Revert test case changes

Author: t-rasmud

clang/test/Analysis/ArrayBound/assumption-reporting.c

@@ -15,8 +15,8 @@ int TenElements[10];
 
 int irrelevantAssumptions(int arg) {
   int a = TenElements[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
+  // Here the analyzer assumes that `arg` is in bounds, but doesn't report this
+  // because `arg` is not interesting for the bug.
   int b = TenElements[13];
   // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
   // expected-note@-2 {{Access of 'TenElements' at index 13, while it holds only 10 'int' elements}}
@@ -26,10 +26,8 @@ int irrelevantAssumptions(int arg) {
 
 int assumingBoth(int arg) {
   int a = TenElements[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
-  int b = TenElements[arg]; // expected-warning{{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-1 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming index is non-negative and less than 10, the number of 'int' elements in 'TenElements'}}
+  int b = TenElements[arg]; // no additional note, we already assumed that 'arg' is in bounds
   int c = TenElements[arg + 10];
   // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
   // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
@@ -41,11 +39,9 @@ int assumingBothPointerToMiddle(int arg) {
   // will speak about the "byte offset" measured from the beginning of the TenElements.
   int *p = TenElements + 2;
   int a = p[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming byte offset is non-negative and less than 40, the extent of 'TenElements'}}
 
-  int b = TenElements[arg]; // expected-warning{{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-1 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  int b = TenElements[arg]; // This is normal access, and only the lower bound is new.
   int c = TenElements[arg + 10];
   // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
   // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
@@ -66,16 +62,15 @@ int assumingLower(int arg) {
 }
 
 int assumingUpper(int arg) {
-  // expected-note@+2 2{{Assuming 'arg' is >= 0}}
-  // expected-note@+1 2{{Taking false branch}}
+  // expected-note@+2 {{Assuming 'arg' is >= 0}}
+  // expected-note@+1 {{Taking false branch}}
   if (arg < 0)
     return 0;
   int a = TenElements[arg];
-  // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming index is less than 10, the number of 'int' elements in 'TenElements'}}
   int b = TenElements[arg - 10];
-  // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  // expected-warning@-1 {{Out of bound access to memory preceding 'TenElements'}}
+  // expected-note@-2 {{Access of 'TenElements' at a negative index}}
   return a + b;
 }
 
@@ -87,13 +82,12 @@ int assumingUpperIrrelevant(int arg) {
   // filter out assumptions that are logically irrelevant but "touch"
   // interesting symbols; eventually it would be good to add support for this.
 
-  // expected-note@+2 2{{Assuming 'arg' is >= 0}}
-  // expected-note@+1 2{{Taking false branch}}
+  // expected-note@+2 {{Assuming 'arg' is >= 0}}
+  // expected-note@+1 {{Taking false branch}}
   if (arg < 0)
     return 0;
   int a = TenElements[arg];
-  // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming index is less than 10, the number of 'int' elements in 'TenElements'}}
   int b = TenElements[arg + 10];
   // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
   // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
@@ -102,11 +96,10 @@ int assumingUpperIrrelevant(int arg) {
 
 int assumingUpperUnsigned(unsigned arg) {
   int a = TenElements[arg];
-  // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming index is less than 10, the number of 'int' elements in 'TenElements'}}
   int b = TenElements[(int)arg - 10];
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
+  // expected-warning@-1 {{Out of bound access to memory preceding 'TenElements'}}
+  // expected-note@-2 {{Access of 'TenElements' at a negative index}}
   return a + b;
 }
 
