Pointer comparisons (and pointer-pointer subtraction). Basically filling in SimpleSValuator::EvalBinOpLL().

llvm-svn: 106992

1 files changed, 221 insertions, 0 deletions

diff --git a/clang/test/Analysis/ptr-arith.c b/clang/test/Analysis/ptr-arith.c
index f6bd61c074a..071c8699a3a 100644
--- a/clang/test/Analysis/ptr-arith.c
+++ b/clang/test/Analysis/ptr-arith.c
@@ -1,6 +1,9 @@
 // RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -verify -triple x86_64-apple-darwin9 %s
 // RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -verify -triple i686-apple-darwin9 %s
 
+// Used to trigger warnings for unreachable paths.
+#define WARN do { int a, b; int c = &b-&a; } while (0)
+
 void f1() {
   int a[10];
   int *p = a;
@@ -60,3 +63,221 @@ void f5() {
 void f6(int *p, int *q) {
   int d = q - p; // no-warning
 }
+
+void null_operand(int *a) {
+start:
+  // LHS is a label, RHS is NULL
+  if (&&start == 0)
+    WARN; // no-warning
+  if (&&start <  0)
+    WARN; // no-warning
+  if (&&start <= 0)
+    WARN; // no-warning
+  if (!(&&start != 0))
+    WARN; // no-warning
+  if (!(&&start >  0))
+    WARN; // no-warning
+  if (!(&&start >= 0))
+    WARN; // no-warning
+  if (!(&&start - 0))
+    WARN; // no-warning
+
+  // LHS is a non-symbolic value, RHS is NULL
+  if (&a == 0)
+    WARN; // no-warning
+  if (&a <  0)
+    WARN; // no-warning
+  if (&a <= 0)
+    WARN; // no-warning
+  if (!(&a != 0))
+    WARN; // no-warning
+  if (!(&a >  0))
+    WARN; // no-warning
+  if (!(&a >= 0))
+    WARN; // no-warning
+
+  if (!(&a - 0)) // expected-warning{{Pointer arithmetic done on non-array variables}}
+    WARN; // no-warning
+
+  // LHS is NULL, RHS is non-symbolic
+  // The same code is used for labels and non-symbolic values.
+  if (0 == &a)
+    WARN; // no-warning
+  if (0 >  &a)
+    WARN; // no-warning
+  if (0 >= &a)
+    WARN; // no-warning
+  if (!(0 != &a))
+    WARN; // no-warning
+  if (!(0 <  &a))
+    WARN; // no-warning
+  if (!(0 <= &a))
+    WARN; // no-warning
+
+  // LHS is a symbolic value, RHS is NULL
+  if (a == 0)
+    WARN; // expected-warning{{}}
+  if (a <  0)
+    WARN; // no-warning
+  if (a <= 0)
+    WARN; // expected-warning{{}}
+  if (!(a != 0))
+    WARN; // expected-warning{{}}
+  if (!(a >  0))
+    WARN; // expected-warning{{}}
+  if (!(a >= 0))
+    WARN; // no-warning
+  if (!(a - 0))
+    WARN; // expected-warning{{}}
+
+  // LHS is NULL, RHS is a symbolic value
+  if (0 == a)
+    WARN; // expected-warning{{}}
+  if (0 >  a)
+    WARN; // no-warning
+  if (0 >= a)
+    WARN; // expected-warning{{}}
+  if (!(0 != a))
+    WARN; // expected-warning{{}}
+  if (!(0 <  a))
+    WARN; // expected-warning{{}}
+  if (!(0 <= a))
+    WARN; // no-warning
+}
+
+void const_locs() {
+  char *a = (char*)0x1000;
+  char *b = (char*)0x1100;
+start:
+  if (a==b)
+    WARN; // no-warning
+  if (!(a!=b))
+    WARN; // no-warning
+  if (a>b)
+    WARN; // no-warning
+  if (b<a)
