misc-ps-region-store.m source code [clang_source_code/test/Analysis/misc-ps-region-store.m]

1	// RUN: %clang_analyze_cc1 -triple i386-apple-darwin9 -analyzer-checker=core,alpha.core.CastToStruct,alpha.security.ReturnPtrRange,alpha.security.ArrayBound -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks -Wno-objc-root-class %s
2	// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin9 -DTEST_64 -analyzer-checker=core,alpha.core.CastToStruct,alpha.security.ReturnPtrRange,alpha.security.ArrayBound -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks -Wno-objc-root-class %s
3
4	typedef long unsigned int size_t;
5	void memcpy(void , const void *, size_t);
6	void *alloca(size_t);
7
8	typedef struct objc_selector *SEL;
9	typedef signed char BOOL;
10	typedef int NSInteger;
11	typedef unsigned int NSUInteger;
12	typedef struct _NSZone NSZone;
13	@class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator;
14	@protocol NSObject - (BOOL)isEqual:(id)object; @end
15	@protocol NSCopying - (id)copyWithZone:(NSZone *)zone; @end
16	@protocol NSMutableCopying - (id)mutableCopyWithZone:(NSZone *)zone; @end
17	@protocol NSCoding - (void)encodeWithCoder:(NSCoder *)aCoder; @end
18	@interface NSObject <NSObject> {} - (id)init; @end
19	extern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone);
20	@interface NSString : NSObject <NSCopying, NSMutableCopying, NSCoding>
21	- (NSUInteger)length;
22	+ (id)stringWithUTF8String:(const char *)nullTerminatedCString;
23	@end extern NSString * const NSBundleDidLoadNotification;
24	@interface NSAssertionHandler : NSObject {}
25	+ (NSAssertionHandler *)currentHandler;
26	- (void)handleFailureInMethod:(SEL)selector object:(id)object file:(NSString )fileName lineNumber:(NSInteger)line description:(NSString )format,...;
27	@end
28	extern NSString * const NSConnectionReplyMode;
29
30	#ifdef TEST_64
31	typedef long long int64_t;
32	typedef int64_t intptr_t;
33	#else
34	typedef int int32_t;
35	typedef int32_t intptr_t;
36	#endif
37
38	//---------------------------------------------------------------------------
39	// Test case 'checkaccess_union' differs for region store and basic store.
40	// The basic store doesn't reason about compound literals, so the code
41	// below won't fire an "uninitialized value" warning.
42	//---------------------------------------------------------------------------
43
44	// PR 2948 (testcase; crash on VisitLValue for union types)
45	// http://llvm.org/bugs/show_bug.cgi?id=2948
46	void checkaccess_union() {
47	int ret = 0, status;
48	// Since RegionStore doesn't handle unions yet,
49	// this branch condition won't be triggered
50	// as involving an uninitialized value.
51	if (((((__extension__ (((union { // no-warning
52	__typeof (status) __in; int __i;}
53	)
54	{
55	.__in = (status)}
56	).__i))) & 0xff00) >> 8) == 1)
57	ret = 1;
58	}
59
60	// Check our handling of fields being invalidated by function calls.
61	struct test2_struct { int x; int y; char* s; };
62	void test2_help(struct test2_struct* p);
63
64	char test2() {
65	struct test2_struct s;
66	test2_help(&s);
67	char *p = 0;
68
69	if (s.x > 1) {
70	if (s.s != 0) {
71	p = "hello";
72	}
73	}
74
75	if (s.x > 1) {
76	if (s.s != 0) {
77	return *p;
78	}
79	}
80
81	return 'a';
82	}
83
84	// BasicStore handles this case incorrectly because it doesn't reason about
85	// the value pointed to by 'x' and thus creates different symbolic values
86	// at the declarations of 'a' and 'b' respectively. RegionStore handles
87	// it correctly. See the companion test in 'misc-ps-basic-store.m'.
88	void test_trivial_symbolic_comparison_pointer_parameter(int *x) {
89	int a = *x;
90	int b = *x;
91	if (a != b) {
92	int *p = 0;
93	*p = 0xDEADBEEF; // no-warning
94	}
95	}
96
97	// This is a modified test from 'misc-ps.m'. Here we have the extra
98	// NULL dereferences which are pruned out by RegionStore's symbolic reasoning
99	// of fields.
100	typedef struct _BStruct { void *grue; } BStruct;
101	void testB_aux(void *ptr);
102
103	void testB(BStruct *b) {
104	{
105	int __gruep__ = ((int )&((b)->grue));
106	int __gruev__ = *__gruep__;
107	int __gruev2__ = *__gruep__;
108	if (__gruev__ != __gruev2__) {
109	int *p = 0;
110	*p = 0xDEADBEEF; // no-warning
111	}
112
113	testB_aux(__gruep__);
114	}
115	{
116	int __gruep__ = ((int )&((b)->grue));
117	int __gruev__ = *__gruep__;
118	int __gruev2__ = *__gruep__;
119	if (__gruev__ != __gruev2__) {
120	int *p = 0;
121	*p = 0xDEADBEEF; // no-warning
122	}
123
124	if (~0 != __gruev__) {}
125	}
126	}
127
128	void testB_2(BStruct *b) {
129	{
130	int __gruep__ = ((int )&((b)->grue));
131	int __gruev__ = __gruep__;
132	testB_aux(__gruep__);
133	}
134	{
135	int __gruep__ = ((int )&((b)->grue));
136	int __gruev__ = __gruep__;
137	if ((int*)~0 != __gruev__) {}
138	}
139	}
140
141	// This test case is a reduced case of a caching bug discovered by an
142	// assertion failure in RegionStoreManager::BindArray. Essentially the
143	// DeclStmt is evaluated twice, but on the second loop iteration the
144	// engine caches out. Previously a false transition would cause UnknownVal
145	// to bind to the variable, firing an assertion failure. This bug was fixed
146	// in r76262.
147	void test_declstmt_caching() {
148	again:
149	{
150	const char a[] = "I like to crash";
151	goto again;
152	}
153	}
154
155	//===----------------------------------------------------------------------===//
156	// Reduced test case from <rdar://problem/7114618>.
157	// Basically a null check is performed on the field value, which is then
158	// assigned to a variable and then checked again.
