diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h index eef7a54f03bf1..29f534eba2a26 100644 --- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h +++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h @@ -487,6 +487,7 @@ class ProgramState : public llvm::FoldingSetNode { friend void ProgramStateRetain(const ProgramState *state); friend void ProgramStateRelease(const ProgramState *state); + SVal desugarReference(SVal Val) const; SVal wrapSymbolicRegion(SVal Base) const; }; diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp index 22eab9f66418d..648c7daf823ed 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -1206,15 +1206,7 @@ void ExprEngine::ProcessInitializer(const CFGInitializer CFGInit, while ((ASE = dyn_cast(Init))) Init = ASE->getBase()->IgnoreImplicit(); - SVal LValue = State->getSVal(Init, stackFrame); - if (!Field->getType()->isReferenceType()) { - if (std::optional LValueLoc = LValue.getAs()) { - InitVal = State->getSVal(*LValueLoc); - } else if (auto CV = LValue.getAs()) { - // Initializer list for an array. - InitVal = *CV; - } - } + InitVal = State->getSVal(Init, stackFrame); // If we fail to get the value for some reason, use a symbolic value. if (InitVal.isUnknownOrUndef()) { diff --git a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp index 02d1358a2001e..ad4e43630dd44 100644 --- a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp +++ b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp @@ -65,6 +65,11 @@ using namespace ento; // MemRegion Construction. //===----------------------------------------------------------------------===// +[[maybe_unused]] static bool isAReferenceTypedValueRegion(const MemRegion *R) { + const auto *TyReg = llvm::dyn_cast(R); + return TyReg && TyReg->getValueType()->isReferenceType(); +} + template RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const SuperTy *superRegion) { @@ -76,6 +81,7 @@ RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, if (!R) { R = new (A) RegionTy(arg1, superRegion); Regions.InsertNode(R, InsertPos); + assert(!isAReferenceTypedValueRegion(superRegion)); } return R; @@ -92,6 +98,7 @@ RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2, if (!R) { R = new (A) RegionTy(arg1, arg2, superRegion); Regions.InsertNode(R, InsertPos); + assert(!isAReferenceTypedValueRegion(superRegion)); } return R; @@ -110,6 +117,7 @@ RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2, if (!R) { R = new (A) RegionTy(arg1, arg2, arg3, superRegion); Regions.InsertNode(R, InsertPos); + assert(!isAReferenceTypedValueRegion(superRegion)); } return R; diff --git a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp index 0be2709f0907d..d4f56342d934c 100644 --- a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp +++ b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp @@ -205,6 +205,16 @@ ProgramStateRef ProgramState::killBinding(Loc LV) const { return makeWithStore(newStore); } +/// We should never form a MemRegion that would wrap a TypedValueRegion of a +/// reference type. What we actually wanted was to create a MemRegion refering +/// to the pointee of that reference. +SVal ProgramState::desugarReference(SVal Val) const { + const auto *TyReg = dyn_cast_or_null(Val.getAsRegion()); + if (!TyReg || !TyReg->getValueType()->isReferenceType()) + return Val; + return getSVal(TyReg); +} + /// SymbolicRegions are expected to be wrapped by an ElementRegion as a /// canonical representation. As a canonical representation, SymbolicRegions /// should be wrapped by ElementRegions before getting a FieldRegion. @@ -445,12 +455,14 @@ void ProgramState::setStore(const StoreRef &newStore) { } SVal ProgramState::getLValue(const FieldDecl *D, SVal Base) const { + Base = desugarReference(Base); Base = wrapSymbolicRegion(Base); return getStateManager().StoreMgr->getLValueField(D, Base); } SVal ProgramState::getLValue(const IndirectFieldDecl *D, SVal Base) const { StoreManager &SM = *getStateManager().StoreMgr; + Base = desugarReference(Base); Base = wrapSymbolicRegion(Base); // FIXME: This should work with `SM.getLValueField(D->getAnonField(), Base)`, diff --git a/clang/test/Analysis/initializer.cpp b/clang/test/Analysis/initializer.cpp index 16d7a348fdfb6..f50afff25d245 100644 --- a/clang/test/Analysis/initializer.cpp +++ b/clang/test/Analysis/initializer.cpp @@ -366,3 +366,29 @@ void testI() { clang_analyzer_eval(B::b == 2); // expected-warning{{TRUE}} } } // namespace dont_skip_vbase_initializers_in_most_derived_class + +namespace elementwise_copy_small_array_from_post_initializer_of_cctor { +struct String { + String(const String &) {} +}; + +struct MatchComponent { + unsigned numbers[2]; + String prerelease; + MatchComponent(MatchComponent const &) = default; +}; + +MatchComponent get(); +void consume(MatchComponent const &); + +MatchComponent parseMatchComponent() { + MatchComponent component = get(); + component.numbers[0] = 10; + component.numbers[1] = 20; + return component; // We should have no stack addr escape warning here. +} + +void top() { + consume(parseMatchComponent()); +} +} // namespace elementwise_copy_small_array_from_post_initializer_of_cctor