misc-ps.m revision b44b96668653e2b19c33712edf73330e2904cd20
1// NOTE: Use '-fobjc-gc' to test the analysis being run twice, and multiple reports are not issued. 2// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync -analyzer-store=region -analyzer-constraints=basic -verify -fblocks -Wno-unreachable-code -Wno-null-dereference %s 3// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync -analyzer-store=region -analyzer-constraints=range -verify -fblocks -Wno-unreachable-code -Wno-null-dereference %s 4// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-checker=core,deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync -analyzer-store=region -analyzer-constraints=basic -verify -fblocks -Wno-unreachable-code -Wno-null-dereference %s 5// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-checker=core,deadcode.IdempotentOperations,experimental.core,osx.cocoa.AtSync -analyzer-store=region -analyzer-constraints=range -verify -fblocks -Wno-unreachable-code -Wno-null-dereference %s 6 7#ifndef __clang_analyzer__ 8#error __clang_analyzer__ not defined 9#endif 10 11typedef struct objc_ivar *Ivar; 12typedef struct objc_selector *SEL; 13typedef signed char BOOL; 14typedef int NSInteger; 15typedef unsigned int NSUInteger; 16typedef struct _NSZone NSZone; 17@class NSInvocation, NSArray, NSMethodSignature, NSCoder, NSString, NSEnumerator; 18@protocol NSObject 19- (BOOL)isEqual:(id)object; 20- (id)autorelease; 21@end 22@protocol NSCopying 23- (id)copyWithZone:(NSZone *)zone; 24@end 25@protocol NSMutableCopying - (id)mutableCopyWithZone:(NSZone *)zone; @end 26@protocol NSCoding 27- (void)encodeWithCoder:(NSCoder *)aCoder; 28@end 29@interface NSObject <NSObject> {} 30- (id)init; 31+ (id)allocWithZone:(NSZone *)zone; 32@end 33extern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone); 34@interface NSString : NSObject <NSCopying, NSMutableCopying, NSCoding> 35- (NSUInteger)length; 36+ (id)stringWithUTF8String:(const char *)nullTerminatedCString; 37@end extern NSString * const NSBundleDidLoadNotification; 38@interface NSValue : NSObject <NSCopying, NSCoding> 39- (void)getValue:(void *)value; 40@end 41@interface NSNumber : NSValue 42- (char)charValue; 43- (id)initWithBool:(BOOL)value; 44@end 45@interface NSAssertionHandler : NSObject {} 46+ (NSAssertionHandler *)currentHandler; 47- (void)handleFailureInMethod:(SEL)selector object:(id)object file:(NSString *)fileName lineNumber:(NSInteger)line description:(NSString *)format,...; 48@end 49extern NSString * const NSConnectionReplyMode; 50typedef float CGFloat; 51typedef struct _NSPoint { 52 CGFloat x; 53 CGFloat y; 54} NSPoint; 55typedef struct _NSSize { 56 CGFloat width; 57 CGFloat height; 58} NSSize; 59typedef struct _NSRect { 60 NSPoint origin; 61 NSSize size; 62} NSRect; 63 64// Reduced test case from crash in <rdar://problem/6253157> 65@interface A @end 66@implementation A 67- (void)foo:(void (^)(NSObject *x))block { 68 if (!((block != ((void *)0)))) {} 69} 70@end 71 72// Reduced test case from crash in PR 2796; 73// http://llvm.org/bugs/show_bug.cgi?id=2796 74 75unsigned foo(unsigned x) { return __alignof__((x)) + sizeof(x); } 76 77// Improvement to path-sensitivity involving compound assignments. 78// Addresses false positive in <rdar://problem/6268365> 79// 80 81unsigned r6268365Aux(); 82 83void r6268365() { 84 unsigned x = 0; 85 x &= r6268365Aux(); // expected-warning{{The left operand to '&=' is always 0}} 86 unsigned j = 0; 87 88 if (x == 0) ++j; 89 if (x == 0) x = x / j; // expected-warning{{Assigned value is always the same as the existing value}} expected-warning{{The right operand to '/' is always 1}} 90} 91 92void divzeroassume(unsigned x, unsigned j) { 93 x /= j; 94 if (j == 0) x /= 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 95 if (j == 0) x /= j; // no static-analyzer warning 96 if (j == 0) x = x / 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 97} 98 99void divzeroassumeB(unsigned x, unsigned j) { 100 x = x / j; 101 if (j == 0) x /= 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 102 if (j == 0) x /= j; // no static-analyzer warning 103 if (j == 0) x = x / 0; // no static-analyzer warning expected-warning {{division by zero is undefined}} 104} 105 106// InitListExpr processing 107 108typedef float __m128 __attribute__((__vector_size__(16), __may_alias__)); 109__m128 return128() { 110 // This compound literal has a Vector type. We currently just 111 // return UnknownVal. 112 return __extension__(__m128) { 0.0f, 0.0f, 0.0f, 0.0f }; 113} 114 115typedef long long __v2di __attribute__ ((__vector_size__ (16))); 116typedef long long __m128i __attribute__ ((__vector_size__ (16), __may_alias__)); 117__m128i vec128i(long long __q1, long long __q0) { 118 // This compound literal returns true for both isVectorType() and 119 // isIntegerType(). 