Index: clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
===================================================================
--- clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
+++ clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
@@ -268,12 +268,20 @@
/// but not written inside, and it has caused an undefined read or a null
/// pointer dereference outside.
class NoStoreFuncVisitor final : public BugReporterVisitor {
+
const SubRegion *RegionOfInterest;
const SourceManager &SM;
const PrintingPolicy &PP;
+ MemRegionManager &MmrMgr;
+
static constexpr const char *DiagnosticsMsg =
"Returning without writing to '";
+ /// Recursion limit for dereferencing fields when looking for the
+ /// region of interest.
+ /// The limit of two indicates that we will dereference fields only once.
+ static const unsigned DEREFERENCE_LIMIT = 2;
+
/// Frames writing into \c RegionOfInterest.
/// This visitor generates a note only if a function does not write into
/// a region of interest. This information is not immediately available
@@ -285,10 +293,14 @@
llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingRegion;
llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingCalculated;
+ using RegionVector = SmallVector<const MemRegion *, 5>;
+
public:
NoStoreFuncVisitor(const SubRegion *R, const ASTContext &Ctx,
- SourceManager &SM)
- : RegionOfInterest(R), SM(SM), PP(Ctx.getPrintingPolicy()) {}
+ SourceManager &SM,
+ MemRegionManager &MmrMgr)
+ : RegionOfInterest(R), SM(SM), PP(Ctx.getPrintingPolicy()),
+ MmrMgr(MmrMgr) {}
void Profile(llvm::FoldingSetNodeID &ID) const override {
static int Tag = 0;
@@ -306,50 +318,80 @@
auto CallExitLoc = N->getLocationAs<CallExitBegin>();
// No diagnostic if region was modified inside the frame.
- if (!CallExitLoc)
+ if (!CallExitLoc || isRegionOfInterestModifiedInFrame(N))
return nullptr;
CallEventRef<> Call =
BRC.getStateManager().getCallEventManager().getCaller(SCtx, State);
+ if (SM.isInSystemHeader(Call->getDecl()->getSourceRange().getBegin()))
+ return nullptr;
+
// Region of interest corresponds to an IVar, exiting a method
// which could have written into that IVar, but did not.
+ // TODO: two bugs here.
+ // 1. No graceful failure from inability to print the region.
+ // 2. Check into writing into ivar does not check whether
+ // it is in fact the ivar we care about: can it though?
if (const auto *MC = dyn_cast<ObjCMethodCall>(Call))
if (const auto *IvarR = dyn_cast<ObjCIvarRegion>(RegionOfInterest))
if (potentiallyWritesIntoIvar(Call->getRuntimeDefinition().getDecl(),
- IvarR->getDecl()) &&
- !isRegionOfInterestModifiedInFrame(N))
- return notModifiedMemberDiagnostics(
- Ctx, *CallExitLoc, Call, MC->getReceiverSVal().getAsRegion());
+ IvarR->getDecl()))
+ return notModifiedDiagnostics(
+ Ctx, *CallExitLoc, Call, {}, MC->getReceiverSVal().getAsRegion(),
+ "self", /*FirstIsReferenceType=*/false, 1);
if (const auto *CCall = dyn_cast<CXXConstructorCall>(Call)) {
const MemRegion *ThisR = CCall->getCXXThisVal().getAsRegion();
if (RegionOfInterest->isSubRegionOf(ThisR)
- && !CCall->getDecl()->isImplicit()
- && !isRegionOfInterestModifiedInFrame(N))
- return notModifiedMemberDiagnostics(Ctx, *CallExitLoc, Call, ThisR);
+ && !CCall->getDecl()->isImplicit())
+ return notModifiedDiagnostics(Ctx, *CallExitLoc, Call, {}, ThisR,
+ "this",
+ /*FirstIsReferenceType=*/false, 1);
+
+ // Do not generate diagnostics for not modified parameters in
+ // constructors.
