misc-ps.m revision 6da60499eae46caf9f92f7ba35c607043dc3f7fa
1// NOTE: Use '-fobjc-gc' to test the analysis being run twice, and multiple reports are not issued. 2// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,experimental.deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync,osx.AtomicCAS -analyzer-store=region -analyzer-constraints=basic -verify -fblocks -Wno-unreachable-code -Wno-null-dereference -Wno-objc-root-class %s 3// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,experimental.deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync,osx.AtomicCAS -analyzer-store=region -analyzer-constraints=range -verify -fblocks -Wno-unreachable-code -Wno-null-dereference -Wno-objc-root-class %s 4// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-checker=core,experimental.deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync,osx.AtomicCAS -analyzer-store=region -analyzer-constraints=basic -verify -fblocks -Wno-unreachable-code -Wno-null-dereference -Wno-objc-root-class %s 5// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-checker=core,experimental.deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync,osx.AtomicCAS -analyzer-store=region -analyzer-constraints=range -verify -fblocks -Wno-unreachable-code -Wno-null-dereference -Wno-objc-root-class %s 6 7#ifndef __clang_analyzer__ 8#error __clang_analyzer__ not defined 9#endif 10 11typedef struct objc_ivar *Ivar; 12typedef struct objc_selector *SEL; 13typedef signed char BOOL; 14typedef int NSInteger; 15typedef unsigned int NSUInteger; 16typedef struct _NSZone NSZone; 17@class NSInvocation, NSArray, NSMethodSignature, NSCoder, NSString, NSEnumerator; 18@protocol NSObject 19- (BOOL)isEqual:(id)object; 20- (id)autorelease; 21@end 22@protocol NSCopying 23- (id)copyWithZone:(NSZone *)zone; 24@end 25@protocol NSMutableCopying - (id)mutableCopyWithZone:(NSZone *)zone; @end 26@protocol NSCoding 27- (void)encodeWithCoder:(NSCoder *)aCoder; 28@end 29@interface NSObject <NSObject> {} 30- (id)init; 31+ (id)allocWithZone:(NSZone *)zone; 32@end 33extern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone); 34@interface NSString : NSObject <NSCopying, NSMutableCopying, NSCoding> 35- (NSUInteger)length; 36+ (id)stringWithUTF8String:(const char *)nullTerminatedCString; 37@end extern NSString * const NSBundleDidLoadNotification; 38@interface NSValue : NSObject <NSCopying, NSCoding> 39- (void)getValue:(void *)value; 40@end 41@interface NSNumber : NSValue 42- (char)charValue; 43- (id)initWithBool:(BOOL)value; 44@end 45@interface NSAssertionHandler : NSObject {} 46+ (NSAssertionHandler *)currentHandler; 47- (void)handleFailureInMethod:(SEL)selector object:(id)object file:(NSString *)fileName lineNumber:(NSInteger)line description:(NSString *)format,...; 48@end 49extern NSString * const NSConnectionReplyMode; 50typedef float CGFloat; 51typedef struct _NSPoint { 52 CGFloat x; 53 CGFloat y; 54} NSPoint; 55typedef struct _NSSize { 56 CGFloat width; 57 CGFloat height; 58} NSSize; 59typedef struct _NSRect { 60 NSPoint origin; 61 NSSize size; 62} NSRect; 63 64// Reduced test case from crash in <rdar://problem/6253157> 65@interface A @end 66@implementation A 67- (void)foo:(void (^)(NSObject *x))block { 68 if (!((block != ((void *)0)))) {} 69} 70@end 71 72// Reduced test case from crash in PR 2796; 73// http://llvm.org/bugs/show_bug.cgi?id=2796 74 75unsigned foo(unsigned x) { return __alignof__((x)) + sizeof(x); } 76 77// Improvement to path-sensitivity involving compound assignments. 78// Addresses false positive in <rdar://problem/6268365> 79// 80 81unsigned r6268365Aux(); 82 83void r6268365() { 84 unsigned x = 0; 85 x &= r6268365Aux(); // expected-warning{{The left operand to '&=' is always 0}} 86 unsigned j = 0; 87 88 if (x == 0) ++j; 89 if (x == 0) x = x / j; // expected-warning{{Assigned value is always the same as the existing value}} expected-warning{{The right operand to '/' is always 1}} 90} 91 92void divzeroassume(unsigned x, unsigned j) { 93 x /= j; 94 if (j == 0) x /= 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 95 if (j == 0) x /= j; // no static-analyzer warning 96 if (j == 0) x = x / 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 97} 98 99void divzeroassumeB(unsigned x, unsigned j) { 100 x = x / j; 101 if (j == 0) x /= 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 102 if (j == 0) x /= j; // no static-analyzer warning 103 if (j == 0) x = x / 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 104} 105 106// InitListExpr processing 107 108typedef float __m128 __attribute__((__vector_size__(16), __may_alias__)); 109__m128 return128() { 110 // This compound literal has a Vector type. We currently just 111 // return UnknownVal. 112 return __extension__(__m128) { 0.0f, 0.0f, 0.0f, 0.0f }; 113} 114 115typedef long long __v2di __attribute__ ((__vector_size__ (16))); 116typedef long long __m128i __attribute__ ((__vector_size__ (16), __may_alias__)); 117__m128i vec128i(long long __q1, long long __q0) { 118 // This compound literal returns true for both isVectorType() and 119 // isIntegerType(). 