blob: d3046d69ca839c27a089e3bca667ecaacefd5266 [file] [log] [blame]
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection\
// RUN: -analyzer-checker cplusplus.Move,alpha.cplusplus.SmartPtr\
// RUN: -analyzer-config cplusplus.SmartPtrModeling:ModelSmartPtrDereference=true\
// RUN: -std=c++11 -verify %s
// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection\
// RUN: -analyzer-checker cplusplus.Move,alpha.cplusplus.SmartPtr\
// RUN: -analyzer-config cplusplus.SmartPtrModeling:ModelSmartPtrDereference=true\
// RUN: -std=c++20 -verify %s
#include "Inputs/system-header-simulator-cxx.h"
void clang_analyzer_warnIfReached();
void clang_analyzer_numTimesReached();
void clang_analyzer_eval(bool);
void clang_analyzer_warnOnDeadSymbol(int *);
void derefAfterMove(std::unique_ptr<int> P) {
std::unique_ptr<int> Q = std::move(P);
if (Q)
clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
*Q.get() = 1; // expected-warning {{Dereference of null pointer [core.NullDereference]}}
if (P)
clang_analyzer_warnIfReached(); // no-warning
// TODO: Report a null dereference (instead).
*P.get() = 1; // expected-warning {{Method called on moved-from object 'P' [cplusplus.Move]}}
// expected-warning@-1 {{Dereference of null pointer [core.NullDereference]}}
}
// Don't crash when attempting to model a call with unknown callee.
namespace testUnknownCallee {
struct S {
void foo();
};
void bar(S *s, void (S::*func)(void)) {
(s->*func)(); // no-crash
}
} // namespace testUnknownCallee
class A {
public:
A(){};
void foo();
};
A *return_null() {
return nullptr;
}
void derefAfterValidCtr() {
std::unique_ptr<A> P(new A());
clang_analyzer_numTimesReached(); // expected-warning {{1}}
P->foo(); // No warning.
}
void derefOfUnknown(std::unique_ptr<A> P) {
P->foo(); // No warning.
}
void derefAfterDefaultCtr() {
std::unique_ptr<A> P;
clang_analyzer_numTimesReached(); // expected-warning {{1}}
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterCtrWithNull() {
std::unique_ptr<A> P(nullptr);
clang_analyzer_numTimesReached(); // expected-warning {{1}}
*P; // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterCtrWithNullVariable() {
A *InnerPtr = nullptr;
std::unique_ptr<A> P(InnerPtr);
clang_analyzer_numTimesReached(); // expected-warning {{1}}
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterRelease() {
std::unique_ptr<A> P(new A());
P.release();
clang_analyzer_numTimesReached(); // expected-warning {{1}}
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterReset() {
std::unique_ptr<A> P(new A());
P.reset();
clang_analyzer_numTimesReached(); // expected-warning {{1}}
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterResetWithNull() {
std::unique_ptr<A> P(new A());
P.reset(nullptr);
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterResetWithNonNull() {
std::unique_ptr<A> P;
P.reset(new A());
clang_analyzer_numTimesReached(); // expected-warning {{1}}
P->foo(); // No warning.
}
void derefAfterReleaseAndResetWithNonNull() {
std::unique_ptr<A> P(new A());
P.release();
P.reset(new A());
P->foo(); // No warning.
}
void derefOnReleasedNullRawPtr() {
std::unique_ptr<A> P;
A *AP = P.release();
AP->foo(); // expected-warning {{Called C++ object pointer is null [core.CallAndMessage]}}
}
void derefOnReleasedValidRawPtr() {
std::unique_ptr<A> P(new A());
A *AP = P.release();
AP->foo(); // No warning.
