[analyzer] We were silently stopping exploring the path after
visiting 'return;' statement!
This most likely caused us to skip a bunch of code when analyzing with
inlining.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151368 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp b/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
index c53b7b1..d2f81ad 100644
--- a/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
@@ -432,7 +432,4 @@
B.generateNode(RS, *it, (*it)->getState());
}
}
- else {
- B.takeNodes(dstPreVisit);
- }
}
diff --git a/test/Analysis/malloc-interprocedural.c b/test/Analysis/malloc-interprocedural.c
index d3a2ea7..0cdd9fb 100644
--- a/test/Analysis/malloc-interprocedural.c
+++ b/test/Analysis/malloc-interprocedural.c
@@ -69,3 +69,19 @@
int *data;
my_free1((int*)data);
}
+
+// Test that we keep processing after 'return;'
+void fooWithEmptyReturn(int x) {
+ if (x)
+ return;
+ x++;
+ return;
+}
+
+int uafAndCallsFooWithEmptyReturn() {
+ int *x = (int*)malloc(12);
+ free(x);
+ fooWithEmptyReturn(12);
+ return *x; // expected-warning {{Use of memory after it is freed}}
+}
+