120 return __extension__ (__m128i)(__v2di){ __q0, __q1 }; 121} 122 123// Zero-sized VLAs. 124void check_zero_sized_VLA(int x) { 125 if (x) 126 return; 127 128 int vla[x]; // expected-warning{{Declared variable-length array (VLA) has zero size}} 129} 130 131void check_uninit_sized_VLA() { 132 int x; 133 int vla[x]; // expected-warning{{Declared variable-length array (VLA) uses a garbage value as its size}} 134} 135 136// sizeof(void) 137// - Tests a regression reported in PR 3211: http://llvm.org/bugs/show_bug.cgi?id=3211 138void handle_sizeof_void(unsigned flag) { 139 int* p = 0; 140 141 if (flag) { 142 if (sizeof(void) == 1) 143 return; 144 // Infeasible. 145 *p = 1; // no-warning 146 } 147 148 void* q; 149 150 if (!flag) { 151 if (sizeof(*q) == 1) 152 return; 153 // Infeasibe. 154 *p = 1; // no-warning 155 } 156 157 // Infeasible. 158 *p = 1; // no-warning 159} 160 161// check deference of undefined values 162void check_deref_undef(void) { 163 int *p; 164 *p = 0xDEADBEEF; // expected-warning{{Dereference of undefined pointer value}} 165} 166 167// PR 3422 168void pr3422_helper(char *p); 169void pr3422() { 170 char buf[100]; 171 char *q = &buf[10]; 172 pr3422_helper(&q[1]); 173} 174 175// PR 3543 (handle empty statement expressions) 176void pr_3543(void) { 177 ({}); 178} 179 180// <rdar://problem/6611677> 181// This test case test the use of a vector type within an array subscript 182// expression. 183typedef long long __a64vector __attribute__((__vector_size__(8))); 184typedef long long __a128vector __attribute__((__vector_size__(16))); 185static inline __a64vector __attribute__((__always_inline__, __nodebug__)) 186my_test_mm_movepi64_pi64(__a128vector a) { 187 return (__a64vector)a[0]; 188} 189 190// Test basic tracking of ivars associated with 'self'. 191@interface SelfIvarTest : NSObject { 192 int flag; 193} 194- (void)test_self_tracking; 195@end 196 197@implementation SelfIvarTest 198- (void)test_self_tracking { 199 char *p = 0; 200 char c; 201 202 if (flag) 203 p = "hello"; 204 205 if (flag) 206 c = *p; // no-warning 207} 208@end 209 210// PR 3770 211char pr3770(int x) { 212 int y = x & 0x2; 213 char *p = 0; 214 if (y == 1) 215 p = "hello"; 216 217 if (y == 1) 218 return p[0]; // no-warning 219 220 return 'a'; 221} 222 223// PR 3772 224// - We just want to test that this doesn't crash the analyzer. 225typedef struct st ST; 226struct st { char *name; }; 227extern ST *Cur_Pu; 228 229void pr3772(void) 230{ 231 static ST *last_Cur_Pu; 232 if (last_Cur_Pu == Cur_Pu) { 233 return; 234 } 235} 236 237// PR 3780 - This tests that StmtIterator isn't broken for VLAs in DeclGroups. 238void pr3780(int sz) { typedef double MAT[sz][sz]; } 239 240// <rdar://problem/6695527> - Test that we don't symbolicate doubles before 241// we are ready to do something with them. 242int rdar6695527(double x) { 243 if (!x) { return 0; } 244 return 1; 245} 246 247// <rdar://problem/6708148> - Test that we properly invalidate structs 248// passed-by-reference to a function. 249void pr6708148_invalidate(NSRect *x); 250void pr6708148_use(NSRect x); 251void pr6708148_test(void) { 252 NSRect x; 253 pr6708148_invalidate(&x); 254 pr6708148_use(x); // no-warning 255} 256 257// Handle both kinds of noreturn attributes for pruning paths. 258void rdar_6777003_noret() __attribute__((noreturn)); 259void rdar_6777003_analyzer_noret() __attribute__((analyzer_noreturn)); 260 261void rdar_6777003(int x) { 262 int *p = 0; 263 264 if (x == 1) { 265 rdar_6777003_noret(); 266 *p = 1; // no-warning; 267 } 268 269 if (x == 2) { 270 rdar_6777003_analyzer_noret(); 271 *p = 1; // no-warning; 272 } 273 274 *p = 1; // expected-warning{{Dereference of null pointer}} 275} 276 277// For pointer arithmetic, --/++ should be treated as preserving non-nullness, 278// regardless of how well the underlying StoreManager reasons about pointer 279// arithmetic. 280// <rdar://problem/6777209> 281void rdar_6777209(char *p) { 282 if (p == 0) 283 return; 284 285 ++p; 286 287 // This branch should always be infeasible. 288 if (p == 0) 289 *p = 'c'; // no-warning 290} 291 292// PR 4033. A symbolic 'void *' pointer can be used as the address for a 293// computed goto. 294typedef void *Opcode; 295Opcode pr_4033_getOpcode(); 296void pr_4033(void) { 297 void *lbl = &&next_opcode; 298next_opcode: 299 { 300 Opcode op = pr_4033_getOpcode(); 301 if (op) goto *op; 302 } 303} 304 305// Test invalidating pointers-to-pointers with slightly different types. This 306// example came from a recent false positive due to a regression where the 307// branch condition was falsely reported as being uninitialized. 308void invalidate_by_ref(char **x); 309int test_invalidate_by_ref() { 310 unsigned short y; 311 invalidate_by_ref((char**) &y); 312 if (y) // no-warning 313 return 1; 314 return 0; 315} 316 317// Test for <rdar://problem/7027684>. This just tests that the CFG is 318// constructed correctly. Previously, the successor block of the entrance 319// was the block containing the merge for '?', which would trigger an 320// assertion failure. 321int rdar_7027684_aux(); 322int rdar_7027684_aux_2() __attribute__((noreturn)); 323void rdar_7027684(int x, int y) { 324 {}; // this empty compound statement is critical. 325 (rdar_7027684_aux() ? rdar_7027684_aux_2() : (void) 0); 326} 327 328// Test that we handle casts of string literals to arbitrary types. 