Fix bucketing for variables passed by reference

Reviewed By: akotulski

Differential Revision: D3358473

fbshipit-source-id: ed7a509

infer/src/backend/errdesc.ml

@@ -693,6 +693,14 @@ let explain_dexp_access prop dexp is_nullable =
                (L.d_str "lookup: case not matched on Darray ";
                 Sil.d_sexp se1; L.d_str " "; Sil.d_sexp se2; L.d_ln());
              None)
+    | Sil.Darrow ((Sil.Dpvaraddr pvar), f) ->
+        (match lookup (Sil.Dpvaraddr pvar) with
+         | None -> None
+         | Some Sil.Estruct (fsel, _) ->
+             lookup_fld fsel f
+         | Some _ ->
+             if verbose then (L.d_str "lookup: case not matched on Darrow "; L.d_ln ());
+             None)
     | Sil.Darrow (de1, f) ->
         (match lookup (Sil.Dderef de1) with
          | None -> None
@@ -730,6 +738,9 @@ let explain_dexp_access prop dexp is_nullable =
       when method_of_pointer_wrapper pname ->
         if verbose then (L.d_strln "lookup: found Dretcall ");
         Some (Sil.Eexp (Sil.Const c, Sil.Ireturn_from_pointer_wrapper_call loc.Location.line))
+    | Sil.Dpvaraddr pvar ->
+        (L.d_strln ("lookup: found Dvaraddr " ^ Sil.dexp_to_string (Sil.Dpvaraddr pvar)));
+        find_ptsto (Sil.Lvar pvar)
     | de ->
         if verbose then (L.d_strln ("lookup: unknown case not matched " ^ Sil.dexp_to_string de));
         None in

infer/tests/codetoanalyze/cpp/errors/npe/npe_added_to_b1.cpp

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2016 - present Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD style license found in the
+ * LICENSE file in the root directory of this source tree. An additional grant
+ * of patent rights can be found in the PATENTS file in the same directory.
+ */
+
+#include <memory>
+
+int deref_ref(std::shared_ptr<int>& p) { return *p; }
+
+int causes_npe() {
+  std::shared_ptr<int> x;
+  return deref_ref(x);
+}
+
+class Person {
+ public:
+  Person() { f1 = nullptr; }
+  int* f1;
+};
+
+int deref_person(Person& p) { return *(p.f1); }
+
+int causes_npe_person() {
+  Person p;
+  return deref_person(p);
+}

infer/tests/endtoend/cpp/NPEAddedToB1Test.java

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2015 - present Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD style license found in the
+ * LICENSE file in the root directory of this source tree. An additional grant
+ * of patent rights can be found in the PATENTS file in the same directory.
+ */
+
+package endtoend.cpp;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static utils.matchers.ResultContainsErrorInMethod.contains;
+import static utils.matchers.ResultContainsExactly.containsExactly;
+import static utils.matchers.ResultContainsNoErrorInMethod.doesNotContain;
+
+import com.google.common.collect.ImmutableList;
+
+import org.junit.BeforeClass;
+import org.junit.ClassRule;
+import org.junit.Test;
+
+import java.io.IOException;
+
+import utils.DebuggableTemporaryFolder;
+import utils.InferException;
+import utils.InferResults;
+import utils.InferRunner;
+
+public class NPEAddedToB1Test {
+
+  public static final String FILE =
+      "infer/tests/codetoanalyze/cpp/errors/npe/npe_added_to_b1.cpp";
+
+  private static ImmutableList<String> inferCmd;
+
+  public static final String NULL_DEREFERENCE = "NULL_DEREFERENCE";
+
+  @ClassRule
+  public static DebuggableTemporaryFolder folder =
+      new DebuggableTemporaryFolder();
+
+  @BeforeClass
+  public static void runInfer() throws InterruptedException, IOException {
+    inferCmd = InferRunner.createCPPInferCommandFilter(folder, FILE);
+  }
+
+  @Test
+  public void whenInferRunsOnMethodCallThenNoNPEFound()
+      throws InterruptedException, IOException, InferException {
+    InferResults inferResults = InferRunner.runInferCPP(inferCmd);
+    String[] procedures = {"causes_npe", "causes_npe_person"};
+    assertThat(
+        "Results should contain " + NULL_DEREFERENCE,
+        inferResults,
+        containsExactly(
+            NULL_DEREFERENCE,
+            FILE,
+            procedures
+        )
+    );
+  }
+}

infer/tests/utils/InferRunner.java

@@ -261,7 +261,8 @@ public class InferRunner {
       @Nullable String ml_buckets,
       boolean arc,
       boolean headers,
-      boolean testingMode) {
+      boolean testingMode,
+      boolean filter) {
     File resultsDir = createResultsDir(folder);
     String resultsDirName = resultsDir.getAbsolutePath();
     InferRunner.bugsFile = new File(resultsDir, BUGS_FILE_NAME);
@@ -288,10 +289,15 @@ public class InferRunner {
     if (testingMode) {
       testingModeOption.add("--testing_mode");
     }
+    ImmutableList.Builder<String> doNotFilterOption =
+        new ImmutableList.Builder<>();
+    if (!filter) {
+      doNotFilterOption.add("--no-filtering");
+    }
     ImmutableList<String> inferCmd = new ImmutableList.Builder<String>()
         .add("infer")
         .add("--no-progress-bar")
-        .add("--no-filtering")
+        .addAll(doNotFilterOption.build())
         .add("--out")
         .add(resultsDirName)
         .addAll(testingModeOption.build())
@@ -304,6 +310,29 @@ public class InferRunner {
     return inferCmd;
   }
 
+  public static ImmutableList<String> createClangInferCommand(
+      TemporaryFolder folder,
+      String sourceFile,
+      Language lang,
+      boolean analyze,
+      @Nullable String isysroot,
+      @Nullable String ml_buckets,
+      boolean arc,
+      boolean headers,
+      boolean testingMode) {
+    return createClangInferCommand(
+        folder,
+        sourceFile,
+        lang,
+        analyze,
+        isysroot,
+        ml_buckets,
+        arc,
+        headers,
+        testingMode,
+        false);
+  }
+
   public static ImmutableList<String> createClangInferCommand(
       TemporaryFolder folder,
       String sourceFile,
@@ -446,6 +475,22 @@ public class InferRunner {
         false);
   }
 
+  public static ImmutableList<String> createCPPInferCommandFilter(
+      TemporaryFolder folder,
+      String sourceFile) throws IOException, InterruptedException {
+    return createClangInferCommand(
+        folder,
+        sourceFile,
+        Language.CPP,
+        true,
+        null,
+        null,
+        false,
+        false,
+        false,
+        true);
+  }
+
   public static ImmutableList<String> createObjCInferCommand(
       TemporaryFolder folder,
       String sourceFile) throws IOException, InterruptedException {