159	//===----------------------------------------------------------------------===//
160	struct s_7114618 { int *p; };
161	void test_rdar_7114618(struct s_7114618 *s) {
162	if (s->p) {
163	int *p = s->p;
164	if (!p) {
165	// Infeasible
166	int *dead = 0;
167	*dead = 0xDEADBEEF; // no-warning
168	}
169	}
170	}
171
172	// Test pointers increment correctly.
173	void f() {
174	int a[2];
175	a[1] = 3;
176	int *p = a;
177	p++;
178	if (*p != 3) {
179	int *q = 0;
180	*q = 3; // no-warning
181	}
182	}
183
184	//===----------------------------------------------------------------------===//
185	// <rdar://problem/7185607>
186	// Bit-fields of a struct should be invalidated when blasting the entire
187	// struct with an integer constant.
188	//===----------------------------------------------------------------------===//
189	struct test_7185607 {
190	int x : 10;
191	int y : 22;
192	};
193	int rdar_test_7185607() {
194	struct test_7185607 s; // Uninitialized.
195	((unsigned ) &s) = 0U;
196	return s.x; // no-warning
197	}
198
199	//===----------------------------------------------------------------------===//
200	// <rdar://problem/7242006> [RegionStore] compound literal assignment with
201	// floats not honored
202	// This test case is mirrored in misc-ps.m, but this case is a negative.
203	//===----------------------------------------------------------------------===//
204	typedef float CGFloat;
205	typedef struct _NSSize {
206	CGFloat width;
207	CGFloat height;
208	} NSSize;
209
210	CGFloat rdar7242006_negative(CGFloat x) {
211	NSSize y;
212	return y.width; // expected-warning{{garbage}}
213	}
214
215	//===----------------------------------------------------------------------===//
216	// <rdar://problem/7249340> - Allow binding of values to symbolic regions.
217	// This test case shows how RegionStore tracks the value bound to 'x'
218	// after the assignment.
219	//===----------------------------------------------------------------------===//
220	typedef int* ptr_rdar_7249340;
221	void rdar_7249340(ptr_rdar_7249340 x) {
222	*x = 1;
223	if (*x)
224	return;
225	int *p = 0; // This is unreachable.
226	*p = 0xDEADBEEF; // no-warning
227	}
228
229	//===----------------------------------------------------------------------===//
230	// <rdar://problem/7249327> - This test case tests both value tracking of
231	// array values and that we handle symbolic values that are casted
232	// between different integer types. Note the assignment 'n = *a++'; here
233	// 'n' is and 'int' and '*a' is 'unsigned'. Previously we got a false positive
234	// at 'x += *b++' (undefined value) because we got a false path.
235	//===----------------------------------------------------------------------===//
236	int rdar_7249327_aux(void);
237
238	void rdar_7249327(unsigned int A[2*32]) {
239	int B[2*32];
240	int *b;
241	unsigned int *a;
242	int x = 0;
243
244	int n;
245
246	a = A;
247	b = B;
248
249	n = *a++;
250	if (n)
251	*b++ = rdar_7249327_aux();
252
253	a = A;
254	b = B;
255
256	n = *a++;
257	if (n)
258	x += *b++; // no-warning
259	}
260
261	//===----------------------------------------------------------------------===//
262	// <rdar://problem/6914474> - Check that 'x' is invalidated because its
263	// address is passed in as a value to a struct.
264	//===----------------------------------------------------------------------===//
265	struct doodad_6914474 { int *v; };
266	extern void prod_6914474(struct doodad_6914474 *d);
267	int rdar_6914474(void) {
268	int x;
269	struct doodad_6914474 d;
270	d.v = &x;
271	prod_6914474(&d);
272	return x; // no-warning
273	}
274
275	// Test invalidation of a single field.
276	struct s_test_field_invalidate {
277	int x;
278	};
279	extern void test_invalidate_field(int *x);
280	int test_invalidate_field_test() {
281	struct s_test_field_invalidate y;
282	test_invalidate_field(&y.x);
283	return y.x; // no-warning
284	}
285	int test_invalidate_field_test_positive() {
286	struct s_test_field_invalidate y;
287	return y.x; // expected-warning{{garbage}}
288	}
289
290	// This test case illustrates how a typeless array of bytes casted to a
291	// struct should be treated as initialized. RemoveDeadBindings previously
292	// had a bug that caused 'x' to lose its default symbolic value after the
293	// assignment to 'p', thus causing 'p->z' to evaluate to "undefined".
294	struct ArrayWrapper { unsigned char y[16]; };
295	struct WrappedStruct { unsigned z; };
296
297	void test_handle_array_wrapper_helper();
298
299	int test_handle_array_wrapper() {
300	struct ArrayWrapper x;
301	test_handle_array_wrapper_helper(&x);
302	struct WrappedStruct p = (struct WrappedStruct) x.y; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}}
303	return p->z; // no-warning
304	}
305
306	//===----------------------------------------------------------------------===//
307	// <rdar://problem/7261075> [RegionStore] crash when
308	// handling load: '((unsigned int )"????")'
309	//===----------------------------------------------------------------------===//
310
311	int rdar_7261075(void) {
312	unsigned int var = 0;
313	if (var == ((unsigned int )"????"))
314	return 1;
315	return 0;
316	}
317
318	//===----------------------------------------------------------------------===//
319	// <rdar://problem/7275774> false path due to limited pointer
320	// arithmetic constraints
321	//===----------------------------------------------------------------------===//
322
323	void rdar_7275774(void *data, unsigned n) {
324	if (!(data \|\| n == 0))
325	return;
326
327	unsigned short p = (unsigned short) data;
328	unsigned short *q = p + (n / 2);
329
330	if (p < q) {
331	// If we reach here, 'p' cannot be null. If 'p' is null, then 'n' must
332	// be '0', meaning that this branch is not feasible.
333	p = q; // no-warning
334	}
335	}
336
337	//===----------------------------------------------------------------------===//
338	// <rdar://problem/7312221>
339	//
340	// Test that Objective-C instance variables aren't prematurely pruned
341	// from the analysis state.
