[analyzer] operator new: Model the cast of returned pointer into object type.
authorArtem Dergachev <artem.dergachev@gmail.com>
Wed, 17 Jan 2018 22:51:19 +0000 (22:51 +0000)
committerArtem Dergachev <artem.dergachev@gmail.com>
Wed, 17 Jan 2018 22:51:19 +0000 (22:51 +0000)
commitbeba5307463158c5b5cfbe7c1be987e781a81e69
treefa180b8632a366dca31672360645f92971088848
parent6b3e48b46a6e2b3283a9d37cfa3e0ac9c2ff91bb
[analyzer] operator new: Model the cast of returned pointer into object type.

According to [basic.stc.dynamic.allocation], the return type of any C++
overloaded operator new() is "void *". However, type of the new-expression
"new T()" and the type of "this" during construction of "T" are both "T *".

Hence an implicit cast, which is not present in the AST, needs to be performed
before the construction. This patch adds such cast in the case when the
allocator was indeed inlined. For now, in the case where the allocator was *not*
inlined we still use the same symbolic value (which is a pure SymbolicRegion of
type "T *") because it is consistent with how we represent the casts and causes
less surprise in the checkers after switching to the new behavior.

The better approach would be to represent that value as a cast over a
SymbolicRegion of type "void *", however we have technical difficulties
conjuring such region without any actual expression of type "void *" present in
the AST.

Differential Revision: https://reviews.llvm.org/D41250
rdar://problem/12180598

llvm-svn: 322777
clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
clang/test/Analysis/new-ctor-conservative.cpp
clang/test/Analysis/new-ctor-inlined.cpp