gcc/testsuite/g++.dg/analyzer/vfunc-5.C

   1 /* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fanalyzer-checker=malloc -fdiagnostics-show-caret" } */
   2 /* { dg-skip-if "requires hosted libstdc++ for cstdlib malloc" { ! hostedlib } } */
   3 /* { dg-enable-nn-line-numbers "" } */
   4
   5 #include <cstdlib>
   6
   7 struct Base
   8 {
   9     virtual void allocate ();
  10     virtual void deallocate ();
  11 };
  12
  13 struct Derived: public Base
  14 {
  15     int *ptr;
  16     void allocate ()
  17     {
  18         ptr = (int*)malloc(sizeof(int));
  19     }
  20     void deallocate ()
  21     {
  22         free(ptr);
  23     }
  24 };
  25
  26 void test()
  27 {
  28     Derived D;
  29     Base B, *base_ptr;
  30     base_ptr = &D;
  31
  32     D.allocate();
  33     base_ptr->deallocate();
  34     int n = *D.ptr;   /* { dg-warning "use after 'free' of 'D.Derived::ptr'" } */
  35 }
  36
  37 /* use after 'free'  */
  38 /* { dg-begin-multiline-output "" }
  39    NN |     int n = *D.ptr;
  40       |         ^
  41   'void test()': events 1-2
  42     |
  43     |   NN | void test()
  44     |      |      ^~~~
  45     |      |      |
  46     |      |      (1) entry to 'test'
  47     |......
  48     |   NN |     D.allocate();
  49     |      |     ~~~~~~~~~~~~
  50     |      |               |
  51     |      |               (2) calling 'Derived::allocate' from 'test'
  52     |
  53     +--> 'virtual void Derived::allocate()': events 3-4
  54            |
  55            |   NN |     void allocate ()
  56            |      |          ^~~~~~~~
  57            |      |          |
  58            |      |          (3) entry to 'Derived::allocate'
  59            |   NN |     {
  60            |   NN |         ptr = (int*)malloc(sizeof(int));
  61            |      |                     ~~~~~~~~~~~~~~~~~~~
  62            |      |                           |
  63            |      |                           (4) allocated here
  64            |
  65     <------+
  66     |
  67   'void test()': events 5-6
  68     |
  69     |   NN |     D.allocate();
  70     |      |     ~~~~~~~~~~^~
  71     |      |               |
  72     |      |               (5) returning to 'test' from 'Derived::allocate'
  73     |   NN |     base_ptr->deallocate();
  74     |      |     ~~~~~~~~~~~~~~~~~~~~~~
  75     |      |                         |
  76     |      |                         (6) calling 'Derived::deallocate' from 'test'
  77     |
  78     +--> 'virtual void Derived::deallocate()': events 7-8
  79            |
  80            |   NN |     void deallocate ()
  81            |      |          ^~~~~~~~~~
  82            |      |          |
  83            |      |          (7) entry to 'Derived::deallocate'
  84            |   NN |     {
  85            |   NN |         free(ptr);
  86            |      |         ~~~~~~~~~
  87            |      |             |
  88            |      |             (8) freed here
  89            |
  90     <------+
  91     |
  92   'void test()': events 9-10
  93     |
  94     |   NN |     base_ptr->deallocate();
  95     |      |     ~~~~~~~~~~~~~~~~~~~~^~
  96     |      |                         |
  97     |      |                         (9) returning to 'test' from 'Derived::deallocate'
  98     |   NN |     int n = *D.ptr;
  99     |      |         ~
 100     |      |         |
 101     |      |         (10) use after 'free' of 'D.Derived::ptr'; freed at (8)
 102     |
 103    { dg-end-multiline-output "" } */
 104