[inferbo] Add model for std::shared_ptr<>::operator->

Summary: This diff gives semantics of `std::shared_ptr<>::operator->` as simple assignment.

Reviewed By: ezgicicek

Differential Revision: D19743415

fbshipit-source-id: 888444125

infer/src/bufferoverrun/bufferOverrunModels.ml

@@ -1411,6 +1411,8 @@ module Call = struct
         $--> StdVector.push_back
       ; -"std" &:: "vector" < any_typ &+ any_typ >:: "reserve" $ any_arg $+ any_arg $--> no_model
       ; -"std" &:: "vector" < capt_typ &+ any_typ >:: "size" $ capt_arg $--> StdVector.size
+      ; -"std" &:: "shared_ptr" &:: "operator->" $ capt_exp $--> id
+      ; -"std" &:: "__shared_ptr_access" &:: "operator->" $ capt_exp $--> id
       ; +PatternMatch.implements_collection
         &:: "<init>" <>$ capt_var_exn
         $+ capt_exp_of_typ (+PatternMatch.implements_collection)

infer/tests/codetoanalyze/cpp/bufferoverrun/issues.exp

@@ -72,6 +72,7 @@ codetoanalyze/cpp/bufferoverrun/repro1.cpp, LM<TFM>::lI_FP, 2, INTEGER_OVERFLOW_
 codetoanalyze/cpp/bufferoverrun/repro1.cpp, LM<TFM>::uI, 0, BUFFER_OVERRUN_U5, no_bucket, ERROR, [<Length trace>,Unknown value from: std::unique_ptr<LMB<TFM>,std::default_delete<LMB<TFM>>>::operator->,Array access: Offset: [-oo, +oo] Size: [0, +oo]]
 codetoanalyze/cpp/bufferoverrun/repro1.cpp, am_Good_FP, 5, INTEGER_OVERFLOW_L5, no_bucket, ERROR, [Call,Call,Call,Assignment,Assignment,Call,Parameter `t->bI`,Call,Assignment,Call,<LHS trace>,Parameter `bi`,Binary operation: ([-oo, +oo] - 1):signed32 by call to `ral_good` ]
 codetoanalyze/cpp/bufferoverrun/simple_vector.cpp, my_vector_oob_Bad, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [Parameter `v->_size`,Call,<Offset trace>,Parameter `i`,<Length trace>,Parameter `this->_size`,Array declaration,Assignment,Array access: Offset: v->_size Size: v->_size by call to `int_vector::access_at` ]
+codetoanalyze/cpp/bufferoverrun/smart_ptr.cpp, smart_ptr::call_method_Bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Call,Parameter `n`,Assignment,Call,<Offset trace>,Parameter `this->i`,<Length trace>,Array declaration,Array access: Offset: 8 Size: 5 by call to `smart_ptr::my_class::array_access` ]
 codetoanalyze/cpp/bufferoverrun/smart_ptr.cpp, smart_ptr::shared_ptr_with_const_int_Bad, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: 8 Size: 5 by call to `smart_ptr::my_class::my_class` ]
 codetoanalyze/cpp/bufferoverrun/smart_ptr.cpp, smart_ptr::shared_ptr_with_std_string_Bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: 8 Size: 5 by call to `smart_ptr::my_class::my_class` ]
 codetoanalyze/cpp/bufferoverrun/smart_ptr.cpp, smart_ptr::use_shared_ptr1_Bad, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: 8 Size: 5 by call to `smart_ptr::my_class::my_class` ]

infer/tests/codetoanalyze/cpp/bufferoverrun/smart_ptr.cpp

@@ -26,6 +26,15 @@ class smart_ptr {
       int a[5];
       a[i] = 0;
     }
+
+    int i;
+
+    void set_i(int n) { i = n; }
+
+    void array_access() {
+      int a[5];
+      a[i] = 0;
+    }
   };
 
   void use_shared_ptr1_Good() {
@@ -71,4 +80,16 @@ class smart_ptr {
     const int i = 8;
     std::shared_ptr<my_class> p = std::make_shared<my_class>(i);
   }
+
+  void call_method_Good() {
+    std::shared_ptr<my_class> p = std::make_shared<my_class>(0);
+    p->set_i(3);
+    p->array_access();
+  }
+
+  void call_method_Bad() {
+    std::shared_ptr<my_class> p = std::make_shared<my_class>(0);
+    p->set_i(8);
+    p->array_access();
+  }
 };