clang/test/Analysis/cfg.cpp

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=debug.DumpCFG -triple x86_64-apple-darwin12 -Wno-error=invalid-gnu-asm-cast -std=c++11 -analyzer-config cfg-rich-constructors=false %s > %t 2>&1
   2 // RUN: FileCheck --input-file=%t -check-prefixes=CHECK,WARNINGS %s
   3 // RUN: %clang_analyze_cc1 -analyzer-checker=debug.DumpCFG -triple x86_64-apple-darwin12 -Wno-error=invalid-gnu-asm-cast -std=c++11 -analyzer-config cfg-rich-constructors=true %s > %t 2>&1
   4 // RUN: FileCheck --input-file=%t -check-prefixes=CHECK,ANALYZER %s
   5
   6 // This file tests how we construct two different flavors of the Clang CFG -
   7 // the CFG used by the Sema analysis-based warnings and the CFG used by the
   8 // static analyzer. The difference in the behavior is checked via FileCheck
   9 // prefixes (WARNINGS and ANALYZER respectively). When introducing new analyzer
  10 // flags, no new run lines should be added - just these flags would go to the
  11 // respective line depending on where is it turned on and where is it turned
  12 // off. Feel free to add tests that test only one of the CFG flavors if you're
  13 // not sure how the other flavor is supposed to work in your case.
  14
  15 // CHECK-LABEL: void checkDeclStmts()
  16 // CHECK: ENTRY
  17 // CHECK-NEXT: Succs (1): B1
  18 // CHECK: [B1]
  19 // CHECK-NEXT:   1: int i;
  20 // CHECK-NEXT:   2: int j;
  21 // CHECK-NEXT:   3: 1
  22 // CHECK-NEXT:   4: int k = 1;
  23 // CHECK-NEXT:   5: int l;
  24 // CHECK-NEXT:   6: 2
  25 // CHECK-NEXT:   7: int m = 2;
  26 // WARNINGS-NEXT: (CXXConstructExpr, struct standalone)
  27 // ANALYZER-NEXT: (CXXConstructExpr, [B1.9], struct standalone)
  28 // CHECK-NEXT:   9: struct standalone myStandalone;
  29 // WARNINGS-NEXT: (CXXConstructExpr, struct (unnamed struct at {{.*}}))
  30 // ANALYZER-NEXT: (CXXConstructExpr, [B1.11], struct (unnamed struct at {{.*}}))
  31 // CHECK-NEXT:  11: struct (unnamed struct at {{.*}}) myAnon;
  32 // WARNINGS-NEXT: (CXXConstructExpr, struct named)
  33 // ANALYZER-NEXT: (CXXConstructExpr, [B1.13], struct named)
  34 // CHECK-NEXT:  13: struct named myNamed;
  35 // CHECK-NEXT:   Preds (1): B2
  36 // CHECK-NEXT:   Succs (1): B0
  37 void checkDeclStmts() {
  38   int i, j;
  39   int k = 1, l, m = 2;
  40
  41   struct standalone { int x, y; };
  42   struct standalone myStandalone;
  43
  44   struct { int x, y; } myAnon;
  45
  46   struct named { int x, y; } myNamed;
  47
  48   static_assert(1, "abc");
  49 }
  50
  51 // CHECK-LABEL: void F(EmptyE e)
  52 // CHECK: ENTRY
  53 // CHECK-NEXT: Succs (1): B1
  54 // CHECK: [B1]
  55 // CHECK-NEXT:   1: e
  56 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, LValueToRValue, EmptyE)
  57 // CHECK-NEXT:   3: [B1.2] (ImplicitCastExpr, IntegralCast, int)
  58 // CHECK-NEXT:   T: switch [B1.3]
  59 // CHECK-NEXT:   Preds (1): B2
  60 // CHECK-NEXT:   Succs (1): B0
  61 // CHECK: [B0 (EXIT)]
  62 // CHECK-NEXT:   Preds (1): B1
  63 enum EmptyE {};
  64 void F(EmptyE e) {
  65   switch (e) {}
  66 }
  67
  68 // CHECK-LABEL: void testBuiltinSize()
  69 // CHECK: ENTRY
