forked from github/codeql
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtrue_upon_entry.cpp
More file actions
106 lines (94 loc) · 1.86 KB
/
true_upon_entry.cpp
File metadata and controls
106 lines (94 loc) · 1.86 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
// This file tests that data flow cannot survive in a variable past a loop that
// always assigns to this variable.
int source();
void sink(...);
bool random();
int test1() {
int x = source();
for (int i = 0; i < 10; i++) {
x = 0;
}
sink(x); // $ SPURIOUS: ir
}
int test2(int iterations) {
int x = source();
for (int i = 0; i < iterations; i++) {
x = 0;
}
sink(x); // $ ast,ir
}
int test3() {
int x = 0;
for (int i = 0; i < 10; i++) {
x = source();
}
sink(x); // $ ast,ir
}
int test4() {
int x = source();
for (int i = 0; i < 10; i++) {
if (random())
break;
x = 0;
}
sink(x); // $ ast,ir
}
int test5() {
int x = source();
for (int i = 0; i < 10; i++) {
if (random())
continue;
x = 0;
}
sink(x); // $ ast,ir
}
int test6() {
int y;
int x = source();
for (int i = 0; i < 10 && (y = 1); i++) {
}
sink(x); // $ ast,ir
}
int test7() {
int y;
int x = source();
for (int i = 0; i < 10 && (y = 1); i++) {
x = 0;
}
sink(x); // $ SPURIOUS: ir
}
int test8() {
int x = source();
// It appears to the analysis that the condition can exit after `i < 10`
// without having assigned to `x`. That is an effect of how the
// true-upon-entry analysis considers the entire loop condition, while the
// analysis of where we might jump out of the loop condition considers every
// jump out of the condition, not just the last one.
for (int i = 0; i < 10 && (x = 1); i++) {
}
sink(x); // $ SPURIOUS: ast,ir
}
int test9() {
int y;
int x = source();
for (int i = 0; (y = 1) && i < 10; i++) {
}
sink(x); // $ ast,ir
}
int test10() {
int x = source();
for (int i = 0; (x = 1) && i < 10; i++) {
}
sink(x); // no flow
}
int test10(int b, int d) {
int i = 0;
int x = source();
if (b)
goto L;
for (; i < 10; i += d) {
x = 0;
L:
}
sink(x); // $ ir MISSING: ast
}