+ return nullptr;
}
ArrayRef<ParmVarDecl *> parameters = getCallParameters(Call);
for (unsigned I = 0; I < Call->getNumArgs() && I < parameters.size(); ++I) {
const ParmVarDecl *PVD = parameters[I];
SVal S = Call->getArgSVal(I);
- unsigned IndirectionLevel = 1;
+ bool ParamIsReferenceType = PVD->getType()->isReferenceType();
+ std::string ParamName = PVD->getNameAsString();
+
+ int IndirectionLevel = 1;
QualType T = PVD->getType();
+
while (const MemRegion *R = S.getAsRegion()) {
- if (RegionOfInterest->isSubRegionOf(R)
- && !isPointerToConst(PVD->getType())) {
+ if (RegionOfInterest->isSubRegionOf(R) && !isPointerToConst(T))
+ return notModifiedDiagnostics(
+ Ctx, *CallExitLoc, Call,
+ {},
+ R,
+ ParamName,
+ ParamIsReferenceType,
+ IndirectionLevel);
- if (isRegionOfInterestModifiedInFrame(N))
- return nullptr;
- return notModifiedParameterDiagnostics(
- Ctx, *CallExitLoc, Call, PVD, R, IndirectionLevel);
- }
QualType PT = T->getPointeeType();
+
if (PT.isNull() || PT->isVoidType()) break;
+
+ if (const RecordDecl *RD = PT->getAsRecordDecl())
+ if (auto P = findRegionOfInterestInRecord(RD, State, R))
+ return notModifiedDiagnostics(Ctx,
+ *CallExitLoc, Call,
+ *P,
+ RegionOfInterest,
+ ParamName,
+ ParamIsReferenceType,
+ IndirectionLevel);
+
S = State->getSVal(R, PT);
T = PT;
+
IndirectionLevel++;
}
}
@@ -358,20 +400,91 @@
}
private:
+ /// Attempts to find the region of interest in a given CXX decl,
+ /// by either following the base classes or fields.
+ /// Dereferences fields up to a given recursion limit.
+ /// \return A chain fields leading to the region of interest or None.
+ const Optional<RegionVector>
+ findRegionOfInterestInRecord(const RecordDecl *RD, ProgramStateRef State,
+ const MemRegion *R,
+ RegionVector Vec = {},
+ int depth = 0) {
+
+ if (depth == DEREFERENCE_LIMIT) // Limit the recursion depth.
+ return None;
+
+ if (const auto *RDX = dyn_cast<CXXRecordDecl>(RD))
+ if (!RDX->hasDefinition())
+ return None;
+
+ // Recursively examine the base classes.
+ // Note that following base classes does not increase the recursion depth.
+ if (const auto *RDX = dyn_cast<CXXRecordDecl>(RD))
+ for (const auto II : RDX->bases())
+ if (const RecordDecl *RRD = II.getType()->getAsRecordDecl())
+ if (auto Out = findRegionOfInterestInRecord(RRD, State, R, Vec, depth))
+ return Out;
+
+ for (const FieldDecl *I : RD->fields()) {
+ QualType FT = I->getType();
+ const FieldRegion *FR = MmrMgr.getFieldRegion(I, cast<SubRegion>(R));
+ const SVal V = State->getSVal(FR);
+ const MemRegion *VR = V.getAsRegion();
+
+ RegionVector VecF = Vec;
+ VecF.push_back(FR);
+
+ if (RegionOfInterest == VR)
+ return VecF;
+
+ if (const RecordDecl *RRD = FT->getAsRecordDecl())
+ if (auto Out =
+ findRegionOfInterestInRecord(RRD, State, FR, VecF, depth + 1))
+ return Out;
+
+ QualType PT = FT->getPointeeType();
+ if (PT.isNull() || PT->isVoidType() || !VR) continue;
+
+ if (const RecordDecl *RRD = PT->getAsRecordDecl())
+ if (auto Out =
+ findRegionOfInterestInRecord(RRD, State, VR, VecF, depth + 1))
+ return Out;
+
+ }
+
+ return None;
+ }
/// \return Whether the method declaration \p Parent
/// syntactically has a binary operation writing into the ivar \p Ivar.
