1 // RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-output=text -verify %s
2 // RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-output=plist-multi-file %s -o %t.plist
3 // RUN: %normalize_plist <%t.plist | diff -ub %S/Inputs/expected-plists/deref-track-symbolic-region.c.plist -
4
5 struct S {
6 int *x;
7 int y;
8 };
9
10 int *foo();
11
test(struct S syz,int * pp)12 void test(struct S syz, int *pp) {
13 int m = 0;
14 syz.x = foo(); // expected-note{{Value assigned to 'syz.x'}}
15
16 struct S *ps = &syz;
17 if (ps->x)
18 //expected-note@-1{{Assuming field 'x' is null}}
19 //expected-note@-2{{Taking false branch}}
20
21 m++;
22
23 m += *syz.x; // expected-warning{{Dereference of null pointer (loaded from field 'x')}}
24 // expected-note@-1{{Dereference of null pointer (loaded from field 'x')}}
25 }
26
testTrackConstraintBRVisitorIsTrackingTurnedOn(struct S syz,int * pp)27 void testTrackConstraintBRVisitorIsTrackingTurnedOn(struct S syz, int *pp) {
28 int m = 0;
29 syz.x = foo(); // expected-note{{Value assigned to 'syz.x'}}
30
31 struct S *ps = &syz;
32 if (ps->x)
33 //expected-note@-1{{Assuming field 'x' is null}}
34 //expected-note@-2{{Taking false branch}}
35
36 m++;
37 int *p = syz.x; //expected-note {{'p' initialized to a null pointer value}}
38 m = *p; // expected-warning {{Dereference of null pointer (loaded from variable 'p')}}
39 // expected-note@-1 {{Dereference of null pointer (loaded from variable 'p')}}
40 }
41
42