2012-08-25 04:39:55 +08:00
|
|
|
// RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.deadcode.UnreachableCode,alpha.core.CastSize,unix.Malloc -analyzer-store=region -verify %s
|
2012-03-30 07:26:54 +08:00
|
|
|
|
|
|
|
typedef __typeof(sizeof(int)) size_t;
|
|
|
|
void *malloc(size_t);
|
|
|
|
void free(void *);
|
|
|
|
void *realloc(void *ptr, size_t size);
|
|
|
|
void *calloc(size_t nmemb, size_t size);
|
2013-04-02 09:28:24 +08:00
|
|
|
char *strdup(const char *s);
|
[analyzer] Always include destructors in the analysis CFG.
While destructors will continue to not be inlined (unless the analyzer
config option 'c++-inlining' is set to 'destructors'), leaving them out
of the CFG is an incomplete model of the behavior of an object, and
can cause false positive warnings (like PR13751, now working).
Destructors for temporaries are still not on by default, since
(a) we haven't actually checked this code to be sure it's fully correct
(in particular, we probably need to be very careful with regard to
lifetime-extension when a temporary is bound to a reference,
C++11 [class.temporary]p5), and
(b) ExprEngine doesn't actually do anything when it sees a temporary
destructor in the CFG -- not even invalidate the object region.
To enable temporary destructors, set the 'cfg-temporary-dtors' analyzer
config option to '1'. The old -cfg-add-implicit-dtors cc1 option, which
controlled all implicit destructors, has been removed.
llvm-svn: 163264
2012-09-06 06:55:23 +08:00
|
|
|
|
|
|
|
void checkThatMallocCheckerIsRunning() {
|
2012-11-16 03:11:43 +08:00
|
|
|
malloc(4);
|
|
|
|
} // expected-warning{{leak}}
|
[analyzer] Always include destructors in the analysis CFG.
While destructors will continue to not be inlined (unless the analyzer
config option 'c++-inlining' is set to 'destructors'), leaving them out
of the CFG is an incomplete model of the behavior of an object, and
can cause false positive warnings (like PR13751, now working).
Destructors for temporaries are still not on by default, since
(a) we haven't actually checked this code to be sure it's fully correct
(in particular, we probably need to be very careful with regard to
lifetime-extension when a temporary is bound to a reference,
C++11 [class.temporary]p5), and
(b) ExprEngine doesn't actually do anything when it sees a temporary
destructor in the CFG -- not even invalidate the object region.
To enable temporary destructors, set the 'cfg-temporary-dtors' analyzer
config option to '1'. The old -cfg-add-implicit-dtors cc1 option, which
controlled all implicit destructors, has been removed.
llvm-svn: 163264
2012-09-06 06:55:23 +08:00
|
|
|
|
2012-03-30 07:26:54 +08:00
|
|
|
// Test for radar://11110132.
|
|
|
|
struct Foo {
|
|
|
|
mutable void* m_data;
|
|
|
|
Foo(void* data) : m_data(data) {}
|
|
|
|
};
|
|
|
|
Foo aFunction() {
|
|
|
|
return malloc(10);
|
|
|
|
}
|
2012-05-04 07:50:28 +08:00
|
|
|
|
|
|
|
// Assume that functions which take a function pointer can free memory even if
|
|
|
|
// they are defined in system headers and take the const pointer to the
|
|
|
|
// allocated memory. (radar://11160612)
|
|
|
|
// Test default parameter.
|
|
|
|
int const_ptr_and_callback_def_param(int, const char*, int n, void(*)(void*) = 0);
|
|
|
|
void r11160612_3() {
|
|
|
|
char *x = (char*)malloc(12);
|
|
|
|
const_ptr_and_callback_def_param(0, x, 12);
|
|
|
|
}
|
2012-05-05 06:18:36 +08:00
|
|
|
|
|
|
|
// Test member function pointer.
|
|
|
|
struct CanFreeMemory {
|
|
|
|
static void myFree(void*);
|
|
|
|
};
|
|
|
|
//This is handled because we look at the type of the parameter(not argument).
|
|
|
|
void r11160612_3(CanFreeMemory* p) {
|
|
|
|
char *x = (char*)malloc(12);
|
|
|
|
const_ptr_and_callback_def_param(0, x, 12, p->myFree);
|
|
|
|
}
|
|
|
|
|
[analyzer] Always include destructors in the analysis CFG.
While destructors will continue to not be inlined (unless the analyzer
config option 'c++-inlining' is set to 'destructors'), leaving them out
of the CFG is an incomplete model of the behavior of an object, and
can cause false positive warnings (like PR13751, now working).
Destructors for temporaries are still not on by default, since
(a) we haven't actually checked this code to be sure it's fully correct
(in particular, we probably need to be very careful with regard to
lifetime-extension when a temporary is bound to a reference,
C++11 [class.temporary]p5), and
(b) ExprEngine doesn't actually do anything when it sees a temporary
destructor in the CFG -- not even invalidate the object region.
To enable temporary destructors, set the 'cfg-temporary-dtors' analyzer
config option to '1'. The old -cfg-add-implicit-dtors cc1 option, which
controlled all implicit destructors, has been removed.
llvm-svn: 163264
2012-09-06 06:55:23 +08:00
|
|
|
|
|
|
|
namespace PR13751 {
|
|
|
|
class OwningVector {
|
|
|
|
void **storage;
|
|
|
|
size_t length;
|
|
|
|
public:
|
|
|
|
OwningVector();
|
|
|
|
~OwningVector();
|
|
|
|
void push_back(void *Item) {
|
|
|
|
storage[length++] = Item;
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testDestructors() {
|
|
|
|
OwningVector v;
|
|
|
|
v.push_back(malloc(4));
|
|
|
|
// no leak warning; freed in destructor
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-02-06 08:01:14 +08:00
|
|
|
struct X { void *a; };
|
|
|
|
|
|
|
|
struct X get() {
|
|
|
|
struct X result;
|
|
|
|
result.a = malloc(4);
|
|
|
|
return result; // no-warning
|
|
|
|
}
|
2013-04-02 09:28:24 +08:00
|
|
|
|
|
|
|
// Ensure that regions accessible through a LazyCompoundVal trigger region escape.
|
|
|
|
// Malloc checker used to report leaks for the following two test cases.
|
|
|
|
struct Property {
|
|
|
|
char* getterName;
|
|
|
|
Property(char* n)
|
|
|
|
: getterName(n) {}
|
|
|
|
|
|
|
|
};
|
|
|
|
void append(Property x);
|
|
|
|
|
|
|
|
void appendWrapper(char *getterName) {
|
|
|
|
append(Property(getterName));
|
|
|
|
}
|
|
|
|
void foo(const char* name) {
|
|
|
|
char* getterName = strdup(name);
|
|
|
|
appendWrapper(getterName); // no-warning
|
|
|
|
}
|
|
|
|
|
|
|
|
struct NestedProperty {
|
|
|
|
Property prop;
|
|
|
|
NestedProperty(Property p)
|
|
|
|
: prop(p) {}
|
|
|
|
};
|
|
|
|
void appendNested(NestedProperty x);
|
|
|
|
|
|
|
|
void appendWrapperNested(char *getterName) {
|
|
|
|
appendNested(NestedProperty(Property(getterName)));
|
|
|
|
}
|
|
|
|
void fooNested(const char* name) {
|
|
|
|
char* getterName = strdup(name);
|
|
|
|
appendWrapperNested(getterName); // no-warning
|
|
|
|
}
|