| 1 | // RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha -analyzer-max-loop 2 -analyzer-config widen-loops=true -analyzer-output=text -verify -analyzer-config eagerly-assume=false %s |
|---|
| 2 | |
|---|
| 3 | int *p_a; |
|---|
| 4 | int bar(); |
|---|
| 5 | int flag_a; |
|---|
| 6 | int test_for_bug_25609() { |
|---|
| 7 | if (p_a == 0) // expected-note {{Assuming 'p_a' is equal to null}} |
|---|
| 8 | // expected-note@-1 {{Taking true branch}} |
|---|
| 9 | bar(); |
|---|
| 10 | for (int i = 0; // expected-note {{Loop condition is true. Entering loop body}} |
|---|
| 11 | // expected-note@-1 {{Loop condition is false. Execution continues on line 16}} |
|---|
| 12 | ++i, // expected-note {{Value assigned to 'p_a'}} |
|---|
| 13 | i < flag_a; |
|---|
| 14 | ++i) {} |
|---|
| 15 | |
|---|
| 16 | *p_a = 25609; // no-crash expected-warning {{Dereference of null pointer (loaded from variable 'p_a')}} |
|---|
| 17 | // expected-note@-1 {{Dereference of null pointer (loaded from variable 'p_a')}} |
|---|
| 18 | return *p_a; |
|---|
| 19 | } |
|---|
| 20 | |
|---|
| 21 | int flag_b; |
|---|
| 22 | int while_analyzer_output() { |
|---|
| 23 | flag_b = 100; |
|---|
| 24 | int num = 10; |
|---|
| 25 | while (flag_b-- > 0) { // expected-note {{Loop condition is true. Entering loop body}} |
|---|
| 26 | // expected-note@-1 {{Value assigned to 'num'}} |
|---|
| 27 | // expected-note@-2 {{Loop condition is false. Execution continues on line 30}} |
|---|
| 28 | num = flag_b; |
|---|
| 29 | } |
|---|
| 30 | if (num < 0) // expected-note {{Assuming 'num' is >= 0}} |
|---|
| 31 | // expected-note@-1 {{Taking false branch}} |
|---|
| 32 | flag_b = 0; |
|---|
| 33 | else if (num >= 1) // expected-note {{Assuming 'num' is < 1}} |
|---|
| 34 | // expected-note@-1 {{Taking false branch}} |
|---|
| 35 | flag_b = 50; |
|---|
| 36 | else |
|---|
| 37 | flag_b = 100; |
|---|
| 38 | return flag_b / num; // no-crash expected-warning {{Division by zero}} |
|---|
| 39 | // expected-note@-1 {{Division by zero}} |
|---|
| 40 | } |
|---|
| 41 | |
|---|
| 42 | int flag_c; |
|---|
| 43 | int do_while_analyzer_output() { |
|---|
| 44 | int num = 10; |
|---|
| 45 | do { // expected-note {{Loop condition is true. Execution continues on line 47}} |
|---|
| 46 | // expected-note@-1 {{Loop condition is false. Exiting loop}} |
|---|
| 47 | num--; |
|---|
| 48 | } while (flag_c-- > 0); //expected-note {{Value assigned to 'num'}} |
|---|
| 49 | int local = 0; |
|---|
| 50 | if (num == 0) // expected-note {{Assuming 'num' is equal to 0}} |
|---|
| 51 | // expected-note@-1 {{Taking true branch}} |
|---|
| 52 | local = 10 / num; // no-crash expected-warning {{Division by zero}} |
|---|
| 53 | // expected-note@-1 {{Division by zero}} |
|---|
| 54 | return local; |
|---|
| 55 | } |
|---|
| 56 | |
|---|
| 57 | int flag_d; |
|---|
| 58 | int test_for_loop() { |
|---|
| 59 | int num = 10; |
|---|
| 60 | for (int i = 0; // expected-note {{Loop condition is true. Entering loop body}} |
|---|
| 61 | // expected-note@-1 {{Loop condition is false. Execution continues on line 67}} |
|---|
| 62 | new int(10), // expected-note {{Value assigned to 'num'}} |
|---|
| 63 | i < flag_d; |
|---|
| 64 | ++i) { |
|---|
| 65 | ++num; |
|---|
| 66 | } |
|---|
| 67 | if (num == 0) // expected-note {{Assuming 'num' is equal to 0}} |
|---|
| 68 | // expected-note@-1 {{Taking true branch}} |
|---|
| 69 | flag_d += 10; |
|---|
| 70 | return flag_d / num; // no-crash expected-warning {{Division by zero}} |
|---|
| 71 | // expected-note@-1 {{Division by zero}} |
|---|
| 72 | } |
|---|
| 73 | |
|---|