1 // RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify -analyzer-config eagerly-assume=false %s
4 #define INT_MAX (int)(UINT_MAX & (UINT_MAX >> 1))
5 #define INT_MIN (int)(UINT_MAX & ~(UINT_MAX >> 1))
7 void clang_analyzer_eval(int);
9 // There should be no warnings unless otherwise indicated.
11 void testComparisons (int a
) {
12 // Sema can already catch the simple comparison a==a,
13 // since that's usually a logic error (and not path-dependent).
15 clang_analyzer_eval(b
== a
); // expected-warning{{TRUE}}
16 clang_analyzer_eval(b
>= a
); // expected-warning{{TRUE}}
17 clang_analyzer_eval(b
<= a
); // expected-warning{{TRUE}}
18 clang_analyzer_eval(b
!= a
); // expected-warning{{FALSE}}
19 clang_analyzer_eval(b
> a
); // expected-warning{{FALSE}}
20 clang_analyzer_eval(b
< a
); // expected-warning{{FALSE}}
23 void testSelfOperations (int a
) {
24 clang_analyzer_eval((a
|a
) == a
); // expected-warning{{TRUE}}
25 clang_analyzer_eval((a
&a
) == a
); // expected-warning{{TRUE}}
26 clang_analyzer_eval((a
^a
) == 0); // expected-warning{{TRUE}}
27 clang_analyzer_eval((a
-a
) == 0); // expected-warning{{TRUE}}
30 void testIdempotent (int a
) {
31 clang_analyzer_eval((a
*1) == a
); // expected-warning{{TRUE}}
32 clang_analyzer_eval((a
/1) == a
); // expected-warning{{TRUE}}
33 clang_analyzer_eval((a
+0) == a
); // expected-warning{{TRUE}}
34 clang_analyzer_eval((a
-0) == a
); // expected-warning{{TRUE}}
35 clang_analyzer_eval((a
<<0) == a
); // expected-warning{{TRUE}}
36 clang_analyzer_eval((a
>>0) == a
); // expected-warning{{TRUE}}
37 clang_analyzer_eval((a
^0) == a
); // expected-warning{{TRUE}}
38 clang_analyzer_eval((a
&(~0)) == a
); // expected-warning{{TRUE}}
39 clang_analyzer_eval((a
|0) == a
); // expected-warning{{TRUE}}
42 void testReductionToConstant (int a
) {
43 clang_analyzer_eval((a
*0) == 0); // expected-warning{{TRUE}}
44 clang_analyzer_eval((a
&0) == 0); // expected-warning{{TRUE}}
45 clang_analyzer_eval((a
|(~0)) == (~0)); // expected-warning{{TRUE}}
48 void testSymmetricIntSymOperations (int a
) {
49 clang_analyzer_eval((2+a
) == (a
+2)); // expected-warning{{TRUE}}
50 clang_analyzer_eval((2*a
) == (a
*2)); // expected-warning{{TRUE}}
51 clang_analyzer_eval((2&a
) == (a
&2)); // expected-warning{{TRUE}}
52 clang_analyzer_eval((2^a
) == (a
^2)); // expected-warning{{TRUE}}
53 clang_analyzer_eval((2|a
) == (a
|2)); // expected-warning{{TRUE}}
56 void testAsymmetricIntSymOperations (int a
) {
57 clang_analyzer_eval(((~0) >> a
) == (~0)); // expected-warning{{TRUE}}
58 clang_analyzer_eval((0 >> a
) == 0); // expected-warning{{TRUE}}
59 clang_analyzer_eval((0 << a
) == 0); // expected-warning{{TRUE}}
61 // Unsigned right shift shifts in zeroes.
