[analyzer] Fix BindingDecl evaluation for reference types

The case when the bound variable is reference type in a
BindingDecl wasn't handled, which lead to false positives.

Differential Revision: https://reviews.llvm.org/D128716
This commit is contained in:
isuckatcs 2022-06-29 12:50:24 +02:00
parent 71c58624e0
commit 9d2e830737
2 changed files with 30 additions and 4 deletions

View File

@ -2630,6 +2630,9 @@ void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D,
} else
llvm_unreachable("An unknown case of structured binding encountered!");
if (BD->getType()->isReferenceType())
V = state->getSVal(V.getAsRegion());
Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr,
ProgramPoint::PostLValueKind);

View File

@ -1,9 +1,32 @@
// RUN: %clang_analyze_cc1 -std=c++17 -analyzer-checker=core -verify %s
// RUN: %clang_analyze_cc1 -std=c++17 -analyzer-checker=core,debug.ExprInspection -verify %s
void clang_analyzer_eval(bool);
struct s { int a; };
int foo() {
auto[a] = s{1}; // FIXME: proper modelling
if (a) {
}
auto [a] = s{1};
clang_analyzer_eval(a == 1); // expected-warning{{TRUE}}
} // expected-warning{{non-void function does not return a value}}
struct s2 {
int &x;
};
int *foo2(s2 in) {
auto [a] = in;
return &a;
}
void bar() {
int i = 1;
s2 a{i};
auto *x = foo2(a);
clang_analyzer_eval(*x == i); // expected-warning{{TRUE}}
*x = 2;
clang_analyzer_eval(*x == 2); // expected-warning{{TRUE}}
clang_analyzer_eval(i == 2); // expected-warning{{TRUE}}
}