[analyzer] dynamic_cast: Better model cast from a reference.

Generate a sink when the dynamic_cast from a reference fails to
represent a thrown exception.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 1 insertions, 5 deletions

diff --git a/lib/StaticAnalyzer/Core/RegionStore.cpp b/lib/StaticAnalyzer/Core/RegionStore.cpp
index 8fb7e88b38..cc3ea8c3bf 100644
--- a/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -896,11 +896,7 @@ SVal RegionStoreManager::evalDynamicCast(SVal base, QualType derivedType,
     return UnknownVal();
   const MemRegion *BaseRegion = baseRegVal->stripCasts();
 
-  // Assume the derived class is a pointer to a CXX record.
-  // TODO: Note, we do not model reference types: a bad_cast exception is thrown
-  // when a cast of reference fails, but we just return an UnknownVal.
-  if (!derivedType->isPointerType())
-    return UnknownVal();
+  // Assume the derived class is a pointer or a reference to a CXX record.
   derivedType = derivedType->getPointeeType();
   assert(!derivedType.isNull());
   const CXXRecordDecl *DerivedDecl = derivedType->getAsCXXRecordDecl();