329unsigned const char *string_literal_test1() { 330 return (const unsigned char*) "hello"; 331} 332 333const float *string_literal_test2() { 334 return (const float*) "hello"; 335} 336 337// Test that we handle casts *from* incomplete struct types. 338extern const struct _FooAssertStruct _cmd; 339void test_cast_from_incomplete_struct_aux(volatile const void *x); 340void test_cast_from_incomplete_struct() { 341 test_cast_from_incomplete_struct_aux(&_cmd); 342} 343 344// Test for <rdar://problem/7034511> 345// "ValueManager::makeIntVal(uint64_t X, QualType T) should return a 'Loc' 346// when 'T' is a pointer" 347// 348// Previously this case would crash. 349void test_rdar_7034511(NSArray *y) { 350 NSObject *x; 351 for (x in y) {} 352 if (x == ((void*) 0)) {} 353} 354 355// Handle casts of function pointers (CodeTextRegions) to arbitrary pointer 356// types. This was previously causing a crash in CastRegion. 357void handle_funcptr_voidptr_casts() { 358 void **ptr; 359 typedef void *PVOID; 360 typedef void *PCHAR; 361 typedef long INT_PTR, *PINT_PTR; 362 typedef INT_PTR (*FARPROC)(); 363 FARPROC handle_funcptr_voidptr_casts_aux(); 364 PVOID handle_funcptr_voidptr_casts_aux_2(PVOID volatile *x); 365 PVOID handle_funcptr_voidptr_casts_aux_3(PCHAR volatile *x); 366 367 ptr = (void**) handle_funcptr_voidptr_casts_aux(); 368 handle_funcptr_voidptr_casts_aux_2(ptr); 369 handle_funcptr_voidptr_casts_aux_3(ptr); 370} 371 372// RegionStore::Retrieve previously crashed on this example. This example 373// was previously in the test file 'xfail_regionstore_wine_crash.c'. 374void testA() { 375 long x = 0; 376 char *y = (char *) &x; 377 if (!*y) 378 return; 379} 380 381// RegionStoreManager previously crashed on this example. The problem is that 382// the value bound to the field of b->grue after the call to testB_aux is 383// a symbolic region. The second '*__gruep__' involves performing a load 384// from a 'int*' that really is a 'void**'. The loaded location must be 385// implicitly converted to an integer that wraps a location. Previosly we would 386// get a crash here due to an assertion failure. 387typedef struct _BStruct { void *grue; } BStruct; 388void testB_aux(void *ptr); 389void testB(BStruct *b) { 390 { 391 int *__gruep__ = ((int *)&((b)->grue)); 392 int __gruev__ = *__gruep__; 393 testB_aux(__gruep__); 394 } 395 { 396 int *__gruep__ = ((int *)&((b)->grue)); 397 int __gruev__ = *__gruep__; 398 if (~0 != __gruev__) {} 399 } 400} 401 402void test_trivial_symbolic_comparison(int *x) { 403 int test_trivial_symbolic_comparison_aux(); 404 int a = test_trivial_symbolic_comparison_aux(); 405 int b = a; 406 if (a != b) { // expected-warning{{Both operands to '!=' always have the same value}} 407 int *p = 0; 408 *p = 0xDEADBEEF; // no-warning 409 } 410 411 a = a == 1; 412 b = b == 1; 413 if (a != b) { // expected-warning{{Both operands to '!=' always have the same value}} 414 int *p = 0; 415 *p = 0xDEADBEEF; // no-warning 416 } 417} 418 419// Test for: 420// <rdar://problem/7062158> false positive null dereference due to 421// BasicStoreManager not tracking *static* globals 422// 423// This just tests the proper tracking of symbolic values for globals (both 424// static and non-static). 425// 426static int* x_rdar_7062158; 427void rdar_7062158() { 428 int *current = x_rdar_7062158; 429 if (current == x_rdar_7062158) 430 return; 431 432 int *p = 0; 433 *p = 0xDEADBEEF; // no-warning 434} 435 436int* x_rdar_7062158_2; 437void rdar_7062158_2() { 438 int *current = x_rdar_7062158_2; 439 if (current == x_rdar_7062158_2) 440 return; 441 442 int *p = 0; 443 *p = 0xDEADBEEF; // no-warning 444} 445 446// This test reproduces a case for a crash when analyzing ClamAV using 447// RegionStoreManager (the crash doesn't exhibit in BasicStoreManager because 448// it isn't doing anything smart about arrays). The problem is that on the 449// second line, 'p = &p[i]', p is assigned an ElementRegion whose index 450// is a 16-bit integer. On the third line, a new ElementRegion is created 451// based on the previous region, but there the region uses a 32-bit integer, 452// resulting in a clash of values (an assertion failure at best). We resolve 453// this problem by implicitly converting index values to 'int' when the 454// ElementRegion is created. 455unsigned char test_array_index_bitwidth(const unsigned char *p) { 456 unsigned short i = 0; 457 for (i = 0; i < 2; i++) p = &p[i]; 458 return p[i+1]; 459} 460 461// This case tests that CastRegion handles casts involving BlockPointerTypes. 462// It should not crash. 463void test_block_cast() { 464 id test_block_cast_aux(); 465 (void (^)(void *))test_block_cast_aux(); // expected-warning{{expression result unused}} 466} 467 468int OSAtomicCompareAndSwap32Barrier(); 469 470// Test comparison of 'id' instance variable to a null void* constant after 471// performing an OSAtomicCompareAndSwap32Barrier. 472// This previously was a crash in RegionStoreManager. 