bool potentiallyWritesIntoIvar(const Decl *Parent,
const ObjCIvarDecl *Ivar) {
using namespace ast_matchers;
- if (!Parent)
+ const char * IvarBind = "Ivar";
+ if (!Parent || !Parent->hasBody())
return false;
StatementMatcher WriteIntoIvarM = binaryOperator(
- hasOperatorName("="), hasLHS(ignoringParenImpCasts(objcIvarRefExpr(
- hasDeclaration(equalsNode(Ivar))))));
+ hasOperatorName("="),
+ hasLHS(ignoringParenImpCasts(
+ objcIvarRefExpr(hasDeclaration(equalsNode(Ivar))).bind(IvarBind))));
StatementMatcher ParentM = stmt(hasDescendant(WriteIntoIvarM));
auto Matches = match(ParentM, *Parent->getBody(), Parent->getASTContext());
- return !Matches.empty();
+ for (BoundNodes &Match : Matches) {
+ auto IvarRef = Match.getNodeAs<ObjCIvarRefExpr>(IvarBind);
+ if (IvarRef->isFreeIvar())
+ return true; // Not quite sufficient.
+
+ const Expr *Base = IvarRef->getBase();
+ if (const auto *ICE = dyn_cast<ImplicitCastExpr>(Base))
+ Base = ICE->getSubExpr();
+
+ if (const auto *DRE = dyn_cast<DeclRefExpr>(Base))
+ if (DRE->getDecl()->getNameAsString() == "self")
+ return true;
+
+ return false;
+ }
+ return false;
}
/// Check and lazily calculate whether the region of interest is
@@ -442,56 +555,26 @@
Ty->getPointeeType().getCanonicalType().isConstQualified();
}
- /// \return Diagnostics piece for the member field not modified
- /// in a given function.
- std::shared_ptr<PathDiagnosticPiece> notModifiedMemberDiagnostics(
- const LocationContext *Ctx,
- CallExitBegin &CallExitLoc,
- CallEventRef<> Call,
- const MemRegion *ArgRegion) {
- const char *TopRegionName = isa<ObjCMethodCall>(Call) ? "self" : "this";
- SmallString<256> sbuf;
- llvm::raw_svector_ostream os(sbuf);
- os << DiagnosticsMsg;
- bool out = prettyPrintRegionName(TopRegionName, "->", /*IsReference=*/true,
- /*IndirectionLevel=*/1, ArgRegion, os, PP);
-
- // Return nothing if we have failed to pretty-print.
- if (!out)
- return nullptr;
-
- os << "'";
- PathDiagnosticLocation L =
- getPathDiagnosticLocation(CallExitLoc.getReturnStmt(), SM, Ctx, Call);
- return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
- }
-
- /// \return Diagnostics piece for the parameter \p PVD not modified
- /// in a given function.
- /// \p IndirectionLevel How many times \c ArgRegion has to be dereferenced
- /// before we get to the super region of \c RegionOfInterest
+ /// \return Diagnostics piece for region not modified in the current function.
std::shared_ptr<PathDiagnosticPiece>
- notModifiedParameterDiagnostics(const LocationContext *Ctx,
+ notModifiedDiagnostics(const LocationContext *Ctx,
CallExitBegin &CallExitLoc,
CallEventRef<> Call,
- const ParmVarDecl *PVD,
- const MemRegion *ArgRegion,
+ RegionVector FieldChain,
+ const MemRegion *MatchedRegion,
+ StringRef FirstElement,
+ bool FirstIsReferenceType,
unsigned IndirectionLevel) {
- PathDiagnosticLocation L = getPathDiagnosticLocation(
- CallExitLoc.getReturnStmt(), SM, Ctx, Call);
+
SmallString<256> sbuf;
llvm::raw_svector_ostream os(sbuf);
os << DiagnosticsMsg;
- bool IsReference = PVD->getType()->isReferenceType();
- const char *Sep = IsReference && IndirectionLevel == 1 ? "." : "->";
- bool Success = prettyPrintRegionName(
- PVD->getQualifiedNameAsString().c_str(),
- Sep, IsReference, IndirectionLevel, ArgRegion, os, PP);
-
- // Print the parameter name if the pretty-printing has failed.
