2018-02-15 10:32:32 +08:00
|
|
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-config cfg-temporary-dtors=false -verify -w -std=c++03 %s
|
|
|
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-config cfg-temporary-dtors=false -verify -w -std=c++11 %s
|
2018-03-02 02:53:13 +08:00
|
|
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -DTEMPORARY_DTORS -verify -w -analyzer-config cfg-temporary-dtors=true,c++-temp-dtor-inlining=true %s -std=c++11
|
2012-08-29 09:11:59 +08:00
|
|
|
|
2013-02-22 07:57:17 +08:00
|
|
|
extern bool clang_analyzer_eval(bool);
|
2014-08-07 18:42:17 +08:00
|
|
|
extern bool clang_analyzer_warnIfReached();
|
2018-02-15 10:32:32 +08:00
|
|
|
void clang_analyzer_checkInlined(bool);
|
2013-02-22 07:57:17 +08:00
|
|
|
|
2018-02-16 03:34:19 +08:00
|
|
|
#include "Inputs/system-header-simulator-cxx.h";
|
|
|
|
|
2012-08-29 09:11:59 +08:00
|
|
|
struct Trivial {
|
|
|
|
Trivial(int x) : value(x) {}
|
|
|
|
int value;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct NonTrivial : public Trivial {
|
|
|
|
NonTrivial(int x) : Trivial(x) {}
|
|
|
|
~NonTrivial();
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
Trivial getTrivial() {
|
|
|
|
return Trivial(42); // no-warning
|
|
|
|
}
|
|
|
|
|
|
|
|
const Trivial &getTrivialRef() {
|
2013-02-26 09:21:21 +08:00
|
|
|
return Trivial(42); // expected-warning {{Address of stack memory associated with temporary object of type 'Trivial' returned to caller}}
|
2012-08-29 09:11:59 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
NonTrivial getNonTrivial() {
|
|
|
|
return NonTrivial(42); // no-warning
|
|
|
|
}
|
|
|
|
|
|
|
|
const NonTrivial &getNonTrivialRef() {
|
2013-02-26 09:21:21 +08:00
|
|
|
return NonTrivial(42); // expected-warning {{Address of stack memory associated with temporary object of type 'NonTrivial' returned to caller}}
|
2012-08-29 09:11:59 +08:00
|
|
|
}
|
|
|
|
|
2013-02-22 07:57:17 +08:00
|
|
|
namespace rdar13265460 {
|
|
|
|
struct TrivialSubclass : public Trivial {
|
|
|
|
TrivialSubclass(int x) : Trivial(x), anotherValue(-x) {}
|
|
|
|
int anotherValue;
|
|
|
|
};
|
|
|
|
|
|
|
|
TrivialSubclass getTrivialSub() {
|
|
|
|
TrivialSubclass obj(1);
|
|
|
|
obj.value = 42;
|
|
|
|
obj.anotherValue = -42;
|
|
|
|
return obj;
|
|
|
|
}
|
|
|
|
|
2013-02-22 09:51:15 +08:00
|
|
|
void testImmediate() {
|
2013-02-22 07:57:17 +08:00
|
|
|
TrivialSubclass obj = getTrivialSub();
|
|
|
|
|
|
|
|
clang_analyzer_eval(obj.value == 42); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(obj.anotherValue == -42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
clang_analyzer_eval(getTrivialSub().value == 42); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(getTrivialSub().anotherValue == -42); // expected-warning{{TRUE}}
|
|
|
|
}
|
2013-02-22 09:51:15 +08:00
|
|
|
|
|
|
|
void testMaterializeTemporaryExpr() {
|
|
|
|
const TrivialSubclass &ref = getTrivialSub();
|
|
|
|
clang_analyzer_eval(ref.value == 42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
const Trivial &baseRef = getTrivialSub();
|
|
|
|
clang_analyzer_eval(baseRef.value == 42); // expected-warning{{TRUE}}
|
|
|
|
}
|
2013-02-22 07:57:17 +08:00
|
|
|
}
|
|
|
|
|
2013-02-26 09:21:27 +08:00
|
|
|
namespace rdar13281951 {
|
|
|
|
struct Derived : public Trivial {
|
|
|
|
Derived(int value) : Trivial(value), value2(-value) {}
|
|
|
|
int value2;
|
|
|
|
};
|
|
|
|
|
|
|
|
void test() {
|
|
|
|
Derived obj(1);
|
|
|
|
obj.value = 42;
|
|
|
|
const Trivial * const &pointerRef = &obj;
|
|
|
|
clang_analyzer_eval(pointerRef->value == 42); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-05-07 00:48:20 +08:00
|
|
|
namespace compound_literals {
|
|
|
|
struct POD {
|
|
|
|
int x, y;
|
|
|
|
};
|
|
|
|
struct HasCtor {
|
|
|
|
HasCtor(int x, int y) : x(x), y(y) {}
|
|
|
|
int x, y;
|
|
|
|
};
|
|
|
|
struct HasDtor {
|
|
|
|
int x, y;
|
|
|
|
~HasDtor();
|
|
|
|
};
|
|
|
|
struct HasCtorDtor {
|
|
|
|
HasCtorDtor(int x, int y) : x(x), y(y) {}
|
|
|
|
~HasCtorDtor();
|
|
|
|
int x, y;
|
|
|
|
};
|
|
|
|
|
|
|
|
void test() {
|
|
|
|
clang_analyzer_eval(((POD){1, 42}).y == 42); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(((HasDtor){1, 42}).y == 42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
#if __cplusplus >= 201103L
|
|
|
|
clang_analyzer_eval(((HasCtor){1, 42}).y == 42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
// FIXME: should be TRUE, but we don't inline the constructors of
|
|
|
|
// temporaries because we can't model their destructors yet.
