2019-03-26 08:36:53 +08:00
|
|
|
// RUN: %clang_analyze_cc1 -w -verify %s\
|
|
|
|
// RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDeleteLeaks\
|
|
|
|
// RUN: -analyzer-checker=debug.ExprInspection -std=c++11
|
|
|
|
// RUN: %clang_analyze_cc1 -w -verify %s\
|
|
|
|
// RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDeleteLeaks\
|
|
|
|
// RUN: -analyzer-checker=debug.ExprInspection -std=c++17
|
|
|
|
// RUN: %clang_analyze_cc1 -w -verify %s\
|
|
|
|
// RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDeleteLeaks\
|
|
|
|
// RUN: -analyzer-checker=debug.ExprInspection -std=c++11\
|
|
|
|
// RUN: -DTEST_INLINABLE_ALLOCATORS
|
|
|
|
// RUN: %clang_analyze_cc1 -w -verify %s\
|
|
|
|
// RUN: -analyzer-checker=core,unix.Malloc,cplusplus.NewDeleteLeaks\
|
|
|
|
// RUN: -analyzer-checker=debug.ExprInspection -std=c++17\
|
|
|
|
// RUN: -DTEST_INLINABLE_ALLOCATORS
|
2012-05-17 00:01:10 +08:00
|
|
|
|
|
|
|
void clang_analyzer_eval(bool);
|
2010-11-16 15:52:17 +08:00
|
|
|
|
2017-10-05 16:43:32 +08:00
|
|
|
#include "Inputs/system-header-simulator-cxx.h"
|
|
|
|
|
2010-11-16 15:52:17 +08:00
|
|
|
class A {
|
|
|
|
int x;
|
|
|
|
public:
|
|
|
|
A();
|
|
|
|
};
|
|
|
|
|
|
|
|
A::A() : x(0) {
|
2012-05-17 00:01:10 +08:00
|
|
|
clang_analyzer_eval(x == 0); // expected-warning{{TRUE}}
|
2010-11-16 15:52:17 +08:00
|
|
|
}
|
2012-07-27 04:04:21 +08:00
|
|
|
|
|
|
|
|
|
|
|
class DirectMember {
|
|
|
|
int x;
|
|
|
|
public:
|
|
|
|
DirectMember(int value) : x(value) {}
|
|
|
|
|
|
|
|
int getX() { return x; }
|
|
|
|
};
|
|
|
|
|
|
|
|
void testDirectMember() {
|
|
|
|
DirectMember obj(3);
|
|
|
|
clang_analyzer_eval(obj.getX() == 3); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
class IndirectMember {
|
|
|
|
struct {
|
|
|
|
int x;
|
|
|
|
};
|
|
|
|
public:
|
|
|
|
IndirectMember(int value) : x(value) {}
|
|
|
|
|
|
|
|
int getX() { return x; }
|
|
|
|
};
|
|
|
|
|
|
|
|
void testIndirectMember() {
|
|
|
|
IndirectMember obj(3);
|
|
|
|
clang_analyzer_eval(obj.getX() == 3); // expected-warning{{TRUE}}
|
|
|
|
}
|
2012-08-03 05:33:42 +08:00
|
|
|
|
|
|
|
|
2012-08-04 07:31:15 +08:00
|
|
|
struct DelegatingConstructor {
|
|
|
|
int x;
|
|
|
|
DelegatingConstructor(int y) { x = y; }
|
|
|
|
DelegatingConstructor() : DelegatingConstructor(42) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testDelegatingConstructor() {
|
|
|
|
DelegatingConstructor obj;
|
|
|
|
clang_analyzer_eval(obj.x == 42); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-08-03 05:33:42 +08:00
|
|
|
struct RefWrapper {
|
|
|
|
RefWrapper(int *p) : x(*p) {}
|
|
|
|
RefWrapper(int &r) : x(r) {}
|
|
|
|
int &x;
|
|
|
|
};
|
|
|
|
|
|
|
|
void testReferenceMember() {
|
|
|
|
int *p = 0;
|
2012-09-01 01:06:49 +08:00
|
|
|
RefWrapper X(p); // expected-warning@-7 {{Dereference of null pointer}}
|
2012-08-03 05:33:42 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void testReferenceMember2() {
|
|
|
|
int *p = 0;
|
2013-03-07 11:02:36 +08:00
|
|
|
RefWrapper X(*p); // expected-warning {{Forming reference to null pointer}}
|
2012-08-03 05:33:42 +08:00
|
|
|
}
|
2012-08-25 09:06:23 +08:00
|
|
|
|
|
|
|
|
|
|
|
extern "C" char *strdup(const char *);
|
|
|
|
|
|
|
|
class StringWrapper {
|
|
|
|
char *str;
|
|
|
|
public:
|
|
|
|
StringWrapper(const char *input) : str(strdup(input)) {} // no-warning
|
|
|
|
};
|
2013-01-26 11:16:31 +08:00
|
|
|
|
|
|
|
|
|
|
|
// PR15070 - Constructing a type containing a non-POD array mistakenly
|
|
|
|
// tried to perform a bind instead of relying on the CXXConstructExpr,
|
|
|
|
// which caused a cast<> failure in RegionStore.