- if (!Success)
- PVD->printQualifiedName(os);
+ prettyPrintRegionName(FirstElement, FirstIsReferenceType, MatchedRegion,
+ FieldChain, IndirectionLevel, os);
+
os << "'";
+ PathDiagnosticLocation L =
+ getPathDiagnosticLocation(CallExitLoc.getReturnStmt(), SM, Ctx, Call);
return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
}
@@ -507,59 +590,112 @@
Call->getRuntimeDefinition().getDecl()->getSourceRange().getEnd(), SM);
}
- /// Pretty-print region \p ArgRegion starting from parent to \p os.
+ /// Pretty-print region \p MatchedRegion starting from parent to \p os.
/// \return whether printing has succeeded
- bool prettyPrintRegionName(StringRef TopRegionName,
- StringRef Sep,
- bool IsReference,
- int IndirectionLevel,
- const MemRegion *ArgRegion,
- llvm::raw_svector_ostream &os,
- const PrintingPolicy &PP) {
- SmallVector<const MemRegion *, 5> Subregions;
+ bool prettyPrintRegionName(
+ StringRef FirstElement,
+ bool FirstIsReferenceType,
+ const MemRegion *MatchedRegion,
+ RegionVector FieldChain,
+ int IndirectionLevel,
+ llvm::raw_svector_ostream &os) {
+
+ RegionVector SubregionsReversed;
+
+ assert(RegionOfInterest->isSubRegionOf(MatchedRegion));
const MemRegion *R = RegionOfInterest;
- while (R != ArgRegion) {
- if (!(isa<FieldRegion>(R) || isa<CXXBaseObjectRegion>(R) ||
- isa<ObjCIvarRegion>(R)))
- return false; // Pattern-matching failed.
- Subregions.push_back(R);
+ while (R != MatchedRegion) {
+ SubregionsReversed.push_back(R);
R = cast<SubRegion>(R)->getSuperRegion();
}
- bool IndirectReference = !Subregions.empty();
+ SubregionsReversed.push_back(MatchedRegion);
- if (IndirectReference)
- IndirectionLevel--; // Due to "->" symbol.
+ RegionVector RegionSequence;
+ for (auto B = SubregionsReversed.rbegin(), E = SubregionsReversed.rend();
+ B != E; ++B)
+ RegionSequence.push_back(*B);
- if (IsReference)
- IndirectionLevel--; // Due to reference semantics.
+ RegionSequence.append(FieldChain.begin(), FieldChain.end());
+ bool PrintedFirst = false;
+ const MemRegion *PrevRegion = nullptr;
+ StringRef Sep;
- bool ShouldSurround = IndirectReference && IndirectionLevel > 0;
+ for (const MemRegion *I : RegionSequence) {
- if (ShouldSurround)
- os << "(";
- for (int i = 0; i < IndirectionLevel; i++)
- os << "*";
- os << TopRegionName;
- if (ShouldSurround)
- os << ")";
+ // Just keep going up to the base region.
+ if (isa<CXXBaseObjectRegion>(I) || isa<CXXTempObjectRegion>(I))
+ continue;
+
+ // Skip first region to be printed.
