1c568f1e98938584c0ef0b12ae5018ff7d90a4072Stephen Hines// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-store=region -verify %s -Wno-undefined-bool-conversion 268957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek 3112344ab7f96cf482bce80530676712c282756d5Jordan Rosetypedef __INTPTR_TYPE__ intptr_t; 4112344ab7f96cf482bce80530676712c282756d5Jordan Rose 568957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenekconst int& g() { 668957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek int s; 7782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin return s; // expected-warning{{Address of stack memory associated with local variable 's' returned}} expected-warning{{reference to stack memory associated with local variable 's' returned}} 868957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek} 926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 1026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int& g2() { 1126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int s1; 1226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int &s2 = s1; // expected-note {{binding reference variable 's2' here}} 13782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin return s2; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}} 1426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 1526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 1626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int& g3() { 1726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int s1; 1826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int &s2 = s1; // expected-note {{binding reference variable 's2' here}} 1926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int &s3 = s2; // expected-note {{binding reference variable 's3' here}} 20782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin return s3; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}} 2126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 2226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 2376b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labathvoid g4() { 2476b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath static const int &x = 3; // no warning 2576b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath} 2676b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath 2726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint get_value(); 2826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 295e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Roseconst int &get_reference1() { return get_value(); } // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}} 3026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 3126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int &get_reference2() { 3226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis const int &x = get_value(); // expected-note {{binding reference variable 'x' here}} 335e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose return x; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}} 3426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 3526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 3626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int &get_reference3() { 3726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}} 3826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}} 395e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose return x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}} 4026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 4126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 4226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint global_var; 4326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f1() { 4426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int &y = global_var; 4526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis return &y; 4626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 4726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 4826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f2() { 4926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int x1; 5026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int &x2 = x1; // expected-note {{binding reference variable 'x2' here}} 51782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin return &x2; // expected-warning{{Address of stack memory associated with local variable 'x1' returned}} expected-warning {{address of stack memory associated with local variable 'x1' returned}} 5226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 5326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 5426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f3() { 5526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int x1; 5626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int *const &x2 = &x1; // expected-note {{binding reference variable 'x2' here}} 576a835dddf45922e71a87637fdfac0863de65123cTed Kremenek return x2; // expected-warning {{address of stack memory associated with local variable 'x1' returned}} expected-warning {{Address of stack memory associated with local variable 'x1' returned to caller}} 5826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 5926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 6026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int *f4() { 6126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}} 6226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}} 635e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose return &x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning address of local temporary}} 6426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 6526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 6626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisstruct S { 6726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int x; 6826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}; 6926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 7026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *mf() { 7126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis S s1; 7226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis S &s2 = s1; // expected-note {{binding reference variable 's2' here}} 7326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int &x = s2.x; // expected-note {{binding reference variable 'x' here}} 74782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin return &x; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{address of stack memory associated with local variable 's1' returned}} 7526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 7626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 7726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisvoid *lf() { 7826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis label: 7926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis void *const &x = &&label; // expected-note {{binding reference variable 'x' here}} 8026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis return x; // expected-warning {{returning address of label, which is local}} 8126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis} 8226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis 8326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidistemplate <typename T> 8426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisstruct TS { 8526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int *get(); 8626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int *m() { 8726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis int *&x = get(); 8826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis return x; 8926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis } 9026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}; 91e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis 92e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis// rdar://11345441 93e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidisint* f5() { 945965b7c7ddf8d9635426943a05441c71cb59fef6Hans Wennborg int& i = i; // expected-warning {{Assigned value is garbage or undefined}} expected-note {{binding reference variable 'i' here}} expected-warning{{reference 'i' is not yet bound to a value when used within its own initialization}} 95e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis return &i; // expected-warning {{address of stack memory associated with local variable 'i' returned}} 96e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis} 97f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek 98f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenekvoid *radar13226577() { 99f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek void *p = &p; 100f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek return p; // expected-warning {{stack memory associated with local variable 'p' returned to caller}} 101f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek} 102f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek 103112344ab7f96cf482bce80530676712c282756d5Jordan Rosenamespace rdar13296133 { 104112344ab7f96cf482bce80530676712c282756d5Jordan Rose class ConvertsToBool { 105112344ab7f96cf482bce80530676712c282756d5Jordan Rose public: 106112344ab7f96cf482bce80530676712c282756d5Jordan Rose operator bool() const { return this; } 107112344ab7f96cf482bce80530676712c282756d5Jordan Rose }; 108112344ab7f96cf482bce80530676712c282756d5Jordan Rose 109112344ab7f96cf482bce80530676712c282756d5Jordan Rose class ConvertsToIntptr { 110112344ab7f96cf482bce80530676712c282756d5Jordan Rose public: 111112344ab7f96cf482bce80530676712c282756d5Jordan Rose operator intptr_t() const { return reinterpret_cast<intptr_t>(this); } 112112344ab7f96cf482bce80530676712c282756d5Jordan Rose }; 113112344ab7f96cf482bce80530676712c282756d5Jordan Rose 114112344ab7f96cf482bce80530676712c282756d5Jordan Rose class ConvertsToPointer { 115112344ab7f96cf482bce80530676712c282756d5Jordan Rose public: 116112344ab7f96cf482bce80530676712c282756d5Jordan Rose operator const void *() const { return this; } 117112344ab7f96cf482bce80530676712c282756d5Jordan Rose }; 118112344ab7f96cf482bce80530676712c282756d5Jordan Rose 119112344ab7f96cf482bce80530676712c282756d5Jordan Rose intptr_t returnAsNonLoc() { 120112344ab7f96cf482bce80530676712c282756d5Jordan Rose ConvertsToIntptr obj; 121112344ab7f96cf482bce80530676712c282756d5Jordan Rose return obj; // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}} 122112344ab7f96cf482bce80530676712c282756d5Jordan Rose } 123112344ab7f96cf482bce80530676712c282756d5Jordan Rose 124112344ab7f96cf482bce80530676712c282756d5Jordan Rose bool returnAsBool() { 125112344ab7f96cf482bce80530676712c282756d5Jordan Rose ConvertsToBool obj; 126112344ab7f96cf482bce80530676712c282756d5Jordan Rose return obj; // no-warning 127112344ab7f96cf482bce80530676712c282756d5Jordan Rose } 128112344ab7f96cf482bce80530676712c282756d5Jordan Rose 129112344ab7f96cf482bce80530676712c282756d5Jordan Rose intptr_t returnAsNonLocViaPointer() { 130112344ab7f96cf482bce80530676712c282756d5Jordan Rose ConvertsToPointer obj; 131112344ab7f96cf482bce80530676712c282756d5Jordan Rose return reinterpret_cast<intptr_t>(static_cast<const void *>(obj)); // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}} 132112344ab7f96cf482bce80530676712c282756d5Jordan Rose } 133112344ab7f96cf482bce80530676712c282756d5Jordan Rose 134112344ab7f96cf482bce80530676712c282756d5Jordan Rose bool returnAsBoolViaPointer() { 135112344ab7f96cf482bce80530676712c282756d5Jordan Rose ConvertsToPointer obj; 136112344ab7f96cf482bce80530676712c282756d5Jordan Rose return obj; // no-warning 137112344ab7f96cf482bce80530676712c282756d5Jordan Rose } 138112344ab7f96cf482bce80530676712c282756d5Jordan Rose} 139112344ab7f96cf482bce80530676712c282756d5Jordan Rose 140