|
|
|
|
clang_analyzer_eval(((HasCtorDtor){1, 42}).y == 42); // expected-warning{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-07-26 01:22:05 +08:00
|
|
|
namespace destructors {
|
2014-08-07 18:42:17 +08:00
|
|
|
struct Dtor {
|
|
|
|
~Dtor();
|
|
|
|
};
|
|
|
|
extern bool coin();
|
|
|
|
extern bool check(const Dtor &);
|
2014-08-07 06:01:54 +08:00
|
|
|
|
2014-08-07 18:42:17 +08:00
|
|
|
void testPR16664andPR18159Crash() {
|
2014-05-05 17:58:03 +08:00
|
|
|
// Regression test: we used to assert here when tmp dtors are enabled.
|
2014-04-02 00:39:33 +08:00
|
|
|
// PR16664 and PR18159
|
2013-07-26 01:22:05 +08:00
|
|
|
if (coin() && (coin() || coin() || check(Dtor()))) {
|
|
|
|
Dtor();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-09-02 17:09:15 +08:00
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
struct NoReturnDtor {
|
|
|
|
~NoReturnDtor() __attribute__((noreturn));
|
|
|
|
};
|
|
|
|
|
|
|
|
void noReturnTemp(int *x) {
|
|
|
|
if (! x) NoReturnDtor();
|
|
|
|
*x = 47; // no warning
|
|
|
|
}
|
|
|
|
|
|
|
|
void noReturnInline(int **x) {
|
|
|
|
NoReturnDtor();
|
|
|
|
}
|
|
|
|
|
|
|
|
void callNoReturn() {
|
|
|
|
int *x;
|
|
|
|
noReturnInline(&x);
|
|
|
|
*x = 47; // no warning
|
|
|
|
}
|
|
|
|
|
|
|
|
extern bool check(const NoReturnDtor &);
|
|
|
|
|
|
|
|
void testConsistencyIf(int i) {
|
2013-07-26 01:22:05 +08:00
|
|
|
if (i != 5)
|
|
|
|
return;
|
|
|
|
if (i == 5 && (i == 4 || check(NoReturnDtor()) || i == 5)) {
|
2013-09-02 17:09:15 +08:00
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testConsistencyTernary(int i) {
|
|
|
|
(i == 5 && (i == 4 || check(NoReturnDtor()) || i == 5)) ? 1 : 0;
|
|
|
|
|
|
|
|
clang_analyzer_eval(true); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
if (i != 5)
|
|
|
|
return;
|
|
|
|
|
|
|
|
(i == 5 && (i == 4 || check(NoReturnDtor()) || i == 5)) ? 1 : 0;
|
|
|
|
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
|
2014-05-05 17:58:03 +08:00
|
|
|
// Regression test: we used to assert here.
|
2014-04-02 00:39:33 +08:00
|
|
|
// PR16664 and PR18159
|
2013-09-02 17:09:15 +08:00
|
|
|
void testConsistencyNested(int i) {
|
|
|
|
extern bool compute(bool);
|
2014-05-05 17:58:03 +08:00
|
|
|
|
2013-12-07 02:56:29 +08:00
|
|
|
if (i == 5 && (i == 4 || i == 5 || check(NoReturnDtor())))
|
2014-05-05 17:58:03 +08:00
|
|
|
clang_analyzer_eval(true); // expected-warning{{TRUE}}
|
|
|
|
|
2013-09-02 17:09:15 +08:00
|
|
|
if (i == 5 && (i == 4 || i == 5 || check(NoReturnDtor())))
|
2014-05-05 17:58:03 +08:00
|
|
|
clang_analyzer_eval(true); // expected-warning{{TRUE}}
|
2013-09-02 17:09:15 +08:00
|
|
|
|
|
|
|
if (i != 5)
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (compute(i == 5 &&
|
|
|
|
(i == 4 || compute(true) ||
|
|
|
|
compute(i == 5 && (i == 4 || check(NoReturnDtor()))))) ||
|
|
|
|
i != 4) {
|
2014-05-05 17:58:03 +08:00
|
|
|
clang_analyzer_eval(true); // expected-warning{{TRUE}}
|
2013-07-26 01:22:05 +08:00
|
|
|
}
|
2013-09-02 17:09:15 +08:00
|
|
|
|
|
|
|
if (compute(i == 5 &&
|
|
|
|
(i == 4 || i == 4 ||
|
|
|
|
compute(i == 5 && (i == 4 || check(NoReturnDtor()))))) ||
|
|
|
|
i != 4) {
|
2014-08-07 18:42:17 +08:00
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
2013-09-02 17:09:15 +08:00
|
|
|
}
|
2014-05-05 17:58:03 +08:00
|
|
|
}
|
2014-04-02 00:39:33 +08:00
|
|
|
|
|
|
|
// PR16664 and PR18159
|
|
|
|
void testConsistencyNestedSimple(bool value) {
|
|
|
|
if (value) {
|
|
|
|
if (!value || check(NoReturnDtor())) {
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// PR16664 and PR18159
|
|
|
|
void testConsistencyNestedComplex(bool value) {
|
|
|
|
if (value) {
|
|
|
|
if (!value || !value || check(NoReturnDtor())) {
|
2014-08-07 18:42:17 +08:00
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
2014-04-02 00:39:33 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// PR16664 and PR18159
|
|
|
|
void testConsistencyNestedWarning(bool value) {
|
|
|
|
if (value) {
|
|
|
|
if (!value || value || check(NoReturnDtor())) {
|
|
|
|
clang_analyzer_eval(true); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2014-08-07 18:42:17 +08:00
|
|
|
// PR16664 and PR18159
|
|
|
|
void testConsistencyNestedComplexMidBranch(bool value) {
|
|
|
|
