1*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-store=region -verify %s 2*f4a2713aSLionel Sambuc 3*f4a2713aSLionel Sambuc typedef __INTPTR_TYPE__ intptr_t; 4*f4a2713aSLionel Sambuc 5*f4a2713aSLionel Sambuc const int& g() { 6*f4a2713aSLionel Sambuc int s; 7*f4a2713aSLionel Sambuc return s; // expected-warning{{Address of stack memory associated with local variable 's' returned}} expected-warning{{reference to stack memory associated with local variable 's' returned}} 8*f4a2713aSLionel Sambuc } 9*f4a2713aSLionel Sambuc 10*f4a2713aSLionel Sambuc const int& g2() { 11*f4a2713aSLionel Sambuc int s1; 12*f4a2713aSLionel Sambuc int &s2 = s1; // expected-note {{binding reference variable 's2' here}} 13*f4a2713aSLionel Sambuc return s2; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}} 14*f4a2713aSLionel Sambuc } 15*f4a2713aSLionel Sambuc 16*f4a2713aSLionel Sambuc const int& g3() { 17*f4a2713aSLionel Sambuc int s1; 18*f4a2713aSLionel Sambuc int &s2 = s1; // expected-note {{binding reference variable 's2' here}} 19*f4a2713aSLionel Sambuc int &s3 = s2; // expected-note {{binding reference variable 's3' here}} 20*f4a2713aSLionel Sambuc return s3; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{reference to stack memory associated with local variable 's1' returned}} 21*f4a2713aSLionel Sambuc } 22*f4a2713aSLionel Sambuc 23*f4a2713aSLionel Sambuc void g4() { 24*f4a2713aSLionel Sambuc static const int &x = 3; // no warning 25*f4a2713aSLionel Sambuc } 26*f4a2713aSLionel Sambuc 27*f4a2713aSLionel Sambuc int get_value(); 28*f4a2713aSLionel Sambuc 29*f4a2713aSLionel Sambuc const int &get_reference1() { return get_value(); } // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}} 30*f4a2713aSLionel Sambuc 31*f4a2713aSLionel Sambuc const int &get_reference2() { 32*f4a2713aSLionel Sambuc const int &x = get_value(); // expected-note {{binding reference variable 'x' here}} 33*f4a2713aSLionel Sambuc return x; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}} 34*f4a2713aSLionel Sambuc } 35*f4a2713aSLionel Sambuc 36*f4a2713aSLionel Sambuc const int &get_reference3() { 37*f4a2713aSLionel Sambuc const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}} 38*f4a2713aSLionel Sambuc const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}} 39*f4a2713aSLionel Sambuc return x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}} 40*f4a2713aSLionel Sambuc } 41*f4a2713aSLionel Sambuc 42*f4a2713aSLionel Sambuc int global_var; 43*f4a2713aSLionel Sambuc int *f1() { 44*f4a2713aSLionel Sambuc int &y = global_var; 45*f4a2713aSLionel Sambuc return &y; 46*f4a2713aSLionel Sambuc } 47*f4a2713aSLionel Sambuc 48*f4a2713aSLionel Sambuc int *f2() { 49*f4a2713aSLionel Sambuc int x1; 50*f4a2713aSLionel Sambuc int &x2 = x1; // expected-note {{binding reference variable 'x2' here}} 51*f4a2713aSLionel Sambuc return &x2; // expected-warning{{Address of stack memory associated with local variable 'x1' returned}} expected-warning {{address of stack memory associated with local variable 'x1' returned}} 52*f4a2713aSLionel Sambuc } 53*f4a2713aSLionel Sambuc 54*f4a2713aSLionel Sambuc int *f3() { 55*f4a2713aSLionel Sambuc int x1; 56*f4a2713aSLionel Sambuc int *const &x2 = &x1; // expected-note {{binding reference variable 'x2' here}} 57*f4a2713aSLionel Sambuc return x2; // expected-warning {{address of stack memory associated with local variable 'x1' returned}} expected-warning {{Address of stack memory associated with local variable 'x1' returned to caller}} 58*f4a2713aSLionel Sambuc } 59*f4a2713aSLionel Sambuc 60*f4a2713aSLionel Sambuc const int *f4() { 61*f4a2713aSLionel Sambuc const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}} 62*f4a2713aSLionel Sambuc const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}} 63*f4a2713aSLionel Sambuc return &x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning address of local temporary}} 64*f4a2713aSLionel Sambuc } 65*f4a2713aSLionel