1 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -verify %s \
2 // RUN: -analyzer-checker=core.builtin \
3 // RUN: -analyzer-checker=debug.ExprInspection \
4 // RUN: -analyzer-checker=unix.cstring \
5 // RUN: -analyzer-config display-checker-name=false
6
7 typedef unsigned long size_t;
8
9 struct S {
10 struct S3 {
11 int y[10];
12 };
13 struct S2 : S3 {
14 int *x;
15 } s2[10];
16 int z;
17 };
18
19
20 void clang_analyzer_explain(int);
21 void clang_analyzer_explain(void *);
22 void clang_analyzer_explain(const int *);
23 void clang_analyzer_explain(S);
24
25 size_t clang_analyzer_getExtent(void *);
26
27 size_t strlen(const char *);
28
29 int conjure();
30 S conjure_S();
31
32 int glob;
33 static int stat_glob;
34 void *glob_ptr;
35
36 // Test strings are regex'ed because we need to match exact string
37 // rather than a substring.
38
test_1(int param,void * ptr)39 void test_1(int param, void *ptr) {
40 clang_analyzer_explain(&glob); // expected-warning-re{{{{^pointer to global variable 'glob'$}}}}
41 clang_analyzer_explain(param); // expected-warning-re{{{{^argument 'param'$}}}}
42 clang_analyzer_explain(ptr); // expected-warning-re{{{{^argument 'ptr'$}}}}
43 if (param == 42)
44 clang_analyzer_explain(param); // expected-warning-re{{{{^signed 32-bit integer '42'$}}}}
45 }
46
test_2(char * ptr,int ext)47 void test_2(char *ptr, int ext) {
48 clang_analyzer_explain((void *) "asdf"); // expected-warning-re{{{{^pointer to element of type 'char' with index 0 of string literal "asdf"$}}}}
49 clang_analyzer_explain(strlen(ptr)); // expected-warning-re{{{{^metadata of type 'unsigned long' tied to pointee of argument 'ptr'$}}}}
50 clang_analyzer_explain(conjure()); // expected-warning-re{{{{^symbol of type 'int' conjured at statement 'conjure\(\)'$}}}}
51 clang_analyzer_explain(glob); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob'$}}}}
52 clang_analyzer_explain(glob_ptr); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob_ptr'$}}}}
53 clang_analyzer_explain(clang_analyzer_getExtent(ptr)); // expected-warning-re{{{{^extent of pointee of argument 'ptr'$}}}}
54 int *x = new int[ext];
55 clang_analyzer_explain(x); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of heap segment that starts at symbol of type 'int \*' conjured at statement 'new int \[ext\]'$}}}}
56 // Sic! What gets computed is the extent of the element-region.
57 clang_analyzer_explain(clang_analyzer_getExtent(x)); // expected-warning-re{{{{^signed 32-bit integer '4'$}}}}
58 delete[] x;
59 }
60
test_3(S s)61 void test_3(S s) {
62 clang_analyzer_explain(&s); // expected-warning-re{{{{^pointer to parameter 's'$}}}}
63 clang_analyzer_explain(s.z); // expected-warning-re{{{{^initial value of field 'z' of parameter 's'$}}}}
64 clang_analyzer_explain(&s.s2[5].y[3]); // expected-warning-re{{{{^pointer to element of type 'int' with index 3 of field 'y' of base object 'S::S3' inside element of type 'struct S::S2' with index 5 of field 's2' of parameter 's'$}}}}
65 if (!s.s2[7].x) {
66 clang_analyzer_explain(s.s2[7].x); // expected-warning-re{{{{^concrete memory address '0'$}}}}
67 // FIXME: we need to be explaining '1' rather than '0' here; not explainer bug.
68 clang_analyzer_explain(s.s2[7].x + 1); // expected-warning-re{{{{^concrete memory address '0'$}}}}
69 }
70 }
71
test_4(int x,int y)72 void test_4(int x, int y) {
73 int z;
74 static int stat;
75 clang_analyzer_explain(x + 1); // expected-warning-re{{{{^\(argument 'x'\) \+ 1$}}}}
76 clang_analyzer_explain(1 + y); // expected-warning-re{{{{^\(argument 'y'\) \+ 1$}}}}
77 clang_analyzer_explain(x + y); // expected-warning-re{{{{^\(argument 'x'\) \+ \(argument 'y'\)$}}}}
78 clang_analyzer_explain(z); // expected-warning-re{{{{^undefined value$}}}}
79 clang_analyzer_explain(&z); // expected-warning-re{{{{^pointer to local variable 'z'$}}}}
80 clang_analyzer_explain(stat); // expected-warning-re{{{{^signed 32-bit integer '0'$}}}}
81 clang_analyzer_explain(&stat); // expected-warning-re{{{{^pointer to static local variable 'stat'$}}}}
82 clang_analyzer_explain(stat_glob); // expected-warning-re{{{{^initial value of global variable 'stat_glob'$}}}}
83 clang_analyzer_explain(&stat_glob); // expected-warning-re{{{{^pointer to global variable 'stat_glob'$}}}}
84 clang_analyzer_explain((int[]){1, 2, 3}); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of temporary object constructed at statement '\(int \[3\]\)\{1, 2, 3\}'$}}}}
85 }
86
87 namespace {
88 class C {
89 int x[10];
90
91 public:
test_5(int i)92 void test_5(int i) {
93 clang_analyzer_explain(this); // expected-warning-re{{{{^pointer to 'this' object$}}}}
94 clang_analyzer_explain(&x[i]); // expected-warning-re{{{{^pointer to element of type 'int' with index 'argument 'i'' of field 'x' of 'this' object$}}}}
95 clang_analyzer_explain(__builtin_alloca(i)); // expected-warning-re{{{{^pointer to region allocated by '__builtin_alloca\(i\)'$}}}}
96 }
97 };
98 } // end of anonymous namespace
99
test_6()100 void test_6() {
101 clang_analyzer_explain(conjure_S()); // expected-warning-re{{{{^lazily frozen compound value of 1st parameter of function 'clang_analyzer_explain\(\)'$}}}}
102 clang_analyzer_explain(conjure_S().z); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure_S\(\)'\) for field 'z' of temporary object constructed at statement 'conjure_S\(\)'$}}}}
103 }
104
105 class C_top_level {
106 public:
C_top_level(int param)107 C_top_level(int param) {
108 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
109 }
110 };
111
112 class C_non_top_level {
113 public:
C_non_top_level(int param)114 C_non_top_level(int param) {
115 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
116 }
117 };
118
test_7(int n)119 void test_7(int n) {
120 C_non_top_level c(n);
121
122 auto lambda_top_level = [n](int param) {
123 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
124 };
125 auto lambda_non_top_level = [n](int param) {
126 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}}
127 };
128
129 lambda_non_top_level(n);
130 }
131