gcc/testsuite/gcc.dg/analyzer/data-model-1.c

   1 /* { dg-require-effective-target alloca } */
   2
   3 #include <stdlib.h>
   4 #include <string.h>
   5 #include <stdio.h>
   6 #include "analyzer-decls.h"
   7
   8 struct foo
   9 {
  10   int i;
  11 };
  12
  13 /* Fields of a local.  */
  14
  15 void test_1 (void)
  16 {
  17   struct foo f;
  18   f.i = 1;
  19   __analyzer_eval (f.i == 1); /* { dg-warning "TRUE" } */
  20 }
  21
  22 /* Fields of a param.  */
  23
  24 void test_2 (struct foo f)
  25 {
  26   __analyzer_eval (f.i == 2); /* { dg-warning "UNKNOWN" } */
  27   f.i = 2;
  28   __analyzer_eval (f.i == 2); /* { dg-warning "TRUE" } */
  29 }
  30
  31 /* Fields of a param ptr.  */
  32
  33 void test_3 (struct foo *f)
  34 {
  35   __analyzer_eval (f->i == 3); /* { dg-warning "UNKNOWN" } */
  36   f->i = 3;
  37   __analyzer_eval (f->i == 3); /* { dg-warning "TRUE" } */
  38 }
  39
  40 /* Fields of a global ptr.  */
  41 struct foo *global_foo_ptr;
  42
  43 void test_3a (void)
  44 {
  45   struct foo *tmp = global_foo_ptr;
  46   __analyzer_eval (global_foo_ptr->i == 3); /* { dg-warning "UNKNOWN" } */
  47   global_foo_ptr->i = 3;
  48   __analyzer_eval (global_foo_ptr->i == 3); /* { dg-warning "TRUE" } */
  49 }
  50
  51 /* Pointer to a local.  */
  52
  53 void test_4 (void)
  54 {
  55   int i;
  56   int *p = &i;
  57   i = 1;
  58   *p = 2;
  59   __analyzer_eval (i == 2); /* { dg-warning "TRUE" } */
  60 }
  61
  62 /* Local array.  */
  63
  64 void test_5 (void)
  65 {
  66   int a[10];
  67   a[3] = 5; /* ARRAY_REF.  */
  68   __analyzer_eval (a[3] == 5); /* { dg-warning "TRUE" } */
  69 }
  70
  71 /* Local array, but using an unknown index.  */
  72
  73 void test_5a (int idx)
  74 {
  75   int a[10];
  76   a[idx] = 5; /* ARRAY_REF.  */
  77   __analyzer_eval (a[idx] == 5); /* { dg-warning "TRUE" } */
  78 }
  79
  80 /* Array passed in as a param.  */
  81
  82 void test_6 (int a[10])
  83 {
  84   /* POINTER_PLUS_EXPR then a MEM_REF.  */
  85   __analyzer_eval (a[3] == 42); /* { dg-warning "UNKNOWN" } */
  86   a[3] = 42;
  87   __analyzer_eval (a[3] == 42); /* { dg-warning "TRUE" } */
  88 }
  89
  90 /* Array passed in as a param ptr.  */
  91
  92 void test_7 (int *a)
  93 {
  94   __analyzer_eval (a[3] == 42); /* { dg-warning "UNKNOWN" } */
  95   a[3] = 42;
  96   __analyzer_eval (a[3] == 42); /* { dg-warning "TRUE" } */
  97 }
  98
  99 /* Globals.  */
 100
 101 int glob_a;
 102
 103 void test_10 (void)
 104 {
 105   __analyzer_eval (glob_a == 42); /* { dg-warning "UNKNOWN" } */
 106   glob_a = 42;
 107   __analyzer_eval (glob_a == 42); /* { dg-warning "TRUE" } */
 108 }
 109
 110 /* malloc.  */
 111
 112 void test_11 (void)
 113 {
 114   void *p = malloc (256);
 115   void *q = malloc (256);
 116
 117   /* malloc results should be unique.  */
 118   __analyzer_eval (p == q); /* { dg-warning "FALSE" } */
 119   __analyzer_eval (p != q); /* { dg-warning "TRUE" } */
 120   __analyzer_eval (p <= q); /* { dg-warning "UNKNOWN" } */
 121   __analyzer_eval (p >= q); /* { dg-warning "UNKNOWN" } */
 122   __analyzer_eval (p < q); /* { dg-warning "UNKNOWN" } */
 123   __analyzer_eval (p > q); /* { dg-warning "UNKNOWN" } */
 124
 125   __analyzer_eval (p == p); /* { dg-warning "TRUE" } */
 126   __analyzer_eval (p != p); /* { dg-warning "FALSE" } */
 127   __analyzer_eval (p <= p); /* { dg-warning "TRUE" } */
 128   __analyzer_eval (p >= p); /* { dg-warning "TRUE" } */
 129   __analyzer_eval (p < p); /* { dg-warning "FALSE" } */
 130   __analyzer_eval (p > p); /* { dg-warning "FALSE" } */
 131
 132   free (p);
 133   free (q);
 134   // TODO: mark freed memory as freed
 135   //__analyzer_break ();
 136 }
 137
 138 /* alloca.  */
 139
 140 void test_12 (void)
 141 {
 142   void *p = __builtin_alloca (256);
 143   void *q = __builtin_alloca (256);
 144
 145   /* alloca results should be unique.  */
 146   __analyzer_eval (p == q); /* { dg-warning "FALSE" } */
 147
 148   // FIXME: complain about uses of poisoned values
 149 }
 150
 151 /* Use of uninit value.  */
 152 int test_12a (void)
 153 {
 154   int i;
 155   return i; // FIXME: do we see the return stmt?
