hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #251 from rdmarsh2/rdmarsh/cpp/sign-analysis

Browse Source 
C++: Sign analysis library
This commit is contained in:
Jonas Jensen
2018-11-12 15:23:18 +01:00
committed by GitHub
parent dd6fd400aa d9495da225
commit 0cb09b113f
14 changed files with 1817 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
cpp/ql/src/semmle/code/cpp/controlflow/IRGuards.qll
View File

@@ -171,7 +171,7 @@ private class GuardConditionFromIR extends GuardCondition {
exists(Instruction li, Instruction ri |
li.getUnconvertedResultExpression() = left and
ri.getUnconvertedResultExpression() = right and
ir.comparesLt(li, ri, k, isLessThan, testIsTrue)
ir.comparesLt(li.getAUse(), ri.getAUse(), k, isLessThan, testIsTrue)
)
}
@@ -181,7 +181,7 @@ private class GuardConditionFromIR extends GuardCondition {
exists(Instruction li, Instruction ri, boolean testIsTrue |
li.getUnconvertedResultExpression() = left and
ri.getUnconvertedResultExpression() = right and
ir.comparesLt(li, ri, k, isLessThan, testIsTrue) and
ir.comparesLt(li.getAUse(), ri.getAUse(), k, isLessThan, testIsTrue) and
this.controls(block, testIsTrue)
)
}
@@ -191,7 +191,7 @@ private class GuardConditionFromIR extends GuardCondition {
exists(Instruction li, Instruction ri |
li.getUnconvertedResultExpression() = left and
ri.getUnconvertedResultExpression() = right and
ir.comparesEq(li, ri, k, areEqual, testIsTrue)
ir.comparesEq(li.getAUse(), ri.getAUse(), k, areEqual, testIsTrue)
)
}
@@ -201,8 +201,8 @@ private class GuardConditionFromIR extends GuardCondition {
exists(Instruction li, Instruction ri, boolean testIsTrue |
li.getUnconvertedResultExpression() = left and
ri.getUnconvertedResultExpression() = right and
ir.comparesEq(li, ri, k, areEqual, testIsTrue)
and this.controls(block, testIsTrue)
ir.comparesEq(li.getAUse(), ri.getAUse(), k, areEqual, testIsTrue) and
this.controls(block, testIsTrue)
)
}
@@ -269,26 +269,26 @@ class IRGuardCondition extends Instruction {
}
/** Holds if (determined by this guard) `left < right + k` evaluates to `isLessThan` if this expression evaluates to `testIsTrue`. */
cached predicate comparesLt(Instruction left, Instruction right, int k, boolean isLessThan, boolean testIsTrue) {
cached predicate comparesLt(Operand left, Operand right, int k, boolean isLessThan, boolean testIsTrue) {
compares_lt(this, left, right, k, isLessThan, testIsTrue)
}
/** Holds if (determined by this guard) `left < right + k` must be `isLessThan` in `block`.
If `isLessThan = false` then this implies `left >= right + k`. */
cached predicate ensuresLt(Instruction left, Instruction right, int k, IRBlock block, boolean isLessThan) {
cached predicate ensuresLt(Operand left, Operand right, int k, IRBlock block, boolean isLessThan) {
exists(boolean testIsTrue |
compares_lt(this, left, right, k, isLessThan, testIsTrue) and this.controls(block, testIsTrue)
)
}
/** Holds if (determined by this guard) `left == right + k` evaluates to `areEqual` if this expression evaluates to `testIsTrue`. */
cached predicate comparesEq(Instruction left, Instruction right, int k, boolean areEqual, boolean testIsTrue) {
cached predicate comparesEq(Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue) {
compares_eq(this, left, right, k, areEqual, testIsTrue)
}
/** Holds if (determined by this guard) `left == right + k` must be `areEqual` in `block`.
If `areEqual = false` then this implies `left != right + k`. */
cached predicate ensuresEq(Instruction left, Instruction right, int k, IRBlock block, boolean areEqual) {
cached predicate ensuresEq(Operand left, Operand right, int k, IRBlock block, boolean areEqual) {
exists(boolean testIsTrue |
compares_eq(this, left, right, k, areEqual, testIsTrue) and this.controls(block, testIsTrue)
)
@@ -328,7 +328,7 @@ private predicate is_condition(Instruction guard) {
*
* Beware making mistaken logical implications here relating `areEqual` and `testIsTrue`.