473@interface TestIdNull { 474 id x; 475} 476-(int)foo; 477@end 478@implementation TestIdNull 479-(int)foo { 480 OSAtomicCompareAndSwap32Barrier(0, (signed)2, (signed*)&x); 481 if (x == (void*) 0) { return 0; } 482 return 1; 483} 484@end 485 486// PR 4594 - This was a crash when handling casts in SimpleSValuator. 487void PR4594() { 488 char *buf[1]; 489 char **foo = buf; 490 *foo = "test"; 491} 492 493// Test invalidation logic where an integer is casted to an array with a 494// different sign and then invalidated. 495void test_invalidate_cast_int() { 496 void test_invalidate_cast_int_aux(unsigned *i); 497 signed i; 498 test_invalidate_cast_int_aux((unsigned*) &i); 499 if (i < 0) 500 return; 501} 502 503int ivar_getOffset(); 504 505// Reduced from a crash involving the cast of an Objective-C symbolic region to 506// 'char *' 507static NSNumber *test_ivar_offset(id self, SEL _cmd, Ivar inIvar) { 508 return [[[NSNumber allocWithZone:((void*)0)] initWithBool:*(_Bool *)((char *)self + ivar_getOffset(inIvar))] autorelease]; 509} 510 511// Reduced from a crash in StoreManager::CastRegion involving a divide-by-zero. 512// This resulted from not properly handling region casts to 'const void*'. 513void test_cast_const_voidptr() { 514 char x[10]; 515 char *p = &x[1]; 516 const void* q = p; 517} 518 519// Reduced from a crash when analyzing Wine. This test handles loads from 520// function addresses. 521typedef long (*FARPROC)(); 522FARPROC test_load_func(FARPROC origfun) { 523 if (!*(unsigned char*) origfun) 524 return origfun; 525 return 0; 526} 527 528// Test passing-by-value an initialized struct variable. 529struct test_pass_val { 530 int x; 531 int y; 532}; 533void test_pass_val_aux(struct test_pass_val s); 534void test_pass_val() { 535 struct test_pass_val s; 536 s.x = 1; 537 s.y = 2; 538 test_pass_val_aux(s); 539} 540 541// This is a reduced test case of a false positive that previously appeared 542// in RegionStoreManager. Previously the array access resulted in dereferencing 543// an undefined value. 544int test_array_compound(int *q, int *r, int *z) { 545 int *array[] = { q, r, z }; 546 int j = 0; 547 for (unsigned i = 0; i < 3 ; ++i) 548 if (*array[i]) ++j; // no-warning 549 return j; 550} 551 552// symbolic value stored in 'x' wouldn't be implicitly casted to a signed value 553// during the comparison. 554int rdar_7124210(unsigned int x) { 555 enum { SOME_CONSTANT = 123 }; 556 int compare = ((signed) SOME_CONSTANT) == *((signed *) &x); 557 return compare ? 0 : 1; // Forces the evaluation of the symbolic constraint. 558} 559 560void pr4781(unsigned long *raw1) { 561 unsigned long *cook, *raw0; 562 unsigned long dough[32]; 563 int i; 564 cook = dough; 565 for( i = 0; i < 16; i++, raw1++ ) { 566 raw0 = raw1++; 567 *cook = (*raw0 & 0x00fc0000L) << 6; 568 *cook |= (*raw0 & 0x00000fc0L) << 10; 569 } 570} 571 572// <rdar://problem/7185647> - 'self' should be treated as being non-null 573// upon entry to an objective-c method. 574@interface RDar7185647 575- (id)foo; 576@end 577@implementation RDar7185647 578- (id) foo { 579 if (self) 580 return self; 581 *((volatile int *) 0x0) = 0xDEADBEEF; // no-warning 582 return self; 583} 584@end 585 586// Test reasoning of __builtin_offsetof; 587struct test_offsetof_A { 588 int x; 589 int y; 590}; 591struct test_offsetof_B { 592 int w; 593 int z; 594}; 595void test_offsetof_1() { 596 if (__builtin_offsetof(struct test_offsetof_A, x) == 597 __builtin_offsetof(struct test_offsetof_B, w)) 598 return; 599 int *p = 0; 600 *p = 0xDEADBEEF; // no-warning 601} 602void test_offsetof_2() { 603 if (__builtin_offsetof(struct test_offsetof_A, y) == 604 __builtin_offsetof(struct test_offsetof_B, z)) 605 return; 606 int *p = 0; 607 *p = 0xDEADBEEF; // no-warning 608} 609void test_offsetof_3() { 610 if (__builtin_offsetof(struct test_offsetof_A, y) - 611 __builtin_offsetof(struct test_offsetof_A, x) 612 == 613 __builtin_offsetof(struct test_offsetof_B, z) - 614 __builtin_offsetof(struct test_offsetof_B, w)) 615 return; 616 int *p = 0; 617 *p = 0xDEADBEEF; // no-warning 618} 619void test_offsetof_4() { 620 if (__builtin_offsetof(struct test_offsetof_A, y) == 621 __builtin_offsetof(struct test_offsetof_B, w)) 622 return; 623 int *p = 0; 624 *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} 625} 626 627// <rdar://problem/6829164> "nil receiver" false positive: make tracking 628// of the MemRegion for 'self' path-sensitive 629@interface RDar6829164 : NSObject { 630 double x; int y; 631} 632- (id) init; 633@end 634 635id rdar_6829164_1(); 636double rdar_6829164_2(); 637 638@implementation RDar6829164 639- (id) init { 640 if((self = [super init]) != 0) { 641 id z = rdar_6829164_1(); 642 y = (z != 0); 643 if (y) 644 x = rdar_6829164_2(); 645 } 646 return self; 647} 648@end 649 650// <rdar://problem/7242015> - Invalidate values passed-by-reference 651// to functions when the pointer to the value is passed as an integer. 652void test_7242015_aux(unsigned long); 653int rdar_7242015() { 654 int x; 655 test_7242015_aux((unsigned long) &x); // no-warning 656 return x; // Previously we return and uninitialized value when 657 // using RegionStore. 