62 clang_analyzer_eval(((~0U) >> a
) != (~0U)); // expected-warning{{UNKNOWN}}
65 void testLocations (char *a
) {
67 clang_analyzer_eval(b
== a
); // expected-warning{{TRUE}}
68 clang_analyzer_eval(b
>= a
); // expected-warning{{TRUE}}
69 clang_analyzer_eval(b
<= a
); // expected-warning{{TRUE}}
70 clang_analyzer_eval(b
!= a
); // expected-warning{{FALSE}}
71 clang_analyzer_eval(b
> a
); // expected-warning{{FALSE}}
72 clang_analyzer_eval(b
< a
); // expected-warning{{FALSE}}
75 void testMixedTypeComparisons (char a
, unsigned long b
) {
77 if (b
!= 0x100) return;
79 clang_analyzer_eval(a
<= b
); // expected-warning{{TRUE}}
80 clang_analyzer_eval(b
>= a
); // expected-warning{{TRUE}}
81 clang_analyzer_eval(a
!= b
); // expected-warning{{TRUE}}
84 void testBitwiseRules(unsigned int a
, int b
, int c
) {
85 clang_analyzer_eval((a
| 1) >= 1); // expected-warning{{TRUE}}
86 clang_analyzer_eval((a
| -1) >= -1); // expected-warning{{TRUE}}
87 clang_analyzer_eval((a
| 2) >= 2); // expected-warning{{TRUE}}
88 clang_analyzer_eval((a
| 5) >= 5); // expected-warning{{TRUE}}
89 clang_analyzer_eval((a
| 10) >= 10); // expected-warning{{TRUE}}
91 // Argument order should not influence this
92 clang_analyzer_eval((1 | a
) >= 1); // expected-warning{{TRUE}}
94 clang_analyzer_eval((a
& 1) <= 1); // expected-warning{{TRUE}}
95 clang_analyzer_eval((a
& 1) >= 0); // expected-warning{{TRUE}}
96 clang_analyzer_eval((a
& 2) <= 2); // expected-warning{{TRUE}}
97 clang_analyzer_eval((a
& 5) <= 5); // expected-warning{{TRUE}}
98 clang_analyzer_eval((a
& 10) <= 10); // expected-warning{{TRUE}}
99 clang_analyzer_eval((a
& -10) <= 10); // expected-warning{{UNKNOWN}}
101 // Again, check for different argument order.
102 clang_analyzer_eval((1 & a
) <= 1); // expected-warning{{TRUE}}
106 clang_analyzer_eval((d
| 0) == 0); // expected-warning{{FALSE}}
108 // Rules don't apply to signed typed, as the values might be negative.
109 clang_analyzer_eval((b
| 1) > 0); // expected-warning{{UNKNOWN}}
111 // Even for signed values, bitwise OR with a non-zero is always non-zero.
112 clang_analyzer_eval((b
| 1) == 0); // expected-warning{{FALSE}}
113 clang_analyzer_eval((b
| -2) == 0); // expected-warning{{FALSE}}
114 clang_analyzer_eval((b
| 10) == 0); // expected-warning{{FALSE}}
115 clang_analyzer_eval((b
| 0) == 0); // expected-warning{{UNKNOWN}}
116 clang_analyzer_eval((b
| -2) >= 0); // expected-warning{{FALSE}}
118 // Check that we can operate with negative ranges
120 clang_analyzer_eval((b
| -1) == -1); // expected-warning{{TRUE}}
121 clang_analyzer_eval((b
| -10) >= -10); // expected-warning{{TRUE}}
122 clang_analyzer_eval((b
& 0) == 0); // expected-warning{{TRUE}}
123 clang_analyzer_eval((b
& -10) <= -10); // expected-warning{{TRUE}}
124 clang_analyzer_eval((b
& 5) >= 0); // expected-warning{{TRUE}}
127 clang_analyzer_eval(e
>= -5 && e
<= -1); // expected-warning{{TRUE}}
130 clang_analyzer_eval((b
| e
) >= -5); // expected-warning{{TRUE}}
131 clang_analyzer_eval((b
& -10) < -20); // expected-warning{{TRUE}}
132 clang_analyzer_eval((b
& e
) < -20); // expected-warning{{TRUE}}
133 clang_analyzer_eval((b
& -30) <= -30); // expected-warning{{TRUE}}
135 if (c
>= -30 && c
<= -10) {
136 clang_analyzer_eval((b
& c
) <= -20); // expected-warning{{TRUE}}
142 clang_analyzer_eval(g
<= 40 && g
>= 0); // expected-warning{{TRUE}}
145 // Check that we can reason about the result even if know nothing
146 // about one of the operands.
147 clang_analyzer_eval((b
| c
) != 0); // expected-warning{{TRUE}}
150 if (a
<= 30 && b
>= 10 && c
>= 20) {
151 // Check that we can reason about non-constant operands.
152 clang_analyzer_eval((b
| c
) >= 20); // expected-warning{{TRUE}}
154 // Check that we can reason about the resulting range even if
155 // the types are not the same, but we still can convert operand
157 clang_analyzer_eval((a
| b
) >= 10); // expected-warning{{TRUE}}
158 clang_analyzer_eval((a
& b
) <= 30); // expected-warning{{TRUE}}
161 clang_analyzer_eval((a
& b
) <= 20); // expected-warning{{TRUE}}
165 // Check that dynamically computed constants also work.
166 unsigned int constant
= 1 << 3;
167 unsigned int f
= a
| constant
;
168 clang_analyzer_eval(f
>= constant
); // expected-warning{{TRUE}}
170 // Check that nested expressions also work.
