head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC6:1.1.1.4 netbsd-11-0-RC5:1.1.1.4 netbsd-11-0-RC4:1.1.1.4 netbsd-11-0-RC3:1.1.1.4 netbsd-11-0-RC2:1.1.1.4 netbsd-11-0-RC1:1.1.1.4 perseant-exfatfs-base-20250801:1.1.1.4 netbsd-11:1.1.1.4.0.10 netbsd-11-base:1.1.1.4 netbsd-10-1-RELEASE:1.1.1.4 perseant-exfatfs-base-20240630:1.1.1.4 perseant-exfatfs:1.1.1.4.0.8 perseant-exfatfs-base:1.1.1.4 netbsd-8-3-RELEASE:1.1.1.2 netbsd-9-4-RELEASE:1.1.1.3 netbsd-10-0-RELEASE:1.1.1.4 netbsd-10-0-RC6:1.1.1.4 netbsd-10-0-RC5:1.1.1.4 netbsd-10-0-RC4:1.1.1.4 netbsd-10-0-RC3:1.1.1.4 netbsd-10-0-RC2:1.1.1.4 netbsd-10-0-RC1:1.1.1.4 netbsd-10:1.1.1.4.0.6 netbsd-10-base:1.1.1.4 netbsd-9-3-RELEASE:1.1.1.3 cjep_sun2x:1.1.1.4.0.4 cjep_sun2x-base:1.1.1.4 cjep_staticlib_x-base1:1.1.1.4 netbsd-9-2-RELEASE:1.1.1.3 cjep_staticlib_x:1.1.1.4.0.2 cjep_staticlib_x-base:1.1.1.4 netbsd-9-1-RELEASE:1.1.1.3 phil-wifi-20200421:1.1.1.4 phil-wifi-20200411:1.1.1.4 phil-wifi-20200406:1.1.1.4 netbsd-8-2-RELEASE:1.1.1.2 netbsd-9-0-RELEASE:1.1.1.3 netbsd-9-0-RC2:1.1.1.3 netbsd-9-0-RC1:1.1.1.3 netbsd-9:1.1.1.3.0.6 netbsd-9-base:1.1.1.3 phil-wifi-20190609:1.1.1.3 netbsd-8-1-RELEASE:1.1.1.2 netbsd-8-1-RC1:1.1.1.2 pgoyette-compat-merge-20190127:1.1.1.3 pgoyette-compat-20190127:1.1.1.3 pgoyette-compat-20190118:1.1.1.3 pgoyette-compat-1226:1.1.1.3 pgoyette-compat-1126:1.1.1.3 pgoyette-compat-1020:1.1.1.3 pgoyette-compat-0930:1.1.1.3 pgoyette-compat-0906:1.1.1.3 netbsd-7-2-RELEASE:1.1.1.2 pgoyette-compat-0728:1.1.1.3 clang-337282:1.1.1.3 netbsd-8-0-RELEASE:1.1.1.2 phil-wifi:1.1.1.3.0.4 phil-wifi-base:1.1.1.3 pgoyette-compat-0625:1.1.1.3 netbsd-8-0-RC2:1.1.1.2 pgoyette-compat-0521:1.1.1.3 pgoyette-compat-0502:1.1.1.3 pgoyette-compat-0422:1.1.1.3 netbsd-8-0-RC1:1.1.1.2 pgoyette-compat-0415:1.1.1.3 pgoyette-compat-0407:1.1.1.3 pgoyette-compat-0330:1.1.1.3 pgoyette-compat-0322:1.1.1.3 pgoyette-compat-0315:1.1.1.3 netbsd-7-1-2-RELEASE:1.1.1.2 pgoyette-compat:1.1.1.3.0.2 pgoyette-compat-base:1.1.1.3 netbsd-7-1-1-RELEASE:1.1.1.2 clang-319952:1.1.1.3 matt-nb8-mediatek:1.1.1.2.0.26 matt-nb8-mediatek-base:1.1.1.2 clang-309604:1.1.1.3 perseant-stdc-iso10646:1.1.1.2.0.24 perseant-stdc-iso10646-base:1.1.1.2 netbsd-8:1.1.1.2.0.22 netbsd-8-base:1.1.1.2 prg-localcount2-base3:1.1.1.2 prg-localcount2-base2:1.1.1.2 prg-localcount2-base1:1.1.1.2 prg-localcount2:1.1.1.2.0.20 prg-localcount2-base:1.1.1.2 pgoyette-localcount-20170426:1.1.1.2 bouyer-socketcan-base1:1.1.1.2 pgoyette-localcount-20170320:1.1.1.2 netbsd-7-1:1.1.1.2.0.18 netbsd-7-1-RELEASE:1.1.1.2 netbsd-7-1-RC2:1.1.1.2 clang-294123:1.1.1.2 netbsd-7-nhusb-base-20170116:1.1.1.2 bouyer-socketcan:1.1.1.2.0.16 bouyer-socketcan-base:1.1.1.2 clang-291444:1.1.1.2 pgoyette-localcount-20170107:1.1.1.2 netbsd-7-1-RC1:1.1.1.2 pgoyette-localcount-20161104:1.1.1.2 netbsd-7-0-2-RELEASE:1.1.1.2 localcount-20160914:1.1.1.2 netbsd-7-nhusb:1.1.1.2.0.14 netbsd-7-nhusb-base:1.1.1.2 clang-280599:1.1.1.2 pgoyette-localcount-20160806:1.1.1.2 pgoyette-localcount-20160726:1.1.1.2 pgoyette-localcount:1.1.1.2.0.12 pgoyette-localcount-base:1.1.1.2 netbsd-7-0-1-RELEASE:1.1.1.2 clang-261930:1.1.1.2 netbsd-7-0:1.1.1.2.0.10 netbsd-7-0-RELEASE:1.1.1.2 netbsd-7-0-RC3:1.1.1.2 netbsd-7-0-RC2:1.1.1.2 netbsd-7-0-RC1:1.1.1.2 clang-237755:1.1.1.2 clang-232565:1.1.1.2 clang-227398:1.1.1.2 tls-maxphys-base:1.1.1.2 tls-maxphys:1.1.1.2.0.8 netbsd-7:1.1.1.2.0.6 netbsd-7-base:1.1.1.2 clang-215315:1.1.1.2 clang-209886:1.1.1.2 yamt-pagecache:1.1.1.2.0.4 yamt-pagecache-base9:1.1.1.2 tls-earlyentropy:1.1.1.2.0.2 tls-earlyentropy-base:1.1.1.2 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.2 riastradh-drm2-base3:1.1.1.2 clang-202566:1.1.1.2 clang-201163:1.1.1.2 clang-199312:1.1.1.2 clang-198450:1.1.1.2 clang-196603:1.1.1.1 clang-195771:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2013.11.28.14.14.57; author