diff options
| -rw-r--r-- | lib/StaticAnalyzer/Core/ExprEngineC.cpp | 7 | ||||
| -rw-r--r-- | test/Analysis/misc-ps-region-store.cpp | 10 |
2 files changed, 16 insertions, 1 deletions
diff --git a/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/lib/StaticAnalyzer/Core/ExprEngineC.cpp index f277a2eaac..ee2d052f28 100644 --- a/lib/StaticAnalyzer/Core/ExprEngineC.cpp +++ b/lib/StaticAnalyzer/Core/ExprEngineC.cpp @@ -375,7 +375,12 @@ void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, // Recover some path-sensitivity if a scalar value evaluated to // UnknownVal. if (InitVal.isUnknown()) { - InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, LC, + QualType Ty = InitEx->getType(); + if (InitEx->isLValue()) { + Ty = getContext().getPointerType(Ty); + } + + InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, LC, Ty, currentBuilderContext->getCurrentBlockCount()); } B.takeNodes(N); diff --git a/test/Analysis/misc-ps-region-store.cpp b/test/Analysis/misc-ps-region-store.cpp index e0cedcce93..8d75fb8ef3 100644 --- a/test/Analysis/misc-ps-region-store.cpp +++ b/test/Analysis/misc-ps-region-store.cpp @@ -568,3 +568,13 @@ struct PR11146::Entry { void PR11146::baz() { (void) &Entry::x; } + +// Test symbolicating a reference. In this example, the +// analyzer (originally) didn't know how to handle x[index - index2], +// returning an UnknownVal. The conjured symbol wasn't a location, +// and would result in a crash. +void rdar10924675(unsigned short x[], int index, int index2) { + unsigned short &y = x[index - index2]; + if (y == 0) + return; +} |