 156 }
 157
 158 void test_12b (void *p, void *q)
 159 {
 160   __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */
 161 }
 162
 163 int test_12c (void)
 164 {
 165   int i;
 166   int j;
 167
 168   j = i; // FIXME: should complain about this
 169
 170   return j;
 171 }
 172
 173 struct coord
 174 {
 175   long x;
 176   long y;
 177 };
 178
 179 int test_12d (struct coord c)
 180 {
 181   struct coord d;
 182   d = c;
 183   __analyzer_eval (d.x == c.x); /* { dg-warning "TRUE" } */
 184   __analyzer_eval (d.y == c.y); /* { dg-warning "TRUE" } */
 185   __analyzer_eval (d.x == d.y); /* { dg-warning "UNKNOWN" } */
 186   /* d and c share an unknown value of type "struct coord".
 187      But d.x and d.y should be different unknown values (although they inherit
 188      from d's region).  */
 189 }
 190
 191 /* Nested structs.  */
 192
 193 struct outer
 194 {
 195   struct middle {
 196     struct inner {
 197       float f;
 198     } in;
 199   } mid;
 200 };
 201
 202 void test_13 (struct outer *o)
 203 {
 204   __analyzer_eval (o->mid.in.f == 0.f); /* { dg-warning "UNKNOWN" } */
 205   o->mid.in.f = 0.f;
 206   __analyzer_eval (o->mid.in.f == 0.f); /* { dg-warning "TRUE" } */
 207 }
 208
 209 void test_14 (struct outer o)
 210 {
 211   __analyzer_eval (o.mid.in.f == 0.f); /* { dg-warning "UNKNOWN" } */
 212   o.mid.in.f = 0.f;
 213   __analyzer_eval (o.mid.in.f == 0.f); /* { dg-warning "TRUE" } */
 214 }
 215
 216 void test_15 (const char *str)
 217 {
 218   char ch = str[0];
 219   __analyzer_eval (ch == 'a'); /* { dg-warning "UNKNOWN" } */
 220   __analyzer_eval (ch == str[0]); /* { dg-warning "TRUE" } */
 221
 222   ch = 'a';
 223   __analyzer_eval (ch == 'a'); /* { dg-warning "TRUE" } */
 224   __analyzer_eval (str[0] == 'a'); /* { dg-warning "UNKNOWN" } */
 225 }
 226
 227 void test_16 (void)
 228 {
 229   const char *msg = "hello world";
 230
 231   __analyzer_eval (msg != NULL); /* { dg-warning "TRUE" } */
 232
 233   __analyzer_eval (msg[0] == 'h'); /* { dg-warning "TRUE" } */
 234
 235   __analyzer_eval (msg[1] == 'e'); /* { dg-warning "TRUE" } */
 236
 237   __analyzer_eval (strlen (msg) == 11); /* { dg-warning "TRUE" } */
 238
 239   /* Out-of-bounds.  */
 240   __analyzer_eval (msg[100] == 'e'); /* { dg-warning "UNKNOWN" } */
 241   // TODO: some kind of warning for the out-of-bounds access
 242 }
 243
 244 static const char *__attribute__((noinline))
 245 get_hello_world (void)
 246 {
 247   return "hello world";
 248 }
 249
 250 void test_16_alt (void)
 251 {
 252   const char *msg = get_hello_world ();
 253
 254   __analyzer_eval (msg != NULL); /* { dg-warning "TRUE" } */
 255
 256   __analyzer_eval (msg[0] == 'h'); /* { dg-warning "TRUE" } */
 257
 258   __analyzer_eval (msg[1] == 'e'); /* { dg-warning "TRUE" } */
 259
 260   __analyzer_eval (strlen (msg) == 11); /* { dg-warning "TRUE" } */
 261 }
 262
 263 void test_16a (const char *msg)
 264 {
 265   __analyzer_eval (strlen (msg) == 11); /* { dg-warning "UNKNOWN" } */
 266 }
 267
 268 void test_16b (const char *msg)
 269 {
 270   __analyzer_eval (strlen (msg) == strlen (msg)); /* { dg-warning "TRUE" "desired" { xfail *-*-* } } */
 271   /* { dg-warning "UNKNOWN" "status quo" { target *-*-* } .-1 } */
 272   // TODO(xfail)
 273 }
 274
 275 extern int unknown_result (void);
 276
 277 void test_16c (int i)
 278 {
 279   int j;
 280
 281   j = i;
 282   __analyzer_eval (j == i); /* { dg-warning "TRUE" } */
 283
 284   j = unknown_result ();
 285   __analyzer_eval (j == i); /* { dg-warning "UNKNOWN" } */
 286 }
 287
 288 void test_16c_a (void)
 289 {
 290   int i, j;
 291
 292   i = unknown_result ();
 293   j = unknown_result ();
 294   __analyzer_eval (i == j); /* { dg-warning "UNKNOWN" } */
 295 }
 296
 297 int global_int_16d;
 298
 299 void test_16d (int i)
 300 {
 301   global_int_16d = i;
 302   __analyzer_eval (global_int_16d == i); /* { dg-warning "TRUE" } */
 303
 304   global_int_16d = unknown_result ();
 305   __analyzer_eval (global_int_16d == i); /* { dg-warning "UNKNOWN" } */
