| 12
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
 100
 101
 102
 103
 104
 105
 106
 107
 108
 109
 110
 111
 112
 113
 114
 115
 116
 117
 118
 119
 120
 121
 122
 123
 124
 125
 126
 127
 128
 129
 130
 131
 132
 133
 134
 135
 136
 137
 138
 139
 140
 141
 142
 143
 144
 145
 146
 147
 148
 149
 150
 151
 152
 153
 154
 155
 156
 157
 158
 159
 160
 161
 162
 163
 164
 165
 166
 167
 168
 169
 170
 171
 172
 173
 174
 175
 176
 177
 178
 179
 180
 181
 182
 183
 184
 185
 186
 187
 188
 189
 190
 191
 192
 193
 194
 195
 196
 197
 198
 199
 200
 201
 202
 203
 
 | // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -disable-free -analyzer-eagerly-assume -analyzer-checker=core,deadcode,debug.ExprInspection -verify %s
void clang_analyzer_eval(int);
int size_rdar9373039 = 1;
int foo_rdar9373039(const char *);
int rdar93730392() {
  int x;
  int j = 0;
  for (int i = 0 ; i < size_rdar9373039 ; ++i)
    x = 1;
    
  int extra = (2 + foo_rdar9373039 ("Clang") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("Clang")) % 4)) % 4)) + (2 + foo_rdar9373039 ("1.0") + ((4 - ((unsigned int) (2 + foo_rdar9373039 ("1.0")) % 4)) % 4)); // expected-warning {{never read}}
  for (int i = 0 ; i < size_rdar9373039 ; ++i)
    j += x; // expected-warning {{garbage}}
  return j;
}
int PR8962 (int *t) {
  // This should look through the __extension__ no-op.
  if (__extension__ (t)) return 0;
  return *t; // expected-warning {{null pointer}}
}
int PR8962_b (int *t) {
  // This should still ignore the nested casts
  // which aren't handled by a single IgnoreParens()
  if (((int)((int)t))) return 0;
  return *t; // expected-warning {{null pointer}}
}
int PR8962_c (int *t) {
  // If the last element in a StmtExpr was a ParenExpr, it's still live
  if (({ (t ? (_Bool)0 : (_Bool)1); })) return 0;
  return *t; // no-warning
}
int PR8962_d (int *t) {
  // If the last element in a StmtExpr is an __extension__, it's still live
  if (({ __extension__(t ? (_Bool)0 : (_Bool)1); })) return 0;
  return *t; // no-warning
}
int PR8962_e (int *t) {
  // Redundant casts can mess things up!
  // Environment used to skip through NoOp casts, but LiveVariables didn't!
  if (({ (t ? (int)(int)0L : (int)(int)1L); })) return 0;
  return *t; // no-warning
}
int PR8962_f (int *t) {
  // The StmtExpr isn't a block-level expression here,
  // the __extension__ is. But the value should be attached to the StmtExpr
  // anyway. Make sure the block-level check is /before/ IgnoreParens.
  if ( __extension__({
    _Bool r;
    if (t) r = 0;
    else r = 1;
    r;
  }) ) return 0;
  return *t; // no-warning
}
// This previously crashed logic in the analyzer engine when evaluating locations.
void rdar10308201_aux(unsigned val);
void rdar10308201 (int valA, void *valB, unsigned valC) {
  unsigned actual_base, lines;
  if (valC == 0) {
    actual_base = (unsigned)valB;
    for (;;) {
      if (valA & (1<<0))
        rdar10308201_aux(actual_base);
    }
  }
}
typedef struct Struct103 {
  unsigned i;
} Struct103;
typedef unsigned int size_t;
void __my_memset_chk(char*, int, size_t);
static int radar10367606(int t) {
  Struct103 overall;
  ((__builtin_object_size ((char *) &overall, 0) != (size_t) -1) ? __builtin___memset_chk ((char *) &overall, 0, sizeof(Struct103), __builtin_object_size ((char *) &overall, 0)) : __my_memset_chk ((char *) &overall, 0, sizeof(Struct103)));
  return 0;
}
/* Caching out on a sink node. */
extern int fooR10376675();
extern int* bazR10376675();
extern int nR10376675;
void barR10376675(int *x) {
  int *pm;
  if (nR10376675 * 2) {
    int *pk  = bazR10376675();
    pm = pk; //expected-warning {{never read}}
  }
  do {
    *x = fooR10376675();
  } while (0);
}
// Test accesses to wide character strings doesn't break the analyzer.
typedef int wchar_t;
struct rdar10385775 {
    wchar_t *name;
};
void RDar10385775(struct rdar10385775* p) {
    p->name = L"a";
}
// Test double loop of array and array literals.  Previously this
// resulted in a false positive uninitailized value warning.
void rdar10686586() {
    int array1[] = { 1, 2, 3, 0 };
    int array2[] = { 1, 2, 3, 0 };
    int *array[] = { array1, array2 };
    int sum = 0;
    for (int i = 0; i < 2; i++) {
        for (int j = 0; j < 4; j++) {
            sum += array[i][j]; // no-warning
        }
    }
}
// This example tests CFG handling of '||' nested in a ternary expression,
// and seeing that the analyzer doesn't crash.
int isctype(char c, unsigned long f)
{
  return (c < 1 || c > 10) ? 0 : !!(c & f);
}
// Test that symbolic array offsets are modeled conservatively.
// This was triggering a false "use of uninitialized value" warning.
void rdar_12075238__aux(unsigned long y);
int rdar_12075238_(unsigned long count) {
  if ((count < 3) || (count > 6))
    return 0;
	
  unsigned long array[6];
  unsigned long i = 0;
  for (; i <= count - 2; i++)
  {
	  array[i] = i;
  }
  array[count - 1] = i;
  rdar_12075238__aux(array[2]); // no-warning
  return 0;
}
// Test that we handle an uninitialized value within a logical expression.
void PR14635(int *p) {
  int a = 0, b;
  *p = a || b; // expected-warning {{Assigned value is garbage or undefined}}
}
// Test handling floating point values with unary '!'.
int PR14634(int x) {
  double y = (double)x;
  return !y;
}
// PR15684: If a checker generates a sink node after generating a regular node
// and no state changes between the two, graph trimming would consider the two
// the same node, forming a loop.
struct PR15684 {
  void (*callback)(int);
};
void sinkAfterRegularNode(struct PR15684 *context) {
  int uninitialized;
  context->callback(uninitialized); // expected-warning {{uninitialized}}
}
// PR16131: C permits variables to be declared extern void.
static void PR16131(int x) {
  extern void v;
  int *ip = (int *)&v;
  char *cp = (char *)&v;
  clang_analyzer_eval(ip == cp); // expected-warning{{TRUE}}
  // expected-warning@-1 {{comparison of distinct pointer types}}
  *ip = 42;
  clang_analyzer_eval(*ip == 42); // expected-warning{{TRUE}}
  clang_analyzer_eval(*(int *)&v == 42); // expected-warning{{TRUE}}
}
// PR15623: Currently the analyzer doesn't handle symbolic expressions of the
// form "(exp comparison_op expr) != 0" very well. We perform a simplification
// translating an assume of a constraint of the form "(exp comparison_op expr)
// != 0" to true into an assume of "exp comparison_op expr" to true.
void PR15623(int n) {
  if ((n == 0) != 0) {
    clang_analyzer_eval(n == 0); // expected-warning{{TRUE}}
  }
}
 |