================
@@ -0,0 +1,43 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+
+// Regression test for #206798.
+//
+// &r->s is a field of a symbolic region, so it's symbol-based. A Yoda null
+// check (`nullptr == p`) has to build the same constraint as the normal
+// `p == nullptr`. If it doesn't, the analyzer disagrees with itself and
+// reports a null deref that can't actually happen.
+
+struct S {
+ int n;
+};
+struct T {
+ S s;
+};
+
+int viaFieldAddress(S *p) {
+ if (!p) {
+ }
+ if (nullptr == p) // Yoda-style null check
+ return 0;
+ return p->n; // no-warning: p can't be null here
+}
+
+void callViaFieldAddress(T *r) { viaFieldAddress(&r->s); }
----------------
steakhal wrote:
What's the purpose of this intermediary function? Couldn't the invoked function
be analyzed in top-level context and then introduce a local variable
initialized by `&r->s`?
https://github.com/llvm/llvm-project/pull/209875
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
