2012-08-22 05:44:07 +08:00
|
|
|
// RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.ExprInspection -verify %s
|
2012-07-10 00:54:49 +08:00
|
|
|
|
|
|
|
void clang_analyzer_eval(int);
|
[analyzer] Add clang_analyzer_checkInlined for debugging purposes.
This check is also accessible through the debug.ExprInspection checker.
Like clang_analyzer_eval, you can use it to test the analyzer engine's
current state; the argument should be true or false to indicate whether or
not you expect the function to be inlined.
When used in the positive case (clang_analyzer_checkInlined(true)), the
analyzer prints the message "TRUE" if the function is ever inlined. However,
clang_analyzer_checkInlined(false) should never print a message; this asserts
that there should be no paths on which the current function is inlined, but
then there are no paths on which to print a message! (If the assertion is
violated, the message "FALSE" will be printed.)
This asymmetry comes from the fact that the only other chance to print a
message is when the function is analyzed as a top-level function. However,
when we do that, we can't be sure it isn't also inlined elsewhere (such as
in a recursive function, or if we want to analyze in both general or
specialized cases). Rather than have all checkInlined calls have an appended,
meaningless "FALSE" or "TOP-LEVEL" case, there is just no message printed.
void clang_analyzer_checkInlined(int);
For debugging purposes only!
llvm-svn: 161708
2012-08-11 06:26:29 +08:00
|
|
|
void clang_analyzer_checkInlined(int);
|
2010-05-06 11:38:27 +08:00
|
|
|
|
2011-01-15 04:29:43 +08:00
|
|
|
int test1_f1() {
|
2010-02-27 10:44:37 +08:00
|
|
|
int y = 1;
|
|
|
|
y++;
|
[analyzer] Add clang_analyzer_checkInlined for debugging purposes.
This check is also accessible through the debug.ExprInspection checker.
Like clang_analyzer_eval, you can use it to test the analyzer engine's
current state; the argument should be true or false to indicate whether or
not you expect the function to be inlined.
When used in the positive case (clang_analyzer_checkInlined(true)), the
analyzer prints the message "TRUE" if the function is ever inlined. However,
clang_analyzer_checkInlined(false) should never print a message; this asserts
that there should be no paths on which the current function is inlined, but
then there are no paths on which to print a message! (If the assertion is
violated, the message "FALSE" will be printed.)
This asymmetry comes from the fact that the only other chance to print a
message is when the function is analyzed as a top-level function. However,
when we do that, we can't be sure it isn't also inlined elsewhere (such as
in a recursive function, or if we want to analyze in both general or
specialized cases). Rather than have all checkInlined calls have an appended,
meaningless "FALSE" or "TOP-LEVEL" case, there is just no message printed.
void clang_analyzer_checkInlined(int);
For debugging purposes only!
llvm-svn: 161708
2012-08-11 06:26:29 +08:00
|
|
|
clang_analyzer_checkInlined(1); // expected-warning{{TRUE}}
|
2010-02-27 10:44:37 +08:00
|
|
|
return y;
|
|
|
|
}
|
|
|
|
|
2011-01-15 04:29:43 +08:00
|
|
|
void test1_f2() {
|
2010-02-27 10:44:37 +08:00
|
|
|
int x = 1;
|
2011-01-15 04:29:43 +08:00
|
|
|
x = test1_f1();
|
2010-02-27 10:44:37 +08:00
|
|
|
if (x == 1) {
|
|
|
|
int *p = 0;
|
|
|
|
*p = 3; // no-warning
|
|
|
|
}
|
|
|
|
if (x == 2) {
|
|
|
|
int *p = 0;
|
2010-03-23 09:11:38 +08:00
|
|
|
*p = 3; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}}
|
2010-02-27 10:44:37 +08:00
|
|
|
}
|
|
|
|
}
|
2011-01-15 04:29:43 +08:00
|
|
|
|
|
|
|
// Test that inlining works when the declared function has less arguments
|
|
|
|
// than the actual number in the declaration.
|
|
|
|
void test2_f1() {}
|
|
|
|
int test2_f2();
|
|
|
|
|
|
|
|
void test2_f3() {
|
|
|
|
test2_f1(test2_f2()); // expected-warning{{too many arguments in call to 'test2_f1'}}
|
|
|
|
}
|
|
|
|
|
2012-01-13 03:25:46 +08:00
|
|
|
// Test that inlining works with recursive functions.
