clang/test/Analysis/use-after-move.cpp

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move %s\
   2 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
   3 // RUN:  -analyzer-config exploration_strategy=unexplored_first_queue\
   4 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
   5 // RUN:  -verify=expected,peaceful,non-aggressive
   6 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move %s\
   7 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
   8 // RUN:  -analyzer-config exploration_strategy=dfs -DDFS\
   9 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
  10 // RUN:  -verify=expected,peaceful,non-aggressive
  11 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move %s\
  12 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
  13 // RUN:  -analyzer-config exploration_strategy=unexplored_first_queue\
  14 // RUN:  -analyzer-config cplusplus.Move:WarnOn=KnownsOnly\
  15 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
  16 // RUN:  -verify=expected,non-aggressive
  17 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move -verify %s\
  18 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
  19 // RUN:  -analyzer-config exploration_strategy=dfs -DDFS\
  20 // RUN:  -analyzer-config cplusplus.Move:WarnOn=KnownsOnly\
  21 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
  22 // RUN:  -verify=expected,non-aggressive
  23 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move %s\
  24 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
  25 // RUN:  -analyzer-config exploration_strategy=unexplored_first_queue\
  26 // RUN:  -analyzer-config cplusplus.Move:WarnOn=All\
  27 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
  28 // RUN:  -verify=expected,peaceful,aggressive
  29 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move %s\
  30 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
  31 // RUN:  -analyzer-config exploration_strategy=dfs -DDFS\
  32 // RUN:  -analyzer-config cplusplus.Move:WarnOn=All\
  33 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
  34 // RUN:  -verify=expected,peaceful,aggressive
  35
  36 // RUN: not %clang_analyze_cc1 -verify %s \
  37 // RUN:   -analyzer-checker=core \
  38 // RUN:   -analyzer-checker=cplusplus.Move \
  39 // RUN:   -analyzer-config cplusplus.Move:WarnOn="a bunch of things" \
  40 // RUN:   2>&1 | FileCheck %s -check-prefix=CHECK-MOVE-INVALID-VALUE
  41
  42 // CHECK-MOVE-INVALID-VALUE: (frontend): invalid input for checker option
  43 // CHECK-MOVE-INVALID-VALUE-SAME: 'cplusplus.Move:WarnOn', that expects either
  44 // CHECK-MOVE-INVALID-VALUE-SAME: "KnownsOnly", "KnownsAndLocals" or "All"
  45 // CHECK-MOVE-INVALID-VALUE-SAME: string value
  46
  47 // Tests checker-messages printing.
  48 // RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.Move %s\
  49 // RUN:  -std=c++11 -analyzer-output=text -analyzer-config eagerly-assume=false\
  50 // RUN:  -analyzer-config exploration_strategy=dfs -DDFS\
  51 // RUN:  -analyzer-config cplusplus.Move:WarnOn=All -DAGGRESSIVE_DFS\
  52 // RUN:  -analyzer-checker core,cplusplus.SmartPtrModeling,debug.ExprInspection\
  53 // RUN:  -verify=expected,peaceful,aggressive %s 2>&1 | FileCheck %s
  54
  55 #include "Inputs/system-header-simulator-cxx.h"
  56
  57 void clang_analyzer_warnIfReached();
  58 void clang_analyzer_printState();
  59
  60 class B {
  61 public:
  62   B() = default;
  63   B(const B &) = default;
  64   B(B &&) = default;
  65   B& operator=(const B &q) = default;
  66   void operator=(B &&b) {
  67     return;
  68   }
  69   void foo() { return; }
  70 };
  71
  72 class A {
  73   int i;
  74   double d;
  75
  76 public:
  77   B b;
  78   A(int ii = 42, double dd = 1.0) : d(dd), i(ii), b(B()) {}
  79   void moveconstruct(A &&other) {
  80     std::swap(b, other.b);
  81     std::swap(d, other.d);
  82     std::swap(i, other.i);
  83     return;
  84   }
  85   static A get() {
  86     A v(12, 13);
  87     return v;
  88   }
  89   A(A *a) {
  90     moveconstruct(std::move(*a));
  91   }
  92   A(const A &other) : i(other.i), d(other.d), b(other.b) {}
  93   A(A &&other) : i(other.i), d(other.d), b(std::move(other.b)) { // aggressive-note{{Object 'b' is moved}}
  94   }
  95   A(A &&other, char *k) {
  96     moveconstruct(std::move(other));
  97   }
  98   void operator=(const A &other) {
  99     i = other.i;
 100     d = other.d;
 101     b = other.b;
 102     return;
 103   }
 104   void operator=(A &&other) {
 105     moveconstruct(std::move(other));
 106     return;
 107   }
 108   int getI() { return i; }
 109   int foo() const;
 110   void bar() const;
 111   void reset();
 112   void destroy();
 113   void clear();
 114   void resize(std::size_t);
 115   void assign(const A &);
