xref: /external/clang/test/Analysis/misc-ps-region-store.cpp

// RUN: %clang_cc1 -triple i386-apple-darwin9 -analyze -analyzer-checker=core,alpha.core -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks %s -fexceptions -fcxx-exceptions
// RUN: %clang_cc1 -triple x86_64-apple-darwin9 -analyze -analyzer-checker=core,alpha.core -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks %s -fexceptions -fcxx-exceptions

// Test basic handling of references.
char &test1_aux();
char *test1() {
  return &test1_aux();
}

// Test test1_aux() evaluates to char &.
char test1_as_rvalue() {
  return test1_aux();
}

// Test passing a value as a reference.  The 'const' in test2_aux() adds
// an ImplicitCastExpr, which is evaluated as an lvalue.
int test2_aux(const int &n);
int test2(int n) {
  return test2_aux(n);
}

int test2_b_aux(const short &n);
int test2_b(int n) {
  return test2_b_aux(n);
}

// Test getting the lvalue of a derived and converting it to a base.  This
// previously crashed.
class Test3_Base {};
class Test3_Derived : public Test3_Base {};

int test3_aux(Test3_Base &x);
int test3(Test3_Derived x) {
  return test3_aux(x);
}

//===---------------------------------------------------------------------===//
// Test CFG support for C++ condition variables.
//===---------------------------------------------------------------------===//

int test_init_in_condition_aux();
int test_init_in_condition() {
  if (int x = test_init_in_condition_aux()) { // no-warning
    return 1;
  }
  return 0;
}

int test_init_in_condition_switch() {
  switch (int x = test_init_in_condition_aux()) { // no-warning
    case 1:
      return 0;
    case 2:
      if (x == 2)
        return 0;
      else {
        // Unreachable.
        int *p = 0;
        *p = 0xDEADBEEF; // no-warning
      }
    default:
      break;
  }
  return 0;
}

int test_init_in_condition_while() {
  int z = 0;
  while (int x = ++z) { // no-warning
    if (x == 2)
      break;
  }

  if (z == 2)
    return 0;

  int *p = 0;
  *p = 0xDEADBEEF; // no-warning
  return 0;
}


int test_init_in_condition_for() {
  int z = 0;
  for (int x = 0; int y = ++z; ++x) {
    if (x == y) // no-warning
      break;
  }
  if (z == 1)
    return 0;

  int *p = 0;
  *p = 0xDEADBEEF; // no-warning
  return 0;
}

//===---------------------------------------------------------------------===//
// Test handling of 'this' pointer.
//===---------------------------------------------------------------------===//

class TestHandleThis {
  int x;

  TestHandleThis();
  int foo();
  int null_deref_negative();
  int null_deref_positive();
};

int TestHandleThis::foo() {
  // Assume that 'x' is initialized.
  return x + 1; // no-warning
}

int TestHandleThis::null_deref_negative() {
  x = 10;
  if (x == 10) {
    return 1;
  }
  int *p = 0;
  *p = 0xDEADBEEF; // no-warning
  return 0;
}

int TestHandleThis::null_deref_positive() {
  x = 10;
  if (x == 9) {
    return 1;
  }
  int *p = 0;
  *p = 0xDEADBEEF; // expected-warning{{null pointer}}
  return 0;
}

// PR 7675 - passing literals by-reference
void pr7675(const double &a);
void pr7675(const int &a);
void pr7675(const char &a);
void pr7675_i(const _Complex double &a);

void pr7675_test() {
  pr7675(10.0);
  pr7675(10);
  pr7675('c');
  pr7675_i(4.0i);
  // Add null deref to ensure we are analyzing the code up to this point.
  int *p = 0;
  *p = 0xDEADBEEF; // expected-warning{{null pointer}}
}

// <rdar://problem/8375510> - CFGBuilder should handle temporaries.
struct R8375510 {
  R8375510();
  ~R8375510();
  R8375510 operator++(int);
};

int r8375510(R8375510 x, R8375510 y) {
  for (; ; x++) { }
}

// PR8419 -- this used to crash.

class String8419 {
 public:
  char& get(int n);
  char& operator[](int n);
};

char& get8419();

void Test8419() {
  String8419 s;
  ++(s.get(0));
  get8419()--;  // used to crash
  --s[0];       // used to crash
  s[0] &= 1;    // used to crash
  s[0]++;       // used to crash
}

// PR8426 -- this used to crash.

void Use(void* to);

template <class T> class Foo {
  ~Foo();
  struct Bar;
  Bar* bar_;
};

template <class T> Foo<T>::~Foo() {
  Use(bar_);
  T::DoSomething();
  bar_->Work();
}