}
void pass_smart_ptr_by_ref(std::unique_ptr<A> &a);
void pass_smart_ptr_by_const_ref(const std::unique_ptr<A> &a);
void pass_smart_ptr_by_rvalue_ref(std::unique_ptr<A> &&a);
void pass_smart_ptr_by_const_rvalue_ref(const std::unique_ptr<A> &&a);
void pass_smart_ptr_by_ptr(std::unique_ptr<A> *a);
void pass_smart_ptr_by_const_ptr(const std::unique_ptr<A> *a);
void regioninvalidationWithPassByRef() {
std::unique_ptr<A> P;
pass_smart_ptr_by_ref(P);
P->foo(); // no-warning
}
void regioninvalidationWithPassByCostRef() {
std::unique_ptr<A> P;
pass_smart_ptr_by_const_ref(P);
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void regioninvalidationWithPassByRValueRef() {
std::unique_ptr<A> P;
pass_smart_ptr_by_rvalue_ref(std::move(P));
P->foo(); // no-warning
}
void regioninvalidationWithPassByConstRValueRef() {
std::unique_ptr<A> P;
pass_smart_ptr_by_const_rvalue_ref(std::move(P));
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void regioninvalidationWithPassByPtr() {
std::unique_ptr<A> P;
pass_smart_ptr_by_ptr(&P);
P->foo();
}
void regioninvalidationWithPassByConstPtr() {
std::unique_ptr<A> P;
pass_smart_ptr_by_const_ptr(&P);
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
struct StructWithSmartPtr {
std::unique_ptr<A> P;
};
void pass_struct_with_smart_ptr_by_ref(StructWithSmartPtr &a);
void pass_struct_with_smart_ptr_by_const_ref(const StructWithSmartPtr &a);
void pass_struct_with_smart_ptr_by_rvalue_ref(StructWithSmartPtr &&a);
void pass_struct_with_smart_ptr_by_const_rvalue_ref(const StructWithSmartPtr &&a);
void pass_struct_with_smart_ptr_by_ptr(StructWithSmartPtr *a);
void pass_struct_with_smart_ptr_by_const_ptr(const StructWithSmartPtr *a);
void regioninvalidationWithinStructPassByRef() {
StructWithSmartPtr S;
pass_struct_with_smart_ptr_by_ref(S);
S.P->foo(); // no-warning
}
void regioninvalidationWithinStructPassByConstRef() {
StructWithSmartPtr S;
pass_struct_with_smart_ptr_by_const_ref(S);
S.P->foo(); // expected-warning {{Dereference of null smart pointer 'S.P' [alpha.cplusplus.SmartPtr]}}
}
void regioninvalidationWithinStructPassByRValueRef() {
StructWithSmartPtr S;
pass_struct_with_smart_ptr_by_rvalue_ref(std::move(S));
S.P->foo(); // no-warning
}
void regioninvalidationWithinStructPassByConstRValueRef() {
StructWithSmartPtr S;
pass_struct_with_smart_ptr_by_const_rvalue_ref(std::move(S));
S.P->foo(); // expected-warning {{Dereference of null smart pointer 'S.P' [alpha.cplusplus.SmartPtr]}}
}
void regioninvalidationWithinStructPassByPtr() {
StructWithSmartPtr S;
pass_struct_with_smart_ptr_by_ptr(&S);
S.P->foo(); // no-warning
}
void regioninvalidationWithinStructPassByConstPtr() {
StructWithSmartPtr S;
pass_struct_with_smart_ptr_by_const_ptr(&S);
S.P->foo(); // expected-warning {{Dereference of null smart pointer 'S.P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterAssignment() {
{
std::unique_ptr<A> P(new A());
std::unique_ptr<A> Q;
Q = std::move(P);
Q->foo(); // no-warning
}
{
std::unique_ptr<A> P;
std::unique_ptr<A> Q;
Q = std::move(P);
Q->foo(); // expected-warning {{Dereference of null smart pointer 'Q' [alpha.cplusplus.SmartPtr]}}
}
}
void derefOnSwappedNullPtr() {
std::unique_ptr<A> P(new A());
std::unique_ptr<A> PNull;
P.swap(PNull);
PNull->foo(); // No warning.
(*P).foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefOnFirstStdSwappedNullPtr() {
std::unique_ptr<A> P;
std::unique_ptr<A> PNull;
std::swap(P, PNull);
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefOnSecondStdSwappedNullPtr() {
std::unique_ptr<A> P;
std::unique_ptr<A> PNull;
std::swap(P, PNull);
PNull->foo(); // expected-warning {{Dereference of null smart pointer 'PNull' [alpha.cplusplus.SmartPtr]}}
}
void derefOnSwappedValidPtr() {
std::unique_ptr<A> P(new A());
std::unique_ptr<A> PValid(new A());
P.swap(PValid);
(*P).foo(); // No warning.
PValid->foo(); // No warning.
std::swap(P, PValid);
P->foo(); // No warning.
PValid->foo(); // No warning.
}
void derefOnRawPtrFromGetOnNullPtr() {
std::unique_ptr<A> P;
P.get()->foo(); // expected-warning {{Called C++ object pointer is null [core.CallAndMessage]}}
}
void derefOnRawPtrFromGetOnValidPtr() {
std::unique_ptr<A> P(new A());
P.get()->foo(); // No warning.
}
void derefOnRawPtrFromGetOnUnknownPtr(std::unique_ptr<A> P) {
P.get()->foo(); // No warning.
