1 // RUN: %clang_cc1 -triple x86_64-pc-linux-gnu -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -DNO_CROSSCHECK -verify %s
2 // RUN: %clang_cc1 -triple x86_64-pc-linux-gnu -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-config crosscheck-with-z3=true -verify %s
3 // REQUIRES: z3
4
5 void clang_analyzer_dump(float);
6
foo(int x)7 int foo(int x)
8 {
9 int *z = 0;
10 if ((x & 1) && ((x & 1) ^ 1))
11 #ifdef NO_CROSSCHECK
12 return *z; // expected-warning {{Dereference of null pointer (loaded from variable 'z')}}
13 #else
14 return *z; // no-warning
15 #endif
16 return 0;
17 }
18
unary(int x,long l)19 int unary(int x, long l)
20 {
21 int *z = 0;
22 int y = l;
23 if ((x & 1) && ((x & 1) ^ 1))
24 if (-y)
25 #ifdef NO_CROSSCHECK
26 return *z; // expected-warning {{Dereference of null pointer (loaded from variable 'z')}}
27 #else
28 return *z; // no-warning
29 #endif
30 return 0;
31 }
32
33 void g(int d);
34
f(int * a,int * b)35 void f(int *a, int *b) {
36 int c = 5;
37 if ((a - b) == 0)
38 c = 0;
39 if (a != b)
40 g(3 / c); // no-warning
41 }
42
43 _Bool nondet_bool();
44
h(int d)45 void h(int d) {
46 int x, y, k, z = 1;
47 while (z < k) { // expected-warning {{The right operand of '<' is a garbage value}}
48 z = 2 * z;
49 }
50 }
51
i()52 void i() {
53 _Bool c = nondet_bool();
54 if (c) {
55 h(1);
56 } else {
57 h(2);
58 }
59 }
60
floatUnaryNegInEq(int h,int l)61 void floatUnaryNegInEq(int h, int l) {
62 int j;
63 clang_analyzer_dump(-(float)h); // expected-warning-re{{-(float) (reg_${{[0-9]+}}<int h>)}}
64 clang_analyzer_dump((float)l); // expected-warning-re {{(float) (reg_${{[0-9]+}}<int l>)}}
65 if (-(float)h != (float)l) { // should not crash
66 j += 10;
67 // expected-warning@-1{{garbage}}
68 }
69 }
70
floatUnaryLNotInEq(int h,int l)71 void floatUnaryLNotInEq(int h, int l) {
72 int j;
73 clang_analyzer_dump(!(float)h); // expected-warning{{Unknown}}
74 clang_analyzer_dump((float)l); // expected-warning-re {{(float) (reg_${{[0-9]+}}<int l>)}}
75 if ((!(float)h) != (float)l) { // should not crash
76 j += 10;
77 // expected-warning@-1{{garbage}}
78 }
79 }
80
81 // don't crash, and also produce a core.CallAndMessage finding
82 void a(int);
83 typedef struct {
84 int b;
85 } c;
86 c *d;
e()87 void e() {
88 (void)d->b;
89 int f;
90 a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
91 }
92