diff options
| -rw-r--r-- | lib/Analysis/RegionStore.cpp | 4 | ||||
| -rw-r--r-- | test/Analysis/null-deref-ps-region.c | 14 |
2 files changed, 18 insertions, 0 deletions
diff --git a/lib/Analysis/RegionStore.cpp b/lib/Analysis/RegionStore.cpp index 7a78036ec0..aeb8a2ac8f 100644 --- a/lib/Analysis/RegionStore.cpp +++ b/lib/Analysis/RegionStore.cpp @@ -912,6 +912,10 @@ Store RegionStoreManager::RemoveDeadBindings(const GRState* state, Stmt* Loc, if (const VarRegion* VR = dyn_cast<VarRegion>(R)) { if (SymReaper.isLive(Loc, VR->getDecl())) RegionRoots.push_back(VR); // This is a live "root". + } + else if (const SymbolicRegion* SR = dyn_cast<SymbolicRegion>(R)) { + if (SymReaper.isLive(SR->getSymbol())) + RegionRoots.push_back(SR); } else { // Get the super region for R. diff --git a/test/Analysis/null-deref-ps-region.c b/test/Analysis/null-deref-ps-region.c new file mode 100644 index 0000000000..80a5f9212f --- /dev/null +++ b/test/Analysis/null-deref-ps-region.c @@ -0,0 +1,14 @@ +// RUN: clang-cc -analyze -std=gnu99 -checker-cfref -analyzer-store=region -verify %s + + +// The store for 'a[1]' should not be removed mistakenly. SymbolicRegions may +// also be live roots. +void f14(int *a) { + int i; + a[1] = 1; + i = a[1]; + if (i != 1) { + int *p = 0; + i = *p; // no-warning + } +} |