uninit-variables.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533
  1. // RUN: %clang_cc1 -fsyntax-only -Wuninitialized -Wconditional-uninitialized -fsyntax-only -fblocks %s -verify
  2. typedef __typeof(sizeof(int)) size_t;
  3. void *malloc(size_t);
  4. int test1() {
  5. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  6. return x; // expected-warning{{variable 'x' is uninitialized when used here}}
  7. }
  8. int test2() {
  9. int x = 0;
  10. return x; // no-warning
  11. }
  12. int test3() {
  13. int x;
  14. x = 0;
  15. return x; // no-warning
  16. }
  17. int test4() {
  18. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  19. ++x; // expected-warning{{variable 'x' is uninitialized when used here}}
  20. return x;
  21. }
  22. int test5() {
  23. int x, y; // expected-note{{initialize the variable 'y' to silence this warning}}
  24. x = y; // expected-warning{{variable 'y' is uninitialized when used here}}
  25. return x;
  26. }
  27. int test6() {
  28. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  29. x += 2; // expected-warning{{variable 'x' is uninitialized when used here}}
  30. return x;
  31. }
  32. int test7(int y) {
  33. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  34. if (y) // expected-warning{{variable 'x' is used uninitialized whenever 'if' condition is false}} \
  35. // expected-note{{remove the 'if' if its condition is always true}}
  36. x = 1;
  37. return x; // expected-note{{uninitialized use occurs here}}
  38. }
  39. int test7b(int y) {
  40. int x = x; // expected-note{{variable 'x' is declared here}}
  41. if (y)
  42. x = 1;
  43. // Warn with "may be uninitialized" here (not "is sometimes uninitialized"),
  44. // since the self-initialization is intended to suppress a -Wuninitialized
  45. // warning.
  46. return x; // expected-warning{{variable 'x' may be uninitialized when used here}}
  47. }
  48. int test8(int y) {
  49. int x;
  50. if (y)
  51. x = 1;
  52. else
  53. x = 0;
  54. return x;
  55. }
  56. int test9(int n) {
  57. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  58. for (unsigned i = 0 ; i < n; ++i) {
  59. if (i == n - 1)
  60. break;
  61. x = 1;
  62. }
  63. return x; // expected-warning{{variable 'x' may be uninitialized when used here}}
  64. }
  65. int test10(unsigned n) {
  66. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  67. for (unsigned i = 0 ; i < n; ++i) {
  68. x = 1;
  69. }
  70. return x; // expected-warning{{variable 'x' may be uninitialized when used here}}
  71. }
  72. int test11(unsigned n) {
  73. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  74. for (unsigned i = 0 ; i <= n; ++i) {
  75. x = 1;
  76. }
  77. return x; // expected-warning{{variable 'x' may be uninitialized when used here}}
  78. }
  79. void test12(unsigned n) {
  80. for (unsigned i ; n ; ++i) ; // expected-warning{{variable 'i' is uninitialized when used here}} expected-note{{initialize the variable 'i' to silence this warning}}
  81. }
  82. int test13() {
  83. static int i;
  84. return i; // no-warning
  85. }
  86. // Simply don't crash on this test case.
  87. void test14() {
  88. const char *p = 0;
  89. for (;;) {}
  90. }
  91. void test15() {
  92. int x = x; // no-warning: signals intended lack of initialization.
  93. }
  94. int test15b() {
  95. // Warn here with the self-init, since it does result in a use of
  96. // an unintialized variable and this is the root cause.
  97. int x = x; // expected-warning {{variable 'x' is uninitialized when used within its own initialization}}
  98. return x;
  99. }
  100. // Don't warn in the following example; shows dataflow confluence.
  101. char *test16_aux();
  102. void test16() {
  103. char *p = test16_aux();
  104. for (unsigned i = 0 ; i < 100 ; i++)
  105. p[i] = 'a'; // no-warning
  106. }
  107. void test17() {
  108. // Don't warn multiple times about the same uninitialized variable
  109. // along the same path.
