1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
// RUN: %clang_analyze_cc1 %s \
// RUN: -analyzer-checker=core \
// RUN: -analyzer-checker=alpha.unix.cstring.OutOfBounds,alpha.unix.cstring.UninitializedRead \
// RUN: -analyzer-config eagerly-assume=false \
// RUN: -verify
// expected-no-diagnostics
typedef typeof(sizeof(int)) size_t;
void *memmove(void *, const void *, size_t);
typedef struct {
char a[1024];
} b;
int c;
b *invalidate();
int d() {
b *a = invalidate();
if (c < 1024)
return 0;
int f = c & ~3, g = f;
g--;
if (g)
return 0;
// Parent state is already infeasible.
// clang_analyzer_printState();
// "constraints": [
// { "symbol": "(derived_$3{conj_$0{int, LC1, S728, #1},c}) & -4", "range": "{ [1, 1] }" },
// { "symbol": "derived_$3{conj_$0{int, LC1, S728, #1},c}", "range": "{ [1024, 2147483647] }" }
// ],
// This sould not crash!
// It crashes in baseline, since there both true and false states are nullptr!
memmove(a->a, &a->a[f], c - f);
return 0;
}
|
