189 lines · cpp
1// RUN: %clang_analyze_cc1 %s -verify=fn-pointer \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-config core.CallAndMessage:FunctionPointer=true \4// RUN: -analyzer-config core.CallAndMessage:ParameterCount=false \5// RUN: -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \6// RUN: -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \7// RUN: -analyzer-config core.CallAndMessage:ArgInitializedness=false \8// RUN: -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \9// RUN: -analyzer-config core.CallAndMessage:NilReceiver=false \10// RUN: -analyzer-config core.CallAndMessage:UndefReceiver=false11 12// RUN: %clang_analyze_cc1 %s -verify=param-count \13// RUN: -analyzer-checker=core \14// RUN: -analyzer-config core.CallAndMessage:FunctionPointer=false \15// RUN: -analyzer-config core.CallAndMessage:ParameterCount=true \16// RUN: -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \17// RUN: -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \18// RUN: -analyzer-config core.CallAndMessage:ArgInitializedness=false \19// RUN: -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \20// RUN: -analyzer-config core.CallAndMessage:NilReceiver=false \21// RUN: -analyzer-config core.CallAndMessage:UndefReceiver=false22 23// RUN: %clang_analyze_cc1 %s -verify=method \24// RUN: -analyzer-checker=core \25// RUN: -analyzer-config core.CallAndMessage:FunctionPointer=false \26// RUN: -analyzer-config core.CallAndMessage:ParameterCount=false \27// RUN: -analyzer-config core.CallAndMessage:CXXThisMethodCall=true \28// RUN: -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \29// RUN: -analyzer-config core.CallAndMessage:ArgInitializedness=false \30// RUN: -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \31// RUN: -analyzer-config core.CallAndMessage:NilReceiver=false \32// RUN: -analyzer-config core.CallAndMessage:UndefReceiver=false33 34// RUN: %clang_analyze_cc1 %s -verify=delete \35// RUN: -analyzer-checker=core \36// RUN: -analyzer-config core.CallAndMessage:FunctionPointer=false \37// RUN: -analyzer-config core.CallAndMessage:ParameterCount=false \38// RUN: -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \39// RUN: -analyzer-config core.CallAndMessage:CXXDeallocationArg=true \40// RUN: -analyzer-config core.CallAndMessage:ArgInitializedness=false \41// RUN: -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \42// RUN: -analyzer-config core.CallAndMessage:NilReceiver=false \43// RUN: -analyzer-config core.CallAndMessage:UndefReceiver=false44 45// RUN: %clang_analyze_cc1 %s -verify=arg-init \46// RUN: -analyzer-checker=core \47// RUN: -analyzer-config core.CallAndMessage:FunctionPointer=false \48// RUN: -analyzer-config core.CallAndMessage:ParameterCount=false \49// RUN: -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \50// RUN: -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \51// RUN: -analyzer-config core.CallAndMessage:ArgInitializedness=true \52// RUN: -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \53// RUN: -analyzer-config core.CallAndMessage:NilReceiver=false \54// RUN: -analyzer-config core.CallAndMessage:UndefReceiver=false55 56// Testing for ArgPointeeInitializedness is in call-and-message.c.57 58// RUN: %clang_analyze_cc1 %s \59// RUN: -verify=fn-pointer,param-count,method,delete,arg-init \60// RUN: -analyzer-checker=core \61// RUN: -analyzer-output=plist -o %t.plist62// RUN: cat %t.plist | FileCheck %s63 64namespace function_pointer {65using Fn = void (*)();66 67void uninit() {68 Fn f;69 f(); // fn-pointer-warning{{Called function pointer is an uninitialized pointer value [core.CallAndMessage]}}70}71 72void null() {73 Fn f = nullptr;74 f(); // fn-pointer-warning{{Called function pointer is null (null dereference) [core.CallAndMessage]}}75}76 77// TODO: If this