joerg; state Exp; branches 1.1.1.1; next ; commitid ow8OybrawrB1f3fx; 1.1.1.1 date 2013.11.28.14.14.57; author joerg; state Exp; branches; next 1.1.1.2; commitid ow8OybrawrB1f3fx; 1.1.1.2 date 2014.01.05.15.39.52; author joerg; state Exp; branches 1.1.1.2.4.1 1.1.1.2.8.1; next 1.1.1.3; commitid wh3aCSIWykURqWjx; 1.1.1.3 date 2017.08.01.19.34.39; author joerg; state Exp; branches 1.1.1.3.4.1; next 1.1.1.4; commitid pMuDy65V0VicSx1A; 1.1.1.4 date 2019.11.13.22.19.38; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.2.4.1 date 2014.01.05.15.39.52; author yamt; state dead; branches; next 1.1.1.2.4.2; commitid WSrDtL5nYAUyiyBx; 1.1.1.2.4.2 date 2014.05.22.16.18.34; author yamt; state Exp; branches; next ; commitid WSrDtL5nYAUyiyBx; 1.1.1.2.8.1 date 2014.01.05.15.39.52; author tls; state dead; branches; next 1.1.1.2.8.2; commitid jTnpym9Qu0o4R1Nx; 1.1.1.2.8.2 date 2014.08.19.23.47.34; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.3.4.1 date 2020.04.13.07.46.50; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,debug.ExprInspection -analyzer-config ipa=none -verify %s void clang_analyzer_eval(bool); class A { public: virtual void f(){}; }; class B : public A{ public: int m; }; class C : public A{}; class BB: public B{}; // A lot of the tests below have the if statement in them, which forces the // analyzer to explore both path - when the result is 0 and not. This makes // sure that we definitely know that the result is non-0 (as the result of // the cast). int testDynCastFromRadar() { B aa; A *a = &aa; const int* res = 0; B *b = dynamic_cast(a); static const int i = 5; if(b) { res = &i; } else { res = 0; } return *res; // no warning } int testBaseToBase1() { B b; B *pb = &b; B *pbb = dynamic_cast(pb); const int* res = 0; static const int i = 5; if (pbb) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing1() { BB bb; B *pb = &bb; A *pa = pb; B *b = dynamic_cast(pa); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing2() { BB bb; A *pbb = &bb; B *b = dynamic_cast(pbb); BB *s = dynamic_cast(b); const int* res = 0; static const int i = 5; if (s) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing3() { BB bb; A *pbb = &bb; B *b = dynamic_cast(pbb); return b->m; // no warning } int testLHS() { B aa; A *a = &aa; return (dynamic_cast(a))->m; } int testLHS2() { B aa; A *a = &aa; return (*dynamic_cast(a)).m; } int testDynCastUnknown2(class A *a) { B *b = dynamic_cast(a); return b->m; // no warning } int testDynCastUnknown(class A *a) { B *b = dynamic_cast(a); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // expected-warning {{Dereference of null pointer}} } int testDynCastFail2() { C c; A *pa = &c; B *b = dynamic_cast(pa); return b->m; // expected-warning {{dereference of a null pointer}} } int testLHSFail() { C c; A *a = &c; return (*dynamic_cast(a)).m; // expected-warning {{Dereference of null pointer}} } int testBaseToDerivedFail() { A a; B *b = dynamic_cast(&a); return b->m; // expected-warning {{dereference of a null pointer}} } int testConstZeroFail() { B *b = dynamic_cast((A *)0); return b->m; // expected-warning {{dereference of a null pointer}} } int testConstZeroFail2() { A *a = 0; B *b = dynamic_cast(a); return b->m; // expected-warning {{dereference of a null pointer}} } int testUpcast() { B b; A *a = dynamic_cast(&b); const int* res = 0; static const int i = 5; if (a) { res = &i; } else { res = 0; } return *res; // no warning } int testCastToVoidStar() { A a; void *b = dynamic_cast(&a); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // no warning } int testReferenceSuccesfulCast() { B rb; B &b = dynamic_cast(rb); int *x = 0; return *x; // expected-warning {{Dereference of null pointer}} } int testReferenceFailedCast() { A a; B &b = dynamic_cast(a); int *x = 0; return *x; // no warning (An exception is thrown by the cast.) } // Here we allow any outcome of the cast and this is good because there is a // situation where this will fail. So if the user has written the code in this // way, we assume they expect the cast to succeed. // Note, this might need special handling if we track types of symbolic casts // and use them for dynamic_cast handling. int testDynCastMostLikelyWillFail(C *c) { B *b = 0; b = dynamic_cast(c); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } // Note: IPA is turned off for this test because the code below shows how the // dynamic_cast could succeed. return *res; // expected-warning{{Dereference of null pointer}} } class M : public B, public C {}; void callTestDynCastMostLikelyWillFail() { M m; testDynCastMostLikelyWillFail(&m); } void testDynCastToMiddleClass () { class BBB : public BB {}; BBB obj; A &ref = obj; // These didn't always correctly layer base regions. B *ptr = dynamic_cast(&ref); clang_analyzer_eval(ptr != 0); // expected-warning{{TRUE}} // This is actually statically resolved to be a DerivedToBase cast. ptr = dynamic_cast(&obj); clang_analyzer_eval(ptr != 0); // expected-warning{{TRUE}} } // ----------------------------- // False positives/negatives. // ----------------------------- // Due to symbolic regions not being typed. int testDynCastFalsePositive(BB *c) { B *b = 0; b = dynamic_cast(c); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // expected-warning{{Dereference of null pointer}} } // Does not work when we new an object. int testDynCastFail3() { A *a = new A(); B *b = dynamic_cast(a); return b->m; } @ 1.1.1.1 log @Import Clang 3.4rc1 r195771. @ text @@ 1.1.1.2 log @Import clang 3.5svn r198450. @ text @d172 1 a172 1 int testReferenceSuccessfulCast() { @ 1.1.1.3 log @Import clang r309604 from branches/release_50 @ text @d1 1 a1 1 // RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -analyzer-checker=core,debug.ExprInspection -analyzer-config ipa=none -verify %s @ 1.1.1.3.4.1 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.4 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.2.8.1 log @file dynamic-cast.cpp was added on branch tls-maxphys on 2014-08-19 23:47:34 +0000 @ text @d1 253 @ 1.1.1.2.8.2 log @Rebase to HEAD as of a few days ago. @ text @a0 253 // RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,debug.ExprInspection -analyzer-config ipa=none -verify %s void clang_analyzer_eval(bool); class A { public: virtual void f(){}; }; class B : public A{ public: int m; }; class C : public A{}; class BB: public B{}; // A lot of the tests below have the if statement in them, which forces the // analyzer to explore both path - when the result is 0 and not. This makes // sure that we definitely know that the result is non-0 (as the result of // the cast). int testDynCastFromRadar() { B aa; A *a = &aa; const int* res = 0; B *b = dynamic_cast(a); static const int i = 5; if(b) { res = &i; } else { res = 0; } return *res; // no warning } int testBaseToBase1() { B b; B *pb = &b; B *pbb = dynamic_cast(pb); const int* res = 0; static const int i = 5; if (pbb) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing1() { BB bb; B *pb = &bb; A *pa = pb; B *b = dynamic_cast(pa); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing2() { BB bb; A *pbb = &bb; B *b = dynamic_cast(pbb); BB *s = dynamic_cast(b); const int* res = 0; static const int i = 5; if (s) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing3() { BB bb; A *pbb = &bb; B *b = dynamic_cast(pbb); return b->m; // no warning } int testLHS() { B aa; A *a = &aa; return (dynamic_cast(a))->m; } int testLHS2() { B aa; A *a = &aa; return (*dynamic_cast(a)).m; } int testDynCastUnknown2(class A *a) { B *b = dynamic_cast(a); return b->m; // no warning } int testDynCastUnknown(class A *a) { B *b = dynamic_cast(a); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // expected-warning {{Dereference of null pointer}} } int testDynCastFail2() { C c; A *pa = &c; B *b = dynamic_cast(pa); return b->m; // expected-warning {{dereference of a null pointer}} } int testLHSFail() { C c; A *a = &c; return (*dynamic_cast(a)).m; // expected-warning {{Dereference of null pointer}} } int testBaseToDerivedFail() { A a; B *b = dynamic_cast(&a); return b->m; // expected-warning {{dereference of a null pointer}} } int testConstZeroFail() { B *b = dynamic_cast((A *)0); return b->m; // expected-warning {{dereference of a null pointer}} } int testConstZeroFail2() { A *a = 0; B *b = dynamic_cast(a); return b->m; // expected-warning {{dereference of a null pointer}} } int testUpcast() { B b; A *a = dynamic_cast(&b); const int* res = 0; static const int i = 5; if (a) { res = &i; } else { res = 0; } return *res; // no warning } int testCastToVoidStar() { A a; void *b = dynamic_cast(&a); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // no warning } int testReferenceSuccessfulCast() { B rb; B &b = dynamic_cast(rb); int *x = 0; return *x; // expected-warning {{Dereference of null pointer}} } int testReferenceFailedCast() { A a; B &b = dynamic_cast(a); int *x = 0; return *x; // no warning (An exception is thrown by the cast.) } // Here we allow any outcome of the cast and this is good because there is a // situation where this will fail. So if the user has written the code in this // way, we assume they expect the cast to succeed. // Note, this might need special handling if we track types of symbolic casts // and use them for dynamic_cast handling. int testDynCastMostLikelyWillFail(C *c) { B *b = 0; b = dynamic_cast(c); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } // Note: IPA is turned off for this test because the code below shows how the // dynamic_cast could succeed. return *res; // expected-warning{{Dereference of null pointer}} } class M : public B, public C {}; void callTestDynCastMostLikelyWillFail() { M m; testDynCastMostLikelyWillFail(&m); } void testDynCastToMiddleClass () { class BBB : public BB {}; BBB obj; A &ref = obj; // These didn't always correctly layer base regions. B *ptr = dynamic_cast(&ref); clang_analyzer_eval(ptr != 0); // expected-warning{{TRUE}} // This is actually statically resolved to be a DerivedToBase cast. ptr = dynamic_cast(&obj); clang_analyzer_eval(ptr != 0); // expected-warning{{TRUE}} } // ----------------------------- // False positives/negatives. // ----------------------------- // Due to symbolic regions not being typed. int testDynCastFalsePositive(BB *c) { B *b = 0; b = dynamic_cast(c); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // expected-warning{{Dereference of null pointer}} } // Does not work when we new an object. int testDynCastFail3() { A *a = new A(); B *b = dynamic_cast(a); return b->m; } @ 1.1.1.2.4.1 log @file dynamic-cast.cpp was added on branch yamt-pagecache on 2014-05-22 16:18:34 +0000 @ text @d1 253 @ 1.1.1.2.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @a0 253 // RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-checker=core,debug.ExprInspection -analyzer-config ipa=none -verify %s void clang_analyzer_eval(bool); class A { public: virtual void f(){}; }; class B : public A{ public: int m; }; class C : public A{}; class BB: public B{}; // A lot of the tests below have the if statement in them, which forces the // analyzer to explore both path - when the result is 0 and not. This makes // sure that we definitely know that the result is non-0 (as the result of // the cast). int testDynCastFromRadar() { B aa; A *a = &aa; const int* res = 0; B *b = dynamic_cast(a); static const int i = 5; if(b) { res = &i; } else { res = 0; } return *res; // no warning } int