if (value) {
|
|
|
|
if (!value || !value || check(NoReturnDtor()) || value) {
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// PR16664 and PR18159
|
|
|
|
void testConsistencyNestedComplexNestedBranch(bool value) {
|
|
|
|
if (value) {
|
|
|
|
if (!value || (!value || check(NoReturnDtor()) || value)) {
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// PR16664 and PR18159
|
|
|
|
void testConsistencyNestedVariableModification(bool value) {
|
|
|
|
bool other = true;
|
|
|
|
if (value) {
|
|
|
|
if (!other || !value || (other = false) || check(NoReturnDtor()) ||
|
|
|
|
!other) {
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testTernaryNoReturnTrueBranch(bool value) {
|
|
|
|
if (value) {
|
|
|
|
bool b = value && (value ? check(NoReturnDtor()) : true);
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
void testTernaryNoReturnFalseBranch(bool value) {
|
|
|
|
if (value) {
|
|
|
|
bool b = !value && !value ? true : check(NoReturnDtor());
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
void testTernaryIgnoreNoreturnBranch(bool value) {
|
|
|
|
if (value) {
|
|
|
|
bool b = !value && !value ? check(NoReturnDtor()) : true;
|
|
|
|
clang_analyzer_eval(true); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
void testTernaryTrueBranchReached(bool value) {
|
|
|
|
value ? clang_analyzer_warnIfReached() : // expected-warning{{REACHABLE}}
|
|
|
|
check(NoReturnDtor());
|
|
|
|
}
|
|
|
|
void testTernaryFalseBranchReached(bool value) {
|
|
|
|
value ? check(NoReturnDtor()) :
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testLoop() {
|
|
|
|
for (int i = 0; i < 10; ++i) {
|
|
|
|
if (i < 3 && (i >= 2 || check(NoReturnDtor()))) {
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
bool testRecursiveFrames(bool isInner) {
|
|
|
|
if (isInner ||
|
|
|
|
(clang_analyzer_warnIfReached(), false) || // expected-warning{{REACHABLE}}
|
|
|
|
check(NoReturnDtor()) ||
|
|
|
|
testRecursiveFrames(true)) {
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
void testRecursiveFramesStart() { testRecursiveFrames(false); }
|
|
|
|
|
|
|
|
void testLambdas() {
|
2015-09-12 00:55:01 +08:00
|
|
|
[]() { check(NoReturnDtor()); } != nullptr || check(Dtor());
|
2014-08-07 18:42:17 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void testGnuExpressionStatements(int v) {
|
|
|
|
({ ++v; v == 10 || check(NoReturnDtor()); v == 42; }) || v == 23;
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
|
|
|
|
({ ++v; check(NoReturnDtor()); v == 42; }) || v == 23;
|
|
|
|
clang_analyzer_warnIfReached(); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
|
|
|
|
void testGnuExpressionStatementsDestructionPoint(int v) {
|
|
|
|
// In normal context, the temporary destructor runs at the end of the full
|
|
|
|
// statement, thus the last statement is reached.
|
|
|
|
(++v, check(NoReturnDtor()), v == 42),
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
|
|
|
|
// GNU expression statements execute temporary destructors within the
|
|
|
|
// blocks, thus the last statement is not reached.
|
|
|
|
({ ++v; check(NoReturnDtor()); v == 42; }),
|
|
|
|
clang_analyzer_warnIfReached(); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
|
|
|
|
void testMultipleTemporaries(bool value) {
|
|
|
|
if (value) {
|
|
|
|
// FIXME: Find a way to verify construction order.
|
|
|
|
// ~Dtor should run before ~NoReturnDtor() because construction order is
|
|
|
|
// guaranteed by comma operator.
|
|
|
|
if (!value || check((NoReturnDtor(), Dtor())) || value) {
|
|
|
|
clang_analyzer_eval(true); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2014-04-02 00:39:33 +08:00
|
|
|
|
2014-05-05 17:58:03 +08:00
|
|
|
void testBinaryOperatorShortcut(bool value) {
|
|
|
|
if (value) {
|
|
|
|
if (false && false && check(NoReturnDtor()) && true) {
|
|
|
|
clang_analyzer_eval(true);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-08-07 18:42:17 +08:00
|
|
|
void testIfAtEndOfLoop() {
|
|
|
|
int y = 0;
|
|
|
|
while (true) {
|
|
|
|
if (y > 0) {
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
|
|
|
++y;
|
|
|
|
// Test that the CFG gets hooked up correctly when temporary destructors
|
|
|
|
// are handled after a statically known branch condition.