120 return __extension__ (__m128i)(__v2di){ __q0, __q1 }; 121} 122 123// Zero-sized VLAs. 124void check_zero_sized_VLA(int x) { 125 if (x) 126 return; 127 128 int vla[x]; // expected-warning{{Declared variable-length array (VLA) has zero size}} 129} 130 131void check_uninit_sized_VLA() { 132 int x; 133 int vla[x]; // expected-warning{{Declared variable-length array (VLA) uses a garbage value as its size}} 134} 135 136// sizeof(void) 137// - Tests a regression reported in PR 3211: http://llvm.org/bugs/show_bug.cgi?id=3211 138void handle_sizeof_void(unsigned flag) { 139 int* p = 0; 140 141 if (flag) { 142 if (sizeof(void) == 1) 143 return; 144 // Infeasible. 145 *p = 1; // no-warning 146 } 147 148 void* q; 149 150 if (!flag) { 151 if (sizeof(*q) == 1) 152 return; 153 // Infeasibe. 154 *p = 1; // no-warning 155 } 156 157 // Infeasible. 158 *p = 1; // no-warning 159} 160 161// check deference of undefined values 162void check_deref_undef(void) { 163 int *p; 164 *p = 0xDEADBEEF; // expected-warning{{Dereference of undefined pointer value}} 165} 166 167// PR 3422 168void pr3422_helper(char *p); 169void pr3422() { 170 char buf[100]; 171 char *q = &buf[10]; 172 pr3422_helper(&q[1]); 173} 174 175// PR 3543 (handle empty statement expressions) 176void pr_3543(void) { 177 ({}); 178} 179 180// <rdar://problem/6611677> 181// This test case test the use of a vector type within an array subscript 182// expression. 183typedef long long __a64vector __attribute__((__vector_size__(8))); 184typedef long long __a128vector __attribute__((__vector_size__(16))); 185static inline __a64vector __attribute__((__always_inline__, __nodebug__)) 186my_test_mm_movepi64_pi64(__a128vector a) { 187 return (__a64vector)a[0]; 188} 189 190// Test basic tracking of ivars associated with 'self'. 191@interface SelfIvarTest : NSObject { 192 int flag; 193} 194- (void)test_self_tracking; 195@end 196 197@implementation SelfIvarTest 198- (void)test_self_tracking { 199 char *p = 0; 200 char c; 201 202 if (flag) 203 p = "hello"; 204 205 if (flag) 206 c = *p; // no-warning 207} 208@end 209 210// PR 3770 211char pr3770(int x) { 212 int y = x & 0x2; 213 char *p = 0; 214 if (y == 1) 215 p = "hello"; 216 217 if (y == 1) 218 return p[0]; // no-warning 219 220 return 'a'; 221} 222 223// PR 3772 224// - We just want to test that this doesn't crash the analyzer. 225typedef struct st ST; 226struct st { char *name; }; 227extern ST *Cur_Pu; 228 229void pr3772(void) 230{ 231 static ST *last_Cur_Pu; 232 if (last_Cur_Pu == Cur_Pu) { 233 return; 234 } 235} 236 237// PR 3780 - This tests that StmtIterator isn't broken for VLAs in DeclGroups. 238void pr3780(int sz) { typedef double MAT[sz][sz]; } 239 240// <rdar://problem/6695527> - Test that we don't symbolicate doubles before 241// we are ready to do something with them. 242int rdar6695527(double x) { 243 if (!x) { return 0; } 244 return 1; 245} 246 247// <rdar://problem/6708148> - Test that we properly invalidate structs 248// passed-by-reference to a function. 249void pr6708148_invalidate(NSRect *x); 250void pr6708148_use(NSRect x); 251void pr6708148_test(void) { 252 NSRect x; 253 pr6708148_invalidate(&x); 254 pr6708148_use(x); // no-warning 255} 256 257// Handle both kinds of noreturn attributes for pruning paths. 258void rdar_6777003_noret() __attribute__((noreturn)); 259void rdar_6777003_analyzer_noret() __attribute__((analyzer_noreturn)); 260 261void rdar_6777003(int x) { 262 int *p = 0; 263 264 if (x == 1) { 265 rdar_6777003_noret(); 266 *p = 1; // no-warning; 267 } 268 269 if (x == 2) { 270 rdar_6777003_analyzer_noret(); 271 *p = 1; // no-warning; 272 } 273 274 *p = 1; // expected-warning{{Dereference of null pointer}} 275} 276 277// Check that the pointer-to-conts arguments do not get invalidated by Obj C 278// interfaces. radar://10595327 279int rdar_10595327(char *str) { 280 char fl = str[0]; 281 int *p = 0; 282 NSString *s = [NSString stringWithUTF8String:str]; 283 if (str[0] != fl) 284 return *p; // no-warning 285 return 0; 286} 287 288// For pointer arithmetic, --/++ should be treated as preserving non-nullness, 289// regardless of how well the underlying StoreManager reasons about pointer 290// arithmetic. 291// <rdar://problem/6777209> 292void rdar_6777209(char *p) { 293 if (p == 0) 294 return; 295 296 ++p; 297 298 // This branch should always be infeasible. 299 if (p == 0) 300 *p = 'c'; // no-warning 301} 302 303// PR 4033. A symbolic 'void *' pointer can be used as the address for a 304// computed goto. 305typedef void *Opcode; 306Opcode pr_4033_getOpcode(); 307void pr_4033(void) { 308 void *lbl = &&next_opcode; 309next_opcode: 310 { 311 Opcode op = pr_4033_getOpcode(); 312 if (op) goto *op; 313 } 314} 315 316// Test invalidating pointers-to-pointers with slightly different types. This 317// example came from a recent false positive due to a regression where the 318// branch condition was falsely reported as being uninitialized. 319void invalidate_by_ref(char **x); 320int test_invalidate_by_ref() { 321 unsigned short y; 322 invalidate_by_ref((char**) &y); 323 if (y) // no-warning 324 return 1; 325 return 0; 326} 327 328// Test for <rdar://problem/7027684>. This just tests that the CFG is 329// constructed correctly. Previously, the successor block of the entrance 330// was the block containing the merge for '?', which would trigger an 331// assertion failure. 332int rdar_7027684_aux(); 333int rdar_7027684_aux_2() __attribute__((noreturn)); 334void rdar_7027684(int x, int y) { 335 {}; // this empty compound statement is critical. 