clang/test/Analysis/z3-crosscheck.c

   1 // RUN: %clang_cc1 -triple x86_64-pc-linux-gnu -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -DNO_CROSSCHECK -verify %s
   2 // RUN: %clang_cc1 -triple x86_64-pc-linux-gnu -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-config crosscheck-with-z3=true -verify %s
   3 // REQUIRES: z3
   4
   5 void clang_analyzer_dump(float);
   6
   7 int foo(int x)
   8 {
   9   int *z = 0;
  10   if ((x & 1) && ((x & 1) ^ 1))
  11 #ifdef NO_CROSSCHECK
  12       return *z; // expected-warning {{Dereference of null pointer (loaded from variable 'z')}}
  13 #else
  14       return *z; // no-warning
  15 #endif
  16   return 0;
  17 }
  18
  19 int unary(int x, long l)
  20 {
  21   int *z = 0;
  22   int y = l;
  23   if ((x & 1) && ((x & 1) ^ 1))
  24     if (-y)
  25 #ifdef NO_CROSSCHECK
  26         return *z; // expected-warning {{Dereference of null pointer (loaded from variable 'z')}}
  27 #else
  28         return *z; // no-warning
  29 #endif
  30   return 0;
  31 }
  32
  33 void g(int d);
  34
  35 void f(int *a, int *b) {
  36   int c = 5;
  37   if ((a - b) == 0)
  38     c = 0;
  39   if (a != b)
  40     g(3 / c); // no-warning
  41 }
  42
  43 _Bool nondet_bool();
  44
  45 void h(int d) {
  46   int x, y, k, z = 1;
  47   while (z < k) { // expected-warning {{The right operand of '<' is a garbage value}}
  48     z = 2 * z;
  49   }
  50 }
  51
  52 void i() {
  53   _Bool c = nondet_bool();
  54   if (c) {
  55     h(1);
  56   } else {
  57     h(2);
  58   }
  59 }
  60
  61 void floatUnaryNegInEq(int h, int l) {
  62   int j;
  63   clang_analyzer_dump(-(float)h); // expected-warning-re{{-(float) (reg_${{[0-9]+}}<int h>)}}
  64   clang_analyzer_dump((float)l); // expected-warning-re {{(float) (reg_${{[0-9]+}}<int l>)}}
  65   if (-(float)h != (float)l) {  // should not crash
  66     j += 10;
  67     // expected-warning@-1{{garbage}}
  68   }
  69 }
  70
  71 void floatUnaryLNotInEq(int h, int l) {
  72   int j;
  73   clang_analyzer_dump(!(float)h); // expected-warning{{Unknown}}
  74   clang_analyzer_dump((float)l); // expected-warning-re {{(float) (reg_${{[0-9]+}}<int l>)}}
  75   if ((!(float)h) != (float)l) {  // should not crash
  76     j += 10;
  77     // expected-warning@-1{{garbage}}
  78   }
  79 }
  80
  81 // don't crash, and also produce a core.CallAndMessage finding
  82 void a(int);
  83 typedef struct {
  84   int b;
  85 } c;
  86 c *d;
  87 void e() {
  88   (void)d->b;
  89   int f;
  90   a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
  91 }