434 lines
14 KiB
Mathematica
434 lines
14 KiB
Mathematica
|
// RUN: %clang_analyze_cc1 -analyzer-store=region -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-output=text -verify %s
|
||
|
|
|
||
|
|
typedef unsigned int NSUInteger;
|
||
|
|
typedef __typeof__(sizeof(int)) size_t;
|
||
|
|
|
||
|
|
void *malloc(size_t);
|
||
|
|
void *calloc(size_t nmemb, size_t size);
|
||
|
|
void free(void *);
|
||
|
|
|
||
|
|
void clang_analyzer_eval(int);
|
||
|
|
|
||
|
|
struct s {
|
||
|
|
int data;
|
||
|
|
};
|
||
|
|
|
||
|
|
struct s global;
|
||
|
|
|
||
|
|
void g(int);
|
||
|
|
|
||
|
|
void f4() {
|
||
|
|
int a;
|
||
|
|
if (global.data == 0)
|
||
|
|
a = 3;
|
||
|
|
if (global.data == 0) // When the true branch is feasible 'a = 3'.
|
||
|
|
g(a); // no-warning
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
// Test uninitialized value due to part of the structure being uninitialized.
|
||
|
|
struct TestUninit { int x; int y; };
|
||
|
|
struct TestUninit test_uninit_aux();
|
||
|
|
void test_unit_aux2(int);
|
||
|
|
void test_uninit_pos() {
|
||
|
|
struct TestUninit v1 = { 0, 0 };
|
||
|
|
struct TestUninit v2 = test_uninit_aux();
|
||
|
|
int z; // expected-note{{'z' declared without an initial value}}
|
||
|
|
v1.y = z; // expected-warning{{Assigned value is garbage or undefined}}
|
||
|
|
// expected-note@-1{{Assigned value is garbage or undefined}}
|
||
|
|
test_unit_aux2(v2.x + v1.y);
|
||
|
|
}
|
||
|
|
void test_uninit_pos_2() {
|
||
|
|
struct TestUninit v1 = { 0, 0 };
|
||
|
|
struct TestUninit v2;
|
||
|
|
test_unit_aux2(v2.x + v1.y); // expected-warning{{The left operand of '+' is a garbage value}}
|
||
|
|
// expected-note@-1{{The left operand of '+' is a garbage value}}
|
||
|
|
}
|
||
|
|
void test_uninit_pos_3() {
|
||
|
|
struct TestUninit v1 = { 0, 0 };
|
||
|
|
struct TestUninit v2;
|
||
|
|
test_unit_aux2(v1.y + v2.x); // expected-warning{{The right operand of '+' is a garbage value}}
|
||
|
|
// expected-note@-1{{The right operand of '+' is a garbage value}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void test_uninit_neg() {
|
||
|
|
struct TestUninit v1 = { 0, 0 };
|
||
|
|
struct TestUninit v2 = test_uninit_aux();
|
||
|
|
test_unit_aux2(v2.x + v1.y);
|
||
|
|
}
|
||
|
|
|
||
|
|
extern void test_uninit_struct_arg_aux(struct TestUninit arg);
|
||
|
|
void test_uninit_struct_arg() {
|
||
|
|
struct TestUninit x; // expected-note{{'x' initialized here}}
|
||
|
|
test_uninit_struct_arg_aux(x); // expected-warning{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'x')}}
|
||
|
|
// expected-note@-1{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'x')}}
|
||
|
|
}
|
||
|
|
|
||
|
|
@interface Foo
|
||
|
|
- (void) passVal:(struct TestUninit)arg;
|
||
|
|
@end
|
||
|
|
void testFoo(Foo *o) {
|
||
|
|
struct TestUninit x; // expected-note{{'x' initialized here}}
|
||
|
|
[o passVal:x]; // expected-warning{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'x')}}
|
||
|
|
// expected-note@-1{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'x')}}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Test case from <rdar://problem/7780304>. That shows an uninitialized value
|
||
|
|
// being used in the LHS of a compound assignment.
