1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
#include "analyzer-decls.h"
void test_1 (void)
{
__analyzer_dump_path (); /* { dg-message "path" } */
}
void test_2 (int flag)
{
if (flag)
__analyzer_dump_path (); /* { dg-message "path" } */
}
void test_3 (int flag)
{
if (flag)
if (!flag)
__analyzer_dump_path (); /* { dg-bogus "path" } */
}
int global_for_test_4;
static void __attribute__((noinline)) called_by_test_4 () {}
void test_4 (void)
{
/* Verify that a state change that happens in a stmt that
isn't the first within its BB can affect path feasibility. */
global_for_test_4 = 0;
global_for_test_4 = 1;
/* Thwart the optimizer. */
called_by_test_4 ();
if (global_for_test_4)
__analyzer_dump_path (); /* { dg-message "path" } */
}
/* Verify that loops don't confuse the feasibility checker. */
void test_5 (void)
{
for (int i = 0; i < 1024; i++)
{
}
__analyzer_dump_path (); /* { dg-message "path" } */
}
/* Reproducer for an issue seen with CVE-2005-1689 (PR analyzer/96374): if we
take the shortest path and update state and check feasibility per-edge, we
can erroneously reject valid diagnostics. */
int test_6 (int a, int b)
{
int problem = 0;
if (a)
problem = 1;
if (b)
{
if (!problem)
problem = 2;
__analyzer_dump_path (); /* { dg-message "path" } */
}
return problem;
}
/* As above, but call a static function.
Even if the path to the call of called_by_test_6a is falsely rejected
as infeasible, it still makes sense to complain about errors within
the called function. */
static void __attribute__((noinline))
called_by_test_6a (void *ptr)
{
__builtin_free (ptr);
__builtin_free (ptr); /* { dg-message "double-'free'" } */
}
int test_6a (int a, int b, void *ptr)
{
int problem = 0;
if (a)
problem = 1;
if (b)
{
if (!problem)
problem = 2;
called_by_test_6a (ptr);
}
return problem;
}
/* After state-merging, the shortest path skips the loop,
but the shortest feasible path enters it. */
void test_7 (int n)
{
int entered_loop = 0;
int i;
for (i = 0; i < n; i++)
entered_loop = 1;
if (entered_loop)
__analyzer_dump_path (); /* { dg-message "path" } */
}
|