*/
private predicate compares_eq(Instruction test, Instruction left, Instruction right, int k, boolean areEqual, boolean testIsTrue) {
private predicate compares_eq(Instruction test, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue) {
/* The simple case where the test *is* the comparison so areEqual = testIsTrue xor eq. */
exists(boolean eq | simple_comparison_eq(test, left, right, k, eq) |
areEqual = true and testIsTrue = eq or areEqual = false and testIsTrue = eq.booleanNot()
@@ -349,13 +349,13 @@ private predicate compares_eq(Instruction test, Instruction left, Instruction ri
}
/** Rearrange various simple comparisons into `left == right + k` form. */
private predicate simple_comparison_eq(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean areEqual) {
left = cmp.getLeftOperand() and cmp instanceof CompareEQInstruction and right = cmp.getRightOperand() and k = 0 and areEqual = true
private predicate simple_comparison_eq(CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual) {
left = cmp.getAnOperand().(LeftOperand) and cmp instanceof CompareEQInstruction and right = cmp.getAnOperand().(RightOperand) and k = 0 and areEqual = true
or
left = cmp.getLeftOperand() and cmp instanceof CompareNEInstruction and right = cmp.getRightOperand() and k = 0 and areEqual = false
left = cmp.getAnOperand().(LeftOperand) and cmp instanceof CompareNEInstruction and right = cmp.getAnOperand().(RightOperand) and k = 0 and areEqual = false
}
private predicate complex_eq(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean areEqual, boolean testIsTrue) {
private predicate complex_eq(CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue) {
sub_eq(cmp, left, right, k, areEqual, testIsTrue)
or
add_eq(cmp, left, right, k, areEqual, testIsTrue)
@@ -367,7 +367,7 @@ private predicate complex_eq(CompareInstruction cmp, Instruction left, Instructi
*/
/** Holds if `left < right + k` evaluates to `isLt` given that test is `testIsTrue`. */
private predicate compares_lt(Instruction test, Instruction left, Instruction right, int k, boolean isLt, boolean testIsTrue) {
private predicate compares_lt(Instruction test, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue) {
/* In the simple case, the test is the comparison, so isLt = testIsTrue */
simple_comparison_lt(test, left, right, k) and isLt = true and testIsTrue = true
or
@@ -387,22 +387,22 @@ private predicate compares_lt(Instruction test, Instruction left, Instruction ri
}
/** `(a < b + k) => (b > a - k) => (b >= a + (1-k))` */
private predicate compares_ge(Instruction test, Instruction left, Instruction right, int k, boolean isGe, boolean testIsTrue) {
private predicate compares_ge(Instruction test, Operand left, Operand right, int k, boolean isGe, boolean testIsTrue) {
exists(int onemk | k = 1 - onemk | compares_lt(test, right, left, onemk, isGe, testIsTrue))
}
/** Rearrange various simple comparisons into `left < right + k` form. */
private predicate simple_comparison_lt(CompareInstruction cmp, Instruction left, Instruction right, int k) {
left = cmp.getLeftOperand() and cmp instanceof CompareLTInstruction and right = cmp.getRightOperand() and k = 0
private predicate simple_comparison_lt(CompareInstruction cmp, Operand left, Operand right, int k) {
left = cmp.getAnOperand().(LeftOperand) and cmp instanceof CompareLTInstruction and right = cmp.getAnOperand().(RightOperand) and k = 0
or
left = cmp.getLeftOperand() and cmp instanceof CompareLEInstruction and right = cmp.getRightOperand() and k = 1
left = cmp.getAnOperand().(LeftOperand) and cmp instanceof CompareLEInstruction and right = cmp.getAnOperand().(RightOperand) and k = 1
or
right = cmp.getLeftOperand() and cmp instanceof CompareGTInstruction and left = cmp.getRightOperand() and k = 0
right = cmp.getAnOperand().(LeftOperand) and cmp instanceof CompareGTInstruction and left = cmp.getAnOperand().(RightOperand) and k = 0
or
right = cmp.getLeftOperand() and cmp instanceof CompareGEInstruction and left = cmp.getRightOperand() and k = 1
right = cmp.getAnOperand().(LeftOperand) and cmp instanceof CompareGEInstruction and left = cmp.getAnOperand().(RightOperand) and k = 1
}
private predicate complex_lt(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean isLt, boolean testIsTrue) {
private predicate complex_lt(CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue) {
sub_lt(cmp, left, right, k, isLt, testIsTrue)
or
add_lt(cmp, left, right, k, isLt, testIsTrue)
@@ -411,33 +411,33 @@ private predicate complex_lt(CompareInstruction cmp, Instruction left, Instructi
/* left - x < right + c => left < right + (c+x)
left < (right - x) + c => left < right + (c-x) */
private predicate sub_lt(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean isLt, boolean testIsTrue) {
exists(SubInstruction lhs, int c, int x | compares_lt(cmp, lhs, right, c, isLt, testIsTrue) and
left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
private predicate sub_lt(CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue) {
exists(SubInstruction lhs, int c, int x | compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
left = lhs.getAnOperand().(LeftOperand) and x = int_value(lhs.getRightOperand())
and k = c + x
)
or
exists(SubInstruction rhs, int c, int x | compares_lt(cmp, left, rhs, c, isLt, testIsTrue) and
right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
exists(SubInstruction rhs, int c, int x | compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
right = rhs.getAnOperand().(LeftOperand) and x = int_value(rhs.getRightOperand())
and k = c - x
)
}
/* left + x < right + c => left < right + (c-x)
left < (right + x) + c => left < right + (c+x) */
private predicate add_lt(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean isLt, boolean testIsTrue) {
exists(AddInstruction lhs, int c, int x | compares_lt(cmp, lhs, right, c, isLt, testIsTrue) and
(left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
