clang/test/Analysis/cstring-addrspace.c

   1 // RUN: %clang_analyze_cc1 -triple amdgcn-unknown-unknown \
   2 // RUN: -analyze -analyzer-checker=core,alpha.unix.cstring \
   3 // RUN: -analyze -analyzer-checker=debug.ExprInspection \
   4 // RUN: -analyzer-config crosscheck-with-z3=true -verify %s \
   5 // RUN: -Wno-incompatible-library-redeclaration
   6 // REQUIRES: z3
   7
   8 void clang_analyzer_warnIfReached();
   9
  10 // From https://llvm.org/docs/AMDGPUUsage.html#address-spaces,
  11 // select address space 3 (local), since the pointer size is
  12 // different than Generic.
  13 #define DEVICE __attribute__((address_space(3)))
  14 _Static_assert(sizeof(int *) == 8, "");
  15 _Static_assert(sizeof(DEVICE int *) == 4, "");
  16 _Static_assert(sizeof(void *) == 8, "");
  17 _Static_assert(sizeof(DEVICE void *) == 4, "");
  18
  19 // Copy from host to device memory. Note this is specialized
  20 // since one of the parameters is assigned an address space such
  21 // that the sizeof the the pointer is different than the other.
  22 //
  23 // Some downstream implementations may have specialized memcpy
  24 // routines that copy from one address space to another. In cases
  25 // like that, the address spaces are assumed to not overlap, so the
  26 // cstring overlap check is not needed. When a static analysis report
  27 // is generated in as case like this, SMTConv may attempt to create
  28 // a refutation to Z3 with different bitwidth pointers which lead to
  29 // a crash. This is not common in directly used upstream compiler builds,
  30 // but can be seen in specialized downstrean implementations. This case
  31 // covers those specific instances found and debugged.
  32 //
  33 // Since memcpy is a builtin, a specialized builtin instance named like
  34 // 'memcpy_special' will hit in cstring, triggering this behavior. The
  35 // best we can do for an upstream test is use the same memcpy function name.
  36 DEVICE void *memcpy(DEVICE void *dst, const void *src, unsigned long len);
  37
  38 void top1(DEVICE void *dst, void *src, int len) {
  39   memcpy(dst, src, len);
  40
  41   // Create a bugreport for triggering Z3 refutation.
  42   clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}
  43 }
  44
  45 void top2(DEVICE int *dst, void *src, int len) {
  46   memcpy(dst, src, len);
  47
  48   // Create a bugreport for triggering Z3 refutation.
  49   clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}
  50 }
  51
  52 void top3(DEVICE int *dst, int *src, int len) {
  53   memcpy(dst, src, len);
  54
  55   // Create a bugreport for triggering Z3 refutation.
  56   clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}
  57 }
  58
  59 void top4() {
  60   memcpy((DEVICE void *)1, (const void *)1, 1);
  61
  62   // Create a bugreport for triggering Z3 refutation.
  63   clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}}
  64 }