Index: cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h =================================================================== --- cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h +++ cfe/trunk/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h @@ -83,6 +83,8 @@ BugReport &BR); }; +/// Finds last store into the given region, +/// which is different from a given symbolic value. class FindLastStoreBRVisitor final : public BugReporterVisitor { const MemRegion *R; SVal V; Index: cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp =================================================================== --- cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp +++ cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp @@ -1294,8 +1294,7 @@ if (const auto *BDR = dyn_cast_or_null(V.getAsRegion())) { if (const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) { - if (Optional KV = - State->getSVal(OriginalR).getAs()) + if (auto KV = State->getSVal(OriginalR).getAs()) BR.addVisitor(llvm::make_unique( *KV, OriginalR, EnableNullFPSuppression)); } @@ -1752,8 +1751,18 @@ else RVal = state->getSVal(L->getRegion()); - if (auto KV = RVal.getAs()) - report.addVisitor(llvm::make_unique( + // FIXME: this is a hack for fixing a later crash when attempting to + // dereference a void* pointer. + // We should not try to dereference pointers at all when we don't care + // what is written inside the pointer. + bool ShouldFindLastStore = true; + if (const auto *SR = dyn_cast(L->getRegion())) + if (SR->getSymbol()->getType()->getPointeeType()->isVoidType()) + ShouldFindLastStore = false; + + if (ShouldFindLastStore) + if (auto KV = RVal.getAs()) + report.addVisitor(llvm::make_unique( *KV, L->getRegion(), EnableNullFPSuppression)); const MemRegion *RegionRVal = RVal.getAsRegion(); Index: cfe/trunk/test/Analysis/diagnostics/find_last_store.c =================================================================== --- cfe/trunk/test/Analysis/diagnostics/find_last_store.c +++ cfe/trunk/test/Analysis/diagnostics/find_last_store.c @@ -0,0 +1,17 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-output=text -verify %s +typedef struct { float b; } c; +void *a(); +void *d() { + return a(); // expected-note{{Returning pointer}} +} + +void no_find_last_store() { + c *e = d(); // expected-note{{Calling 'd'}} + // expected-note@-1{{Returning from 'd'}} + // expected-note@-2{{'e' initialized here}} + + (void)(e || e->b); // expected-note{{Assuming 'e' is null}} + // expected-note@-1{{Left side of '||' is false}} + // expected-note@-2{{Access to field 'b' results in a dereference of a null pointer (loaded from variable 'e')}} + // expected-warning@-3{{Access to field 'b' results in a dereference of a null pointer (loaded from variable 'e')}} +}