clang/test/Analysis/dtor.cpp

   1 // RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,debug.ExprInspection,cplusplus -analyzer-config c++-inlining=destructors -Wno-null-dereference -Wno-inaccessible-base -verify -analyzer-config eagerly-assume=false %s
   2
   3 void clang_analyzer_eval(bool);
   4 void clang_analyzer_checkInlined(bool);
   5
   6 class A {
   7 public:
   8   ~A() {
   9     int *x = 0;
  10     *x = 3; // expected-warning{{Dereference of null pointer}}
  11   }
  12 };
  13
  14 int main() {
  15   A a;
  16 }
  17
  18
  19 typedef __typeof(sizeof(int)) size_t;
  20 void *malloc(size_t);
  21 void free(void *);
  22
  23 class SmartPointer {
  24   void *X;
  25 public:
  26   SmartPointer(void *x) : X(x) {}
  27   ~SmartPointer() {
  28     free(X);
  29   }
  30 };
  31
  32 void testSmartPointer() {
  33   char *mem = (char*)malloc(4);
  34   {
  35     SmartPointer Deleter(mem);
  36     // destructor called here
  37   }
  38   *mem = 0; // expected-warning{{Use of memory after it is freed}}
  39 }
  40
  41
  42 void doSomething();
  43 void testSmartPointer2() {
  44   char *mem = (char*)malloc(4);
  45   {
  46     SmartPointer Deleter(mem);
  47     // Remove dead bindings...
  48     doSomething();
  49     // destructor called here
  50   }
  51   *mem = 0; // expected-warning{{Use of memory after it is freed}}
  52 }
  53
  54
  55 class Subclass : public SmartPointer {
  56 public:
  57   Subclass(void *x) : SmartPointer(x) {}
  58 };
  59
  60 void testSubclassSmartPointer() {
  61   char *mem = (char*)malloc(4);
  62   {
  63     Subclass Deleter(mem);
  64     // Remove dead bindings...
  65     doSomething();
  66     // destructor called here
  67   }
  68   *mem = 0; // expected-warning{{Use of memory after it is freed}}
  69 }
  70
  71
  72 class MultipleInheritance : public Subclass, public SmartPointer {
  73 public:
  74   MultipleInheritance(void *a, void *b) : Subclass(a), SmartPointer(b) {}
  75 };
  76
  77 void testMultipleInheritance1() {
  78   char *mem = (char*)malloc(4);
  79   {
  80     MultipleInheritance Deleter(mem, 0);
  81     // Remove dead bindings...
  82     doSomething();
  83     // destructor called here
  84   }
  85   *mem = 0; // expected-warning{{Use of memory after it is freed}}
  86 }
  87
  88 void testMultipleInheritance2() {
  89   char *mem = (char*)malloc(4);
  90   {
  91     MultipleInheritance Deleter(0, mem);
  92     // Remove dead bindings...
  93     doSomething();
  94     // destructor called here
  95   }
  96   *mem = 0; // expected-warning{{Use of memory after it is freed}}
  97 }
  98
  99 void testMultipleInheritance3() {
 100   char *mem = (char*)malloc(4);
 101   {
 102     MultipleInheritance Deleter(mem, mem);
 103     // Remove dead bindings...
 104     doSomething();
 105     // destructor called here
 106     // expected-warning@28 {{Attempt to free released memory}}
 107   }
 108 }
 109
 110
 111 class SmartPointerMember {
 112   SmartPointer P;
 113 public:
 114   SmartPointerMember(void *x) : P(x) {}
 115 };
 116
 117 void testSmartPointerMember() {
 118   char *mem = (char*)malloc(4);
 119   {
 120     SmartPointerMember Deleter(mem);
 121     // Remove dead bindings...
 122     doSomething();
 123     // destructor called here
 124   }
 125   *mem = 0; // expected-warning{{Use of memory after it is freed}}
 126 }
 127
 128
 129 struct IntWrapper {
 130   IntWrapper() : x(0) {}
 131   ~IntWrapper();
 132   int *x;
 133 };
 134
 135 void testArrayInvalidation() {
 136   int i = 42;
 137   int j = 42;
 138
 139   {
 140     IntWrapper arr[2];
 141
 142     // There should be no undefined value warnings here.
