From fcad574c4eb0d34b97130246f78e54851fff9747 Mon Sep 17 00:00:00 2001 From: Artem Dergachev Date: Wed, 20 Dec 2017 00:47:17 +0000 Subject: [analyzer] trackNullOrUndefValue: track last store to non-variables. When reporting certain kinds of analyzer warnings, we use the bugreporter::trackNullOrUndefValue mechanism, which is part of public checker API, to understand where a zero, null-pointer, or garbage value came from, which would highlight important events with respect to that value in the diagnostic path notes, and help us suppress various false positives that result from values appearing from particular sources. Previously, we've lost track of the value when it was written into a memory region that is not a plain variable. Now try to resume tracking in this situation by finding where the last write to this region has occured. Differential revision: https://reviews.llvm.org/D41253 llvm-svn: 321130 --- clang/test/Analysis/inlining/inline-defensive-checks.c | 18 ++++++++++++++++++ clang/test/Analysis/nullptr.cpp | 5 +++-- 2 files changed, 21 insertions(+), 2 deletions(-) (limited to 'clang/test/Analysis') diff --git a/clang/test/Analysis/inlining/inline-defensive-checks.c b/clang/test/Analysis/inlining/inline-defensive-checks.c index 9f211b502bc..7440c77736e 100644 --- a/clang/test/Analysis/inlining/inline-defensive-checks.c +++ b/clang/test/Analysis/inlining/inline-defensive-checks.c @@ -190,3 +190,21 @@ void idcTrackZeroValueThroughUnaryPointerOperatorsWithArrayField(struct S2 *s) { idc(s); *(&(s->a[0])) = 7; // no-warning } + +void idcTrackConstraintThroughSymbolicRegion(int **x) { + idc(*x); + // FIXME: Should not warn. + **x = 7; // expected-warning{{Dereference of null pointer}} +} + +int *idcPlainNull(int coin) { + if (coin) + return 0; + static int X; + return &X; +} + +void idcTrackZeroValueThroughSymbolicRegion(int coin, int **x) { + *x = idcPlainNull(coin); + **x = 7; // no-warning +} diff --git a/clang/test/Analysis/nullptr.cpp b/clang/test/Analysis/nullptr.cpp index b3e61c9defb..38e099b7fbd 100644 --- a/clang/test/Analysis/nullptr.cpp +++ b/clang/test/Analysis/nullptr.cpp @@ -142,8 +142,9 @@ void shouldNotCrash() { // expected-note@-1{{Passing null pointer value via 1st parameter 'x'}} if (getSymbol()) { // expected-note {{Assuming the condition is true}} // expected-note@-1{{Taking true branch}} - X *x = Type().x; // expected-note{{'x' initialized to a null pointer value}} - x->f(); // expected-warning{{Called C++ object pointer is null}} + X *xx = Type().x; // expected-note {{Null pointer value stored to field 'x'}} + // expected-note@-1{{'xx' initialized to a null pointer value}} + xx->f(); // expected-warning{{Called C++ object pointer is null}} // expected-note@-1{{Called C++ object pointer is null}} } } -- cgit v1.2.3