gcc/testsuite/c-c++-common/analyzer/feasibility-1.c

   1 #include "analyzer-decls.h"
   2
   3 void test_1 (void)
   4 {
   5   __analyzer_dump_path (); /* { dg-message "path" } */
   6 }
   7
   8 void test_2 (int flag)
   9 {
  10   if (flag)
  11     __analyzer_dump_path (); /* { dg-message "path" } */
  12 }
  13
  14 void test_3 (int flag)
  15 {
  16   if (flag)
  17     if (!flag)
  18       __analyzer_dump_path (); /* { dg-bogus "path" } */
  19 }
  20
  21 int global_for_test_4;
  22 static void __attribute__((noinline)) called_by_test_4 () {}
  23 void test_4 (void)
  24 {
  25   /* Verify that a state change that happens in a stmt that
  26      isn't the first within its BB can affect path feasibility.  */
  27   global_for_test_4 = 0;
  28   global_for_test_4 = 1;
  29   /* Thwart the optimizer.  */
  30   called_by_test_4 ();
  31   if (global_for_test_4)
  32     __analyzer_dump_path (); /* { dg-message "path" } */
  33 }
  34
  35 /* Verify that loops don't confuse the feasibility checker.  */
  36
  37 void test_5 (void)
  38 {
  39   for (int i = 0; i < 1024; i++)
  40     {
  41     }
  42   __analyzer_dump_path (); /* { dg-message "path" } */
  43 }
  44
  45 /* Reproducer for an issue seen with CVE-2005-1689 (PR analyzer/96374): if we
  46    take the shortest path and update state and check feasibility per-edge, we
  47    can erroneously reject valid diagnostics.  */
  48
  49 int test_6 (int a, int b)
  50 {
  51   int problem = 0;
  52   if (a)
  53     problem = 1;
  54   if (b)
  55     {
  56       if (!problem)
  57         problem = 2;
  58       __analyzer_dump_path (); /* { dg-message "path" } */
  59     }
  60   return problem;
  61 }
  62
  63 /* As above, but call a static function.
  64    Even if the path to the call of called_by_test_6a is falsely rejected
  65    as infeasible, it still makes sense to complain about errors within
  66    the called function.  */
  67
  68 static void __attribute__((noinline))
  69 called_by_test_6a (void *ptr)
  70 {
  71   __builtin_free (ptr);
  72   __builtin_free (ptr); /* { dg-message "double-'free'" } */
  73 }
  74
  75 int test_6a (int a, int b, void *ptr)
  76 {
  77   int problem = 0;
  78   if (a)
  79     problem = 1;
  80   if (b)
  81     {
  82       if (!problem)
  83         problem = 2;
  84       called_by_test_6a (ptr);
  85     }
  86   return problem;
  87 }
  88
  89 /* After state-merging, the shortest path skips the loop,
  90    but the shortest feasible path enters it.  */
  91
  92 void test_7 (int n)
  93 {
  94   int entered_loop = 0;
  95   int i;
  96   for (i = 0; i < n; i++)
  97     entered_loop = 1;
  98   if (entered_loop)
  99     __analyzer_dump_path (); /* { dg-message "path" } */
 100 }