342	//===----------------------------------------------------------------------===//
343
344	struct rdar_7312221_value { int x; };
345
346	@interface RDar7312221
347	{
348	struct rdar_7312221_value *y;
349	}
350	- (void) doSomething_7312221;
351	@end
352
353	extern struct rdar_7312221_value *rdar_7312221_helper();
354	extern int rdar_7312221_helper_2(id o);
355	extern void rdar_7312221_helper_3(int z);
356
357	@implementation RDar7312221
358	- (void) doSomething_7312221 {
359	if (y == 0) {
360	y = rdar_7312221_helper();
361	if (y != 0) {
362	y->x = rdar_7312221_helper_2(self);
363	// The following use of 'y->x' previously triggered a null dereference, as the value of 'y'
364	// before 'y = rdar_7312221_helper()' would be used.
365	rdar_7312221_helper_3(y->x); // no-warning
366	}
367	}
368	}
369	@end
370
371	struct rdar_7312221_container {
372	struct rdar_7312221_value *y;
373	};
374
375	extern int rdar_7312221_helper_4(struct rdar_7312221_container *s);
376
377	// This test case essentially matches the one in [RDar7312221 doSomething_7312221].
378	void doSomething_7312221_with_struct(struct rdar_7312221_container *Self) {
379	if (Self->y == 0) {
380	Self->y = rdar_7312221_helper();
381	if (Self->y != 0) {
382	Self->y->x = rdar_7312221_helper_4(Self);
383	rdar_7312221_helper_3(Self->y->x); // no-warning
384	}
385	}
386	}
387
388	//===----------------------------------------------------------------------===//
389	// <rdar://problem/7332673> - Just more tests cases for regions
390	//===----------------------------------------------------------------------===//
391
392	void rdar_7332673_test1() {
393	char value[1];
394	if ( *(value) != 1 ) {} // expected-warning{{The left operand of '!=' is a garbage value}}
395	}
396	int rdar_7332673_test2_aux(char *x);
397	void rdar_7332673_test2() {
398	char *value;
399	if ( rdar_7332673_test2_aux(value) != 1 ) {} // expected-warning{{1st function call argument is an uninitialized value}}
400	}
401
402	//===----------------------------------------------------------------------===//
403	// <rdar://problem/7347252>: Because of a bug in
404	// RegionStoreManager::RemoveDeadBindings(), the symbol for s->session->p
405	// would incorrectly be pruned from the state after the call to
406	// rdar7347252_malloc1(), and would incorrectly result in a warning about
407	// passing a null pointer to rdar7347252_memcpy().
408	//===----------------------------------------------------------------------===//
409
410	struct rdar7347252_AA { char *p;};
411	typedef struct {
412	struct rdar7347252_AA *session;
413	int t;
414	char *q;
415	} rdar7347252_SSL1;
416
417	int rdar7347252_f(rdar7347252_SSL1 *s);
418	char *rdar7347252_malloc1(int);
419	char rdar7347252_memcpy1(char d, char *s, int n) __attribute__((nonnull (1,2)));
420
421	int rdar7347252(rdar7347252_SSL1 *s) {
422	rdar7347252_f(s); // the SymbolicRegion of 's' is set a default binding of conjured symbol
423	if (s->session->p == ((void*)0)) {
424	if ((s->session->p = rdar7347252_malloc1(10)) == ((void*)0)) {
425	return 0;
426	}
427	rdar7347252_memcpy1(s->session->p, "aa", 2); // no-warning
428	}
429	return 0;
430	}
431
432	//===----------------------------------------------------------------------===//
433	// PR 5316 - "crash when accessing field of lazy compound value"
434	// Previously this caused a crash at the MemberExpr '.chr' when loading
435	// a field value from a LazyCompoundVal
436	//===----------------------------------------------------------------------===//
437
438	typedef unsigned int pr5316_wint_t;
439	typedef pr5316_wint_t pr5316_REFRESH_CHAR;
440	typedef struct {
441	pr5316_REFRESH_CHAR chr;
442	}
443	pr5316_REFRESH_ELEMENT;
444	static void pr5316(pr5316_REFRESH_ELEMENT dst, const pr5316_REFRESH_ELEMENT src) {
445	while ((dst++ = src++).chr != L'\0') ;
446	}
447
448	//===----------------------------------------------------------------------===//
449	// Exercise creating ElementRegion with symbolic super region.
450	//===----------------------------------------------------------------------===//
451	void element_region_with_symbolic_superregion(int* p) {
452	int *x;
453	int a;
454	if (p[0] == 1)
455	x = &a;
456	if (p[0] == 1)
457	(void)*x; // no-warning
458	}
459
460	//===----------------------------------------------------------------------===//
461	// Test returning an out-of-bounds pointer (CWE-466)
462	//===----------------------------------------------------------------------===//
463
464	static int test_cwe466_return_outofbounds_pointer_a[10];
465	int *test_cwe466_return_outofbounds_pointer() {
466	int *p = test_cwe466_return_outofbounds_pointer_a+10;
467	return p; // expected-warning{{Returned pointer value points outside the original object}}
468	}
469
470	//===----------------------------------------------------------------------===//
471	// PR 3135 - Test case that shows that a variable may get invalidated when its
472	// address is included in a structure that is passed-by-value to an unknown function.
473	//===----------------------------------------------------------------------===//
474
475	typedef struct { int *a; } pr3135_structure;
476	int pr3135_bar(pr3135_structure *x);
477	int pr3135() {
478	int x;
479	pr3135_structure y = { &x };
480	// the call to pr3135_bar may initialize x
481	if (pr3135_bar(&y) && x) // no-warning
482	return 1;
483	return 0;
484	}
485
486	//===----------------------------------------------------------------------===//
487	// <rdar://problem/7403269> - Test that we handle compound initializers with
488	// partially unspecified array values. Previously this caused a crash.