  110. int *x; // expected-note{{initialize the variable 'x' to silence this warning}}
  111. *x = 1; // expected-warning{{variable 'x' is uninitialized when used here}}
  112. *x = 1; // no-warning
  113. }
  114. int test18(int x, int y) {
  115. int z;
  116. if (x && y && (z = 1)) {
  117. return z; // no-warning
  118. }
  119. return 0;
  120. }
  121. int test19_aux1();
  122. int test19_aux2();
  123. int test19_aux3(int *x);
  124. int test19() {
  125. int z;
  126. if (test19_aux1() + test19_aux2() && test19_aux1() && test19_aux3(&z))
  127. return z; // no-warning
  128. return 0;
  129. }
  130. int test20() {
  131. int z; // expected-note{{initialize the variable 'z' to silence this warning}}
  132. if ((test19_aux1() + test19_aux2() && test19_aux1()) || test19_aux3(&z)) // expected-warning {{variable 'z' is used uninitialized whenever '||' condition is true}} expected-note {{remove the '||' if its condition is always false}}
  133. return z; // expected-note {{uninitialized use occurs here}}
  134. return 0;
  135. }
  136. int test21(int x, int y) {
  137. int z; // expected-note{{initialize the variable 'z' to silence this warning}}
  138. if ((x && y) || test19_aux3(&z) || test19_aux2()) // expected-warning {{variable 'z' is used uninitialized whenever '||' condition is true}} expected-note {{remove the '||' if its condition is always false}}
  139. return z; // expected-note {{uninitialized use occurs here}}
  140. return 0;
  141. }
  142. int test22() {
  143. int z;
  144. while (test19_aux1() + test19_aux2() && test19_aux1() && test19_aux3(&z))
  145. return z; // no-warning
  146. return 0;
  147. }
  148. int test23() {
  149. int z;
  150. for ( ; test19_aux1() + test19_aux2() && test19_aux1() && test19_aux3(&z) ; )
  151. return z; // no-warning
  152. return 0;
  153. }
  154. // The basic uninitialized value analysis doesn't have enough path-sensitivity
  155. // to catch initializations relying on control-dependencies spanning multiple
  156. // conditionals. This possibly can be handled by making the CFG itself
  157. // represent such control-dependencies, but it is a niche case.
  158. int test24(int flag) {
  159. unsigned val; // expected-note{{initialize the variable 'val' to silence this warning}}
  160. if (flag)
  161. val = 1;
  162. if (!flag)
  163. val = 1;
  164. return val; // expected-warning{{variable 'val' may be uninitialized when used here}}
  165. }
  166. float test25() {
  167. float x; // expected-note{{initialize the variable 'x' to silence this warning}}
  168. return x; // expected-warning{{variable 'x' is uninitialized when used here}}
  169. }
  170. typedef int MyInt;
  171. MyInt test26() {
  172. MyInt x; // expected-note{{initialize the variable 'x' to silence this warning}}
  173. return x; // expected-warning{{variable 'x' is uninitialized when used here}}
  174. }
  175. // Test handling of sizeof().
  176. int test27() {
  177. struct test_27 { int x; } *y;
  178. return sizeof(y->x); // no-warning
  179. }
  180. int test28() {
  181. int len; // expected-note{{initialize the variable 'len' to silence this warning}}
  182. return sizeof(int[len]); // expected-warning{{variable 'len' is uninitialized when used here}}
  183. }
  184. void test29() {
  185. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  186. (void) ^{ (void) x; }; // expected-warning{{variable 'x' is uninitialized when captured by block}}
  187. }
  188. void test30() {
  189. static int x; // no-warning
  190. (void) ^{ (void) x; };
  191. }
  192. void test31() {
  193. __block int x; // no-warning
  194. (void) ^{ (void) x; };
  195. }
  196. int test32_x;
  197. void test32() {
  198. (void) ^{ (void) test32_x; }; // no-warning
  199. }
  200. void test_33() {
  201. int x; // no-warning
  202. (void) x;
  203. }
  204. int test_34() {
  205. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  206. (void) x;
  207. return x; // expected-warning{{variable 'x' is uninitialized when used here}}
  208. }
  209. // Test that this case doesn't crash.
  210. void test35(int x) {
  211. __block int y = 0;
  212. ^{ y = (x == 0); }();
  213. }
  214. // Test handling of indirect goto.
  215. void test36()
  216. {
  217. void **pc; // expected-note{{initialize the variable 'pc' to silence this warning}}
  218. void *dummy[] = { &&L1, &&L2 };
  219. L1:
  220. goto *pc; // expected-warning{{variable 'pc' is uninitialized when used here}}
  221. L2:
  222. goto *pc;
  223. }
  224. // Test && nested in ||.
  225. int test37_a();
  226. int test37_b();
  227. int test37()
  228. {
  229. int identifier;
  230. if ((test37_a() && (identifier = 1)) ||
  231. (test37_b() && (identifier = 2))) {
  232. return identifier; // no-warning
  233. }
  234. return 0;
  235. }
  236. // Test merging of path-specific dataflow values (without asserting).