 143     clang_analyzer_eval(arr[0].x == 0); // expected-warning{{TRUE}}
 144     clang_analyzer_eval(arr[1].x == 0); // expected-warning{{TRUE}}
 145
 146     arr[0].x = &i;
 147     arr[1].x = &j;
 148     clang_analyzer_eval(*arr[0].x == 42); // expected-warning{{TRUE}}
 149     clang_analyzer_eval(*arr[1].x == 42); // expected-warning{{TRUE}}
 150   }
 151
 152   // The destructors should have invalidated i and j.
 153   clang_analyzer_eval(i == 42); // expected-warning{{UNKNOWN}}
 154   clang_analyzer_eval(j == 42); // expected-warning{{UNKNOWN}}
 155 }
 156
 157
 158
 159 // Don't crash on a default argument inside an initializer.
 160 struct DefaultArg {
 161   DefaultArg(int x = 0) {}
 162   ~DefaultArg();
 163 };
 164
 165 struct InheritsDefaultArg : DefaultArg {
 166   InheritsDefaultArg() {}
 167   virtual ~InheritsDefaultArg();
 168 };
 169
 170 void testDefaultArg() {
 171   InheritsDefaultArg a;
 172   // Force a bug to be emitted.
 173   *(char *)0 = 1; // expected-warning{{Dereference of null pointer}}
 174 }
 175
 176
 177 namespace DestructorVirtualCalls {
 178   class A {
 179   public:
 180     int *out1, *out2, *out3;
 181
 182     virtual int get() { return 1; }
 183
 184     ~A() {
 185       *out1 = get();
 186     }
 187   };
 188
 189   class B : public A {
 190   public:
 191     virtual int get() { return 2; }
 192
 193     ~B() {
 194       *out2 = get();
 195     }
 196   };
 197
 198   class C : public B {
 199   public:
 200     virtual int get() { return 3; }
 201
 202     ~C() {
 203       *out3 = get();
 204     }
 205   };
 206
 207   void test() {
 208     int a, b, c;
 209
 210     // New scope for the C object.
 211     {
 212       C obj;
 213       clang_analyzer_eval(obj.get() == 3); // expected-warning{{TRUE}}
 214
 215       // Correctness check for devirtualization.
 216       A *base = &obj;
 217       clang_analyzer_eval(base->get() == 3); // expected-warning{{TRUE}}
 218
 219       obj.out1 = &a;
 220       obj.out2 = &b;
 221       obj.out3 = &c;
 222     }
 223
 224     clang_analyzer_eval(a == 1); // expected-warning{{TRUE}}
 225     clang_analyzer_eval(b == 2); // expected-warning{{TRUE}}
 226     clang_analyzer_eval(c == 3); // expected-warning{{TRUE}}
 227   }
 228 }
 229
 230
 231 namespace DestructorsShouldNotAffectReturnValues {
 232   class Dtor {
 233   public:
 234     ~Dtor() {
 235       clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
 236     }
 237   };
 238
 239   void *allocate() {
 240     Dtor d;
 241     return malloc(4); // no-warning
 242   }
 243
 244   void test() {
 245     // At one point we had an issue where the statements inside an
 246     // inlined destructor kept us from finding the return statement,
 247     // leading the analyzer to believe that the malloc'd memory had leaked.
 248     void *p = allocate();
 249     free(p); // no-warning
 250   }
 251 }
 252
 253 namespace MultipleInheritanceVirtualDtors {
 254   class VirtualDtor {
 255   protected:
 256     virtual ~VirtualDtor() {
 257       clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
 258     }
 259   };
 260
 261   class NonVirtualDtor {
 262   protected:
 263     ~NonVirtualDtor() {
 264       clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
 265     }
 266   };
 267
 268   class SubclassA : public VirtualDtor, public NonVirtualDtor {
 269   public:
 270     virtual ~SubclassA() {}
 271   };
 272   class SubclassB : public NonVirtualDtor, public VirtualDtor {
 273   public:
 274     virtual ~SubclassB() {}
 275   };
 276
 277   void test() {
 278     SubclassA a;
 279     SubclassB b;
 280   }
 281 }
 282
 283 namespace ExplicitDestructorCall {
 284   class VirtualDtor {
 285   public:
 286     virtual ~VirtualDtor() {
 287       clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
 288     }
 289   };
 290
 291   class Subclass : public VirtualDtor {
 292   public:
 293     virtual ~Subclass() {
 294       clang_analyzer_checkInlined(false); // no-warning
 295     }
 296   };
 297
 298   void destroy(Subclass *obj) {
 299     obj->VirtualDtor::~VirtualDtor();
 300   }
 301 }
 302
 303
 304 namespace MultidimensionalArrays {
 305   void testArrayInvalidation() {
 306     int i = 42;
 307     int j = 42;
 308
 309     {
 310       IntWrapper arr[2][2];
 311
 312       // There should be no undefined value warnings here.