489	//===----------------------------------------------------------------------===//
490
491	typedef struct RDar7403269 {
492	unsigned x[10];
493	unsigned y;
494	} RDar7403269;
495
496	void rdar7403269() {
497	RDar7403269 z = { .y = 0 };
498	if (z.x[4] == 0)
499	return;
500	int *p = 0;
501	*p = 0xDEADBEEF; // no-warning
502	}
503
504	typedef struct RDar7403269_b {
505	struct zorg { int w; int k; } x[10];
506	unsigned y;
507	} RDar7403269_b;
508
509	void rdar7403269_b() {
510	RDar7403269_b z = { .y = 0 };
511	if (z.x[5].w == 0)
512	return;
513	int *p = 0;
514	*p = 0xDEADBEEF; // no-warning
515	}
516
517	void rdar7403269_b_pos() {
518	RDar7403269_b z = { .y = 0 };
519	if (z.x[5].w == 1)
520	return;
521	int *p = 0;
522	*p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}}
523	}
524
525
526	//===----------------------------------------------------------------------===//
527	// Test that incrementing a non-null pointer results in a non-null pointer.
528	// (<rdar://problem/7191542>)
529	//===----------------------------------------------------------------------===//
530
531	void test_increment_nonnull_rdar_7191542(const char *path) {
532	const char *alf = 0;
533
534	for (;;) {
535	// When using basic-store, we get a null dereference here because we lose information
536	// about path after the pointer increment.
537	char c = *path++; // no-warning
538	if (c == 'a') {
539	alf = path;
540	}
541
542	if (alf)
543	return;
544	}
545	}
546
547	//===----------------------------------------------------------------------===//
548	// Test that the store (implicitly) tracks values for doubles/floats that are
549	// uninitialized (<rdar://problem/6811085>)
550	//===----------------------------------------------------------------------===//
551
552	double rdar_6811085(void) {
553	double u;
554	return u + 10; // expected-warning{{The left operand of '+' is a garbage value}}
555	}
556
557	//===----------------------------------------------------------------------===//
558	// Path-sensitive tests for blocks.
559	//===----------------------------------------------------------------------===//
560
561	void indirect_block_call(void (^f)());
562
563	int blocks_1(int *p, int z) {
564	__block int *q = 0;
565	void (^bar)() = ^{ q = p; };
566
567	if (z == 1) {
568	// The call to 'bar' might cause 'q' to be invalidated.
569	bar();
570	*q = 0x1; // no-warning
571	}
572	else if (z == 2) {
573	// The function 'indirect_block_call' might invoke bar, thus causing
574	// 'q' to possibly be invalidated.
575	indirect_block_call(bar);
576	*q = 0x1; // no-warning
577	}
578	else {
579	*q = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}}
580	}
581	return z;
582	}
583
584	int blocks_2(int *p, int z) {
585	int *q = 0;
586	void (^bar)(int ) = ^(int r){ *r = p; };
587
588	if (z) {
589	// The call to 'bar' might cause 'q' to be invalidated.
590	bar(&q);
591	*q = 0x1; // no-warning
592	}
593	else {
594	*q = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}}
595	}
596	return z;
597	}
598
599	// Test that the value of 'x' is considered invalidated after the block
600	// is passed as an argument to the message expression.
601	typedef void (^RDar7582031CB)(void);
602	@interface RDar7582031
603	- rdar7582031:RDar7582031CB;
604	- rdar7582031_b:RDar7582031CB;
605	@end
606
607	// Test with one block.
608	unsigned rdar7582031(RDar7582031 *o) {
609	__block unsigned x;
610	[o rdar7582031:^{ x = 1; }];
611	return x; // no-warning
612	}
613
614	// Test with two blocks.
615	unsigned long rdar7582031_b(RDar7582031 *o) {
616	__block unsigned y;
617	__block unsigned long x;
618	[o rdar7582031:^{ y = 1; }];
619	[o rdar7582031_b:^{ x = 1LL; }];
620	return x + (unsigned long) y; // no-warning
621	}
622
623	// Show we get an error when 'o' is null because the message
624	// expression has no effect.
625	unsigned long rdar7582031_b2(RDar7582031 *o) {
626	__block unsigned y;
627	__block unsigned long x;
628	if (o)
629	return 1;
630	[o rdar7582031:^{ y = 1; }];
631	[o rdar7582031_b:^{ x = 1LL; }];
632	return x + (unsigned long) y; // expected-warning{{The left operand of '+' is a garbage value}}
633	}
634
635	// Show that we handle static variables also getting invalidated.
636	void rdar7582031_aux(void (^)(void));
637	RDar7582031 *rdar7582031_aux_2();
638
639	unsigned rdar7582031_static() {
640	static RDar7582031 *o = 0;
641	rdar7582031_aux(^{ o = rdar7582031_aux_2(); });
642
643	__block unsigned x;
644	[o rdar7582031:^{ x = 1; }];
645	return x; // no-warning
646	}
647
648	//===----------------------------------------------------------------------===//
649	// <rdar://problem/7462324> - Test that variables passed using __blocks
650	// are not treated as being uninitialized.
651	//===----------------------------------------------------------------------===//
652
653	typedef void (^RDar_7462324_Callback)(id obj);
654
655	@interface RDar7462324
656	- (void) foo:(id)target;
657	- (void) foo_positive:(id)target;
658
659	@end
660
661	@implementation RDar7462324
662	- (void) foo:(id)target {
663	__block RDar_7462324_Callback builder = ((void*) 0);
664	builder = ^(id object) {
665	if (object) {
666	builder(self); // no-warning
667	}
668	};
669	builder(target);
670	}
671	- (void) foo_positive:(id)target {
672	__block RDar_7462324_Callback builder = ((void*) 0);
673	builder = ^(id object) {
674	id x;
675	if (object) {
676	builder(x); // expected-warning{{1st block call argument is an uninitialized value}}
677	}
678	};
679	builder(target);
680	}
681	@end
682
683	//===----------------------------------------------------------------------===//
684	// <rdar://problem/7468209> - Scanning for live variables within a block should
685	// not crash on variables passed by reference via __block.
686	//===----------------------------------------------------------------------===//
687
688	int rdar7468209_aux();
689	void rdar7468209_aux_2();
690
691	void rdar7468209() {
692	__block int x = 0;
693	^{
694	x = rdar7468209_aux();
695	// We need a second statement so that 'x' would be removed from the store if it wasn't
696	// passed by reference.
697	rdar7468209_aux_2();
698	}();
699	}
700
701	//===----------------------------------------------------------------------===//
702	// PR 5857 - Test loading an integer from a byte array that has also been
703	// reinterpreted to be loaded as a field.
