1*f4a2713aSLionel Sambuc// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-checker=core -analyzer-store=region -fblocks -analyzer-opt-analyze-nested-blocks -verify %s 2*f4a2713aSLionel Sambuc// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-checker=core -analyzer-store=region -fblocks -analyzer-opt-analyze-nested-blocks -verify -x objective-c++ %s 3*f4a2713aSLionel Sambuc 4*f4a2713aSLionel Sambuc//===----------------------------------------------------------------------===// 5*f4a2713aSLionel Sambuc// The following code is reduced using delta-debugging from Mac OS X headers: 6*f4a2713aSLionel Sambuc//===----------------------------------------------------------------------===// 7*f4a2713aSLionel Sambuc 8*f4a2713aSLionel Sambuctypedef __builtin_va_list va_list; 9*f4a2713aSLionel Sambuctypedef unsigned int uint32_t; 10*f4a2713aSLionel Sambuctypedef struct dispatch_queue_s *dispatch_queue_t; 11*f4a2713aSLionel Sambuctypedef struct dispatch_queue_attr_s *dispatch_queue_attr_t; 12*f4a2713aSLionel Sambuctypedef void (^dispatch_block_t)(void); 13*f4a2713aSLionel Sambucvoid dispatch_async(dispatch_queue_t queue, dispatch_block_t block); 14*f4a2713aSLionel Sambuc__attribute__((visibility("default"))) __attribute__((__malloc__)) __attribute__((__warn_unused_result__)) __attribute__((__nothrow__)) dispatch_queue_t dispatch_queue_create(const char *label, dispatch_queue_attr_t attr); 15*f4a2713aSLionel Sambuctypedef long dispatch_once_t; 16*f4a2713aSLionel Sambucvoid dispatch_once(dispatch_once_t *predicate, dispatch_block_t block); 17*f4a2713aSLionel Sambucdispatch_queue_t 18*f4a2713aSLionel Sambucdispatch_queue_create(const char *label, dispatch_queue_attr_t attr); 19*f4a2713aSLionel Sambuc 20*f4a2713aSLionel Sambuc 21*f4a2713aSLionel Sambuctypedef signed char BOOL; 22*f4a2713aSLionel Sambuctypedef unsigned long NSUInteger; 23*f4a2713aSLionel Sambuctypedef struct _NSZone NSZone; 24*f4a2713aSLionel Sambuc@class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator; 25*f4a2713aSLionel Sambuc@protocol NSObject 26*f4a2713aSLionel Sambuc- (BOOL)isEqual:(id)object; 27*f4a2713aSLionel Sambuc- (oneway void)release; 28*f4a2713aSLionel Sambuc@end 29*f4a2713aSLionel Sambuc@protocol NSCopying - (id)copyWithZone:(NSZone *)zone; @end 30*f4a2713aSLionel Sambuc@protocol NSMutableCopying - (id)mutableCopyWithZone:(NSZone *)zone; @end 31*f4a2713aSLionel Sambuc@protocol NSCoding - (void)encodeWithCoder:(NSCoder *)aCoder; @end 32*f4a2713aSLionel Sambuc@interface NSObject <NSObject> {} 33*f4a2713aSLionel Sambuc+ (id)alloc; 34*f4a2713aSLionel Sambuc- (id)init; 35*f4a2713aSLionel Sambuc- (id)copy; 36*f4a2713aSLionel Sambuc@end 37*f4a2713aSLionel Sambucextern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone); 38*f4a2713aSLionel Sambuc@interface NSString : NSObject <NSCopying, NSMutableCopying, NSCoding> 39*f4a2713aSLionel Sambuc- (NSUInteger)length; 40*f4a2713aSLionel Sambuc- (const char *)UTF8String; 41*f4a2713aSLionel Sambuc- (id)initWithFormat:(NSString *)format arguments:(va_list)argList __attribute__((format(__NSString__, 1, 0))); 42*f4a2713aSLionel