[analyzer] Cleanup a FIXME in SValBuilder.cpp

This change follows up on a FIXME submitted with D105974. This change simply let's the reference case fall through to return a concrete 'true'
instead of a nonloc pointer of appropriate length set to NULL.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D107720

Author: vabridgers

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

@@ -725,16 +725,12 @@ SVal SValBuilder::evalCastSubKind(loc::MemRegionVal V, QualType CastTy,
       // This change is needed for architectures with varying
       // pointer widths. See the amdgcn opencl reproducer with
       // this change as an example: solver-sym-simplification-ptr-bool.cl
-      // FIXME: We could encounter a reference here,
-      //        try returning a concrete 'true' since it might
-      //        be easier on the solver.
       // FIXME: Cleanup remainder of `getZeroWithPtrWidth ()`
       //        and `getIntWithPtrWidth()` functions to prevent future
       //        confusion
-      const llvm::APSInt &Zero = Ty->isReferenceType()
-                                     ? BasicVals.getZeroWithPtrWidth()
-                                     : BasicVals.getZeroWithTypeSize(Ty);
-      return makeNonLoc(Sym, BO_NE, Zero, CastTy);
+      if (!Ty->isReferenceType())
+        return makeNonLoc(Sym, BO_NE, BasicVals.getZeroWithTypeSize(Ty),
+                          CastTy);
     }
     // Non-symbolic memory regions are always true.
     return makeTruthVal(true, CastTy);

clang/test/Analysis/solver-sym-simplification-bool.cpp

@@ -0,0 +1,10 @@
+// RUN: %clang_analyze_cc1 -analyze -analyzer-checker=core \
+// RUN: -analyzer-checker=debug.ExprInspection -verify %s
+
+void clang_analyzer_dump(bool);
+
+void foo(int &x) {
+  int *p = &x; // 'p' is the same SVal as 'x'
+  bool b = p;
+  clang_analyzer_dump(b); // expected-warning {{1 U1b}}
+}