704	//===----------------------------------------------------------------------===//
705
706	typedef struct { int x; } TestFieldLoad;
707	int pr5857(char *src) {
708	TestFieldLoad tfl = (TestFieldLoad ) (intptr_t) src;
709	int y = tfl->x;
710	long long z = (long long ) (intptr_t) src;
711	long long w = 0;
712	int n = 0;
713	for (n = 0; n < y; ++n) {
714	// Previously we crashed analyzing this statement.
715	w = *z++;
716	}
717	return 1;
718	}
719
720	//===----------------------------------------------------------------------===//
721	// PR 4358 - Without field-sensitivity, this code previously triggered
722	// a false positive that 'uninit' could be uninitialized at the call
723	// to pr4358_aux().
724	//===----------------------------------------------------------------------===//
725
726	struct pr4358 {
727	int bar;
728	int baz;
729	};
730	void pr4358_aux(int x);
731	void pr4358(struct pr4358 *pnt) {
732	int uninit;
733	if (pnt->bar < 3) {
734	uninit = 1;
735	} else if (pnt->baz > 2) {
736	uninit = 3;
737	} else if (pnt->baz <= 2) {
738	uninit = 2;
739	}
740	pr4358_aux(uninit); // no-warning
741	}
742
743	//===----------------------------------------------------------------------===//
744	// <rdar://problem/7526777>
745	// Test handling fields of values returned from function calls or
746	// message expressions.
747	//===----------------------------------------------------------------------===//
748
749	typedef struct testReturn_rdar_7526777 {
750	int x;
751	int y;
752	} testReturn_rdar_7526777;
753
754	@interface TestReturnStruct_rdar_7526777
755	- (testReturn_rdar_7526777) foo;
756	@end
757
758	int test_return_struct(TestReturnStruct_rdar_7526777 *x) {
759	return [x foo].x;
760	}
761
762	testReturn_rdar_7526777 test_return_struct_2_aux_rdar_7526777();
763
764	int test_return_struct_2_rdar_7526777() {
765	return test_return_struct_2_aux_rdar_7526777().x;
766	}
767
768	//===----------------------------------------------------------------------===//
769	// <rdar://problem/7527292> Assertion failed: (Op == BinaryOperator::Add \|\|
770	// Op == BinaryOperator::Sub)
771	// This test case previously triggered an assertion failure due to a discrepancy
772	// been the loaded/stored value in the array
773	//===----------------------------------------------------------------------===//
774
775	_Bool OSAtomicCompareAndSwapPtrBarrier( void __oldValue, void __newValue, void * volatile *__theValue );
776
777	void rdar_7527292() {
778	static id Cache7527292[32];
779	for (signed long idx = 0;
780	idx < 32;
781	idx++) {
782	id v = Cache7527292[idx];
783	if (v && OSAtomicCompareAndSwapPtrBarrier(v, ((void)0), (void volatile *)(Cache7527292 + idx))) {
784	}
785	}
786	}
787
788	//===----------------------------------------------------------------------===//
789	// <rdar://problem/7515938> - Handle initialization of incomplete arrays
790	// in structures using a compound value. Previously this crashed.
791	//===----------------------------------------------------------------------===//
792
793	struct rdar_7515938 {
794	int x;
795	int y[];
796	};
797
798	const struct rdar_7515938 *rdar_7515938() {
799	static const struct rdar_7515938 z = { 0, { 1, 2 } };
800	if (z.y[0] != 1) {
801	int *p = 0;
802	*p = 0xDEADBEEF; // no-warning
803	}
804	return &z;
805	}
806
807	struct rdar_7515938_str {
808	int x;
809	char y[];
810	};
811
812	const struct rdar_7515938_str *rdar_7515938_str() {
813	static const struct rdar_7515938_str z = { 0, "hello" };
814	return &z;
815	}
816
817	//===----------------------------------------------------------------------===//
818	// Assorted test cases from PR 4172.
819	//===----------------------------------------------------------------------===//
820
821	struct PR4172A_s { int *a; };
822
823	void PR4172A_f2(struct PR4172A_s *p);
824
825	int PR4172A_f1(void) {
826	struct PR4172A_s m;
827	int b[4];
828	m.a = b;
829	PR4172A_f2(&m);
830	return b[3]; // no-warning
831	}
832
833	struct PR4172B_s { int *a; };
834
835	void PR4172B_f2(struct PR4172B_s *p);
836
837	int PR4172B_f1(void) {
838	struct PR4172B_s m;
839	int x;
840	m.a = &x;
841	PR4172B_f2(&m);
842	return x; // no-warning
843	}
844
845	//===----------------------------------------------------------------------===//
846	// Test invalidation of values in struct literals.
847	//===----------------------------------------------------------------------===//
848
849	struct s_rev96062 { int x; int y; };
850	struct s_rev96062_nested { struct s_rev96062 z; };
851
852	void test_a_rev96062_aux(struct s_rev96062 *s);
853	void test_a_rev96062_aux2(struct s_rev96062_nested *s);
854
855	int test_a_rev96062() {
856	int a, b;
857	struct s_rev96062 x = { &a, &b };
858	test_a_rev96062_aux(&x);
859	return a + b; // no-warning
860	}
861	int test_b_rev96062() {
862	int a, b;
863	struct s_rev96062 x = { &a, &b };
864	struct s_rev96062 z = x;
865	test_a_rev96062_aux(&z);
866	return a + b; // no-warning
867	}
868	int test_c_rev96062() {
869	int a, b;
870	struct s_rev96062 x = { &a, &b };
871	struct s_rev96062_nested w = { x };
872	struct s_rev96062_nested z = w;
873	test_a_rev96062_aux2(&z);
874	return a + b; // no-warning
875	}
876
877	//===----------------------------------------------------------------------===//
878	// <rdar://problem/7242010> - The access to y[0] at the bottom previously
879	// was reported as an uninitialized value.
880	//===----------------------------------------------------------------------===//
881
882	char rdar_7242010(int count, char *y) {
883	char *x = alloca((count + 4) sizeof(*x));
884	x[0] = "hi";
885	x[1] = "there";
886	x[2] = "every";
887	x[3] = "body";
888	memcpy(x + 4, y, count * sizeof(*x));
889	y = x;
890	return y[0]; // no-warning
891	}
892
893	//===----------------------------------------------------------------------===//
894	// <rdar://problem/7770737>
895	//===----------------------------------------------------------------------===//
896
897	struct rdar_7770737_s { intptr_t p; };
898	void rdar_7770737_aux(struct rdar_7770737_s *p);
899	int rdar_7770737(void)
900	{
901	int x;
902
903	// Previously 'f' was not properly invalidated, causing the use of
904	// an uninitailized value below.