hash ever changes, turn78// core.CallAndMessage:FunctionPointer from a checker option into a79// checker, as described in the CallAndMessage comments!80// CHECK: <key>issue_hash_content_of_line_in_context</key>81// CHECK-SAME: <string>eb2083c01775eef452afa75728dd4d8f</string>82// CHECK: <key>issue_hash_content_of_line_in_context</key>83// CHECK-SAME: <string>407c50d9bedd8db28bf34f9411308100</string>84 85} // namespace function_pointer86 87namespace wrong_param_count {88using FnOneParam = void (*)(int);89using FnTwoParam = void (*)(int, int);90 91void f(int, int) {}92 93void wrong_cast() {94 FnTwoParam f1 = f;95 FnOneParam f2 = reinterpret_cast<FnOneParam>(f1);96 f2(5); // param-count-warning{{Function taking 2 arguments is called with fewer (1) [core.CallAndMessage]}}97}98 99// TODO: If this hash ever changes, turn100// core.CallAndMessage:ParameterCount from a checker option into a101// checker, as described in the CallAndMessage comments!102// CHECK: <key>issue_hash_content_of_line_in_context</key>103// CHECK-SAME: <string>9ff0e9b728422017945c9d5a673de223</string>104} // namespace wrong_param_count105 106namespace method_call {107struct A {108 void m();109};110 111void uninit() {112 A *a;113 a->m(); // method-warning{{Called C++ object pointer is uninitialized [core.CallAndMessage]}}114}115 116// TODO: If this hash ever changes, turn117// core.CallAndMessage:CXXThisMethodCall from a checker option into a118// checker, as described in the CallAndMessage comments!119// CHECK: <key>issue_hash_content_of_line_in_context</key>120// CHECK-SAME: <string>7bc35c70465837948a3f5018f27b21cd</string>121 122void null() {123 A *a = nullptr;124 a->m(); // method-warning{{Called C++ object pointer is null [core.CallAndMessage]}}125}126 127// TODO: If this hash ever changes, turn128// core.CallAndMessage:CXXThisMethodCall from a checker option into a129// checker, as described in the CallAndMessage comments!130// CHECK: <key>issue_hash_content_of_line_in_context</key>131// CHECK-SAME: <string>8ec260c9ef11d7c51fa872212df1163f</string>132} // namespace method_call133 134namespace operator_delete {135void f() {136 int *i;137 delete i; // delete-warning{{Argument to 'delete' is uninitialized [core.CallAndMessage]}}138}139 140// TODO: If this hash ever changes, turn141// core.CallAndMessage:CXXDeallocationArg from a checker option into a142// checker, as described in the CallAndMessage comments!143// CHECK: <key>issue_hash_content_of_line_in_context</key>144// CHECK-SAME: <string>a8ff99ebaa8746457d3e14af8ef7e75c</string>145} // namespace operator_delete146 147namespace uninit_arg {148template <class T>149void consume(T);150 151void fundamental_uninit() {152 int i;153 consume(i); // arg-init-warning{{1st function call argument is an uninitialized value [core.CallAndMessage]}}154}155 156struct A {157 int i;158};159 160void record_uninit() {161 A a;162 consume(a); // arg-init-warning{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'i') [core.CallAndMessage]}}163}164 165// TODO: If this hash ever changes, turn166// core.CallAndMessage:ArgInitializedness from a checker option into a167// checker, as described in the CallAndMessage comments!168// CHECK: <key>issue_hash_content_of_line_in_context</key>169// CHECK-SAME: <string>a46bb5c1ee44d4611ffeb13f7f499605</string>170// CHECK: <key>issue_hash_content_of_line_in_context</key>171// CHECK-SAME: <string>e0e0d30ea5a7b2e3a71e1931fa0768a5</string>172 173struct B{174 int i :2;175 int :30; // unnamed bit-field176};177 178void bitfield_B_init(void) {179 B b1;180 b1.i = 1; // b1 is initialized181 consume(b1);182}183 184void bitfield_B_uninit(void) {185 B b2;186 consume(b2); // arg-init-warning{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'i') [core.CallAndMessage]}}187}188} // namespace uninit_arg189