More test cases revealed that the logic in StoreManager::InvalidateRegion() needs more finesse when handling the invalidation of pointers. Pointers that were invalidated as integers could later cause problems for clients using them as pointers. It is easier for us to model a symbolic value as a pointer rather than modeling a non-symbolic value as a pointer.

This patch causes:
- StoreManager::InvalidateRegion() to not used the casted type of a region if
  it would cause a pointer type to be invalidated as a non-pointer type.
- Pushes RegionStore::RetrieveElement() further by handling retrievals from
  symbolic arrays that have been invalidated.  This uses the new SymbolDerived
  construct that was recently introduced.
  
The result is that the failing test in misc-ps-region-store-x86_64.m now passes.
Both misc-ps-region-store-x86_64.m and misc-ps-region-store-i386.m contain a
test case that motivated this change.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@75730 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 10 insertions, 6 deletions

diff --git a/lib/Analysis/Store.cpp b/lib/Analysis/Store.cpp
index 2910f49c80..bbda565cec 100644
--- a/lib/Analysis/Store.cpp
+++ b/lib/Analysis/Store.cpp
@@ -238,16 +238,20 @@ const GRState *StoreManager::InvalidateRegion(const GRState *state,
   }
 
   const TypedRegion *TR = cast<TypedRegion>(R);
+  QualType T = TR->getValueType(Ctx);
 
-  QualType T;
- 
-  // If the region is cast to another type, use that type.
+  // If the region is cast to another type, use that type.  
   if (const QualType *CastTy = getCastType(state, R)) {
     assert(!(*CastTy)->isObjCObjectPointerType());
-    T = (*CastTy)->getAsPointerType()->getPointeeType();
-  } else
-    T = TR->getValueType(Ctx);
+    QualType NewT = (*CastTy)->getAsPointerType()->getPointeeType();    
 
+    // The only exception is if the original region had a location type as its
+    // value type we always want to treat the region as binding to a location.
+    // This issue can arise when pointers are casted to integers and back.
+    if (!Loc::IsLocType(T) || Loc::IsLocType(NewT))
+      T = NewT;
+  }
+  
   if (Loc::IsLocType(T) || (T->isIntegerType() && T->isScalarType())) {
     SVal V = ValMgr.getConjuredSymbolVal(E, T, Count);
     return Bind(state, ValMgr.makeLoc(TR), V);