diff --git a/clang/lib/Analysis/GRExprEngine.cpp b/clang/lib/Analysis/GRExprEngine.cpp index 3c2512215a36..0336ae5ada3b 100644 --- a/clang/lib/Analysis/GRExprEngine.cpp +++ b/clang/lib/Analysis/GRExprEngine.cpp @@ -1221,7 +1221,8 @@ void GRExprEngine::ProcessSwitch(GRSwitchNodeBuilder& builder) { do { nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1.Val.getInt())); - DefinedOrUnknownSVal Res = SVator.EvalEQ(DefaultSt, CondV, CaseVal); + DefinedOrUnknownSVal Res = SVator.EvalEQ(DefaultSt ? DefaultSt : state, + CondV, CaseVal); // Now "assume" that the case matches. if (const GRState* stateNew = state->Assume(Res, true)) { @@ -1236,11 +1237,17 @@ void GRExprEngine::ProcessSwitch(GRSwitchNodeBuilder& builder) { // Now "assume" that the case doesn't match. Add this state // to the default state (if it is feasible). - if (const GRState *stateNew = DefaultSt->Assume(Res, false)) { - defaultIsFeasible = true; - DefaultSt = stateNew; + if (DefaultSt) { + if (const GRState *stateNew = DefaultSt->Assume(Res, false)) { + defaultIsFeasible = true; + DefaultSt = stateNew; + } + else { + defaultIsFeasible = false; + DefaultSt = NULL; + } } - + // Concretize the next value in the range. if (V1.Val.getInt() == V2.Val.getInt()) break; diff --git a/clang/test/Analysis/misc-ps-ranges.m b/clang/test/Analysis/misc-ps-ranges.m index 760b4d743357..df7e97c46736 100644 --- a/clang/test/Analysis/misc-ps-ranges.m +++ b/clang/test/Analysis/misc-ps-ranges.m @@ -21,3 +21,40 @@ int main(int argc, char* argv[]) { return *p; // no-warning } + +// PR 5969: the comparison of argc < 3 || argc > 4 should constraint the switch +// statement from having the 'default' branch taken. This previously reported a false +// positive with the use of 'v'. + +int pr5969(int argc, char *argv[]) { + + int v; + + if ((argc < 3) || (argc > 4)) return 0; + + switch(argc) { + case 3: + v = 33; + break; + case 4: + v = 44; + break; + } + + return v; // no-warning +} + +int pr5969_positive(int argc, char *argv[]) { + + int v; + + if ((argc < 3) || (argc > 4)) return 0; + + switch(argc) { + case 3: + v = 33; + break; + } + + return v; // expected-warning{{Undefined or garbage value returned to caller}} +}