336 (rdar_7027684_aux() ? rdar_7027684_aux_2() : (void) 0); 337} 338 339// Test that we handle casts of string literals to arbitrary types. 340unsigned const char *string_literal_test1() { 341 return (const unsigned char*) "hello"; 342} 343 344const float *string_literal_test2() { 345 return (const float*) "hello"; 346} 347 348// Test that we handle casts *from* incomplete struct types. 349extern const struct _FooAssertStruct _cmd; 350void test_cast_from_incomplete_struct_aux(volatile const void *x); 351void test_cast_from_incomplete_struct() { 352 test_cast_from_incomplete_struct_aux(&_cmd); 353} 354 355// Test for <rdar://problem/7034511> 356// "ValueManager::makeIntVal(uint64_t X, QualType T) should return a 'Loc' 357// when 'T' is a pointer" 358// 359// Previously this case would crash. 360void test_rdar_7034511(NSArray *y) { 361 NSObject *x; 362 for (x in y) {} 363 if (x == ((void*) 0)) {} 364} 365 366// Handle casts of function pointers (CodeTextRegions) to arbitrary pointer 367// types. This was previously causing a crash in CastRegion. 368void handle_funcptr_voidptr_casts() { 369 void **ptr; 370 typedef void *PVOID; 371 typedef void *PCHAR; 372 typedef long INT_PTR, *PINT_PTR; 373 typedef INT_PTR (*FARPROC)(); 374 FARPROC handle_funcptr_voidptr_casts_aux(); 375 PVOID handle_funcptr_voidptr_casts_aux_2(PVOID volatile *x); 376 PVOID handle_funcptr_voidptr_casts_aux_3(PCHAR volatile *x); 377 378 ptr = (void**) handle_funcptr_voidptr_casts_aux(); 379 handle_funcptr_voidptr_casts_aux_2(ptr); 380 handle_funcptr_voidptr_casts_aux_3(ptr); 381} 382 383// RegionStore::Retrieve previously crashed on this example. This example 384// was previously in the test file 'xfail_regionstore_wine_crash.c'. 385void testA() { 386 long x = 0; 387 char *y = (char *) &x; 388 if (!*y) 389 return; 390} 391 392// RegionStoreManager previously crashed on this example. The problem is that 393// the value bound to the field of b->grue after the call to testB_aux is 394// a symbolic region. The second '*__gruep__' involves performing a load 395// from a 'int*' that really is a 'void**'. The loaded location must be 396// implicitly converted to an integer that wraps a location. Previosly we would 397// get a crash here due to an assertion failure. 398typedef struct _BStruct { void *grue; } BStruct; 399void testB_aux(void *ptr); 400void testB(BStruct *b) { 401 { 402 int *__gruep__ = ((int *)&((b)->grue)); 403 int __gruev__ = *__gruep__; 404 testB_aux(__gruep__); 405 } 406 { 407 int *__gruep__ = ((int *)&((b)->grue)); 408 int __gruev__ = *__gruep__; 409 if (~0 != __gruev__) {} 410 } 411} 412 413void test_trivial_symbolic_comparison(int *x) { 414 int test_trivial_symbolic_comparison_aux(); 415 int a = test_trivial_symbolic_comparison_aux(); 416 int b = a; 417 if (a != b) { // expected-warning{{Both operands to '!=' always have the same value}} 418 int *p = 0; 419 *p = 0xDEADBEEF; // no-warning 420 } 421 422 a = a == 1; 423 b = b == 1; 424 if (a != b) { // expected-warning{{Both operands to '!=' always have the same value}} 425 int *p = 0; 426 *p = 0xDEADBEEF; // no-warning 427 } 428} 429 430// Test for: 431// <rdar://problem/7062158> false positive null dereference due to 432// BasicStoreManager not tracking *static* globals 433// 434// This just tests the proper tracking of symbolic values for globals (both 435// static and non-static). 436// 437static int* x_rdar_7062158; 438void rdar_7062158() { 439 int *current = x_rdar_7062158; 440 if (current == x_rdar_7062158) 441 return; 442 443 int *p = 0; 444 *p = 0xDEADBEEF; // no-warning 445} 446 447int* x_rdar_7062158_2; 448void rdar_7062158_2() { 449 int *current = x_rdar_7062158_2; 450 if (current == x_rdar_7062158_2) 451 return; 452 453 int *p = 0; 454 *p = 0xDEADBEEF; // no-warning 455} 456 457// This test reproduces a case for a crash when analyzing ClamAV using 458// RegionStoreManager (the crash doesn't exhibit in BasicStoreManager because 459// it isn't doing anything smart about arrays). The problem is that on the 460// second line, 'p = &p[i]', p is assigned an ElementRegion whose index 461// is a 16-bit integer. On the third line, a new ElementRegion is created 462// based on the previous region, but there the region uses a 32-bit integer, 463// resulting in a clash of values (an assertion failure at best). We resolve 464// this problem by implicitly converting index values to 'int' when the 465// ElementRegion is created. 466unsigned char test_array_index_bitwidth(const unsigned char *p) { 467 unsigned short i = 0; 468 for (i = 0; i < 2; i++) p = &p[i]; 469 return p[i+1]; 470} 471 472// This case tests that CastRegion handles casts involving BlockPointerTypes. 473// It should not crash. 474void test_block_cast() { 475 id test_block_cast_aux(); 476 (void (^)(void *))test_block_cast_aux(); // expected-warning{{expression result unused}} 477} 478 479int OSAtomicCompareAndSwap32Barrier(); 480 481// Test comparison of 'id' instance variable to a null void* constant after 482// performing an OSAtomicCompareAndSwap32Barrier. 483// This previously was a crash in RegionStoreManager. 