2ed0e79bb8
SymbolReaper now realizes that our liveness analysis isn't sharp enough to discriminate between liveness of, say, variables and their fields. Surprisingly, this didn't quite work before: having a variable live only through Environment (eg., calling a C++ method on a local variable as the last action ever performed on that variable) would not keep the region value symbol of a field of that variable alive. It would have been broken in the opposite direction as well, but both Environment and RegionStore use the scanReachableSymbols mechanism for finding live symbols regions within their values, and due to that they accidentally end up marking the whole chain of super-regions as live when at least one sub-region is known to be live. It is now a direct responsibility of SymbolReaper to maintain this invariant, and a unit test was added in order to make sure it stays that way. Differential Revision: https://reviews.llvm.org/D56632 rdar://problem/46914108 llvm-svn: 351499
31 lines
1.1 KiB
C++
31 lines
1.1 KiB
C++
// RUN: %clang_analyze_cc1 -w -analyzer-checker=core,cplusplus -analyzer-output=text -verify %s
|
|
|
|
namespace no_crash_on_delete_dtor {
|
|
// We were crashing when producing diagnostics for this code, but not for the
|
|
// report that it currently emits. Instead, Static Analyzer was thinking that
|
|
// p.get()->foo() is a null dereference because it was dropping
|
|
// constraints over x too early and took a different branch next time
|
|
// we call .get().
|
|
struct S {
|
|
void foo();
|
|
~S();
|
|
};
|
|
|
|
struct smart_ptr {
|
|
int x;
|
|
S *s;
|
|
smart_ptr(S *);
|
|
S *get() {
|
|
return (x || 0) ? nullptr : s; // expected-note{{Left side of '||' is false}}
|
|
// expected-note@-1{{'?' condition is false}}
|
|
// expected-warning@-2{{Use of memory after it is freed}}
|
|
// expected-note@-3{{Use of memory after it is freed}}
|
|
}
|
|
};
|
|
|
|
void bar(smart_ptr p) {
|
|
delete p.get(); // expected-note{{Memory is released}}
|
|
p.get()->foo(); // expected-note{{Calling 'smart_ptr::get'}}
|
|
}
|
|
} // namespace no_crash_on_delete_dtor
|