If the SymbolicRegion was cast to another type, use that type to create the

ElementRegion.

llvm-svn: 73754

clang/lib/Analysis/RegionStore.cpp

@@ -749,9 +749,15 @@ SVal RegionStoreManager::EvalBinOp(const GRState *state,
   // If the operand is a symbolic or alloca region, create the first element
   // region on it.
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR)) {
-    // Get symbol's type. It should be a pointer type.
-    SymbolRef Sym = SR->getSymbol();
-    QualType T = Sym->getType(getContext());
+    QualType T;
+    // If the SymbolicRegion was cast to another type, use that type.
+    if (const QualType *t = state->get<RegionCasts>(SR)) {
+      T = *t;
+    } else {
+      // Otherwise use the symbol's type.
+      SymbolRef Sym = SR->getSymbol();
+      T = Sym->getType(getContext());
+    }
     QualType EleTy = T->getAsPointerType()->getPointeeType();
 
     SVal ZeroIdx = ValMgr.makeZeroArrayIndex();

clang/test/Analysis/casts.c

@@ -27,3 +27,12 @@ int f1(struct s **pval) {
   char c = (unsigned char) *tbool; // Should use cast-to type to create symbol.
 }
 
+void f2(const char *str) {
+ unsigned char ch, cl, *p;
+
+ p = (unsigned char *)str;
+ ch = *p++; // use cast-to type 'unsigned char' to create element region.
+ cl = *p++;
+ if(!cl)
+    cl = 'a';
+}