maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity
llvm-project/clang/test/Analysis/inline-plist.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

90 lines
3.7 KiB
C
Raw Normal View History

[analyzer] Move analyzer-eagerly-assume to AnalyzerOptions, enable by default Differential Revision: https://reviews.llvm.org/D51251 llvm-svn: 340963
2018-08-30 04:29:17 +08:00
// RUN: %clang_analyze_cc1 %s -analyzer-checker=core.NullDereference,core.DivideZero -fblocks -analyzer-output=text -analyzer-config suppress-null-return-paths=false -verify -analyzer-config eagerly-assume=false %s
// RUN: %clang_analyze_cc1 -analyzer-config eagerly-assume=false %s -analyzer-checker=core.NullDereference,core.DivideZero -fblocks -analyzer-output=plist -analyzer-config suppress-null-return-paths=false -o %t
Reapply r362994 & co "[analyzer][tests] Add normalize_plist to replace diff_plist" Following r363007, which reverted r362998, r362996, and r362994, reapply with adjustments for the CRLF differences encountered with Windows. Namely, the `-b` option of `diff` is employed, and the `grep` patterns have `$` replaced with `[[:space:]]*$`. llvm-svn: 363069
2019-06-11 22:21:32 +08:00
// RUN: %normalize_plist <%t | diff -ub %S/Inputs/expected-plists/inline-plist.c.plist -
[analyzer diagnostics] flush locations *before* popping the current path when visiting a CallEnter. Fixes <rdar://problem/10967815> llvm-svn: 151938
2012-03-03 05:16:22 +08:00
// <rdar://problem/10967815>
void mmm(int y) {
if (y != 0)
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
y++;
[analyzer diagnostics] flush locations *before* popping the current path when visiting a CallEnter. Fixes <rdar://problem/10967815> llvm-svn: 151938
2012-03-03 05:16:22 +08:00
}
int foo(int x, int y) {
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
mmm(y);
if (x != 0) {
// expected-note@-1 {{Assuming 'x' is equal to 0}}
// expected-note@-2 {{Taking false branch}}
x++;
}
return 5/x; // expected-warning{{Division by zero}} expected-note{{Division by zero}}
[analyzer diagnostics] flush locations *before* popping the current path when visiting a CallEnter. Fixes <rdar://problem/10967815> llvm-svn: 151938
2012-03-03 05:16:22 +08:00
}
[analyzer] Include inlining call stack depth in plist output. llvm-svn: 152584
2012-03-13 06:10:57 +08:00
// Test a bug triggering only when inlined.
void has_bug(int *p) {
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
*p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
[analyzer] Include inlining call stack depth in plist output. llvm-svn: 152584
2012-03-13 06:10:57 +08:00
}
void test_has_bug() {
has_bug(0);
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
// expected-note@-1 {{Passing null pointer value via 1st parameter 'p'}}
// expected-note@-2 {{Calling 'has_bug'}}
[analyzer] Include inlining call stack depth in plist output. llvm-svn: 152584
2012-03-13 06:10:57 +08:00
}
Refine analyzer diagnostics by adding an expression "cone-of-influence" to reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> llvm-svn: 155971
2012-05-02 08:31:29 +08:00
void triggers_bug(int *p) {
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
*p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
Refine analyzer diagnostics by adding an expression "cone-of-influence" to reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> llvm-svn: 155971
2012-05-02 08:31:29 +08:00
}
// This function triggers a bug by calling triggers_bug(). The diagnostics
// should show when p is assumed to be null.
void bar(int *p) {
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
if (!!p) {
// expected-note@-1 {{Assuming 'p' is null}}
TrackConstraintBRVisitor and ConditionBRVisitor can emit similar path notes for cases where a value may be assumed to be null, etc. Instead of having redundant diagnostics, do a pass over the generated PathDiagnostic pieces and remove notes from TrackConstraintBRVisitor that are already covered by ConditionBRVisitor, whose notes tend to be better. Fixes <rdar://problem/12252783> llvm-svn: 166728
2012-10-26 06:07:10 +08:00
// expected-note@-2 {{Taking false branch}}
Refine analyzer diagnostics by adding an expression "cone-of-influence" to reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> llvm-svn: 155971
2012-05-02 08:31:29 +08:00
return;
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
}
Reland 4: [analyzer] NFC: Update test infrastructure to support multiple constraint managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296895
2017-03-04 02:02:02 +08:00
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
if (p == 0) {
[analyzer] ConditionBRVisitor: Enhance to write out more information Summary: Add extra messages to the bug report to inform the user why the analyzer `Taking true/false branch`. Reviewers: NoQ, george.karpenkov Reviewed By: NoQ Subscribers: gerazo, gsd, dkrupp, whisperity, baloghadamsoftware, xazax.hun, eraman, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D53076 llvm-svn: 362020
2019-05-30 04:06:09 +08:00
// expected-note@-1 {{'p' is equal to null}}
// expected-note@-2 {{Taking true branch}}
Refine analyzer diagnostics by adding an expression "cone-of-influence" to reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> llvm-svn: 155971
2012-05-02 08:31:29 +08:00
triggers_bug(p);
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
// expected-note@-1 {{Passing null pointer value via 1st parameter 'p'}}
// expected-note@-2 {{Calling 'triggers_bug'}}
}
Refine analyzer diagnostics by adding an expression "cone-of-influence" to reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> llvm-svn: 155971
2012-05-02 08:31:29 +08:00
}
Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that when we generate a new ExplodedNode we use the same Expr* as the one being currently visited. This is preparation for transitioning to having ProgramPoints refer to CFGStmts. This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact, as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but it will look a lot cleaner when were start using CFGStmt* in the appropriate places. As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed. I have audited these, and they look reasonable. llvm-svn: 154214
2012-04-07 06:10:18 +08:00
static analyzer: add inlining support for directly called blocks. llvm-svn: 157833
2012-06-02 04:04:04 +08:00
// ========================================================================== //
// Test inlining of blocks.