 116   bool empty() const;
 117   bool isEmpty() const;
 118   operator bool() const;
 119
 120   void testUpdateField() {
 121     A a;
 122     A b = std::move(a);
 123     a.i = 1;
 124     a.foo(); // no-warning
 125   }
 126   void testUpdateFieldDouble() {
 127     A a;
 128     A b = std::move(a);
 129     a.d = 1.0;
 130     a.foo(); // no-warning
 131   }
 132 };
 133
 134 int bignum();
 135
 136 void moveInsideFunctionCall(A a) {
 137   A b = std::move(a);
 138 }
 139 void leftRefCall(A &a) {
 140   a.foo();
 141 }
 142 void rightRefCall(A &&a) {
 143   a.foo();
 144 }
 145 void constCopyOrMoveCall(const A a) {
 146   a.foo();
 147 }
 148
 149 void copyOrMoveCall(A a) {
 150   a.foo();
 151 }
 152
 153 void simpleMoveCtorTest() {
 154   {
 155     A a;
 156     A b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 157
 158 #ifdef AGGRESSIVE_DFS
 159     clang_analyzer_printState();
 160
 161 // CHECK:      "checker_messages": [
 162 // CHECK-NEXT:   { "checker": "cplusplus.Move", "messages": [
 163 // CHECK-NEXT:     "Moved-from objects :",
 164 // CHECK:          "a: moved",
 165 // CHECK:          ""
 166 // CHECK-NEXT:   ]}
 167 // CHECK-NEXT: ]
 168 #endif
 169
 170     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 171              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 172   }
 173   {
 174     A a;
 175     A b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 176     b = a; // peaceful-warning {{Moved-from object 'a' is copied}}
 177            // peaceful-note@-1 {{Moved-from object 'a' is copied}}
 178   }
 179   {
 180     A a;
 181     A b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 182     b = std::move(a); // peaceful-warning {{Moved-from object 'a' is moved}}
 183                       // peaceful-note@-1 {{Moved-from object 'a' is moved}}
 184   }
 185 }
 186
 187 void simpleMoveAssignementTest() {
 188   {
 189     A a;
 190     A b;
 191     b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 192     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 193              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 194   }
 195   {
 196     A a;
 197     A b;
 198     b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 199     A c(a); // peaceful-warning {{Moved-from object 'a' is copied}}
 200             // peaceful-note@-1 {{Moved-from object 'a' is copied}}
 201   }
 202   {
 203     A a;
 204     A b;
 205     b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 206     A c(std::move(a)); // peaceful-warning {{Moved-from object 'a' is moved}}
 207                        // peaceful-note@-1 {{Moved-from object 'a' is moved}}
 208   }
 209 }
 210
 211 void moveInInitListTest() {
 212   struct S {
 213     A a;
 214   };
 215   A a;
 216   S s{std::move(a)}; // peaceful-note {{Object 'a' is moved}}
 217   a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 218            // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 219 }
 220
 221 // Don't report a bug if the variable was assigned to in the meantime.
 222 void reinitializationTest(int i) {
 223   {
 224     A a;
 225     A b;
 226     b = std::move(a);
 227     a = A();
 228     a.foo();
 229   }
 230   {
 231     A a;
 232     if (i == 1) { // peaceful-note 2 {{Assuming 'i' is not equal to 1}}
 233                   // peaceful-note@-1 2 {{Taking false branch}}
 234       A b;
 235       b = std::move(a);
 236       a = A();
 237     }
 238     if (i == 2) { // peaceful-note 2 {{Assuming 'i' is not equal to 2}}
 239                   // peaceful-note@-1 2 {{Taking false branch}}
 240       a.foo();    // no-warning
 241     }
 242   }
 243   {
 244     A a;
 245     if (i == 1) { // peaceful-note 2 {{'i' is not equal to 1}}
 246                   // peaceful-note@-1 2 {{Taking false branch}}
 247       (void)std::move(a);
 248     }
 249     if (i == 2) { // peaceful-note 2 {{'i' is not equal to 2}}
 250                   // peaceful-note@-1 2 {{Taking false branch}}
 251       a = A();
 252       a.foo();
 253     }
 254   }
 255   // The built-in assignment operator should also be recognized as a
 256   // reinitialization. (std::move() may be called on built-in types in template
 257   // code.)
 258   {
 259     int a1 = 1, a2 = 2;
 260     std::swap(a1, a2);
 261   }
 262   // A std::move() after the assignment makes the variable invalid again.
 263   {
 264     A a;
 265     A b;
 266     b = std::move(a);
 267     a = A();
 268     b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 269     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 270              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 271   }
 272   // If a path exist where we not reinitialize the variable we report a bug.