  237. int test38(int r, int x, int y)
  238. {
  239. int z;
  240. return ((r < 0) || ((r == 0) && (x < y)));
  241. }
  242. int test39(int x) {
  243. int y; // expected-note{{initialize the variable 'y' to silence this warning}}
  244. int z = x + y; // expected-warning {{variable 'y' is uninitialized when used here}}
  245. return z;
  246. }
  247. int test40(int x) {
  248. int y; // expected-note{{initialize the variable 'y' to silence this warning}}
  249. return x ? 1 : y; // expected-warning {{variable 'y' is uninitialized when used here}}
  250. }
  251. int test41(int x) {
  252. int y; // expected-note{{initialize the variable 'y' to silence this warning}}
  253. if (x) y = 1; // expected-warning{{variable 'y' is used uninitialized whenever 'if' condition is false}} \
  254. // expected-note{{remove the 'if' if its condition is always true}}
  255. return y; // expected-note{{uninitialized use occurs here}}
  256. }
  257. void test42() {
  258. int a;
  259. a = 30; // no-warning
  260. }
  261. void test43_aux(int x);
  262. void test43(int i) {
  263. int x; // expected-note{{initialize the variable 'x' to silence this warning}}
  264. for (i = 0 ; i < 10; i++)
  265. test43_aux(x++); // expected-warning {{variable 'x' is uninitialized when used here}}
  266. }
  267. void test44(int i) {
  268. int x = i;
  269. int y; // expected-note{{initialize the variable 'y' to silence this warning}}
  270. for (i = 0; i < 10; i++ ) {
  271. test43_aux(x++); // no-warning
  272. x += y; // expected-warning {{variable 'y' is uninitialized when used here}}
  273. }
  274. }
  275. int test45(int j) {
  276. int x = 1, y = x + 1;
  277. if (y) // no-warning
  278. return x;
  279. return y;
  280. }
  281. void test46()
  282. {
  283. int i; // expected-note{{initialize the variable 'i' to silence this warning}}
  284. int j = i ? : 1; // expected-warning {{variable 'i' is uninitialized when used here}}
  285. }
  286. void *test47(int *i)
  287. {
  288. return i ? : 0; // no-warning
  289. }
  290. void *test49(int *i)
  291. {
  292. int a;
  293. return &a ? : i; // no-warning
  294. }
  295. void test50()
  296. {
  297. char c[1 ? : 2]; // no-warning
  298. }
  299. int test51(void)
  300. {
  301. __block int a;
  302. ^(void) {
  303. a = 42;
  304. }();
  305. return a; // no-warning
  306. }
  307. // FIXME: This is a false positive, but it tests logical operations in switch statements.
  308. int test52(int a, int b) {
  309. int x; // expected-note {{initialize the variable 'x' to silence this warning}}
  310. switch (a || b) { // expected-warning {{switch condition has boolean value}}
  311. case 0:
  312. x = 1;
  313. break;
  314. case 1:
  315. x = 2;
  316. break;
  317. }
  318. return x; // expected-warning {{variable 'x' may be uninitialized when used here}}
  319. }
  320. void test53() {
  321. int x; // expected-note {{initialize the variable 'x' to silence this warning}}
  322. int y = (x); // expected-warning {{variable 'x' is uninitialized when used here}}
  323. }
  324. // This CFG caused the uninitialized values warning to inf-loop.
  325. extern int PR10379_g();
  326. void PR10379_f(int *len) {
  327. int new_len; // expected-note{{initialize the variable 'new_len' to silence this warning}}
  328. for (int i = 0; i < 42 && PR10379_g() == 0; i++) {
  329. if (PR10379_g() == 1)
  330. continue;
  331. if (PR10379_g() == 2)
  332. PR10379_f(&new_len);
  333. else if (PR10379_g() == 3)
  334. PR10379_f(&new_len);
  335. *len += new_len; // expected-warning {{variable 'new_len' may be uninitialized when used here}}
  336. }
  337. }
  338. // Test that sizeof(VLA) doesn't trigger a warning.
  339. void test_vla_sizeof(int x) {
  340. double (*memory)[2][x] = malloc(sizeof(*memory)); // no-warning
  341. }
  342. // Test absurd case of deadcode + use of blocks. This previously was a false positive
  343. // due to an analysis bug.
  344. int test_block_and_dead_code() {
  345. __block int x;
  346. ^{ x = 1; }();
  347. if (0)
  348. return x;
  349. return x; // no-warning
  350. }
  351. // This previously triggered an infinite loop in the analysis.