658} 659 660// <rdar://problem/7242006> [RegionStore] compound literal assignment with 661// floats not honored 662CGFloat rdar7242006(CGFloat x) { 663 NSSize y = (NSSize){x, 10}; 664 return y.width; // no-warning 665} 666 667// PR 4988 - This test exhibits a case where a function can be referenced 668// when not explicitly used in an "lvalue" context (as far as the analyzer is 669// concerned). This previously triggered a crash due to an invalid assertion. 670void pr_4988(void) { 671 pr_4988; // expected-warning{{expression result unused}} 672} 673 674// <rdar://problem/7152418> - A 'signed char' is used as a flag, which is 675// implicitly converted to an int. 676void *rdar7152418_bar(); 677@interface RDar7152418 { 678 signed char x; 679} 680-(char)foo; 681@end; 682@implementation RDar7152418 683-(char)foo { 684 char *p = 0; 685 void *result = 0; 686 if (x) { 687 result = rdar7152418_bar(); 688 p = "hello"; 689 } 690 if (!result) { 691 result = rdar7152418_bar(); 692 if (result && x) 693 return *p; // no-warning 694 } 695 return 1; 696} 697 698//===----------------------------------------------------------------------===// 699// Test constant-folding of symbolic values, automatically handling type 700// conversions of the symbol as necessary. 701//===----------------------------------------------------------------------===// 702 703// Previously this would crash once we started eagerly evaluating symbols whose 704// values were constrained to a single value. 705void test_symbol_fold_1(signed char x) { 706 while (1) { 707 if (x == ((signed char) 0)) {} 708 } 709} 710 711// This previously caused a crash because it triggered an assertion in APSInt. 712void test_symbol_fold_2(unsigned int * p, unsigned int n, 713 const unsigned int * grumpkin, unsigned int dn) { 714 unsigned int i; 715 unsigned int tempsub[8]; 716 unsigned int *solgrumpkin = tempsub + n; 717 for (i = 0; i < n; i++) 718 solgrumpkin[i] = (i < dn) ? ~grumpkin[i] : 0xFFFFFFFF; 719 for (i <<= 5; i < (n << 5); i++) {} 720} 721 722// This previously caused a crash because it triggered an assertion in APSInt. 723// 'x' would evaluate to a 8-bit constant (because of the return value of 724// test_symbol_fold_3_aux()) which would not get properly promoted to an 725// integer. 726char test_symbol_fold_3_aux(void); 727unsigned test_symbol_fold_3(void) { 728 unsigned x = test_symbol_fold_3_aux(); 729 if (x == 54) 730 return (x << 8) | 0x5; 731 return 0; 732} 733 734//===----------------------------------------------------------------------===// 735// Tests for the warning of casting a non-struct type to a struct type 736//===----------------------------------------------------------------------===// 737 738typedef struct {unsigned int v;} NSSwappedFloat; 739 740NSSwappedFloat test_cast_nonstruct_to_struct(float x) { 741 struct hodor { 742 float number; 743 NSSwappedFloat sf; 744 }; 745 return ((struct hodor *)&x)->sf; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}} 746} 747 748NSSwappedFloat test_cast_nonstruct_to_union(float x) { 749 union bran { 750 float number; 751 NSSwappedFloat sf; 752 }; 753 return ((union bran *)&x)->sf; // no-warning 754} 755 756void test_undefined_array_subscript() { 757 int i, a[10]; 758 int *p = &a[i]; // expected-warning{{Array subscript is undefined}} 759} 760@end 761 762//===----------------------------------------------------------------------===// 763// Test using an uninitialized value as a branch condition. 764//===----------------------------------------------------------------------===// 765 766int test_uninit_branch(void) { 767 int x; 768 if (x) // expected-warning{{Branch condition evaluates to a garbage value}} 769 return 1; 770 return 0; 771} 772 773int test_uninit_branch_b(void) { 774 int x; 775 return x ? 1 : 0; // expected-warning{{Branch condition evaluates to a garbage value}} 776} 777 778int test_uninit_branch_c(void) { 779 int x; 780 if ((short)x) // expected-warning{{Branch condition evaluates to a garbage value}} 781 return 1; 782 return 0; 783} 784 785//===----------------------------------------------------------------------===// 786// Test passing an undefined value in a message or function call. 787//===----------------------------------------------------------------------===// 788 789void test_bad_call_aux(int x); 790void test_bad_call(void) { 791 int y; 792 test_bad_call_aux(y); // expected-warning{{Function call argument is an uninitialized value}} 793} 794 795@interface TestBadArg {} 796- (void) testBadArg:(int) x; 797@end 798 799void test_bad_msg(TestBadArg *p) { 800 int y; 801 [p testBadArg:y]; // expected-warning{{Argument in message expression is an uninitialized value}} 802} 803 804//===----------------------------------------------------------------------===// 805// PR 6033 - Test emitting the correct output in a warning where we use '%' 806// with operands that are undefined. 