 273   {
 274     A a;
 275     A b;
 276     b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 277     if (i < 10) { // peaceful-note {{Assuming 'i' is >= 10}}
 278                   // peaceful-note@-1 {{Taking false branch}}
 279       a = A();
 280     }
 281     if (i > 5) { // peaceful-note {{'i' is > 5}}
 282                  // peaceful-note@-1 {{Taking true branch}}
 283       a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 284                // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 285     }
 286   }
 287 }
 288
 289 // Using decltype on an expression is not a use.
 290 void decltypeIsNotUseTest() {
 291   A a;
 292   // A b(std::move(a));
 293   decltype(a) other_a; // no-warning
 294 }
 295
 296 void loopTest() {
 297   {
 298     A a;
 299     // FIXME: Execution doesn't jump to the end of the function yet.
 300     for (int i = 0; i < bignum(); i++) { // peaceful-note {{Loop condition is false. Execution jumps to the end of the function}}
 301       rightRefCall(std::move(a));        // no-warning
 302     }
 303   }
 304   {
 305     A a;
 306     for (int i = 0; i < 2; i++) { // peaceful-note    {{Loop condition is true.  Entering loop body}}
 307                                   // peaceful-note@-1 {{Loop condition is true.  Entering loop body}}
 308                                   // peaceful-note@-2 {{Loop condition is false. Execution jumps to the end of the function}}
 309       rightRefCall(std::move(a)); // no-warning
 310     }
 311   }
 312   {
 313     A a;
 314     for (int i = 0; i < bignum(); i++) { // peaceful-note {{Loop condition is false. Execution jumps to the end of the function}}
 315       leftRefCall(a);                    // no-warning
 316     }
 317   }
 318   {
 319     A a;
 320     for (int i = 0; i < 2; i++) { // peaceful-note    {{Loop condition is true.  Entering loop body}}
 321                                   // peaceful-note@-1 {{Loop condition is true.  Entering loop body}}
 322                                   // peaceful-note@-2 {{Loop condition is false. Execution jumps to the end of the function}}
 323       leftRefCall(a);             // no-warning
 324     }
 325   }
 326   {
 327     A a;
 328     for (int i = 0; i < bignum(); i++) { // peaceful-note {{Loop condition is false. Execution jumps to the end of the function}}
 329       constCopyOrMoveCall(a);            // no-warning
 330     }
 331   }
 332   {
 333     A a;
 334     for (int i = 0; i < 2; i++) { // peaceful-note    {{Loop condition is true.  Entering loop body}}
 335                                   // peaceful-note@-1 {{Loop condition is true.  Entering loop body}}
 336                                   // peaceful-note@-2 {{Loop condition is false. Execution jumps to the end of the function}}
 337       constCopyOrMoveCall(a);     // no-warning
 338     }
 339   }
 340   {
 341     A a;
 342     for (int i = 0; i < bignum(); i++) { // peaceful-note {{Loop condition is false. Execution jumps to the end of the function}}
 343       moveInsideFunctionCall(a);         // no-warning
 344     }
 345   }
 346   {
 347     A a;
 348     for (int i = 0; i < 2; i++) { // peaceful-note    {{Loop condition is true.  Entering loop body}}
 349                                   // peaceful-note@-1 {{Loop condition is true.  Entering loop body}}
 350                                   // peaceful-note@-2 {{Loop condition is false. Execution jumps to the end of the function}}
 351       moveInsideFunctionCall(a);  // no-warning
 352     }
 353   }
 354   {
 355     A a;
 356     for (int i = 0; i < bignum(); i++) { // peaceful-note {{Loop condition is false. Execution jumps to the end of the function}}
 357       copyOrMoveCall(a);                 // no-warning
 358     }
 359   }
 360   {
 361     A a;
 362     for (int i = 0; i < 2; i++) { // peaceful-note    {{Loop condition is true.  Entering loop body}}
 363                                   // peaceful-note@-1 {{Loop condition is true.  Entering loop body}}
 364                                   // peaceful-note@-2 {{Loop condition is false. Execution jumps to the end of the function}}
 365       copyOrMoveCall(a);          // no-warning
 366     }
 367   }
 368   {
 369     A a;
 370     for (int i = 0; i < bignum(); i++) { // peaceful-note    {{Loop condition is true.  Entering loop body}}
 371                                          // peaceful-note@-1 {{Loop condition is true.  Entering loop body}}
 372       constCopyOrMoveCall(std::move(a)); // peaceful-note {{Object 'a' is moved}}
 373                                          // peaceful-warning@-1 {{Moved-from object 'a' is moved}}
 374                                          // peaceful-note@-2    {{Moved-from object 'a' is moved}}
 375     }
 376   }
 377
 378   // Don't warn if we return after the move.