484@interface TestIdNull { 485 id x; 486} 487-(int)foo; 488@end 489@implementation TestIdNull 490-(int)foo { 491 OSAtomicCompareAndSwap32Barrier(0, (signed)2, (signed*)&x); 492 if (x == (void*) 0) { return 0; } 493 return 1; 494} 495@end 496 497// Do not crash when performing compare and swap on symbolic values. 498typedef int int32_t; 499typedef int int32; 500typedef int32 Atomic32; 501int OSAtomicCompareAndSwap32( int32_t __oldValue, int32_t __newValue, volatile int32_t *__theValue); 502void radar11390991_NoBarrier_CompareAndSwap(volatile Atomic32 *ptr, 503 Atomic32 old_value, 504 Atomic32 new_value) { 505 OSAtomicCompareAndSwap32(old_value, new_value, ptr); 506} 507 508// PR 4594 - This was a crash when handling casts in SimpleSValuator. 509void PR4594() { 510 char *buf[1]; 511 char **foo = buf; 512 *foo = "test"; 513} 514 515// Test invalidation logic where an integer is casted to an array with a 516// different sign and then invalidated. 517void test_invalidate_cast_int() { 518 void test_invalidate_cast_int_aux(unsigned *i); 519 signed i; 520 test_invalidate_cast_int_aux((unsigned*) &i); 521 if (i < 0) 522 return; 523} 524 525int ivar_getOffset(); 526 527// Reduced from a crash involving the cast of an Objective-C symbolic region to 528// 'char *' 529static NSNumber *test_ivar_offset(id self, SEL _cmd, Ivar inIvar) { 530 return [[[NSNumber allocWithZone:((void*)0)] initWithBool:*(_Bool *)((char *)self + ivar_getOffset(inIvar))] autorelease]; 531} 532 533// Reduced from a crash in StoreManager::CastRegion involving a divide-by-zero. 534// This resulted from not properly handling region casts to 'const void*'. 535void test_cast_const_voidptr() { 536 char x[10]; 537 char *p = &x[1]; 538 const void* q = p; 539} 540 541// Reduced from a crash when analyzing Wine. This test handles loads from 542// function addresses. 543typedef long (*FARPROC)(); 544FARPROC test_load_func(FARPROC origfun) { 545 if (!*(unsigned char*) origfun) 546 return origfun; 547 return 0; 548} 549 550// Test passing-by-value an initialized struct variable. 551struct test_pass_val { 552 int x; 553 int y; 554}; 555void test_pass_val_aux(struct test_pass_val s); 556void test_pass_val() { 557 struct test_pass_val s; 558 s.x = 1; 559 s.y = 2; 560 test_pass_val_aux(s); 561} 562 563// This is a reduced test case of a false positive that previously appeared 564// in RegionStoreManager. Previously the array access resulted in dereferencing 565// an undefined value. 566int test_array_compound(int *q, int *r, int *z) { 567 int *array[] = { q, r, z }; 568 int j = 0; 569 for (unsigned i = 0; i < 3 ; ++i) 570 if (*array[i]) ++j; // no-warning 571 return j; 572} 573 574// symbolic value stored in 'x' wouldn't be implicitly casted to a signed value 575// during the comparison. 576int rdar_7124210(unsigned int x) { 577 enum { SOME_CONSTANT = 123 }; 578 int compare = ((signed) SOME_CONSTANT) == *((signed *) &x); 579 return compare ? 0 : 1; // Forces the evaluation of the symbolic constraint. 580} 581 582void pr4781(unsigned long *raw1) { 583 unsigned long *cook, *raw0; 584 unsigned long dough[32]; 585 int i; 586 cook = dough; 587 for( i = 0; i < 16; i++, raw1++ ) { 588 raw0 = raw1++; 589 *cook = (*raw0 & 0x00fc0000L) << 6; 590 *cook |= (*raw0 & 0x00000fc0L) << 10; 591 } 592} 593 594// <rdar://problem/7185647> - 'self' should be treated as being non-null 595// upon entry to an objective-c method. 596@interface RDar7185647 597- (id)foo; 598@end 599@implementation RDar7185647 600- (id) foo { 601 if (self) 602 return self; 603 *((volatile int *) 0x0) = 0xDEADBEEF; // no-warning 604 return self; 605} 606@end 607 608// Test reasoning of __builtin_offsetof; 609struct test_offsetof_A { 610 int x; 611 int y; 612}; 613struct test_offsetof_B { 614 int w; 615 int z; 616}; 617void test_offsetof_1() { 618 if (__builtin_offsetof(struct test_offsetof_A, x) == 619 __builtin_offsetof(struct test_offsetof_B, w)) 620 return; 621 int *p = 0; 622 *p = 0xDEADBEEF; // no-warning 623} 624void test_offsetof_2() { 625 if (__builtin_offsetof(struct test_offsetof_A, y) == 626 __builtin_offsetof(struct test_offsetof_B, z)) 627 return; 628 int *p = 0; 629 *p = 0xDEADBEEF; // no-warning 630} 631void test_offsetof_3() { 632 if (__builtin_offsetof(struct test_offsetof_A, y) - 633 __builtin_offsetof(struct test_offsetof_A, x) 634 == 635 __builtin_offsetof(struct test_offsetof_B, z) - 636 __builtin_offsetof(struct test_offsetof_B, w)) 637 return; 638 int *p = 0; 639 *p = 0xDEADBEEF; // no-warning 640} 641void test_offsetof_4() { 642 if (__builtin_offsetof(struct test_offsetof_A, y) == 643 __builtin_offsetof(struct test_offsetof_B, w)) 644 return; 645 int *p = 0; 646 *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} 647} 648 649// <rdar://problem/6829164> "nil receiver" false positive: make tracking 650// of the MemRegion for 'self' path-sensitive 651@interface RDar6829164 : NSObject { 652 double x; int y; 653} 654- (id) init; 655@end 656 657id rdar_6829164_1(); 658double rdar_6829164_2(); 659 660@implementation RDar6829164 661- (id) init { 662 if((self = [super init]) != 0) { 663 id z = rdar_6829164_1(); 664 y = (z != 0); 665 if (y) 666 x = rdar_6829164_2(); 667 } 668 return self; 669} 670@end 671 672// <rdar://problem/7242015> - Invalidate values passed-by-reference 673// to functions when the pointer to the value is passed as an integer. 