}
void derefOnRawPtrFromMultipleGetOnUnknownPtr(std::unique_ptr<A> P) {
A *X = P.get();
A *Y = P.get();
clang_analyzer_eval(X == Y); // expected-warning{{TRUE}}
if (!X) {
Y->foo(); // expected-warning {{Called C++ object pointer is null [core.CallAndMessage]}}
}
}
void derefOnMovedFromValidPtr() {
std::unique_ptr<A> PToMove(new A());
std::unique_ptr<A> P;
P = std::move(PToMove);
PToMove->foo(); // expected-warning {{Dereference of null smart pointer 'PToMove' [alpha.cplusplus.SmartPtr]}}
}
void derefOnMovedToNullPtr() {
std::unique_ptr<A> PToMove(new A());
std::unique_ptr<A> P;
P = std::move(PToMove); // No note.
P->foo(); // No warning.
}
void derefOnNullPtrGotMovedFromValidPtr() {
std::unique_ptr<A> P(new A());
std::unique_ptr<A> PToMove;
P = std::move(PToMove);
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefOnMovedFromUnknownPtr(std::unique_ptr<A> PToMove) {
std::unique_ptr<A> P;
P = std::move(PToMove);
P->foo(); // No warning.
}
void derefOnMovedUnknownPtr(std::unique_ptr<A> PToMove) {
std::unique_ptr<A> P;
P = std::move(PToMove);
PToMove->foo(); // expected-warning {{Dereference of null smart pointer 'PToMove' [alpha.cplusplus.SmartPtr]}}
}
void derefOnAssignedNullPtrToNullSmartPtr() {
std::unique_ptr<A> P;
P = nullptr;
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefOnAssignedZeroToNullSmartPtr() {
std::unique_ptr<A> P(new A());
P = 0;
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefOnAssignedNullToUnknowSmartPtr(std::unique_ptr<A> P) {
P = nullptr;
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
std::unique_ptr<A> &&returnRValRefOfUniquePtr();
void drefOnAssignedNullFromMethodPtrValidSmartPtr() {
std::unique_ptr<A> P(new A());
P = returnRValRefOfUniquePtr();
P->foo(); // No warning.
}
void derefMoveConstructedWithValidPtr() {
std::unique_ptr<A> PToMove(new A());
std::unique_ptr<A> P(std::move(PToMove));
P->foo(); // No warning.
}
void derefMoveConstructedWithNullPtr() {
std::unique_ptr<A> PToMove;
std::unique_ptr<A> P(std::move(PToMove));
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefMoveConstructedWithUnknownPtr(std::unique_ptr<A> PToMove) {
std::unique_ptr<A> P(std::move(PToMove));
P->foo(); // No warning.
}
void derefValidPtrMovedToConstruct() {
std::unique_ptr<A> PToMove(new A());
std::unique_ptr<A> P(std::move(PToMove));
PToMove->foo(); // expected-warning {{Dereference of null smart pointer 'PToMove' [alpha.cplusplus.SmartPtr]}}
}
void derefNullPtrMovedToConstruct() {
std::unique_ptr<A> PToMove;
std::unique_ptr<A> P(std::move(PToMove));
PToMove->foo(); // expected-warning {{Dereference of null smart pointer 'PToMove' [alpha.cplusplus.SmartPtr]}}
}
void derefUnknownPtrMovedToConstruct(std::unique_ptr<A> PToMove) {
std::unique_ptr<A> P(std::move(PToMove));
PToMove->foo(); // expected-warning {{Dereference of null smart pointer 'PToMove' [alpha.cplusplus.SmartPtr]}}
}
std::unique_ptr<A> &&functionReturnsRValueRef();
void derefMoveConstructedWithRValueRefReturn() {
std::unique_ptr<A> P(functionReturnsRValueRef());
P->foo(); // No warning.
}
void derefConditionOnNullPtr() {
std::unique_ptr<A> P;
if (P)
P->foo(); // No warning.
else
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefConditionOnNotNullPtr() {
std::unique_ptr<A> P;
if (!P)
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefConditionOnValidPtr() {
std::unique_ptr<A> P(new A());
std::unique_ptr<A> PNull;
if (P)
PNull->foo(); // expected-warning {{Dereference of null smart pointer 'PNull' [alpha.cplusplus.SmartPtr]}}
}
void derefConditionOnNotValidPtr() {
std::unique_ptr<A> P(new A());
std::unique_ptr<A> PNull;
if (!P)
PNull->foo(); // No warning.
}
void derefConditionOnUnKnownPtr(std::unique_ptr<A> P) {
if (P)
P->foo(); // No warning.
else
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefOnValidPtrAfterReset(std::unique_ptr<A> P) {
P.reset(new A());
if (!P)
P->foo(); // No warning.
else
P->foo(); // No warning.