private predicate add_lt(CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue) {
exists(AddInstruction lhs, int c, int x | compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
(left = lhs.getAnOperand().(LeftOperand) and x = int_value(lhs.getRightOperand())
or
left = lhs.getRightOperand() and x = int_value(lhs.getLeftOperand())
left = lhs.getAnOperand().(RightOperand) and x = int_value(lhs.getLeftOperand())
)
and k = c - x
)
or
exists(AddInstruction rhs, int c, int x | compares_lt(cmp, left, rhs, c, isLt, testIsTrue) and
(right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
exists(AddInstruction rhs, int c, int x | compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
(right = rhs.getAnOperand().(LeftOperand) and x = int_value(rhs.getRightOperand())
or
right = rhs.getRightOperand() and x = int_value(rhs.getLeftOperand())
right = rhs.getAnOperand().(RightOperand) and x = int_value(rhs.getLeftOperand())
)
and k = c + x
)
@@ -446,14 +446,14 @@ private predicate add_lt(CompareInstruction cmp, Instruction left, Instruction r
/* left - x == right + c => left == right + (c+x)
left == (right - x) + c => left == right + (c-x) */
private predicate sub_eq(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean areEqual, boolean testIsTrue) {
exists(SubInstruction lhs, int c, int x | compares_eq(cmp, lhs, right, c, areEqual, testIsTrue) and
left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
private predicate sub_eq(CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue) {
exists(SubInstruction lhs, int c, int x | compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
left = lhs.getAnOperand().(LeftOperand) and x = int_value(lhs.getRightOperand())
and k = c + x
)
or
exists(SubInstruction rhs, int c, int x | compares_eq(cmp, left, rhs, c, areEqual, testIsTrue) and
right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
exists(SubInstruction rhs, int c, int x | compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
right = rhs.getAnOperand().(LeftOperand) and x = int_value(rhs.getRightOperand())
and k = c - x
)
}
@@ -461,19 +461,19 @@ private predicate sub_eq(CompareInstruction cmp, Instruction left, Instruction r
/* left + x == right + c => left == right + (c-x)
left == (right + x) + c => left == right + (c+x) */
private predicate add_eq(CompareInstruction cmp, Instruction left, Instruction right, int k, boolean areEqual, boolean testIsTrue) {
exists(AddInstruction lhs, int c, int x | compares_eq(cmp, lhs, right, c, areEqual, testIsTrue) and
(left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
private predicate add_eq(CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue) {
exists(AddInstruction lhs, int c, int x | compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
(left = lhs.getAnOperand().(LeftOperand) and x = int_value(lhs.getRightOperand())
or
left = lhs.getRightOperand() and x = int_value(lhs.getLeftOperand())
left = lhs.getAnOperand().(RightOperand) and x = int_value(lhs.getLeftOperand())
)
and k = c - x
)
or
exists(AddInstruction rhs, int c, int x | compares_eq(cmp, left, rhs, c, areEqual, testIsTrue) and
(right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
exists(AddInstruction rhs, int c, int x | compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
(right = rhs.getAnOperand().(LeftOperand) and x = int_value(rhs.getRightOperand())
or
right = rhs.getRightOperand() and x = int_value(rhs.getLeftOperand())
right = rhs.getAnOperand().(RightOperand) and x = int_value(rhs.getLeftOperand())
)
and k = c + x
)

6
cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
View File

@@ -761,6 +761,12 @@ class RemInstruction extends BinaryInstruction {
}
}
class NegateInstruction extends UnaryInstruction {
NegateInstruction() {
opcode instanceof Opcode::Negate
}
}
class BitAndInstruction extends BinaryInstruction {
BitAndInstruction() {
opcode instanceof Opcode::BitAnd

6
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
View File

@@ -761,6 +761,12 @@ class RemInstruction extends BinaryInstruction {
}
}
class NegateInstruction extends UnaryInstruction {
NegateInstruction() {
opcode instanceof Opcode::Negate
}
}
class BitAndInstruction extends BinaryInstruction {
BitAndInstruction() {
opcode instanceof Opcode::BitAnd

6
cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
View File

@@ -761,6 +761,12 @@ class RemInstruction extends BinaryInstruction {
}
}
class NegateInstruction extends UnaryInstruction {
NegateInstruction() {
opcode instanceof Opcode::Negate
}
}
class BitAndInstruction extends BinaryInstruction {
BitAndInstruction() {
opcode instanceof Opcode::BitAnd

483
cpp/ql/src/semmle/code/cpp/rangeanalysis/SignAnalysis.qll Normal file
View File

@@ -0,0 +1,483 @@
/**
* Provides sign analysis to determine whether expression are always positive
* or negative.
*
* The analysis is implemented as an abstract interpretation over the
* three-valued domain `{negative, zero, positive}`.
*/
import cpp
private import semmle.code.cpp.ir.IR
private import semmle.code.cpp.controlflow.IRGuards
private import semmle.code.cpp.ir.ValueNumbering
private import SignAnalysisCached
private newtype TSign = TNeg() or TZero() or TPos()
private class Sign extends TSign {
string toString() {
result = "-" and this = TNeg() or
result = "0" and this = TZero() or
result = "+" and this = TPos()
}
Sign inc() {
this = TNeg() and result = TNeg() or
this = TNeg() and result = TZero() or
this = TZero() and result = TPos() or
this = TPos() and result = TPos()
}
Sign dec() {
result.inc() = this
}
Sign neg() {
this = TNeg() and result = TPos() or
this = TZero() and result = TZero() or
this = TPos() and result = TNeg()
}
Sign bitnot() {
this = TNeg() and result = TPos() or
this = TNeg() and result = TZero() or
this = TZero() and result = TNeg() or
this = TPos() and result = TNeg()
}
Sign add(Sign s) {
this = TZero() and result = s or
s = TZero() and result = this or
this = s and this = result or
this = TPos() and s = TNeg() or