// ========================================================================== //
void test_block__capture_null() {
[analyzer] Use 'MemRegion::printPretty()' instead of assuming the region is a VarRegion. Fixes PR15358 and <rdar://problem/13295437>. Along the way, shorten path diagnostics that say "Variable 'x'" to just be "'x'". By the context, it is obvious that we have a variable, and so this just consumes text space. llvm-svn: 176115
2013-02-27 03:44:38 +08:00
int *p = 0; // expected-note{{'p' initialized to a null pointer value}}
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
^(){ // expected-note {{Calling anonymous block}}
*p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
}();
Reland 4: [analyzer] NFC: Update test infrastructure to support multiple constraint managers Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952. Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D30373 llvm-svn: 296895
2017-03-04 02:02:02 +08:00
static analyzer: add inlining support for directly called blocks. llvm-svn: 157833
2012-06-02 04:04:04 +08:00
}
void test_block_ret() {
[analyzer] Suppress paths involving a reference whose rvalue is null. Most map types have an operator[] that inserts a new element if the key isn't found, then returns a reference to the value slot so that you can assign into it. However, if the value type is a pointer, it will be initialized to null. This is usually no problem. However, if the user /knows/ the map contains a value for a particular key, they may just use it immediately: // From ClangSACheckersEmitter.cpp recordGroupMap[group]->Checkers In this case the analyzer reports a null dereference on the path where the key is not in the map, even though the user knows that path is impossible here. They could silence the warning by adding an assertion, but that means splitting up the expression and introducing a local variable. (Note that the analyzer has no way of knowing that recordGroupMap[group] will return the same reference if called twice in a row!) We already have logic that says a null dereference has a high chance of being a false positive if the null came from an inlined function. This patch simply extends that to references whose rvalues are null as well, silencing several false positives in LLVM. <rdar://problem/13239854> llvm-svn: 176371
2013-03-02 03:45:10 +08:00
int *p = ^int*(){ // expected-note {{Calling anonymous block}} expected-note{{Returning to caller}} expected-note {{'p' initialized to a null pointer value}}
[analyzer] Use 'MemRegion::printPretty()' instead of assuming the region is a VarRegion. Fixes PR15358 and <rdar://problem/13295437>. Along the way, shorten path diagnostics that say "Variable 'x'" to just be "'x'". By the context, it is obvious that we have a variable, and so this just consumes text space. llvm-svn: 176115
2013-02-27 03:44:38 +08:00
int *q = 0; // expected-note {{'q' initialized to a null pointer value}}
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
return q; // expected-note {{Returning null pointer (loaded from 'q')}}
}();
*p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
static analyzer: add inlining support for directly called blocks. llvm-svn: 157833
2012-06-02 04:04:04 +08:00
}
void test_block_blockvar() {
__block int *p;
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
^(){ // expected-note{{Calling anonymous block}} expected-note{{Returning to caller}}
p = 0; // expected-note{{Null pointer value stored to 'p'}}
}();
*p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
static analyzer: add inlining support for directly called blocks. llvm-svn: 157833
2012-06-02 04:04:04 +08:00
}
void test_block_arg() {
int *p;
[analyzer] Better path notes for null pointers passed as arguments. Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> llvm-svn: 164444
2012-09-22 09:24:46 +08:00
^(int **q){ // expected-note{{Calling anonymous block}} expected-note{{Returning to caller}}
*q = 0; // expected-note{{Null pointer value stored to 'p'}}
}(&p);
*p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
static analyzer: add inlining support for directly called blocks. llvm-svn: 157833
2012-06-02 04:04:04 +08:00
}