 379   {
 380     A a;
 381     for (int i = 0; i < 3; ++i) {
 382       a.bar();
 383       if (a.foo() > 0) {
 384         A b;
 385         b = std::move(a); // no-warning
 386         return;
 387       }
 388     }
 389   }
 390 }
 391
 392 // Report a usage of a moved-from object only at the first use.
 393 void uniqueTest(bool cond) {
 394   A a(42, 42.0);
 395   A b;
 396   b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 397
 398   if (cond) { // peaceful-note {{Assuming 'cond' is true}}
 399               // peaceful-note@-1 {{Taking true branch}}
 400     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 401              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 402   }
 403   if (cond) {
 404     a.bar(); // no-warning
 405   }
 406
 407   a.bar(); // no-warning
 408 }
 409
 410 void uniqueTest2() {
 411   A a;
 412   A a1 = std::move(a); // peaceful-note {{Object 'a' is moved}}
 413   a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 414            // peaceful-note@-1    {{Method called on moved-from object 'a'}}
 415
 416   A a2 = std::move(a); // no-warning
 417   a.foo();             // no-warning
 418 }
 419
 420 // There are exceptions where we assume in general that the method works fine
 421 //even on moved-from objects.
 422 void moveSafeFunctionsTest() {
 423   A a;
 424   A b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 425   a.empty();          // no-warning
 426   a.isEmpty();        // no-warning
 427   (void)a;            // no-warning
 428   (bool)a;            // expected-warning {{expression result unused}}
 429   a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 430            // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 431 }
 432
 433 void moveStateResetFunctionsTest() {
 434   {
 435     A a;
 436     A b = std::move(a);
 437     a.reset(); // no-warning
 438     a.foo();   // no-warning
 439     // Test if resets the state of subregions as well.
 440     a.b.foo(); // no-warning
 441   }
 442   {
 443     A a;
 444     A b = std::move(a);
 445     a.destroy(); // no-warning
 446     a.foo();     // no-warning
 447   }
 448   {
 449     A a;
 450     A b = std::move(a);
 451     a.clear(); // no-warning
 452     a.foo();   // no-warning
 453     a.b.foo(); // no-warning
 454   }
 455   {
 456     A a;
 457     A b = std::move(a);
 458     a.resize(0); // no-warning
 459     a.foo();   // no-warning
 460     a.b.foo(); // no-warning
 461   }
 462   {
 463     A a;
 464     A b = std::move(a);
 465     a.assign(A()); // no-warning
 466     a.foo();   // no-warning
 467     a.b.foo(); // no-warning
 468   }
 469 }
 470
 471 // Moves or uses that occur as part of template arguments.
 472 template <int>
 473 class ClassTemplate {
 474 public:
 475   void foo(A a);
 476 };
 477
 478 template <int>
 479 void functionTemplate(A a);
 480
 481 void templateArgIsNotUseTest() {
 482   {
 483     // A pattern like this occurs in the EXPECT_EQ and ASSERT_EQ macros in
 484     // Google Test.
 485     A a;
 486     ClassTemplate<sizeof(A(std::move(a)))>().foo(std::move(a)); // no-warning
 487   }
 488   {
 489     A a;
 490     functionTemplate<sizeof(A(std::move(a)))>(std::move(a)); // no-warning
 491   }
 492 }
 493
 494 // Moves of global variables are not reported.
 495 A global_a;
 496 void globalVariablesTest() {
 497   (void)std::move(global_a);
 498   global_a.foo(); // no-warning
 499 }
 500
 501 // Moves of member variables.
 502 class memberVariablesTest {
 503   A a;
 504   static A static_a;
 505
 506   void f() {
 507     A b;
 508     b = std::move(a); // aggressive-note {{Object 'a' is moved}}
 509
 510     a.foo(); // aggressive-warning {{Method called on moved-from object 'a'}}
 511              // aggressive-note@-1 {{Method called on moved-from object 'a'}}
 512
 513     b = std::move(static_a); // aggressive-note {{Object 'static_a' is moved}}
 514     static_a.foo(); // aggressive-warning {{Method called on moved-from object 'static_a'}}
 515                     // aggressive-note@-1 {{Method called on moved-from object 'static_a'}}
 516   }
 517 };
 518
 519 void PtrAndArrayTest() {
 520   A *Ptr = new A(1, 1.5);
 521   A Arr[10];
 522   Arr[2] = std::move(*Ptr); // aggressive-note{{Object is moved}}
 523   (*Ptr).foo(); // aggressive-warning{{Method called on moved-from object}}
 524                 // aggressive-note@-1{{Method called on moved-from object}}
 525
 526   Ptr = &Arr[1];
 527   Arr[3] = std::move(Arr[1]); // aggressive-note {{Object is moved}}
 528   Ptr->foo(); // aggressive-warning {{Method called on moved-from object}}
 529               // aggressive-note@-1 {{Method called on moved-from object}}
 530
 531   Arr[3] = std::move(Arr[2]); // aggressive-note{{Object is moved}}
 532   Arr[2].foo(); // aggressive-warning{{Method called on moved-from object}}
 533                 // aggressive-note@-1{{Method called on moved-from object}}
 534
 535   Arr[2] = std::move(Arr[3]); // reinitialization
 536   Arr[2].foo();               // no-warning
 537 }
 538
 539 void exclusiveConditionsTest(bool cond) {
 540   A a;
 541   if (cond) {
 542     A b;
 543     b = std::move(a);
 544   }
 545   if (!cond) {
 546     a.bar(); // no-warning
 547   }
 548 }
 549
 550 void differentBranchesTest(int i) {
 551   // Don't warn if the use is in a different branch from the move.
