1 // RUN: %clang_analyze_cc1 %s -analyzer-checker=core.NullDereference,core.DivideZero -fblocks -analyzer-output=text -analyzer-config suppress-null-return-paths=false -verify -analyzer-config eagerly-assume=false %s
2 // RUN: %clang_analyze_cc1 -analyzer-config eagerly-assume=false %s -analyzer-checker=core.NullDereference,core.DivideZero -fblocks -analyzer-output=plist -analyzer-config suppress-null-return-paths=false -o %t
3 // RUN: %normalize_plist <%t | diff -ub %S/Inputs/expected-plists/inline-plist.c.plist -
4
mmm(int y)5 void mmm(int y) {
6 if (y != 0)
7 y++;
8 }
9
foo(int x,int y)10 int foo(int x, int y) {
11 mmm(y);
12 if (x != 0) {
13 // expected-note@-1 {{Assuming 'x' is equal to 0}}
14 // expected-note@-2 {{Taking false branch}}
15 x++;
16 }
17 return 5/x; // expected-warning{{Division by zero}} expected-note{{Division by zero}}
18 }
19
20 // Test a bug triggering only when inlined.
has_bug(int * p)21 void has_bug(int *p) {
22 *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
23 }
24
test_has_bug(void)25 void test_has_bug(void) {
26 has_bug(0);
27 // expected-note@-1 {{Passing null pointer value via 1st parameter 'p'}}
28 // expected-note@-2 {{Calling 'has_bug'}}
29 }
30
triggers_bug(int * p)31 void triggers_bug(int *p) {
32 *p = 0xDEADBEEF; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
33 }
34
35 // This function triggers a bug by calling triggers_bug(). The diagnostics
36 // should show when p is assumed to be null.
bar(int * p)37 void bar(int *p) {
38 if (!!p) {
39 // expected-note@-1 {{Assuming 'p' is null}}
40 // expected-note@-2 {{Taking false branch}}
41 return;
42 }
43
44 if (p == 0) {
45 // expected-note@-1 {{'p' is equal to null}}
46 // expected-note@-2 {{Taking true branch}}
47 triggers_bug(p);
48 // expected-note@-1 {{Passing null pointer value via 1st parameter 'p'}}
49 // expected-note@-2 {{Calling 'triggers_bug'}}
50 }
51 }
52
53 // ========================================================================== //
54 // Test inlining of blocks.
55 // ========================================================================== //
56
test_block__capture_null(void)57 void test_block__capture_null(void) {
58 int *p = 0; // expected-note{{'p' initialized to a null pointer value}}
59 ^(void){ // expected-note {{Calling anonymous block}}
60 *p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
61 }();
62
63 }
64
test_block_ret(void)65 void test_block_ret(void) {
66 int *p = ^int*(void){ // expected-note {{Calling anonymous block}} expected-note{{Returning to caller}} expected-note {{'p' initialized to a null pointer value}}
67 int *q = 0; // expected-note {{'q' initialized to a null pointer value}}
68 return q; // expected-note {{Returning null pointer (loaded from 'q')}}
69 }();
70 *p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
71 }
72
test_block_blockvar(void)73 void test_block_blockvar(void) {
74 __block int *p;
75 ^(void){ // expected-note{{Calling anonymous block}} expected-note{{Returning to caller}}
76 p = 0; // expected-note{{Null pointer value stored to 'p'}}
77 }();
78 *p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
79 }
80
test_block_arg(void)81 void test_block_arg(void) {
82 int *p;
83 ^(int **q){ // expected-note{{Calling anonymous block}} expected-note{{Returning to caller}}
84 *q = 0; // expected-note{{Null pointer value stored to 'p'}}
85 }(&p);
86 *p = 1; // expected-warning{{Dereference of null pointer (loaded from variable 'p')}} expected-note{{Dereference of null pointer (loaded from variable 'p')}}
87 }
88
89