Sambuc@end 43*f4a2713aSLionel Sambuc@class NSString, NSData; 44*f4a2713aSLionel Sambuctypedef struct cssm_sample {} CSSM_SAMPLEGROUP, *CSSM_SAMPLEGROUP_PTR; 45*f4a2713aSLionel Sambuctypedef struct __aslclient *aslclient; 46*f4a2713aSLionel Sambuctypedef struct __aslmsg *aslmsg; 47*f4a2713aSLionel Sambucaslclient asl_open(const char *ident, const char *facility, uint32_t opts); 48*f4a2713aSLionel Sambucint asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5))); 49*f4a2713aSLionel Sambuc 50*f4a2713aSLionel Sambuc//===----------------------------------------------------------------------===// 51*f4a2713aSLionel Sambuc// Begin actual test cases. 52*f4a2713aSLionel Sambuc//===----------------------------------------------------------------------===// 53*f4a2713aSLionel Sambuc 54*f4a2713aSLionel Sambuc// test1 - This test case exposed logic that caused the analyzer to crash because of a memory bug 55*f4a2713aSLionel Sambuc// in BlockDataRegion. It represents real code that contains two block literals. Eventually 56*f4a2713aSLionel Sambuc// via IPA 'logQueue' and 'client' should be updated after the call to 'dispatch_once'. 57*f4a2713aSLionel Sambucvoid test1(NSString *format, ...) { 58*f4a2713aSLionel Sambuc static dispatch_queue_t logQueue; 59*f4a2713aSLionel Sambuc static aslclient client; 60*f4a2713aSLionel Sambuc static dispatch_once_t pred; 61*f4a2713aSLionel Sambuc do { 62*f4a2713aSLionel Sambuc if (__builtin_expect(*(&pred), ~0l) != ~0l) 63*f4a2713aSLionel Sambuc dispatch_once(&pred, ^{ 64*f4a2713aSLionel Sambuc logQueue = dispatch_queue_create("com.mycompany.myproduct.asl", 0); 65*f4a2713aSLionel Sambuc client = asl_open(((char*)0), "com.mycompany.myproduct", 0); 66*f4a2713aSLionel Sambuc }); 67*f4a2713aSLionel Sambuc } while (0); 68*f4a2713aSLionel Sambuc 69*f4a2713aSLionel Sambuc va_list args; 70*f4a2713aSLionel Sambuc __builtin_va_start(args, format); 71*f4a2713aSLionel Sambuc 72*f4a2713aSLionel Sambuc NSString *str = [[NSString alloc] initWithFormat:format arguments:args]; 73*f4a2713aSLionel Sambuc dispatch_async(logQueue, ^{ asl_log(client, ((aslmsg)0), 4, "%s", [str UTF8String]); }); 74*f4a2713aSLionel Sambuc [str release]; 75*f4a2713aSLionel Sambuc 76*f4a2713aSLionel Sambuc __builtin_va_end(args); 77*f4a2713aSLionel Sambuc} 78*f4a2713aSLionel Sambuc 79*f4a2713aSLionel Sambuc// test2 - Test that captured variables that are uninitialized are flagged 80*f4a2713aSLionel Sambuc// as such. 81*f4a2713aSLionel Sambucvoid test2() { 82*f4a2713aSLionel Sambuc static int y = 0; 83*f4a2713aSLionel Sambuc int x; 84*f4a2713aSLionel Sambuc ^{ y = x + 1; }(); // expected-warning{{Variable 'x' is uninitialized when captured by block}} 85*f4a2713aSLionel Sambuc} 86*f4a2713aSLionel Sambuc 87*f4a2713aSLionel Sambucvoid test2_b() { 88*f4a2713aSLionel Sambuc static int y = 0; 89*f4a2713aSLionel Sambuc __block int x; 90*f4a2713aSLionel Sambuc ^{ y = x + 1; }(); // expected-warning {{left operand of '+' is a garbage value}} 91*f4a2713aSLionel Sambuc} 92*f4a2713aSLionel Sambuc 93*f4a2713aSLionel Sambucvoid test2_c() { 94*f4a2713aSLionel Sambuc typedef void (^myblock)(void); 95*f4a2713aSLionel Sambuc myblock f = ^() { f(); }; // expected-warning{{Variable 'f' is uninitialized when captured by block}} 96*f4a2713aSLionel Sambuc} 97*f4a2713aSLionel Sambuc 98*f4a2713aSLionel Sambuc 99*f4a2713aSLionel Sambucvoid testMessaging() { 100*f4a2713aSLionel Sambuc // <rdar://problem/12119814> 101*f4a2713aSLionel Sambuc [[^(){} copy] release]; 102*f4a2713aSLionel Sambuc} 103*f4a2713aSLionel Sambuc 104*f4a2713aSLionel Sambuc 105*f4a2713aSLionel Sambuc@interface rdar12415065 : NSObject 106*f4a2713aSLionel Sambuc@end 107*f4a2713aSLionel Sambuc 108*f4a2713aSLionel Sambuc@implementation rdar12415065 109*f4a2713aSLionel Sambuc- (void)test { 110*f4a2713aSLionel Sambuc // At one point this crashed because we created a path note at a 111*f4a2713aSLionel Sambuc // PreStmtPurgeDeadSymbols point but only knew how to deal with PostStmt 112*f4a2713aSLionel Sambuc // points. <rdar://problem/12687586> 113*f4a2713aSLionel Sambuc 114*f4a2713aSLionel Sambuc extern dispatch_queue_t queue; 115*f4a2713aSLionel Sambuc 116*f4a2713aSLionel Sambuc if (!queue) 117*f4a2713aSLionel Sambuc return; 118*f4a2713aSLionel Sambuc 119*f4a2713aSLionel Sambuc // This previously was a false positive with 'x' being flagged as being 120*f4a2713aSLionel Sambuc // uninitialized when captured by the exterior block (when it is only 121*f4a2713aSLionel Sambuc // captured by the interior block). 122*f4a2713aSLionel Sambuc dispatch_async(queue, ^{ 123*f4a2713aSLionel Sambuc double x = 0.0; 124*f4a2713aSLionel Sambuc if (24.0f < x) { 125*f4a2713aSLionel Sambuc dispatch_async(queue, ^{ (void)x; }); 126*f4a2713aSLionel Sambuc [self test]; 127*f4a2713aSLionel Sambuc } 128*f4a2713aSLionel Sambuc }); 129*f4a2713aSLionel Sambuc} 130*f4a2713aSLionel Sambuc@end 131*f4a2713aSLionel Sambuc 132*f4a2713aSLionel Sambucvoid testReturnVariousSignatures() { 133*f4a2713aSLionel Sambuc (void)^int(){ 134*f4a2713aSLionel Sambuc return 42; 135*f4a2713aSLionel Sambuc }(); 136*f4a2713aSLionel Sambuc 137*f4a2713aSLionel Sambuc (void)^int{ 138*f4a2713aSLionel Sambuc return 42; 139*f4a2713aSLionel Sambuc }(); 140*f4a2713aSLionel Sambuc 141*f4a2713aSLionel Sambuc (void)^(){ 142*f4a2713aSLionel Sambuc return 42; 143*f4a2713aSLionel Sambuc }(); 144*f4a2713aSLionel Sambuc 145*f4a2713aSLionel Sambuc (void)^{ 146*f4a2713aSLionel Sambuc return 42; 147*f4a2713aSLionel Sambuc }(); 148*f4a2713aSLionel Sambuc} 149*f4a2713aSLionel Sambuc 150*f4a2713aSLionel Sambuc// This test used to cause infinite loop in the region invalidation. 151*f4a2713aSLionel Sambucvoid blockCapturesItselfInTheLoop(int x, int m) { 152*f4a2713aSLionel Sambuc void (^assignData)(int) = ^(int x){ 153*f4a2713aSLionel Sambuc x++; 154*f4a2713aSLionel Sambuc }; 155*f4a2713aSLionel Sambuc while (m < 0) { 156*f4a2713aSLionel Sambuc void (^loop)(int); 157*f4a2713aSLionel Sambuc loop = ^(int x) { 158*f4a2713aSLionel Sambuc assignData(x); 159*f4a2713aSLionel Sambuc }; 160*f4a2713aSLionel Sambuc assignData = loop; 161*f4a2713aSLionel Sambuc m++; 162*f4a2713aSLionel Sambuc } 163*f4a2713aSLionel Sambuc assignData(x); 164*f4a2713aSLionel Sambuc} 165