this = TNeg() and s = TPos()
}
Sign mul(Sign s) {
result = TZero() and this = TZero() or
result = TZero() and s = TZero() or
result = TNeg() and this = TPos() and s = TNeg() or
result = TNeg() and this = TNeg() and s = TPos() or
result = TPos() and this = TPos() and s = TPos() or
result = TPos() and this = TNeg() and s = TNeg()
}
Sign div(Sign s) {
result = TZero() and s = TNeg() or
result = TZero() and s = TPos() or
result = TNeg() and this = TPos() and s = TNeg() or
result = TNeg() and this = TNeg() and s = TPos() or
result = TPos() and this = TPos() and s = TPos() or
result = TPos() and this = TNeg() and s = TNeg()
}
Sign rem(Sign s) {
result = TZero() and s = TNeg() or
result = TZero() and s = TPos() or
result = this and s = TNeg() or
result = this and s = TPos()
}
Sign bitand(Sign s) {
result = TZero() and this = TZero() or
result = TZero() and s = TZero() or
result = TZero() and this = TPos() or
result = TZero() and s = TPos() or
result = TNeg() and this = TNeg() and s = TNeg() or
result = TPos() and this = TNeg() and s = TPos() or
result = TPos() and this = TPos() and s = TNeg() or
result = TPos() and this = TPos() and s = TPos()
}
Sign bitor(Sign s) {
result = TZero() and this = TZero() and s = TZero() or
result = TNeg() and this = TNeg() or
result = TNeg() and s = TNeg() or
result = TPos() and this = TPos() and s = TZero() or
result = TPos() and this = TZero() and s = TPos() or
result = TPos() and this = TPos() and s = TPos()
}
Sign bitxor(Sign s) {
result = TZero() and this = s or
result = this and s = TZero() or
result = s and this = TZero() or
result = TPos() and this = TPos() and s = TPos() or
result = TNeg() and this = TNeg() and s = TPos() or
result = TNeg() and this = TPos() and s = TNeg() or
result = TPos() and this = TNeg() and s = TNeg()
}
Sign lshift(Sign s) {
result = TZero() and this = TZero() or
result = this and s = TZero() or
this != TZero() and s != TZero()
}
Sign rshift(Sign s) {
result = TZero() and this = TZero() or
result = this and s = TZero() or
result = TNeg() and this = TNeg() or
result != TNeg() and this = TPos() and s != TZero()
}
Sign urshift(Sign s) {
result = TZero() and this = TZero() or
result = this and s = TZero() or
result != TZero() and this = TNeg() and s != TZero() or
result != TNeg() and this = TPos() and s != TZero()
}
}
private Sign certainInstructionSign(Instruction inst) {
exists(int i | inst.(IntegerConstantInstruction).getValue().toInt() = i |
i < 0 and result = TNeg() or
i = 0 and result = TZero() or
i > 0 and result = TPos()
)
or
exists(float f | f = inst.(FloatConstantInstruction).getValue().toFloat() |
f < 0 and result = TNeg() or
f = 0 and result = TZero() or
f > 0 and result = TPos()
)
}
private newtype CastKind = TWiden() or TSame() or TNarrow()
private CastKind getCastKind(ConvertInstruction ci) {
exists(int fromSize, int toSize |
toSize = ci.getResultSize() and
fromSize = ci.getOperand().getResultSize()
|
fromSize < toSize and
result = TWiden()
or
fromSize = toSize and
result = TSame()
or
fromSize > toSize and
result = TNarrow()
)
}
private predicate bindBool(boolean bool) {
bool = true or
bool = false
}
private Sign castSign(Sign s, boolean fromSigned, boolean toSigned, CastKind ck) {
result = TZero() and
(
bindBool(fromSigned) and
bindBool(toSigned) and
s = TZero()
or
bindBool(fromSigned) and
bindBool(toSigned) and
ck = TNarrow()
)
or
result = TPos() and
(
bindBool(fromSigned) and
bindBool(toSigned) and
s = TPos()
or
bindBool(fromSigned) and
bindBool(toSigned) and
s = TNeg() and
ck = TNarrow()
or
fromSigned = true and
toSigned = false and
s = TNeg()
)
or
result = TNeg() and
(
fromSigned = true and
toSigned = true and
s = TNeg()
or
fromSigned = false and
toSigned = true and
s = TPos() and
ck != TWiden()
)
}
/** Holds if the sign of `e` is too complicated to determine. */
private predicate unknownSign(Instruction i) {
(
i instanceof UnmodeledDefinitionInstruction
or
i instanceof UninitializedInstruction
or
i instanceof InitializeParameterInstruction
or
i instanceof BuiltInInstruction
or
i instanceof CallInstruction
)
}
/**
* Holds if `lowerbound` is a lower bound for `bounded`. This is restricted
* to only include bounds for which we might determine a sign.
*/
private predicate lowerBound(IRGuardCondition comp, Operand lowerbound, Operand bounded, boolean isStrict) {
exists(int adjustment, Operand compared |
valueNumber(bounded.getDefinitionInstruction()) = valueNumber(compared.getDefinitionInstruction()) and
(
isStrict = true and
adjustment = 0
or
isStrict = false and
adjustment = 1
) and
comp.ensuresLt(lowerbound, compared, adjustment, bounded.getInstruction().getBlock(), true)
)
}
/**
* Holds if `upperbound` is an upper bound for `bounded` at `pos`. This is restricted
* to only include bounds for which we might determine a sign.
*/
private predicate upperBound(IRGuardCondition comp, Operand upperbound, Operand bounded, boolean isStrict) {
exists(int adjustment, Operand compared |
valueNumber(bounded.getDefinitionInstruction()) = valueNumber(compared.getDefinitionInstruction()) and
(
isStrict = true and
adjustment = 0
or
isStrict = false and
adjustment = 1
) and
comp.ensuresLt(compared, upperbound, adjustment, bounded.getInstruction().getBlock(), true)
)
}
/**
* Holds if `eqbound` is an equality/inequality for `bounded` at `pos`. This is
* restricted to only include bounds for which we might determine a sign. The
* boolean `isEq` gives the polarity:
* - `isEq = true` : `bounded = eqbound`
* - `isEq = false` : `bounded != eqbound`
*/
private predicate eqBound(IRGuardCondition guard, Operand eqbound, Operand bounded, boolean isEq) {
exists(Operand compared |
valueNumber(bounded.getDefinitionInstruction()) = valueNumber(compared.getDefinitionInstruction()) and
guard.ensuresEq(compared, eqbound, 0, bounded.getInstruction().getBlock(), isEq)
)
}
/**
* Holds if `bound` is a bound for `v` at `pos` that needs to be positive in
* order for `v` to be positive.