Sambuc 66*f4a2713aSLionel Sambuc struct S { 67*f4a2713aSLionel Sambuc int x; 68*f4a2713aSLionel Sambuc }; 69*f4a2713aSLionel Sambuc 70*f4a2713aSLionel Sambuc int *mf() { 71*f4a2713aSLionel Sambuc S s1; 72*f4a2713aSLionel Sambuc S &s2 = s1; // expected-note {{binding reference variable 's2' here}} 73*f4a2713aSLionel Sambuc int &x = s2.x; // expected-note {{binding reference variable 'x' here}} 74*f4a2713aSLionel Sambuc return &x; // expected-warning{{Address of stack memory associated with local variable 's1' returned}} expected-warning {{address of stack memory associated with local variable 's1' returned}} 75*f4a2713aSLionel Sambuc } 76*f4a2713aSLionel Sambuc 77*f4a2713aSLionel Sambuc void *lf() { 78*f4a2713aSLionel Sambuc label: 79*f4a2713aSLionel Sambuc void *const &x = &&label; // expected-note {{binding reference variable 'x' here}} 80*f4a2713aSLionel Sambuc return x; // expected-warning {{returning address of label, which is local}} 81*f4a2713aSLionel Sambuc } 82*f4a2713aSLionel Sambuc 83*f4a2713aSLionel Sambuc template <typename T> 84*f4a2713aSLionel Sambuc struct TS { 85*f4a2713aSLionel Sambuc int *get(); 86*f4a2713aSLionel Sambuc int *m() { 87*f4a2713aSLionel Sambuc int *&x = get(); 88*f4a2713aSLionel Sambuc return x; 89*f4a2713aSLionel Sambuc } 90*f4a2713aSLionel Sambuc }; 91*f4a2713aSLionel Sambuc 92*f4a2713aSLionel Sambuc // rdar://11345441 93*f4a2713aSLionel Sambuc int* f5() { 94*f4a2713aSLionel Sambuc int& i = i; // expected-warning {{Assigned value is garbage or undefined}} expected-note {{binding reference variable 'i' here}} expected-warning{{reference 'i' is not yet bound to a value when used within its own initialization}} 95*f4a2713aSLionel Sambuc return &i; // expected-warning {{address of stack memory associated with local variable 'i' returned}} 96*f4a2713aSLionel Sambuc } 97*f4a2713aSLionel Sambuc 98*f4a2713aSLionel Sambuc void *radar13226577() { 99*f4a2713aSLionel Sambuc void *p = &p; 100*f4a2713aSLionel Sambuc return p; // expected-warning {{stack memory associated with local variable 'p' returned to caller}} 101*f4a2713aSLionel Sambuc } 102*f4a2713aSLionel Sambuc 103*f4a2713aSLionel Sambuc namespace rdar13296133 { 104*f4a2713aSLionel Sambuc class ConvertsToBool { 105*f4a2713aSLionel Sambuc public: 106*f4a2713aSLionel Sambuc operator bool() const { return this; } 107*f4a2713aSLionel Sambuc }; 108*f4a2713aSLionel Sambuc 109*f4a2713aSLionel Sambuc class ConvertsToIntptr { 110*f4a2713aSLionel Sambuc public: 111*f4a2713aSLionel Sambuc operator intptr_t() const { return reinterpret_cast<intptr_t>(this); } 112*f4a2713aSLionel Sambuc }; 113*f4a2713aSLionel Sambuc 114*f4a2713aSLionel Sambuc class ConvertsToPointer { 115*f4a2713aSLionel Sambuc public: 116*f4a2713aSLionel Sambuc operator const void *() const { return this; } 117*f4a2713aSLionel Sambuc }; 118*f4a2713aSLionel Sambuc 119*f4a2713aSLionel Sambuc intptr_t returnAsNonLoc() { 120*f4a2713aSLionel Sambuc ConvertsToIntptr obj; 121*f4a2713aSLionel Sambuc return obj; // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}} 122*f4a2713aSLionel Sambuc } 123*f4a2713aSLionel Sambuc 124*f4a2713aSLionel Sambuc bool returnAsBool() { 125*f4a2713aSLionel Sambuc ConvertsToBool obj; 126*f4a2713aSLionel Sambuc return obj; // no-warning 127*f4a2713aSLionel Sambuc } 128*f4a2713aSLionel Sambuc 129*f4a2713aSLionel Sambuc intptr_t returnAsNonLocViaPointer() { 130*f4a2713aSLionel Sambuc ConvertsToPointer obj; 131*f4a2713aSLionel Sambuc return reinterpret_cast<intptr_t>(static_cast<const void *>(obj)); // expected-warning{{Address of stack memory associated with local variable 'obj' returned to caller}} 132*f4a2713aSLionel Sambuc } 133*f4a2713aSLionel Sambuc 134*f4a2713aSLionel Sambuc bool returnAsBoolViaPointer() { 135*f4a2713aSLionel Sambuc ConvertsToPointer obj; 136*f4a2713aSLionel Sambuc return obj; // no-warning 137*f4a2713aSLionel Sambuc } 138*f4a2713aSLionel Sambuc } 139*f4a2713aSLionel Sambuc 140