blob: 17d9db6ea23a669d54741909f6c1522824f3f4c9 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
// RUN: %clang_cc1 -analyze -analyzer-checker=core,deadcode.experimental.UnreachableCode,unix.experimental.Malloc -verify -analyzer-constraints=basic %s
// RUN: %clang_cc1 -analyze -analyzer-checker=core,deadcode.experimental.UnreachableCode,unix.experimental.Malloc -verify -analyzer-constraints=range %s
// These are used to trigger warnings.
typedef typeof(sizeof(int)) size_t;
void *malloc(size_t);
void free(void *);
#define NULL ((void*)0)
#define UINT_MAX -1U
//---------------
// Plus/minus
//---------------
void separateExpressions (int a) {
int b = a + 1;
--b;
char* buf = malloc(1);
if (a != 0 && b == 0)
return; // expected-warning{{never executed}}
free(buf);
}
void oneLongExpression (int a) {
// Expression canonicalization should still allow this to work, even though
// the first term is on the left.
int b = 15 + a + 15 - 10 - 20;
char* buf = malloc(1);
if (a != 0 && b == 0)
return; // expected-warning{{never executed}}
free(buf);
}
void mixedTypes (int a) {
char* buf = malloc(1);
// Different additive types should not cause crashes when constant-folding.
// This is part of PR7406.
int b = a + 1LL;
if (a != 0 && (b-1) == 0) // not crash
return; // expected-warning{{never executed}}
int c = a + 1U;
if (a != 0 && (c-1) == 0) // not crash
return; // expected-warning{{never executed}}
free(buf);
}
//---------------
// Comparisons
//---------------
// Equality and inequality only
void eq_ne (unsigned a) {
char* b = NULL;
if (a == UINT_MAX)
b = malloc(1);
if (a+1 != 0)
return; // no-warning
if (a-1 != UINT_MAX-1)
return; // no-warning
free(b);
}
void ne_eq (unsigned a) {
char* b = NULL;
if (a != UINT_MAX)
b = malloc(1);
if (a+1 == 0)
return; // no-warning
if (a-1 == UINT_MAX-1)
return; // no-warning
free(b);
}
// Mixed typed inequalities (part of PR7406)
// These should not crash.
void mixed_eq_ne (int a) {
char* b = NULL;
if (a == 1)
b = malloc(1);
if (a+1U != 2)
return; // no-warning
if (a-1U != 0)
return; // expected-warning{{never executed}}
free(b);
}
void mixed_ne_eq (int a) {
char* b = NULL;
if (a != 1)
b = malloc(1);
if (a+1U == 2)
return; // no-warning
if (a-1U == 0)
return; // expected-warning{{never executed}}
free(b);
}
// Simple order comparisons with no adjustment
void baselineGT (unsigned a) {
char* b = NULL;
if (a > 0)
b = malloc(1);
if (a == 0)
return; // no-warning
free(b);
}
void baselineGE (unsigned a) {
char* b = NULL;
if (a >= UINT_MAX)
b = malloc(1);
if (a == UINT_MAX)
free(b);
return; // no-warning
}
void baselineLT (unsigned a) {
char* b = NULL;
if (a < UINT_MAX)
b = malloc(1);
if (a == UINT_MAX)
return; // no-warning
free(b);
}
void baselineLE (unsigned a) {
char* b = NULL;
if (a <= 0)
b = malloc(1);
if (a == 0)
free(b);
return; // no-warning
}
// Adjustment gives each of these an extra solution!
void adjustedGT (unsigned a) {
char* b = NULL;
if (a-1 > UINT_MAX-1)
b = malloc(1);
return; // expected-warning{{leak}}
}
void adjustedGE (unsigned a) {
char* b = NULL;
if (a-1 >= UINT_MAX-1)
b = malloc(1);
if (a == UINT_MAX)
free(b);
return; // expected-warning{{leak}}
}
void adjustedLT (unsigned a) {
char* b = NULL;
if (a+1 < 1)
b = malloc(1);
return; // expected-warning{{leak}}
}
void adjustedLE (unsigned a) {
char* b = NULL;
if (a+1 <= 1)
b = malloc(1);
if (a == 0)
free(b);
return; // expected-warning{{leak}}
}
// Tautologies
void tautologyGT (unsigned a) {
char* b = malloc(1);
if (a > UINT_MAX)
return; // no-warning
free(b);
}
void tautologyGE (unsigned a) {
char* b = malloc(1);
if (a >= 0) // expected-warning{{always true}}
free(b);
return; // no-warning
}
void tautologyLT (unsigned a) {
char* b = malloc(1);
if (a < 0) // expected-warning{{always false}}
return; // expected-warning{{never executed}}
free(b);
}
void tautologyLE (unsigned a) {
char* b = malloc(1);
if (a <= UINT_MAX)
free(b);
return; // no-warning
}
|
