1 // RUN: %clang_analyze_cc1 -triple amdgcn-unknown-unknown \ 2 // RUN: -analyze -analyzer-checker=core,alpha.unix.cstring \ 3 // RUN: -analyze -analyzer-checker=debug.ExprInspection \ 4 // RUN: -analyzer-config crosscheck-with-z3=true -verify %s \ 5 // RUN: -Wno-incompatible-library-redeclaration 6 // REQUIRES: z3 7 8 void clang_analyzer_warnIfReached(); 9 10 // From https://llvm.org/docs/AMDGPUUsage.html#address-spaces, 11 // select address space 3 (local), since the pointer size is 12 // different than Generic. 13 #define DEVICE __attribute__((address_space(3))) 14 _Static_assert(sizeof(int *) == 8, ""); 15 _Static_assert(sizeof(DEVICE int *) == 4, ""); 16 _Static_assert(sizeof(void *) == 8, ""); 17 _Static_assert(sizeof(DEVICE void *) == 4, ""); 18 19 // Copy from host to device memory. Note this is specialized 20 // since one of the parameters is assigned an address space such 21 // that the sizeof the the pointer is different than the other. 22 // 23 // Some downstream implementations may have specialized memcpy 24 // routines that copy from one address space to another. In cases 25 // like that, the address spaces are assumed to not overlap, so the 26 // cstring overlap check is not needed. When a static analysis report 27 // is generated in as case like this, SMTConv may attempt to create 28 // a refutation to Z3 with different bitwidth pointers which lead to 29 // a crash. This is not common in directly used upstream compiler builds, 30 // but can be seen in specialized downstrean implementations. This case 31 // covers those specific instances found and debugged. 32 // 33 // Since memcpy is a builtin, a specialized builtin instance named like 34 // 'memcpy_special' will hit in cstring, triggering this behavior. The 35 // best we can do for an upstream test is use the same memcpy function name. 36 DEVICE void *memcpy(DEVICE void *dst, const void *src, unsigned long len); 37 38 void top1(DEVICE void *dst, void *src, int len) { 39 memcpy(dst, src, len); 40 41 // Create a bugreport for triggering Z3 refutation. 42 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}} 43 } 44 45 void top2(DEVICE int *dst, void *src, int len) { 46 memcpy(dst, src, len); 47 48 // Create a bugreport for triggering Z3 refutation. 49 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}} 50 } 51 52 void top3(DEVICE int *dst, int *src, int len) { 53 memcpy(dst, src, len); 54 55 // Create a bugreport for triggering Z3 refutation. 56 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}} 57 } 58 59 void top4() { 60 memcpy((DEVICE void *)1, (const void *)1, 1); 61 62 // Create a bugreport for triggering Z3 refutation. 63 clang_analyzer_warnIfReached(); // expected-warning {{REACHABLE}} 64 } 65