1c568f1e98938584c0ef0b12ae5018ff7d90a4072Stephen Hines// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-store=region -verify %s -Wno-undefined-bool-conversion
268957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek
3112344ab7f96cf482bce80530676712c282756d5Jordan Rosetypedef __INTPTR_TYPE__ intptr_t;
4112344ab7f96cf482bce80530676712c282756d5Jordan Rose
568957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenekconst int& g() {
668957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek  int s;
7782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return s; // expected-warning{{Address of stack memory associated with local variable 's' returned}} expected-warning{{reference to stack memory associated with local variable 's' returned}}
868957a919084ab8bbd1f01d534db1d6f31d0f459Ted Kremenek}
926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
1026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int& g2() {
1126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int s1;
1226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
13782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return s2; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}}
1426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
1526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
1626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int& g3() {
1726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int s1;
1826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
1926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &s3 = s2; // expected-note {{binding reference variable 's3' here}}
20782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return s3; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}}
2126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
2226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
2376b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labathvoid g4() {
2476b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath  static const int &x = 3; // no warning
2576b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath}
2676b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath
2726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint get_value();
2826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
295e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Roseconst int &get_reference1() { return get_value(); } // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
3026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
3126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int &get_reference2() {
3226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x = get_value(); // expected-note {{binding reference variable 'x' here}}
335e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose  return x; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
3426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
3526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
3626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int &get_reference3() {
3726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}}
3826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
395e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose  return x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
4026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
4126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
4226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint global_var;
4326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f1() {
4426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &y = global_var;
4526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  return &y;
4626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
4726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
4826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f2() {
4926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int x1;
5026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
51782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return &x2; // expected-warning{{Address of stack memory associated with local variable 'x1' returned}} expected-warning {{address of stack memory associated with local variable 'x1' returned}}
5226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
5326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
5426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *f3() {
5526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int x1;
5626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int *const &x2 = &x1; // expected-note {{binding reference variable 'x2' here}}
576a835dddf45922e71a87637fdfac0863de65123cTed Kremenek  return x2; // expected-warning {{address of stack memory associated with local variable 'x1' returned}} expected-warning {{Address of stack memory associated with local variable 'x1' returned to caller}}
5826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
5926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
6026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisconst int *f4() {
6126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}}
6226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
635e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose  return &x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning address of local temporary}}
6426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
6526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
6626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisstruct S {
6726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int x;
6826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis};
6926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
7026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisint *mf() {
7126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  S s1;
7226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  S &s2 = s1; // expected-note {{binding reference variable 's2' here}}
7326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int &x = s2.x; // expected-note {{binding reference variable 'x' here}}
74782f63ecd124f9384f988dc7e0cf4ae1540c15f6Jeffrey Yasskin  return &x; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{address of stack memory associated with local variable 's1' returned}}
7526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
7626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
7726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisvoid *lf() {
7826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    label:
7926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    void *const &x = &&label; // expected-note {{binding reference variable 'x' here}}
8026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    return x; // expected-warning {{returning address of label, which is local}}
8126e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis}
8226e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis
8326e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidistemplate <typename T>
8426e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidisstruct TS {
8526e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int *get();
8626e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  int *m() {
8726e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    int *&x = get();
8826e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis    return x;
8926e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis  }
9026e10bea3d2e9d2979194890e51b98ecea165a96Argyrios Kyrtzidis};
91e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis
92e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis// rdar://11345441
93e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidisint* f5() {
945965b7c7ddf8d9635426943a05441c71cb59fef6Hans Wennborg  int& i = i; // expected-warning {{Assigned value is garbage or undefined}} expected-note {{binding reference variable 'i' here}} expected-warning{{reference 'i' is not yet bound to a value when used within its own initialization}}
95e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis  return &i; // expected-warning {{address of stack memory associated with local variable 'i' returned}}
96e720ce7a3b1c1bfa5f7482183caa6e31fca9a3fbArgyrios Kyrtzidis}
97f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek
98f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenekvoid *radar13226577() {
99f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek    void *p = &p;
100f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek    return p; // expected-warning {{stack memory associated with local variable 'p' returned to caller}}
101f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek}
102f08740ba5903d089a53cc315c19286e2189f9ff3Ted Kremenek
103112344ab7f96cf482bce80530676712c282756d5Jordan Rosenamespace rdar13296133 {
104112344ab7f96cf482bce80530676712c282756d5Jordan Rose  class ConvertsToBool {
105112344ab7f96cf482bce80530676712c282756d5Jordan Rose  public:
106112344ab7f96cf482bce80530676712c282756d5Jordan Rose    operator bool() const { return this; }
107112344ab7f96cf482bce80530676712c282756d5Jordan Rose  };
108112344ab7f96cf482bce80530676712c282756d5Jordan Rose
109112344ab7f96cf482bce80530676712c282756d5Jordan Rose  class ConvertsToIntptr {
110112344ab7f96cf482bce80530676712c282756d5Jordan Rose  public:
111112344ab7f96cf482bce80530676712c282756d5Jordan Rose    operator intptr_t() const { return reinterpret_cast<intptr_t>(this); }
112112344ab7f96cf482bce80530676712c282756d5Jordan Rose  };
113112344ab7f96cf482bce80530676712c282756d5Jordan Rose
114112344ab7f96cf482bce80530676712c282756d5Jordan Rose  class ConvertsToPointer {
115112344ab7f96cf482bce80530676712c282756d5Jordan Rose  public:
116112344ab7f96cf482bce80530676712c282756d5Jordan Rose    operator const void *() const { return this; }
117112344ab7f96cf482bce80530676712c282756d5Jordan Rose  };
118112344ab7f96cf482bce80530676712c282756d5Jordan Rose
119112344ab7f96cf482bce80530676712c282756d5Jordan Rose  intptr_t returnAsNonLoc() {
120112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToIntptr obj;
121112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return obj; // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}}
122112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
123112344ab7f96cf482bce80530676712c282756d5Jordan Rose
124112344ab7f96cf482bce80530676712c282756d5Jordan Rose  bool returnAsBool() {
125112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToBool obj;
126112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return obj; // no-warning
127112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
128112344ab7f96cf482bce80530676712c282756d5Jordan Rose
129112344ab7f96cf482bce80530676712c282756d5Jordan Rose  intptr_t returnAsNonLocViaPointer() {
130112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToPointer obj;
131112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return reinterpret_cast<intptr_t>(static_cast<const void *>(obj)); // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}}
132112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
133112344ab7f96cf482bce80530676712c282756d5Jordan Rose
134112344ab7f96cf482bce80530676712c282756d5Jordan Rose  bool returnAsBoolViaPointer() {
135112344ab7f96cf482bce80530676712c282756d5Jordan Rose    ConvertsToPointer obj;
136112344ab7f96cf482bce80530676712c282756d5Jordan Rose    return obj; // no-warning
137112344ab7f96cf482bce80530676712c282756d5Jordan Rose  }
138112344ab7f96cf482bce80530676712c282756d5Jordan Rose}
139112344ab7f96cf482bce80530676712c282756d5Jordan Rose
140