|
|
|
|
namespace DefaultConstructorWithCleanups {
|
|
|
|
class Element {
|
|
|
|
public:
|
|
|
|
int value;
|
|
|
|
|
|
|
|
class Helper {
|
|
|
|
public:
|
|
|
|
~Helper();
|
|
|
|
};
|
|
|
|
Element(Helper h = Helper());
|
|
|
|
};
|
|
|
|
class Wrapper {
|
|
|
|
public:
|
|
|
|
Element arr[2];
|
|
|
|
|
|
|
|
Wrapper();
|
|
|
|
};
|
|
|
|
|
|
|
|
Wrapper::Wrapper() /* initializers synthesized */ {}
|
|
|
|
|
|
|
|
int test() {
|
|
|
|
Wrapper w;
|
|
|
|
return w.arr[0].value; // no-warning
|
|
|
|
}
|
|
|
|
}
|
2013-07-18 01:16:42 +08:00
|
|
|
|
|
|
|
namespace DefaultMemberInitializers {
|
|
|
|
struct Wrapper {
|
|
|
|
int value = 42;
|
|
|
|
|
|
|
|
Wrapper() {}
|
|
|
|
Wrapper(int x) : value(x) {}
|
|
|
|
Wrapper(bool) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void test() {
|
|
|
|
Wrapper w1;
|
|
|
|
clang_analyzer_eval(w1.value == 42); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
Wrapper w2(50);
|
|
|
|
clang_analyzer_eval(w2.value == 50); // expected-warning{{TRUE}}
|
|
|
|
|
|
|
|
Wrapper w3(false);
|
|
|
|
clang_analyzer_eval(w3.value == 42); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
struct StringWrapper {
|
|
|
|
const char s[4] = "abc";
|
|
|
|
const char *p = "xyz";
|
|
|
|
|
|
|
|
StringWrapper(bool) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testString() {
|
|
|
|
StringWrapper w(true);
|
|
|
|
clang_analyzer_eval(w.s[1] == 'b'); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(w.p[1] == 'y'); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
}
|
2015-12-17 08:28:33 +08:00
|
|
|
|
|
|
|
namespace ReferenceInitialization {
|
|
|
|
struct OtherStruct {
|
|
|
|
OtherStruct(int i);
|
|
|
|
~OtherStruct();
|
|
|
|
};
|
|
|
|
|
|
|
|
struct MyStruct {
|
|
|
|
MyStruct(int i);
|
|
|
|
MyStruct(OtherStruct os);
|
|
|
|
|
|
|
|
void method() const;
|
|
|
|
};
|
|
|
|
|
|
|
|
void referenceInitializeLocal() {
|
|
|
|
const MyStruct &myStruct(5);
|
|
|
|
myStruct.method(); // no-warning
|
|
|
|
}
|
|
|
|
|
|
|
|
void referenceInitializeMultipleLocals() {
|
|
|
|
const MyStruct &myStruct1(5), myStruct2(5), &myStruct3(5);
|
|
|
|
myStruct1.method(); // no-warning
|
|
|
|
myStruct2.method(); // no-warning
|
|
|
|
myStruct3.method(); // no-warning
|
|
|
|
}
|
|
|
|
|
|
|
|
void referenceInitializeLocalWithCleanup() {
|
|
|
|
const MyStruct &myStruct(OtherStruct(5));
|
|
|
|
myStruct.method(); // no-warning
|
|
|
|
}
|
|
|
|
};
|
2017-01-12 17:46:16 +08:00
|
|
|
|
|
|
|
namespace PR31592 {
|
|
|
|
struct C {
|
|
|
|
C() : f("}") { } // no-crash
|
|
|
|
const char(&f)[2];
|
|
|
|
};
|
|
|
|
}
|
2017-10-05 16:43:32 +08:00
|
|
|
|
|
|
|
namespace CXX_initializer_lists {
|
|
|
|
struct C {
|
|
|
|
C(std::initializer_list<int *> list);
|
|
|
|
};
|
2017-11-28 01:37:09 +08:00
|
|
|
void testPointerEscapeIntoLists() {
|
2017-10-05 16:43:32 +08:00
|
|
|
C empty{}; // no-crash
|
|
|
|
|
|
|
|
// Do not warn that 'x' leaks. It might have been deleted by
|
|
|
|
// the destructor of 'c'.
