diff options
author | Anna Zaks <ganna@apple.com> | 2012-04-10 21:29:03 +0000 |
---|---|---|
committer | Anna Zaks <ganna@apple.com> | 2012-04-10 21:29:03 +0000 |
commit | a2c8d2edfff1573450c6feba876830dd746ffaad (patch) | |
tree | fc34542f4580fc54138fc40f970e1cfee0a2befd /lib/StaticAnalyzer | |
parent | 15f4c9819d172139c0b37e8a68767ea4fc03e5b6 (diff) |
[analyzer] dynamic_cast: Better model cast from a reference.
Generate a sink when the dynamic_cast from a reference fails to
represent a thrown exception.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8
Diffstat (limited to 'lib/StaticAnalyzer')
-rw-r--r-- | lib/StaticAnalyzer/Core/ExprEngineC.cpp | 23 | ||||
-rw-r--r-- | lib/StaticAnalyzer/Core/RegionStore.cpp | 6 |
2 files changed, 16 insertions, 13 deletions
diff --git a/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/lib/StaticAnalyzer/Core/ExprEngineC.cpp index 5070e9d111..57efd463ae 100644 --- a/lib/StaticAnalyzer/Core/ExprEngineC.cpp +++ b/lib/StaticAnalyzer/Core/ExprEngineC.cpp @@ -304,14 +304,21 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, val = getStoreManager().evalDynamicCast(val, T, Failed); if (Failed) { - // If the cast fails, conjure symbol constrained to 0. - DefinedOrUnknownSVal NewSym = svalBuilder.getConjuredSymbolVal(NULL, - CastE, LCtx, resultType, - currentBuilderContext->getCurrentBlockCount()); - DefinedOrUnknownSVal Constraint = svalBuilder.evalEQ(state, - NewSym, svalBuilder.makeZeroVal(resultType)); - state = state->assume(Constraint, true); - state = state->BindExpr(CastE, LCtx, NewSym); + if (T->isReferenceType()) { + // A bad_cast exception is thrown if input value is a reference. + // Currently, we model this, by generating a sink. + Bldr.generateNode(CastE, Pred, state, true); + continue; + } else { + // If the cast fails on a pointer, conjure symbol constrained to 0. + DefinedOrUnknownSVal NewSym = svalBuilder.getConjuredSymbolVal(NULL, + CastE, LCtx, resultType, + currentBuilderContext->getCurrentBlockCount()); + DefinedOrUnknownSVal Constraint = svalBuilder.evalEQ(state, + NewSym, svalBuilder.makeZeroVal(resultType)); + state = state->assume(Constraint, true); + state = state->BindExpr(CastE, LCtx, NewSym); + } } else { // If we don't know if the cast succeeded, conjure a new symbol. if (val.isUnknown()) { diff --git a/lib/StaticAnalyzer/Core/RegionStore.cpp b/lib/StaticAnalyzer/Core/RegionStore.cpp index 8fb7e88b38..cc3ea8c3bf 100644 --- a/lib/StaticAnalyzer/Core/RegionStore.cpp +++ b/lib/StaticAnalyzer/Core/RegionStore.cpp @@ -896,11 +896,7 @@ SVal RegionStoreManager::evalDynamicCast(SVal base, QualType derivedType, return UnknownVal(); const MemRegion *BaseRegion = baseRegVal->stripCasts(); - // Assume the derived class is a pointer to a CXX record. - // TODO: Note, we do not model reference types: a bad_cast exception is thrown - // when a cast of reference fails, but we just return an UnknownVal. - if (!derivedType->isPointerType()) - return UnknownVal(); + // Assume the derived class is a pointer or a reference to a CXX record. derivedType = derivedType->getPointeeType(); assert(!derivedType.isNull()); const CXXRecordDecl *DerivedDecl = derivedType->getAsCXXRecordDecl(); |