204 lines · c
1// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -disable-free -analyzer-checker=core,deadcode,debug.ExprInspection -Wno-pointer-to-int-cast -verify %s2 3void clang_analyzer_eval(int);4 5int size_rdar9373039 = 1;6int foo_rdar9373039(const char *);7 8int rdar93730392(void) {9 int x;10 int j = 0;11 12 for (int i = 0 ; i < size_rdar9373039 ; ++i)13 x = 1;14 15 int extra = (2 + foo_rdar9373039 ("Clang") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("Clang")) % 4)) % 4)) + (2 + foo_rdar9373039 ("1.0") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("1.0")) % 4)) % 4)); // expected-warning {{never read}}16 17 for (int i = 0 ; i < size_rdar9373039 ; ++i)18 j += x; // expected-warning {{uninitialized}}19 20 return j;21}22 23 24int PR8962 (int *t) {25 // This should look through the __extension__ no-op.26 if (__extension__ (t)) return 0;27 return *t; // expected-warning {{null pointer}}28}29 30int PR8962_b (int *t) {31 // This should still ignore the nested casts32 // which aren't handled by a single IgnoreParens()33 if (((int)((int)t))) return 0;34 return *t; // expected-warning {{null pointer}}35}36 37int PR8962_c (int *t) {38 // If the last element in a StmtExpr was a ParenExpr, it's still live39 if (({ (t ? (_Bool)0 : (_Bool)1); })) return 0;40 return *t; // no-warning41}42 43int PR8962_d (int *t) {44 // If the last element in a StmtExpr is an __extension__, it's still live45 if (({ __extension__(t ? (_Bool)0 : (_Bool)1); })) return 0;46 return *t; // no-warning47}48 49int PR8962_e (int *t) {50 // Redundant casts can mess things up!51 // Environment used to skip through NoOp casts, but LiveVariables didn't!52 if (({ (t ? (int)(int)0L : (int)(int)1L); })) return 0;53 return *t; // no-warning54}55 56int PR8962_f (int *t) {57 // The StmtExpr isn't a block-level expression here,58 // the __extension__ is. But the value should be attached to the StmtExpr59 // anyway. Make sure the block-level check is /before/ IgnoreParens.60 if ( __extension__({61 _Bool r;62 if (t) r = 0;63 else r = 1;64 r;65 }) ) return 0;66 return *t; // no-warning67}68 69// This previously crashed logic in the analyzer engine when evaluating locations.70void rdar10308201_aux(unsigned val);71void rdar10308201 (int valA, void *valB, unsigned valC) {72 unsigned actual_base, lines;73 if (valC == 0) {74 actual_base = (unsigned)valB;75 for (;;) {76 if (valA & (1<<0))77 rdar10308201_aux(actual_base);78 }79 }80}81 82typedef struct Struct103 {83 unsigned i;84} Struct103;85typedef unsigned int size_t;86void __my_memset_chk(char*, int, size_t);87static int radar10367606(int t) {88 Struct103 overall;89 ((__builtin_object_size ((char *) &overall, 0) != (size_t) -1) ? __builtin___memset_chk ((char *) &overall, 0, sizeof(Struct103), __builtin_object_size ((char *) &overall, 0)) : __my_memset_chk ((char *) &overall, 0, sizeof(Struct103)));90 return 0;91}92 93/* Caching out on a sink node. */94extern int fooR10376675(void);95extern int* bazR10376675(void);96extern int nR10376675;97void barR10376675(int *x) {98 int *pm;99 if (nR10376675 * 2) {100 int *pk = bazR10376675();101 pm = pk; //expected-warning {{never read}}102 }103 do {104 *x = fooR10376675();105 } while (0);106}107 108// Test accesses to wide character strings doesn't break the analyzer.109typedef int wchar_t;110struct rdar10385775 {111 wchar_t *name;112};113void RDar10385775(struct rdar10385775* p) {114 p->name = L"a";115}116 117// Test double loop of array and array literals. Previously this118// resulted in a false positive uninitailized value warning.119void rdar10686586(void) {120 int array1[] = { 1, 2, 3, 0 };121 int array2[] = { 1, 2, 3, 0 };122 int *array[] = { array1, array2 };123 int sum = 0;124 for (int i = 0; i < 2; i++) {125 for (int j = 0; j < 4; j++) {126 sum += array[i][j]; // no-warning127 }128 }129}130 131// This example tests CFG handling of '||' nested in a ternary expression,132// and seeing that the analyzer doesn't crash.133int isctype(char c, unsigned long f)134{135 return (c < 1 || c > 10) ? 0 : !!(c & f);136}137 138// Test that symbolic array offsets are modeled conservatively.139// This was triggering a false "use of uninitialized value" warning.140void rdar_12075238__aux(unsigned long y);141int rdar_12075238_(unsigned long count) {142 if ((count < 3) || (count > 6))143 return 0;144 145 unsigned long array[6];146 unsigned long i = 0;147 for (; i <= count - 2; i++)148 {149 array[i] = i;150 }151 array[count - 1] = i;152 rdar_12075238__aux(array[2]); // no-warning153 return 0;154}155 156// Test that we handle an uninitialized value within a logical expression.157void PR14635(int *p) {158 int a = 0, b;159 *p = a || b; // expected-warning {{Assigned value is uninitialized}}160}161 162// Test handling floating point values with unary '!'.163int PR14634(int x) {164 double y = (double)x;165 return !y;166}167 168 169// PR15684: If a checker generates a sink node after generating a regular node170// and no state changes between the two, graph trimming would consider the two171// the same node, forming a loop.172struct PR15684 {173 void (*callback)(int);174};175void sinkAfterRegularNode(struct PR15684 *context) {176 int uninitialized;177 context->callback(uninitialized); // expected-warning {{uninitialized}}178}179 180 181// PR16131: C permits variables to be declared extern void.182static void PR16131(int x) {183 extern void v;184 185 int *ip = (int *)&v;186 char *cp = (char *)&v;187 clang_analyzer_eval(ip == cp); // expected-warning{{TRUE}}188 // expected-warning@-1 {{comparison of distinct pointer types}}189 190 *ip = 42;191 clang_analyzer_eval(*ip == 42); // expected-warning{{TRUE}}192 clang_analyzer_eval(*(int *)&v == 42); // expected-warning{{TRUE}}193}194 195// PR15623: Currently the analyzer doesn't handle symbolic expressions of the196// form "(exp comparison_op expr) != 0" very well. We perform a simplification197// translating an assume of a constraint of the form "(exp comparison_op expr)198// != 0" to true into an assume of "exp comparison_op expr" to true.199void PR15623(int n) {200 if ((n == 0) != 0) {201 clang_analyzer_eval(n == 0); // expected-warning{{TRUE}}202 }203}204