|
|
|
|
int *x = new int;
|
|
|
|
C c{x}; // no-warning
|
|
|
|
}
|
2017-11-28 01:37:09 +08:00
|
|
|
|
|
|
|
void testPassListsWithExplicitConstructors() {
|
|
|
|
(void)(std::initializer_list<int>){12}; // no-crash
|
|
|
|
}
|
2017-10-05 16:43:32 +08:00
|
|
|
}
|
[analyzer] Fix a crash during C++17 aggregate construction of base objects.
Since C++17, classes that have base classes can potentially be initialized as
aggregates. Trying to construct such objects through brace initialization was
causing the analyzer to crash when the base class has a non-trivial constructor,
while figuring target region for the base class constructor, because the parent
stack frame didn't contain the constructor of the subclass, because there is
no constructor for subclass, merely aggregate initialization.
This patch avoids the crash, but doesn't provide the actually correct region
for the constructor, which still remains to be fixed. Instead, construction
goes into a fake temporary region which would be immediately discarded. Similar
extremely conservative approach is used for other cases in which the logic for
finding the target region is not yet implemented, including aggregate
initialization with fields instead of base-regions (which is not C++17-specific
but also never worked, just didn't crash).
Differential revision: https://reviews.llvm.org/D40841
rdar://problem/35441058
llvm-svn: 321128
2017-12-20 08:40:38 +08:00
|
|
|
|
|
|
|
namespace CXX17_aggregate_construction {
|
|
|
|
struct A {
|
|
|
|
A();
|
|
|
|
};
|
|
|
|
|
|
|
|
struct B: public A {
|
|
|
|
};
|
|
|
|
|
|
|
|
struct C: public B {
|
|
|
|
};
|
|
|
|
|
|
|
|
struct D: public virtual A {
|
|
|
|
};
|
|
|
|
|
|
|
|
// In C++17, classes B and C are aggregates, so they will be constructed
|
|
|
|
// without actually calling their trivial constructor. Used to crash.
|
|
|
|
void foo() {
|
|
|
|
B b = {}; // no-crash
|
|
|
|
const B &bl = {}; // no-crash
|
|
|
|
B &&br = {}; // no-crash
|
|
|
|
|
|
|
|
C c = {}; // no-crash
|
|
|
|
const C &cl = {}; // no-crash
|
|
|
|
C &&cr = {}; // no-crash
|
|
|
|
|
|
|
|
D d = {}; // no-crash
|
|
|
|
|
2019-03-26 08:36:53 +08:00
|
|
|
#if __cplusplus >= 201703L
|
[analyzer] Fix a crash during C++17 aggregate construction of base objects.
Since C++17, classes that have base classes can potentially be initialized as
aggregates. Trying to construct such objects through brace initialization was
causing the analyzer to crash when the base class has a non-trivial constructor,
while figuring target region for the base class constructor, because the parent
stack frame didn't contain the constructor of the subclass, because there is
no constructor for subclass, merely aggregate initialization.
This patch avoids the crash, but doesn't provide the actually correct region
for the constructor, which still remains to be fixed. Instead, construction
goes into a fake temporary region which would be immediately discarded. Similar
extremely conservative approach is used for other cases in which the logic for
finding the target region is not yet implemented, including aggregate
initialization with fields instead of base-regions (which is not C++17-specific
but also never worked, just didn't crash).
Differential revision: https://reviews.llvm.org/D40841
rdar://problem/35441058
llvm-svn: 321128
2017-12-20 08:40:38 +08:00
|
|
|
C cd = {{}}; // no-crash
|
|
|
|
const C &cdl = {{}}; // no-crash
|
|
|
|
C &&cdr = {{}}; // no-crash
|
|
|
|
|
|
|
|
const B &bll = {{}}; // no-crash
|
|
|
|
const B &bcl = C({{}}); // no-crash
|
|
|
|
B &&bcr = C({{}}); // no-crash
|
|
|
|
#endif
|
|
|
|
}
|
2019-03-21 08:15:07 +08:00
|
|
|
} // namespace CXX17_aggregate_construction
|
|
|
|
|
|
|
|
namespace CXX17_transparent_init_list_exprs {
|
|
|
|
class A {};
|
|
|
|
|
|
|
|
class B: private A {};
|
|
|
|
|
|
|
|
B boo();
|
|
|
|
void foo1() {
|
|
|
|
B b { boo() }; // no-crash
|
|
|
|
}
|
|
|
|
|
|
|
|
class C: virtual public A {};
|
|
|
|
|
|
|
|
C coo();
|
|
|
|
void foo2() {
|
|
|
|
C c { coo() }; // no-crash
|
[analyzer] Fix a crash during C++17 aggregate construction of base objects.
