walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Bug hunting; Started to activate some itc tests for uninitialized variables

This commit is contained in:
Daniel Marjamäki 2020-05-15 20:58:33 +02:00
parent 6fb014a07a
commit 76f4fae806
4 changed files with 61 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/exprengine.cpp
View File

@ -1612,13 +1612,22 @@ static ExprEngine::ValuePtr executeBinaryOp(const Token *tok, Data &data)
{
ExprEngine::ValuePtr v1 = executeExpression(tok->astOperand1(), data);
ExprEngine::ValuePtr v2;
if (tok->str() == "&&" || tok->str() == "||") {
if (tok->str() == "?" && tok->astOperand1()->hasKnownIntValue()) {
if (tok->astOperand1()->getKnownIntValue())
v2 = executeExpression(tok->astOperand2()->astOperand1(), data);
else
v2 = executeExpression(tok->astOperand2()->astOperand2(), data);
call(data.callbacks, tok, v2, &data);
return v2;
} else if (tok->str() == "&&" || tok->str() == "||") {
Data data2(data);
data2.addConstraint(v1, tok->str() == "&&");
v2 = executeExpression(tok->astOperand2(), data2);
} else {
v2 = executeExpression(tok->astOperand2(), data);
}
if (v1 && v2) {
auto result = simplifyValue(std::make_shared<ExprEngine::BinOpResult>(tok->str(), v1, v2));
call(data.callbacks, tok, result, &data);
@ -1917,6 +1926,9 @@ static void execute(const Token *start, const Token *end, Data &data)
if (changedVariables.find(varid) != changedVariables.end())
continue;
changedVariables.insert(varid);
auto oldValue = data.getValue(varid, nullptr, nullptr);
if (oldValue && oldValue->isUninit())
call(data.callbacks, tok2->astOperand1(), oldValue, &data);
data.assignValue(tok2, varid, getValueRangeFromValueType(data.getNewSymbolName(), tok2->astOperand1()->valueType(), *data.settings));
} else if (Token::Match(tok2, "++|--") && tok2->astOperand1() && tok2->astOperand1()->variable()) {
// give variable "any" value
@ -1925,6 +1937,9 @@ static void execute(const Token *start, const Token *end, Data &data)
if (changedVariables.find(varid) != changedVariables.end())
continue;
changedVariables.insert(varid);
auto oldValue = data.getValue(varid, nullptr, nullptr);
if (oldValue && oldValue->type == ExprEngine::ValueType::UninitValue)
call(data.callbacks, tok2, oldValue, &data);
data.assignValue(tok2, varid, getValueRangeFromValueType(data.getNewSymbolName(), vartok->valueType(), *data.settings));
}
}
@ -2068,6 +2083,8 @@ void ExprEngine::executeFunction(const Scope *functionScope, ErrorLogger *errorL
try {
execute(functionScope->bodyStart, functionScope->bodyEnd, data);
} catch (VerifyException &e) {
if (settings->debugBugHunting)
report << "VerifyException tok.line:" << e.tok->linenr() << " what:" << e.what << "\n";
trackExecution.setAbortLine(e.tok->linenr());
auto bailoutValue = std::make_shared<BailoutValue>();
for (const Token *tok = e.tok; tok != functionScope->bodyEnd; tok = tok->next()) {

7
lib/symboldatabase.cpp
View File

@ -5724,7 +5724,12 @@ static const Token * parsedecl(const Token *type, ValueType * const valuetype, V
} else if (!valuetype->typeScope && (type->str() == "struct" || type->str() == "enum"))
valuetype->type = type->str() == "struct" ? ValueType::Type::RECORD : ValueType::Type::NONSTD;
else if (!valuetype->typeScope && type->type() && type->type()->classScope) {
valuetype->type = ValueType::Type::RECORD;
if (type->type()->classScope->type == Scope::ScopeType::eEnum) {
valuetype->type = ValueType::Type::INT;
valuetype->sign = ValueType::Sign::SIGNED;
} else {
valuetype->type = ValueType::Type::RECORD;
}
valuetype->typeScope = type->type()->classScope;
} else if (type->isName() && valuetype->sign != ValueType::Sign::UNKNOWN_SIGN && valuetype->pointer == 0U)
return nullptr;

