
+struct A {};
+struct B : public A{};
+
+void foo(A* a) {
+  B* b = (B* ) a;
+  A* a2 = (A *) b;
+  clang_analyzer_eval(a2 == a); // expected-warning{{TRUE}}
+}
+}
+
+namespace base_to_derived_double_inheritance {
+struct A {
+  int x;
+};
+struct B {
+  int y;
+};
+struct C : A, B {};
+
+void foo(B *b) {
+  C *c = (C *)b;
+  b->y = 1;
+  clang_analyzer_eval(c->x); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(c->y); // expected-warning{{TRUE}}
+}
+}
+