dont report biabduction NPE's on tmp variables

Reviewed By: da319

Differential Revision: D13800608

fbshipit-source-id: 2f54c8be6

infer/src/IR/DecompiledExp.ml

@@ -147,7 +147,7 @@ let pp_vpath pe fmt vpath =
 
 let rec has_tmp_var = function
   | Dpvar pvar | Dpvaraddr pvar ->
-      Pvar.is_frontend_tmp pvar
+      Pvar.is_frontend_tmp pvar || Pvar.is_clang_tmp pvar
   | Dderef dexp | Ddot (dexp, _) | Darrow (dexp, _) | Dunop (_, dexp) | Dsizeof (_, Some dexp, _)
     ->
       has_tmp_var dexp

infer/src/IR/Pvar.ml

@@ -171,6 +171,10 @@ let is_frontend_tmp pvar =
       false
 
 
+let tmp_clang_regex = Str.regexp "^__\\(range\\|begin\\|end\\)[0-9]*$"
+
+let is_clang_tmp pvar = Str.string_match tmp_clang_regex (to_string pvar) 0
+
 (* in Sawja, variables like $T0_18 are temporaries, but not SSA vars. *)
 let is_ssa_frontend_tmp pvar =
   is_frontend_tmp pvar

infer/src/IR/Pvar.mli

@@ -72,6 +72,9 @@ val is_self : t -> bool
 val is_frontend_tmp : t -> bool
 (** return true if [pvar] is a temporary variable generated by the frontend *)
 
+val is_clang_tmp : t -> bool
+(** return true if [pvar] is a temporary variable generated by clang *)
+
 val is_ssa_frontend_tmp : t -> bool
 (** return true if [pvar] is a temporary variable generated by the frontend and is only assigned
     once on a non-looping control-flow path *)

infer/src/biabduction/Buckets.ml

@@ -10,6 +10,7 @@ open! IStd
 
 (** Classify bugs into buckets *)
 
+module DExp = DecompiledExp
 module L = Logging
 
 let verbose = Config.trace_error
@@ -152,5 +153,9 @@ let check_access access_opt de_opt =
 
 let classify_access desc access_opt de_opt is_nullable =
   let default_bucket = if is_nullable then Localise.BucketLevel.b1 else Localise.BucketLevel.b5 in
-  let bucket = check_access access_opt de_opt |> Option.value ~default:default_bucket in
+  let tmp_var = Option.value_map de_opt ~default:false ~f:DExp.has_tmp_var in
+  let bucket =
+    if tmp_var then Localise.BucketLevel.b5
+    else check_access access_opt de_opt |> Option.value ~default:default_bucket
+  in
   Localise.error_desc_set_bucket desc bucket