+ if (PrevRegion == nullptr) {
+ PrevRegion = I;
+ continue;
+ }
+
+ if (!PrintedFirst) {
+ Sep = prettyPrintFirstElement(FirstElement, FirstIsReferenceType,
+ /*MoreItemsExpected=*/true,
+ IndirectionLevel, os);
+ PrintedFirst = true;
+ }
- for (auto I = Subregions.rbegin(), E = Subregions.rend(); I != E; ++I) {
- if (const auto *FR = dyn_cast<FieldRegion>(*I)) {
- os << Sep;
+ os << Sep;
+
+ if (const auto *FR = dyn_cast<FieldRegion>(I)) {
FR->getDecl()->getDeclName().print(os, PP);
- Sep = ".";
- } else if (const auto *IR = dyn_cast<ObjCIvarRegion>(*I)) {
- os << "->";
+ Sep = FR->getValueType()->isAnyPointerType() ? "->" : ".";
+ } else if (const auto *VR = dyn_cast<VarRegion>(I)) {
+ VR->getDecl()->getDeclName().print(os, PP);
+ Sep = "."; // ? or * ?
+ } else if (const auto *IR = dyn_cast<ObjCIvarRegion>(I)) {
IR->getDecl()->getDeclName().print(os, PP);
Sep = ".";
- } else if (isa<CXXBaseObjectRegion>(*I)) {
- continue; // Just keep going up to the base region.
} else {
+ I->dump();
llvm_unreachable("Previous check has missed an unexpected region");
}
+
+ PrevRegion = I;
}
+
+ if (!PrintedFirst)
+ prettyPrintFirstElement(FirstElement, FirstIsReferenceType,
+ /*MoreItemsExpected=*/false, IndirectionLevel,
+ os);
+
return true;
}
+
+ /// Print first item in the chain, return new separator.
+ StringRef prettyPrintFirstElement(StringRef First,
+ bool IsReference,
+ bool MoreItemsExpected,
+ int IndirectionLevel,
+ llvm::raw_svector_ostream &os) {
+ if (IsReference)
+ IndirectionLevel--;
+
+ StringRef Out = ".";
+
+ if (MoreItemsExpected && IndirectionLevel > 0) {
+ IndirectionLevel--;
+ Out = "->";
+ }
+
+ if (IndirectionLevel > 0 && MoreItemsExpected)
+ os << "(";
+
+ for (int i=0; i<IndirectionLevel; i++) {
+ os << "*";
+ }
+
+ os << First;
+
+ if (IndirectionLevel > 0 && MoreItemsExpected)
+ os << ")";
+
+ return Out;
+ }
};
/// Suppress null-pointer-dereference bugs where dereferenced null was returned
@@ -1594,14 +1730,16 @@
LVNode->getSVal(Inner).getAsRegion();
if (R) {
+ ProgramStateRef S = N->getState();
// Mark both the variable region and its contents as interesting.
SVal V = LVState->getRawSVal(loc::MemRegionVal(R));
report.addVisitor(
llvm::make_unique<NoStoreFuncVisitor>(
cast<SubRegion>(R),
- N->getState()->getStateManager().getContext(),
- N->getState()->getAnalysisManager().getSourceManager()));
+ S->getStateManager().getContext(),
+ S->getAnalysisManager().getSourceManager(),
+ S->getStateManager().getRegionManager()));
MacroNullReturnSuppressionVisitor::addMacroVisitorIfNecessary(
N, R, EnableNullFPSuppression, report, V);
Index: clang/test/Analysis/diagnostics/no-store-func-path-notes.c
===================================================================
--- clang/test/Analysis/diagnostics/no-store-func-path-notes.c
+++ clang/test/Analysis/diagnostics/no-store-func-path-notes.c
@@ -224,3 +224,23 @@
return s.x; // expected-warning{{Undefined or garbage value returned to caller}}
// expected-note@-1{{Undefined or garbage value returned to caller}}
}
+
+typedef struct {
+ int *x;
+} D;
+
+void initializeMaybeInStruct(D* pD) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ *pD->x = 120;
+} // expected-note{{Returning without writing to 'pD->x'}}
+
+int useInitializeMaybeInStruct() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ D d;
+ d.x = &z;
+ initializeMaybeInStruct(&d); // expected-note{{Calling 'initializeMaybeInStruct'}}
+ // expected-note@-1{{Returning from 'initializeMaybeInStruct'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
Index: clang/test/Analysis/diagnostics/no-store-func-path-notes.cpp
===================================================================