@@ -127,10 +120,8 @@ short assumingConvertedToCharP(int arg) {
   // result type of the subscript operator.
   char *cp = (char*)TenElements;
   char a = cp[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 40 'char' elements}}
-  char b = cp[arg]; // expected-warning{{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-1 {{Access of 'TenElements' at an overflowing index, while it holds only 40 'char' elements}}
+  // expected-note@-1 {{Assuming index is non-negative and less than 40, the number of 'char' elements in 'TenElements'}}
+  char b = cp[arg]; // no additional note, we already assumed that 'arg' is in bounds
   char c = cp[arg + 40];
   // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
   // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 40 'char' elements}}
@@ -147,14 +138,14 @@ int assumingConvertedToIntP(struct foo f, int arg) {
   // When indices are reported, the note will use the element type that's the
   // result type of the subscript operator.
   int a = ((int*)(f.a))[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'f.a'}}
-  // expected-note@-2 {{Access of 'f.a' at a negative or overflowing index, while it holds only 2 'int' elements}}
+  // expected-note@-1 {{Assuming index is non-negative and less than 2, the number of 'int' elements in 'f.a'}}
+  // However, if the extent of the memory region is not divisible by the
+  // element size, the checker measures the offset and extent in bytes.
   int b = ((int*)(f.b))[arg];
-  // expected-warning@-1 {{Out of bound access to memory after the end of 'f.b'}}
-  // expected-note@-2 {{Access of 'f.b' at an overflowing byte offset, while it holds only 5 bytes}}
+  // expected-note@-1 {{Assuming byte offset is less than 5, the extent of 'f.b'}}
   int c = TenElements[arg-2];
-  // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
+  // expected-warning@-1 {{Out of bound access to memory preceding 'TenElements'}}
+  // expected-note@-2 {{Access of 'TenElements' at a negative index}}
   return a + b + c;
 }
 
@@ -163,14 +154,16 @@ int assumingPlainOffset(struct foo f, int arg) {
   // shorter "offset" instead of "byte offset" when it's irrelevant that the
   // offset is measured in bytes.
 
-  // expected-note@+2 2{{Assuming 'arg' is < 2}}
-  // expected-note@+1 2{{Taking false branch}}
+  // expected-note@+2 {{Assuming 'arg' is < 2}}
+  // expected-note@+1 {{Taking false branch}}
   if (arg >= 2)
     return 0;
 
   int b = ((int*)(f.b))[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'f.b'}}
-  // expected-note@-2 {{Access of 'f.b' at a negative or overflowing byte offset, while it holds only 5 bytes}}
+  // expected-note@-1 {{Assuming byte offset is non-negative and less than 5, the extent of 'f.b'}}
+  // FIXME: this should be {{Assuming offset is non-negative}}
+  // but the current simplification algorithm doesn't realize that arg <= 1
+  // implies that the byte offset arg*4 will be less than 5.
 
   int c = TenElements[arg+10];
   // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
@@ -188,14 +181,13 @@ int assumingExtent(int arg) {
   int *mem = (int*)malloc(arg);
 
   mem[12] = 123;
-  // expected-warning@-1 {{Out of bound access to memory after the end of the heap area}}
-  // expected-note@-2 {{Access of 'int' element in the heap area at index 12}}
+  // expected-note@-1 {{Assuming index '12' is less than the number of 'int' elements in the heap area}}
 
   free(mem);
 
   return TenElements[arg];
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
+  // expected-warning@-1 {{Out of bound access to memory after the end of 'TenElements'}}
+  // expected-note@-2 {{Access of 'TenElements' at an overflowing index, while it holds only 10 'int' elements}}
 }
 
 int *extentInterestingness(int arg) {
@@ -204,8 +196,7 @@ int *extentInterestingness(int arg) {
   int *mem = (int*)malloc(arg);
 
   TenElements[arg] = 123;
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming index is non-negative and less than 10, the number of 'int' elements in 'TenElements'}}
 
   return &mem[12];
   // expected-warning@-1 {{Out of bound access to memory after the end of the heap area}}
@@ -217,7 +208,8 @@ int triggeredByAnyReport(int arg) {
   // not limited to ArrayBound reports but will appear on any bug report (that
   // marks the relevant symbol as interesting).
   TenElements[arg + 10] = 8;
-  // expected-warning@-1 {{Out of bound access to memory around 'TenElements'}}
-  // expected-note@-2 {{Access of 'TenElements' at a negative or overflowing index, while it holds only 10 'int' elements}}
+  // expected-note@-1 {{Assuming index is non-negative and less than 10, the number of 'int' elements in 'TenElements'}}
   return 1024 >> arg;
+  // expected-warning@-1 {{Right operand is negative in right shift}}
+  // expected-note@-2 {{The result of right shift is undefined because the right operand is negative}}
 }

