1 // RUN: %clang_analyze_cc1 %s \
2 // RUN: -analyzer-checker=core \
3 // RUN: -analyzer-checker=alpha.unix.cstring.OutOfBounds,alpha.unix.cstring.UninitializedRead \
4 // RUN: -analyzer-config eagerly-assume=false \
5 // RUN: -verify
6
7 // expected-no-diagnostics
8
9 typedef typeof(sizeof(int)) size_t;
10 void *memmove(void *, const void *, size_t);
11
12 typedef struct {
13 char a[1024];
14 } b;
15 int c;
16 b *invalidate();
d()17 int d() {
18 b *a = invalidate();
19 if (c < 1024)
20 return 0;
21 int f = c & ~3, g = f;
22 g--;
23 if (g)
24 return 0;
25
26 // Parent state is already infeasible.
27 // clang_analyzer_printState();
28 // "constraints": [
29 // { "symbol": "(derived_$3{conj_$0{int, LC1, S728, #1},c}) & -4", "range": "{ [1, 1] }" },
30 // { "symbol": "derived_$3{conj_$0{int, LC1, S728, #1},c}", "range": "{ [1024, 2147483647] }" }
31 // ],
32
33 // This sould not crash!
34 // It crashes in baseline, since there both true and false states are nullptr!
35 memmove(a->a, &a->a[f], c - f);
36
37 return 0;
38 }
39