--- clang/test/Analysis/diagnostics/no-store-func-path-notes.cpp
+++ clang/test/Analysis/diagnostics/no-store-func-path-notes.cpp
@@ -10,10 +10,10 @@
}
int param_not_initialized_by_func() {
- int p; // expected-note {{'p' declared without an initial value}}
- int out = initializer1(p, 0); // expected-note{{Calling 'initializer1'}}
+ int outP; // expected-note {{'outP' declared without an initial value}}
+ int out = initializer1(outP, 0); // expected-note{{Calling 'initializer1'}}
// expected-note@-1{{Returning from 'initializer1'}}
- return p; // expected-note{{Undefined or garbage value returned to caller}}
+ return outP; // expected-note{{Undefined or garbage value returned to caller}}
// expected-warning@-1{{Undefined or garbage value returned to caller}}
}
@@ -175,3 +175,137 @@
//expected-note@-1{{}}
(void)useLocal;
}
+
+////////
+
+struct HasRef {
+ int &a;
+ HasRef(int &a) : a(a) {}
+};
+
+
+void maybeInitialize(const HasRef &&pA) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ pA.a = 120;
+} // expected-note{{Returning without writing to 'pA.a'}}
+
+int useMaybeInitializerWritingIntoField() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ maybeInitialize(HasRef(z)); // expected-note{{Calling constructor for 'HasRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasRef'}}
+ // expected-note@-2{{Calling 'maybeInitialize'}}
+ // expected-note@-3{{Returning from 'maybeInitialize'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+void maybeInitialize(const HasRef *pA) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ pA->a = 120;
+} // expected-note{{Returning without writing to 'pA->a'}}
+
+int useMaybeInitializerStructByPointer() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ HasRef wrapper(z); // expected-note{{Calling constructor for 'HasRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasRef'}}
+ maybeInitialize(&wrapper); // expected-note{{Calling 'maybeInitialize'}}
+ // expected-note@-1{{Returning from 'maybeInitialize'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasParentWithRef : public HasRef {
+ HasParentWithRef(int &a) : HasRef(a) {} // expected-note{{Calling constructor for 'HasRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasRef'}}
+};
+
+void maybeInitializeWithParent(const HasParentWithRef &pA) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ pA.a = 120;
+} // expected-note{{Returning without writing to 'pA.a'}}
+
+int useMaybeInitializerWritingIntoParentField() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ maybeInitializeWithParent(HasParentWithRef(z)); // expected-note{{Calling constructor for 'HasParentWithRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasParentWithRef'}}
+ // expected-note@-2{{Calling 'maybeInitializeWithParent'}}
+ // expected-note@-3{{Returning from 'maybeInitializeWithParent'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasIndirectRef {
+ HasRef &Ref;
+ HasIndirectRef(HasRef &Ref) : Ref(Ref) {}
+};
+
+void maybeInitializeIndirectly(const HasIndirectRef &pA) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ pA.Ref.a = 120;
+} // expected-note{{Returning without writing to 'pA.Ref.a'}}
+
+int useMaybeInitializeIndirectly() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ HasRef r(z); // expected-note{{Calling constructor for 'HasRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasRef'}}
+ maybeInitializeIndirectly(HasIndirectRef(r)); // expected-note{{Calling 'maybeInitializeIndirectly'}}
+ // expected-note@-1{{Returning from 'maybeInitializeIndirectly'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasIndirectRefByValue {
+ HasRef Ref;
+ HasIndirectRefByValue(HasRef Ref) : Ref(Ref) {}
+};
+