// PR8427 -- this used to crash.

class Dummy {};

bool operator==(Dummy, int);

template <typename T>
class Foo2 {
  bool Bar();
};

template <typename T>
bool Foo2<T>::Bar() {
  return 0 == T();
}

// PR8433 -- this used to crash.

template <typename T>
class Foo3 {
 public:
  void Bar();
  void Baz();
  T value_;
};

template <typename T>
void Foo3<T>::Bar() {
  Baz();
  value_();
}

//===---------------------------------------------------------------------===//
// Handle misc. C++ constructs.
//===---------------------------------------------------------------------===//

namespace fum {
  int i = 3;
};

void test_namespace() {
  // Previously triggered a crash.
  using namespace fum;
  int x = i;
}

// Test handling methods that accept references as parameters, and that
// variables are properly invalidated.
class RDar9203355 {
  bool foo(unsigned valA, long long &result) const;
  bool foo(unsigned valA, int &result) const;
};
bool RDar9203355::foo(unsigned valA, int &result) const {
  long long val;
  if (foo(valA, val) ||
      (int)val != val) // no-warning
    return true;
  result = val; // no-warning
  return false;
}

// Test handling of new[].
void rdar9212512() {
  int *x = new int[10];
  for (unsigned i = 0 ; i < 2 ; ++i) {
    // This previously triggered an uninitialized values warning.
    x[i] = 1;  // no-warning
  }
}

// Test basic support for dynamic_cast<>.
struct Rdar9212495_C { virtual void bar() const; };
class Rdar9212495_B : public Rdar9212495_C {};
class Rdar9212495_A : public Rdar9212495_B {};
const Rdar9212495_A& rdar9212495(const Rdar9212495_C* ptr) {
  const Rdar9212495_A& val = dynamic_cast<const Rdar9212495_A&>(*ptr);

  // This is not valid C++; dynamic_cast with a reference type will throw an
  // exception if the pointer does not match the expected type. However, our
  // implementation of dynamic_cast will pass through a null pointer...or a
  // "null reference"! So this branch is actually possible.
  if (&val == 0) {
    val.bar(); // expected-warning{{Called C++ object pointer is null}}
  }

  return val;
}

const Rdar9212495_A* rdar9212495_ptr(const Rdar9212495_C* ptr) {
  const Rdar9212495_A* val = dynamic_cast<const Rdar9212495_A*>(ptr);

  if (val == 0) {
    val->bar(); // expected-warning{{Called C++ object pointer is null}}
  }

  return val;
}

// Test constructors invalidating arguments.  Previously this raised
// an uninitialized value warning.
extern "C" void __attribute__((noreturn)) PR9645_exit(int i);

class PR9645_SideEffect
{
public:
  PR9645_SideEffect(int *pi); // caches pi in i_
  void Read(int *pi); // copies *pi into *i_
private:
  int *i_;
};

void PR9645() {
  int i;

  PR9645_SideEffect se(&i);
  int j = 1;
  se.Read(&j); // this has a side-effect of initializing i.

  PR9645_exit(i); // no-warning
}

PR9645_SideEffect::PR9645_SideEffect(int *pi) : i_(pi) {}
void PR9645_SideEffect::Read(int *pi) { *i_ = *pi; }

// Invalidate fields during C++ method calls.
class RDar9267815 {
  int x;
  void test();
  void test_pos();
  void test2();
  void invalidate();
};

void RDar9267815::test_pos() {
  int *p = 0;
  if (x == 42)
    return;
  *p = 0xDEADBEEF; // expected-warning {{null}}
}
void RDar9267815::test() {
  int *p = 0;
  if (x == 42)
    return;
  if (x == 42)
    *p = 0xDEADBEEF; // no-warning
}

void RDar9267815::test2() {
  int *p = 0;
  if (x == 42)
    return;
  invalidate();
  if (x == 42)
    *p = 0xDEADBEEF; // expected-warning {{null}}
}

// Test reference parameters.
void test_ref_double_aux(double &Value);
float test_ref_double() {
  double dVal;
  test_ref_double_aux(dVal);
  // This previously warned because 'dVal' was thought to be uninitialized.
  float Val = (float)dVal; // no-warning
  return Val;
}

// Test invalidation of class fields.
class TestInvalidateClass {
public:
  int x;
};

void test_invalidate_class_aux(TestInvalidateClass &x);

int test_invalidate_class() {
  TestInvalidateClass y;
  test_invalidate_class_aux(y);
  return y.x; // no-warning
}