  70 // CHECK-NEXT: Succs (1): B1
  71 // CHECK: [B1]
  72 // CHECK-NEXT:   1: __builtin_object_size
  73 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, BuiltinFnToFnPtr, unsigned long (*)(const void *, int) noexcept)
  74 // CHECK-NEXT:   3: [B1.2](dummy(), 0)
  75 // CHECK-NEXT:   4: (void)[B1.3] (CStyleCastExpr, ToVoid, void)
  76 // CHECK-NEXT:   Preds (1): B2
  77 // CHECK-NEXT:   Succs (1): B0
  78 // CHECK: [B0 (EXIT)]
  79 // CHECK-NEXT:   Preds (1): B1
  80 void testBuiltinSize() {
  81   extern int *dummy();
  82   (void)__builtin_object_size(dummy(), 0);
  83 }
  84
  85 class A {
  86 public:
  87   A() {}
  88   ~A() {}
  89 };
  90
  91 // CHECK-LABEL: void test_deletedtor()
  92 // CHECK: [B2 (ENTRY)]
  93 // CHECK-NEXT:   Succs (1): B1
  94 // CHECK: [B1]
  95 // CHECK-NEXT:   1:  CFGNewAllocator(A *)
  96 // WARNINGS-NEXT:   2:  (CXXConstructExpr, A)
  97 // ANALYZER-NEXT:   2:  (CXXConstructExpr, [B1.3], A)
  98 // CHECK-NEXT:   3: new A([B1.2])
  99 // CHECK-NEXT:   4: A *a = new A();
 100 // CHECK-NEXT:   5: a
 101 // CHECK-NEXT:   6: [B1.5] (ImplicitCastExpr, LValueToRValue, A *)
 102 // CHECK-NEXT:   7: [B1.6]->~A() (Implicit destructor)
 103 // CHECK-NEXT:   8: delete [B1.6]
 104 // CHECK-NEXT:   Preds (1): B2
 105 // CHECK-NEXT:   Succs (1): B0
 106 // CHECK: [B0 (EXIT)]
 107 // CHECK-NEXT:   Preds (1): B1
 108 void test_deletedtor() {
 109   A *a = new A();
 110   delete a;
 111 }
 112
 113 // CHECK-LABEL: void test_deleteArraydtor()
 114 // CHECK: [B2 (ENTRY)]
 115 // CHECK-NEXT:   Succs (1): B1
 116 // CHECK: [B1]
 117 // CHECK-NEXT:   1: 5
 118 // CHECK-NEXT:   2: CFGNewAllocator(A *)
 119 // WARNINGS-NEXT:   3:  (CXXConstructExpr, A[5])
 120 // ANALYZER-NEXT:   3:  (CXXConstructExpr, [B1.4], A[5])
 121 // CHECK-NEXT:   4: new A {{\[\[}}B1.1]]
 122 // CHECK-NEXT:   5: A *a = new A [5];
 123 // CHECK-NEXT:   6: a
 124 // CHECK-NEXT:   7: [B1.6] (ImplicitCastExpr, LValueToRValue, A *)
 125 // CHECK-NEXT:   8: [B1.7]->~A() (Implicit destructor)
 126 // CHECK-NEXT:   9: delete [] [B1.7]
 127 // CHECK-NEXT:   Preds (1): B2
 128 // CHECK-NEXT:   Succs (1): B0
 129 // CHECK: [B0 (EXIT)]
 130 // CHECK-NEXT:   Preds (1): B1
 131 void test_deleteArraydtor() {
 132   A *a = new A[5];
 133   delete[] a;
 134 }
 135
 136
 137 namespace NoReturnSingleSuccessor {
 138   struct A {
 139     A();
 140     ~A();
 141   };
 142
 143   struct B : public A {
 144     B();
 145     ~B() __attribute__((noreturn));
 146   };
 147
 148 // CHECK-LABEL: int test1(int *x)
 149 // CHECK: 1: 1
 150 // CHECK-NEXT: 2: return
 151 // CHECK-NEXT: ~B() (Implicit destructor)
 152 // CHECK-NEXT: Preds (1)
 153 // CHECK-NEXT: Succs (1): B0
 154   int test1(int *x) {
 155     B b;
 156     if (x)
 157       return 1;
 158   }
 159
 160 // CHECK-LABEL: int test2(int *x)
 161 // CHECK: 1: 1
 162 // CHECK-NEXT: 2: return
 163 // CHECK-NEXT: destructor
 164 // CHECK-NEXT: Preds (1)
 165 // CHECK-NEXT: Succs (1): B0
 166   int test2(int *x) {
 167     const A& a = B();
 168     if (x)
 169       return 1;
 170   }
 171 }
 172
 173 // Test CFG support for "extending" an enum.
