reference.cpp revision 018e9aa033ff7363797c62fc3b14669d0558284b
1// RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.core,debug.ExprInspection -analyzer-store=region -analyzer-constraints=range -verify -Wno-null-dereference %s 2 3void clang_analyzer_eval(bool); 4 5typedef typeof(sizeof(int)) size_t; 6void malloc (size_t); 7 8void f1() { 9 int const &i = 3; 10 int b = i; 11 12 int *p = 0; 13 14 if (b != 3) 15 *p = 1; // no-warning 16} 17 18char* ptr(); 19char& ref(); 20 21// These next two tests just shouldn't crash. 22char t1 () { 23 ref() = 'c'; 24 return '0'; 25} 26 27// just a sanity test, the same behavior as t1() 28char t2 () { 29 *ptr() = 'c'; 30 return '0'; 31} 32 33// Each of the tests below is repeated with pointers as well as references. 34// This is mostly a sanity check, but then again, both should work! 35char t3 () { 36 char& r = ref(); 37 r = 'c'; // no-warning 38 if (r) return r; 39 return *(char*)0; // no-warning 40} 41 42char t4 () { 43 char* p = ptr(); 44 *p = 'c'; // no-warning 45 if (*p) return *p; 46 return *(char*)0; // no-warning 47} 48 49char t5 (char& r) { 50 r = 'c'; // no-warning 51 if (r) return r; 52 return *(char*)0; // no-warning 53} 54 55char t6 (char* p) { 56 *p = 'c'; // no-warning 57 if (*p) return *p; 58 return *(char*)0; // no-warning 59} 60 61 62// PR13440 / <rdar://problem/11977113> 63// Test that the array-to-pointer decay works for array references as well. 64// More generally, when we want an lvalue for a reference field, we still need 65// to do one level of load. 66namespace PR13440 { 67 typedef int T[1]; 68 struct S { 69 T &x; 70 71 int *m() { return x; } 72 }; 73 74 struct S2 { 75 int (&x)[1]; 76 77 int *m() { return x; } 78 }; 79 80 void test() { 81 int a[1]; 82 S s = { a }; 83 S2 s2 = { a }; 84 85 if (s.x != a) return; 86 if (s2.x != a) return; 87 88 a[0] = 42; 89 clang_analyzer_eval(s.x[0] == 42); // expected-warning{{TRUE}} 90 clang_analyzer_eval(s2.x[0] == 42); // expected-warning{{TRUE}} 91 } 92} 93 94void testNullReference() { 95 int *x = 0; 96 int &y = *x; // expected-warning{{Dereference of null pointer}} 97 y = 5; 98} 99 100void testRetroactiveNullReference(int *x) { 101 // According to the C++ standard, there is no such thing as a 102 // "null reference". So the 'if' statement ought to be dead code. 103 // However, Clang (and other compilers) don't actually check that a pointer 104 // value is non-null in the implementation of references, so it is possible 105 // to produce a supposed "null reference" at runtime. The analyzer shoeuld 106 // still warn when it can prove such errors. 107 int &y = *x; 108 if (x != 0) 109 return; 110 y = 5; // expected-warning{{Dereference of null pointer}} 111} 112 113void testReferenceAddress(int &x) { 114 clang_analyzer_eval(&x != 0); // expected-warning{{TRUE}} 115 clang_analyzer_eval(&ref() != 0); // expected-warning{{TRUE}} 116 117 struct S { int &x; }; 118 119 extern S getS(); 120 clang_analyzer_eval(&getS().x != 0); // expected-warning{{TRUE}} 121 122 extern S *getSP(); 123 clang_analyzer_eval(&getSP()->x != 0); // expected-warning{{TRUE}} 124} 125 126 127void testFunctionPointerReturn(void *opaque) { 128 typedef int &(*RefFn)(); 129 130 RefFn getRef = (RefFn)opaque; 131 132 // Don't crash writing to or reading from this reference. 133 int &x = getRef(); 134 x = 42; 135 clang_analyzer_eval(x == 42); // expected-warning{{TRUE}} 136} 137 138int &testReturnNullReference() { 139 int *x = 0; 140 return *x; // expected-warning{{Returning null reference}} 141} 142 143char &refFromPointer() { 144 return *ptr(); 145} 146 147void testReturnReference() { 148 clang_analyzer_eval(ptr() == 0); // expected-warning{{UNKNOWN}} 149 clang_analyzer_eval(&refFromPointer() == 0); // expected-warning{{FALSE}} 150} 151 152void intRefParam(int &r) { 153 ; 154} 155 156void test(int *ptr) { 157 clang_analyzer_eval(ptr == 0); // expected-warning{{UNKNOWN}} 158 159 extern void use(int &ref); 160 use(*ptr); 161 162 clang_analyzer_eval(ptr == 0); // expected-warning{{FALSE}} 163} 164 165void testIntRefParam() { 166 int i = 0; 167 intRefParam(i); // no-warning 168} 169 170int refParam(int &byteIndex) { 171 return byteIndex; 172} 173 174void testRefParam(int *p) { 175 if (p) 176 ; 177 refParam(*p); // expected-warning {{Forming reference to null pointer}} 178} 179 180int ptrRefParam(int *&byteIndex) { 181 return *byteIndex; // expected-warning {{Dereference of null pointer}} 182} 183void testRefParam2() { 184 int *p = 0; 185 int *&rp = p; 186 ptrRefParam(rp); 187} 188 189int *maybeNull() { 190 extern bool coin(); 191 static int x; 192 return coin() ? &x : 0; 193} 194 195void use(int &x) { 196 x = 1; // no-warning 197} 198 199void testSuppression() { 200 use(*maybeNull()); 201} 202 203namespace rdar11212286 { 204 class B{}; 205 206 B test() { 207 B *x = 0; 208 return *x; // expected-warning {{Forming reference to null pointer}} 209 } 210 211 B testif(B *x) { 212 if (x) 213 ; 214 return *x; // expected-warning {{Forming reference to null pointer}} 215 } 216 217 void idc(B *x) { 218 if (x) 219 ; 220 } 221 222 B testidc(B *x) { 223 idc(x); 224 return *x; // no-warning 225 } 226} 227