================
@@ -0,0 +1,43 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+
+// Regression test for #206798.
+//
+// &r->s is a field of a symbolic region, so it's symbol-based. A Yoda null
+// check (`nullptr == p`) has to build the same constraint as the normal
+// `p == nullptr`. If it doesn't, the analyzer disagrees with itself and
+// reports a null deref that can't actually happen.
+
+struct S {
+ int n;
+};
+struct T {
+ S s;
+};
+
+int viaFieldAddress(S *p) {
+ if (!p) {
+ }
+ if (nullptr == p) // Yoda-style null check
----------------
steakhal wrote:
I'd probably go as far as not even mentioning Yoda. Let's just call it swapped.
Also in the name of the test, just suffix it with swapped.
Canonical may suggest something different in the engine, usually referring to
aliasing pointers where the pointees should be canonicalized (so that they
actually considered aliasing). They frequently appear in the context of
reinterpret cast, etc. Which is not really the case here so let's avoid
`canonical` if possible.
https://github.com/llvm/llvm-project/pull/209875
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