 174 // CHECK-LABEL: int test_enum_with_extension(enum MyEnum value)
 175 // CHECK:  [B7 (ENTRY)]
 176 // CHECK-NEXT:    Succs (1): B2
 177 // CHECK:  [B1]
 178 // CHECK-NEXT:    1: x
 179 // CHECK-NEXT:    2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 180 // CHECK-NEXT:    3: return [B1.2];
 181 // CHECK-NEXT:    Preds (5): B3 B4 B5 B6 B2(Unreachable)
 182 // CHECK-NEXT:    Succs (1): B0
 183 // CHECK:  [B2]
 184 // CHECK-NEXT:    1: 0
 185 // CHECK-NEXT:    2: int x = 0;
 186 // CHECK-NEXT:    3: value
 187 // CHECK-NEXT:    4: [B2.3] (ImplicitCastExpr, LValueToRValue, enum MyEnum)
 188 // CHECK-NEXT:    5: [B2.4] (ImplicitCastExpr, IntegralCast, int)
 189 // CHECK-NEXT:    T: switch [B2.5]
 190 // CHECK-NEXT:    Preds (1): B7
 191 // CHECK-NEXT:    Succs (5): B3 B4 B5 B6 B1(Unreachable)
 192 // CHECK:  [B3]
 193 // CHECK-NEXT:   case D:
 194 // CHECK-NEXT:    1: 4
 195 // CHECK-NEXT:    2: x
 196 // CHECK-NEXT:    3: [B3.2] = [B3.1]
 197 // CHECK-NEXT:    T: break;
 198 // CHECK-NEXT:    Preds (1): B2
 199 // CHECK-NEXT:    Succs (1): B1
 200 // CHECK:  [B4]
 201 // CHECK-NEXT:   case C:
 202 // CHECK-NEXT:    1: 3
 203 // CHECK-NEXT:    2: x
 204 // CHECK-NEXT:    3: [B4.2] = [B4.1]
 205 // CHECK-NEXT:    T: break;
 206 // CHECK-NEXT:    Preds (1): B2
 207 // CHECK-NEXT:    Succs (1): B1
 208 // CHECK:  [B5]
 209 // CHECK-NEXT:   case B:
 210 // CHECK-NEXT:    1: 2
 211 // CHECK-NEXT:    2: x
 212 // CHECK-NEXT:    3: [B5.2] = [B5.1]
 213 // CHECK-NEXT:    T: break;
 214 // CHECK-NEXT:    Preds (1): B2
 215 // CHECK-NEXT:    Succs (1): B1
 216 // CHECK:  [B6]
 217 // CHECK-NEXT:   case A:
 218 // CHECK-NEXT:    1: 1
 219 // CHECK-NEXT:    2: x
 220 // CHECK-NEXT:    3: [B6.2] = [B6.1]
 221 // CHECK-NEXT:    T: break;
 222 // CHECK-NEXT:    Preds (1): B2
 223 // CHECK-NEXT:    Succs (1): B1
 224 // CHECK:  [B0 (EXIT)]
 225 // CHECK-NEXT:    Preds (1): B1
 226 enum MyEnum : int { A, B, C };
 227 static const enum MyEnum D = (enum MyEnum) 32;
 228
 229 int test_enum_with_extension(enum MyEnum value) {
 230   int x = 0;
 231   switch (value) {
 232     case A: x = 1; break;
 233     case B: x = 2; break;
 234     case C: x = 3; break;
 235     case D: x = 4; break;
 236   }
 237   return x;
 238 }
 239
 240 // CHECK-LABEL: int test_enum_with_extension_default(enum MyEnum value)
 241 // CHECK:  [B7 (ENTRY)]
 242 // CHECK-NEXT:    Succs (1): B2
 243 // CHECK:  [B1]
 244 // CHECK-NEXT:    1: x
 245 // CHECK-NEXT:    2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 246 // CHECK-NEXT:    3: return [B1.2];
 247 // CHECK-NEXT:    Preds (4): B3 B4 B5 B6
 248 // CHECK-NEXT:    Succs (1): B0
 249 // CHECK:  [B2]
 250 // CHECK-NEXT:    1: 0
 251 // CHECK-NEXT:    2: int x = 0;
 252 // CHECK-NEXT:    3: value