171 clang_analyzer_eval(((a
| 10) | 5) >= 10); // expected-warning{{TRUE}}
174 clang_analyzer_eval((a
| 20) >= 20); // expected-warning{{TRUE}}
178 clang_analyzer_eval((a
& 1) <= 1); // expected-warning{{TRUE}}
182 unsigned reset(void);
184 void testCombinedSources(unsigned a
, unsigned b
) {
185 if (b
>= 10 && (a
| b
) <= 30) {
186 // Check that we can merge constraints from (a | b), a, and b.
187 // Because of the order of assumptions, we already know that (a | b) is [10, 30].
188 clang_analyzer_eval((a
| b
) >= 10 && (a
| b
) <= 30); // expected-warning{{TRUE}}
194 if ((a
| b
) <= 30 && b
>= 10) {
195 // Check that we can merge constraints from (a | b), a, and b.
196 // At this point, we know that (a | b) is [0, 30], but the knowledge
197 // of b >= 10 added later can help us to refine it and change it to [10, 30].
198 clang_analyzer_eval(10 <= (a
| b
) && (a
| b
) <= 30); // expected-warning{{TRUE}}
204 unsigned c
= (a
| b
) & (a
!= b
);
205 if (c
<= 40 && a
== b
) {
206 // Even though we have a directo constraint for c [0, 40],
207 // we can get a more precise range by looking at the expression itself.
208 clang_analyzer_eval(c
== 0); // expected-warning{{TRUE}}
212 void testRemainderRules(unsigned int a
, unsigned int b
, int c
, int d
) {
213 // Check that we know that remainder of zero divided by any number is still 0.
214 clang_analyzer_eval((0 % c
) == 0); // expected-warning{{TRUE}}
216 clang_analyzer_eval((10 % a
) <= 10); // expected-warning{{TRUE}}
218 if (a
<= 30 && b
<= 50) {
219 clang_analyzer_eval((40 % a
) < 30); // expected-warning{{TRUE}}
220 clang_analyzer_eval((a
% b
) < 50); // expected-warning{{TRUE}}
221 clang_analyzer_eval((b
% a
) < 30); // expected-warning{{TRUE}}
224 // Even though it seems like a valid assumption, it is not.
225 // Check that we are not making this mistake.
226 clang_analyzer_eval((a
% b
) >= 10); // expected-warning{{UNKNOWN}}
228 // Check that we can we can infer when remainder is equal
230 clang_analyzer_eval((4 % a
) == 4); // expected-warning{{TRUE}}
232 clang_analyzer_eval((b
% a
) < 7); // expected-warning{{TRUE}}
238 clang_analyzer_eval((d
% c
) < INT_MAX
); // expected-warning{{TRUE}}
239 clang_analyzer_eval((d
% c
) > INT_MIN
+ 1); // expected-warning{{TRUE}}
242 // Check that we can reason about signed integers when they are
243 // known to be positive.
244 if (c
>= 10 && c
<= 30 && d
>= 20 && d
<= 50) {
245 clang_analyzer_eval((5 % c
) == 5); // expected-warning{{TRUE}}
246 clang_analyzer_eval((c
% d
) <= 30); // expected-warning{{TRUE}}
247 clang_analyzer_eval((c
% d
) >= 0); // expected-warning{{TRUE}}
248 clang_analyzer_eval((d
% c
) < 30); // expected-warning{{TRUE}}
249 clang_analyzer_eval((d
% c
) >= 0); // expected-warning{{TRUE}}
252 if (c
>= -30 && c
<= -10 && d
>= -20 && d
<= 50) {
253 // Test positive LHS with negative RHS.
254 clang_analyzer_eval((40 % c
) < 30); // expected-warning{{TRUE}}
255 clang_analyzer_eval((40 % c
) > -30); // expected-warning{{TRUE}}
257 // Test negative LHS with possibly negative RHS.
258 clang_analyzer_eval((-10 % d
) < 50); // expected-warning{{TRUE}}
259 clang_analyzer_eval((-20 % d
) > -50); // expected-warning{{TRUE}}
261 // Check that we don't make wrong assumptions
262 clang_analyzer_eval((-20 % d
) > -20); // expected-warning{{UNKNOWN}}
264 // Check that we can reason about negative ranges...
265 clang_analyzer_eval((c
% d
) < 50); // expected-warning{{TRUE}}
267 clang_analyzer_eval((d
% c
) < 30); // expected-warning{{TRUE}}
270 // Result is unsigned. This means that 'c' is casted to unsigned.
271 // We don't want to reason about ranges changing boundaries with
273 clang_analyzer_eval((a
% c
) < 30); // expected-warning{{UNKNOWN}}
277 // Check that we work correctly when minimal unsigned value from a range is
278 // equal to the signed minimum for the same bit width.
279 unsigned int x
= INT_MIN
;
280 if (a
>= x
&& a
<= x
+ 10) {
281 clang_analyzer_eval((b
% a
) < x
+ 10); // expected-warning{{TRUE}}