807//===----------------------------------------------------------------------===// 808 809int pr6033(int x) { 810 int y; 811 return x % y; // expected-warning{{The right operand of '%' is a garbage value}} 812} 813 814struct trie { 815 struct trie* next; 816}; 817 818struct kwset { 819 struct trie *trie; 820 unsigned char y[10]; 821 struct trie* next[10]; 822 int d; 823}; 824 825typedef struct trie trie_t; 826typedef struct kwset kwset_t; 827 828void f(kwset_t *kws, char const *p, char const *q) { 829 struct trie const *trie; 830 struct trie * const *next = kws->next; 831 register unsigned char c; 832 register char const *end = p; 833 register char const *lim = q; 834 register int d = 1; 835 register unsigned char const *y = kws->y; 836 837 d = y[c = (end+=d)[-1]]; // no-warning 838 trie = next[c]; 839} 840 841//===----------------------------------------------------------------------===// 842// <rdar://problem/7593875> When handling sizeof(VLA) it leads to a hole in 843// the ExplodedGraph (causing a false positive) 844//===----------------------------------------------------------------------===// 845 846int rdar_7593875_aux(int x); 847int rdar_7593875(int n) { 848 int z[n > 10 ? 10 : n]; // VLA. 849 int v; 850 v = rdar_7593875_aux(sizeof(z)); 851 // Previously we got a false positive about 'v' being uninitialized. 852 return v; // no-warning 853} 854 855//===----------------------------------------------------------------------===// 856// Handle casts from symbolic regions (packaged as integers) to doubles. 857// Previously this caused an assertion failure. 858//===----------------------------------------------------------------------===// 859 860void *foo_rev95119(); 861void baz_rev95119(double x); 862void bar_rev95119() { 863 // foo_rev95119() returns a symbolic pointer. It is then 864 // cast to an int which is then cast to a double. 865 int value = (int) foo_rev95119(); 866 baz_rev95119((double)value); 867} 868 869//===----------------------------------------------------------------------===// 870// Handle loading a symbolic pointer from a symbolic region that was 871// invalidated by a call to an unknown function. 872//===----------------------------------------------------------------------===// 873 874void bar_rev95192(int **x); 875void foo_rev95192(int **x) { 876 *x = 0; 877 bar_rev95192(x); 878 // Not a null dereference. 879 **x = 1; // no-warning 880} 881 882//===----------------------------------------------------------------------===// 883// Handle casts of a function to a function pointer with a different return 884// value. We don't yet emit an error for such cases, but we now we at least 885// don't crash when the return value gets interpreted in a way that 886// violates our invariants. 887//===----------------------------------------------------------------------===// 888 889void *foo_rev95267(); 890int bar_rev95267() { 891 char (*Callback_rev95267)(void) = (char (*)(void)) foo_rev95267; 892 if ((*Callback_rev95267)() == (char) 0) 893 return 1; 894 return 0; 895} 896 897// Same as previous case, but handle casts to 'void'. 898int bar_rev95274() { 899 void (*Callback_rev95274)(void) = (void (*)(void)) foo_rev95267; 900 (*Callback_rev95274)(); 901 return 0; 902} 903 904void rdar7582031_test_static_init_zero() { 905 static unsigned x; 906 if (x == 0) 907 return; 908 int *p = 0; 909 *p = 0xDEADBEEF; 910} 911void rdar7582031_test_static_init_zero_b() { 912 static void* x; 913 if (x == 0) 914 return; 915 int *p = 0; 916 *p = 0xDEADBEEF; 917} 918 919//===----------------------------------------------------------------------===// 920// Test handling of parameters that are structs that contain floats and // 921// nested fields. // 922//===----------------------------------------------------------------------===// 923 924struct s_rev95547_nested { float x, y; }; 925struct s_rev95547 { 926 struct s_rev95547_nested z1; 927 struct s_rev95547_nested z2; 928}; 929float foo_rev95547(struct s_rev95547 w) { 930 return w.z1.x + 20.0; // no-warning 931} 932void foo_rev95547_b(struct s_rev95547 w) { 933 struct s_rev95547 w2 = w; 934 w2.z1.x += 20.0; // no-warning 935} 936 937//===----------------------------------------------------------------------===// 938// Test handling statement expressions that don't populate a CFG block that 939// is used to represent the computation of the RHS of a logical operator. 940// This previously triggered a crash. 941//===----------------------------------------------------------------------===// 942 943void pr6938() { 944 if (1 && ({ 945 while (0); 946 0; 947 }) == 0) { 948 } 949} 950 951void pr6938_b() { 952 if (1 && *({ // expected-warning{{Dereference of null pointer}} 953 while (0) {} 954 ({ 955 (int *) 0; 956 }); 957 }) == 0) { 958 } 959} 960 961//===----------------------------------------------------------------------===// 962// <rdar://problem/7979430> - The CFG for code containing an empty 963// @synchronized block was previously broken (and would crash the analyzer). 964//===----------------------------------------------------------------------===// 965 966void r7979430(id x) { 967 @synchronized(x) {} 968} 969 970//===----------------------------------------------------------------------=== 971// PR 7361 - Test that functions wrapped in macro instantiations are analyzed. 