 306 }
 307
 308 extern void might_write_to (int *);
 309
 310 void test_16e (int i)
 311 {
 312   int j;
 313
 314   j = i;
 315   __analyzer_eval (j == i); /* { dg-warning "TRUE" } */
 316
 317   might_write_to (&j);
 318   __analyzer_eval (j == i); /* { dg-warning "UNKNOWN" } */
 319 }
 320
 321 void test_17 (int i)
 322 {
 323   int j = 42;
 324   __analyzer_eval (j == 42); /* { dg-warning "TRUE" } */
 325
 326   __analyzer_eval (i == j); /* { dg-warning "UNKNOWN" } */
 327   i = j;
 328   __analyzer_eval (i == j); /* { dg-warning "TRUE" } */
 329 }
 330
 331 void test_18 (int i)
 332 {
 333   int j;
 334   __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */
 335
 336   j = i;
 337
 338   __analyzer_eval (i == j); /* { dg-warning "TRUE" } */
 339   __analyzer_eval (i >= j); /* { dg-warning "TRUE" } */
 340   __analyzer_eval (i <= j); /* { dg-warning "TRUE" } */
 341
 342   __analyzer_eval (i != j); /* { dg-warning "FALSE" } */
 343   __analyzer_eval (i > j); /* { dg-warning "FALSE" } */
 344   __analyzer_eval (i < j); /* { dg-warning "FALSE" } */
 345 }
 346
 347 void test_19 (void)
 348 {
 349   int i, j;
 350   /* Compare two uninitialized locals.  */
 351     __analyzer_eval (i == j); /* { dg-warning "UNKNOWN" } */
 352 }
 353
 354 void test_20 (int i, int j)
 355 {
 356   __analyzer_eval (i + 1); /* { dg-warning "UNKNOWN" } */
 357   __analyzer_eval (i + j); /* { dg-warning "UNKNOWN" } */
 358
 359   __analyzer_eval (i - 1); /* { dg-warning "UNKNOWN" } */
 360   __analyzer_eval (i - j); /* { dg-warning "UNKNOWN" } */
 361
 362   __analyzer_eval (i * 2); /* { dg-warning "UNKNOWN" } */
 363   __analyzer_eval (i * j); /* { dg-warning "UNKNOWN" } */
 364
 365   __analyzer_eval (i / 2); /* { dg-warning "UNKNOWN" } */
 366   __analyzer_eval (i / j); /* { dg-warning "UNKNOWN" } */
 367
 368   __analyzer_eval (i % 2); /* { dg-warning "UNKNOWN" } */
 369   __analyzer_eval (i % j); /* { dg-warning "UNKNOWN" } */
 370
 371   __analyzer_eval (i & 1); /* { dg-warning "UNKNOWN" } */
 372   __analyzer_eval (i & j); /* { dg-warning "UNKNOWN" } */
 373
 374   __analyzer_eval (i | 1); /* { dg-warning "UNKNOWN" } */
 375   __analyzer_eval (i | j); /* { dg-warning "UNKNOWN" } */
 376
 377   __analyzer_eval (i ^ 1); /* { dg-warning "UNKNOWN" } */
 378   __analyzer_eval (i ^ j); /* { dg-warning "UNKNOWN" } */
 379
 380   __analyzer_eval (i >> 1); /* { dg-warning "UNKNOWN" } */
 381   __analyzer_eval (i >> j); /* { dg-warning "UNKNOWN" } */
 382
 383   __analyzer_eval (i << 1); /* { dg-warning "UNKNOWN" } */
 384   __analyzer_eval (i << j); /* { dg-warning "UNKNOWN" } */
 385
 386   __analyzer_eval (i && 0); /* { dg-warning "FALSE" } */
 387   __analyzer_eval (i && 1); /* { dg-warning "UNKNOWN" } */
 388   __analyzer_eval (i && j); /* { dg-warning "UNKNOWN" } */
 389
 390   __analyzer_eval (i || 0); /* { dg-warning "UNKNOWN" } */
 391
 392   __analyzer_eval (i || 1); /* { dg-warning "TRUE" } */
 393   __analyzer_eval (i || j); /* { dg-warning "UNKNOWN" } */
 394
 395   __analyzer_eval (~i); /* { dg-warning "UNKNOWN" } */
 396   __analyzer_eval (-i); /* { dg-warning "UNKNOWN" } */
 397   __analyzer_eval (+i); /* { dg-warning "UNKNOWN" } */
 398
 399   /* Anything added above should be added to the next function also.  */
 400 }
 401
 402 /* As above, but where the values are known due to the region model,
 403    but not known to GCC's regular optimizations (folding and SSA).  */
 404
 405 void test_21 (void)
 406 {
 407   int i, j, zero;
 408   int *pi = &i;
 409   int *pj = &j;
 410   int *pzero = &zero;
 411   *pi = 5;
 412   *pj = 3;
 413   *pzero = 0;
 414
 415   __analyzer_eval (i + j == 8); /* { dg-warning "TRUE" } */
 416   __analyzer_eval (i - j == 2); /* { dg-warning "TRUE" } */
 417   __analyzer_eval (i * j == 15); /* { dg-warning "TRUE" } */
 418   __analyzer_eval (i / j == 1); /* { dg-warning "TRUE" } */
 419   __analyzer_eval (i % j == 2); /* { dg-warning "TRUE" } */
 420
 421   /* Division by zero.  */
 422   // TODO: should we warn for this?
