1 // RUN: %clang_analyze_cc1 -w -analyzer-checker=core -analyzer-config exploration_strategy=unexplored_first -analyzer-output=text -verify %s
2 // RUN: %clang_analyze_cc1 -w -analyzer-checker=core -analyzer-config exploration_strategy=unexplored_first_queue -analyzer-output=text -verify %s
3 
4 extern int coin();
5 
6 int foo() {
7     int *x = 0; // expected-note {{'x' initialized to a null pointer value}}
8     while (coin()) { // expected-note{{Loop condition is true}}
9         if (coin())  // expected-note {{Taking true branch}}
10                      // expected-note@-1 {{Assuming the condition is true}}
11             return *x; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
12                        // expected-note@-1{{Dereference of null pointer (loaded from variable 'x')}}
13     }
14     return 0;
15 }
16 
17 void bar() {
18     while(coin())
19         if (coin())
20             foo();
21 }
22 
23 int foo2() {
24     int *x = 0; // expected-note {{'x' initialized to a null pointer value}}
25     while (coin()) { // expected-note{{Loop condition is true}}
26         if (coin())  // expected-note {{Taking false branch}}
27                      // expected-note@-1 {{Assuming the condition is false}}
28             return false;
29         else
30             return *x; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
31                        // expected-note@-1{{Dereference of null pointer (loaded from variable 'x')}}
32     }
33     return 0;
34 }
35 
36 void bar2() {
37     while(coin()) // expected-note{{Loop condition is true}}
38         if (coin()) // expected-note {{Assuming the condition is false}}
39                     // expected-note@-1 {{Taking false branch}}
40           return;
41         else
42             foo(); // expected-note{{Calling 'foo'}}
43 }
44