  352. void PR11069(int a, int b) {
  353. unsigned long flags;
  354. for (;;) {
  355. if (a && !b)
  356. break;
  357. }
  358. for (;;) {
  359. // This does not trigger a warning because it isn't a real use.
  360. (void)(flags); // no-warning
  361. }
  362. }
  363. // Test uninitialized value used in loop condition.
  364. void rdar9432305(float *P) {
  365. int i; // expected-note {{initialize the variable 'i' to silence this warning}}
  366. for (; i < 10000; ++i) // expected-warning {{variable 'i' is uninitialized when used here}}
  367. P[i] = 0.0f;
  368. }
  369. // Test that fixits are not emitted inside macros.
  370. #define UNINIT(T, x, y) T x; T y = x;
  371. #define ASSIGN(T, x, y) T y = x;
  372. void test54() {
  373. UNINIT(int, a, b); // expected-warning {{variable 'a' is uninitialized when used here}} \
  374. // expected-note {{variable 'a' is declared here}}
  375. int c; // expected-note {{initialize the variable 'c' to silence this warning}}
  376. ASSIGN(int, c, d); // expected-warning {{variable 'c' is uninitialized when used here}}
  377. }
  378. // Taking the address is fine
  379. struct { struct { void *p; } a; } test55 = { { &test55.a }}; // no-warning
  380. struct { struct { void *p; } a; } test56 = { { &(test56.a) }}; // no-warning
  381. void uninit_in_loop() {
  382. int produce(void);
  383. void consume(int);
  384. for (int n = 0; n < 100; ++n) {
  385. int k; // expected-note {{initialize}}
  386. consume(k); // expected-warning {{variable 'k' is uninitialized}}
  387. k = produce();
  388. }
  389. }
  390. void uninit_in_loop_goto() {
  391. int produce(void);
  392. void consume(int);
  393. for (int n = 0; n < 100; ++n) {
  394. goto skip_decl;
  395. int k; // expected-note {{initialize}}
  396. skip_decl:
  397. // FIXME: This should produce the 'is uninitialized' diagnostic, but we
  398. // don't have enough information in the CFG to easily tell that the
  399. // variable's scope has been left and re-entered.
  400. consume(k); // expected-warning {{variable 'k' may be uninitialized}}
  401. k = produce();
  402. }
  403. }
  404. typedef char jmp_buf[256];
  405. extern int setjmp(jmp_buf env); // implicitly returns_twice
  406. void do_stuff_and_longjmp(jmp_buf env, int *result) __attribute__((noreturn));
  407. int returns_twice() {
  408. int a; // expected-note {{initialize}}
  409. if (!a) { // expected-warning {{variable 'a' is uninitialized}}
  410. jmp_buf env;
  411. int b;
  412. if (setjmp(env) == 0) {
  413. do_stuff_and_longjmp(env, &b);
  414. } else {
  415. a = b; // no warning
  416. }
  417. }
  418. return a;
  419. }
  420. int compound_assign(int *arr, int n) {
  421. int sum; // expected-note {{initialize}}
  422. for (int i = 0; i < n; ++i)
  423. sum += arr[i]; // expected-warning {{variable 'sum' is uninitialized}}
  424. return sum / n;
  425. }
  426. int compound_assign_2() {
  427. int x; // expected-note {{initialize}}
  428. return x += 1; // expected-warning {{variable 'x' is uninitialized}}
  429. }
  430. int compound_assign_3() {
  431. int x; // expected-note {{initialize}}
  432. x *= 0; // expected-warning {{variable 'x' is uninitialized}}
  433. return x;
  434. }
  435. int self_init_in_cond(int *p) {
  436. int n = ((p && (0 || 1)) && (n = *p)) ? n : -1; // ok
  437. return n;
  438. }
  439. void test_analyzer_noreturn_aux() __attribute__((analyzer_noreturn));
  440. void test_analyzer_noreturn(int y) {
  441. int x; // expected-note {{initialize the variable 'x' to silence this warning}}
  442. if (y) {
  443. test_analyzer_noreturn_aux();
  444. ++x; // no-warning
  445. }
  446. else {
  447. ++x; // expected-warning {{variable 'x' is uninitialized when used here}}
  448. }
  449. }
  450. void test_analyzer_noreturn_2(int y) {
  451. int x;
  452. if (y) {
  453. test_analyzer_noreturn_aux();
  454. }
  455. else {
  456. x = 1;
  457. }
  458. ++x; // no-warning
  459. }