1 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -verify %s \ 2 // RUN: -analyzer-checker=debug.ExprInspection \ 3 // RUN: -analyzer-checker=unix.cstring \ 4 // RUN: -analyzer-checker=unix.Malloc \ 5 // RUN: -analyzer-config display-checker-name=false 6 7 typedef unsigned long size_t; 8 9 struct S { 10 struct S3 { 11 int y[10]; 12 }; 13 struct S2 : S3 { 14 int *x; 15 } s2[10]; 16 int z; 17 }; 18 19 20 void clang_analyzer_explain(int); 21 void clang_analyzer_explain(void *); 22 void clang_analyzer_explain(const int *); 23 void clang_analyzer_explain(S); 24 25 size_t clang_analyzer_getExtent(void *); 26 27 size_t strlen(const char *); 28 29 int conjure(); 30 S conjure_S(); 31 32 int glob; 33 static int stat_glob; 34 void *glob_ptr; 35 36 // Test strings are regex'ed because we need to match exact string 37 // rather than a substring. 38 39 void test_1(int param, void *ptr) { 40 clang_analyzer_explain(&glob); // expected-warning-re{{{{^pointer to global variable 'glob'$}}}} 41 clang_analyzer_explain(param); // expected-warning-re{{{{^argument 'param'$}}}} 42 clang_analyzer_explain(ptr); // expected-warning-re{{{{^argument 'ptr'$}}}} 43 if (param == 42) 44 clang_analyzer_explain(param); // expected-warning-re{{{{^signed 32-bit integer '42'$}}}} 45 } 46 47 void test_2(char *ptr, int ext) { 48 clang_analyzer_explain((void *) "asdf"); // expected-warning-re{{{{^pointer to element of type 'char' with index 0 of string literal "asdf"$}}}} 49 clang_analyzer_explain(strlen(ptr)); // expected-warning-re{{{{^metadata of type 'unsigned long' tied to pointee of argument 'ptr'$}}}} 50 clang_analyzer_explain(conjure()); // expected-warning-re{{{{^symbol of type 'int' conjured at statement 'conjure\(\)'$}}}} 51 clang_analyzer_explain(glob); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob'$}}}} 52 clang_analyzer_explain(glob_ptr); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob_ptr'$}}}} 53 clang_analyzer_explain(clang_analyzer_getExtent(ptr)); // expected-warning-re{{{{^extent of pointee of argument 'ptr'$}}}} 54 int *x = new int[ext]; 55 clang_analyzer_explain(x); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of heap segment that starts at symbol of type 'int \*' conjured at statement 'new int \[ext\]'$}}}} 56 // Sic! What gets computed is the extent of the element-region. 57 clang_analyzer_explain(clang_analyzer_getExtent(x)); // expected-warning-re{{{{^\(argument 'ext'\) \* 4$}}}} 58 delete[] x; 59 } 60 61 void test_3(S s) { 62 clang_analyzer_explain(&s); // expected-warning-re{{{{^pointer to parameter 's'$}}}} 63 clang_analyzer_explain(s.z); // expected-warning-re{{{{^initial value of field 'z' of parameter 's'$}}}} 64 clang_analyzer_explain(&s.s2[5].y[3]); // expected-warning-re{{{{^pointer to element of type 'int' with index 3 of field 'y' of base object 'S::S3' inside element of type 'struct S::S2' with index 5 of field 's2' of parameter 's'$}}}} 65 if (!s.s2[7].x) { 66 clang_analyzer_explain(s.s2[7].x); // expected-warning-re{{{{^concrete memory address '0'$}}}} 67 // FIXME: we need to be explaining '1' rather than '0' here; not explainer bug. 68 clang_analyzer_explain(s.s2[7].x + 1); // expected-warning-re{{{{^concrete memory address '0'$}}}} 69 } 70 } 71 72 void test_4(int x, int y) { 73 int z; 74 static int stat; 75 clang_analyzer_explain(-x); // expected-warning-re{{{{^\- \(argument 'x'\)$}}}} 76 clang_analyzer_explain(x + 1); // expected-warning-re{{{{^\(argument 'x'\) \+ 1$}}}} 77 clang_analyzer_explain(1 + y); // expected-warning-re{{{{^\(argument 'y'\) \+ 1$}}}} 78 clang_analyzer_explain(x + y); // expected-warning-re{{{{^\(argument 'x'\) \+ \(argument 'y'\)$}}}} 79 clang_analyzer_explain(z); // expected-warning-re{{{{^undefined value$}}}} 80 clang_analyzer_explain(&z); // expected-warning-re{{{{^pointer to local variable 'z'$}}}} 81 clang_analyzer_explain(stat); // expected-warning-re{{{{^signed 32-bit integer '0'$}}}} 82 clang_analyzer_explain(&stat); // expected-warning-re{{{{^pointer to static local variable 'stat'$}}}} 83 clang_analyzer_explain(stat_glob); // expected-warning-re{{{{^initial value of global variable 'stat_glob'$}}}} 84 clang_analyzer_explain(&stat_glob); // expected-warning-re{{{{^pointer to global variable 'stat_glob'$}}}} 85 clang_analyzer_explain((int[]){1, 2, 3}); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of temporary object constructed at statement '\(int\[3\]\)\{1, 2, 3\}'$}}}} 86 } 87 88 namespace { 89 class C { 90 int x[10]; 91 92 public: 93 void test_5(int i) { 94 clang_analyzer_explain(this); // expected-warning-re{{{{^pointer to 'this' object$}}}} 95 clang_analyzer_explain(&x[i]); // expected-warning-re{{{{^pointer to element of type 'int' with index 'argument 'i'' of field 'x' of 'this' object$}}}} 96 clang_analyzer_explain(__builtin_alloca(i)); // expected-warning-re{{{{^pointer to region allocated by '__builtin_alloca\(i\)'$}}}} 97 } 98 }; 99 } // end of anonymous namespace 100 101 void test_6() { 102 clang_analyzer_explain(conjure_S()); // expected-warning-re{{{{^symbol of type 'int' conjured at statement 'conjure_S\(\)'$}}}} 103 clang_analyzer_explain(conjure_S().z); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure_S\(\)'\) for field 'z' of temporary object constructed at statement 'conjure_S\(\)'$}}}} 104 } 105 106 class C_top_level { 107 public: 108 C_top_level(int param) { 109 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}} 110 } 111 }; 112 113 class C_non_top_level { 114 public: 115 C_non_top_level(int param) { 116 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}} 117 } 118 }; 119 120 void test_7(int n) { 121 C_non_top_level c(n); 122 123 auto lambda_top_level = [n](int param) { 124 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}} 125 }; 126 auto lambda_non_top_level = [n](int param) { 127 clang_analyzer_explain(¶m); // expected-warning-re{{{{^pointer to parameter 'param'$}}}} 128 }; 129 130 lambda_non_top_level(n); 131 } 132