64 lines · c
1// RUN: %clang_analyze_cc1 -triple amdgcn-unknown-unknown \2// RUN: -analyzer-checker=core,alpha.unix.cstring,debug.ExprInspection \3// RUN: -analyzer-config crosscheck-with-z3=true -verify %s \4// RUN: -Wno-incompatible-library-redeclaration5// REQUIRES: z36 7void clang_analyzer_warnIfReached();8 9// From https://llvm.org/docs/AMDGPUUsage.html#address-spaces,10// select address space 3 (local), since the pointer size is11// different than Generic.12#define DEVICE __attribute__((address_space(3)))13_Static_assert(sizeof(int *) == 8, "");14_Static_assert(sizeof(DEVICE int *) == 4, "");15_Static_assert(sizeof(void *) == 8, "");16_Static_assert(sizeof(DEVICE void *) == 4, "");17 18// Copy from host to device memory. Note this is specialized19// since one of the parameters is assigned an address space such20// that the sizeof the the pointer is different than the other.21//22// Some downstream implementations may have specialized memcpy23// routines that copy from one address space to another. In cases24// like that, the address spaces are assumed to not overlap, so the25// cstring overlap check is not needed. When a static analysis report26// is generated in as case like this, SMTConv may attempt to create27// a refutation to Z3 with different bitwidth pointers which lead to28// a crash. This is not common in directly used upstream compiler builds,29// but can be seen in specialized downstrean implementations. This case30// covers those specific instances found and debugged.31//32// Since memcpy is a builtin, a specialized builtin instance named like33// 'memcpy_special' will hit in cstring, triggering this behavior. The34// best we can do for an upstream test is use the same memcpy function name.35DEVICE void *memcpy(DEVICE void *dst, const void *src, unsigned long len);36 37void top1(DEVICE void *dst, void *src, int len) {38 memcpy(dst, src, len);39 40 // Create a bugreport for triggering Z3 refutation.41 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}42}43 44void top2(DEVICE int *dst, void *src, int len) {45 memcpy(dst, src, len);46 47 // Create a bugreport for triggering Z3 refutation.48 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}49}50 51void top3(DEVICE int *dst, int *src, int len) {52 memcpy(dst, src, len);53 54 // Create a bugreport for triggering Z3 refutation.55 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}56}57 58void top4() {59 memcpy((DEVICE void *)1, (const void *)1, 1);60 61 // Create a bugreport for triggering Z3 refutation.62 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}63}64