// Test correct pointer arithmetic using 'p--'.  This is to warn that we
// were loading beyond the written characters in buf.
char *RDar9269695(char *dst, unsigned int n)
{
  char buff[40], *p;

  p = buff;
  do
    *p++ = '0' + n % 10;
  while (n /= 10);

  do
    *dst++ = *--p; // no-warning
  while (p != buff);

  return dst;
}

// Test that we invalidate byref arguments passed to constructors.
class TestInvalidateInCtor {
public:
  TestInvalidateInCtor(unsigned &x);
};

unsigned test_invalidate_in_ctor() {
  unsigned x;
  TestInvalidateInCtor foo(x);
  return x; // no-warning
}
unsigned test_invalidate_in_ctor_new() {
  unsigned x;
  delete (new TestInvalidateInCtor(x));
  return x; // no-warning
}

// Test assigning into a symbolic offset.
struct TestAssignIntoSymbolicOffset {
  int **stuff[100];
  void test(int x, int y);
};

void TestAssignIntoSymbolicOffset::test(int x, int y) {
  x--;
  if (x > 8 || x < 0)
    return;
  if (stuff[x])
    return;
  if (!stuff[x]) {
    stuff[x] = new int*[y+1];
    // Previously triggered a null dereference.
    stuff[x][y] = 0; // no-warning
  }
}

// Test loads from static fields.  This previously triggered an uninitialized
// value warning.
class ClassWithStatic {
public:
    static const unsigned value = 1;
};

int rdar9948787_negative() {
    ClassWithStatic classWithStatic;
    unsigned value = classWithStatic.value;
    if (value == 1)
      return 1;
    int *p = 0;
    *p = 0xDEADBEEF; // no-warning
    return 0;
}

int rdar9948787_positive() {
    ClassWithStatic classWithStatic;
    unsigned value = classWithStatic.value;
    if (value == 0)
      return 1;
    int *p = 0;
    *p = 0xDEADBEEF; // expected-warning {{null}}
    return 0;
}

// Regression test against global constants and switches.
enum rdar10202899_ValT { rdar10202899_ValTA, rdar10202899_ValTB, rdar10202899_ValTC };
const rdar10202899_ValT val = rdar10202899_ValTA;
void rdar10202899_test1() {
  switch (val) {
    case rdar10202899_ValTA: {}
  };
}

void rdar10202899_test2() {
  if (val == rdar10202899_ValTA)
   return;
  int *p = 0;
  *p = 0xDEADBEEF;
}

void rdar10202899_test3() {
  switch (val) {
    case rdar10202899_ValTA: return;
    default: ;
  };
  int *p = 0;
  *p = 0xDEADBEEF;
}

// This used to crash the analyzer because of the unnamed bitfield.
void PR11249()
{
  struct {
    char f1:4;
    char   :4;
    char f2[1];
    char f3;
  } V = { 1, {2}, 3 };
  int *p = 0;
  if (V.f1 != 1)
    *p = 0xDEADBEEF;  // no-warning
  if (V.f2[0] != 2)
    *p = 0xDEADBEEF;  // no-warning
  if (V.f3 != 3)
    *p = 0xDEADBEEF;  // no-warning
}

// Handle doing a load from the memory associated with the code for
// a function.
extern double nan( const char * );
double PR11450() {
  double NaN = *(double*) nan;
  return NaN;
}

// Test that 'this' is assumed non-null upon analyzing the entry to a "top-level"
// function (i.e., when not analyzing from a specific caller).
struct TestNullThis {
  int field;
  void test();
};

void TestNullThis::test() {
  int *p = &field;
  if (p)
    return;
  field = 2; // no-warning
}

// Test handling of 'catch' exception variables, and not warning
// about uninitialized values.
enum MyEnum { MyEnumValue };
MyEnum rdar10892489() {
  try {
      throw MyEnumValue;
  } catch (MyEnum e) {
      return e; // no-warning
  }
  return MyEnumValue;
}

MyEnum rdar10892489_positive() {
  try {
    throw MyEnumValue;
  } catch (MyEnum e) {
    int *p = 0;
    // FALSE NEGATIVE
    *p = 0xDEADBEEF; // {{null}}
    return e;
  }
  return MyEnumValue;
}

// Test handling of catch with no condition variable.
void PR11545() {
  try
  {
      throw;
  }
  catch (...)
  {
  }
}

void PR11545_positive() {
  try
  {
      throw;
  }
  catch (...)
  {
    int *p = 0;
    // FALSE NEGATIVE
    *p = 0xDEADBEEF; // {{null}}
  }
}