 253 // CHECK-NEXT:    4: [B2.3] (ImplicitCastExpr, LValueToRValue, enum MyEnum)
 254 // CHECK-NEXT:    5: [B2.4] (ImplicitCastExpr, IntegralCast, int)
 255 // CHECK-NEXT:    T: switch [B2.5]
 256 // CHECK-NEXT:    Preds (1): B7
 257 // CHECK-NEXT:    Succs (4): B4 B5 B6 B3(Unreachable)
 258 // CHECK:  [B3]
 259 // CHECK-NEXT:   default:
 260 // CHECK-NEXT:    1: 4
 261 // CHECK-NEXT:    2: x
 262 // CHECK-NEXT:    3: [B3.2] = [B3.1]
 263 // CHECK-NEXT:    T: break;
 264 // CHECK-NEXT:    Preds (1): B2(Unreachable)
 265 // CHECK-NEXT:    Succs (1): B1
 266 // CHECK:  [B4]
 267 // CHECK-NEXT:   case C:
 268 // CHECK-NEXT:    1: 3
 269 // CHECK-NEXT:    2: x
 270 // CHECK-NEXT:    3: [B4.2] = [B4.1]
 271 // CHECK-NEXT:    T: break;
 272 // CHECK-NEXT:    Preds (1): B2
 273 // CHECK-NEXT:    Succs (1): B1
 274 // CHECK:  [B5]
 275 // CHECK-NEXT:   case B:
 276 // CHECK-NEXT:    1: 2
 277 // CHECK-NEXT:    2: x
 278 // CHECK-NEXT:    3: [B5.2] = [B5.1]
 279 // CHECK-NEXT:    T: break;
 280 // CHECK-NEXT:    Preds (1): B2
 281 // CHECK-NEXT:    Succs (1): B1
 282 // CHECK:  [B6]
 283 // CHECK-NEXT:   case A:
 284 // CHECK-NEXT:    1: 1
 285 // CHECK-NEXT:    2: x
 286 // CHECK-NEXT:    3: [B6.2] = [B6.1]
 287 // CHECK-NEXT:    T: break;
 288 // CHECK-NEXT:    Preds (1): B2
 289 // CHECK-NEXT:    Succs (1): B1
 290 // CHECK:  [B0 (EXIT)]
 291 // CHECK-NEXT:    Preds (1): B1
 292 int test_enum_with_extension_default(enum MyEnum value) {
 293   int x = 0;
 294   switch (value) {
 295     case A: x = 1; break;
 296     case B: x = 2; break;
 297     case C: x = 3; break;
 298     default: x = 4; break;
 299   }
 300   return x;
 301 }
 302
 303 // CHECK-LABEL: void test_placement_new()
 304 // CHECK:  [B2 (ENTRY)]
 305 // CHECK-NEXT:  Succs (1): B1
 306 // CHECK:  [B1]
 307 // CHECK-NEXT:  1: int buffer[16];
 308 // CHECK-NEXT:  2: buffer
 309 // CHECK-NEXT:  3: [B1.2] (ImplicitCastExpr, ArrayToPointerDecay, int *)
 310 // CHECK-NEXT:  4: [B1.3] (ImplicitCastExpr, BitCast, void *)
 311 // CHECK-NEXT:  5: CFGNewAllocator(MyClass *)
 312 // WARNINGS-NEXT:  6:  (CXXConstructExpr, MyClass)
 313 // ANALYZER-NEXT:  6:  (CXXConstructExpr, [B1.7], MyClass)
 314 // CHECK-NEXT:  7: new ([B1.4]) MyClass([B1.6])
 315 // CHECK-NEXT:  8: MyClass *obj = new (buffer) MyClass();
 316 // CHECK-NEXT:  Preds (1): B2
 317 // CHECK-NEXT:  Succs (1): B0
 318 // CHECK: [B0 (EXIT)]
 319 // CHECK-NEXT:  Preds (1): B1
 320
 321 extern void* operator new (unsigned long sz, void* v);
 322 extern void* operator new[] (unsigned long sz, void* ptr);
 323
 324 class MyClass {
 325 public:
 326   MyClass() {}
 327   ~MyClass() {}
 328 };
 329
 330 void test_placement_new() {
 331   int buffer[16];
 332   MyClass* obj = new (buffer) MyClass();
 333 }
 334
 335 // CHECK-LABEL: void test_placement_new_array()