905	struct rdar_7770737_s f = { .p = (intptr_t)&x };
906	rdar_7770737_aux(&f);
907	return x; // no-warning
908	}
909	int rdar_7770737_pos(void)
910	{
911	int x;
912	struct rdar_7770737_s f = { .p = (intptr_t)&x };
913	return x; // expected-warning{{Undefined or garbage value returned to caller}}
914	}
915
916	//===----------------------------------------------------------------------===//
917	// Test handling of the implicit 'isa' field. For now we don't do anything
918	// interesting.
919	//===----------------------------------------------------------------------===//
920
921	void pr6302(id x, Class y) {
922	// This previously crashed the analyzer (reported in PR 6302)
923	x->isa = y; // expected-warning {{assignment to Objective-C's isa is deprecated in favor of object_setClass()}}
924	}
925
926	//===----------------------------------------------------------------------===//
927	// Specially handle global variables that are declared constant. In the
928	// example below, this forces the loop to take exactly 2 iterations.
929	//===----------------------------------------------------------------------===//
930
931	const int pr6288_L_N = 2;
932	void pr6288_(void) {
933	int x[2];
934	int *px[2];
935	int i;
936	for (i = 0; i < pr6288_L_N; i++)
937	px[i] = &x[i];
938	*(px[0]) = 0; // no-warning
939	}
940
941	void pr6288_pos(int z) {
942	int x[2];
943	int *px[2];
944	int i;
945	for (i = 0; i < z; i++)
946	px[i] = &x[i]; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
947	*(px[0]) = 0; // expected-warning{{Dereference of undefined pointer value}}
948	}
949
950	void pr6288_b(void) {
951	const int L_N = 2;
952	int x[2];
953	int *px[2];
954	int i;
955	for (i = 0; i < L_N; i++)
956	px[i] = &x[i];
957	*(px[0]) = 0; // no-warning
958	}
959
960	// <rdar://problem/7817800> - A bug in RemoveDeadBindings was causing instance variable bindings
961	// to get prematurely pruned from the state.
962	@interface Rdar7817800 {
963	char *x;
964	}
965	- (void) rdar7817800_baz;
966	@end
967
968	char *rdar7817800_foobar();
969	void rdar7817800_qux(void*);
970
971	@implementation Rdar7817800
972	- (void) rdar7817800_baz {
973	if (x)
974	rdar7817800_qux(x);
975	x = rdar7817800_foobar();
976	// Previously this triggered a bogus null dereference warning.
977	x[1] = 'a'; // no-warning
978	}
979	@end
980
981	// PR 6036 - This test case triggered a crash inside StoreManager::CastRegion because the size
982	// of 'unsigned long (*)[0]' is 0.
983	struct pr6036_a { int pr6036_b; };
984	struct pr6036_c;
985	void u132monitk (struct pr6036_c *pr6036_d) {
986	(void) ((struct pr6036_a ) (unsigned long ()[0]) ((char *) pr6036_d - 1))->pr6036_b; // expected-warning{{Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption}}
987	}
988
989	// <rdar://problem/7813989> - ?-expressions used as a base of a member expression should be treated as an lvalue
990	typedef struct rdar7813989_NestedVal { int w; } rdar7813989_NestedVal;
991	typedef struct rdar7813989_Val { rdar7813989_NestedVal nv; } rdar7813989_Val;
992
993	int rdar7813989(int x, rdar7813989_Val a, rdar7813989_Val b) {
994	// This previously crashed with an assertion failure.
995	int z = (x ? a->nv : b->nv).w;
996	return z + 1;
997	}
998
999	// PR 6844 - Don't crash on vaarg expression.
1000	typedef __builtin_va_list va_list;
1001	void map(int srcID, ...) {
1002	va_list ap;
1003	int i;
1004	for (i = 0; i < srcID; i++) {
1005	int v = __builtin_va_arg(ap, int);
1006	}
1007	}
1008
1009	// PR 6854 - crash when casting symbolic memory address to a float
1010	// Handle casting from a symbolic region to a 'float'. This isn't
1011	// really all that intelligent, but previously this caused a crash
1012	// in SimpleSValuator.
1013	void pr6854(void * arg) {
1014	void * a = arg;
1015	(void*)a = arg;
1016	float f = (float) a;
1017	}
1018
1019	// <rdar://problem/8032791> False positive due to symbolic store not find
1020	// value because of 'const' qualifier
1021	double rdar_8032791_2();
1022	double rdar_8032791_1() {
1023	struct R8032791 { double x[2]; double y; }
1024	data[3] = {
1025	{{1.0, 3.0}, 3.0}, // 1 2 3
1026	{{1.0, 1.0}, 0.0}, // 1 1 2 2 3 3
1027	{{1.0, 3.0}, 1.0} // 1 2 3
1028	};
1029
1030	double x = 0.0;
1031	for (unsigned i = 0 ; i < 3; i++) {
1032	const struct R8032791 *p = &data[i];
1033	x += p->y + rdar_8032791_2(); // no-warning
1034	}
1035	return x;
1036	}
1037
1038	// PR 7450 - Handle pointer arithmetic with __builtin_alloca
1039	void pr_7450_aux(void *x);
1040	void pr_7450() {
1041	void *p = __builtin_alloca(10);
1042	// Don't crash when analyzing the following statement.
1043	pr_7450_aux(p + 8);
1044	}
1045
1046	// <rdar://problem/8243408> - Symbolicate struct values returned by value.
1047	struct s_rdar_8243408 { int x; };
1048	extern struct s_rdar_8243408 rdar_8243408_aux(void);
1049	void rdar_8243408(void) {
1050	struct s_rdar_8243408 a = { 1 }, *b = 0;
1051	while (a.x && !b)
1052	a = rdar_8243408_aux();
1053
1054	// Previously there was a false error here with 'b' being null.
1055	(void) (a.x && b->x); // no-warning
1056
1057	// Introduce a null deref to ensure we are checking this path.