 423   __analyzer_eval (i / zero); /* { dg-warning "UNKNOWN" } */
 424   __analyzer_eval (i % zero); /* { dg-warning "UNKNOWN" } */
 425
 426   __analyzer_eval ((i & 1) == (5 & 1)); /* { dg-warning "TRUE" } */
 427   __analyzer_eval ((i & j) == (5 & 3)); /* { dg-warning "TRUE" } */
 428   __analyzer_eval ((i | 1) == (5 | 1)); /* { dg-warning "TRUE" } */
 429   __analyzer_eval ((i | j) == (5 | 3)); /* { dg-warning "TRUE" } */
 430   __analyzer_eval ((i ^ 1) == (5 ^ 1)); /* { dg-warning "TRUE" } */
 431   __analyzer_eval ((i ^ j) == (5 ^ 3)); /* { dg-warning "TRUE" } */
 432   __analyzer_eval ((i >> 1) == (5 >> 1)); /* { dg-warning "TRUE" } */
 433   __analyzer_eval ((i >> j) == (5 >> 3)); /* { dg-warning "TRUE" } */
 434   __analyzer_eval ((i << 1) == (5 << 1)); /* { dg-warning "TRUE" } */
 435   __analyzer_eval ((i << j) == (5 << 3)); /* { dg-warning "TRUE" } */
 436   __analyzer_eval (i && 0); /* { dg-warning "FALSE" } */
 437   __analyzer_eval (i && 1); /* { dg-warning "TRUE" } */
 438   __analyzer_eval (i && j); /* { dg-warning "TRUE" } */
 439
 440   __analyzer_eval (i || 0); /* { dg-warning "TRUE" } */
 441   __analyzer_eval (i || 1); /* { dg-warning "TRUE" } */
 442   __analyzer_eval (i || j); /* { dg-warning "TRUE" } */
 443
 444   __analyzer_eval (~i == ~5); /* { dg-warning "TRUE" } */
 445   __analyzer_eval (-i == -5); /* { dg-warning "TRUE" } */
 446   __analyzer_eval (+i == +5); /* { dg-warning "TRUE" } */
 447 }
 448
 449 void test_22 (int i, int j)
 450 {
 451   __analyzer_eval (i + j == i + j); /* { dg-warning "TRUE" } */
 452   // FIXME: this is getting folded; can we build a non-folded equivalent?
 453 }
 454
 455 void test_23 (struct foo *f, struct foo *g)
 456 {
 457   int i, j, k;
 458   i = f->i + g->i;
 459   j = f->i + g->i;
 460   k = f->i * g->i;
 461   __analyzer_eval (i == j); /* { dg-warning "TRUE" } */
 462   __analyzer_eval (i == k); /* { dg-warning "UNKNOWN" } */
 463 }
 464
 465 void test_24 (struct foo *f)
 466 {
 467   struct foo g;
 468   g.i = 42;
 469   __analyzer_eval (g.i == 42); /* { dg-warning "TRUE" } */
 470
 471   /* Overwriting a whole struct should invalidate our knowledge
 472      about fields within it.  */
 473   g = *f;
 474   __analyzer_eval (g.i == 42); /* { dg-warning "UNKNOWN" } */
 475 }
 476
 477 void test_25 (struct foo *f)
 478 {
 479   struct foo g;
 480   g.i = 42;
 481   f->i = 43;
 482   __analyzer_eval (f->i == 43); /* { dg-warning "TRUE" } */
 483   __analyzer_eval (g.i == 42); /* { dg-warning "TRUE" } */
 484
 485   /* Overwriting a whole struct where we know things about the
 486      source value should update our knowledge about fields within
 487      the dest value.  */
 488   g = *f;
 489   __analyzer_eval (g.i == 43); /* { dg-warning "TRUE" } */
 490 }
 491
 492 void test_26 (struct coord *p, struct coord *q)
 493 {
 494   p->x = 42;
 495   q->y = 17; /* could clobber p->x.  */
 496   __analyzer_eval (p->x == 42); /* { dg-warning "UNKNOWN" } */
 497   __analyzer_eval (p->y); /* { dg-warning "UNKNOWN" } */
 498   __analyzer_eval (q->x); /* { dg-warning "UNKNOWN" } */
 499   __analyzer_eval (q->y == 17); /* { dg-warning "TRUE" } */
 500
 501   /* Overwriting a whole struct where we know some things about the
 502      source value should update our knowledge about fields within
 503      the dest value.  */
 504   *p = *q;
 505   __analyzer_eval (p->x); /* { dg-warning "UNKNOWN" } */
 506   __analyzer_eval (p->y == 17); /* { dg-warning "TRUE" } */
 507
 508   __analyzer_eval (q->x); /* { dg-warning "UNKNOWN" } */
 509   __analyzer_eval (q->y == 17); /* { dg-warning "TRUE" "desired" { xfail *-*-* } } */
 510   /* { dg-warning "UNKNOWN" "status quo" { target *-*-* } .-1 } */
 511 }