 336 // CHECK:  [B2 (ENTRY)]
 337 // CHECK-NEXT:  Succs (1): B1
 338 // CHECK: [B1]
 339 // CHECK-NEXT:  1: int buffer[16];
 340 // CHECK-NEXT:  2: buffer
 341 // CHECK-NEXT:  3: [B1.2] (ImplicitCastExpr, ArrayToPointerDecay, int *)
 342 // CHECK-NEXT:  4: [B1.3] (ImplicitCastExpr, BitCast, void *)
 343 // CHECK-NEXT:  5: 5
 344 // CHECK-NEXT:  6: CFGNewAllocator(MyClass *)
 345 // WARNINGS-NEXT:  7:  (CXXConstructExpr, MyClass[5])
 346 // ANALYZER-NEXT:  7:  (CXXConstructExpr, [B1.8], MyClass[5])
 347 // CHECK-NEXT:  8: new ([B1.4]) MyClass {{\[\[}}B1.5]]
 348 // CHECK-NEXT:  9: MyClass *obj = new (buffer) MyClass [5];
 349 // CHECK-NEXT:  Preds (1): B2
 350 // CHECK-NEXT:  Succs (1): B0
 351 // CHECK: [B0 (EXIT)]
 352 // CHECK-NEXT:  Preds (1): B1
 353
 354 void test_placement_new_array() {
 355   int buffer[16];
 356   MyClass* obj = new (buffer) MyClass[5];
 357 }
 358
 359
 360 // CHECK-LABEL: void test_lifetime_extended_temporaries()
 361 // CHECK: [B1]
 362 struct LifetimeExtend { LifetimeExtend(int); ~LifetimeExtend(); };
 363 struct Aggregate { const LifetimeExtend a; const LifetimeExtend b; };
 364 struct AggregateRef { const LifetimeExtend &a; const LifetimeExtend &b; };
 365 void test_lifetime_extended_temporaries() {
 366   // CHECK: LifetimeExtend(1);
 367   // CHECK-NEXT: : 1
 368   // CHECK-NEXT: ~LifetimeExtend()
 369   // CHECK-NOT: ~LifetimeExtend()
 370   {
 371     const LifetimeExtend &l = LifetimeExtend(1);
 372     1;
 373   }
 374   // CHECK: LifetimeExtend(2)
 375   // CHECK-NEXT: ~LifetimeExtend()
 376   // CHECK-NEXT: : 2
 377   // CHECK-NOT: ~LifetimeExtend()
 378   {
 379     // No life-time extension.
 380     const int &l = (LifetimeExtend(2), 2);
 381     2;
 382   }
 383   // CHECK: LifetimeExtend(3)
 384   // CHECK-NEXT: : 3
 385   // CHECK-NEXT: ~LifetimeExtend()
 386   // CHECK-NOT: ~LifetimeExtend()
 387   {
 388     // The last one is lifetime extended.
 389     const LifetimeExtend &l = (3, LifetimeExtend(3));
 390     3;
 391   }
 392   // CHECK: LifetimeExtend(4)
 393   // CHECK-NEXT: ~LifetimeExtend()
 394   // CHECK-NEXT: ~LifetimeExtend()
 395   // CHECK-NEXT: : 4
 396   // CHECK-NOT: ~LifetimeExtend()
 397   {
 398     Aggregate a{LifetimeExtend(4), LifetimeExtend(4)};
 399     4;
 400   }
 401   // CHECK: LifetimeExtend(5)
 402   // CHECK-NEXT: : 5
 403   // FIXME: We want to emit the destructors of the lifetime
 404   // extended variables here.
 405   // CHECK-NOT: ~LifetimeExtend()
 406   {
 407     AggregateRef a{LifetimeExtend(5), LifetimeExtend(5)};
 408     5;
 409   }
 410   // FIXME: Add tests for lifetime extension via subobject
 411   // references (LifetimeExtend().some_member).
 412 }
 413
 414
 415 // FIXME: The destructor for 'a' shouldn't be there because it's deleted
 416 // in the union.