}
void innerPointerSymbolLiveness() {
std::unique_ptr<int> P(new int());
clang_analyzer_warnOnDeadSymbol(P.get());
int *RP = P.release();
} // expected-warning{{SYMBOL DEAD}}
void boolOpCreatedConjuredSymbolLiveness(std::unique_ptr<int> P) {
if (P) {
int *X = P.get();
clang_analyzer_warnOnDeadSymbol(X);
}
} // expected-warning{{SYMBOL DEAD}}
void getCreatedConjuredSymbolLiveness(std::unique_ptr<int> P) {
int *X = P.get();
clang_analyzer_warnOnDeadSymbol(X);
int Y;
if (!P) {
Y = *P.get(); // expected-warning {{Dereference of null pointer [core.NullDereference]}}
// expected-warning@-1 {{SYMBOL DEAD}}
}
}
int derefConditionOnUnKnownPtr(int *q) {
std::unique_ptr<int> P(q);
if (P)
return *P; // No warning.
else
return *P; // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
void derefAfterBranchingOnUnknownInnerPtr(std::unique_ptr<A> P) {
A *RP = P.get();
if (!RP) {
P->foo(); // expected-warning {{Dereference of null smart pointer 'P' [alpha.cplusplus.SmartPtr]}}
}
}
// The following is a silly function,
// but serves to test if we are picking out
// standard comparision functions from custom ones.
template <typename T>
bool operator<(std::unique_ptr<T> &x, double d);
void uniquePtrComparision(std::unique_ptr<int> unknownPtr) {
auto ptr = std::unique_ptr<int>(new int(13));
auto nullPtr = std::unique_ptr<int>();
auto otherPtr = std::unique_ptr<int>(new int(29));
clang_analyzer_eval(ptr == ptr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr > ptr); // expected-warning{{FALSE}}
clang_analyzer_eval(ptr <= ptr); // expected-warning{{TRUE}}
clang_analyzer_eval(nullPtr <= unknownPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(unknownPtr >= nullPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr != otherPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr > nullPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr != nullptr); // expected-warning{{TRUE}}
clang_analyzer_eval(nullPtr != nullptr); // expected-warning{{FALSE}}
clang_analyzer_eval(nullptr <= unknownPtr); // expected-warning{{TRUE}}
}
void uniquePtrComparisionStateSplitting(std::unique_ptr<int> unknownPtr) {
auto ptr = std::unique_ptr<int>(new int(13));
clang_analyzer_eval(ptr > unknownPtr); // expected-warning{{TRUE}}
// expected-warning@-1{{FALSE}}
}
void uniquePtrComparisionDifferingTypes(std::unique_ptr<int> unknownPtr) {
auto ptr = std::unique_ptr<int>(new int(13));
auto nullPtr = std::unique_ptr<A>();
auto otherPtr = std::unique_ptr<double>(new double(3.14));
clang_analyzer_eval(nullPtr <= unknownPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(unknownPtr >= nullPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr != otherPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr > nullPtr); // expected-warning{{TRUE}}
clang_analyzer_eval(ptr != nullptr); // expected-warning{{TRUE}}
clang_analyzer_eval(nullPtr != nullptr); // expected-warning{{FALSE}}
clang_analyzer_eval(nullptr <= unknownPtr); // expected-warning{{TRUE}}
}
#if __cplusplus >= 202002L
void testOstreamOverload(std::unique_ptr<int> P) {
auto &Cout = std::cout;
auto &PtrCout = std::cout << P;
auto &StringCout = std::cout << "hello";
// We are testing the fact that in our modelling of
// operator<<(basic_ostream<T1> &, const unique_ptr<T2> &)
// we set the return SVal to the SVal of the ostream arg.
clang_analyzer_eval(&Cout == &PtrCout); // expected-warning {{TRUE}}
// FIXME: Technically, they should be equal,
// that hasn't been modelled yet.
clang_analyzer_eval(&Cout == &StringCout); // expected-warning {{UNKNOWN}}
}
int glob;
void testOstreamDoesntInvalidateGlobals(std::unique_ptr<int> P) {
int x = glob;
std::cout << P;
int y = glob;
clang_analyzer_eval(x == y); // expected-warning {{TRUE}}
}
#endif
// The following test isn't really a "smart-ptr" test
// It came up during a bug fix (D106296)
void testCheckForFunctionsWithNoDecl(void (*bar)(bool, bool)) {
// This should NOT crash.
bar(true, false);
}