 313       clang_analyzer_eval(arr[0][0].x == 0); // expected-warning{{TRUE}}
 314       clang_analyzer_eval(arr[1][1].x == 0); // expected-warning{{TRUE}}
 315
 316       arr[0][0].x = &i;
 317       arr[1][1].x = &j;
 318       clang_analyzer_eval(*arr[0][0].x == 42); // expected-warning{{TRUE}}
 319       clang_analyzer_eval(*arr[1][1].x == 42); // expected-warning{{TRUE}}
 320     }
 321
 322     // The destructors should have invalidated i and j.
 323     clang_analyzer_eval(i == 42); // expected-warning{{UNKNOWN}}
 324     clang_analyzer_eval(j == 42); // expected-warning{{UNKNOWN}}
 325   }
 326 }
 327
 328 namespace LifetimeExtension {
 329   struct IntWrapper {
 330         int x;
 331         IntWrapper(int y) : x(y) {}
 332         IntWrapper() {
 333       extern void use(int);
 334       use(x); // no-warning
 335         }
 336   };
 337
 338   struct DerivedWrapper : public IntWrapper {
 339         DerivedWrapper(int y) : IntWrapper(y) {}
 340   };
 341
 342   DerivedWrapper get() {
 343         return DerivedWrapper(1);
 344   }
 345
 346   void test() {
 347         const DerivedWrapper &d = get(); // lifetime extended here
 348   }
 349
 350
 351   class SaveOnDestruct {
 352   public:
 353     static int lastOutput;
 354     int value;
 355
 356     SaveOnDestruct();
 357     ~SaveOnDestruct() {
 358       lastOutput = value;
 359     }
 360   };
 361
 362   void testSimple() {
 363     {
 364       const SaveOnDestruct &obj = SaveOnDestruct();
 365       if (obj.value != 42)
 366         return;
 367       // destructor called here
 368     }
 369
 370     clang_analyzer_eval(SaveOnDestruct::lastOutput == 42); // expected-warning{{TRUE}}
 371   }
 372
 373   struct NRCheck {
 374     bool bool_;
 375     NRCheck():bool_(true) {}
 376     ~NRCheck() __attribute__((noreturn));
 377     operator bool() const { return bool_; }
 378   };
 379
 380   struct CheckAutoDestructor {
 381     bool bool_;
 382     CheckAutoDestructor():bool_(true) {}
 383     operator bool() const { return bool_; }
 384   };
 385
 386   struct CheckCustomDestructor {
 387     bool bool_;
 388     CheckCustomDestructor():bool_(true) {}
 389     ~CheckCustomDestructor();
 390     operator bool() const { return bool_; }
 391   };
 392
 393   bool testUnnamedNR() {
 394     if (NRCheck())
 395       return true;
 396     return false;
 397   }
 398
 399   bool testNamedNR() {
 400     if (NRCheck c = NRCheck())
 401       return true;
 402     return false;
 403   }
 404
 405   bool testUnnamedAutoDestructor() {
 406     if (CheckAutoDestructor())
 407       return true;
 408     return false;
 409   }
 410
 411   bool testNamedAutoDestructor() {
 412     if (CheckAutoDestructor c = CheckAutoDestructor())
 413       return true;
 414     return false;
 415   }
 416
 417   bool testUnnamedCustomDestructor() {
 418     if (CheckCustomDestructor())
 419       return true;
 420     return false;
 421   }
 422
 423   // This case used to cause an unexpected "Undefined or garbage value returned
 424   // to caller" warning
 425   bool testNamedCustomDestructor() {
 426     if (CheckCustomDestructor c = CheckCustomDestructor())
 427       return true;
 428     return false;
 429   }
 430
 431   bool testMultipleTemporariesCustomDestructor() {
 432     if (CheckCustomDestructor c = (CheckCustomDestructor(), CheckCustomDestructor()))
 433       return true;
 434     return false;
 435   }
 436
 437   class VirtualDtorBase {
 438   public:
 439     int value;
 440     virtual ~VirtualDtorBase() {}
 441   };
 442
 443   class SaveOnVirtualDestruct : public VirtualDtorBase {
 444   public:
 445     static int lastOutput;
 446
 447     SaveOnVirtualDestruct();
 448     virtual ~SaveOnVirtualDestruct() {
 449       lastOutput = value;
 450     }
 451   };
 452
 453   void testVirtual() {
 454     {
 455       const VirtualDtorBase &obj = SaveOnVirtualDestruct();
 456       if (obj.value != 42)
 457         return;
 458       // destructor called here
 459     }
 460
 461     clang_analyzer_eval(SaveOnVirtualDestruct::lastOutput == 42); // expected-warning{{TRUE}}
 462   }
 463 }
 464
 465 namespace NoReturn {
 466   struct NR {
 467     ~NR() __attribute__((noreturn));
 468   };
 469
 470   void f(int **x) {
 471     NR nr;
 472   }
 473
 474   void g() {
 475     int *x;
 476     f(&x);
 477     *x = 47; // no warning
 478   }
 479
 480   void g2(int *x) {
 481     if (! x) NR();
 482     *x = 47; // no warning
 483   }
 484 }
 485
 486 namespace PseudoDtor {
 487   template <typename T>
 488   void destroy(T &obj) {
 489     clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
 490     obj.~T();
 491   }
 492
 493   void test() {
 494     int i;
 495     destroy(i);
 496     clang_analyzer_eval(true); // expected-warning{{TRUE}}
 497   }
 498 }
 499
 500 namespace Incomplete {
 501   class Foo; // expected-note{{forward declaration}}
 502   void f(Foo *foo) { delete foo; } // expected-warning{{deleting pointer to incomplete type}}
 503 }
 504
 505 namespace TypeTraitExpr {
 506 template <bool IsSimple, typename T>
 507 struct copier {
 508   static void do_copy(T *dest, const T *src, unsigned count);
 509 };
 510 template <typename T, typename U>
 511 void do_copy(T *dest, const U *src, unsigned count) {
 512   const bool IsSimple = __is_trivial(T) && __is_same(T, U);
 513   copier<IsSimple, T>::do_copy(dest, src, count);
 514 }
 515 struct NonTrivial {
 516   int *p;
 517   NonTrivial() : p(new int[1]) { p[0] = 0; }
 518   NonTrivial(const NonTrivial &other) {
 519     p = new int[1];
 520     do_copy(p, other.p, 1);
 521   }
 522   NonTrivial &operator=(const NonTrivial &other) {
 523     p = other.p;
 524     return *this;
 525   }
 526   ~NonTrivial() {
 527     delete[] p; // expected-warning {{free released memory}}
 528   }
 529 };
 530
 531 void f() {
 532   NonTrivial nt1;
 533   NonTrivial nt2(nt1);
 534   nt1 = nt2;
 535   clang_analyzer_eval(__is_trivial(NonTrivial)); // expected-warning{{FALSE}}
 536   clang_analyzer_eval(__alignof(NonTrivial) > 0); // expected-warning{{TRUE}}
 537 }
 538 }
 539
 540 namespace dtor_over_loc_concrete_int {
 541 struct A {
 542   ~A() {}
 543 };
 544
 545 struct B {
 546   A a;
 547   ~B() {}
 548 };
 549
 550 struct C : A {
 551   ~C() {}
 552 };
 553
 554 void testB() {
 555   B *b = (B *)-1;
 556   b->~B(); // no-crash
 557 }
 558
 559 void testC() {
 560   C *c = (C *)-1;
 561   c->~C(); // no-crash
 562 }
 563
 564 void testAutoDtor() {
 565   const A &a = *(A *)-1;
 566   // no-crash
 567 }
 568 } // namespace dtor_over_loc_concrete_int
 569
 570 // Test overriden new/delete operators
 571 struct CustomOperators {
 572   void *operator new(size_t count) {
 573     return malloc(count);
 574   }
 575
 576   void operator delete(void *addr) {
 577     free(addr);
 578   }
 579
 580 private:
 581   int i;
 582 };
 583
 584 void compliant() {
 585   auto *a = new CustomOperators();
 586   delete a;
 587 }
 588
 589 void overrideLeak() {
 590   auto *a = new CustomOperators();
 591 } // expected-warning{{Potential leak of memory pointed to by 'a'}}
 592
 593 void overrideDoubleDelete() {
 594   auto *a = new CustomOperators();
 595   delete a;
 596   delete a; // expected-warning@577 {{Attempt to free released memory}}
 597 }