 417 // CHECK-LABEL: void foo()
 418 // CHECK:  [B2 (ENTRY)]
 419 // CHECK-NEXT:    Succs (1): B1
 420 // CHECK:  [B1]
 421 // WARNINGS-NEXT:    1:  (CXXConstructExpr, A)
 422 // ANALYZER-NEXT:    1:  (CXXConstructExpr, [B1.2], A)
 423 // CHECK-NEXT:    2: A a;
 424 // CHECK-NEXT:    3: [B1.2].~A() (Implicit destructor)
 425 // CHECK-NEXT:    Preds (1): B2
 426 // CHECK-NEXT:    Succs (1): B0
 427 // CHECK:  [B0 (EXIT)]
 428 // CHECK-NEXT:    Preds (1): B1
 429
 430 namespace pr37688_deleted_union_destructor {
 431 struct S { ~S(); };
 432 struct A {
 433   ~A() noexcept {}
 434   union {
 435     struct {
 436       S s;
 437     } ss;
 438   };
 439 };
 440 void foo() {
 441   A a;
 442 }
 443 } // end namespace pr37688_deleted_union_destructor
 444
 445
 446 namespace return_statement_expression {
 447 int unknown();
 448
 449 // CHECK-LABEL: int foo()
 450 // CHECK:       [B6 (ENTRY)]
 451 // CHECK-NEXT:    Succs (1): B5
 452 // CHECK:       [B1]
 453 // CHECK-NEXT:    1: 0
 454 // CHECK-NEXT:    2: return [B1.1];
 455 // CHECK-NEXT:    Preds (1): B5
 456 // CHECK-NEXT:    Succs (1): B0
 457 // CHECK:       [B2]
 458 // CHECK-NEXT:    1: 0
 459 // CHECK-NEXT:    2: ({ ... ; [B2.1] })
 460 // CHECK-NEXT:    3: return [B2.2];
 461 // CHECK-NEXT:    Preds (1): B4
 462 // CHECK-NEXT:    Succs (1): B0
 463 // FIXME: Why do we have [B3] at all?
 464 // CHECK:       [B3]
 465 // CHECK-NEXT:    Succs (1): B4
 466 // CHECK:       [B4]
 467 // CHECK-NEXT:    1: 0
 468 // CHECK-NEXT:    2: [B4.1] (ImplicitCastExpr, IntegralToBoolean, _Bool)
 469 // CHECK-NEXT:    T: while [B4.2]
 470 // CHECK-NEXT:    Preds (2): B3 B5
 471 // CHECK-NEXT:    Succs (2): NULL B2
 472 // CHECK:       [B5]
 473 // CHECK-NEXT:    1: unknown
 474 // CHECK-NEXT:    2: [B5.1] (ImplicitCastExpr, FunctionToPointerDecay, int (*)(void))
 475 // CHECK-NEXT:    3: [B5.2]()
 476 // CHECK-NEXT:    4: [B5.3] (ImplicitCastExpr, IntegralToBoolean, _Bool)
 477 // CHECK-NEXT:    T: if [B5.4]
 478 // CHECK-NEXT:    Preds (1): B6
 479 // CHECK-NEXT:    Succs (2): B4 B1
 480 // CHECK:       [B0 (EXIT)]
 481 // CHECK-NEXT:    Preds (2): B1 B2
 482 int foo() {
 483   if (unknown())
 484     return ({
 485       while (0)
 486         ;
 487       0;
 488     });
 489   else
 490     return 0;
 491 }
 492 } // namespace statement_expression_in_return
 493
 494 // CHECK-LABEL: void vla_simple(int x)
 495 // CHECK: [B1]
 496 // CHECK-NEXT:   1: x
 497 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 498 // CHECK-NEXT:   3: int vla[x];
 499 void vla_simple(int x) {
 500   int vla[x];
 501 }
 502
 503 // CHECK-LABEL: void vla_typedef(int x)
 504 // CHECK: [B1]
 505 // CHECK-NEXT:   1: x
 506 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 507 // CHECK-NEXT:   3: typedef int VLA[x];
 508 void vla_typedef(int x) {
 509   typedef int VLA[x];
 510 }
 511
 512 // CHECK-LABEL: void vla_typealias(int x)
 513 // CHECK: [B1]
 514 // CHECK-NEXT:   1: x
 515 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 516 // CHECK-NEXT:   3: using VLA = int[x];