*/
private predicate posBound(IRGuardCondition comp, Operand bound, Operand op) {
upperBound(comp, bound, op, _) or
eqBound(comp, bound, op, true)
}
/**
* Holds if `bound` is a bound for `v` at `pos` that needs to be negative in
* order for `v` to be negative.
*/
private predicate negBound(IRGuardCondition comp, Operand bound, Operand op) {
lowerBound(comp, bound, op, _) or
eqBound(comp, bound, op, true)
}
/**
* Holds if `bound` is a bound for `v` at `pos` that can restrict whether `v`
* can be zero.
*/
private predicate zeroBound(IRGuardCondition comp, Operand bound, Operand op) {
lowerBound(comp, bound, op, _) or
upperBound(comp, bound, op, _) or
eqBound(comp, bound, op, _)
}
/** Holds if `bound` allows `v` to be positive at `pos`. */
private predicate posBoundOk(IRGuardCondition comp, Operand bound, Operand op) {
posBound(comp, bound, op) and TPos() = operandSign(bound)
}
/** Holds if `bound` allows `v` to be negative at `pos`. */
private predicate negBoundOk(IRGuardCondition comp, Operand bound, Operand op) {
negBound(comp, bound, op) and TNeg() = operandSign(bound)
}
/** Holds if `bound` allows `v` to be zero at `pos`. */
private predicate zeroBoundOk(IRGuardCondition comp, Operand bound, Operand op) {
lowerBound(comp, bound, op, _) and TNeg() = operandSign(bound) or
lowerBound(comp, bound, op, false) and TZero() = operandSign(bound) or
upperBound(comp, bound, op, _) and TPos() = operandSign(bound) or
upperBound(comp, bound, op, false) and TZero() = operandSign(bound) or
eqBound(comp, bound, op, true) and TZero() = operandSign(bound) or
eqBound(comp, bound, op, false) and TZero() != operandSign(bound)
}
private Sign binaryOpLhsSign(Instruction i) {
result = operandSign(i.getAnOperand().(LeftOperand))
}
private Sign binaryOpRhsSign(Instruction i) {
result = operandSign(i.getAnOperand().(RightOperand))
}
pragma[noinline]
private predicate binaryOpSigns(Instruction i, Sign lhs, Sign rhs) {
lhs = binaryOpLhsSign(i) and
rhs = binaryOpRhsSign(i)
}
private Sign unguardedOperandSign(Operand operand) {
result = instructionSign(operand.getDefinitionInstruction()) and
not hasGuard(operand, result)
}
private Sign guardedOperandSign(Operand operand) {
result = instructionSign(operand.getDefinitionInstruction()) and
hasGuard(operand, result)
}
private Sign guardedOperandSignOk(Operand operand) {
result = TPos() and forex(IRGuardCondition guard, Operand bound | posBound(guard, bound, operand) | posBoundOk(guard, bound, operand)) or
result = TNeg() and forex(IRGuardCondition guard, Operand bound | negBound(guard, bound, operand) | negBoundOk(guard, bound, operand)) or
result = TZero() and forex(IRGuardCondition guard, Operand bound | zeroBound(guard, bound, operand) | zeroBoundOk(guard, bound, operand))
}
/**
* Holds if there is a bound that might restrict whether `v` has the sign `s`
* at `pos`.
*/
private predicate hasGuard(Operand op, Sign s) {
s = TPos() and posBound(_, _, op)
or
s = TNeg() and negBound(_, _, op)
or
s = TZero() and zeroBound(_, _, op)
}
cached module SignAnalysisCached {
/**
* Gets a sign that `operand` may have at `pos`, taking guards into account.
*/
cached
Sign operandSign(Operand operand) {
result = unguardedOperandSign(operand)
or
result = guardedOperandSign(operand) and
result = guardedOperandSignOk(operand)
}
cached
Sign instructionSign(Instruction i) {
result = certainInstructionSign(i)
or
not exists(certainInstructionSign(i)) and
not (
result = TNeg() and
i.getResultType().(IntegralType).isUnsigned()
) and
(
unknownSign(i)
or
exists(ConvertInstruction ci, Instruction prior, boolean fromSigned, boolean toSigned |
i = ci and
prior = ci.getOperand() and
(
if ci.getResultType().(IntegralType).isSigned()
then toSigned = true
else toSigned = false
) and
(
if prior.getResultType().(IntegralType).isSigned()
then fromSigned = true
else fromSigned = false
) and
result = castSign(operandSign(ci.getAnOperand()), fromSigned, toSigned, getCastKind(ci))
)
or
result = operandSign(i.getAnOperand().(CopySourceOperand))
or
result = operandSign(i.(BitComplementInstruction).getAnOperand()).bitnot()
or
result = operandSign(i.(NegateInstruction).getAnOperand()).neg()
or
exists(Sign s1, Sign s2 |
binaryOpSigns(i, s1, s2)
|
i instanceof AddInstruction and result = s1.add(s2)
or
i instanceof SubInstruction and result = s1.add(s2.neg())
or
i instanceof MulInstruction and result = s1.mul(s2)
or
i instanceof DivInstruction and result = s1.div(s2)
or
i instanceof RemInstruction and result = s1.rem(s2)
or
i instanceof BitAndInstruction and result = s1.bitand(s2)
or
i instanceof BitOrInstruction and result = s1.bitor(s2)
or
i instanceof BitXorInstruction and result = s1.bitxor(s2)
or
i instanceof ShiftLeftInstruction and result = s1.lshift(s2)
or
i instanceof ShiftRightInstruction and
i.getResultType().(IntegralType).isSigned() and
result = s1.rshift(s2)
or
i instanceof ShiftRightInstruction and
not i.getResultType().(IntegralType).isSigned() and
result = s1.urshift(s2)
)
or
// use hasGuard here?