+    WARN; // no-warning
+  if (a>=b)
+    WARN; // no-warning
+  if (b<=a)
+    WARN; // no-warning
+  if (b-a != 0x100)
+    WARN; // no-warning
+
+  if (&&start == a)
+    WARN; // expected-warning{{}}
+  if (a == &&start)
+    WARN; // expected-warning{{}}
+  if (&a == (char**)a)
+    WARN; // expected-warning{{}}
+  if ((char**)a == &a)
+    WARN; // expected-warning{{}}
+}
+
+void array_matching_types() {
+  int array[10];
+  int *a = &array[2];
+  int *b = &array[5];
+
+  if (a==b)
+    WARN; // no-warning
+  if (!(a!=b))
+    WARN; // no-warning
+  if (a>b)
+    WARN; // no-warning
+  if (b<a)
+    WARN; // no-warning
+  if (a>=b)
+    WARN; // no-warning
+  if (b<=a)
+    WARN; // no-warning
+  if ((b-a) == 0)
+    WARN; // no-warning
+}
+
+// This takes a different code path than array_matching_types()
+void array_different_types() {
+  int array[10];
+  int *a = &array[2];
+  char *b = (char*)&array[5];
+
+  if (a==b) // expected-warning{{comparison of distinct pointer types}}
+    WARN; // no-warning
+  if (!(a!=b)) // expected-warning{{comparison of distinct pointer types}}
+    WARN; // no-warning
+  if (a>b) // expected-warning{{comparison of distinct pointer types}}
+    WARN; // no-warning
+  if (b<a) // expected-warning{{comparison of distinct pointer types}}
+    WARN; // no-warning
+  if (a>=b) // expected-warning{{comparison of distinct pointer types}}
+    WARN; // no-warning
+  if (b<=a) // expected-warning{{comparison of distinct pointer types}}
+    WARN; // no-warning
+}
+
+struct test { int x; int y; };
+void struct_fields() {
+  struct test a, b;
+
+  if (&a.x == &a.y)
+    WARN; // no-warning
+  if (!(&a.x != &a.y))
+    WARN; // no-warning
+  if (&a.x > &a.y)
+    WARN; // no-warning
+  if (&a.y < &a.x)
+    WARN; // no-warning
+  if (&a.x >= &a.y)
+    WARN; // no-warning
+  if (&a.y <= &a.x)
+    WARN; // no-warning
+
+  if (&a.x == &b.x)
+    WARN; // no-warning
+  if (!(&a.x != &b.x))
+    WARN; // no-warning
+  if (&a.x > &b.x)
+    WARN; // expected-warning{{}}
+  if (&b.x < &a.x)
+    WARN; // expected-warning{{}}
+  if (&a.x >= &b.x)
+    WARN; // expected-warning{{}}
+  if (&b.x <= &a.x)
+    WARN; // expected-warning{{}}
+}
+
+void mixed_region_types() {
+  struct test s;
+  int array[2];
+  void *a = &array, *b = &s;
+
+  if (&a == &b)
+    WARN; // no-warning
+  if (!(&a != &b))
+    WARN; // no-warning
+  if (&a > &b)
+    WARN; // expected-warning{{}}
+  if (&b < &a)
+    WARN; // expected-warning{{}}
+  if (&a >= &b)
+    WARN; // expected-warning{{}}
+  if (&b <= &a)
+    WARN; // expected-warning{{}}
+}
+
+void symbolic_region(int *p) {
+  int a;
+
+  if (&a == p)
+    WARN; // expected-warning{{}}
+  if (&a != p)
+    WARN; // expected-warning{{}}
+  if (&a > p)
+    WARN; // expected-warning{{}}
+  if (&a < p)
+    WARN; // expected-warning{{}}
+  if (&a >= p)
+    WARN; // expected-warning{{}}
+  if (&a <= p)
+    WARN; // expected-warning{{}}
+}