 552   {
 553     A a;
 554     if (i > 0) { // peaceful-note {{Assuming 'i' is > 0}}
 555                  // peaceful-note@-1 {{Taking true branch}}
 556       A b;
 557       b = std::move(a);
 558     } else {
 559       a.foo(); // no-warning
 560     }
 561   }
 562   // Same thing, but with a ternary operator.
 563   {
 564     A a, b;
 565     i > 0 ? (void)(b = std::move(a)) : a.bar(); // no-warning
 566     // peaceful-note@-1 {{'i' is > 0}}
 567     // peaceful-note@-2 {{'?' condition is true}}
 568   }
 569   // A variation on the theme above.
 570   {
 571     A a;
 572     a.foo() > 0 ? a.foo() : A(std::move(a)).foo();
 573 #ifdef DFS
 574     // peaceful-note@-2 {{Assuming the condition is false}}
 575     // peaceful-note@-3 {{'?' condition is false}}
 576 #else
 577     // peaceful-note@-5 {{Assuming the condition is true}}
 578     // peaceful-note@-6 {{'?' condition is true}}
 579 #endif
 580   }
 581   // Same thing, but with a switch statement.
 582   {
 583     A a, b;
 584     switch (i) { // peaceful-note {{Control jumps to 'case 1:'}}
 585     case 1:
 586       b = std::move(a); // no-warning
 587       // FIXME: Execution doesn't jump to the end of the function yet.
 588       break; // peaceful-note {{Execution jumps to the end of the function}}
 589     case 2:
 590       a.foo(); // no-warning
 591       break;
 592     }
 593   }
 594   // However, if there's a fallthrough, we do warn.
 595   {
 596     A a, b;
 597     switch (i) { // peaceful-note {{Control jumps to 'case 1:'}}
 598     case 1:
 599       b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 600     case 2:
 601       a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 602                // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 603       break;
 604     }
 605   }
 606 }
 607
 608 void tempTest() {
 609   A a = A::get();
 610   A::get().foo(); // no-warning
 611   for (int i = 0; i < bignum(); i++) {
 612     A::get().foo(); // no-warning
 613   }
 614 }
 615
 616 void lifeTimeExtendTest() {
 617   A&& a = A{};
 618   A b = std::move(a); // peaceful-note {{Object is moved}}
 619
 620   a.foo(); // peaceful-warning {{Method called on moved-from object}}
 621            // peaceful-note@-1 {{Method called on moved-from object}}
 622 }
 623
 624 void interFunTest1(A &a) {
 625   a.bar(); // peaceful-warning {{Method called on moved-from object 'a'}}
 626            // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 627 }
 628
 629 void interFunTest2() {
 630   A a;
 631   A b;
 632   b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 633   interFunTest1(a); // peaceful-note {{Calling 'interFunTest1'}}
 634 }
 635
 636 void foobar(A a, int i);
 637 void foobar(int i, A a);
 638
 639 void paramEvaluateOrderTest() {
 640   A a;
 641   foobar(std::move(a), a.getI()); // peaceful-note {{Object 'a' is moved}}
 642                                   // peaceful-warning@-1 {{Method called on moved-from object 'a'}}
 643                                   // peaceful-note@-2    {{Method called on moved-from object 'a'}}
 644
 645   //FALSE NEGATIVE since parameters evaluate order is undefined
 646   foobar(a.getI(), std::move(a)); //no-warning
 647 }
 648
 649 void not_known_pass_by_ref(A &a);
 650 void not_known_pass_by_const_ref(const A &a);
 651 void not_known_pass_by_rvalue_ref(A &&a);
 652 void not_known_pass_by_ptr(A *a);
 653 void not_known_pass_by_const_ptr(const A *a);
 654
 655 void regionAndPointerEscapeTest() {
 656   {
 657     A a;
 658     A b;
 659     b = std::move(a);
 660     not_known_pass_by_ref(a);
 661     a.foo(); // no-warning
 662   }
 663   {
 664     A a;
 665     A b;
 666     b = std::move(a); // peaceful-note{{Object 'a' is moved}}
 667     not_known_pass_by_const_ref(a);
 668     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 669              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 670   }
 671   {
 672     A a;
 673     A b;
 674     b = std::move(a);
 675     not_known_pass_by_rvalue_ref(std::move(a));
 676     a.foo(); // no-warning
 677   }
 678   {
 679     A a;
 680     A b;
 681     b = std::move(a);
 682     not_known_pass_by_ptr(&a);
 683     a.foo(); // no-warning
 684   }
 685   {
 686     A a;
 687     A b;
 688     b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 689     not_known_pass_by_const_ptr(&a);
 690     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 691              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 692   }
 693 }
 694
 695 // A declaration statement containing multiple declarations sequences the
 696 // initializer expressions.