result = operandSign(i.(PhiInstruction).getAnOperand())
)
}
}
/** Holds if `i` can be positive and cannot be negative. */
predicate positiveInstruction(Instruction i) {
instructionSign(i) = TPos() and
not instructionSign(i) = TNeg()
}
/** Holds if `i` at `pos` can be positive at and cannot be negative. */
predicate positive(Operand op) {
operandSign(op) = TPos() and
not operandSign(op) = TNeg()
}
/** Holds if `i` can be negative and cannot be positive. */
predicate negativeInstruction(Instruction i) {
instructionSign(i) = TNeg() and
not instructionSign(i) = TPos()
}
/** Holds if `i` at `pos` can be negative and cannot be positive. */
predicate negative(Operand op) {
operandSign(op) = TNeg() and
not operandSign(op) = TPos()
}
/** Holds if `i` is strictly positive. */
predicate strictlyPositiveInstruction(Instruction i) {
instructionSign(i) = TPos() and
not instructionSign(i) = TNeg() and
not instructionSign(i) = TZero()
}
/** Holds if `i` is strictly positive at `pos`. */
predicate strictlyPositive(Operand op) {
operandSign(op) = TPos() and
not operandSign(op) = TNeg() and
not operandSign(op) = TZero()
}
/** Holds if `i` is strictly negative. */
predicate strictlyNegativeInstruction(Instruction i) {
instructionSign(i) = TNeg() and
not instructionSign(i) = TPos() and
not instructionSign(i) = TZero()
}
/** Holds if `i` is strictly negative at `pos`. */
predicate strictlyNegative(Operand op) {
operandSign(op) = TNeg() and
not operandSign(op) = TPos() and
not operandSign(op) = TZero()
}

27
cpp/ql/test/library-tests/controlflow/guards-ir/tests.ql
View File

@@ -51,7 +51,7 @@ query predicate irGuards(IRGuardCondition guard) {
}
query predicate irGuardsCompare(int startLine, string msg) {
exists(IRGuardCondition guard, Instruction left, Instruction right, int k, string which, string op |
exists(IRGuardCondition guard, Operand left, Operand right, int k, string which, string op |
exists(boolean sense |
sense = true and which = "true"
or sense = false and which = "false"
@@ -65,7 +65,7 @@ query predicate irGuardsCompare(int startLine, string msg) {
guard.comparesEq(left, right, k, false, sense) and op = " != "
)
and startLine = guard.getLocation().getStartLine()
and msg = left.getUnconvertedResultExpression() + op + right.getUnconvertedResultExpression() + "+" + k + " when " + guard + " is " + which
and msg = left.getDefinitionInstruction().getUnconvertedResultExpression() + op + right.getDefinitionInstruction().getUnconvertedResultExpression() + "+" + k + " when " + guard + " is " + which
)
}
query predicate irGuardsControl(IRGuardCondition guard, boolean sense, int start, int end) {
@@ -77,15 +77,18 @@ query predicate irGuardsControl(IRGuardCondition guard, boolean sense, int start
query predicate irGuardsEnsure(IRGuardCondition guard, Instruction left, string op, Instruction right, int k, int start, int end)
{
exists(IRBlock block |
guard.ensuresLt(left, right, k, block, true) and op = "<"
or
guard.ensuresLt(left, right, k, block, false) and op = ">="
or
guard.ensuresEq(left, right, k, block, true) and op = "=="
or
guard.ensuresEq(left, right, k, block, false) and op = "!="
|
block.getLocation().hasLocationInfo(_, start, _, end, _)
exists(IRBlock block, Operand leftOp, Operand rightOp |
guard.ensuresLt(leftOp, rightOp, k, block, true) and op = "<"
or
guard.ensuresLt(leftOp, rightOp, k, block, false) and op = ">="
or
guard.ensuresEq(leftOp, rightOp, k, block, true) and op = "=="
or
guard.ensuresEq(leftOp, rightOp, k, block, false) and op = "!="
|
leftOp = left.getAUse() and
rightOp = right.getAUse() and
block.getLocation().hasLocationInfo(_, start, _, end, _)
)
}

688
cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected Normal file
View File

@@ -0,0 +1,688 @@
| binary_logical_operator.c:2:11:2:25 | Constant: ... && ... | positive strictlyPositive |
| binary_logical_operator.c:2:11:2:25 | Load: ... && ... | positive |
| binary_logical_operator.c:2:11:2:25 | Phi: ... && ... | positive |
| binary_logical_operator.c:2:11:2:25 | Store: ... && ... | positive |
| binary_logical_operator.c:2:11:2:25 | Store: ... && ... | positive strictlyPositive |
| binary_logical_operator.c:2:15:2:16 | Constant: 10 | positive strictlyPositive |
| binary_logical_operator.c:3:7:3:7 | Load: b | positive |
| bounded_bounds.c:3:12:3:12 | Load: x | negative strictlyNegative |
| bounded_bounds.c:3:12:3:12 | Store: x | negative strictlyNegative |
| bounded_bounds.c:5:7:5:7 | Load: x | positive |
| bounded_bounds.c:6:11:6:11 | Load: y | positive strictlyPositive |
| bounded_bounds.c:6:11:6:11 | Store: y | positive strictlyPositive |
| bounded_bounds.c:16:12:16:12 | Load: x | negative strictlyNegative |
| bounded_bounds.c:16:12:16:12 | Store: x | negative strictlyNegative |
| inline_assembly.c:9:23:9:23 | Uninitialized: definition of y | positive |
