145
|
1 /* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-verbosity=2" } */
|
|
2 /* { dg-enable-nn-line-numbers "" } */
|
|
3
|
|
4 #include <stdlib.h>
|
|
5
|
|
6 void calls_free_1 (void *ptr)
|
|
7 {
|
|
8 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
|
|
9 }
|
|
10
|
|
11 void test_1 (void *ptr, int a, int b)
|
|
12 {
|
|
13 if (a)
|
|
14 calls_free_1 (ptr);
|
|
15
|
|
16 if (b)
|
|
17 {
|
|
18 }
|
|
19 else
|
|
20 calls_free_1 (ptr);
|
|
21 }
|
|
22
|
|
23 /* { dg-begin-multiline-output "" }
|
|
24 NN | free (ptr);
|
|
25 | ^~~~~~~~~~
|
|
26 'test_1': events 1-4
|
|
27 |
|
|
28 | NN | void test_1 (void *ptr, int a, int b)
|
|
29 | | ^~~~~~
|
|
30 | | |
|
|
31 | | (1) entry to 'test_1'
|
|
32 | NN | {
|
|
33 | NN | if (a)
|
|
34 | | ~
|
|
35 | | |
|
|
36 | | (2) following 'true' branch (when 'a != 0')...
|
|
37 | NN | calls_free_1 (ptr);
|
|
38 | | ~~~~~~~~~~~~~~~~~~
|
|
39 | | |
|
|
40 | | (3) ...to here
|
|
41 | | (4) calling 'calls_free_1' from 'test_1'
|
|
42 |
|
|
43 +--> 'calls_free_1': events 5-6
|
|
44 |
|
|
45 | NN | void calls_free_1 (void *ptr)
|
|
46 | | ^~~~~~~~~~~~
|
|
47 | | |
|
|
48 | | (5) entry to 'calls_free_1'
|
|
49 | NN | {
|
|
50 | NN | free (ptr);
|
|
51 | | ~~~~~~~~~~
|
|
52 | | |
|
|
53 | | (6) first 'free' here
|
|
54 |
|
|
55 <------+
|
|
56 |
|
|
57 'test_1': events 7-10
|
|
58 |
|
|
59 | NN | calls_free_1 (ptr);
|
|
60 | | ^~~~~~~~~~~~~~~~~~
|
|
61 | | |
|
|
62 | | (7) returning to 'test_1' from 'calls_free_1'
|
|
63 | NN |
|
|
64 | NN | if (b)
|
|
65 | | ~
|
|
66 | | |
|
|
67 | | (8) following 'false' branch (when 'b == 0')...
|
|
68 |......
|
|
69 | NN | calls_free_1 (ptr);
|
|
70 | | ~~~~~~~~~~~~~~~~~~
|
|
71 | | |
|
|
72 | | (9) ...to here
|
|
73 | | (10) passing freed pointer 'ptr' in call to 'calls_free_1' from 'test_1'
|
|
74 |
|
|
75 +--> 'calls_free_1': events 11-12
|
|
76 |
|
|
77 | NN | void calls_free_1 (void *ptr)
|
|
78 | | ^~~~~~~~~~~~
|
|
79 | | |
|
|
80 | | (11) entry to 'calls_free_1'
|
|
81 | NN | {
|
|
82 | NN | free (ptr);
|
|
83 | | ~~~~~~~~~~
|
|
84 | | |
|
|
85 | | (12) second 'free' here; first 'free' was at (6)
|
|
86 |
|
|
87 { dg-end-multiline-output "" } */
|
|
88
|
|
89 void calls_free_2 (void *ptr)
|
|
90 {
|
|
91 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
|
|
92 }
|
|
93
|
|
94 void test_2 (void *ptr, int a, int b)
|
|
95 {
|
|
96 switch (a)
|
|
97 {
|
|
98 default:
|
|
99 break;
|
|
100 case 1:
|
|
101 break;
|
|
102 case 3:
|
|
103 calls_free_2 (ptr);
|
|
104 break;
|
|
105 }
|
|
106
|
|
107 switch (b)
|
|
108 {
|
|
109 default:
|
|
110 calls_free_2 (ptr);
|
|
111 break;
|
|
112 case 1:
|
|
113 break;
|
|
114 case 42:
|
|
115 break;
|
|
116 }
|
|
117 }
|
|
118
|
|
119 /* { dg-begin-multiline-output "" }
|
|
120 NN | free (ptr);
|
|
121 | ^~~~~~~~~~
|
|
122 'test_2': events 1-4
|
|
123 |
|
|
124 | NN | void test_2 (void *ptr, int a, int b)
|
|
125 | | ^~~~~~
|
|
126 | | |
|
|
127 | | (1) entry to 'test_2'
|
|
128 | NN | {
|
|
129 | NN | switch (a)
|
|
130 | | ~~~~~~
|
|
131 | | |
|
|
132 | | (2) following 'case 3:' branch...
