From 2fdc07ee8972b41032a98ed7699fed132557a78e Mon Sep 17 00:00:00 2001
From: Jordan Rose <jordan_rose@apple.com>
Date: Tue, 12 Jun 2012 00:20:22 +0000
Subject: [PATCH] Revert "[analyzer] Treat LValueBitCasts like regular pointer
 bit casts."

This does not actually give us the right behavior for reinterpret_cast
of references. Reverting so I can think about it some more.

This reverts commit 50a75a6e26a49011150067adac556ef978639fe6.

llvm-svn: 158341
---
 clang/lib/StaticAnalyzer/Core/ExprEngine.cpp  |  2 +-
 clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp |  4 +--
 clang/lib/StaticAnalyzer/Core/RegionStore.cpp | 13 +++----
 clang/test/Analysis/casts.cpp                 | 36 -------------------
 4 files changed, 7 insertions(+), 48 deletions(-)
 delete mode 100644 clang/test/Analysis/casts.cpp

diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
index fb41a9384c8a..a95f565b6c9d 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -1641,7 +1641,7 @@ void ExprEngine::evalLoad(ExplodedNodeSet &Dst,
   assert(!isa<NonLoc>(location) && "location cannot be a NonLoc.");
   assert(!isa<loc::ObjCPropRef>(location));
 
-  // Are we loading from a reference?  This actually results in two loads; one
+  // Are we loading from a region?  This actually results in two loads; one
   // to fetch the address of the referenced value and one to fetch the
   // referenced value.
   if (const TypedValueRegion *TR =
diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp
index 2e3e9f51e7df..670786000935 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp
@@ -279,7 +279,6 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
       case CK_Dependent:
       case CK_ArrayToPointerDecay:
       case CK_BitCast:
-      case CK_LValueBitCast:
       case CK_IntegralCast:
       case CK_NullToPointer:
       case CK_IntegralToPointer:
@@ -378,7 +377,8 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
       case CK_UserDefinedConversion:
       case CK_ConstructorConversion:
       case CK_VectorSplat:
-      case CK_MemberPointerToBoolean: {
+      case CK_MemberPointerToBoolean:
+      case CK_LValueBitCast: {
         // Recover some path-sensitivty by conjuring a new value.
         QualType resultType = CastE->getType();
         if (CastE->isGLValue())
diff --git a/clang/lib/StaticAnalyzer/Core/RegionStore.cpp b/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
index 86a68a6b3a59..9c00d963432b 100644
--- a/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/clang/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -878,15 +878,10 @@ SVal RegionStoreManager::ArrayToPointer(Loc Array) {
   if (!ArrayR)
     return UnknownVal();
 
-  // Extract the element type from the array region's ValueType.
-  // Be careful about weird things happening due to user-written casts.
-  QualType T = ArrayR->getValueType();
-  if (const ArrayType *AT = Ctx.getAsArrayType(T))
-    T = AT->getElementType();
-  else if (const PointerType *PT = T->getAs<PointerType>())
-    T = PT->getPointeeType();
-  else
-    return UnknownVal();
+  // Strip off typedefs from the ArrayRegion's ValueType.
+  QualType T = ArrayR->getValueType().getDesugaredType(Ctx);
+  const ArrayType *AT = cast<ArrayType>(T);
+  T = AT->getElementType();
 
   NonLoc ZeroIdx = svalBuilder.makeZeroArrayIndex();
   return loc::MemRegionVal(MRMgr.getElementRegion(T, ZeroIdx, ArrayR, Ctx));
diff --git a/clang/test/Analysis/casts.cpp b/clang/test/Analysis/casts.cpp
deleted file mode 100644
index 046ffb53c8ff..000000000000
--- a/clang/test/Analysis/casts.cpp
+++ /dev/null
@@ -1,36 +0,0 @@
-// RUN: %clang_cc1 -analyze -analyzer-checker=core,experimental.core -analyzer-store=region -verify %s
-
-void fill_r (int * const &x);
-
-char testPointer () {
-  int x[8];
-  int *xp = x;
-  fill_r(xp);
-
-  return x[0]; // no-warning
-}
-
-char testArray () {
-  int x[8];
-  fill_r(x);
-
-  return x[0]; // no-warning
-}
-
-char testReferenceCast () {
-  int x[8];
-  int *xp = x;
-  fill_r(reinterpret_cast<int * const &>(xp));
-  
-  return x[0]; // no-warning
-}
-
-
-void fill (int *x);
-char testReferenceCastRValue () {
-  int x[8];
-  int *xp = x;
-  fill(reinterpret_cast<int * const &>(xp));
-
-  return x[0]; // no-warning
-}