|
|
|
|
if (true) (void)0; else (void)check(NoReturnDtor());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testTernaryAtEndOfLoop() {
|
|
|
|
int y = 0;
|
|
|
|
while (true) {
|
|
|
|
if (y > 0) {
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
|
|
|
++y;
|
|
|
|
// Test that the CFG gets hooked up correctly when temporary destructors
|
|
|
|
// are handled after a statically known branch condition.
|
|
|
|
true ? (void)0 : (void)check(NoReturnDtor());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testNoReturnInComplexCondition() {
|
|
|
|
check(Dtor()) &&
|
|
|
|
(check(NoReturnDtor()) || check(NoReturnDtor())) && check(Dtor());
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testSequencingOfConditionalTempDtors(bool b) {
|
|
|
|
b || (check(Dtor()), check(NoReturnDtor()));
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
void testSequencingOfConditionalTempDtors2(bool b) {
|
|
|
|
(b || check(Dtor())), check(NoReturnDtor());
|
|
|
|
clang_analyzer_warnIfReached(); // no warning, unreachable code
|
|
|
|
}
|
|
|
|
|
|
|
|
void testSequencingOfConditionalTempDtorsWithinBinaryOperators(bool b) {
|
|
|
|
b || (check(Dtor()) + check(NoReturnDtor()));
|
|
|
|
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
|
|
|
|
}
|
2014-08-11 22:54:30 +08:00
|
|
|
|
|
|
|
void f(Dtor d = Dtor());
|
|
|
|
void testDefaultParameters() {
|
|
|
|
f();
|
|
|
|
}
|
2014-08-13 23:25:55 +08:00
|
|
|
|
|
|
|
struct DefaultParam {
|
|
|
|
DefaultParam(int, const Dtor& d = Dtor());
|
|
|
|
~DefaultParam();
|
|
|
|
};
|
|
|
|
void testDefaultParamConstructorsInLoops() {
|
|
|
|
while (true) {
|
|
|
|
// FIXME: This exact pattern triggers the temporary cleanup logic
|
|
|
|
// to fail when adding a 'clean' state.
|
|
|
|
DefaultParam(42);
|
|
|
|
DefaultParam(42);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
void testDefaultParamConstructorsInTernariesInLoops(bool value) {
|
|
|
|
while (true) {
|
|
|
|
// FIXME: This exact pattern triggers the temporary cleanup logic
|
|
|
|
// to visit the bind-temporary logic with a state that already has that
|
|
|
|
// temporary marked as executed.
|
|
|
|
value ? DefaultParam(42) : DefaultParam(42);
|
|
|
|
}
|
|
|
|
}
|
2016-12-20 06:23:22 +08:00
|
|
|
#else // !TEMPORARY_DTORS
|
|
|
|
|
|
|
|
// Test for fallback logic that conservatively stops exploration after
|
|
|
|
// executing a temporary constructor for a class with a no-return destructor
|
|
|
|
// when temporary destructors are not enabled in the CFG.
|
|
|
|
|
|
|
|
struct CtorWithNoReturnDtor {
|
|
|
|
CtorWithNoReturnDtor() = default;
|
|
|
|
|
2018-02-15 10:32:32 +08:00
|
|
|
CtorWithNoReturnDtor(int x) {
|
|
|
|
clang_analyzer_checkInlined(false); // no-warning
|
|
|
|
}
|
|
|
|
|
2016-12-20 06:23:22 +08:00
|
|
|
~CtorWithNoReturnDtor() __attribute__((noreturn));
|
|
|
|
};
|
|
|
|
|
|
|
|
void testDefaultContructorWithNoReturnDtor() {
|
|
|
|
CtorWithNoReturnDtor();
|
|
|
|
clang_analyzer_warnIfReached(); // no-warning
|
|
|
|
}
|
|
|
|
|
|
|
|
void testLifeExtensionWithNoReturnDtor() {
|
|
|
|
const CtorWithNoReturnDtor &c = CtorWithNoReturnDtor();
|
|
|
|
|
|
|
|
// This represents an (expected) loss of coverage, since the destructor
|
2018-01-26 16:15:52 +08:00
|
|
|
// of the lifetime-exended temporary is executed at the end of
|
2016-12-20 06:23:22 +08:00
|
|
|
// scope.
