205 lines · c
1// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false %s2// RUN: %clang_analyze_cc1 -DTEST_NULL_TERM -analyzer-checker=core,unix.Malloc,debug.ExprInspection,alpha.cplusplus.IteratorRange -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false %s3 4void clang_analyzer_eval(int);5void clang_analyzer_warnIfReached(void);6 7typedef __typeof(sizeof(int)) size_t;8void *malloc(size_t);9void free(void *);10 11void loop_which_iterates_limit_times_not_widened(void) {12 int i;13 int x = 1;14 // Check loop isn't widened by checking x isn't invalidated15 for (i = 0; i < 1; ++i) {}16 clang_analyzer_eval(x == 1); // expected-warning {{TRUE}}17 for (i = 0; i < 2; ++i) {}18 clang_analyzer_eval(x == 1); // expected-warning {{TRUE}}19 for (i = 0; i < 3; ++i) {}20 // FIXME loss of precision as a result of evaluating the widened loop body21 // *instead* of the last iteration.22 clang_analyzer_eval(x == 1); // expected-warning {{UNKNOWN}}23}24 25int a_global;26 27void loop_evaluated_before_widening(void) {28 int i;29 a_global = 1;30 for (i = 0; i < 10; ++i) {31 if (i == 2) {32 // True before widening then unknown after.33 clang_analyzer_eval(a_global == 1); // expected-warning{{TRUE}} expected-warning{{UNKNOWN}}34 }35 }36 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}37}38 39void warnings_after_loop(void) {40 int i;41 for (i = 0; i < 10; ++i) {}42 char *m = (char*)malloc(12);43} // expected-warning {{Potential leak of memory pointed to by 'm'}}44 45void for_loop_exits(void) {46 int i;47 for (i = 0; i < 10; ++i) {}48 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}49}50 51void while_loop_exits(void) {52 int i = 0;53 while (i < 10) {++i;}54 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}55}56 57void do_while_loop_exits(void) {58 int i = 0;59 do {++i;} while (i < 10);60 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}61}62 63void loop_body_is_widened(void) {64 int i = 0;65 while (i < 100) {66 if (i > 10) {67 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}68 }69 ++i;70 }71 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}72}73 74void invariably_infinite_loop(void) {75 int i = 0;76 while (1) { ++i; }77 clang_analyzer_warnIfReached(); // no-warning78}79 80void invariably_infinite_break_loop(void) {81 int i = 0;82 while (1) {83 ++i;84 int x = 1;85 if (!x) break;86 }87 clang_analyzer_warnIfReached(); // no-warning88}89 90void reachable_break_loop(void) {91 int i = 0;92 while (1) {93 ++i;94 if (i == 100) break;95 }96 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}97}98 99void condition_constrained_true_in_loop(void) {100 int i = 0;101 while (i < 50) {102 clang_analyzer_eval(i < 50); // expected-warning {{TRUE}}103 ++i;104 }105 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}106}107 108void condition_constrained_false_after_loop(void) {109 int i = 0;110 while (i < 50) {111 ++i;112 }113 clang_analyzer_eval(i >= 50); // expected-warning {{TRUE}}114 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}115}116 117void multiple_exit_test(void) {118 int x = 0;119 int i = 0;120 while (i < 50) {121 if (x) {122 i = 10;123 break;124 }125 ++i;126 }127 // Reachable by 'normal' exit128 if (i == 50) clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}129 // Reachable by break point130 if (i == 10) clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}131 // Not reachable132 if (i < 10) clang_analyzer_warnIfReached(); // no-warning133 if (i > 10 && i < 50) clang_analyzer_warnIfReached(); // no-warning134}135 136void pointer_doesnt_leak_from_loop(void) {137 int *h_ptr = (int *) malloc(sizeof(int));138 for (int i = 0; i < 2; ++i) {}139 for (int i = 0; i < 10; ++i) {} // no-warning140 free(h_ptr);141}142 143int g_global;144 145void unknown_after_loop(int s_arg) {146 g_global = 0;147 s_arg = 1;148 int s_local = 2;149 int *h_ptr = malloc(sizeof(int));150 151 for (int i = 0; i < 10; ++i) {}152 153 clang_analyzer_eval(g_global); // expected-warning {{UNKNOWN}}154 clang_analyzer_eval(s_arg); // expected-warning {{UNKNOWN}}155 clang_analyzer_eval(s_local); // expected-warning {{UNKNOWN}}156 clang_analyzer_eval(h_ptr == 0); // expected-warning {{UNKNOWN}}157 free(h_ptr);158}159 160void variable_bound_exiting_loops_widened(int x) {161 int i = 0;162 int t = 1;163 while (i < x) {164 ++i;165 }166 clang_analyzer_eval(t == 1); // expected-warning {{TRUE}} // expected-warning {{UNKNOWN}}167}168 169void nested_loop_outer_widen(void) {170 int i = 0, j = 0;171 for (i = 0; i < 10; i++) {172 clang_analyzer_eval(i < 10); // expected-warning {{TRUE}}173 for (j = 0; j < 2; j++) {174 clang_analyzer_eval(j < 2); // expected-warning {{TRUE}}175 }176 clang_analyzer_eval(j >= 2); // expected-warning {{TRUE}}177 }178 clang_analyzer_eval(i >= 10); // expected-warning {{TRUE}}179}180 181void nested_loop_inner_widen(void) {182 int i = 0, j = 0;183 for (i = 0; i < 2; i++) {184 clang_analyzer_eval(i < 2); // expected-warning {{TRUE}}185 for (j = 0; j < 10; j++) {186 clang_analyzer_eval(j < 10); // expected-warning {{TRUE}}187 }188 clang_analyzer_eval(j >= 10); // expected-warning {{TRUE}}189 }190 clang_analyzer_eval(i >= 2); // expected-warning {{TRUE}}191}192 193#ifdef TEST_NULL_TERM194void null_terminator_loop_widen(int *a) {195 int c;196 // Loop widening will call 'invalidateRegions()' and 'invalidateRegions()'197 // will construct the SymbolConjured with null Stmt because of the null198 // terminator statement. Accessing the null Stmt will cause a crash.199 for (;;) {200 c = *a; // no-crash201 a++;202 }203}204#endif205