[analyzer] Warn on passing a reference to null pointer as an argument in a call

Warn about null pointer dereference earlier when a reference to a null pointer is
passed in a call. The idea is that even though the standard might allow this, reporting
the issue earlier is better for diagnostics (the error is reported closer to the place where
the pointer was set to NULL). This also simplifies analyzer’s diagnostic logic, which has
to track “where the null came from”. As a consequence, some of our null pointer
warning suppression mechanisms started triggering more often.

TODO: Change the name of the file and class to reflect the new check.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176612 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 66 insertions, 4 deletions

diff --git a/test/Analysis/reference.cpp b/test/Analysis/reference.cpp
index ed05720fe6..8dd0baf8c3 100644
--- a/test/Analysis/reference.cpp
+++ b/test/Analysis/reference.cpp
@@ -149,16 +149,78 @@ void testReturnReference() {
   clang_analyzer_eval(&refFromPointer() == 0); // expected-warning{{FALSE}}
 }
 
+void intRefParam(int &r) {
+	;
+}
+
+void test(int *ptr) {
+	clang_analyzer_eval(ptr == 0); // expected-warning{{UNKNOWN}}
+
+	extern void use(int &ref);
+	use(*ptr);
+
+	clang_analyzer_eval(ptr == 0); // expected-warning{{FALSE}}
+}
+
+void testIntRefParam() {
+	int i = 0;
+	intRefParam(i); // no-warning
+}
 
-// ------------------------------------
-// False negatives
-// ------------------------------------
+int refParam(int &byteIndex) {
+	return byteIndex;
+}
+
+void testRefParam(int *p) {
+	if (p)
+		;
+	refParam(*p); // expected-warning {{Forming reference to null pointer}}
+}
+
+int ptrRefParam(int *&byteIndex) {
+	return *byteIndex;  // expected-warning {{Dereference of null pointer}}
+}
+void testRefParam2() {
+	int *p = 0;
+	int *&rp = p;
+	ptrRefParam(rp);
+}
+
+int *maybeNull() {
+	extern bool coin();
+	static int x;
+	return coin() ? &x : 0;
+}
+
+void use(int &x) {
+	x = 1; // no-warning
+}
+
+void testSuppression() {
+	use(*maybeNull());
+}
 
 namespace rdar11212286 {
   class B{};
 
   B test() {
     B *x = 0;
-    return *x; // should warn here!
+    return *x; // expected-warning {{Forming reference to null pointer}}
+  }
+
+  B testif(B *x) {
+    if (x)
+      ;
+    return *x; // expected-warning {{Forming reference to null pointer}}
+  }
+
+  void idc(B *x) {
+    if (x)
+      ;
+  }
+
+  B testidc(B *x) {
+    idc(x);
+    return *x; // no-warning
   }
 }