|
|
|
|
clang_analyzer_warnIfReached(); // no-warning
|
|
|
|
}
|
|
|
|
|
2018-02-15 10:32:32 +08:00
|
|
|
#if __cplusplus >= 201103L
|
|
|
|
CtorWithNoReturnDtor returnNoReturnDtor() {
|
|
|
|
return {1}; // no-crash
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2013-09-02 17:09:15 +08:00
|
|
|
#endif // TEMPORARY_DTORS
|
2013-07-26 01:22:05 +08:00
|
|
|
}
|
2013-07-26 19:50:42 +08:00
|
|
|
|
|
|
|
void testStaticMaterializeTemporaryExpr() {
|
|
|
|
static const Trivial &ref = getTrivial();
|
|
|
|
clang_analyzer_eval(ref.value == 42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
static const Trivial &directRef = Trivial(42);
|
|
|
|
clang_analyzer_eval(directRef.value == 42); // expected-warning{{TRUE}}
|
|
|
|
|
2013-07-26 20:50:30 +08:00
|
|
|
#if __has_feature(cxx_thread_local)
|
2013-07-26 19:50:42 +08:00
|
|
|
thread_local static const Trivial &threadRef = getTrivial();
|
|
|
|
clang_analyzer_eval(threadRef.value == 42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
thread_local static const Trivial &threadDirectRef = Trivial(42);
|
|
|
|
clang_analyzer_eval(threadDirectRef.value == 42); // expected-warning{{TRUE}}
|
|
|
|
#endif
|
|
|
|
}
|
2013-08-09 15:46:29 +08:00
|
|
|
|
|
|
|
namespace PR16629 {
|
|
|
|
struct A {
|
|
|
|
explicit A(int* p_) : p(p_) {}
|
|
|
|
int* p;
|
|
|
|
};
|
|
|
|
|
|
|
|
extern void escape(const A*[]);
|
|
|
|
extern void check(int);
|
|
|
|
|
|
|
|
void callEscape(const A& a) {
|
|
|
|
const A* args[] = { &a };
|
|
|
|
escape(args);
|
|
|
|
}
|
|
|
|
|
|
|
|
void testNoWarning() {
|
|
|
|
int x;
|
|
|
|
callEscape(A(&x));
|
|
|
|
check(x); // Analyzer used to give a "x is uninitialized warning" here
|
|
|
|
}
|
|
|
|
|
|
|
|
void set(const A*a[]) {
|
|
|
|
*a[0]->p = 47;
|
|
|
|
}
|
|
|
|
|
|
|
|
void callSet(const A& a) {
|
|
|
|
const A* args[] = { &a };
|
|
|
|
set(args);
|
|
|
|
}
|
|
|
|
|
|
|
|
void testConsistency() {
|
|
|
|
int x;
|
|
|
|
callSet(A(&x));
|
|
|
|
clang_analyzer_eval(x == 47); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
}
|
2017-03-02 01:48:39 +08:00
|
|
|
|
|
|
|
namespace PR32088 {
|
|
|
|
void testReturnFromStmtExprInitializer() {
|
|
|
|
// We shouldn't try to destroy the object pointed to by `obj' upon return.
|
|
|
|
const NonTrivial &obj = ({
|
|
|
|
return; // no-crash
|
|
|
|
NonTrivial(42);
|
|
|
|
});
|
|
|
|
}
|
|
|
|
}
|
[analyzer] When creating a temporary object, properly copy the value into it.
Adjustments should be considered properly; we should copy the unadjusted object
over the whole temporary base region. If the unadjusted object is no longer
available in the Environment, invalidate the temporary base region, and then
copy the adjusted object into the adjusted sub-region of the temporary region.
This fixes a regression introduced by r288263, that caused various
false positives, due to copying only adjusted object into the adjusted region;
the rest of the base region therefore remained undefined.
Before r288263, the adjusted value was copied over the unadjusted region,
which is incorrect, but accidentally worked better due to how region store
disregards compound value bindings to non-base regions.
An additional test machinery is introduced to make sure that despite making
two binds, we only notify checkers once for both of them, without exposing
the partially copied objects.
This fix is a hack over a hack. The proper fix would be to model C++ temporaries
in the CFG, and after that dealing with adjustments would no longer be
necessary, and the values we need would no longer disappear from the
Environment.
rdar://problem/30658168
Differential Revision: https://reviews.llvm.org/D30534
llvm-svn: 298924
2017-03-28 23:43:26 +08:00
|
|
|
|
|
|
|
namespace CopyToTemporaryCorrectly {
|
|
|
|
class Super {
|
|
|
|
public:
|
|
|
|
void m() {
|
|
|
|
mImpl();
|
|
|
|
}
|
|
|
|
virtual void mImpl() = 0;
|
|
|
|
};
|
|
|
|
class Sub : public Super {
|
|
|
|
public:
|
|
|
|
Sub(const int &p) : j(p) {}
|
|
|
|
virtual void mImpl() override {
|
|
|
|
// Used to be undefined pointer dereference because we didn't copy
|
|
|
|
// the subclass data (j) to the temporary object properly.