 517 void vla_typealias(int x) {
 518   using VLA = int[x];
 519 }
 520
 521 // CHECK-LABEL: void vla_typedef_multi(int x, int y)
 522 // CHECK:  [B1]
 523 // CHECK-NEXT:   1: y
 524 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 525 // CHECK-NEXT:   3: x
 526 // CHECK-NEXT:   4: [B1.3] (ImplicitCastExpr, LValueToRValue, int)
 527 // CHECK-NEXT:   5: typedef int VLA[x][y];
 528 void vla_typedef_multi(int x, int y) {
 529   typedef int VLA[x][y];
 530 }
 531
 532 // CHECK-LABEL: void vla_typedefname_multi(int x, int y)
 533 // CHECK:  [B1]
 534 // CHECK-NEXT:   1: x
 535 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, LValueToRValue, int)
 536 // CHECK-NEXT:   3: typedef int VLA[x];
 537 // CHECK-NEXT:   4: y
 538 // CHECK-NEXT:   5: [B1.4] (ImplicitCastExpr, LValueToRValue, int)
 539 // CHECK-NEXT:   6: typedef VLA VLA1[y];
 540 // CHECK-NEXT:   7: 3
 541 // CHECK-NEXT:   8: using VLA2 = VLA1[3];
 542 // CHECK-NEXT:   9: 4
 543 // CHECK-NEXT:  10: VLA2 vla[4];
 544 void vla_typedefname_multi(int x, int y) {
 545   typedef int VLA[x];
 546   typedef VLA VLA1[y];
 547   using VLA2 = VLA1[3];
 548   VLA2 vla[4];
 549 }
 550
 551 // CHECK-LABEL: int vla_evaluate(int x)
 552 // CHECK:  [B1]
 553 // CHECK-NEXT:   1: x
 554 // CHECK-NEXT:   2: ++[B1.1]
 555 // CHECK-NEXT:   3: [B1.2] (ImplicitCastExpr, LValueToRValue, int)
 556 // CHECK-NEXT:   4: typedef int VLA[++x];
 557 // CHECK-NEXT:   5: x
 558 // CHECK-NEXT:   6: ++[B1.5]
 559 // CHECK-NEXT:   7: [B1.6] (ImplicitCastExpr, LValueToRValue, int)
 560 // CHECK-NEXT:   8: sizeof(int[++x])
 561 // CHECK-NEXT:   9: alignof(int[++x])
 562 // CHECK-NEXT:  10: 0
 563 // CHECK-NEXT:  11: x
 564 // CHECK-NEXT:  12: [B1.11] (ImplicitCastExpr, LValueToRValue, int)
 565 // CHECK-NEXT:  13: return [B1.12];
 566 int vla_evaluate(int x) {
 567   // Evaluates the ++x
 568   typedef int VLA[++x];
 569   sizeof(int[++x]);
 570
 571   // Do not evaluate the ++x
 572   _Alignof(int[++x]);
 573   _Generic((int(*)[++x])0, default : 0);
 574
 575   return x;
 576 }
 577
 578 // CHECK-LABEL: void CommaTemp::f()
 579 // CHECK:       [B1]
 580 // CHECK-NEXT:    1: A() (CXXConstructExpr,
 581 // CHECK-NEXT:    2: [B1.1] (BindTemporary)
 582 // CHECK-NEXT:    3: B() (CXXConstructExpr,
 583 // CHECK-NEXT:    4: [B1.3] (BindTemporary)
 584 // CHECK-NEXT:    5: ... , [B1.4]
 585 // CHECK-NEXT:    6: ~B() (Temporary object destructor)
 586 // CHECK-NEXT:    7: ~A() (Temporary object destructor)
 587 namespace CommaTemp {
 588   struct A { ~A(); };
 589   struct B { ~B(); };
 590   void f();
 591 }
 592 void CommaTemp::f() {
 593   A(), B();
 594 }
 595
 596 // CHECK-LABEL: int crash_with_thread_local(char *p, int *q)
 597 // CHECK:       [B7 (ENTRY)]
 598 // CHECK-NEXT:    Succs (1): B6
 599 // CHECK:       [B1]
 600 // CHECK-NEXT:   bail:
 601 // CHECK-NEXT:    1: 0
 602 // CHECK-NEXT:    2: return [B1.1];
 603 // CHECK-NEXT:    Preds (2): B2 B5
 604 // CHECK-NEXT:    Succs (1): B0