 512
 513 void test_27 (struct coord *p)
 514 {
 515   memset (p, 0, sizeof (struct coord));
 516   __analyzer_eval (p->x == 0); /* { dg-warning "TRUE" } */
 517   __analyzer_eval (p->y == 0); /* { dg-warning "TRUE" } */
 518 }
 519
 520 void test_28 (struct coord *p)
 521 {
 522   memset (p, 0, sizeof (struct coord) * 10);
 523   __analyzer_eval (p[0].x == 0); /* { dg-warning "TRUE" } */
 524   __analyzer_eval (p[0].y == 0); /* { dg-warning "TRUE" } */
 525
 526   __analyzer_eval (p[9].x == 0); /* { dg-warning "TRUE" } */
 527   __analyzer_eval (p[9].y == 0); /* { dg-warning "TRUE" } */
 528
 529   __analyzer_eval (p[10].x == 0); /* { dg-warning "UNKNOWN" } */
 530   __analyzer_eval (p[10].y == 0); /* { dg-warning "UNKNOWN" } */
 531 }
 532
 533 void test_29 (struct coord *p)
 534 {
 535   struct coord *q;
 536
 537   p[0].x = 100024;
 538   p[0].y = 100025;
 539
 540   p[7].x = 107024;
 541   p[7].y = 107025;
 542
 543   p[9].x = 109024;
 544   p[9].y = 109025;
 545
 546   __analyzer_eval (p[0].x == 100024); /* { dg-warning "TRUE" } */
 547   __analyzer_eval (p[0].y == 100025); /* { dg-warning "TRUE" } */
 548
 549   __analyzer_eval (p[7].x == 107024); /* { dg-warning "TRUE" } */
 550   __analyzer_eval (p[7].y == 107025); /* { dg-warning "TRUE" } */
 551
 552   __analyzer_eval (p[9].x == 109024); /* { dg-warning "TRUE" } */
 553   __analyzer_eval (p[9].y == 109025); /* { dg-warning "TRUE" } */
 554
 555   __analyzer_eval (p[10].x == 0); /* { dg-warning "UNKNOWN" } */
 556   __analyzer_eval (p[10].y == 0); /* { dg-warning "UNKNOWN" } */
 557
 558   q = &p[7];
 559
 560   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 561   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 562
 563   __analyzer_eval (q[2].x == 109024); /* { dg-warning "TRUE" } */
 564   __analyzer_eval (q[2].y == 109025); /* { dg-warning "TRUE" } */
 565
 566   q += 2;
 567
 568   __analyzer_eval (q->x == 109024); /* { dg-warning "TRUE" } */
 569   __analyzer_eval (q->y == 109025); /* { dg-warning "TRUE" } */
 570
 571   __analyzer_eval (q[-2].x == 107024); /* { dg-warning "TRUE" } */
 572   __analyzer_eval (q[-2].y == 107025); /* { dg-warning "TRUE" } */
 573
 574   q -= 2;
 575
 576   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 577   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 578 }
 579
 580 void test_29a (struct coord p[])
 581 {
 582   struct coord *q;
 583
 584   p[0].x = 100024;
 585   p[0].y = 100025;
 586
 587   p[7].x = 107024;
 588   p[7].y = 107025;
 589
 590   p[9].x = 109024;
 591   p[9].y = 109025;
 592
 593   __analyzer_eval (p[0].x == 100024); /* { dg-warning "TRUE" } */
 594   __analyzer_eval (p[0].y == 100025); /* { dg-warning "TRUE" } */
 595
 596   __analyzer_eval (p[7].x == 107024); /* { dg-warning "TRUE" } */
 597   __analyzer_eval (p[7].y == 107025); /* { dg-warning "TRUE" } */
 598
 599   __analyzer_eval (p[9].x == 109024); /* { dg-warning "TRUE" } */
 600   __analyzer_eval (p[9].y == 109025); /* { dg-warning "TRUE" } */
 601
 602   __analyzer_eval (p[10].x == 0); /* { dg-warning "UNKNOWN" } */
 603   __analyzer_eval (p[10].y == 0); /* { dg-warning "UNKNOWN" } */
 604
 605   q = &p[7];
 606
 607   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 608   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 609
 610   __analyzer_eval (q[2].x == 109024); /* { dg-warning "TRUE" } */
 611   __analyzer_eval (q[2].y == 109025); /* { dg-warning "TRUE" } */
 612
 613   q += 2;
 614
 615   __analyzer_eval (q->x == 109024); /* { dg-warning "TRUE" } */
 616   __analyzer_eval (q->y == 109025); /* { dg-warning "TRUE" } */
 617
 618   __analyzer_eval (q[-2].x == 107024); /* { dg-warning "TRUE" } */
 619   __analyzer_eval (q[-2].y == 107025); /* { dg-warning "TRUE" } */