|
||
|
|
void rdar_7780304() {
|
||
|
|
typedef struct s_r7780304 { int x; } s_r7780304;
|
||
|
|
s_r7780304 b;
|
||
|
|
b.x |= 1; // expected-warning{{The left expression of the compound assignment is an uninitialized value. The computed value will also be garbage}}
|
||
|
|
// expected-note@-1{{The left expression of the compound assignment is an uninitialized value. The computed value will also be garbage}}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
// The flip side of PR10163 -- float arrays that are actually uninitialized
|
||
|
|
void test_PR10163(float);
|
||
|
|
void PR10163 (void) {
|
||
|
|
float x[2];
|
||
|
|
test_PR10163(x[1]); // expected-warning{{uninitialized value}}
|
||
|
|
// expected-note@-1{{1st function call argument is an uninitialized value}}
|
||
|
|
}
|
||
|
|
|
||
|
|
// PR10163 -- don't warn for default-initialized float arrays.
|
||
|
|
void PR10163_default_initialized_arrays(void) {
|
||
|
|
float x[2] = {0};
|
||
|
|
test_PR10163(x[1]); // no-warning
|
||
|
|
}
|
||
|
|
|
||
|
|
struct MyStr {
|
||
|
|
int x;
|
||
|
|
int y;
|
||
|
|
};
|
||
|
|
void swap(struct MyStr *To, struct MyStr *From) {
|
||
|
|
// This is not really a swap but close enough for our test.
|
||
|
|
To->x = From->x;
|
||
|
|
To->y = From->y; // expected-note{{Uninitialized value stored to field 'y'}}
|
||
|
|
}
|
||
|
|
int test_undefined_member_assignment_in_swap(struct MyStr *s2) {
|
||
|
|
struct MyStr s1;
|
||
|
|
s1.x = 5;
|
||
|
|
swap(s2, &s1); // expected-note{{Calling 'swap'}}
|
||
|
|
// expected-note@-1{{Returning from 'swap'}}
|
||
|
|
return s2->y; // expected-warning{{Undefined or garbage value returned to caller}}
|
||
|
|
// expected-note@-1{{Undefined or garbage value returned to caller}}
|
||
|
|
}
|
||
|
|
|
||
|
|
@interface A
|
||
|
|
- (NSUInteger)foo;
|
||
|
|
@end
|
||
|
|
|
||
|
|
NSUInteger f8(A* x){
|
||
|
|
const NSUInteger n = [x foo];
|
||
|
|
int* bogus;
|
||
|
|
|
||
|
|
if (n > 0) { // tests const cast transfer function logic
|
||
|
|
NSUInteger i;
|
||
|
|
|
||
|
|
for (i = 0; i < n; ++i)
|
||
|
|
bogus = 0;
|
||
|
|
|
||
|
|
if (bogus) // no-warning
|
||
|
|
return n+1;
|
||
|
|
}
|
||
|
|
|
||
|
|
return n;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct {
|
||
|
|
float x;
|
||
|
|
float y;
|
||
|
|
float z;
|
||
|
|
} Point;
|
||
|
|
typedef struct {
|
||
|
|
Point origin;
|
||
|
|
int size;
|
||
|
|
} Circle;
|
||
|
|
|
||
|
|
Point makePoint(float x, float y) {
|
||
|
|
Point result;
|
||
|
|
result.x = x;
|
||
|
|
result.y = y;
|
||
|
|
result.z = 0.0;
|
||
|
|
return result;
|
||
|
|
}
|
||
|
|
|
||
|
|
void PR14765_test() {
|
||
|
|
Circle *testObj = calloc(sizeof(Circle), 1);
|
||
|
|
|
||
|
|
clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
testObj->origin = makePoint(0.0, 0.0);
|
||
|
|
if (testObj->size > 0) { ; } // expected-note{{Assuming field 'size' is <= 0}}
|
||
|
|
// expected-note@-1{{Taking false branch}}
|
||
|
|
|
||
|
|
// FIXME: Assigning to 'testObj->origin' kills the default binding for the
|
||
|
|
// whole region, meaning that we've forgotten that testObj->size should also
|
||
|
|
// default to 0. Tracked by <rdar://problem/12701038>.
|
||
|
|
// This should be TRUE.