clang/test/Analysis/ArrayBound/assumptions.c

@@ -12,63 +12,63 @@ void clang_analyzer_value(int);
 extern int FiveInts[5];
 
 void int_plus_one(int len) {
-  (void)FiveInts[len + 1]; // expected-warning {{Out of bound access to memory around 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{32s:{ [4, 2147483647] }}}
+  (void)FiveInts[len + 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
 }
 
 void int_neutral(int len) {
-  (void)FiveInts[len]; // expected-warning {{Out of bound access to memory around 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{32s:{ [5, 2147483647] }}}
+  (void)FiveInts[len]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
 }
 
 void int_minus_one(int len) {
-  (void)FiveInts[len - 1]; // expected-warning {{Out of bound access to memory around 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{32s:{ [-2147483648, -2147483648], [6, 2147483647] }}}
+  (void)FiveInts[len - 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
 }
 
 void unsigned_plus_one(unsigned len) {
-  (void)FiveInts[len + 1]; // expected-warning {{Out of bound access to memory after the end of 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{32u:{ [4, 4294967295] }}}
+  (void)FiveInts[len + 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
 }
 
 void unsigned_neutral(unsigned len) {
-  (void)FiveInts[len]; // expected-warning {{Out of bound access to memory after the end of 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{32u:{ [5, 4294967295] }}}
+  (void)FiveInts[len]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
 }
 
 void unsigned_minus_one(unsigned len) {
-  (void)FiveInts[len - 1]; // expected-warning {{Out of bound access to memory after the end of 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{32u:{ [0, 0], [6, 4294967295] }}
+  (void)FiveInts[len - 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
 }
 
 void ll_plus_one(long long len) {
-  (void)FiveInts[len + 1]; // expected-warning {{Out of bound access to memory around 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{64s:{ [4, 9223372036854775807] }}}
+  (void)FiveInts[len + 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
 }
 
 void ll_neutral(long long len) {
-  (void)FiveInts[len]; // expected-warning {{Out of bound access to memory around 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{64s:{ [5, 9223372036854775807] }}}
+  (void)FiveInts[len]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
 }
 
 void ll_minus_one(long long len) {
-  (void)FiveInts[len - 1]; // expected-warning {{Out of bound access to memory around 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{64s:{ [-9223372036854775808, -9223372036854775808], [6, 9223372036854775807] }}}
+  (void)FiveInts[len - 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
 }
 
 void ull_plus_one(unsigned long long len) {
-  (void)FiveInts[len + 1]; // expected-warning {{Out of bound access to memory after the end of 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{64u:{ [4, 18446744073709551615] }}}
+  (void)FiveInts[len + 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
 }
 
 void ull_neutral(unsigned long long len) {
-  (void)FiveInts[len]; // expected-warning {{Out of bound access to memory after the end of 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{64u:{ [5, 18446744073709551615] }}}
+  (void)FiveInts[len]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
 }
 
 void ull_minus_one(unsigned long long len) {
-  (void)FiveInts[len - 1]; // expected-warning {{Out of bound access to memory after the end of 'FiveInts'}}
-  clang_analyzer_value(len); // expected-warning {{64u:{ [0, 0], [6, 18446744073709551615] }}}
+  (void)FiveInts[len - 1]; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
 }
 