|
|
133 |......
|
|
134 | NN | case 3:
|
|
135 | | ~~~~
|
|
136 | | |
|
|
137 | | (3) ...to here
|
|
138 | NN | calls_free_2 (ptr);
|
|
139 | | ~~~~~~~~~~~~~~~~~~
|
|
140 | | |
|
|
141 | | (4) calling 'calls_free_2' from 'test_2'
|
|
142 |
|
|
143 +--> 'calls_free_2': events 5-6
|
|
144 |
|
|
145 | NN | void calls_free_2 (void *ptr)
|
|
146 | | ^~~~~~~~~~~~
|
|
147 | | |
|
|
148 | | (5) entry to 'calls_free_2'
|
|
149 | NN | {
|
|
150 | NN | free (ptr);
|
|
151 | | ~~~~~~~~~~
|
|
152 | | |
|
|
153 | | (6) first 'free' here
|
|
154 |
|
|
155 <------+
|
|
156 |
|
|
157 'test_2': events 7-10
|
|
158 |
|
|
159 | NN | calls_free_2 (ptr);
|
|
160 | | ^~~~~~~~~~~~~~~~~~
|
|
161 | | |
|
|
162 | | (7) returning to 'test_2' from 'calls_free_2'
|
|
163 |......
|
|
164 | NN | switch (b)
|
|
165 | | ~~~~~~
|
|
166 | | |
|
|
167 | | (8) following 'default:' branch...
|
|
168 | NN | {
|
|
169 | NN | default:
|
|
170 | | ~~~~~~~
|
|
171 | | |
|
|
172 | | (9) ...to here
|
|
173 | NN | calls_free_2 (ptr);
|
|
174 | | ~~~~~~~~~~~~~~~~~~
|
|
175 | | |
|
|
176 | | (10) passing freed pointer 'ptr' in call to 'calls_free_2' from 'test_2'
|
|
177 |
|
|
178 +--> 'calls_free_2': events 11-12
|
|
179 |
|
|
180 | NN | void calls_free_2 (void *ptr)
|
|
181 | | ^~~~~~~~~~~~
|
|
182 | | |
|
|
183 | | (11) entry to 'calls_free_2'
|
|
184 | NN | {
|
|
185 | NN | free (ptr);
|
|
186 | | ~~~~~~~~~~
|
|
187 | | |
|
|
188 | | (12) second 'free' here; first 'free' was at (6)
|
|
189 |
|
|
190 { dg-end-multiline-output "" } */
|
|
191
|
|
192 // TODO: range cases
|
|
193
|
|
194 /* The call/return to this function shouldn't appear in the path. */
|
|
195
|
|
196 void called_by_test_3 (void)
|
|
197 {
|
|
198 }
|
|
199
|
|
200 void test_3 (void *ptr)
|
|
201 {
|
|
202 free (ptr);
|
|
203 called_by_test_3 ();
|
|
204 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
|
|
205 }
|
|
206
|
|
207 /* { dg-begin-multiline-output "" }
|
|
208 NN | free (ptr);
|
|
209 | ^~~~~~~~~~
|
|
210 'test_3': events 1-2
|
|
211 |
|
|
212 | NN | free (ptr);
|
|
213 | | ^~~~~~~~~~
|
|
214 | | |
|
|
215 | | (1) first 'free' here
|
|
216 | NN | called_by_test_3 ();
|
|
217 | NN | free (ptr);
|
|
218 | | ~~~~~~~~~~
|
|
219 | | |
|
|
220 | | (2) second 'free' here; first 'free' was at (1)
|
|
221 |
|
|
222 { dg-end-multiline-output "" } */
|