+void maybeInitializeIndirectly(const HasIndirectRefByValue &pA) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ pA.Ref.a = 120;
+} // expected-note{{Returning without writing to 'pA.Ref.a'}}
+
+int useMaybeInitializeIndirectlyIndirectRefByValue() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ HasRef r(z); // expected-note{{Calling constructor for 'HasRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasRef'}}
+ maybeInitializeIndirectly(HasIndirectRefByValue(r)); // expected-note{{Calling 'maybeInitializeIndirectly'}}
+ // expected-note@-1{{Returning from 'maybeInitializeIndirectly'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasIndirectPointerRef {
+ HasRef *Ref;
+ HasIndirectPointerRef(HasRef *Ref) : Ref(Ref) {}
+};
+
+void maybeInitializeIndirectly(const HasIndirectPointerRef &pA) {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ pA.Ref->a = 120;
+} // expected-note{{Returning without writing to 'pA.Ref->a'}}
+
+int useMaybeInitializeIndirectlyWithPointer() {
+ int z; // expected-note{{'z' declared without an initial value}}
+ HasRef r(z); // expected-note{{Calling constructor for 'HasRef'}}
+ // expected-note@-1{{Returning from constructor for 'HasRef'}}
+ maybeInitializeIndirectly(HasIndirectPointerRef(&r)); // expected-note{{Calling 'maybeInitializeIndirectly'}}
+ // expected-note@-1{{Returning from 'maybeInitializeIndirectly'}}
+ return z; // expected-warning{{Undefined or garbage value returned to caller}}
+ // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
Index: clang/test/Analysis/diagnostics/no-store-func-path-notes.m
===================================================================
--- clang/test/Analysis/diagnostics/no-store-func-path-notes.m
+++ clang/test/Analysis/diagnostics/no-store-func-path-notes.m
@@ -52,7 +52,6 @@
extern void expectNonNull(NSString * _Nonnull a);
@interface A : NSObject
-- (void) func;
- (void) initAMaybe;
@end
@@ -66,7 +65,7 @@
a = @"string";
} // expected-note{{Returning without writing to 'self->a'}}
-- (void) func {
+- (void) passNullToNonnull {
a = nil; // expected-note{{nil object reference stored to 'a'}}
[self initAMaybe]; // expected-note{{Calling 'initAMaybe'}}
// expected-note@-1{{Returning from 'initAMaybe'}}
@@ -74,4 +73,33 @@
// expected-note@-1{{nil passed to a callee that requires a non-null 1st parameter}}
}
+- (void) initAMaybeWithExplicitSelf {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ self->a = @"string";
+} // expected-note{{Returning without writing to 'self->a'}}
+
+- (void) passNullToNonnullWithExplicitSelf {
+ self->a = nil; // expected-note{{nil object reference stored to 'a'}}
+ [self initAMaybeWithExplicitSelf]; // expected-note{{Calling 'initAMaybeWithExplicitSelf'}}
+ // expected-note@-1{{Returning from 'initAMaybeWithExplicitSelf'}}
+ expectNonNull(a); // expected-warning{{nil passed to a callee that requires a non-null 1st parameter}}
+ // expected-note@-1{{nil passed to a callee that requires a non-null 1st parameter}}
+}
+
+- (void) initPassedAMaybe:(A *) param {
+ if (coin()) // expected-note{{Assuming the condition is false}}
+ // expected-note@-1{{Taking false branch}}
+ param->a = @"string";
+} // expected-note{{Returning without writing to 'param->a'}}
+
+- (void) useInitPassedAMaybe:(A *) paramA {
+ paramA->a = nil; // expected-note{{nil object reference stored to 'a'}}
+ [self initPassedAMaybe:paramA]; // expected-note{{Calling 'initPassedAMaybe:'}}
+ // expected-note@-1{{Returning from 'initPassedAMaybe:'}}
+ expectNonNull(paramA->a); // expected-warning{{nil passed to a callee that requires a non-null 1st parameter}}
+ // expected-note@-1{{nil passed to a callee that requires a non-null 1st parameter}}
+
+}
+
@end