1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -disable-free -analyzer-eagerly-assume -analyzer-checker=core,deadcode,debug.ExprInspection -verify %s
void clang_analyzer_eval(int);
int size_rdar9373039 = 1;
int foo_rdar9373039(const char *);
int rdar93730392() {
int x;
int j = 0;
for (int i = 0 ; i < size_rdar9373039 ; ++i)
x = 1;
int extra = (2 + foo_rdar9373039 ("Clang") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("Clang")) % 4)) % 4)) + (2 + foo_rdar9373039 ("1.0") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("1.0")) % 4)) % 4)); // expected-warning {{never read}}
for (int i = 0 ; i < size_rdar9373039 ; ++i)
j += x; // expected-warning {{garbage}}
return j;
}
int PR8962 (int *t) {
// This should look through the __extension__ no-op.
if (__extension__ (t)) return 0;
return *t; // expected-warning {{null pointer}}
}
int PR8962_b (int *t) {
// This should still ignore the nested casts
// which aren't handled by a single IgnoreParens()
if (((int)((int)t))) return 0;
return *t; // expected-warning {{null pointer}}
}
int PR8962_c (int *t) {
// If the last element in a StmtExpr was a ParenExpr, it's still live
if (({ (t ? (_Bool)0 : (_Bool)1); })) return 0;
return *t; // no-warning
}
int PR8962_d (int *t) {
// If the last element in a StmtExpr is an __extension__, it's still live
if (({ __extension__(t ? (_Bool)0 : (_Bool)1); })) return 0;
return *t; // no-warning
}
int PR8962_e (int *t) {
// Redundant casts can mess things up!
// Environment used to skip through NoOp casts, but LiveVariables didn't!
if (({ (t ? (int)(int)0L : (int)(int)1L); })) return 0;
return *t; // no-warning
}
int PR8962_f (int *t) {
// The StmtExpr isn't a block-level expression here,
// the __extension__ is. But the value should be attached to the StmtExpr
// anyway. Make sure the block-level check is /before/ IgnoreParens.
if ( __extension__({
_Bool r;
if (t) r = 0;
else r = 1;
r;
}) ) return 0;
return *t; // no-warning
}
// This previously crashed logic in the analyzer engine when evaluating locations.
void rdar10308201_aux(unsigned val);
void rdar10308201 (int valA, void *valB, unsigned valC) {
unsigned actual_base, lines;
if (valC == 0) {
actual_base = (unsigned)valB;
for (;;) {
if (valA & (1<<0))
rdar10308201_aux(actual_base);
}
}
}
typedef struct Struct103 {
unsigned i;
} Struct103;
typedef unsigned int size_t;
void __my_memset_chk(char*, int, size_t);
static int radar10367606(int t) {
Struct103 overall;
((__builtin_object_size ((char *) &overall, 0) != (size_t) -1) ? __builtin___memset_chk ((char *) &overall, 0, sizeof(Struct103), __builtin_object_size ((char *) &overall, 0)) : __my_memset_chk ((char *) &overall, 0, sizeof(Struct103)));
return 0;
}
/* Caching out on a sink node. */
extern int fooR10376675();
extern int* bazR10376675();
extern int nR10376675;
void barR10376675(int *x) {
int *pm;
if (nR10376675 * 2) {
int *pk = bazR10376675();
pm = pk; //expected-warning {{never read}}
}
do {
*x = fooR10376675();
} while (0);
}
// Test accesses to wide character strings doesn't break the analyzer.
typedef int wchar_t;
struct rdar10385775 {
wchar_t *name;
};
void RDar10385775(struct rdar10385775* p) {
p->name = L"a";
}
// Test double loop of array and array literals. Previously this
// resulted in a false positive uninitailized value warning.
void rdar10686586() {
int array1[] = { 1, 2, 3, 0 };
int array2[] = { 1, 2, 3, 0 };
int *array[] = { array1, array2 };
int sum = 0;
for (int i = 0; i < 2; i++) {
for (int j = 0; j < 4; j++) {
sum += array[i][j]; // no-warning
}
}
}
// This example tests CFG handling of '||' nested in a ternary expression,
// and seeing that the analyzer doesn't crash.
int isctype(char c, unsigned long f)
{
return (c < 1 || c > 10) ? 0 : !!(c & f);
}
// Test that symbolic array offsets are modeled conservatively.
// This was triggering a false "use of uninitialized value" warning.
void rdar_12075238__aux(unsigned long y);
int rdar_12075238_(unsigned long count) {
if ((count < 3) || (count > 6))
return 0;
unsigned long array[6];
unsigned long i = 0;
for (; i <= count - 2; i++)
{
array[i] = i;
}
array[count - 1] = i;
rdar_12075238__aux(array[2]); // no-warning
return 0;
}
// Test that we handle an uninitialized value within a logical expression.
void PR14635(int *p) {
int a = 0, b;
*p = a || b; // expected-warning {{Assigned value is garbage or undefined}}
}
// Test handling floating point values with unary '!'.
int PR14634(int x) {
double y = (double)x;
return !y;
}
// PR15684: If a checker generates a sink node after generating a regular node
// and no state changes between the two, graph trimming would consider the two
// the same node, forming a loop.
struct PR15684 {
void (*callback)(int);
};
void sinkAfterRegularNode(struct PR15684 *context) {
int uninitialized;
context->callback(uninitialized); // expected-warning {{uninitialized}}
}
// PR16131: C permits variables to be declared extern void.
static void PR16131(int x) {
extern void v;
int *ip = (int *)&v;
char *cp = (char *)&v;
clang_analyzer_eval(ip == cp); // expected-warning{{TRUE}}
// expected-warning@-1 {{comparison of distinct pointer types}}
*ip = 42;
clang_analyzer_eval(*ip == 42); // expected-warning{{TRUE}}
clang_analyzer_eval(*(int *)&v == 42); // expected-warning{{TRUE}}
}
// PR15623: Currently the analyzer doesn't handle symbolic expressions of the
// form "(exp comparison_op expr) != 0" very well. We perform a simplification
// translating an assume of a constraint of the form "(exp comparison_op expr)
// != 0" to true into an assume of "exp comparison_op expr" to true.
void PR15623(int n) {
if ((n == 0) != 0) {
clang_analyzer_eval(n == 0); // expected-warning{{TRUE}}
}
}
|