972//===----------------------------------------------------------------------=== 973#define MAKE_TEST_FN() \ 974 void test_pr7361 (char a) {\ 975 char* b = 0x0; *b = a;\ 976 } 977 978MAKE_TEST_FN() // expected-warning{{null pointer}} 979 980//===----------------------------------------------------------------------=== 981// PR 7491 - Test that symbolic expressions can be used as conditions. 982//===----------------------------------------------------------------------=== 983 984void pr7491 () { 985 extern int getint(); 986 int a = getint()-1; 987 if (a) { 988 return; 989 } 990 if (!a) { 991 return; 992 } else { 993 // Should be unreachable 994 (void)*(char*)0; // no-warning 995 } 996} 997 998//===----------------------------------------------------------------------=== 999// PR 7475 - Test that assumptions about global variables are reset after 1000// calling a global function. 1001//===----------------------------------------------------------------------=== 1002 1003int *pr7475_someGlobal; 1004void pr7475_setUpGlobal(); 1005 1006void pr7475() { 1007 if (pr7475_someGlobal == 0) 1008 pr7475_setUpGlobal(); 1009 *pr7475_someGlobal = 0; // no-warning 1010} 1011 1012void pr7475_warn() { 1013 static int *someStatic = 0; 1014 if (someStatic == 0) 1015 pr7475_setUpGlobal(); 1016 *someStatic = 0; // expected-warning{{null pointer}} 1017} 1018 1019// <rdar://problem/8202272> - __imag passed non-complex should not crash 1020float f0(_Complex float x) { 1021 float l0 = __real x; 1022 return __real l0 + __imag l0; 1023} 1024 1025 1026//===----------------------------------------------------------------------=== 1027// Test that we can reduce symbols to constants whether they are on the left 1028// or right side of an expression. 1029//===----------------------------------------------------------------------=== 1030 1031void reduce_to_constant(int x, int y) { 1032 if (x != 20) 1033 return; 1034 1035 int a = x + y; 1036 int b = y + x; 1037 1038 if (y == -20 && a != 0) 1039 (void)*(char*)0; // no-warning 1040 if (y == -20 && b != 0) 1041 (void)*(char*)0; // no-warning 1042} 1043 1044// <rdar://problem/8360854> - Test that code after a switch statement with no 1045// 'case:' labels is correctly evaluated. 1046void r8360854(int n) { 1047 switch (n) { 1048 default: ; 1049 } 1050 int *p = 0; 1051 *p = 0xDEADBEEF; // expected-warning{{null pointer}} 1052} 1053 1054// PR 8050 - crash in CastSizeChecker when pointee is an incomplete type 1055typedef long unsigned int __darwin_size_t; 1056typedef __darwin_size_t size_t; 1057void *malloc(size_t); 1058 1059struct PR8050; 1060 1061void pr8050(struct PR8050 **arg) 1062{ 1063 *arg = malloc(1); 1064} 1065 1066// <rdar://problem/5880430> Switch on enum should not consider default case live 1067// if all enum values are covered 1068enum Cases { C1, C2, C3, C4 }; 1069void test_enum_cases(enum Cases C) { 1070 switch (C) { 1071 case C1: 1072 case C2: 1073 case C4: 1074 case C3: 1075 return; 1076 } 1077 int *p = 0; 1078 *p = 0xDEADBEEF; // no-warning 1079} 1080 1081void test_enum_cases_positive(enum Cases C) { 1082 switch (C) { // expected-warning{{enumeration value 'C4' not handled in switch}} 1083 case C1: 1084 case C2: 1085 case C3: 1086 return; 1087 } 1088 int *p = 0; 1089 *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}} 1090} 1091 1092// <rdar://problem/6351970> rule request: warn if synchronization mutex can be nil 1093void rdar6351970() { 1094 id x = 0; 1095 @synchronized(x) {} // expected-warning{{Nil value used as mutex for @synchronized() (no synchronization will occur)}} 1096} 1097 1098void rdar6351970_b(id x) { 1099 if (!x) 1100 @synchronized(x) {} // expected-warning{{Nil value used as mutex for @synchronized() (no synchronization will occur)}} 1101} 1102 1103void rdar6351970_c() { 1104 id x; 1105 @synchronized(x) {} // expected-warning{{Uninitialized value used as mutex for @synchronized}} 1106} 1107 1108@interface Rdar8578650 1109- (id) foo8578650; 1110@end 1111 1112void rdar8578650(id x) { 1113 @synchronized (x) { 1114 [x foo8578650]; 1115 } 1116 // At this point we should assume that 'x' is not nil, not 1117 // the inverse. 1118 @synchronized (x) { // no-warning 1119 } 1120} 1121 1122// <rdar://problem/6352035> rule request: direct structure member access null pointer dereference 1123@interface RDar6352035 { 1124 int c; 1125} 1126- (void)foo; 1127- (void)bar; 1128@end 1129 1130@implementation RDar6352035 1131- (void)foo { 1132 RDar6352035 *friend = 0; 1133 friend->c = 7; // expected-warning{{Instance variable access (via 'friend') results in a null pointer dereference}} 1134} 1135- (void)bar { 1136 self = 0; 1137 c = 7; // expected-warning{{Instance variable access (via 'self') results in a null pointer dereference}} 1138} 1139@end 1140 1141// PR 8149 - GNU statement expression in condition of ForStmt. 1142// This previously triggered an assertion failure in CFGBuilder. 