674void test_7242015_aux(unsigned long); 675int rdar_7242015() { 676 int x; 677 test_7242015_aux((unsigned long) &x); // no-warning 678 return x; // Previously we return and uninitialized value when 679 // using RegionStore. 680} 681 682// <rdar://problem/7242006> [RegionStore] compound literal assignment with 683// floats not honored 684CGFloat rdar7242006(CGFloat x) { 685 NSSize y = (NSSize){x, 10}; 686 return y.width; // no-warning 687} 688 689// PR 4988 - This test exhibits a case where a function can be referenced 690// when not explicitly used in an "lvalue" context (as far as the analyzer is 691// concerned). This previously triggered a crash due to an invalid assertion. 692void pr_4988(void) { 693 pr_4988; // expected-warning{{expression result unused}} 694} 695 696// <rdar://problem/7152418> - A 'signed char' is used as a flag, which is 697// implicitly converted to an int. 698void *rdar7152418_bar(); 699@interface RDar7152418 { 700 signed char x; 701} 702-(char)foo; 703@end; 704@implementation RDar7152418 705-(char)foo { 706 char *p = 0; 707 void *result = 0; 708 if (x) { 709 result = rdar7152418_bar(); 710 p = "hello"; 711 } 712 if (!result) { 713 result = rdar7152418_bar(); 714 if (result && x) 715 return *p; // no-warning 716 } 717 return 1; 718} 719 720//===----------------------------------------------------------------------===// 721// Test constant-folding of symbolic values, automatically handling type 722// conversions of the symbol as necessary. 723//===----------------------------------------------------------------------===// 724 725// Previously this would crash once we started eagerly evaluating symbols whose 726// values were constrained to a single value. 727void test_symbol_fold_1(signed char x) { 728 while (1) { 729 if (x == ((signed char) 0)) {} 730 } 731} 732 733// This previously caused a crash because it triggered an assertion in APSInt. 734void test_symbol_fold_2(unsigned int * p, unsigned int n, 735 const unsigned int * grumpkin, unsigned int dn) { 736 unsigned int i; 737 unsigned int tempsub[8]; 738 unsigned int *solgrumpkin = tempsub + n; 739 for (i = 0; i < n; i++) 740 solgrumpkin[i] = (i < dn) ? ~grumpkin[i] : 0xFFFFFFFF; 741 for (i <<= 5; i < (n << 5); i++) {} 742} 743 744// This previously caused a crash because it triggered an assertion in APSInt. 745// 'x' would evaluate to a 8-bit constant (because of the return value of 746// test_symbol_fold_3_aux()) which would not get properly promoted to an 747// integer. 748char test_symbol_fold_3_aux(void); 749unsigned test_symbol_fold_3(void) { 750 unsigned x = test_symbol_fold_3_aux(); 751 if (x == 54) 752 return (x << 8) | 0x5; 753 return 0; 754} 755 756//===----------------------------------------------------------------------===// 757// Tests for the warning of casting a non-struct type to a struct type 758//===----------------------------------------------------------------------===// 759 760typedef struct {unsigned int v;} NSSwappedFloat; 761 762NSSwappedFloat test_cast_nonstruct_to_struct(float x) { 763 struct hodor { 764 float number; 765 NSSwappedFloat sf; 766 }; 767 return ((struct hodor *)&x)->sf; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}} 768} 769 770NSSwappedFloat test_cast_nonstruct_to_union(float x) { 771 union bran { 772 float number; 773 NSSwappedFloat sf; 774 }; 775 return ((union bran *)&x)->sf; // no-warning 776} 777 778void test_undefined_array_subscript() { 779 int i, a[10]; 780 int *p = &a[i]; // expected-warning{{Array subscript is undefined}} 781} 782@end 783 784//===----------------------------------------------------------------------===// 785// Test using an uninitialized value as a branch condition. 786//===----------------------------------------------------------------------===// 787 788int test_uninit_branch(void) { 789 int x; 790 if (x) // expected-warning{{Branch condition evaluates to a garbage value}} 791 return 1; 792 return 0; 793} 794 795int test_uninit_branch_b(void) { 796 int x; 797 return x ? 1 : 0; // expected-warning{{Branch condition evaluates to a garbage value}} 798} 799 800int test_uninit_branch_c(void) { 801 int x; 802 if ((short)x) // expected-warning{{Branch condition evaluates to a garbage value}} 803 return 1; 804 return 0; 805} 806 807//===----------------------------------------------------------------------===// 808// Test passing an undefined value in a message or function call. 809//===----------------------------------------------------------------------===// 810 811void test_bad_call_aux(int x); 812void test_bad_call(void) { 813 int y; 814 test_bad_call_aux(y); // expected-warning{{Function call argument is an uninitialized value}} 815} 816 817@interface TestBadArg {} 818- (void) testBadArg:(int) x; 819@end 820 821void test_bad_msg(TestBadArg *p) { 822 int y; 823 [p testBadArg:y]; // expected-warning{{Argument in message expression is an uninitialized value}} 824} 825 826//===----------------------------------------------------------------------===// 827// PR 6033 - Test emitting the correct output in a warning where we use '%' 828// with operands that are undefined. 