 // Also try the same with a dynamically allocated memory block, because in the
@@ -80,84 +80,84 @@ void free(void *);
 
 void dyn_int_plus_one(int len) {
   char *p = malloc(5);
-  p[len + 1] = 1; // expected-warning {{Out of bound access to memory around the heap area}}
-  clang_analyzer_value(len); // expected-warning {{32s:{ [4, 2147483647] }}}
+  p[len + 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
   free(p);
 }
 
 void dyn_int_neutral(int len) {
   char *p = malloc(5);
-  p[len] = 1; // expected-warning {{Out of bound access to memory around the heap area}}
-  clang_analyzer_value(len); // expected-warning {{32s:{ [5, 2147483647] }}}
+  p[len] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
   free(p);
 }
 
 void dyn_int_minus_one(int len) {
   char *p = malloc(5);
-  p[len - 1] = 1; // expected-warning {{Out of bound access to memory around the heap area}}
-  clang_analyzer_value(len); // expected-warning {{32s:{ [6, 2147483647] }}}
+  p[len - 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
   free(p);
 }
 
 void dyn_unsigned_plus_one(unsigned len) {
   char *p = malloc(5);
-  p[len + 1] = 1; // expected-warning {{Out of bound access to memory after the end of the heap area}}
-  clang_analyzer_value(len); // expected-warning {{32u:{ [4, 4294967295] }}}
+  p[len + 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
   free(p);
 }
 
 void dyn_unsigned_neutral(unsigned len) {
   char *p = malloc(5);
-  p[len] = 1; // expected-warning {{Out of bound access to memory after the end of the heap area}}
-  clang_analyzer_value(len); // expected-warning {{32u:{ [5, 4294967295] }}}
+  p[len] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
   free(p);
 }
 
 void dyn_unsigned_minus_one(unsigned len) {
   char *p = malloc(5);
-  p[len - 1] = 1; // expected-warning {{Out of bound access to memory after the end of the heap area}}
-  clang_analyzer_value(len); // expected-warning {{32u:{ [6, 4294967295] }}}
+  p[len - 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
   free(p);
 }
 
 void dyn_ll_plus_one(long long len) {
   char *p = malloc(5);
-  p[len + 1] = 1; // expected-warning {{Out of bound access to memory around the heap area}}
-  clang_analyzer_value(len); // expected-warning {{64s:{ [4, 9223372036854775807] }}}
+  p[len + 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [-1, 3] }}}
   free(p);
 }
 
 void dyn_ll_neutral(long long len) {
   char *p = malloc(5);
-  p[len] = 1; // expected-warning {{Out of bound access to memory around the heap area}}
-  clang_analyzer_value(len); // expected-warning {{64s:{ [5, 9223372036854775807] }}}
+  p[len] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
   free(p);
 }
 
 void dyn_ll_minus_one(long long len) {
   char *p = malloc(5);
-  p[len - 1] = 1; // expected-warning {{Out of bound access to memory around the heap area}}
-  clang_analyzer_value(len); // expected-warning {{64s:{ [-9223372036854775808, -9223372036854775808], [6, 9223372036854775807] }}}
+  p[len - 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
   free(p);
 }
 
 void dyn_ull_plus_one(unsigned long long len) {
   char *p = malloc(5);
-  p[len + 1] = 1; // expected-warning {{Out of bound access to memory after the end of the heap area}}
-  clang_analyzer_value(len); // expected-warning {{64u:{ [4, 18446744073709551615] }}}
+  p[len + 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 3] }}}
   free(p);
 }
 
 void dyn_ull_neutral(unsigned long long len) {
   char *p = malloc(5);
-  p[len] = 1; // expected-warning {{Out of bound access to memory after the end of the heap area}}
-  clang_analyzer_value(len); // expected-warning {{64u:{ [5, 18446744073709551615] }}}
+  p[len] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [0, 4] }}}
   free(p);
 }
 
 void dyn_ull_minus_one(unsigned long long len) {
   char *p = malloc(5);
-  p[len - 1] = 1; // expected-warning {{Out of bound access to memory after the end of the heap area}}
-  clang_analyzer_value(len); // expected-warning {{64u:{ [6, 9223372036854775808] }}}
+  p[len - 1] = 1; // no-warning
+  clang_analyzer_value(len); // expected-warning {{{ [1, 5] }}}
   free(p);
 }