 620
 621   q -= 2;
 622   __analyzer_eval (q == &p[7]); /* { dg-warning "UNKNOWN" } */
 623   // TODO: make this be TRUE
 624
 625   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 626   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 627 }
 628
 629 void test_29b (void)
 630 {
 631   struct coord p[11];
 632   struct coord *q;
 633
 634   p[0].x = 100024;
 635   p[0].y = 100025;
 636
 637   p[7].x = 107024;
 638   p[7].y = 107025;
 639
 640   p[9].x = 109024;
 641   p[9].y = 109025;
 642
 643   __analyzer_eval (p[0].x == 100024); /* { dg-warning "TRUE" } */
 644   __analyzer_eval (p[0].y == 100025); /* { dg-warning "TRUE" } */
 645
 646   __analyzer_eval (p[7].x == 107024); /* { dg-warning "TRUE" } */
 647   __analyzer_eval (p[7].y == 107025); /* { dg-warning "TRUE" } */
 648
 649   __analyzer_eval (p[9].x == 109024); /* { dg-warning "TRUE" } */
 650   __analyzer_eval (p[9].y == 109025); /* { dg-warning "TRUE" } */
 651
 652   __analyzer_eval (p[10].x == 0); /* { dg-warning "UNKNOWN" } */
 653   __analyzer_eval (p[10].y == 0); /* { dg-warning "UNKNOWN" } */
 654
 655   q = &p[7];
 656
 657   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 658   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 659
 660   __analyzer_eval (q[2].x == 109024); /* { dg-warning "TRUE" } */
 661   __analyzer_eval (q[2].y == 109025); /* { dg-warning "TRUE" } */
 662
 663   q += 2;
 664
 665   __analyzer_eval (q->x == 109024); /* { dg-warning "TRUE" } */
 666   __analyzer_eval (q->y == 109025); /* { dg-warning "TRUE" } */
 667
 668   __analyzer_eval (q[-2].x == 107024); /* { dg-warning "TRUE" } */
 669   __analyzer_eval (q[-2].y == 107025); /* { dg-warning "TRUE" } */
 670
 671   q -= 2;
 672   __analyzer_eval (q == &p[7]); /* { dg-warning "TRUE" } */
 673
 674   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 675   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 676 }
 677
 678 void test_29c (int len)
 679 {
 680   struct coord p[len];
 681   struct coord *q;
 682
 683   p[0].x = 100024;
 684   p[0].y = 100025;
 685
 686   p[7].x = 107024;
 687   p[7].y = 107025;
 688
 689   p[9].x = 109024;
 690   p[9].y = 109025;
 691
 692   __analyzer_eval (p[0].x == 100024); /* { dg-warning "TRUE" } */
 693   __analyzer_eval (p[0].y == 100025); /* { dg-warning "TRUE" } */
 694
 695   __analyzer_eval (p[7].x == 107024); /* { dg-warning "TRUE" } */
 696   __analyzer_eval (p[7].y == 107025); /* { dg-warning "TRUE" } */
 697
 698   __analyzer_eval (p[9].x == 109024); /* { dg-warning "TRUE" } */
 699   __analyzer_eval (p[9].y == 109025); /* { dg-warning "TRUE" } */
 700
 701   __analyzer_eval (p[10].x == 0); /* { dg-warning "UNKNOWN" } */
 702   __analyzer_eval (p[10].y == 0); /* { dg-warning "UNKNOWN" } */
 703
 704   q = &p[7];
 705
 706   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 707   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 708
 709   __analyzer_eval (q[2].x == 109024); /* { dg-warning "TRUE" } */
 710   __analyzer_eval (q[2].y == 109025); /* { dg-warning "TRUE" } */
 711
 712   q += 2;
 713
 714   __analyzer_eval (q->x == 109024); /* { dg-warning "TRUE" } */
 715   __analyzer_eval (q->y == 109025); /* { dg-warning "TRUE" } */
 716
 717   __analyzer_eval (q[-2].x == 107024); /* { dg-warning "TRUE" } */
 718   __analyzer_eval (q[-2].y == 107025); /* { dg-warning "TRUE" } */
 719
 720   q -= 2;
 721   __analyzer_eval (q == &p[7]); /* { dg-warning "TRUE" } */
 722
 723   __analyzer_eval (q->x == 107024); /* { dg-warning "TRUE" } */
 724   __analyzer_eval (q->y == 107025); /* { dg-warning "TRUE" } */
 725 }
 726
 727 void test_30 (void *ptr)
 728 {
 729   struct coord *p = (struct coord *)ptr;
