132 lines · cpp
1// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -verify %s \2// RUN: -analyzer-checker=debug.ExprInspection \3// RUN: -analyzer-checker=unix.cstring \4// RUN: -analyzer-checker=unix.Malloc \5// RUN: -analyzer-config display-checker-name=false6 7typedef unsigned long size_t;8 9struct S {10 struct S3 {11 int y[10];12 };13 struct S2 : S3 {14 int *x;15 } s2[10];16 int z;17};18 19 20void clang_analyzer_explain(int);21void clang_analyzer_explain(void *);22void clang_analyzer_explain(const int *);23void clang_analyzer_explain(S);24 25size_t clang_analyzer_getExtent(void *);26 27size_t strlen(const char *);28 29int conjure();30S conjure_S();31 32int glob;33static int stat_glob;34void *glob_ptr;35 36// Test strings are regex'ed because we need to match exact string37// rather than a substring.38 39void test_1(int param, void *ptr) {40 clang_analyzer_explain(&glob); // expected-warning-re{{{{^pointer to global variable 'glob'$}}}}41 clang_analyzer_explain(param); // expected-warning-re{{{{^argument 'param'$}}}}42 clang_analyzer_explain(ptr); // expected-warning-re{{{{^argument 'ptr'$}}}}43 if (param == 42)44 clang_analyzer_explain(param); // expected-warning-re{{{{^signed 32-bit integer '42'$}}}}45}46 47void test_2(char *ptr, int ext) {48 clang_analyzer_explain((void *) "asdf"); // expected-warning-re{{{{^pointer to element of type 'char' with index 0 of string literal "asdf"$}}}}49 clang_analyzer_explain(strlen(ptr)); // expected-warning-re{{{{^metadata of type '__size_t' tied to pointee of argument 'ptr'$}}}}50 clang_analyzer_explain(conjure()); // expected-warning-re{{{{^symbol of type 'int' conjured at CFG element 'conjure\(\)'$}}}}51 clang_analyzer_explain(glob); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at CFG element 'conjure\(\)'\) for global variable 'glob'$}}}}52 clang_analyzer_explain(glob_ptr); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at CFG element 'conjure\(\)'\) for global variable 'glob_ptr'$}}}}53 clang_analyzer_explain(clang_analyzer_getExtent(ptr)); // expected-warning-re{{{{^extent of pointee of argument 'ptr'$}}}}54 int *x = new int[ext];55 clang_analyzer_explain(x); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of heap segment that starts at symbol of type 'int \*' conjured at CFG element 'CFGNewAllocator\(int \*\)'$}}}}56 // Sic! What gets computed is the extent of the element-region.57 clang_analyzer_explain(clang_analyzer_getExtent(x)); // expected-warning-re{{{{^\(argument 'ext'\) \* 4$}}}}58 delete[] x;59}60 61void test_3(S s) {62 clang_analyzer_explain(&s); // expected-warning-re{{{{^pointer to parameter 's'$}}}}63 clang_analyzer_explain(s.z); // expected-warning-re{{{{^initial value of field 'z' of parameter 's'$}}}}64 clang_analyzer_explain(&s.s2[5].y[3]); // expected-warning-re{{{{^pointer to element of type 'int' with index 3 of field 'y' of base object 'S::S3' inside element of type 'struct S::S2' with index 5 of field 's2' of parameter 's'$}}}}65 if (!s.s2[7].x) {66 clang_analyzer_explain(s.s2[7].x); // expected-warning-re{{{{^concrete memory address '0'$}}}}67 // FIXME: we need to be explaining '1' rather than '0' here; not explainer bug.68 clang_analyzer_explain(s.s2[7].x + 1); // expected-warning-re{{{{^concrete memory address '0'$}}}}69 }70}71 72void test_4(int x, int y) {73 int z;74 static int stat;75 clang_analyzer_explain(-x); // expected-warning-re{{{{^\- \(argument 'x'\)$}}}}76 clang_analyzer_explain(x + 1); // expected-warning-re{{{{^\(argument 'x'\) \+ 1$}}}}77 clang_analyzer_explain(1 + y); // expected-warning-re{{{{^\(argument 'y'\) \+ 1$}}}}78 clang_analyzer_explain(x + y); // expected-warning-re{{{{^\(argument 'x'\) \+ \(argument 'y'\)$}}}}79 clang_analyzer_explain(z); // expected-warning-re{{{{^undefined value$}}}}80 clang_analyzer_explain(&z); // expected-warning-re{{{{^pointer to local variable 'z'$}}}}81 clang_analyzer_explain(stat); // expected-warning-re{{{{^signed 32-bit integer '0'$}}}}82 clang_analyzer_explain(&stat); // expected-warning-re{{{{^pointer to static local variable 'stat'$}}}}83 clang_analyzer_explain(stat_glob); // expected-warning-re{{{{^initial value of global variable 'stat_glob'$}}}}84 clang_analyzer_explain(&stat_glob); // expected-warning-re{{{{^pointer to global variable 'stat_glob'$}}}}85 clang_analyzer_explain((int[]){1, 2, 3}); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of temporary object constructed at statement '\(int\[3\]\)\{1, 2, 3\}'$}}}}86}87 88namespace {89class C {90 int x[10];91 92public:93 void test_5(int i) {94 clang_analyzer_explain(this); // expected-warning-re{{{{^pointer to 'this' object$}}}}95 clang_analyzer_explain(&x[i]); // expected-warning-re{{{{^pointer to element of type 'int' with index 'argument 'i'' of field 'x' of 'this' object$}}}}96 clang_analyzer_explain(__builtin_alloca(i)); // expected-warning-re{{{{^pointer to region allocated by '__builtin_alloca\(i\)'$}}}}97 }98};99} // end of anonymous namespace100 101void test_6() {102 clang_analyzer_explain(conjure_S()); // expected-warning-re{{{{^lazily frozen compound value of 1st parameter of function 'clang_analyzer_explain\(\)'$}}}}103 clang_analyzer_explain(conjure_S().z); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at CFG element 'conjure_S\(\) \(CXXRecordTypedCall, \)'\) for field 'z' of temporary object constructed at statement 'conjure_S\(\)'$}}}}104}105 106class C_top_level {107public:108 C_top_level(int param) {109 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}110 }111};112 113class C_non_top_level {114public:115 C_non_top_level(int param) {116 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}117 }118};119 120void test_7(int n) {121 C_non_top_level c(n);122 123 auto lambda_top_level = [n](int param) {124 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}125 };126 auto lambda_non_top_level = [n](int param) {127 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}128 };129 130 lambda_non_top_level(n);131}132