================
@@ -0,0 +1,43 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+
+// Regression test for #206798.
+//
+// &r->s is a field of a symbolic region, so it's symbol-based. A Yoda null
+// check (`nullptr == p`) has to build the same constraint as the normal
+// `p == nullptr`. If it doesn't, the analyzer disagrees with itself and
+// reports a null deref that can't actually happen.
+
+struct S {
+ int n;
+};
+struct T {
+ S s;
+};
+
+int viaFieldAddress(S *p) {
+ if (!p) {
+ }
+ if (nullptr == p) // Yoda-style null check
+ return 0;
+ return p->n; // no-warning: p can't be null here
+}
+
+void callViaFieldAddress(T *r) { viaFieldAddress(&r->s); }
+
+// The normal `p == nullptr` order should still work too.
----------------
steakhal wrote:
My problem with this and similar comments is that:
- It is far away from where it matters/refers to.
- it doesn't tell much what "work" means here. If anything, it should signal
the expectation.
This is usually done by: `// FIXME: why...` or `// no-warning: why...` comments
attached to the relevant lines. I'd suggest the latter in this context.
https://github.com/llvm/llvm-project/pull/209875
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