// Test handling taking the address of a field.  While the analyzer
// currently doesn't do anything intelligent here, this previously
// resulted in a crash.
class PR11146 {
public:
  struct Entry;
  void baz();
};

struct PR11146::Entry {
  int x;
};

void PR11146::baz() {
  (void) &Entry::x;
}

// Test symbolicating a reference.  In this example, the
// analyzer (originally) didn't know how to handle x[index - index2],
// returning an UnknownVal.  The conjured symbol wasn't a location,
// and would result in a crash.
void rdar10924675(unsigned short x[], int index, int index2) {
  unsigned short &y = x[index - index2];
  if (y == 0)
    return;
}

// Test handling CXXScalarValueInitExprs.
void rdar11401827() {
  int x = int();
  if (!x) {
    int *p = 0;
    *p = 0xDEADBEEF; // expected-warning {{null pointer}}
  }
  else {
    int *p = 0;
    *p = 0xDEADBEEF;
  }
}

//===---------------------------------------------------------------------===//
// Handle inlining of C++ method calls.
//===---------------------------------------------------------------------===//

struct A {
  int *p;
  void foo(int *q) {
    p = q;
  }
  void bar() {
    *p = 0; // expected-warning {{null pointer}}
  }
};

void test_inline() {
  A a;
  a.foo(0);
  a.bar();
}

void test_alloca_in_a_recursive_function(int p1) {
    __builtin_alloca (p1);
    test_alloca_in_a_recursive_function(1);
    test_alloca_in_a_recursive_function(2);
}

//===---------------------------------------------------------------------===//
// Random tests.
//===---------------------------------------------------------------------===//

// Tests assigning using a C-style initializer to a struct
// variable whose sub-field is also a struct.  This currently
// results in a CXXTempObjectRegion being created, but not
// properly handled.  For now, we just ignore that value
// to avoid a crash (<rdar://problem/12753384>).
struct RDar12753384_ClassA {
  unsigned z;
};
struct  RDar12753384_ClassB {
  unsigned x;
  RDar12753384_ClassA y[ 8 ] ;
};
unsigned RDar12753384() {
  RDar12753384_ClassB w = { 0x00 };
  RDar12753384_ClassA y[8];
  return w.x;
}

// This testcase tests whether we treat the anonymous union and union
// the same way.  This previously resulted in a "return of stack address"
// warning because the anonymous union resulting in a temporary object
// getting put into the initializer.  We still aren't handling this correctly,
// but now if a temporary object appears in an initializer we just ignore it.
// Fixes <rdar://problem/12755044>.

struct Rdar12755044_foo
{
    struct Rdar12755044_bar
    {
        union baz
        {
            int   i;
        };
    } aBar;
};

struct Rdar12755044_foo_anon
{
    struct Rdar12755044_bar
    {
        union
        {
            int   i;
        };
    } aBar;
};

const Rdar12755044_foo_anon *radar12755044_anon() {
  static const Rdar12755044_foo_anon Rdar12755044_foo_list[] = { { { } } };
  return Rdar12755044_foo_list; // no-warning
}

const Rdar12755044_foo *radar12755044() {
  static const Rdar12755044_foo Rdar12755044_foo_list[] = { { { } } };
  return Rdar12755044_foo_list; // no-warning
}

// Test the correct handling of integer to bool conversions.  Previously
// this resulted in a false positive because integers were being truncated
// and not tested for non-zero.
void rdar12759044() {
  int flag = 512;
  if (!(flag & 512)) {
   int *p = 0;
   *p = 0xDEADBEEF; // no-warning
  }
}

// The analyzer currently does not model complex types.  Test that the load
// from 'x' is not flagged as being uninitialized.
typedef __complex__ float _ComplexT;
void rdar12964481(_ComplexT *y) {
   _ComplexT x;
   __real__ x = 1.0;
   __imag__ x = 1.0;
   *y *= x; // no-warning
}
void rdar12964481_b(_ComplexT *y) {
   _ComplexT x;
   // Eventually this should be a warning.
   *y *= x; // no-warning
}

// Test case for PR 12921.  This previously produced
// a bogus warning.
static const int pr12921_arr[] = { 0, 1 };
static const int pr12921_arrcount = sizeof(pr12921_arr)/sizeof(int);

int pr12921(int argc, char **argv) {
  int i, retval;
  for (i = 0; i < pr12921_arrcount; i++) {
    if (argc == i) {
      retval = i;
      break;
    }
  }

  // No match
  if (i == pr12921_arrcount) return 66;
  return pr12921_arr[retval];
}