Since C++17, classes that have base classes can potentially be initialized as
aggregates. Trying to construct such objects through brace initialization was
causing the analyzer to crash when the base class has a non-trivial constructor,
while figuring target region for the base class constructor, because the parent
stack frame didn't contain the constructor of the subclass, because there is
no constructor for subclass, merely aggregate initialization.
This patch avoids the crash, but doesn't provide the actually correct region
for the constructor, which still remains to be fixed. Instead, construction
goes into a fake temporary region which would be immediately discarded. Similar
extremely conservative approach is used for other cases in which the logic for
finding the target region is not yet implemented, including aggregate
initialization with fields instead of base-regions (which is not C++17-specific
but also never worked, just didn't crash).
Differential revision: https://reviews.llvm.org/D40841
rdar://problem/35441058
llvm-svn: 321128
2017-12-20 08:40:38 +08:00
|
|
|
}
|
2019-03-26 08:36:53 +08:00
|
|
|
|
|
|
|
B foo_recursive() {
|
|
|
|
B b { foo_recursive() };
|
|
|
|
}
|
2019-03-21 08:15:07 +08:00
|
|
|
} // namespace CXX17_transparent_init_list_exprs
|
2019-05-25 07:37:08 +08:00
|
|
|
|
|
|
|
namespace skip_vbase_initializer_side_effects {
|
|
|
|
int glob;
|
|
|
|
struct S {
|
|
|
|
S() { ++glob; }
|
|
|
|
};
|
|
|
|
|
|
|
|
struct A {
|
|
|
|
A() {}
|
|
|
|
A(S s) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
struct B : virtual A {
|
|
|
|
B() : A(S()) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
struct C : B {
|
|
|
|
C() {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void foo() {
|
|
|
|
glob = 0;
|
|
|
|
B b;
|
|
|
|
clang_analyzer_eval(glob == 1); // expected-warning{{TRUE}}
|
|
|
|
C c; // no-crash
|
|
|
|
clang_analyzer_eval(glob == 1); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
} // namespace skip_vbase_initializer_side_effects
|
|
|
|
|
|
|
|
namespace dont_skip_vbase_initializers_in_most_derived_class {
|
|
|
|
struct A {
|
|
|
|
static int a;
|
|
|
|
A() { a = 0; }
|
|
|
|
A(int x) { a = x; }
|
|
|
|
};
|
|
|
|
|
|
|
|
struct B {
|
|
|
|
static int b;
|
|
|
|
B() { b = 0; }
|
|
|
|
B(int y) { b = y; }
|
|
|
|
};
|
|
|
|
|
|
|
|
struct C : virtual A {
|
|
|
|
C() : A(1) {}
|
|
|
|
};
|
|
|
|
struct D : C, virtual B {
|
|
|
|
D() : B(2) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testD() {
|
|
|
|
D d;
|
|
|
|
clang_analyzer_eval(A::a == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(B::b == 2); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
struct E : virtual B, C {
|
|
|
|
E() : B(2) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testE() {
|
|
|
|
E e;
|
|
|
|
clang_analyzer_eval(A::a == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(B::b == 2); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
struct F : virtual A, virtual B {
|
|
|
|
F() : A(1) {}
|
|
|
|
};
|
|
|
|
struct G : F {
|
|
|
|
G(): B(2) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testG() {
|
|
|
|
G g;
|
|
|
|
clang_analyzer_eval(A::a == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(B::b == 2); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
struct H : virtual B, virtual A {
|
|
|
|
H(): A(1) {}
|
|
|
|
};
|
|
|
|
struct I : H {
|
|
|
|
I(): B(2) {}
|
|
|
|
};
|
|
|
|
|
|
|
|
void testI() {
|
|
|
|
I i;
|
|
|
|
clang_analyzer_eval(A::a == 0); // expected-warning{{TRUE}}
|
|
|
|
clang_analyzer_eval(B::b == 2); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
} // namespace dont_skip_vbase_initializers_in_most_derived_class
|