 697 void declarationSequenceTest() {
 698   {
 699     A a;
 700     A a1 = a, a2 = std::move(a); // no-warning
 701   }
 702   {
 703     A a;
 704     A a1 = std::move(a), a2 = a; // peaceful-note {{Object 'a' is moved}}
 705                                  // peaceful-warning@-1 {{Moved-from object 'a' is copied}}
 706                                  // peaceful-note@-2    {{Moved-from object 'a' is copied}}
 707   }
 708 }
 709
 710 // The logical operators && and || sequence their operands.
 711 void logicalOperatorsSequenceTest() {
 712   {
 713     A a;
 714     if (a.foo() > 0 && A(std::move(a)).foo() > 0) { // peaceful-note    {{Assuming the condition is false}}
 715                                                     // peaceful-note@-1 {{Left side of '&&' is false}}
 716                                                     // peaceful-note@-2 {{Taking false branch}}
 717                                                     // And the other report:
 718                                                     // peaceful-note@-4 {{Assuming the condition is false}}
 719                                                     // peaceful-note@-5 {{Left side of '&&' is false}}
 720                                                     // peaceful-note@-6 {{Taking false branch}}
 721       A().bar();
 722     }
 723   }
 724   // A variation: Negate the result of the && (which pushes the && further down
 725   // into the AST).
 726   {
 727     A a;
 728     if (!(a.foo() > 0 && A(std::move(a)).foo() > 0)) { // peaceful-note    {{Assuming the condition is false}}
 729                                                        // peaceful-note@-1 {{Left side of '&&' is false}}
 730                                                        // peaceful-note@-2 {{Taking true branch}}
 731                                                        // And the other report:
 732                                                        // peaceful-note@-4 {{Assuming the condition is false}}
 733                                                        // peaceful-note@-5 {{Left side of '&&' is false}}
 734                                                        // peaceful-note@-6 {{Taking true branch}}
 735       A().bar();
 736     }
 737   }
 738   {
 739     A a;
 740     if (A(std::move(a)).foo() > 0 && a.foo() > 0) { // peaceful-note    {{Object 'a' is moved}}
 741                                                     // peaceful-note@-1 {{Assuming the condition is true}}
 742                                                     // peaceful-note@-2 {{Left side of '&&' is true}}
 743                                                     // peaceful-warning@-3 {{Method called on moved-from object 'a'}}
 744                                                     // peaceful-note@-4    {{Method called on moved-from object 'a'}}
 745                                                     // And the other report:
 746                                                     // peaceful-note@-6 {{Assuming the condition is false}}
 747                                                     // peaceful-note@-7 {{Left side of '&&' is false}}
 748                                                     // peaceful-note@-8 {{Taking false branch}}
 749       A().bar();
 750     }
 751   }
 752   {
 753     A a;
 754     if (a.foo() > 0 || A(std::move(a)).foo() > 0) { // peaceful-note    {{Assuming the condition is true}}
 755                                                     // peaceful-note@-1 {{Left side of '||' is true}}
 756                                                     // peaceful-note@-2 {{Taking true branch}}
 757       A().bar();
 758     }
 759   }
 760   {
 761     A a;
 762     if (A(std::move(a)).foo() > 0 || a.foo() > 0) { // peaceful-note {{Object 'a' is moved}}
 763                                                     // peaceful-note@-1 {{Assuming the condition is false}}
 764                                                     // peaceful-note@-2 {{Left side of '||' is false}}
 765                                                     // peaceful-warning@-3 {{Method called on moved-from object 'a'}}
 766                                                     // peaceful-note@-4    {{Method called on moved-from object 'a'}}
 767       A().bar();
 768     }
 769   }
 770 }
 771
 772 // A range-based for sequences the loop variable declaration before the body.
 773 void forRangeSequencesTest() {
 774   A v[2] = {A(), A()};
 775   for (A &a : v) {
 776     A b;
 777     b = std::move(a); // no-warning
 778   }
 779 }
 780
 781 // If a variable is declared in an if statement, the declaration of the variable
 782 // (which is treated like a reinitialization by the check) is sequenced before
 783 // the evaluation of the condition (which constitutes a use).
