[analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.
Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus
Reviewed By: NoQ
Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D62926
llvm-svn: 363491
2019-06-15 18:05:49 +08:00
|
|
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core \
|
|
|
|
// RUN: -analyzer-config suppress-null-return-paths=false \
|
|
|
|
// RUN: -verify %s
|
|
|
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core \
|
|
|
|
// RUN: -DSUPPRESSED \
|
|
|
|
// RUN: -verify %s
|
2018-01-25 04:32:26 +08:00
|
|
|
|
|
|
|
void clang_analyzer_eval(bool);
|
|
|
|
|
|
|
|
typedef __typeof__(sizeof(int)) size_t;
|
|
|
|
|
|
|
|
|
|
|
|
// These are ill-formed. One cannot return nullptr from a throwing version of an
|
|
|
|
// operator new.
|
|
|
|
void *operator new(size_t size) {
|
|
|
|
return nullptr;
|
[analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.
Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus
Reviewed By: NoQ
Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D62926
llvm-svn: 363491
2019-06-15 18:05:49 +08:00
|
|
|
// expected-warning@-1 {{'operator new' should not return a null pointer unless it is declared 'throw()' or 'noexcept'}}
|
2018-01-25 04:32:26 +08:00
|
|
|
}
|
|
|
|
void *operator new[](size_t size) {
|
|
|
|
return nullptr;
|
[analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.
Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus
Reviewed By: NoQ
Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D62926
llvm-svn: 363491
2019-06-15 18:05:49 +08:00
|
|
|
// expected-warning@-1 {{'operator new[]' should not return a null pointer unless it is declared 'throw()' or 'noexcept'}}
|
2018-01-25 04:32:26 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
struct S {
|
|
|
|
int x;
|
|
|
|
S() : x(1) {}
|
|
|
|
~S() {}
|
[analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.
Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus
Reviewed By: NoQ
Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D62926
llvm-svn: 363491
2019-06-15 18:05:49 +08:00
|
|
|
int getX() const { return x; }
|
2018-01-25 04:32:26 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
void testArrays() {
|
|
|
|
S *s = new S[10]; // no-crash
|
[analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.
Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus
Reviewed By: NoQ
Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D62926
llvm-svn: 363491
2019-06-15 18:05:49 +08:00
|
|
|
s[0].x = 2;
|
|
|
|
#ifndef SUPPRESSED
|
|
|
|
// expected-warning@-2 {{Dereference of null pointer}}
|
|
|
|
#endif
|
2018-01-25 04:32:26 +08:00
|
|
|
}
|
[analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.
Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus
Reviewed By: NoQ
Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D62926
llvm-svn: 363491
2019-06-15 18:05:49 +08:00
|
|
|
|
|
|
|
void testCtor() {
|
|
|
|
S *s = new S();
|
|
|
|
s->x = 13;
|
|
|
|
#ifndef SUPPRESSED
|
|
|
|
// expected-warning@-2 {{Access to field 'x' results in a dereference of a null pointer (loaded from variable 's')}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
void testMethod() {
|
|
|
|
S *s = new S();
|
|
|
|
const int X = s->getX();
|
|
|
|
#ifndef SUPPRESSED
|
|
|
|
// expected-warning@-2 {{Called C++ object pointer is null}}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|