 730   struct coord *q = (struct coord *)ptr;
 731
 732   p->x = 42;
 733
 734   __analyzer_eval (p->x == 42); /* { dg-warning "TRUE" } */
 735   __analyzer_eval (q->x == 42); /* { dg-warning "TRUE" } */
 736 }
 737
 738 void test_31 (unsigned i)
 739 {
 740   int j, k;
 741
 742   j = i < 100 ? i : 100; /* MIN_EXPR.  */
 743   k = i < 100 ? 100 : i; /* MAX_EXPR.  */
 744 }
 745
 746 enum color
 747 {
 748   RED,
 749   GREEN,
 750   BLUE
 751 };
 752
 753 void test_32 (enum color c)
 754 {
 755   __analyzer_eval (c == GREEN); /* { dg-warning "UNKNOWN" } */
 756
 757   c = RED;
 758
 759   __analyzer_eval (c == RED); /* { dg-warning "TRUE" } */
 760   __analyzer_eval (c == GREEN); /* { dg-warning "FALSE" } */
 761 }
 762
 763 void test_33 (void)
 764 {
 765   static int s;
 766
 767   __analyzer_eval (s == 42); /* { dg-warning "UNKNOWN" } */
 768
 769   s = 42;
 770
 771   __analyzer_eval (s == 42); /* { dg-warning "TRUE" } */
 772 }
 773
 774 static int __attribute__((noinline))
 775 __analyzer_only_called_by_test_34 (int parm)
 776 {
 777   __analyzer_eval (parm == 42); /* { dg-warning "TRUE" } */
 778
 779   return parm * 2;
 780 }
 781
 782 void test_34 (void)
 783 {
 784   int result = __analyzer_only_called_by_test_34 (42);
 785   __analyzer_eval (result == 84); /* { dg-warning "TRUE" } */
 786 }
 787
 788 void test_35 (int i, int j)
 789 {
 790   __analyzer_eval (&i == &i); /* { dg-warning "TRUE" } */
 791   __analyzer_eval (&i != &j); /* { dg-warning "TRUE" } */
 792 }
 793
 794 static void __attribute__((noinline))
 795 write_through_ptr (int *dst, int val)
 796 {
 797   *dst = val;
 798 }
 799
 800 void test_36 (int i)
 801 {
 802   __analyzer_eval (i == 42); /* { dg-warning "UNKNOWN" } */
 803
 804   write_through_ptr (&i, 42);
 805
 806   __analyzer_eval (i == 42); /* { dg-warning "TRUE" } */
 807 }
 808
 809 /* Read through uninitialized pointer.  */
 810
 811 int test_37 (void)
 812 {
 813   int *ptr;
 814   return *ptr; /* { dg-warning "use of uninitialized value 'ptr'" "uninit-warning-removed" { xfail *-*-* } } */
 815 }
 816
 817 /* Write through uninitialized pointer.  */
 818
 819 void test_37a (int i)
 820 {
 821   int *ptr;
 822   *ptr = i; /* { dg-warning "use of uninitialized value 'ptr'" "uninit-warning-removed" { xfail *-*-* } } */
 823 }
 824
 825 // TODO: the various other ptr deref poisonings
 826
 827 /* Read through NULL pointer.  */
 828
 829 int test_38 (void)
 830 {
 831   int *ptr = NULL;
 832   return *ptr; /* { dg-warning "dereference of NULL 'ptr'" } */
 833 }
 834
 835 /* Write through NULL pointer.  */
 836
 837 int test_38a (int i)
 838 {
 839   int *ptr = NULL;
 840   *ptr = i; /* { dg-warning "dereference of NULL 'ptr'" } */
 841 }
 842
 843 /* Read through non-NULL constant pointer.  */
 844
 845 int test_39 (void)
 846 {
 847   int *ptr = (int *)0x1000;
 848   return *ptr;
 849 }
 850
 851 int test_40 (int flag)
 852 {
 853   int i;
 854   if (flag)
 855     i = 43;
 856   else
 857     i = 17;
 858
 859   /* With state-merging, we lose the relationship between 'flag' and 'i'.  */
 860   __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
 861
 862   if (flag)
 863     __analyzer_eval (i == 43); /* { dg-warning "UNKNOWN" } */
 864   else
 865     __analyzer_eval (i == 17); /* { dg-warning "UNKNOWN" } */
 866 }
 867
 868 struct link
 869 {
 870   struct link *next;
 871   int f;
 872 };
 873
 874 /* Traversing a singly-linked list.  */
 875
 876 void foo (struct link *in)
 877 {
 878   struct link a;
 879   struct link b;
 880   struct link c;
 881   a.next = &b;
 882   b.next = &c;
 883   in->next = &a;
 884   c.f = 42;
 885   __analyzer_eval (in->next->next->next->f == 42);  /* { dg-warning "TRUE" } */
 886 }
 887
