================
@@ -451,7 +444,8 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const
Expr *Ex,
if (T->isReferenceType()) {
// A bad_cast exception is thrown if input value is a reference.
// Currently, we model this, by generating a sink.
- Bldr.generateSink(CastE, Pred, state);
+ Dst.insert(Engine.makePostStmtNode(CastE, state, Pred,
+ /* MarkAsSink */ true));
----------------
NagyDonat wrote:
```suggestion
Engine.makePostStmtNode(CastE, state, Pred, /*MarkAsSink=*/true);
```
`ExplodedNodeSet` has an invariant that it never contains [null or] sink nodes,
trying to insert a sink node is a no-op (and `MarkAsSink` guarantees that the
result is null or sink).
The only effect of creating a sink node is that:
- it will appear in the exploded graph as a child of its parent node;
- it can be used as an error node in a checker that wants to create a bug
report.
Note that we often use the phrase "we sink the execution path" but the sink
node itself is usually irrelevant and the "real" effect of `generateSink` is
that it removes the parent of the sink node from the `Frontier` of the node
builder (without inserting a new node into the `Frontier`).
After the removal of the `NodeBuilders` it becomes easier to see that these
sinks are mostly useless (although their presence in the graph can influence a
few things) -- but the were already mostly useless even before the refactoring.
https://github.com/llvm/llvm-project/pull/212186
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