|
|
|
|
(void)(j + 1); // no-warning
|
|
|
|
if (j != 22) {
|
|
|
|
clang_analyzer_warnIfReached(); // no-warning
|
|
|
|
}
|
|
|
|
}
|
|
|
|
const int &j;
|
|
|
|
};
|
|
|
|
void run() {
|
|
|
|
int i = 22;
|
|
|
|
Sub(i).m();
|
|
|
|
}
|
|
|
|
}
|
2018-02-15 10:32:32 +08:00
|
|
|
|
|
|
|
namespace test_return_temporary {
|
|
|
|
class C {
|
|
|
|
int x, y;
|
|
|
|
|
|
|
|
public:
|
|
|
|
C(int x, int y) : x(x), y(y) {}
|
|
|
|
int getX() const { return x; }
|
|
|
|
int getY() const { return y; }
|
|
|
|
~C() {}
|
|
|
|
};
|
|
|
|
|
|
|
|
class D: public C {
|
|
|
|
public:
|
|
|
|
D() : C(1, 2) {}
|
|
|
|
D(const D &d): C(d.getX(), d.getY()) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
C returnTemporaryWithVariable() { C c(1, 2); return c; }
|
|
|
|
C returnTemporaryWithAnotherFunctionWithVariable() {
|
|
|
|
return returnTemporaryWithVariable();
|
|
|
|
}
|
|
|
|
C returnTemporaryWithCopyConstructionWithVariable() {
|
|
|
|
return C(returnTemporaryWithVariable());
|
|
|
|
}
|
|
|
|
|
|
|
|
C returnTemporaryWithConstruction() { return C(1, 2); }
|
|
|
|
C returnTemporaryWithAnotherFunctionWithConstruction() {
|
|
|
|
return returnTemporaryWithConstruction();
|
|
|
|
}
|
|
|
|
C returnTemporaryWithCopyConstructionWithConstruction() {
|
|
|
|
return C(returnTemporaryWithConstruction());
|
|
|
|
}
|
|
|
|
|
|
|
|
D returnTemporaryWithVariableAndNonTrivialCopy() { D d; return d; }
|
|
|
|
D returnTemporaryWithAnotherFunctionWithVariableAndNonTrivialCopy() {
|
|
|
|
return returnTemporaryWithVariableAndNonTrivialCopy();
|
|
|
|
}
|
|
|
|
D returnTemporaryWithCopyConstructionWithVariableAndNonTrivialCopy() {
|
|
|
|
return D(returnTemporaryWithVariableAndNonTrivialCopy());
|
|
|
|
}
|
|
|
|
|
|
|
|
#if __cplusplus >= 201103L
|
|
|
|
C returnTemporaryWithBraces() { return {1, 2}; }
|
|
|
|
C returnTemporaryWithAnotherFunctionWithBraces() {
|
|
|
|
return returnTemporaryWithBraces();
|
|
|
|
}
|
|
|
|
C returnTemporaryWithCopyConstructionWithBraces() {
|
|
|
|
return C(returnTemporaryWithBraces());
|
|
|
|
}
|
|
|
|
#endif // C++11
|
|
|
|
|
|
|
|
void test() {
|
|
|
|
C c1 = returnTemporaryWithVariable();
|
|
|
|
clang_analyzer_eval(c1.getX() == 1); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(c1.getY() == 2); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
C c2 = returnTemporaryWithAnotherFunctionWithVariable();
|
|
|
|
clang_analyzer_eval(c2.getX() == 1); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(c2.getY() == 2); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
C c3 = returnTemporaryWithCopyConstructionWithVariable();
|
|
|
|
clang_analyzer_eval(c3.getX() == 1); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(c3.getY() == 2); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
C c4 = returnTemporaryWithConstruction();
|
[analyzer] Inline constructors for destroyable temporaries.
Since r325210, in cfg-temporary-dtors mode, we can rely on the CFG to tell us
that we're indeed constructing a temporary, so we can trivially construct a
temporary region and inline the constructor.
Much like r325202, this is only done under the off-by-default
cfg-temporary-dtors flag because the temporary destructor, even if available,
will not be inlined and won't have the correct object value (target region).
Unless this is fixed, it is quite unsafe to inline the constructor.
If the temporary is lifetime-extended, the destructor would be an automatic
destructor, which would be evaluated with a "correct" target region - modulo
the series of incorrect relocations performed during the lifetime extension.
It means that at least, values within the object are guaranteed to be properly
escaped or invalidated.
Differential Revision: https://reviews.llvm.org/D43062
llvm-svn: 325211
2018-02-15 11:26:43 +08:00
|
|
|
clang_analyzer_eval(c4.getX() == 1);
|
|
|
|
clang_analyzer_eval(c4.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
2018-02-15 10:32:32 +08:00
|
|
|
|
|
|
|
C c5 = returnTemporaryWithAnotherFunctionWithConstruction();
|
[analyzer] Inline constructors for destroyable temporaries.
Since r325210, in cfg-temporary-dtors mode, we can rely on the CFG to tell us
that we're indeed constructing a temporary, so we can trivially construct a
temporary region and inline the constructor.
Much like r325202, this is only done under the off-by-default
cfg-temporary-dtors flag because the temporary destructor, even if available,
will not be inlined and won't have the correct object value (target region).
Unless this is fixed, it is quite unsafe to inline the constructor.
If the temporary is lifetime-extended, the destructor would be an automatic
destructor, which would be evaluated with a "correct" target region - modulo
the series of incorrect relocations performed during the lifetime extension.
It means that at least, values within the object are guaranteed to be properly
escaped or invalidated.
Differential Revision: https://reviews.llvm.org/D43062
llvm-svn: 325211
2018-02-15 11:26:43 +08:00
|
|
|
clang_analyzer_eval(c5.getX() == 1);
|
|
|
|
clang_analyzer_eval(c5.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
2018-02-15 10:32:32 +08:00
|
|
|
|
|
|
|
C c6 = returnTemporaryWithCopyConstructionWithConstruction();
|
[analyzer] Inline constructors for destroyable temporaries.
Since r325210, in cfg-temporary-dtors mode, we can rely on the CFG to tell us
that we're indeed constructing a temporary, so we can trivially construct a
temporary region and inline the constructor.
Much like r325202, this is only done under the off-by-default
cfg-temporary-dtors flag because the temporary destructor, even if available,
will not be inlined and won't have the correct object value (target region).
Unless this is fixed, it is quite unsafe to inline the constructor.
