[analyzer] Cleanup a FIXME in SValBuilder.cpp

[vabridgers]

Summary

This change follows up on a FIXME submitted with D105974. This change simply let's the reference case fall through to return a concrete 'true'
instead of a nonloc pointer of appropriate length set to NULL.

[NoQ]

Looks correct.

Tests pls? I think that's one of the places where clang_analyzer_dump() is appropriate.

[vabridgers]

I'll add a test and repost. Thanks!

[vabridgers]

Add missing test case :)

[vabridgers]

add test case

[vabridgers]

only need the one test case

[NoQ]

Awesome, thanks!

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

if (const FunctionCodeRegion *FTR = dyn_cast<FunctionCodeRegion>(R))
           return nonloc::SymbolVal(SymMgr.getExtentSymbol(FTR));
 
     if (const SymbolicRegion *SymR = R->getSymbolicBase()) {
       SymbolRef Sym = SymR->getSymbol();
       QualType Ty = Sym->getType();
       // This change is needed for architectures with varying
       // pointer widths. See the amdgcn opencl reproducer with
       // this change as an example: solver-sym-simplification-ptr-bool.cl
-      // FIXME: We could encounter a reference here,
-      //        try returning a concrete 'true' since it might
-      //        be easier on the solver.
       // FIXME: Cleanup remainder of `getZeroWithPtrWidth ()`
       //        and `getIntWithPtrWidth()` functions to prevent future
       //        confusion
-      const llvm::APSInt &Zero = Ty->isReferenceType()
-                                     ? BasicVals.getZeroWithPtrWidth()
-                                     : BasicVals.getZeroWithTypeSize(Ty);
-      return makeNonLoc(Sym, BO_NE, Zero, CastTy);
+      if (!Ty->isReferenceType())
+        return makeNonLoc(Sym, BO_NE, BasicVals.getZeroWithTypeSize(Ty),
+                          CastTy);
     }
     // Non-symbolic memory regions are always true.
     return makeTruthVal(true, CastTy);
   }
 
   const bool IsUnknownOriginalType = OriginalTy.isNull();
   // Try to cast to array
   const auto *ArrayTy =

clang/test/Analysis/solver-sym-simplification-bool.cpp

+// RUN: %clang_analyze_cc1 -analyze -analyzer-checker=core \
+// RUN: -analyzer-checker=debug.ExprInspection -verify %s
+
+void clang_analyzer_dump(bool);
+
+void foo(int &x) {
+  int *p = &x; // 'p' is the same SVal as 'x'
+  bool b = p;
+  clang_analyzer_dump(b); // expected-warning {{1 U1b}}
+}