llvm-project/clang/test/Analysis/ctu-main.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

77 lines
2.3 KiB
C
Raw Normal View History

// RUN: rm -rf %t && mkdir %t
// RUN: mkdir -p %t/ctudir2
// RUN: %clang_cc1 -triple x86_64-pc-linux-gnu \
// RUN: -emit-pch -o %t/ctudir2/ctu-other.c.ast %S/Inputs/ctu-other.c
// RUN: cp %S/Inputs/ctu-other.c.externalDefMap.ast-dump.txt %t/ctudir2/externalDefMap.txt
// RUN: %clang_cc1 -triple x86_64-pc-linux-gnu -fsyntax-only -std=c89 -analyze \
// RUN: -analyzer-checker=core,debug.ExprInspection \
// RUN: -analyzer-config experimental-enable-naive-ctu-analysis=true \
// RUN: -analyzer-config ctu-dir=%t/ctudir2 \
// RUN: -verify %s
void clang_analyzer_eval(int);
// Test typedef and global variable in function.
typedef struct {
int a;
int b;
} FooBar;
extern FooBar fb;
int f(int);
void testGlobalVariable(void) {
clang_analyzer_eval(f(5) == 1); // expected-warning{{TRUE}}
}
// Test enums.
int enumCheck(void);
enum A { x,
y,
z };
void testEnum(void) {
clang_analyzer_eval(x == 0); // expected-warning{{TRUE}}
clang_analyzer_eval(enumCheck() == 42); // expected-warning{{TRUE}}
}
// Test that asm import does not fail.
int inlineAsm(void);
int testInlineAsm(void) {
return inlineAsm();
}
// Test reporting error in a macro.
struct S;
int g(struct S *);
void testMacro(void) {
g(0); // expected-warning@Inputs/ctu-other.c:29 {{Access to field 'a' results in a dereference of a null pointer (loaded from variable 'ctx')}}
}
// The external function prototype is incomplete.
// warning:implicit functions are prohibited by c99
void testImplicit(void) {
int res = identImplicit(6); // external implicit functions are not inlined
clang_analyzer_eval(res == 6); // expected-warning{{TRUE}}
// Call something with uninitialized from the same function in which the implicit was called.
// This is necessary to reproduce a special bug in NoStoreFuncVisitor.
int uninitialized;
h(uninitialized); // expected-warning{{1st function call argument is an uninitialized value}}
}
// Tests the import of functions that have a struct parameter
// defined in its prototype.
struct DataType {
int a;
int b;
};
int structInProto(struct DataType *d);
void testStructDefInArgument(void) {
struct DataType d;
d.a = 1;
d.b = 0;
clang_analyzer_eval(structInProto(&d) == 0); // expected-warning{{TRUE}} expected-warning{{FALSE}}
}
[AST][PCH][ASTImporter] Fix UB caused by uninited SwitchStmt member The SwitchStmt::FirstCase member is not initialized when the AST is built by the ASTStmtReader. See the below code of ASTStmtReader::VisitSwitchStmt in the case where the for loop does not have any iterations: ``` // ... more code ... SwitchCase *PrevSC = nullptr; for (auto E = Record.size(); Record.getIdx() != E; ) { SwitchCase *SC = Record.getSwitchCaseWithID(Record.readInt()); if (PrevSC) PrevSC->setNextSwitchCase(SC); else S->setSwitchCaseList(SC); // Sets FirstCase !!! PrevSC = SC; } } // return ``` Later, in ASTNodeImporter::VisitSwitchStmt, we have a condition that depends on this uninited value: ``` for (SwitchCase *SC = S->getSwitchCaseList(); SC != nullptr; SC = SC->getNextSwitchCase()) { // ... more code ... } ``` This is clearly an UB. This causes non-deterministic crashes when ClangSA analyzes some code with CTU. See the below report by valgrind (the whole valgrind output is attached): ``` ==31019== Conditional jump or move depends on uninitialised value(s) ==31019== at 0x12ED1983: clang::ASTNodeImporter::VisitSwitchStmt(clang::SwitchStmt*) (ASTImporter.cpp:6195) ==31019== by 0x12F1D509: clang::StmtVisitorBase<std::add_pointer, clang::ASTNodeImporter, llvm::Expected<clang::Stmt*>>::Visit(clang::Stmt*) (StmtNodes.inc:591) ==31019== by 0x12EE4FDF: clang::ASTImporter::Import(clang::Stmt*) (ASTImporter.cpp:8484) ==31019== by 0x12F09498: llvm::Expected<clang::Stmt*> clang::ASTNodeImporter::import<clang::Stmt>(clang::Stmt*) (ASTImporter.cpp:164) ==31019== by 0x12F3A1F5: llvm::Error clang::ASTNodeImporter::ImportArrayChecked<clang::Stmt**, clang::Stmt**>(clang::Stmt**, clang::Stmt**, clang::Stmt**) (ASTImporter.cpp:653) ==31019== by 0x12F13152: llvm::Error clang::ASTNodeImporter::ImportContainerChecked<llvm::iterator_range<clang::Stmt**>, llvm::SmallVector<clang::Stmt*, 8u> >(llvm::iterator_range<clang::Stmt**> const&, llvm::SmallVector<clang::Stmt*, 8u>&) (ASTImporter.cpp:669) ==31019== by 0x12ED099F: clang::ASTNodeImporter::VisitCompoundStmt(clang::CompoundStmt*) (ASTImporter.cpp:6077) ==31019== by 0x12F1CC2D: clang::StmtVisitorBase<std::add_pointer, clang::ASTNodeImporter, llvm::Expected<clang::Stmt*>>::Visit(clang::Stmt*) (StmtNodes.inc:73) ==31019== by 0x12EE4FDF: clang::ASTImporter::Import(clang::Stmt*) (ASTImporter.cpp:8484) ==31019== by 0x12F09498: llvm::Expected<clang::Stmt*> clang::ASTNodeImporter::import<clang::Stmt>(clang::Stmt*) (ASTImporter.cpp:164) ==31019== by 0x12F13275: clang::Stmt* clang::ASTNodeImporter::importChecked<clang::Stmt*>(llvm::Error&, clang::Stmt* const&) (ASTImporter.cpp:197) ==31019== by 0x12ED0CE6: clang::ASTNodeImporter::VisitCaseStmt(clang::CaseStmt*) (ASTImporter.cpp:6098) ``` Differential Revision: https://reviews.llvm.org/D97849
2021-03-03 20:35:13 +08:00
int switchWithoutCases(int);
void testSwitchStmtCrash(int x) {
switchWithoutCases(x);
}