1143void pr8149(void) { 1144 for (; ({ do { } while (0); 0; });) { } 1145} 1146 1147// PR 8458 - Make sure @synchronized doesn't crash with properties. 1148@interface PR8458 {} 1149@property(readonly) id lock; 1150@end 1151 1152static 1153void __PR8458(PR8458 *x) { 1154 @synchronized(x.lock) {} // no-warning 1155} 1156 1157// PR 8440 - False null dereference during store to array-in-field-in-global. 1158// This test case previously resulted in a bogus null deref warning from 1159// incorrect lazy symbolication logic in RegionStore. 1160static struct { 1161 int num; 1162 char **data; 1163} saved_pr8440; 1164 1165char *foo_pr8440(); 1166char **bar_pr8440(); 1167void baz_pr8440(int n) 1168{ 1169 saved_pr8440.num = n; 1170 if (saved_pr8440.data) 1171 return; 1172 saved_pr8440.data = bar_pr8440(); 1173 for (int i = 0 ; i < n ; i ++) 1174 saved_pr8440.data[i] = foo_pr8440(); // no-warning 1175} 1176 1177// Support direct accesses to non-null memory. Reported in: 1178// PR 5272 1179// <rdar://problem/6839683> 1180int test_direct_address_load() { 1181 int *p = (int*) 0x4000; 1182 return *p; // no-warning 1183} 1184 1185void pr5272_test() { 1186 struct pr5272 { int var2; }; 1187 (*(struct pr5272*)0xBC000000).var2 = 0; // no-warning 1188 (*(struct pr5272*)0xBC000000).var2 += 2; // no-warning 1189} 1190 1191// Support casting the return value of function to another different type 1192// This previously caused a crash, although we likely need more precise 1193// reasoning here. <rdar://problem/8663544> 1194void* rdar8663544(); 1195typedef struct {} Val8663544; 1196Val8663544 bazR8663544() { 1197 Val8663544(*func) () = (Val8663544(*) ()) rdar8663544; 1198 return func(); 1199} 1200 1201// PR 8619 - Handle ternary expressions with a call to a noreturn function. 1202// This previously resulted in a crash. 1203void pr8619_noreturn(int x) __attribute__((noreturn)); 1204 1205void pr8619(int a, int b, int c) { 1206 a ?: pr8619_noreturn(b || c); 1207} 1208 1209 1210// PR 8646 - crash in the analyzer when handling unions. 1211union pr8648_union { 1212 signed long long pr8648_union_field; 1213}; 1214void pr8648() { 1215 long long y; 1216 union pr8648_union x = { .pr8648_union_field = 0LL }; 1217 y = x.pr8648_union_field; 1218 1219 union pr8648_union z; 1220 z = (union pr8648_union) { .pr8648_union_field = 0LL }; 1221 1222 union pr8648_union w; 1223 w = ({ (union pr8648_union) { .pr8648_union_field = 0LL }; }); 1224 1225 // crash, no assignment 1226 (void) ({ (union pr8648_union) { .pr8648_union_field = 0LL }; }).pr8648_union_field; 1227 1228 // crash with assignment 1229 y = ({ (union pr8648_union) { .pr8648_union_field = 0LL }; }).pr8648_union_field; 1230} 1231 1232// PR 9269 - don't assert when building the following CFG. The for statement 1233// contains a condition with multiple basic blocks, and the value of the 1234// statement expression is then indexed as part of a bigger condition expression. 1235// This example exposed a bug in child traversal in the CFGBuilder. 1236void pr9269() { 1237 struct s { char *bar[10]; } baz[2] = { 0 }; 1238 unsigned i = 0; 1239 for (i = 0; 1240 (* ({ while(0); ({ &baz[0]; }); })).bar[0] != 0; 1241 ++i) {} 1242} 1243 1244// Test evaluation of GNU-style ?:. 1245int pr9287(int type) { return type ? : 0; } // no-warning 1246 1247void pr9287_b(int type, int *p) { 1248 int x = type ? : 0; 1249 if (x) { 1250 p = 0; 1251 } 1252 if (type) { 1253 *p = 0xDEADBEEF; // expected-warning {{null pointer}} 1254 } 1255} 1256 1257void pr9287_c(int type, int *p) { 1258 int x = type ? : 0; 1259 if (x) { 1260 p = 0; 1261 } 1262 if (!type) { 1263 *p = 0xDEADBEEF; // no-warning 1264 } 1265} 1266 1267void test_switch() { 1268 switch (4) { 1269 case 1: { 1270 int *p = 0; 1271 *p = 0xDEADBEEF; // no-warning 1272 break; 1273 } 1274 case 4: { 1275 int *p = 0; 1276 *p = 0xDEADBEEF; // expected-warning {{null}} 1277 break; 1278 } 1279 default: { 1280 int *p = 0; 1281 *p = 0xDEADBEEF; // no-warning 1282 break; 1283 } 1284 } 1285} 1286 1287// PR 9467. Tests various CFG optimizations. This previously crashed. 1288static void test(unsigned int bit_mask) 1289{ 1290 unsigned int bit_index; 1291 for (bit_index = 0; 1292 bit_index < 24; 1293 bit_index++) { 1294 switch ((0x01 << bit_index) & bit_mask) { 1295 case 0x100000: ; 1296 } 1297 } 1298} 1299 1300// Don't crash on code containing __label__. 1301int radar9414427_aux(); 1302void radar9414427() { 1303 __label__ mylabel; 1304 if (radar9414427_aux()) { 1305 mylabel: do {} 1306 while (0); 1307 } 1308} 1309 1310// Analyze methods in @implementation (category) 1311@interface RDar9465344 1312@end 1313 1314@implementation RDar9465344 (MyCategory) 1315- (void) testcategoryImpl { 1316 int *p = 0x0; 1317 *p = 0xDEADBEEF; // expected-warning {{null}} 1318} 1319@end 1320 1321@implementation RDar9465344 1322@end 1323 1324// Don't crash when analyzing access to 'self' within a block. 1325@interface Rdar10380300Base 1326- (void) foo; 1327@end 1328@interface Rdar10380300 : Rdar10380300Base @end 1329@implementation Rdar10380300 1330- (void)foo { 1331 ^{ 1332 [super foo]; 1333 }(); 1334} 1335@end 1336 1337