clang/test/Analysis/explain-svals.cpp

   1 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -verify %s \
   2 // RUN:   -analyzer-checker=debug.ExprInspection \
   3 // RUN:   -analyzer-checker=unix.cstring \
   4 // RUN:   -analyzer-checker=unix.Malloc \
   5 // RUN:   -analyzer-config display-checker-name=false
   6
   7 typedef unsigned long size_t;
   8
   9 struct S {
  10   struct S3 {
  11     int y[10];
  12   };
  13   struct S2 : S3 {
  14     int *x;
  15   } s2[10];
  16   int z;
  17 };
  18
  19
  20 void clang_analyzer_explain(int);
  21 void clang_analyzer_explain(void *);
  22 void clang_analyzer_explain(const int *);
  23 void clang_analyzer_explain(S);
  24
  25 size_t clang_analyzer_getExtent(void *);
  26
  27 size_t strlen(const char *);
  28
  29 int conjure();
  30 S conjure_S();
  31
  32 int glob;
  33 static int stat_glob;
  34 void *glob_ptr;
  35
  36 // Test strings are regex'ed because we need to match exact string
  37 // rather than a substring.
  38
  39 void test_1(int param, void *ptr) {
  40   clang_analyzer_explain(&glob); // expected-warning-re{{{{^pointer to global variable 'glob'$}}}}
  41   clang_analyzer_explain(param); // expected-warning-re{{{{^argument 'param'$}}}}
  42   clang_analyzer_explain(ptr); // expected-warning-re{{{{^argument 'ptr'$}}}}
  43   if (param == 42)
  44     clang_analyzer_explain(param); // expected-warning-re{{{{^signed 32-bit integer '42'$}}}}
  45 }
  46
  47 void test_2(char *ptr, int ext) {
  48   clang_analyzer_explain((void *) "asdf"); // expected-warning-re{{{{^pointer to element of type 'char' with index 0 of string literal "asdf"$}}}}
  49   clang_analyzer_explain(strlen(ptr)); // expected-warning-re{{{{^metadata of type 'unsigned long' tied to pointee of argument 'ptr'$}}}}
  50   clang_analyzer_explain(conjure()); // expected-warning-re{{{{^symbol of type 'int' conjured at statement 'conjure\(\)'$}}}}
  51   clang_analyzer_explain(glob); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob'$}}}}
  52   clang_analyzer_explain(glob_ptr); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob_ptr'$}}}}
  53   clang_analyzer_explain(clang_analyzer_getExtent(ptr)); // expected-warning-re{{{{^extent of pointee of argument 'ptr'$}}}}
  54   int *x = new int[ext];
  55   clang_analyzer_explain(x); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of heap segment that starts at symbol of type 'int \*' conjured at statement 'new int \[ext\]'$}}}}
  56   // Sic! What gets computed is the extent of the element-region.
  57   clang_analyzer_explain(clang_analyzer_getExtent(x)); // expected-warning-re{{{{^\(argument 'ext'\) \* 4$}}}}
  58   delete[] x;
  59 }
  60
  61 void test_3(S s) {
  62   clang_analyzer_explain(&s); // expected-warning-re{{{{^pointer to parameter 's'$}}}}
  63   clang_analyzer_explain(s.z); // expected-warning-re{{{{^initial value of field 'z' of parameter 's'$}}}}
  64   clang_analyzer_explain(&s.s2[5].y[3]); // expected-warning-re{{{{^pointer to element of type 'int' with index 3 of field 'y' of base object 'S::S3' inside element of type 'struct S::S2' with index 5 of field 's2' of parameter 's'$}}}}
  65   if (!s.s2[7].x) {
  66     clang_analyzer_explain(s.s2[7].x); // expected-warning-re{{{{^concrete memory address '0'$}}}}
  67     // FIXME: we need to be explaining '1' rather than '0' here; not explainer bug.
  68     clang_analyzer_explain(s.s2[7].x + 1); // expected-warning-re{{{{^concrete memory address '0'$}}}}
  69   }
  70 }
  71
  72 void test_4(int x, int y) {
  73   int z;
  74   static int stat;
  75   clang_analyzer_explain(-x);    // expected-warning-re{{{{^\- \(argument 'x'\)$}}}}
  76   clang_analyzer_explain(x + 1); // expected-warning-re{{{{^\(argument 'x'\) \+ 1$}}}}
  77   clang_analyzer_explain(1 + y); // expected-warning-re{{{{^\(argument 'y'\) \+ 1$}}}}
  78   clang_analyzer_explain(x + y); // expected-warning-re{{{{^\(argument 'x'\) \+ \(argument 'y'\)$}}}}
  79   clang_analyzer_explain(z); // expected-warning-re{{{{^undefined value$}}}}
  80   clang_analyzer_explain(&z); // expected-warning-re{{{{^pointer to local variable 'z'$}}}}
  81   clang_analyzer_explain(stat); // expected-warning-re{{{{^signed 32-bit integer '0'$}}}}
  82   clang_analyzer_explain(&stat); // expected-warning-re{{{{^pointer to static local variable 'stat'$}}}}
  83   clang_analyzer_explain(stat_glob); // expected-warning-re{{{{^initial value of global variable 'stat_glob'$}}}}
  84   clang_analyzer_explain(&stat_glob); // expected-warning-re{{{{^pointer to global variable 'stat_glob'$}}}}
  85   clang_analyzer_explain((int[]){1, 2, 3}); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of temporary object constructed at statement '\(int\[3\]\)\{1, 2, 3\}'$}}}}
  86 }
  87
  88 namespace {
  89 class C {
  90   int x[10];
  91
  92 public:
  93   void test_5(int i) {
  94     clang_analyzer_explain(this); // expected-warning-re{{{{^pointer to 'this' object$}}}}
  95     clang_analyzer_explain(&x[i]); // expected-warning-re{{{{^pointer to element of type 'int' with index 'argument 'i'' of field 'x' of 'this' object$}}}}
  96     clang_analyzer_explain(__builtin_alloca(i)); // expected-warning-re{{{{^pointer to region allocated by '__builtin_alloca\(i\)'$}}}}
  97   }
  98 };
  99 } // end of anonymous namespace
 100
 101 void test_6() {
 102   clang_analyzer_explain(conjure_S()); // expected-warning-re{{{{^lazily frozen compound value of 1st parameter of function 'clang_analyzer_explain\(\)'$}}}}
 103   clang_analyzer_explain(conjure_S().z); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure_S\(\)'\) for field 'z' of temporary object constructed at statement 'conjure_S\(\)'$}}}}
 104 }
 105
 106 class C_top_level {
 107 public:
 108   C_top_level(int param) {
 109     clang_analyzer_explain(&param); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
 110   }
 111 };
 112
 113 class C_non_top_level {
 114 public:
 115   C_non_top_level(int param) {
 116     clang_analyzer_explain(&param); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
 117   }
 118 };
 119
 120 void test_7(int n) {
 121   C_non_top_level c(n);
 122
 123   auto lambda_top_level = [n](int param) {
 124     clang_analyzer_explain(&param); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
 125   };
 126   auto lambda_non_top_level = [n](int param) {
 127     clang_analyzer_explain(&param); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
 128   };
 129
 130   lambda_non_top_level(n);
 131 }