If the temporary is lifetime-extended, the destructor would be an automatic
destructor, which would be evaluated with a "correct" target region - modulo
the series of incorrect relocations performed during the lifetime extension.
It means that at least, values within the object are guaranteed to be properly
escaped or invalidated.
Differential Revision: https://reviews.llvm.org/D43062
llvm-svn: 325211
2018-02-15 11:26:43 +08:00
|
|
|
clang_analyzer_eval(c5.getX() == 1);
|
|
|
|
clang_analyzer_eval(c5.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
2018-02-15 10:32:32 +08:00
|
|
|
|
|
|
|
#if __cplusplus >= 201103L
|
|
|
|
|
|
|
|
C c7 = returnTemporaryWithBraces();
|
|
|
|
clang_analyzer_eval(c7.getX() == 1);
|
|
|
|
clang_analyzer_eval(c7.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
C c8 = returnTemporaryWithAnotherFunctionWithBraces();
|
|
|
|
clang_analyzer_eval(c8.getX() == 1);
|
|
|
|
clang_analyzer_eval(c8.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
C c9 = returnTemporaryWithCopyConstructionWithBraces();
|
|
|
|
clang_analyzer_eval(c9.getX() == 1);
|
|
|
|
clang_analyzer_eval(c9.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#endif // C++11
|
|
|
|
|
|
|
|
D d1 = returnTemporaryWithVariableAndNonTrivialCopy();
|
|
|
|
clang_analyzer_eval(d1.getX() == 1);
|
|
|
|
clang_analyzer_eval(d1.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
D d2 = returnTemporaryWithAnotherFunctionWithVariableAndNonTrivialCopy();
|
|
|
|
clang_analyzer_eval(d2.getX() == 1);
|
|
|
|
clang_analyzer_eval(d2.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
D d3 = returnTemporaryWithCopyConstructionWithVariableAndNonTrivialCopy();
|
[analyzer] Inline constructors for destroyable temporaries.
Since r325210, in cfg-temporary-dtors mode, we can rely on the CFG to tell us
that we're indeed constructing a temporary, so we can trivially construct a
temporary region and inline the constructor.
Much like r325202, this is only done under the off-by-default
cfg-temporary-dtors flag because the temporary destructor, even if available,
will not be inlined and won't have the correct object value (target region).
Unless this is fixed, it is quite unsafe to inline the constructor.
If the temporary is lifetime-extended, the destructor would be an automatic
destructor, which would be evaluated with a "correct" target region - modulo
the series of incorrect relocations performed during the lifetime extension.
It means that at least, values within the object are guaranteed to be properly
escaped or invalidated.
Differential Revision: https://reviews.llvm.org/D43062
llvm-svn: 325211
2018-02-15 11:26:43 +08:00
|
|
|
clang_analyzer_eval(d3.getX() == 1);
|
|
|
|
clang_analyzer_eval(d3.getY() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
2018-02-15 10:32:32 +08:00
|
|
|
}
|
|
|
|
} // namespace test_return_temporary
|
[analyzer] Inline constructors for destroyable temporaries.
Since r325210, in cfg-temporary-dtors mode, we can rely on the CFG to tell us
that we're indeed constructing a temporary, so we can trivially construct a
temporary region and inline the constructor.
Much like r325202, this is only done under the off-by-default
cfg-temporary-dtors flag because the temporary destructor, even if available,
will not be inlined and won't have the correct object value (target region).
Unless this is fixed, it is quite unsafe to inline the constructor.
If the temporary is lifetime-extended, the destructor would be an automatic
destructor, which would be evaluated with a "correct" target region - modulo
the series of incorrect relocations performed during the lifetime extension.
It means that at least, values within the object are guaranteed to be properly
escaped or invalidated.
Differential Revision: https://reviews.llvm.org/D43062
llvm-svn: 325211
2018-02-15 11:26:43 +08:00
|
|
|
|
|
|
|
|
|
|
|
namespace test_temporary_object_expr_without_dtor {
|
|
|
|
class C {
|
|
|
|
int x;
|
|
|
|
public:
|
|
|
|
C(int x) : x(x) {}
|
|
|
|
int getX() const { return x; }
|
|
|
|
};
|
|
|
|
|
|
|
|
void test() {
|
|
|
|
clang_analyzer_eval(C(3).getX() == 3); // expected-warning{{TRUE}}
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
namespace test_temporary_object_expr_with_dtor {
|
|
|
|
class C {
|
|
|
|
int x;
|
|
|
|
|
|
|
|
public:
|
|
|
|
C(int x) : x(x) {}
|
|
|
|
~C() {}
|
|
|
|
int getX() const { return x; }
|
|
|
|
};
|
|
|
|
|
|
|
|
void test(int coin) {
|
|
|
|
clang_analyzer_eval(C(3).getX() == 3);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-2{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-4{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
const C &c1 = coin ? C(1) : C(2);
|
|
|
|
if (coin) {
|
|
|
|
clang_analyzer_eval(c1.getX() == 1);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-2{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-4{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
} else {
|
|
|
|
clang_analyzer_eval(c1.getX() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-2{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-4{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
C c2 = coin ? C(1) : C(2);
|
|
|
|
if (coin) {
|
|
|
|
clang_analyzer_eval(c2.getX() == 1);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-2{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-4{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
} else {
|
|
|
|
clang_analyzer_eval(c2.getX() == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-2{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-4{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
} // namespace test_temporary_object_expr
|
2018-02-16 03:17:44 +08:00
|
|
|
|
|
|
|
namespace test_match_constructors_and_destructors {
|
|
|
|
class C {
|
|
|
|
public:
|
|
|
|
int &x, &y;
|
|
|
|
C(int &_x, int &_y) : x(_x), y(_y) { ++x; }
|
|
|
|
C(const C &c): x(c.x), y(c.y) { ++x; }
|
|
|
|
~C() { ++y; }
|
|
|
|
};
|
|
|
|
|
|
|
|
void test_simple_temporary() {
|
|
|
|
int x = 0, y = 0;
|
|
|
|
{
|
|
|
|
const C &c = C(x, y);
|
|
|
|
}
|
|
|
|
// One constructor and one destructor.