| inline_assembly.c:10:3:10:7 | Store: ... = ... | positive strictlyPositive |
| inline_assembly.c:10:7:10:7 | Constant: (unsigned int)... | positive strictlyPositive |
| inline_assembly.c:12:32:12:32 | Load: y | positive strictlyPositive |
| minmax.c:16:9:16:10 | Constant: 1 | positive strictlyPositive |
| minmax.c:16:9:16:10 | Store: 1 | positive strictlyPositive |
| minmax.c:16:16:16:17 | Constant: 2 | positive strictlyPositive |
| minmax.c:16:16:16:17 | Store: 2 | positive strictlyPositive |
| minmax.c:16:23:16:24 | Constant: 3 | positive strictlyPositive |
| minmax.c:16:23:16:24 | Store: 3 | positive strictlyPositive |
| minmax.c:18:37:18:37 | Load: x | positive strictlyPositive |
| minmax.c:18:40:18:40 | Load: y | positive strictlyPositive |
| minmax.c:18:43:18:43 | Load: z | positive strictlyPositive |
| test.c:7:10:7:10 | Phi: p | positive |
| test.c:8:5:8:19 | Store: ... = ... | positive strictlyPositive |
| test.c:8:13:8:17 | Load: count | positive |
| test.c:8:13:8:19 | Add: ... + ... | positive strictlyPositive |
| test.c:8:19:8:19 | Constant: 1 | positive strictlyPositive |
| test.c:10:10:10:14 | Load: count | positive |
| test.c:10:10:10:14 | Store: count | positive |
| test.c:15:10:15:10 | Phi: p | positive |
| test.c:16:5:16:26 | Store: ... = ... | positive |
| test.c:16:13:16:26 | Rem: ... % ... | positive |
| test.c:16:14:16:18 | Load: count | positive |
| test.c:16:14:16:20 | Add: ... + ... | positive strictlyPositive |
| test.c:16:20:16:20 | Constant: 1 | positive strictlyPositive |
| test.c:16:25:16:26 | Constant: 10 | positive strictlyPositive |
| test.c:18:10:18:14 | Load: count | positive |
| test.c:18:10:18:14 | Store: count | positive |
| test.c:23:10:23:10 | Phi: p | positive |
| test.c:24:5:24:11 | Add: ... ++ | positive strictlyPositive |
| test.c:24:5:24:11 | Constant: ... ++ | positive strictlyPositive |
| test.c:24:5:24:11 | Load: ... ++ | positive |
| test.c:24:5:24:11 | Store: ... ++ | positive strictlyPositive |
| test.c:25:5:25:22 | Store: ... = ... | positive |
| test.c:25:13:25:17 | Load: count | positive strictlyPositive |
| test.c:25:13:25:22 | Rem: ... % ... | positive |
| test.c:25:21:25:22 | Constant: 10 | positive strictlyPositive |
| test.c:27:10:27:14 | Load: count | positive |
| test.c:27:10:27:14 | Store: count | positive |
| test.c:33:15:33:15 | Load: i | positive |
| test.c:33:15:33:15 | Phi: i | positive |
| test.c:33:15:33:15 | Phi: i | positive |
| test.c:33:19:33:19 | Constant: 2 | positive strictlyPositive |
| test.c:33:22:33:28 | Store: ... = ... | positive strictlyPositive |
| test.c:33:26:33:26 | Load: i | positive |
| test.c:33:26:33:28 | Add: ... + ... | positive strictlyPositive |
| test.c:33:28:33:28 | Constant: 1 | positive strictlyPositive |
| test.c:34:5:34:14 | Add: ... += ... | positive |
| test.c:34:5:34:14 | Load: ... += ... | positive |
| test.c:34:5:34:14 | Store: ... += ... | positive |
| test.c:34:14:34:14 | Load: i | positive |
| test.c:36:10:36:14 | Load: total | positive |
| test.c:36:10:36:18 | Add: ... + ... | positive |
| test.c:36:10:36:18 | Store: ... + ... | positive |
| test.c:36:18:36:18 | Load: i | positive |
| test.c:42:15:42:15 | Load: i | positive |
| test.c:42:15:42:15 | Phi: i | positive |
| test.c:42:15:42:15 | Phi: i | positive |
| test.c:42:19:42:19 | Constant: 2 | positive strictlyPositive |
| test.c:42:22:42:24 | Add: ... ++ | positive strictlyPositive |
| test.c:42:22:42:24 | Constant: ... ++ | positive strictlyPositive |
| test.c:42:22:42:24 | Load: ... ++ | positive |
| test.c:42:22:42:24 | Store: ... ++ | positive strictlyPositive |
| test.c:43:5:43:14 | Add: ... += ... | positive |
| test.c:43:5:43:14 | Load: ... += ... | positive |
| test.c:43:5:43:14 | Store: ... += ... | positive |
| test.c:43:14:43:14 | Load: i | positive |
| test.c:45:10:45:14 | Load: total | positive |
| test.c:45:10:45:18 | Add: ... + ... | positive |
| test.c:45:10:45:18 | Store: ... + ... | positive |
| test.c:45:18:45:18 | Load: i | positive |
| test.c:51:15:51:15 | Load: i | positive |
| test.c:51:15:51:15 | Phi: i | positive |
| test.c:51:15:51:15 | Phi: i | positive |
| test.c:51:15:51:17 | Add: ... + ... | positive strictlyPositive |
| test.c:51:17:51:17 | Constant: 2 | positive strictlyPositive |
| test.c:51:21:51:21 | Constant: 4 | positive strictlyPositive |
| test.c:51:24:51:30 | Store: ... = ... | positive strictlyPositive |
| test.c:51:28:51:28 | Load: i | positive |
| test.c:51:28:51:30 | Add: ... + ... | positive strictlyPositive |
| test.c:51:30:51:30 | Constant: 1 | positive strictlyPositive |
| test.c:52:5:52:14 | Add: ... += ... | positive |
| test.c:52:5:52:14 | Load: ... += ... | positive |
| test.c:52:5:52:14 | Store: ... += ... | positive |