829//===----------------------------------------------------------------------===// 830 831int pr6033(int x) { 832 int y; 833 return x % y; // expected-warning{{The right operand of '%' is a garbage value}} 834} 835 836struct trie { 837 struct trie* next; 838}; 839 840struct kwset { 841 struct trie *trie; 842 unsigned char y[10]; 843 struct trie* next[10]; 844 int d; 845}; 846 847typedef struct trie trie_t; 848typedef struct kwset kwset_t; 849 850void f(kwset_t *kws, char const *p, char const *q) { 851 struct trie const *trie; 852 struct trie * const *next = kws->next; 853 register unsigned char c; 854 register char const *end = p; 855 register char const *lim = q; 856 register int d = 1; 857 register unsigned char const *y = kws->y; 858 859 d = y[c = (end+=d)[-1]]; // no-warning 860 trie = next[c]; 861} 862 863//===----------------------------------------------------------------------===// 864// <rdar://problem/7593875> When handling sizeof(VLA) it leads to a hole in 865// the ExplodedGraph (causing a false positive) 866//===----------------------------------------------------------------------===// 867 868int rdar_7593875_aux(int x); 869int rdar_7593875(int n) { 870 int z[n > 10 ? 10 : n]; // VLA. 871 int v; 872 v = rdar_7593875_aux(sizeof(z)); 873 // Previously we got a false positive about 'v' being uninitialized. 874 return v; // no-warning 875} 876 877//===----------------------------------------------------------------------===// 878// Handle casts from symbolic regions (packaged as integers) to doubles. 879// Previously this caused an assertion failure. 880//===----------------------------------------------------------------------===// 881 882void *foo_rev95119(); 883void baz_rev95119(double x); 884void bar_rev95119() { 885 // foo_rev95119() returns a symbolic pointer. It is then 886 // cast to an int which is then cast to a double. 887 int value = (int) foo_rev95119(); 888 baz_rev95119((double)value); 889} 890 891//===----------------------------------------------------------------------===// 892// Handle loading a symbolic pointer from a symbolic region that was 893// invalidated by a call to an unknown function. 894//===----------------------------------------------------------------------===// 895 896void bar_rev95192(int **x); 897void foo_rev95192(int **x) { 898 *x = 0; 899 bar_rev95192(x); 900 // Not a null dereference. 901 **x = 1; // no-warning 902} 903 904//===----------------------------------------------------------------------===// 905// Handle casts of a function to a function pointer with a different return 906// value. We don't yet emit an error for such cases, but we now we at least 907// don't crash when the return value gets interpreted in a way that 908// violates our invariants. 909//===----------------------------------------------------------------------===// 910 911void *foo_rev95267(); 912int bar_rev95267() { 913 char (*Callback_rev95267)(void) = (char (*)(void)) foo_rev95267; 914 if ((*Callback_rev95267)() == (char) 0) 915 return 1; 916 return 0; 917} 918 919// Same as previous case, but handle casts to 'void'. 920int bar_rev95274() { 921 void (*Callback_rev95274)(void) = (void (*)(void)) foo_rev95267; 922 (*Callback_rev95274)(); 923 return 0; 924} 925 926void rdar7582031_test_static_init_zero() { 927 static unsigned x; 928 if (x == 0) 929 return; 930 int *p = 0; 931 *p = 0xDEADBEEF; 932} 933void rdar7582031_test_static_init_zero_b() { 934 static void* x; 935 if (x == 0) 936 return; 937 int *p = 0; 938 *p = 0xDEADBEEF; 939} 940 941//===----------------------------------------------------------------------===// 942// Test handling of parameters that are structs that contain floats and // 943// nested fields. // 944//===----------------------------------------------------------------------===// 945 946struct s_rev95547_nested { float x, y; }; 947struct s_rev95547 { 948 struct s_rev95547_nested z1; 949 struct s_rev95547_nested z2; 950}; 951float foo_rev95547(struct s_rev95547 w) { 952 return w.z1.x + 20.0; // no-warning 953} 954void foo_rev95547_b(struct s_rev95547 w) { 955 struct s_rev95547 w2 = w; 956 w2.z1.x += 20.0; // no-warning 957} 958 959//===----------------------------------------------------------------------===// 960// Test handling statement expressions that don't populate a CFG block that 961// is used to represent the computation of the RHS of a logical operator. 962// This previously triggered a crash. 963//===----------------------------------------------------------------------===// 964 965void pr6938() { 966 if (1 && ({ 967 while (0); 968 0; 969 }) == 0) { 970 } 971} 972 973void pr6938_b() { 974 if (1 && *({ // expected-warning{{Dereference of null pointer}} 975 while (0) {} 976 ({ 977 (int *) 0; 978 }); 979 }) == 0) { 980 } 981} 982 983//===----------------------------------------------------------------------===// 984// <rdar://problem/7979430> - The CFG for code containing an empty 985// @synchronized block was previously broken (and would crash the analyzer). 986//===----------------------------------------------------------------------===// 987 988void r7979430(id x) { 989 @synchronized(x) {} 990} 991 992//===----------------------------------------------------------------------=== 993// PR 7361 - Test that functions wrapped in macro instantiations are analyzed. 