[analyzer] Improve modeling of static initializers.

[ygribov]

Summary

Conversions between unrelated pointer types (e.g. char * and void *) involve bitcasts which were not properly modeled in case of static initializers. The patch fixes this problem.

The problem was originally spotted by Artem Dergachev.

[zaks.anna]

test/Analysis/inline.cpp

308 ↗

(On Diff #40144)

Why are we checking that the first element is not '0'?

[ygribov]

test/Analysis/inline.cpp

308 ↗

(On Diff #40144)

We could check s[0] as well, there is no difference actually.

[zaks.anna]

Fixed and committed.

test/Analysis/inline.cpp

308 ↗

(On Diff #40144)

Why we are checking for non-equality to '0' instead of checking for equality to 'b'?

[ygribov]

test/Analysis/inline.cpp

308 ↗

(On Diff #40144)

Ah yeah, that would be more precise.

cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp

Optional<SVal> SValBuilder::getConstantVal(const Expr *E) {
   case Stmt::ObjCBoolLiteralExprClass:
     return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
 
   case Stmt::CXXNullPtrLiteralExprClass:
     return makeNull();
 
   case Stmt::ImplicitCastExprClass: {
     const CastExpr *CE = cast<CastExpr>(E);
-    if (CE->getCastKind() == CK_ArrayToPointerDecay) {
-      Optional<SVal> ArrayVal = getConstantVal(CE->getSubExpr());
-      if (!ArrayVal)
+    switch (CE->getCastKind()) {
+    default:
+      break;
+    case CK_ArrayToPointerDecay:
+    case CK_BitCast: {
+      const Expr *SE = CE->getSubExpr();
+      Optional<SVal> Val = getConstantVal(SE);
+      if (!Val)
         return None;
-      return evalCast(*ArrayVal, CE->getType(), CE->getSubExpr()->getType());
+      return evalCast(*Val, CE->getType(), SE->getType());
+    }
     }
     // FALLTHROUGH
   }
 
   // If we don't have a special case, fall back to the AST's constant evaluator.
   default: {
     // Don't try to come up with a value for materialized temporaries.
     if (E->isGLValue())

cfe/trunk/test/Analysis/inline.cpp

namespace DefaultArgs {
   }
 
   void testReference() {
     clang_analyzer_eval(defaultReference(1) == -1); // expected-warning{{TRUE}}
     clang_analyzer_eval(defaultReference() == -42); // expected-warning{{TRUE}}
 
     clang_analyzer_eval(defaultReferenceZero(1) == -1); // expected-warning{{TRUE}}
     clang_analyzer_eval(defaultReferenceZero() == 0); // expected-warning{{TRUE}}
   }
 
   double defaultFloatReference(const double &i = 42) {
     return -i;
   }
   double defaultFloatReferenceZero(const double &i = 0) {
     return -i;
   }
 
   void testFloatReference() {
     clang_analyzer_eval(defaultFloatReference(1) == -1); // expected-warning{{UNKNOWN}}
     clang_analyzer_eval(defaultFloatReference() == -42); // expected-warning{{UNKNOWN}}
 
     clang_analyzer_eval(defaultFloatReferenceZero(1) == -1); // expected-warning{{UNKNOWN}}
     clang_analyzer_eval(defaultFloatReferenceZero() == 0); // expected-warning{{UNKNOWN}}
   }
 
   char defaultString(const char *s = "abc") {
     return s[1];
   }
 
   void testString() {
     clang_analyzer_eval(defaultString("xyz") == 'y'); // expected-warning{{TRUE}}
     clang_analyzer_eval(defaultString() == 'b'); // expected-warning{{TRUE}}
   }
+
+  const void * const void_string = "abc";
+
+  void testBitcastedString() {
+    clang_analyzer_eval(0 != void_string); // expected-warning{{TRUE}}
+    clang_analyzer_eval('b' == ((char *)void_string)[1]); // expected-warning{{TRUE}}
+  }
 }
 
 namespace OperatorNew {
   class IntWrapper {
   public:
     int value;
 
     IntWrapper(int input) : value(input) {