From 94ae8fd470471134114599ccfc2301da05719212 Mon Sep 17 00:00:00 2001 From: Ted Kremenek Date: Thu, 31 Mar 2011 04:46:53 +0000 Subject: Static analyzer: fix bug in handling of dynamic_cast<>. The sink node wouldn't always be the final node, thus causing the state to continue propagating. Instead, recover some path-sensitivity by conjuring a symbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128612 91177308-0d34-0410-b5e6-96231b3b80d8 --- test/Analysis/misc-ps-region-store.cpp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'test/Analysis') diff --git a/test/Analysis/misc-ps-region-store.cpp b/test/Analysis/misc-ps-region-store.cpp index 26a31526b7..4ead8bb617 100644 --- a/test/Analysis/misc-ps-region-store.cpp +++ b/test/Analysis/misc-ps-region-store.cpp @@ -264,3 +264,17 @@ void rdar9212512() { } } +// Test basic support for dynamic_cast<>. +struct Rdar9212495_C { virtual void bar() const; }; +class Rdar9212495_B : public Rdar9212495_C {}; +class Rdar9212495_A : public Rdar9212495_B {}; +const Rdar9212495_A& rdar9212495(const Rdar9212495_C* ptr) { + const Rdar9212495_A& val = dynamic_cast(*ptr); + + if (&val == 0) { + val.bar(); // FIXME: This should eventually be a null dereference. + } + + return val; +} + -- cgit v1.2.1