1058	int *p = 0;
1059	*p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}}
1060	}
1061
1062	// <rdar://problem/8258814>
1063	int r8258814()
1064	{
1065	int foo;
1066	int * a = &foo;
1067	a[0] = 10;
1068	// Do not warn that the value of 'foo' is uninitialized.
1069	return foo; // no-warning
1070	}
1071
1072	// PR 8052 - Don't crash when reasoning about loads from a function address.\n
1073	typedef unsigned int __uint32_t;
1074	typedef unsigned long vm_offset_t;
1075	typedef __uint32_t pd_entry_t;
1076	typedef unsigned char u_char;
1077	typedef unsigned int u_int;
1078	typedef unsigned long u_long;
1079	extern int bootMP_size;
1080	void bootMP(void);
1081	static void
1082	pr8052(u_int boot_addr)
1083	{
1084	int x;
1085	int size = (int ) ((u_long) & bootMP_size);
1086	u_char src = (u_char ) ((u_long) bootMP);
1087	u_char dst = (u_char ) boot_addr + ((vm_offset_t) ((((((((1 <<
1088	12) / (sizeof(pd_entry_t))) - 1) - 1) - (260 - 2))) << 22) \| ((0) << 12)));
1089	#ifdef TEST_64
1090	// expected-warning@-3 {{cast to 'u_char ' (aka 'unsigned char ') from smaller integer type 'u_int' (aka 'unsigned int')}}
1091	#endif
1092	for (x = 0;
1093	x < size;
1094	++x)
1095	dst++ = src++;
1096	}
1097
1098	// PR 8015 - don't return undefined values for arrays when using a valid
1099	// symbolic index
1100	int pr8015_A();
1101	void pr8015_B(const char *);
1102
1103	void pr8015_C() {
1104	int number = pr8015_A();
1105	const char *numbers[] = { "zero" };
1106	if (number == 0) {
1107	pr8015_B(numbers[number]); // no-warning
1108	}
1109	}
1110
1111	// Tests that we correctly handle that 'number' is perfectly constrained
1112	// after 'if (number == 0)', allowing us to resolve that
1113	// numbers[number] == numbers[0].
1114	void pr8015_D_FIXME() {
1115	int number = pr8015_A();
1116	const char *numbers[] = { "zero" };
1117	if (number == 0) {
1118	if (numbers[number] == numbers[0])
1119	return;
1120	// Unreachable.
1121	int *p = 0;
1122	*p = 0xDEADBEEF; // no-warnng
1123	}
1124	}
1125
1126	void pr8015_E() {
1127	// Similar to pr8015_C, but number is allowed to be a valid range.
1128	unsigned number = pr8015_A();
1129	const char *numbers[] = { "zero", "one", "two" };
1130	if (number < 3) {
1131	pr8015_B(numbers[number]); // no-warning
1132	}
1133	}
1134
1135	void pr8015_F_FIXME() {
1136	// Similar to pr8015_E, but like pr8015_D we check if the pointer
1137	// is the same as one of the string literals. The null dereference
1138	// here is not feasible in practice, so this is a false positive.
1139	int number = pr8015_A();
1140	const char *numbers[] = { "zero", "one", "two" };
1141	if (number < 3) {
1142	const char *p = numbers[number];
1143	if (p == numbers[0] \|\| p == numbers[1] \|\| p == numbers[2])
1144	return;
1145	int *q = 0;
1146	*q = 0xDEADBEEF; // expected-warning{{Dereference of null pointer}}
1147	}
1148	}
1149
1150	// PR 8141. Previously the statement expression in the for loop caused
1151	// the CFG builder to crash.
1152	struct list_pr8141
1153	{
1154	struct list_pr8141 *tail;
1155	};
1156
1157	struct list_pr8141 *
1158	pr8141 (void) {
1159	struct list_pr8141 *items;
1160	for (;; items = ({ do { } while (0); items->tail; })) // expected-warning{{Dereference of undefined pointer value}}
1161	{
1162	}
1163	}
1164
1165	// Don't crash when building the CFG.
1166	void do_not_crash(int x) {
1167	while (x - ({do {} while (0); x; })) {
1168	}
1169	}
1170
1171	// <rdar://problem/8424269> - Handle looking at the size of a VLA in
1172	// ArrayBoundChecker. Nothing intelligent (yet); just don't crash.
1173	typedef struct RDar8424269_A {
1174	int RDar8424269_C;
1175	} RDar8424269_A;
1176	static void RDar8424269_B(RDar8424269_A p, unsigned char RDar8424269_D,
1177	const unsigned char *RDar8424269_E, int RDar8424269_F,
1178	int b_w, int b_h, int dx, int dy) {
1179	int x, y, b, r, l;
1180	unsigned char tmp2t[3][RDar8424269_F * (32 + 8)];
1181	unsigned char *tmp2 = tmp2t[0];
1182	if (p && !p->RDar8424269_C)
1183	b = 15;
1184	tmp2 = tmp2t[1];
1185	if (b & 2) { // expected-warning{{The left operand of '&' is a garbage value}}
1186	for (y = 0; y < b_h; y++) {
1187	for (x = 0; x < b_w + 1; x++) {
1188	int am = 0;
1189	tmp2[x] = am;
1190	}
1191	}
1192	}
1193	tmp2 = tmp2t[2];
1194	}
1195
1196	// <rdar://problem/8642434> - Handle transparent unions with the NonNullParamChecker.
1197	typedef union {
1198	struct rdar_8642434_typeA *_dq;
1199	}
1200	rdar_8642434_typeB __attribute__((transparent_union));
1201
1202	__attribute__((visibility("default"))) __attribute__((__nonnull__)) __attribute__((__nothrow__))
1203	void rdar_8642434_funcA(rdar_8642434_typeB object);
1204
1205	void rdar_8642434_funcB(struct rdar_8642434_typeA x, struct rdar_8642434_typeA y) {
1206	rdar_8642434_funcA(x);
1207	if (!y)
1208	rdar_8642434_funcA(y); // expected-warning{{Null pointer passed as an argument to a 'nonnull' parameter}}
1209	}
1210
1211	// <rdar://problem/8848957> - Handle loads and stores from a symbolic index
1212	// into array without warning about an uninitialized value being returned.