45
test/bug-hunting/itc.py
View File

@ -16,11 +16,12 @@ else:
CPPCHECK_PATH = '../../cppcheck'
if len(sys.argv) >= 2 and sys.argv[-1] != '--clang':
TESTFILE = sys.argv[-1]
TESTFILES = [sys.argv[-1]]
else:
TESTFILE = os.path.expanduser('~/itc/01.w_Defects/zero_division.c')
if not os.path.isfile(TESTFILE):
print('ERROR: %s is not a file' % TESTFILE)
TESTFILES = [os.path.expanduser('~/itc/01.w_Defects/zero_division.c'),
os.path.expanduser('~/itc/01.w_Defects/uninit_var.c')]
if not os.path.isfile(TESTFILES[0]):
print('ERROR: %s is not a file' % TESTFILES[0])
sys.exit(1)
RUN_CLANG = ('--clang' in sys.argv)
@ -40,8 +41,7 @@ def check(filename):
'--platform=unix64',
filename]
if RUN_CLANG:
cmd += ['--clang', '--cppcheck-build-dir=itc-build-dir']
os.mkdir('itc-build-dir')
cmd.append('--clang')
print(' '.join(cmd))
p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
@ -52,9 +52,12 @@ def check(filename):
if RUN_CLANG:
shutil.rmtree('itc-build-dir')
w = r'.*zero_division.c:([0-9]+):[0-9]+: error:(inconclusive:)? There is division.*'
if TESTFILE.find('uninit_') > 0:
if filename.find('zero_division.c') >= 0:
w = r'.*zero_division.c:([0-9]+):[0-9]+: error: There is division.*'
elif filename.find('uninit_') >= 0:
w = r'.*c:([0-9]+):[0-9]+: error: .*bughuntingUninit.*'
else:
w = r'.*c:([0-9]+):[0-9]+: error: .*bughunting.*'
ret = []
for line in stderr.split('\n'):
@ -66,16 +69,20 @@ def check(filename):
ret.append(linenr)
return ret
wanted = get_error_lines(TESTFILE)
actual = check(TESTFILE)
print('wanted:' + str(wanted))
print('actual:' + str(actual))
missing = []
for w in wanted:
if w not in actual:
missing.append(w);
print('missing:' + str(missing))
if len(missing) > 0:
sys.exit(1)
for testfile in TESTFILES:
wanted = get_error_lines(testfile)
actual = check(testfile)
missing = []
for w in wanted:
if w not in actual:
missing.append(w);
if len(missing) > 0:
print('wanted:' + str(wanted))
print('actual:' + str(actual))
print('missing:' + str(missing))
# temporary hack because we have false negatives
if testfile.find('uninit_') >= 0 and missing[0] > 150:
continue
sys.exit(1)

11
test/testexprengine.cpp
View File

@ -63,6 +63,7 @@ private:
TEST_CASE(while2);
TEST_CASE(while3);
TEST_CASE(while4);
TEST_CASE(while5);
TEST_CASE(array1);
TEST_CASE(array2);
@ -459,6 +460,16 @@ private:
ASSERT_EQUALS("", expr(code, "=="));
}
void while5() {
const char code[] = "void f() {\n"
" int x;\n"
" while (cond)\n"
" x += 4;\n"
"}";
ASSERT(getRange(code, "x", 4).find("?") != std::string::npos);
}
void array1() {
ASSERT_EQUALS("(= 5 0)\nz3::unsat\n",
expr("int f() { int arr[10]; arr[4] = 5; return arr[4]==0; }", "=="));