[analyzer] canonicalize special case of structure/pointer deref
authorVince Bridgers <vince.a.bridgers@gmail.com>
Tue, 28 Sep 2021 13:42:31 +0000 (08:42 -0500)
committereinvbri <vince.a.bridgers@ericsson.com>
Wed, 6 Oct 2021 10:18:27 +0000 (05:18 -0500)
commitb29186c08ae230d0decbca67565be68919c6b24d
tree25ee1f76f835553acf1ee2cfc31e8b36e76cfe42
parentc11e7b59d2e9a221b2a956dcc0e0711eec12118e
[analyzer] canonicalize special case of structure/pointer deref

This simple change addresses a special case of structure/pointer
aliasing that produced different symbolvals, leading to false positives
during analysis.

The reproducer is as simple as this.

```lang=C++
struct s {
  int v;
};

void foo(struct s *ps) {
  struct s ss = *ps;
  clang_analyzer_dump(ss.v); // reg_$1<int Element{SymRegion{reg_$0<struct s *ps>},0 S64b,struct s}.v>
  clang_analyzer_dump(ps->v); //reg_$3<int SymRegion{reg_$0<struct s *ps>}.v>
  clang_analyzer_eval(ss.v == ps->v); // UNKNOWN
}
```

Acks: Many thanks to @steakhal and @martong for the group debug session.

Reviewed By: steakhal, martong

Differential Revision: https://reviews.llvm.org/D110625
clang/lib/StaticAnalyzer/Core/Store.cpp
clang/test/Analysis/ptr-arith.c