|
|
|
|
|
|
|
|
unsigned factorial(unsigned x) {
|
|
|
|
if (x <= 1)
|
|
|
|
return 1;
|
|
|
|
return x * factorial(x - 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
void test_factorial() {
|
|
|
|
if (factorial(3) == 6) {
|
|
|
|
int *p = 0;
|
|
|
|
*p = 0xDEADBEEF; // expected-warning {{null}}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
int *p = 0;
|
|
|
|
*p = 0xDEADBEEF; // no-warning
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void test_factorial_2() {
|
|
|
|
unsigned x = factorial(3);
|
|
|
|
if (x == factorial(3)) {
|
|
|
|
int *p = 0;
|
|
|
|
*p = 0xDEADBEEF; // expected-warning {{null}}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
int *p = 0;
|
|
|
|
*p = 0xDEADBEEF; // no-warning
|
|
|
|
}
|
|
|
|
}
|
2012-03-03 09:22:03 +08:00
|
|
|
|
|
|
|
// Test that returning stack memory from a parent stack frame does
|
|
|
|
// not trigger a warning.
|
|
|
|
static char *return_buf(char *buf) {
|
|
|
|
return buf + 10;
|
|
|
|
}
|
|
|
|
|
|
|
|
void test_return_stack_memory_ok() {
|
|
|
|
char stack_buf[100];
|
|
|
|
char *pos = return_buf(stack_buf);
|
|
|
|
(void) pos;
|
|
|
|
}
|
|
|
|
|
|
|
|
char *test_return_stack_memory_bad() {
|
|
|
|
char stack_buf[100];
|
|
|
|
char *x = stack_buf;
|
|
|
|
return x; // expected-warning {{stack memory associated}}
|
|
|
|
}
|
|
|
|
|
2012-03-06 07:57:14 +08:00
|
|
|
// Test that passing a struct value with an uninitialized field does
|
|
|
|
// not trigger a warning if we are inlining and the body is available.
|
|
|
|
struct rdar10977037 { int x, y; };
|
|
|
|
int test_rdar10977037_aux(struct rdar10977037 v) { return v.y; }
|
|
|
|
int test_rdar10977037_aux_2(struct rdar10977037 v);
|
|
|
|
int test_rdar10977037() {
|
|
|
|
struct rdar10977037 v;
|
|
|
|
v.y = 1;
|
|
|
|
v. y += test_rdar10977037_aux(v); // no-warning
|
|
|
|
return test_rdar10977037_aux_2(v); // expected-warning {{Passed-by-value struct argument contains uninitialized data}}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-07-10 00:54:49 +08:00
|
|
|
// Test inlining a forward-declared function.
|
|
|
|
// This regressed when CallEvent was first introduced.
|
|
|
|
int plus1(int x);
|
|
|
|
void test() {
|
|
|
|
clang_analyzer_eval(plus1(2) == 3); // expected-warning{{TRUE}}
|
|
|
|
}
|
|
|
|
|
|
|
|
int plus1(int x) {
|
|
|
|
return x + 1;
|
|
|
|
}
|
|
|
|
|
[analyzer] Add clang_analyzer_checkInlined for debugging purposes.
This check is also accessible through the debug.ExprInspection checker.
Like clang_analyzer_eval, you can use it to test the analyzer engine's
current state; the argument should be true or false to indicate whether or
not you expect the function to be inlined.
When used in the positive case (clang_analyzer_checkInlined(true)), the
analyzer prints the message "TRUE" if the function is ever inlined. However,
clang_analyzer_checkInlined(false) should never print a message; this asserts
that there should be no paths on which the current function is inlined, but
then there are no paths on which to print a message! (If the assertion is
violated, the message "FALSE" will be printed.)
This asymmetry comes from the fact that the only other chance to print a
message is when the function is analyzed as a top-level function. However,
when we do that, we can't be sure it isn't also inlined elsewhere (such as
in a recursive function, or if we want to analyze in both general or
specialized cases). Rather than have all checkInlined calls have an appended,
meaningless "FALSE" or "TOP-LEVEL" case, there is just no message printed.
void clang_analyzer_checkInlined(int);
For debugging purposes only!
llvm-svn: 161708
2012-08-11 06:26:29 +08:00
|
|
|
|
|
|
|
void never_called_by_anyone() {
|
|
|
|
clang_analyzer_checkInlined(0); // no-warning
|
|
|
|
}
|
|
|
|
|
2013-06-19 16:19:56 +08:00
|
|
|
|
|
|
|
void knr_one_argument(a) int a; { }
|
|
|
|
|
|
|
|
void call_with_less_arguments() {
|
|
|
|
knr_one_argument(); // expected-warning{{too few arguments}} expected-warning{{Function taking 1 argument}}
|
|
|
|
}
|