 605 // CHECK:       [B2]
 606 // CHECK-NEXT:    1: 0
 607 // CHECK-NEXT:    2: q
 608 // CHECK-NEXT:    3: [B2.2] (ImplicitCastExpr, LValueToRValue, int *)
 609 // CHECK-NEXT:    4: *[B2.3]
 610 // CHECK-NEXT:    5: [B2.4] = [B2.1]
 611 // CHECK-NEXT:    Preds (2): B3 B4
 612 // CHECK-NEXT:    Succs (1): B1
 613 // CHECK:       [B3]
 614 // WARNINGS-NEXT: 1:  (CXXConstructExpr, ClassWithDtor)
 615 // ANALYZER-NEXT: 1:  (CXXConstructExpr, [B3.2], ClassWithDtor)
 616 // CHECK-NEXT:    2: thread_local ClassWithDtor a;
 617 // CHECK-NEXT:    Preds (1): B4
 618 // CHECK-NEXT:    Succs (1): B2
 619 // CHECK:       [B4]
 620 // CHECK-NEXT:    T: static init a
 621 // CHECK-NEXT:    Preds (1): B6
 622 // CHECK-NEXT:    Succs (2): B2 B3
 623 // CHECK:       [B5]
 624 // CHECK-NEXT:    T: goto bail;
 625 // CHECK-NEXT:    Preds (1): B6
 626 // CHECK-NEXT:    Succs (1): B1
 627 // CHECK:       [B6]
 628 // CHECK-NEXT:    1: p
 629 // CHECK-NEXT:    2: [B6.1] (ImplicitCastExpr, LValueToRValue, char *)
 630 // CHECK-NEXT:    3: 0
 631 // CHECK-NEXT:    4: [B6.3] (ImplicitCastExpr, NullToPointer, char *)
 632 // CHECK-NEXT:    5: [B6.2] != [B6.4]
 633 // CHECK-NEXT:    T: if [B6.5]
 634 // CHECK-NEXT:    Preds (1): B7
 635 // CHECK-NEXT:    Succs (2): B5 B4
 636 // CHECK:       [B0 (EXIT)]
 637 // CHECK-NEXT:    Preds (1): B1
 638
 639 struct ClassWithDtor {
 640   ~ClassWithDtor() {}
 641 };
 642
 643 int crash_with_thread_local(char *p, int *q) {
 644   if (p != 0) {
 645     goto bail;
 646   }
 647   thread_local ClassWithDtor a;
 648   *q = 0;
 649 bail:
 650   return 0;
 651 }
 652
 653 // CHECK-LABEL: void DecompositionDecl()
 654 // CHECK:       [B1]
 655 // CHECK-NEXT:    1: int arr[2];
 656 // CHECK-NEXT:    2: arr
 657 // CHECK-NEXT:    3: [B1.2] (ImplicitCastExpr, ArrayToPointerDecay, int *)
 658 // CHECK-NEXT:    4: *
 659 // CHECK-NEXT:    5: [B1.3]{{\[\[}}B1.4]]
 660 // CHECK-NEXT:    6: [B1.5] (ImplicitCastExpr, LValueToRValue, int)
 661 // CHECK-NEXT:    7: {{\{}}[B1.6]{{(\})}}
 662 // CHECK-NEXT:    8: auto = {{\{}}arr[*]{{(\})}};
 663 void DecompositionDecl() {
 664   int arr[2];
 665
 666   auto [a, b] = arr;
 667 }
 668
 669 // CHECK-LABEL: template<> int *PR18472<int>()
 670 // CHECK: [B2 (ENTRY)]
 671 // CHECK-NEXT:   Succs (1): B1
 672 // CHECK: [B1]
 673 // CHECK-NEXT:   1: 0
 674 // CHECK-NEXT:   2: [B1.1] (ImplicitCastExpr, NullToPointer, PR18472_t)
 675 // CHECK-NEXT:   3: (PR18472_t)[B1.2] (CStyleCastExpr, NoOp, PR18472_t)
 676 // CHECK-NEXT:   4: CFGNewAllocator(int *)
 677 // CHECK-NEXT:   5: new (([B1.3])) int
 678 // CHECK-NEXT:   6: return [B1.5];
 679 // CHECK-NEXT:   Preds (1): B2
 680 // CHECK-NEXT:   Succs (1): B0
 681 // CHECK: [B0 (EXIT)]
 682 // CHECK-NEXT:   Preds (1): B1
 683
 684 extern "C" typedef int *PR18472_t;
 685 void *operator new (unsigned long, PR18472_t);
 686 template <class T> T *PR18472() {
 687   return new (((PR18472_t) 0)) T;
 688 }
 689 void PR18472_helper() {
 690   PR18472<int>();
 691 }