 784 void ifStmtSequencesDeclAndConditionTest() {
 785   for (int i = 0; i < 3; ++i) {
 786     if (A a = A()) {
 787       A b;
 788       b = std::move(a); // no-warning
 789     }
 790   }
 791 }
 792
 793 struct C : public A {
 794   [[clang::reinitializes]] void reinit();
 795 };
 796
 797 void subRegionMoveTest() {
 798   {
 799     A a;
 800     B b = std::move(a.b); // aggressive-note {{Object 'b' is moved}}
 801     a.b.foo(); // aggressive-warning {{Method called on moved-from object 'b'}}
 802                // aggressive-note@-1 {{Method called on moved-from object 'b'}}
 803   }
 804   {
 805     A a;
 806     A a1 = std::move(a); // aggressive-note {{Calling move constructor for 'A'}}
 807                          // aggressive-note@-1 {{Returning from move constructor for 'A'}}
 808     a.b.foo(); // aggressive-warning{{Method called on moved-from object 'b'}}
 809                // aggressive-note@-1{{Method called on moved-from object 'b'}}
 810   }
 811   // Don't report a misuse if any SuperRegion is already reported.
 812   {
 813     A a;
 814     A a1 = std::move(a); // peaceful-note {{Object 'a' is moved}}
 815     a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 816              // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 817     a.b.foo(); // no-warning
 818   }
 819   {
 820     C c;
 821     C c1 = std::move(c); // peaceful-note {{Object 'c' is moved}}
 822     c.foo(); // peaceful-warning {{Method called on moved-from object 'c'}}
 823              // peaceful-note@-1 {{Method called on moved-from object 'c'}}
 824     c.b.foo(); // no-warning
 825   }
 826 }
 827
 828 void resetSuperClass() {
 829   C c;
 830   C c1 = std::move(c);
 831   c.clear();
 832   C c2 = c; // no-warning
 833 }
 834
 835 void resetSuperClass2() {
 836   C c;
 837   C c1 = std::move(c);
 838   c.reinit();
 839   C c2 = c; // no-warning
 840 }
 841
 842 void reportSuperClass() {
 843   C c;
 844   C c1 = std::move(c); // peaceful-note {{Object 'c' is moved}}
 845   c.foo(); // peaceful-warning {{Method called on moved-from object 'c'}}
 846            // peaceful-note@-1 {{Method called on moved-from object 'c'}}
 847   C c2 = c; // no-warning
 848 }
 849
 850 struct Empty {};
 851
 852 Empty inlinedCall() {
 853   // Used to warn because region 'e' failed to be cleaned up because no symbols
 854   // have ever died during the analysis and the checkDeadSymbols callback
 855   // was skipped entirely.
 856   Empty e{};
 857   return e; // no-warning
 858 }
 859
 860 void checkInlinedCallZombies() {
 861   while (true)
 862     inlinedCall();
 863 }
 864
 865 void checkLoopZombies() {
 866   while (true) {
 867     Empty e{};
 868     Empty f = std::move(e); // no-warning
 869   }
 870 }
 871
 872 void checkMoreLoopZombies1(bool flag) {
 873   while (flag) {
 874     Empty e{};
 875     if (true)
 876       e; // expected-warning {{expression result unused}}
 877     Empty f = std::move(e); // no-warning
 878   }
 879 }
 880
 881 bool coin();
 882
 883 void checkMoreLoopZombies2(bool flag) {
 884   while (flag) {
 885     Empty e{};
 886     while (coin())
 887       e; // expected-warning {{expression result unused}}
 888     Empty f = std::move(e); // no-warning
 889   }
 890 }
 891
 892 void checkMoreLoopZombies3(bool flag) {
 893   while (flag) {
 894     Empty e{};
 895     do
 896       e; // expected-warning {{expression result unused}}
 897     while (coin());
 898     Empty f = std::move(e); // no-warning
 899   }
 900 }
 901
 902 void checkMoreLoopZombies4(bool flag) {
 903   while (flag) {
 904     Empty e{};
 905     for (; coin();)
 906       e; // expected-warning {{expression result unused}}
 907     Empty f = std::move(e); // no-warning
 908   }
 909 }
 910
 911 void checkExplicitDestructorCalls() {
 912   // The below code segments invoke the destructor twice (explicit and
 913   // implicit). While this is not a desired code behavior, it is
 914   // not the use-after-move checker's responsibility to issue such a warning.