testBaseToBase1() { B b; B *pb = &b; B *pbb = dynamic_cast(pb); const int* res = 0; static const int i = 5; if (pbb) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing1() { BB bb; B *pb = &bb; A *pa = pb; B *b = dynamic_cast(pa); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing2() { BB bb; A *pbb = &bb; B *b = dynamic_cast(pbb); BB *s = dynamic_cast(b); const int* res = 0; static const int i = 5; if (s) { res = &i; } else { res = 0; } return *res; // no warning } int testMultipleLevelsOfSubclassing3() { BB bb; A *pbb = &bb; B *b = dynamic_cast(pbb); return b->m; // no warning } int testLHS() { B aa; A *a = &aa; return (dynamic_cast(a))->m; } int testLHS2() { B aa; A *a = &aa; return (*dynamic_cast(a)).m; } int testDynCastUnknown2(class A *a) { B *b = dynamic_cast(a); return b->m; // no warning } int testDynCastUnknown(class A *a) { B *b = dynamic_cast(a); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // expected-warning {{Dereference of null pointer}} } int testDynCastFail2() { C c; A *pa = &c; B *b = dynamic_cast(pa); return b->m; // expected-warning {{dereference of a null pointer}} } int testLHSFail() { C c; A *a = &c; return (*dynamic_cast(a)).m; // expected-warning {{Dereference of null pointer}} } int testBaseToDerivedFail() { A a; B *b = dynamic_cast(&a); return b->m; // expected-warning {{dereference of a null pointer}} } int testConstZeroFail() { B *b = dynamic_cast((A *)0); return b->m; // expected-warning {{dereference of a null pointer}} } int testConstZeroFail2() { A *a = 0; B *b = dynamic_cast(a); return b->m; // expected-warning {{dereference of a null pointer}} } int testUpcast() { B b; A *a = dynamic_cast(&b); const int* res = 0; static const int i = 5; if (a) { res = &i; } else { res = 0; } return *res; // no warning } int testCastToVoidStar() { A a; void *b = dynamic_cast(&a); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // no warning } int testReferenceSuccessfulCast() { B rb; B &b = dynamic_cast(rb); int *x = 0; return *x; // expected-warning {{Dereference of null pointer}} } int testReferenceFailedCast() { A a; B &b = dynamic_cast(a); int *x = 0; return *x; // no warning (An exception is thrown by the cast.) } // Here we allow any outcome of the cast and this is good because there is a // situation where this will fail. So if the user has written the code in this // way, we assume they expect the cast to succeed. // Note, this might need special handling if we track types of symbolic casts // and use them for dynamic_cast handling. int testDynCastMostLikelyWillFail(C *c) { B *b = 0; b = dynamic_cast(c); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } // Note: IPA is turned off for this test because the code below shows how the // dynamic_cast could succeed. return *res; // expected-warning{{Dereference of null pointer}} } class M : public B, public C {}; void callTestDynCastMostLikelyWillFail() { M m; testDynCastMostLikelyWillFail(&m); } void testDynCastToMiddleClass () { class BBB : public BB {}; BBB obj; A &ref = obj; // These didn't always correctly layer base regions. B *ptr = dynamic_cast(&ref); clang_analyzer_eval(ptr != 0); // expected-warning{{TRUE}} // This is actually statically resolved to be a DerivedToBase cast. ptr = dynamic_cast(&obj); clang_analyzer_eval(ptr != 0); // expected-warning{{TRUE}} } // ----------------------------- // False positives/negatives. // ----------------------------- // Due to symbolic regions not being typed. int testDynCastFalsePositive(BB *c) { B *b = 0; b = dynamic_cast(c); const int* res = 0; static const int i = 5; if (b) { res = &i; } else { res = 0; } return *res; // expected-warning{{Dereference of null pointer}} } // Does not work when we new an object. int testDynCastFail3() { A *a = new A(); B *b = dynamic_cast(a); return b->m; } @