diff options
| -rw-r--r-- | lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp | 14 | ||||
| -rw-r--r-- | test/Analysis/misc-ps-region-store.cpp | 8 |
2 files changed, 16 insertions, 6 deletions
diff --git a/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp b/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp index e09d6885a9..30f45c7685 100644 --- a/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp @@ -232,7 +232,11 @@ void CallAndMessageChecker::checkPreStmt(const CallExpr *CE, return; } - if (L.isZeroConstant()) { + ProgramStateRef StNonNull, StNull; + llvm::tie(StNonNull, StNull) = State->assume(cast<DefinedOrUnknownSVal>(L)); + + // FIXME: Do we want to record the non-null assumption here? + if (StNull && !StNonNull) { if (!BT_call_null) BT_call_null.reset( new BuiltinBug("Called function pointer is null (null dereference)")); @@ -253,7 +257,13 @@ void CallAndMessageChecker::checkPreCall(const CallEvent &Call, emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr()); return; } - if (V.isZeroConstant()) { + + ProgramStateRef State = C.getState(); + ProgramStateRef StNonNull, StNull; + llvm::tie(StNonNull, StNull) = State->assume(cast<DefinedOrUnknownSVal>(V)); + + // FIXME: Do we want to record the non-null assumption here? + if (StNull && !StNonNull) { if (!BT_cxx_call_null) BT_cxx_call_null.reset(new BuiltinBug("Called C++ object pointer " "is null")); diff --git a/test/Analysis/misc-ps-region-store.cpp b/test/Analysis/misc-ps-region-store.cpp index fcffe07536..e30cedb911 100644 --- a/test/Analysis/misc-ps-region-store.cpp +++ b/test/Analysis/misc-ps-region-store.cpp @@ -272,11 +272,11 @@ const Rdar9212495_A& rdar9212495(const Rdar9212495_C* ptr) { const Rdar9212495_A& val = dynamic_cast<const Rdar9212495_A&>(*ptr); // This is not valid C++; dynamic_cast with a reference type will throw an - // exception if the pointer does not match the expected type. + // exception if the pointer does not match the expected type. However, our + // implementation of dynamic_cast will pass through a null pointer...or a + // "null reference"! So this branch is actually possible. if (&val == 0) { - val.bar(); // no warning (unreachable) - int *p = 0; - *p = 0xDEAD; // no warning (unreachable) + val.bar(); // expected-warning{{Called C++ object pointer is null}} } return val; |