1  #include "analyzer-decls.h"
       2  
       3  void test_1 (void)
       4  {
       5    __analyzer_dump_path (); /* { dg-message "path" } */
       6  }
       7  
       8  void test_2 (int flag)
       9  {
      10    if (flag)
      11      __analyzer_dump_path (); /* { dg-message "path" } */
      12  }
      13  
      14  void test_3 (int flag)
      15  {
      16    if (flag)
      17      if (!flag)
      18        __analyzer_dump_path (); /* { dg-bogus "path" } */
      19  }
      20  
      21  int global_for_test_4;
      22  static void __attribute__((noinline)) called_by_test_4 () {}
      23  void test_4 (void)
      24  {
      25    /* Verify that a state change that happens in a stmt that
      26       isn't the first within its BB can affect path feasibility.  */
      27    global_for_test_4 = 0;
      28    global_for_test_4 = 1;
      29    /* Thwart the optimizer.  */
      30    called_by_test_4 ();
      31    if (global_for_test_4)
      32      __analyzer_dump_path (); /* { dg-message "path" } */
      33  }
      34  
      35  /* Verify that loops don't confuse the feasibility checker.  */
      36  
      37  void test_5 (void)
      38  {
      39    for (int i = 0; i < 1024; i++)
      40      {
      41      }
      42    __analyzer_dump_path (); /* { dg-message "path" } */
      43  }
      44  
      45  /* Reproducer for an issue seen with CVE-2005-1689 (PR analyzer/96374): if we
      46     take the shortest path and update state and check feasibility per-edge, we
      47     can erroneously reject valid diagnostics.  */
      48  
      49  int test_6 (int a, int b)
      50  {
      51    int problem = 0;
      52    if (a)
      53      problem = 1;
      54    if (b)
      55      {
      56        if (!problem)
      57  	problem = 2;
      58        __analyzer_dump_path (); /* { dg-message "path" } */
      59      }
      60    return problem;
      61  }
      62  
      63  /* As above, but call a static function.
      64     Even if the path to the call of called_by_test_6a is falsely rejected
      65     as infeasible, it still makes sense to complain about errors within
      66     the called function.  */
      67  
      68  static void __attribute__((noinline))
      69  called_by_test_6a (void *ptr)
      70  {
      71    __builtin_free (ptr);
      72    __builtin_free (ptr); /* { dg-message "double-'free'" } */
      73  }
      74  
      75  int test_6a (int a, int b, void *ptr)
      76  {
      77    int problem = 0;
      78    if (a)
      79      problem = 1;
      80    if (b)
      81      {
      82        if (!problem)
      83  	problem = 2;
      84        called_by_test_6a (ptr);
      85      }
      86    return problem;
      87  }
      88  
      89  /* After state-merging, the shortest path skips the loop,
      90     but the shortest feasible path enters it.  */
      91  
      92  void test_7 (int n)
      93  {
      94    int entered_loop = 0;
      95    int i;
      96    for (i = 0; i < n; i++)
      97      entered_loop = 1;
      98    if (entered_loop)
      99      __analyzer_dump_path (); /* { dg-message "path" } */
     100  }