994//===----------------------------------------------------------------------=== 995#define MAKE_TEST_FN() \ 996 void test_pr7361 (char a) {\ 997 char* b = 0x0; *b = a;\ 998 } 999 1000MAKE_TEST_FN() // expected-warning{{null pointer}} 1001 1002//===----------------------------------------------------------------------=== 1003// PR 7491 - Test that symbolic expressions can be used as conditions. 1004//===----------------------------------------------------------------------=== 1005 1006void pr7491 () { 1007 extern int getint(); 1008 int a = getint()-1; 1009 if (a) { 1010 return; 1011 } 1012 if (!a) { 1013 return; 1014 } else { 1015 // Should be unreachable 1016 (void)*(char*)0; // no-warning 1017 } 1018} 1019 1020//===----------------------------------------------------------------------=== 1021// PR 7475 - Test that assumptions about global variables are reset after 1022// calling a global function. 1023//===----------------------------------------------------------------------=== 1024 1025int *pr7475_someGlobal; 1026void pr7475_setUpGlobal(); 1027 1028void pr7475() { 1029 if (pr7475_someGlobal == 0) 1030 pr7475_setUpGlobal(); 1031 *pr7475_someGlobal = 0; // no-warning 1032} 1033 1034void pr7475_warn() { 1035 static int *someStatic = 0; 1036 if (someStatic == 0) 1037 pr7475_setUpGlobal(); 1038 *someStatic = 0; // expected-warning{{null pointer}} 1039} 1040 1041// <rdar://problem/8202272> - __imag passed non-complex should not crash 1042float f0(_Complex float x) { 1043 float l0 = __real x; 1044 return __real l0 + __imag l0; 1045} 1046 1047 1048//===----------------------------------------------------------------------=== 1049// Test that we can reduce symbols to constants whether they are on the left 1050// or right side of an expression. 1051//===----------------------------------------------------------------------=== 1052 1053void reduce_to_constant(int x, int y) { 1054 if (x != 20) 1055 return; 1056 1057 int a = x + y; 1058 int b = y + x; 1059 1060 if (y == -20 && a != 0) 1061 (void)*(char*)0; // no-warning 1062 if (y == -20 && b != 0) 1063 (void)*(char*)0; // no-warning 1064} 1065 1066// <rdar://problem/8360854> - Test that code after a switch statement with no 1067// 'case:' labels is correctly evaluated. 1068void r8360854(int n) { 1069 switch (n) { 1070 default: ; 1071 } 1072 int *p = 0; 1073 *p = 0xDEADBEEF; // expected-warning{{null pointer}} 1074} 1075 1076// PR 8050 - crash in CastSizeChecker when pointee is an incomplete type 1077typedef long unsigned int __darwin_size_t; 1078typedef __darwin_size_t size_t; 1079void *malloc(size_t); 1080 1081struct PR8050; 1082 1083void pr8050(struct PR8050 **arg) 1084{ 1085 *arg = malloc(1); 1086} 1087 1088// <rdar://problem/5880430> Switch on enum should not consider default case live 1089// if all enum values are covered 1090enum Cases { C1, C2, C3, C4 }; 1091void test_enum_cases(enum Cases C) { 1092 switch (C) { 1093 case C1: 1094 case C2: 1095 case C4: 1096 case C3: 1097 return; 1098 } 1099 int *p = 0; 1100 *p = 0xDEADBEEF; // no-warning 1101} 1102 1103void test_enum_cases_positive(enum Cases C) { 1104 switch (C) { // expected-warning{{enumeration value 'C4' not handled in switch}} 1105 case C1: 1106 case C2: 1107 case C3: 1108 return; 1109 } 1110 int *p = 0; 1111 *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} 1112} 1113 1114// <rdar://problem/6351970> rule request: warn if synchronization mutex can be nil 1115void rdar6351970() { 1116 id x = 0; 1117 @synchronized(x) {} // expected-warning{{Nil value used as mutex for @synchronized() (no synchronization will occur)}} 1118} 1119 1120void rdar6351970_b(id x) { 1121 if (!x) 1122 @synchronized(x) {} // expected-warning{{Nil value used as mutex for @synchronized() (no synchronization will occur)}} 1123} 1124 1125void rdar6351970_c() { 1126 id x; 1127 @synchronized(x) {} // expected-warning{{Uninitialized value used as mutex for @synchronized}} 1128} 1129 1130@interface Rdar8578650 1131- (id) foo8578650; 1132@end 1133 1134void rdar8578650(id x) { 1135 @synchronized (x) { 1136 [x foo8578650]; 1137 } 1138 // At this point we should assume that 'x' is not nil, not 1139 // the inverse. 1140 @synchronized (x) { // no-warning 1141 } 1142} 1143 1144// <rdar://problem/6352035> rule request: direct structure member access null pointer dereference 1145@interface RDar6352035 { 1146 int c; 1147} 1148- (void)foo; 1149- (void)bar; 1150@end 1151 1152@implementation RDar6352035 1153- (void)foo { 1154 RDar6352035 *friend = 0; 1155 friend->c = 7; // expected-warning{{Instance variable access (via 'friend') results in a null pointer dereference}} 1156} 1157- (void)bar { 1158 self = 0; 1159 c = 7; // expected-warning{{Instance variable access (via 'self') results in a null pointer dereference}} 1160} 1161@end 1162 1163// PR 8149 - GNU statement expression in condition of ForStmt. 1164// This previously triggered an assertion failure in CFGBuilder. 1165void pr8149(void) { 1166 for (; ({ do { } while (0); 0; });) { } 1167} 1168 1169// PR 8458 - Make sure @synchronized doesn't crash with properties. 1170@interface PR8458 {} 1171@property(readonly) id lock; 1172@end 1173 1174static 1175void __PR8458(PR8458 *x) { 1176 @synchronized(x.lock) {} // no-warning 1177} 1178 1179// PR 8440 - False null dereference during store to array-in-field-in-global. 