From 267e45adab7f7dbbcf3299565840b95c21e6e3c0 Mon Sep 17 00:00:00 2001
From: Ted Kremenek <kremenek@apple.com>
Date: Thu, 24 Sep 2009 04:11:44 +0000
Subject: Fix: <rdar://problem/7249340> [RegionStore] model stores to symbolic
 parameter regions

The issue was a discrepancy between how RegionStoreManager::Bind() and
RegionStoreManager::Retrieve() derived the "key" for the first element
of a symbolic region.

llvm-svn: 82680
---
 clang/lib/Analysis/RegionStore.cpp | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

(limited to 'clang/lib')

diff --git a/clang/lib/Analysis/RegionStore.cpp b/clang/lib/Analysis/RegionStore.cpp
index b54fa272a00..31f52a55b3d 100644
--- a/clang/lib/Analysis/RegionStore.cpp
+++ b/clang/lib/Analysis/RegionStore.cpp
@@ -315,6 +315,9 @@ public:
                                   const GRState *state,
                                   const TypedRegion *R);
 
+  const ElementRegion *GetElementZeroRegion(const SymbolicRegion *SR,
+                                            QualType T);
+
   //===------------------------------------------------------------------===//
   // State pruning.
   //===------------------------------------------------------------------===//
@@ -857,6 +860,16 @@ static bool IsReinterpreted(QualType RTy, QualType UsedTy, ASTContext &Ctx) {
   return true;
 }
 
+const ElementRegion *
+RegionStoreManager::GetElementZeroRegion(const SymbolicRegion *SR, QualType T) {
+  ASTContext &Ctx = getContext();
+  SVal idx = ValMgr.makeZeroArrayIndex();
+  assert(!T.isNull());
+  return MRMgr.getElementRegion(T, idx, SR, Ctx);
+}
+  
+  
+
 SValuator::CastResult
 RegionStoreManager::Retrieve(const GRState *state, Loc L, QualType T) {
 
@@ -879,12 +892,8 @@ RegionStoreManager::Retrieve(const GRState *state, Loc L, QualType T) {
   if (isa<AllocaRegion>(MR))
     return SValuator::CastResult(state, UnknownVal());
 
-  if (isa<SymbolicRegion>(MR)) {
-    ASTContext &Ctx = getContext();
-    SVal idx = ValMgr.makeZeroArrayIndex();
-    assert(!T.isNull());
-    MR = MRMgr.getElementRegion(T, idx, MR, Ctx);
-  }
+  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
+    MR = GetElementZeroRegion(SR, T);
 
   if (isa<CodeTextRegion>(MR))
     return SValuator::CastResult(state, UnknownVal());
@@ -1309,6 +1318,13 @@ const GRState *RegionStoreManager::Bind(const GRState *state, Loc L, SVal V) {
       }
     }
   }
+  else if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
+    // Binding directly to a symbolic region should be treated as binding
+    // to element 0.
+    QualType T = SR->getSymbol()->getType(getContext());
+    T = cast<PointerType>(T)->getPointeeType();
+    R = GetElementZeroRegion(SR, T);
+  }
 
   // Perform the binding.
   RegionBindings B = GetRegionBindings(state->getStore());
-- 
cgit v1.2.3