1 // RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -disable-free -analyzer-eagerly-assume -analyzer-checker=core,deadcode,debug.ExprInspection -verify %s
3 void clang_analyzer_eval(int);
5 int size_rdar9373039 = 1;
6 int foo_rdar9373039(const char *);
12 for (int i = 0 ; i < size_rdar9373039 ; ++i)
15 int extra = (2 + foo_rdar9373039 ("Clang") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("Clang")) % 4)) % 4)) + (2 + foo_rdar9373039 ("1.0") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("1.0")) % 4)) % 4)); // expected-warning {{never read}}
17 for (int i = 0 ; i < size_rdar9373039 ; ++i)
18 j += x; // expected-warning {{garbage}}
25 // This should look through the __extension__ no-op.
26 if (__extension__ (t)) return 0;
27 return *t; // expected-warning {{null pointer}}
30 int PR8962_b (int *t) {
31 // This should still ignore the nested casts
32 // which aren't handled by a single IgnoreParens()
33 if (((int)((int)t))) return 0;
34 return *t; // expected-warning {{null pointer}}
37 int PR8962_c (int *t) {
38 // If the last element in a StmtExpr was a ParenExpr, it's still live
39 if (({ (t ? (_Bool)0 : (_Bool)1); })) return 0;
40 return *t; // no-warning
43 int PR8962_d (int *t) {
44 // If the last element in a StmtExpr is an __extension__, it's still live
45 if (({ __extension__(t ? (_Bool)0 : (_Bool)1); })) return 0;
46 return *t; // no-warning
49 int PR8962_e (int *t) {
50 // Redundant casts can mess things up!
51 // Environment used to skip through NoOp casts, but LiveVariables didn't!
52 if (({ (t ? (int)(int)0L : (int)(int)1L); })) return 0;
53 return *t; // no-warning
56 int PR8962_f (int *t) {
57 // The StmtExpr isn't a block-level expression here,
58 // the __extension__ is. But the value should be attached to the StmtExpr
59 // anyway. Make sure the block-level check is /before/ IgnoreParens.
66 return *t; // no-warning
69 // This previously crashed logic in the analyzer engine when evaluating locations.
70 void rdar10308201_aux(unsigned val);
71 void rdar10308201 (int valA, void *valB, unsigned valC) {
72 unsigned actual_base, lines;
74 actual_base = (unsigned)valB;
77 rdar10308201_aux(actual_base);
82 typedef struct Struct103 {
85 typedef unsigned int size_t;
86 void __my_memset_chk(char*, int, size_t);
87 static int radar10367606(int t) {
89 ((__builtin_object_size ((char *) &overall, 0) != (size_t) -1) ? __builtin___memset_chk ((char *) &overall, 0, sizeof(Struct103), __builtin_object_size ((char *) &overall, 0)) : __my_memset_chk ((char *) &overall, 0, sizeof(Struct103)));
93 /* Caching out on a sink node. */
94 extern int fooR10376675();
95 extern int* bazR10376675();
96 extern int nR10376675;
97 void barR10376675(int *x) {
100 int *pk = bazR10376675();
101 pm = pk; //expected-warning {{never read}}
108 // Test accesses to wide character strings doesn't break the analyzer.
110 struct rdar10385775 {
113 void RDar10385775(struct rdar10385775* p) {
117 // Test double loop of array and array literals. Previously this
118 // resulted in a false positive uninitailized value warning.
119 void rdar10686586() {
120 int array1[] = { 1, 2, 3, 0 };
121 int array2[] = { 1, 2, 3, 0 };
122 int *array[] = { array1, array2 };
124 for (int i = 0; i < 2; i++) {
125 for (int j = 0; j < 4; j++) {
126 sum += array[i][j]; // no-warning
131 // This example tests CFG handling of '||' nested in a ternary expression,
132 // and seeing that the analyzer doesn't crash.
133 int isctype(char c, unsigned long f)
135 return (c < 1 || c > 10) ? 0 : !!(c & f);
138 // Test that symbolic array offsets are modeled conservatively.
139 // This was triggering a false "use of uninitialized value" warning.
140 void rdar_12075238__aux(unsigned long y);
141 int rdar_12075238_(unsigned long count) {
142 if ((count < 3) || (count > 6))
145 unsigned long array[6];
147 for (; i <= count - 2; i++)
151 array[count - 1] = i;
152 rdar_12075238__aux(array[2]); // no-warning
156 // Test that we handle an uninitialized value within a logical expression.
157 void PR14635(int *p) {
159 *p = a || b; // expected-warning {{Assigned value is garbage or undefined}}
162 // Test handling floating point values with unary '!'.
164 double y = (double)x;
169 // PR15684: If a checker generates a sink node after generating a regular node
170 // and no state changes between the two, graph trimming would consider the two
171 // the same node, forming a loop.
173 void (*callback)(int);
175 void sinkAfterRegularNode(struct PR15684 *context) {
177 context->callback(uninitialized); // expected-warning {{uninitialized}}
181 // PR16131: C permits variables to be declared extern void.
182 static void PR16131(int x) {
186 char *cp = (char *)&v;
187 clang_analyzer_eval(ip == cp); // expected-warning{{TRUE}}
188 // expected-warning@-1 {{comparison of distinct pointer types}}
191 clang_analyzer_eval(*ip == 42); // expected-warning{{TRUE}}
192 clang_analyzer_eval(*(int *)&v == 42); // expected-warning{{TRUE}}
195 // PR15623: Currently the analyzer doesn't handle symbolic expressions of the
196 // form "(exp comparison_op expr) != 0" very well. We perform a simplification
197 // translating an assume of a constraint of the form "(exp comparison_op expr)
198 // != 0" to true into an assume of "exp comparison_op expr" to true.
199 void PR15623(int n) {
201 clang_analyzer_eval(n == 0); // expected-warning{{TRUE}}