|
||
|
|
clang_analyzer_eval(testObj->size == 0); // expected-warning{{UNKNOWN}}
|
||
|
|
// expected-note@-1{{UNKNOWN}}
|
||
|
|
|
||
|
|
free(testObj);
|
||
|
|
}
|
||
|
|
|
||
|
|
void PR14765_argument(Circle *testObj) {
|
||
|
|
int oldSize = testObj->size;
|
||
|
|
clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
testObj->origin = makePoint(0.0, 0.0);
|
||
|
|
clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct {
|
||
|
|
int x;
|
||
|
|
int y;
|
||
|
|
int z;
|
||
|
|
} IntPoint;
|
||
|
|
typedef struct {
|
||
|
|
IntPoint origin;
|
||
|
|
int size;
|
||
|
|
} IntCircle;
|
||
|
|
|
||
|
|
IntPoint makeIntPoint(int x, int y) {
|
||
|
|
IntPoint result;
|
||
|
|
result.x = x;
|
||
|
|
result.y = y;
|
||
|
|
result.z = 0;
|
||
|
|
return result;
|
||
|
|
}
|
||
|
|
|
||
|
|
void PR14765_test_int() {
|
||
|
|
IntCircle *testObj = calloc(sizeof(IntCircle), 1);
|
||
|
|
|
||
|
|
clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.x == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.y == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.z == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
testObj->origin = makeIntPoint(1, 2);
|
||
|
|
if (testObj->size > 0) { ; } // expected-note{{Assuming field 'size' is <= 0}}
|
||
|
|
// expected-note@-1{{Taking false branch}}
|
||
|
|
// expected-note@-2{{Assuming field 'size' is <= 0}}
|
||
|
|
// expected-note@-3{{Taking false branch}}
|
||
|
|
// expected-note@-4{{Assuming field 'size' is <= 0}}
|
||
|
|
// expected-note@-5{{Taking false branch}}
|
||
|
|
// expected-note@-6{{Assuming field 'size' is <= 0}}
|
||
|
|
// expected-note@-7{{Taking false branch}}
|
||
|
|
|
||
|
|
// FIXME: Assigning to 'testObj->origin' kills the default binding for the
|
||
|
|
// whole region, meaning that we've forgotten that testObj->size should also
|
||
|
|
// default to 0. Tracked by <rdar://problem/12701038>.
|
||
|
|
// This should be TRUE.
|
||
|
|
clang_analyzer_eval(testObj->size == 0); // expected-warning{{UNKNOWN}}
|
||
|
|
// expected-note@-1{{UNKNOWN}}
|
||
|
|
clang_analyzer_eval(testObj->origin.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.z == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
free(testObj);
|
||
|
|
}
|
||
|
|
|
||
|
|
void PR14765_argument_int(IntCircle *testObj) {
|
||
|
|
int oldSize = testObj->size;
|
||
|
|
clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
testObj->origin = makeIntPoint(1, 2);
|
||
|
|
clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.z == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
void rdar13292559(Circle input) {
|
||
|
|
extern void useCircle(Circle);
|
||
|
|
|
||
|
|
Circle obj = input;
|
||
|
|
useCircle(obj); // no-warning
|
||
|
|
|
||
|
|
// This generated an "uninitialized 'size' field" warning for a (short) while.