1180// This test case previously resulted in a bogus null deref warning from 1181// incorrect lazy symbolication logic in RegionStore. 1182static struct { 1183 int num; 1184 char **data; 1185} saved_pr8440; 1186 1187char *foo_pr8440(); 1188char **bar_pr8440(); 1189void baz_pr8440(int n) 1190{ 1191 saved_pr8440.num = n; 1192 if (saved_pr8440.data) 1193 return; 1194 saved_pr8440.data = bar_pr8440(); 1195 for (int i = 0 ; i < n ; i ++) 1196 saved_pr8440.data[i] = foo_pr8440(); // no-warning 1197} 1198 1199// Support direct accesses to non-null memory. Reported in: 1200// PR 5272 1201// <rdar://problem/6839683> 1202int test_direct_address_load() { 1203 int *p = (int*) 0x4000; 1204 return *p; // no-warning 1205} 1206 1207void pr5272_test() { 1208 struct pr5272 { int var2; }; 1209 (*(struct pr5272*)0xBC000000).var2 = 0; // no-warning 1210 (*(struct pr5272*)0xBC000000).var2 += 2; // no-warning 1211} 1212 1213// Support casting the return value of function to another different type 1214// This previously caused a crash, although we likely need more precise 1215// reasoning here. <rdar://problem/8663544> 1216void* rdar8663544(); 1217typedef struct {} Val8663544; 1218Val8663544 bazR8663544() { 1219 Val8663544(*func) () = (Val8663544(*) ()) rdar8663544; 1220 return func(); 1221} 1222 1223// PR 8619 - Handle ternary expressions with a call to a noreturn function. 1224// This previously resulted in a crash. 1225void pr8619_noreturn(int x) __attribute__((noreturn)); 1226 1227void pr8619(int a, int b, int c) { 1228 a ?: pr8619_noreturn(b || c); 1229} 1230 1231 1232// PR 8646 - crash in the analyzer when handling unions. 1233union pr8648_union { 1234 signed long long pr8648_union_field; 1235}; 1236void pr8648() { 1237 long long y; 1238 union pr8648_union x = { .pr8648_union_field = 0LL }; 1239 y = x.pr8648_union_field; 1240 1241 union pr8648_union z; 1242 z = (union pr8648_union) { .pr8648_union_field = 0LL }; 1243 1244 union pr8648_union w; 1245 w = ({ (union pr8648_union) { .pr8648_union_field = 0LL }; }); 1246 1247 // crash, no assignment 1248 (void) ({ (union pr8648_union) { .pr8648_union_field = 0LL }; }).pr8648_union_field; 1249 1250 // crash with assignment 1251 y = ({ (union pr8648_union) { .pr8648_union_field = 0LL }; }).pr8648_union_field; 1252} 1253 1254// PR 9269 - don't assert when building the following CFG. The for statement 1255// contains a condition with multiple basic blocks, and the value of the 1256// statement expression is then indexed as part of a bigger condition expression. 1257// This example exposed a bug in child traversal in the CFGBuilder. 1258void pr9269() { 1259 struct s { char *bar[10]; } baz[2] = { 0 }; 1260 unsigned i = 0; 1261 for (i = 0; 1262 (* ({ while(0); ({ &baz[0]; }); })).bar[0] != 0; // expected-warning {{while loop has empty body}} expected-note {{put the semicolon on a separate line to silence this warning}} 1263 ++i) {} 1264} 1265 1266// Test evaluation of GNU-style ?:. 1267int pr9287(int type) { return type ? : 0; } // no-warning 1268 1269void pr9287_b(int type, int *p) { 1270 int x = type ? : 0; 1271 if (x) { 1272 p = 0; 1273 } 1274 if (type) { 1275 *p = 0xDEADBEEF; // expected-warning {{null pointer}} 1276 } 1277} 1278 1279void pr9287_c(int type, int *p) { 1280 int x = type ? : 0; 1281 if (x) { 1282 p = 0; 1283 } 1284 if (!type) { 1285 *p = 0xDEADBEEF; // no-warning 1286 } 1287} 1288 1289void test_switch() { 1290 switch (4) { 1291 case 1: { 1292 int *p = 0; 1293 *p = 0xDEADBEEF; // no-warning 1294 break; 1295 } 1296 case 4: { 1297 int *p = 0; 1298 *p = 0xDEADBEEF; // expected-warning {{null}} 1299 break; 1300 } 1301 default: { 1302 int *p = 0; 1303 *p = 0xDEADBEEF; // no-warning 1304 break; 1305 } 1306 } 1307} 1308 1309// PR 9467. Tests various CFG optimizations. This previously crashed. 1310static void test(unsigned int bit_mask) 1311{ 1312 unsigned int bit_index; 1313 for (bit_index = 0; 1314 bit_index < 24; 1315 bit_index++) { 1316 switch ((0x01 << bit_index) & bit_mask) { 1317 case 0x100000: ; 1318 } 1319 } 1320} 1321 1322// Don't crash on code containing __label__. 1323int radar9414427_aux(); 1324void radar9414427() { 1325 __label__ mylabel; 1326 if (radar9414427_aux()) { 1327 mylabel: do {} 1328 while (0); 1329 } 1330} 1331 1332// Analyze methods in @implementation (category) 1333@interface RDar9465344 1334@end 1335 1336@implementation RDar9465344 (MyCategory) 1337- (void) testcategoryImpl { 1338 int *p = 0x0; 1339 *p = 0xDEADBEEF; // expected-warning {{null}} 1340} 1341@end 1342 1343@implementation RDar9465344 1344@end 1345 1346// Don't crash when analyzing access to 'self' within a block. 1347@interface Rdar10380300Base 1348- (void) foo; 1349@end 1350@interface Rdar10380300 : Rdar10380300Base @end 1351@implementation Rdar10380300 1352- (void)foo { 1353 ^{ 1354 [super foo]; 1355 }(); 1356} 1357@end 1358 1359// Don't crash when a ?: is only preceded by a statement (not an expression) 1360// in the CFG. 1361void __assert_fail(); 1362 1363enum rdar1196620_e { E_A, E_B, E_C, E_D }; 1364struct rdar1196620_s { int ints[E_D+1]; }; 1365 1366static int rdar1196620_call_assert(struct rdar1196620_s* s) { 1367 int i = 0; 1368 s?(void)0:__assert_fail(); 1369} 1370 1371static void rdar1196620(struct rdar1196620_s* s) { 1372 if (rdar1196620_call_assert(s)) 1373 return; 1374} 1375 1376 1377