1 // RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false %s 2 // RUN: %clang_analyze_cc1 -DTEST_NULL_TERM -analyzer-checker=core,unix.Malloc,debug.ExprInspection,alpha.cplusplus.IteratorRange -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify -analyzer-config eagerly-assume=false %s 3 4 void clang_analyzer_eval(int); 5 void clang_analyzer_warnIfReached(); 6 7 typedef __typeof(sizeof(int)) size_t; 8 void *malloc(size_t); 9 void free(void *); 10 loop_which_iterates_limit_times_not_widened()11void loop_which_iterates_limit_times_not_widened() { 12 int i; 13 int x = 1; 14 // Check loop isn't widened by checking x isn't invalidated 15 for (i = 0; i < 1; ++i) {} 16 clang_analyzer_eval(x == 1); // expected-warning {{TRUE}} 17 for (i = 0; i < 2; ++i) {} 18 clang_analyzer_eval(x == 1); // expected-warning {{TRUE}} 19 for (i = 0; i < 3; ++i) {} 20 // FIXME loss of precision as a result of evaluating the widened loop body 21 // *instead* of the last iteration. 22 clang_analyzer_eval(x == 1); // expected-warning {{UNKNOWN}} 23 } 24 25 int a_global; 26 loop_evaluated_before_widening()27void loop_evaluated_before_widening() { 28 int i; 29 a_global = 1; 30 for (i = 0; i < 10; ++i) { 31 if (i == 2) { 32 // True before widening then unknown after. 33 clang_analyzer_eval(a_global == 1); // expected-warning{{TRUE}} expected-warning{{UNKNOWN}} 34 } 35 } 36 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 37 } 38 warnings_after_loop()39void warnings_after_loop() { 40 int i; 41 for (i = 0; i < 10; ++i) {} 42 char *m = (char*)malloc(12); 43 } // expected-warning {{Potential leak of memory pointed to by 'm'}} 44 for_loop_exits()45void for_loop_exits() { 46 int i; 47 for (i = 0; i < 10; ++i) {} 48 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 49 } 50 while_loop_exits()51void while_loop_exits() { 52 int i = 0; 53 while (i < 10) {++i;} 54 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 55 } 56 do_while_loop_exits()57void do_while_loop_exits() { 58 int i = 0; 59 do {++i;} while (i < 10); 60 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 61 } 62 loop_body_is_widened()63void loop_body_is_widened() { 64 int i = 0; 65 while (i < 100) { 66 if (i > 10) { 67 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 68 } 69 ++i; 70 } 71 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 72 } 73 invariably_infinite_loop()74void invariably_infinite_loop() { 75 int i = 0; 76 while (1) { ++i; } 77 clang_analyzer_warnIfReached(); // no-warning 78 } 79 invariably_infinite_break_loop()80void invariably_infinite_break_loop() { 81 int i = 0; 82 while (1) { 83 ++i; 84 int x = 1; 85 if (!x) break; 86 } 87 clang_analyzer_warnIfReached(); // no-warning 88 } 89 reachable_break_loop()90void reachable_break_loop() { 91 int i = 0; 92 while (1) { 93 ++i; 94 if (i == 100) break; 95 } 96 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 97 } 98 condition_constrained_true_in_loop()99void condition_constrained_true_in_loop() { 100 int i = 0; 101 while (i < 50) { 102 clang_analyzer_eval(i < 50); // expected-warning {{TRUE}} 103 ++i; 104 } 105 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 106 } 107 condition_constrained_false_after_loop()108void condition_constrained_false_after_loop() { 109 int i = 0; 110 while (i < 50) { 111 ++i; 112 } 113 clang_analyzer_eval(i >= 50); // expected-warning {{TRUE}} 114 clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 115 } 116 multiple_exit_test()117void multiple_exit_test() { 118 int x = 0; 119 int i = 0; 120 while (i < 50) { 121 if (x) { 122 i = 10; 123 break; 124 } 125 ++i; 126 } 127 // Reachable by 'normal' exit 128 if (i == 50) clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 129 // Reachable by break point 130 if (i == 10) clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}} 131 // Not reachable 132 if (i < 10) clang_analyzer_warnIfReached(); // no-warning 133 if (i > 10 && i < 50) clang_analyzer_warnIfReached(); // no-warning 134 } 135 pointer_doesnt_leak_from_loop()136void pointer_doesnt_leak_from_loop() { 137 int *h_ptr = (int *) malloc(sizeof(int)); 138 for (int i = 0; i < 2; ++i) {} 139 for (int i = 0; i < 10; ++i) {} // no-warning 140 free(h_ptr); 141 } 142 143 int g_global; 144 unknown_after_loop(int s_arg)145void unknown_after_loop(int s_arg) { 146 g_global = 0; 147 s_arg = 1; 148 int s_local = 2; 149 int *h_ptr = malloc(sizeof(int)); 150 151 for (int i = 0; i < 10; ++i) {} 152 153 clang_analyzer_eval(g_global); // expected-warning {{UNKNOWN}} 154 clang_analyzer_eval(s_arg); // expected-warning {{UNKNOWN}} 155 clang_analyzer_eval(s_local); // expected-warning {{UNKNOWN}} 156 clang_analyzer_eval(h_ptr == 0); // expected-warning {{UNKNOWN}} 157 free(h_ptr); 158 } 159 variable_bound_exiting_loops_widened(int x)160void variable_bound_exiting_loops_widened(int x) { 161 int i = 0; 162 int t = 1; 163 while (i < x) { 164 ++i; 165 } 166 clang_analyzer_eval(t == 1); // expected-warning {{TRUE}} // expected-warning {{UNKNOWN}} 167 } 168 nested_loop_outer_widen()169void nested_loop_outer_widen() { 170 int i = 0, j = 0; 171 for (i = 0; i < 10; i++) { 172 clang_analyzer_eval(i < 10); // expected-warning {{TRUE}} 173 for (j = 0; j < 2; j++) { 174 clang_analyzer_eval(j < 2); // expected-warning {{TRUE}} 175 } 176 clang_analyzer_eval(j >= 2); // expected-warning {{TRUE}} 177 } 178 clang_analyzer_eval(i >= 10); // expected-warning {{TRUE}} 179 } 180 nested_loop_inner_widen()181void nested_loop_inner_widen() { 182 int i = 0, j = 0; 183 for (i = 0; i < 2; i++) { 184 clang_analyzer_eval(i < 2); // expected-warning {{TRUE}} 185 for (j = 0; j < 10; j++) { 186 clang_analyzer_eval(j < 10); // expected-warning {{TRUE}} 187 } 188 clang_analyzer_eval(j >= 10); // expected-warning {{TRUE}} 189 } 190 clang_analyzer_eval(i >= 2); // expected-warning {{TRUE}} 191 } 192 193 #ifdef TEST_NULL_TERM null_terminator_loop_widen(int * a)194void null_terminator_loop_widen(int *a) { 195 int c; 196 // Loop widening will call 'invalidateRegions()' and 'invalidateRegions()' 197 // will construct the SymbolConjured with null Stmt because of the null 198 // terminator statement. Accessing the null Stmt will cause a crash. 199 for (;;) { 200 c = *a; // no-crash 201 a++; 202 } 203 } 204 #endif 205