|
||
|
|
obj.origin = makePoint(0.0, 0.0);
|
||
|
|
useCircle(obj); // no-warning
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct {
|
||
|
|
int x;
|
||
|
|
int y;
|
||
|
|
} IntPoint2D;
|
||
|
|
typedef struct {
|
||
|
|
IntPoint2D origin;
|
||
|
|
int size;
|
||
|
|
} IntCircle2D;
|
||
|
|
|
||
|
|
IntPoint2D makeIntPoint2D(int x, int y) {
|
||
|
|
IntPoint2D result;
|
||
|
|
result.x = x;
|
||
|
|
result.y = y;
|
||
|
|
return result;
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructsCopiedPerField() {
|
||
|
|
IntPoint2D a;
|
||
|
|
a.x = 0;
|
||
|
|
|
||
|
|
IntPoint2D b = a;
|
||
|
|
extern void useInt(int);
|
||
|
|
useInt(b.x); // no-warning
|
||
|
|
useInt(b.y); // expected-warning{{uninitialized}}
|
||
|
|
// expected-note@-1{{uninitialized}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void testLargeStructsNotCopiedPerField() {
|
||
|
|
IntPoint a;
|
||
|
|
a.x = 0;
|
||
|
|
|
||
|
|
IntPoint b = a;
|
||
|
|
extern void useInt(int);
|
||
|
|
useInt(b.x); // no-warning
|
||
|
|
useInt(b.y); // no-warning
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructInLargerStruct() {
|
||
|
|
IntCircle2D *testObj = calloc(sizeof(IntCircle2D), 1);
|
||
|
|
|
||
|
|
clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.x == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.y == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
testObj->origin = makeIntPoint2D(1, 2);
|
||
|
|
if (testObj->size > 0) { ; } // expected-note{{Field 'size' is <= 0}}
|
||
|
|
// expected-note@-1{{Taking false branch}}
|
||
|
|
// expected-note@-2{{Field 'size' is <= 0}}
|
||
|
|
// expected-note@-3{{Taking false branch}}
|
||
|
|
// expected-note@-4{{Field 'size' is <= 0}}
|
||
|
|
// expected-note@-5{{Taking false branch}}
|
||
|
|
|
||
|
|
clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
free(testObj);
|
||
|
|
}
|
||
|
|
|
||
|
|
void testCopySmallStructIntoArgument(IntCircle2D *testObj) {
|
||
|
|
int oldSize = testObj->size;
|
||
|
|
clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
testObj->origin = makeIntPoint2D(1, 2);
|
||
|
|
clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(testObj->origin.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructBitfields() {
|
||
|
|
struct {
|
||
|
|
int x : 4;
|
||
|
|
int y : 4;
|
||
|
|
} a, b;
|
||
|
|
|
||
|
|
a.x = 1;
|
||
|
|
a.y = 2;
|
||
|
|
|
||
|
|
b = a;
|
||
|
|
clang_analyzer_eval(b.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(b.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructBitfieldsFirstUndef() {
|
||
|
|
struct {
|
||
|
|
int x : 4;
|
||
|
|
int y : 4;
|
||
|
|
} a, b;
|
||
|
|
|
||
|
|
a.y = 2;
|
||
|
|
|
||
|
|
b = a;
|
||
|
|
clang_analyzer_eval(b.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(b.x == 1); // expected-warning{{garbage}}
|
||
|
|
// expected-note@-1{{garbage}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructBitfieldsSecondUndef() {
|
||
|
|
struct {
|
||
|
|
int x : 4;
|
||
|
|
int y : 4;
|
||
|
|
} a, b;
|
||
|
|
|
||
|
|
a.x = 1;
|
||
|
|
|
||
|
|
b = a;
|
||
|
|
clang_analyzer_eval(b.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
clang_analyzer_eval(b.y == 2); // expected-warning{{garbage}}
|
||
|
|
// expected-note@-1{{garbage}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructBitfieldsFirstUnnamed() {
|
||
|
|
struct {
|
||
|
|
int : 4;
|
||
|
|
int y : 4;
|
||
|
|
} a, b, c; // expected-note{{'c' initialized here}}
|
||
|
|
|
||
|
|
a.y = 2;
|
||
|
|
|
||
|
|
b = a;
|
||
|
|
clang_analyzer_eval(b.y == 2); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
b = c; // expected-note{{Uninitialized value stored to 'b.y'}}
|
||
|
|
clang_analyzer_eval(b.y == 2); // expected-warning{{garbage}}
|
||
|
|
// expected-note@-1{{garbage}}
|
||
|
|
}
|
||
|
|
|
||
|
|
void testSmallStructBitfieldsSecondUnnamed() {
|
||
|
|
struct {
|
||
|
|
int x : 4;
|
||
|
|
int : 4;
|
||
|
|
} a, b, c; // expected-note{{'c' initialized here}}
|
||
|
|
|
||
|
|
a.x = 1;
|
||
|
|
|
||
|
|
b = a;
|
||
|
|
clang_analyzer_eval(b.x == 1); // expected-warning{{TRUE}}
|
||
|
|
// expected-note@-1{{TRUE}}
|
||
|
|
|
||
|
|
b = c; // expected-note{{Uninitialized value stored to 'b.x'}}
|
||
|
|
clang_analyzer_eval(b.x == 1); // expected-warning{{garbage}}
|
||
|
|
// expected-note@-1{{garbage}}
|
||
|
|
}
|