 888 union u
 889 {
 890   int i;
 891   int *ptr;
 892 };
 893
 894 void test_41 (void)
 895 {
 896   union u u;
 897   u.i = 42;
 898   __analyzer_eval (u.i == 42); /* { dg-warning "TRUE" } */
 899   __analyzer_eval (u.ptr == NULL); /* { dg-warning "UNKNOWN|FALSE" } */
 900
 901   /* Writes to a union member should invalidate knowledge about other members.  */
 902   u.ptr = NULL;
 903   __analyzer_eval (u.ptr == NULL); /* { dg-warning "TRUE" } */
 904   __analyzer_eval (u.i == 42); /* { dg-warning "UNKNOWN|FALSE" } */
 905 }
 906
 907 void test_42 (void)
 908 {
 909   int i;
 910   float f;
 911   i = 42;
 912   f = i;
 913   __analyzer_eval (f == 42.0); /* { dg-warning "TRUE" } */
 914 }
 915
 916 void test_43 (void)
 917 {
 918   int i;
 919   float f;
 920   f = 42.0f;
 921   i = f;
 922   __analyzer_eval (i == 42);  /* { dg-warning "TRUE" } */
 923 }
 924
 925 struct sbits
 926 {
 927   signed int b0 : 1;
 928   signed int b123 : 3;
 929   signed int b456 : 3;
 930   signed int b7 : 1;
 931 };
 932
 933 void test_44 (void)
 934 {
 935   struct sbits bits;
 936   bits.b0 = -1;
 937   __analyzer_eval (bits.b0 == -1); /* { dg-warning "TRUE" } */
 938
 939   bits.b456 = -4;
 940   __analyzer_eval (bits.b456 == -4); /* { dg-warning "TRUE" } */
 941 };
 942
 943 struct ubits
 944 {
 945   unsigned int b0 : 1;
 946   unsigned int b123 : 3;
 947   unsigned int b456 : 3;
 948   unsigned int b7 : 1;
 949 };
 950
 951 void test_45 (void)
 952 {
 953   struct ubits bits;
 954   bits.b0 = 1;
 955   __analyzer_eval (bits.b0 == 1); /* { dg-warning "TRUE" } */
 956
 957   bits.b456 = 5;
 958   __analyzer_eval (bits.b456 == 5); /* { dg-warning "TRUE" } */
 959 };
 960
 961 extern const char *char_ptr;
 962
 963 int test_46 (void)
 964 {
 965   if (strcmp("literal", char_ptr))
 966     return 1;
 967   return 0;
 968 }
 969
 970 char test_47 (void)
 971 {
 972   static const char* my_version = "1.1.3";
 973   return my_version[0];
 974 }
 975
 976 unsigned test_48 (unsigned char *p, unsigned char *q)
 977 {
 978   return (unsigned int)(p - q);
 979 }
 980
 981 typedef struct {
 982   const char *filename;
 983   short lineno;
 984 } loc;
 985
 986 static loc loc_last;
 987
 988 void test_49 (void)
 989 {
 990   loc_last = __extension__(loc) { "", 328 };
 991   loc_last = __extension__(loc) { "", 333 };
 992 }
 993
 994 void test_50 (void *p, void *q)
 995 {
 996   __analyzer_eval (p == q); /* { dg-warning "UNKNOWN" } */
 997   __analyzer_eval (p == p); /* { dg-warning "TRUE" } */
 998   __analyzer_eval (q == q); /* { dg-warning "TRUE" } */
 999   __analyzer_eval (p == (struct coord *)p); /* { dg-warning "TRUE" } */
1000   __analyzer_eval (p == (const struct coord *)p); /* { dg-warning "TRUE" } */
1001
1002   struct coord *cp = (struct coord *)p;
1003   __analyzer_eval (p == cp); /* { dg-warning "TRUE" } */
1004
1005   struct coord *cq = (struct coord *)q;
1006   __analyzer_eval (q == cq); /* { dg-warning "TRUE" } */
1007
1008   __analyzer_eval (cp == cq); /* { dg-warning "UNKNOWN" } */
1009 }
1010
1011 void test_51 (struct coord c)
1012 {
1013   struct coord d;
1014   memcpy (&d, &c, sizeof (struct coord));
1015   __analyzer_eval (c.x == d.x); /* { dg-warning "TRUE" } */
1016   __analyzer_eval (c.y == d.y); /* { dg-warning "TRUE" } */
1017 }
1018
1019 struct big
1020 {
1021   int ia[1024];
1022 };
1023
1024 void test_52 (struct big b)
1025 {
1026   struct big d;
1027   memcpy (&d, &b, sizeof (struct big));
1028   __analyzer_eval (b.ia[0] == d.ia[0]); /* { dg-warning "TRUE" } */
1029   __analyzer_eval (b.ia[1023] == d.ia[1023]); /* { dg-warning "TRUE" } */
1030 }
1031
1032 void test_53 (const char *msg)
1033 {
1034   (void)fprintf(stderr, "LOG: %s", msg);
1035 }