 915   {
 916      B* b = new B;
 917      B a = std::move(*b);
 918      b->~B(); // no-warning
 919      delete b;
 920   }
 921   {
 922     B a, b;
 923     new (&a) B(reinterpret_cast<B &&>(b));
 924     (&b)->~B(); // no-warning
 925   }
 926   {
 927     B b;
 928     B a  = std::move(b);
 929     b.~B(); // no-warning
 930   }
 931 }
 932
 933 struct MoveOnlyWithDestructor {
 934   MoveOnlyWithDestructor();
 935   ~MoveOnlyWithDestructor();
 936   MoveOnlyWithDestructor(const MoveOnlyWithDestructor &m) = delete;
 937   MoveOnlyWithDestructor(MoveOnlyWithDestructor &&m);
 938 };
 939
 940 MoveOnlyWithDestructor foo() {
 941   MoveOnlyWithDestructor m;
 942   return m;
 943 }
 944
 945 class HasSTLField {
 946   std::vector<int> V;
 947   void testVector() {
 948     // Warn even in non-aggressive mode when it comes to STL, because
 949     // in STL the object is left in "valid but unspecified state" after move.
 950     std::vector<int> W = std::move(V); // expected-note {{Object 'V' of type 'std::vector' is left in a valid but unspecified state after move}}
 951     V.push_back(123); // expected-warning {{Method called on moved-from object 'V'}}
 952                       // expected-note@-1 {{Method called on moved-from object 'V'}}
 953   }
 954
 955   std::unique_ptr<int> P;
 956   void testUniquePtr() {
 957     // unique_ptr remains in a well-defined state after move.
 958     std::unique_ptr<int> Q = std::move(P); // aggressive-note {{Object 'P' is moved}}
 959                                            // non-aggressive-note@-1 {{Smart pointer 'P' of type 'std::unique_ptr' is reset to null when moved from}}
 960     P.get(); // aggressive-warning{{Method called on moved-from object 'P'}}
 961              // aggressive-note@-1{{Method called on moved-from object 'P'}}
 962
 963     // Because that well-defined state is null, dereference is still UB.
 964     // Note that in aggressive mode we already warned about 'P',
 965     // so no extra warning is generated.
 966     *P += 1; // non-aggressive-warning{{Dereference of null smart pointer 'P' of type 'std::unique_ptr'}}
 967              // non-aggressive-note@-1{{Dereference of null smart pointer 'P' of type 'std::unique_ptr'}}
 968
 969     // The program should have crashed by now.
 970     clang_analyzer_warnIfReached(); // no-warning
 971   }
 972 };
 973
 974 void localRValueMove(A &&a) {
 975   A b = std::move(a); // peaceful-note {{Object 'a' is moved}}
 976   a.foo(); // peaceful-warning {{Method called on moved-from object 'a'}}
 977            // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 978 }
 979
 980 void localUniquePtr(std::unique_ptr<int> P) {
 981   // Even though unique_ptr is safe to use after move,
 982   // reusing a local variable this way usually indicates a bug.
 983   std::unique_ptr<int> Q = std::move(P); // peaceful-note {{Object 'P' is moved}}
 984   P.get(); // peaceful-warning {{Method called on moved-from object 'P'}}
 985            // peaceful-note@-1 {{Method called on moved-from object 'P'}}
 986 }
 987
 988 void localUniquePtrWithArrow(std::unique_ptr<A> P) {
 989   std::unique_ptr<A> Q = std::move(P); // expected-note{{Smart pointer 'P' of type 'std::unique_ptr' is reset to null when moved from}}
 990   P->foo(); // expected-warning{{Dereference of null smart pointer 'P' of type 'std::unique_ptr'}}
 991             // expected-note@-1{{Dereference of null smart pointer 'P' of type 'std::unique_ptr'}}
 992 }
 993
 994 void getAfterMove(std::unique_ptr<A> P) {
 995   std::unique_ptr<A> Q = std::move(P); // peaceful-note {{Object 'P' is moved}}
 996
 997   // TODO: Explain why (bool)P is false.
 998   if (P) // peaceful-note{{Taking false branch}}
 999     clang_analyzer_warnIfReached(); // no-warning
1000
1001   A *a = P.get(); // peaceful-warning {{Method called on moved-from object 'P'}}
1002                   // peaceful-note@-1 {{Method called on moved-from object 'P'}}
1003
1004   // TODO: Warn on a null dereference here.
1005   a->foo();
1006 }
1007
1008 struct OtherMoveSafeClasses {
1009   std::packaged_task<int(void)> Task;
1010
1011   void test() {
1012     // Test the suppression caused by use-after-move semantics of
1013     // std::package_task being different from other standard classes.
1014     // Only warn in aggressive mode. Don't say that the object
1015     // is left in unspecified state after move.
1016     std::packaged_task<int(void)> Task2 = std::move(Task);
1017     // aggressive-note@-1   {{Object 'Task' is moved}}
1018     std::packaged_task<int(void)> Task3 = std::move(Task);
1019     // aggressive-warning@-1{{Moved-from object 'Task' is moved}}
1020     // aggressive-note@-2   {{Moved-from object 'Task' is moved}}
1021   }
1022 };