1213	// While RegionStore can't fully reason about this example, it shouldn't
1214	// warn here either.
1215	typedef struct s_test_rdar8848957 {
1216	int x, y, z;
1217	} s_test_rdar8848957;
1218
1219	s_test_rdar8848957 foo_rdar8848957();
1220	int rdar8848957(int index) {
1221	s_test_rdar8848957 vals[10];
1222	vals[index] = foo_rdar8848957();
1223	return vals[index].x; // no-warning
1224	}
1225
1226	// PR 9049 - crash on symbolicating unions. This test exists solely to
1227	// test that the analyzer doesn't crash.
1228	typedef struct pr9048_cdev *pr9048_cdev_t;
1229	typedef union pr9048_abstracted_disklabel { void *opaque; } pr9048_disklabel_t;
1230	struct pr9048_diskslice { pr9048_disklabel_t ds_label; };
1231	struct pr9048_diskslices {
1232	int dss_secmult;
1233	struct pr9048_diskslice dss_slices[16];
1234	};
1235	void pr9048(pr9048_cdev_t dev, struct pr9048_diskslices * ssp, unsigned int slice)
1236	{
1237	pr9048_disklabel_t lp;
1238	struct pr9048_diskslice *sp;
1239	sp = &ssp->dss_slices[slice];
1240	if (ssp->dss_secmult == 1) {
1241	} else if ((lp = sp->ds_label).opaque != ((void *) 0)) {
1242	}
1243	}
1244
1245	// Test Store reference counting in the presence of Lazy compound values.
1246	// This previously caused an infinite recursion.
1247	typedef struct {} Rdar_9103310_A;
1248	typedef struct Rdar_9103310_B Rdar_9103310_B_t;
1249	struct Rdar_9103310_B {
1250	unsigned char Rdar_9103310_C[101];
1251	};
1252	void Rdar_9103310_E(Rdar_9103310_A * x, struct Rdar_9103310_C * b) { // expected-warning {{declaration of 'struct Rdar_9103310_C' will not be visible outside of this function}}
1253	char Rdar_9103310_D[4][4] = { "a", "b", "c", "d"};
1254	int i;
1255	Rdar_9103310_B_t y = (Rdar_9103310_B_t ) x;
1256	for (i = 0; i < 101; i++) {
1257	Rdar_9103310_F(b, "%2d%s ", (y->Rdar_9103310_C[i]) / 4, Rdar_9103310_D[(y->Rdar_9103310_C[i]) % 4]); // expected-warning {{implicit declaration of function 'Rdar_9103310_F' is invalid in C99}}
1258	}
1259	}
1260
1261	// Test handling binding lazy compound values to a region and then have
1262	// specific elements have other bindings.
1263	int PR9455() {
1264	char arr[4] = "000";
1265	arr[0] = '1';
1266	if (arr[1] == '0')
1267	return 1;
1268	int *p = 0;
1269	*p = 0xDEADBEEF; // no-warning
1270	return 1;
1271	}
1272	int PR9455_2() {
1273	char arr[4] = "000";
1274	arr[0] = '1';
1275	if (arr[1] == '0') {
1276	int *p = 0;
1277	*p = 0xDEADBEEF; // expected-warning {{null}}
1278	}
1279	return 1;
1280	}
1281
1282	// Test initialization of substructs via lazy compound values.
1283	typedef float RDar9163742_Float;
1284
1285	typedef struct {
1286	RDar9163742_Float x, y;
1287	} RDar9163742_Point;
1288	typedef struct {
1289	RDar9163742_Float width, height;
1290	} RDar9163742_Size;
1291	typedef struct {
1292	RDar9163742_Point origin;
1293	RDar9163742_Size size;
1294	} RDar9163742_Rect;
1295
1296	extern RDar9163742_Rect RDar9163742_RectIntegral(RDar9163742_Rect);
1297
1298	RDar9163742_Rect RDar9163742_IntegralRect(RDar9163742_Rect frame)
1299	{
1300	RDar9163742_Rect integralFrame;
1301	integralFrame.origin.x = frame.origin.x;
1302	integralFrame.origin.y = frame.origin.y;
1303	integralFrame.size = frame.size;
1304	return RDar9163742_RectIntegral(integralFrame); // no-warning; all fields initialized
1305	}
1306
1307	// Test correct handling of prefix '--' operator.
1308	void rdar9444714() {
1309	int x;
1310	char str[ 32 ];
1311	char buf[ 32 ];
1312	char * dst;
1313	char * ptr;
1314
1315	x = 1234;
1316	dst = str;
1317	ptr = buf;
1318	do
1319	{
1320	*ptr++ = (char)( '0' + ( x % 10 ) );
1321	x /= 10;
1322	} while( x > 0 );
1323
1324	while( ptr > buf )
1325	{
1326	dst++ = ( --( ptr ) ); // no-warning
1327	}
1328	*dst = '\0';
1329	}
1330
1331	// Test handling symbolic elements with field accesses.
1332	// <rdar://problem/11127008>
1333	typedef struct {
1334	unsigned value;
1335	} RDar11127008;
1336
1337	signed rdar_11127008_index();
1338
1339	static unsigned rdar_11127008(void) {
1340	RDar11127008 values[] = {{.value = 0}, {.value = 1}};
1341	signed index = rdar_11127008_index();
1342	if (index < 0) return 0;
1343	if (index >= 2) return 0;
1344	return values[index].value;
1345	}
1346
1347	// Test handling invalidating arrays passed to a block via captured
1348	// pointer value (not a __block variable).
1349	typedef void (^radar11125868_cb)(int *, unsigned);
1350
1351	void rdar11125868_aux(radar11125868_cb cb);
1352
1353	int rdar11125868() {
1354	int integersStackArray[1];
1355	int *integers = integersStackArray;
1356	rdar11125868_aux(^(int *integerValue, unsigned index) {
1357	integers[index] = integerValue[index];
1358	});
1359	return integers[0] == 0; // no-warning
1360	}
1361
1362	int rdar11125868_positive() {
1363	int integersStackArray[1];
1364	int *integers = integersStackArray;
1365	return integers[0] == 0; // expected-warning {{The left operand of '==' is a}}
1366	}
1367

Clang Project