|
|
|
|
clang_analyzer_eval(x == 1);
|
|
|
|
clang_analyzer_eval(y == 1);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
void test_simple_temporary_with_copy() {
|
|
|
|
int x = 0, y = 0;
|
|
|
|
{
|
|
|
|
C c = C(x, y);
|
|
|
|
}
|
|
|
|
// Two constructors (temporary object expr and copy) and two destructors.
|
|
|
|
clang_analyzer_eval(x == 2);
|
|
|
|
clang_analyzer_eval(y == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
void test_ternary_temporary(int coin) {
|
|
|
|
int x = 0, y = 0, z = 0, w = 0;
|
|
|
|
{
|
|
|
|
const C &c = coin ? C(x, y) : C(z, w);
|
|
|
|
}
|
|
|
|
// This time each branch contains an additional elidable copy constructor.
|
|
|
|
if (coin) {
|
|
|
|
clang_analyzer_eval(x == 2);
|
|
|
|
clang_analyzer_eval(y == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
clang_analyzer_eval(z == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(w == 0); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
} else {
|
|
|
|
clang_analyzer_eval(x == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(y == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(z == 2);
|
|
|
|
clang_analyzer_eval(w == 2);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void test_ternary_temporary_with_copy(int coin) {
|
|
|
|
int x = 0, y = 0, z = 0, w = 0;
|
|
|
|
{
|
|
|
|
C c = coin ? C(x, y) : C(z, w);
|
|
|
|
}
|
|
|
|
// Temporary expression, elidable copy within branch,
|
|
|
|
// constructor for variable - 3 total.
|
|
|
|
if (coin) {
|
|
|
|
clang_analyzer_eval(x == 3);
|
|
|
|
clang_analyzer_eval(y == 3);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
clang_analyzer_eval(z == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(w == 0); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
} else {
|
|
|
|
clang_analyzer_eval(x == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(y == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(z == 3);
|
|
|
|
clang_analyzer_eval(w == 3);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
// expected-warning@-3{{TRUE}}
|
|
|
|
#else
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
// expected-warning@-6{{UNKNOWN}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} // namespace test_match_constructors_and_destructors
|
2018-02-16 03:34:19 +08:00
|
|
|
|
2018-02-28 03:47:49 +08:00
|
|
|
namespace dont_forget_destructor_around_logical_op {
|
|
|
|
int glob;
|
|
|
|
|
|
|
|
class C {
|
|
|
|
public:
|
2018-02-28 05:02:58 +08:00
|
|
|
~C() {
|
|
|
|
glob = 1;
|
|
|
|
clang_analyzer_checkInlined(true);
|
|
|
|
#ifdef TEMPORARY_DTORS
|
|
|
|
// expected-warning@-2{{TRUE}}
|
|
|
|
#endif
|
|
|
|
}
|
2018-02-28 03:47:49 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
C get();
|
|
|
|
|
|
|
|
bool is(C);
|
|
|
|
|
|
|
|
|
|
|
|
void test(int coin) {
|
|
|
|
// Here temporaries are being cleaned up after && is evaluated. There are two
|
|
|
|
// temporaries: the return value of get() and the elidable copy constructor
|
|
|
|
// of that return value into is(). According to the CFG, we need to cleanup
|
|
|
|
// both of them depending on whether the temporary corresponding to the
|
2018-02-28 05:02:58 +08:00
|
|
|
// return value of get() was initialized. However, we didn't track
|
|
|
|
// temporaries returned from functions, so we took the wrong branch.
|
2018-02-28 03:47:49 +08:00
|
|
|
coin && is(get()); // no-crash
|
2018-02-28 05:02:58 +08:00
|
|
|
// FIXME: Should be true once we inline all destructors.
|
|
|
|
clang_analyzer_eval(glob); // expected-warning{{UNKNOWN}}
|
2018-02-28 03:47:49 +08:00
|
|
|
}
|
|
|
|
} // namespace dont_forget_destructor_around_logical_op
|
|
|
|
|
2018-02-16 03:34:19 +08:00
|
|
|
#if __cplusplus >= 201103L
|
|
|
|
namespace temporary_list_crash {
|
|
|
|
class C {
|
|
|
|
public:
|
|
|
|
C() {}
|
|
|
|
~C() {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void test() {
|
|
|
|
std::initializer_list<C>{C(), C()}; // no-crash
|
|
|
|
}
|
|
|
|
} // namespace temporary_list_crash
|
|
|
|
#endif // C++11
|