| test.c:52:14:52:14 | Load: i | positive |
| test.c:54:10:54:14 | Load: total | positive |
| test.c:54:10:54:18 | Add: ... + ... | positive |
| test.c:54:10:54:18 | Store: ... + ... | positive |
| test.c:54:18:54:18 | Load: i | positive |
| test.c:58:11:58:11 | Constant: 4 | positive strictlyPositive |
| test.c:59:13:59:13 | Constant: 5 | positive strictlyPositive |
| test.c:63:10:63:10 | Constant: 1 | positive strictlyPositive |
| test.c:63:10:63:10 | Store: 1 | positive strictlyPositive |
| test.c:67:7:67:11 | Constant: - ... | negative strictlyNegative |
| test.c:67:24:67:25 | Constant: 10 | positive strictlyPositive |
| test.c:68:15:68:15 | Constant: 2 | positive strictlyPositive |
| test.c:77:13:77:13 | Constant: 4 | positive strictlyPositive |
| test.c:81:13:81:13 | Constant: 4 | positive strictlyPositive |
| test.c:82:14:82:14 | Constant: 1 | positive strictlyPositive |
| test.c:82:14:82:14 | Store: 1 | positive strictlyPositive |
| test.c:88:5:88:10 | Phi: test10 | positive |
| test.c:89:11:89:11 | Constant: 7 | positive strictlyPositive |
| test.c:90:13:90:13 | Load: y | positive strictlyPositive |
| test.c:93:12:93:12 | Load: x | positive strictlyPositive |
| test.c:93:12:93:12 | Store: x | positive strictlyPositive |
| test.c:95:10:95:10 | Constant: 1 | positive strictlyPositive |
| test.c:95:10:95:10 | Store: 1 | positive strictlyPositive |
| test.c:98:5:98:10 | Phi: test11 | positive |
| test.c:102:6:102:8 | Constant: ... ++ | positive strictlyPositive |
| test.c:104:12:104:14 | Constant: 58 | positive strictlyPositive |
| test.c:107:8:107:10 | Constant: ... ++ | positive strictlyPositive |
| test.c:109:14:109:16 | Constant: 44 | positive strictlyPositive |
| test.c:110:14:110:14 | Constant: 1 | positive strictlyPositive |
| test.c:110:14:110:14 | Store: 1 | positive strictlyPositive |
| test.c:119:10:119:12 | Add: ... ++ | positive strictlyPositive |
| test.c:119:10:119:12 | Constant: ... ++ | positive strictlyPositive |
| test.c:119:10:119:12 | Store: ... ++ | positive strictlyPositive |
| test.c:124:11:124:15 | Load: Start | positive |
| test.c:124:11:124:15 | Phi: Start | positive |
| test.c:124:20:124:32 | Call: call to test12_helper | positive |
| test.c:124:20:124:36 | Sub: ... - ... | positive |
| test.c:124:36:124:36 | Constant: (unsigned long long)... | positive strictlyPositive |
| test.c:126:31:126:43 | Call: call to test12_helper | positive |
| test.c:126:31:126:43 | Store: call to test12_helper | positive |
| test.c:127:6:127:24 | Add: ... += ... | positive strictlyPositive |
| test.c:127:6:127:24 | Load: ... += ... | positive |
| test.c:127:6:127:24 | Store: ... += ... | positive strictlyPositive |
| test.c:127:15:127:20 | Load: Length | positive |
| test.c:127:15:127:24 | Add: ... + ... | positive strictlyPositive |
| test.c:127:24:127:24 | Constant: (unsigned long long)... | positive strictlyPositive |
| test.c:130:11:130:11 | Constant: 1 | positive strictlyPositive |
| test.c:130:11:130:11 | Store: 1 | positive strictlyPositive |
| test.c:135:22:135:22 | Convert: (unsigned char)... | positive |
| test.c:135:22:135:22 | Store: (unsigned char)... | positive |
| test.c:137:22:137:22 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:138:13:138:13 | Constant: 1 | positive strictlyPositive |
| test.c:139:19:139:28 | Convert: (unsigned int)... | positive |
| test.c:139:19:139:32 | Add: ... + ... | positive |
| test.c:139:27:139:28 | Convert: (int)... | positive |
| test.c:139:27:139:28 | Load: uc | positive |
| test.c:139:40:139:40 | Convert: (unsigned int)... | positive |
| test.c:145:12:145:32 | Convert: (int)... | positive |
| test.c:145:12:145:32 | Store: (int)... | positive |
| test.c:145:17:145:32 | Convert: (unsigned char)... | positive |
| test.c:146:12:146:33 | Convert: (int)... | positive |
| test.c:146:12:146:33 | Store: (int)... | positive |
| test.c:146:17:146:33 | Convert: (unsigned short)... | positive |
| test.c:147:17:147:31 | Convert: (unsigned int)... | positive |
| test.c:149:23:149:23 | Convert: (unsigned short)... | positive |
| test.c:149:23:149:23 | Store: (unsigned short)... | positive |
| test.c:150:15:150:16 | Load: x1 | positive |
| test.c:150:20:150:21 | Load: x2 | positive |
| test.c:150:35:150:36 | Convert: (int)... | positive |
| test.c:150:35:150:36 | Load: s0 | positive |
| test.c:154:10:154:40 | Store: ... ? ... : ... | negative strictlyNegative |
| test.c:154:10:154:40 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:154:20:154:20 | Load: x | positive strictlyPositive |
| test.c:154:25:154:30 | Convert: (int)... | positive |
| test.c:154:25:154:30 | Convert: (long long)... | positive |
| test.c:154:30:154:30 | Load: x | positive strictlyPositive |
| test.c:154:35:154:35 | Load: x | positive strictlyPositive |
| test.c:154:39:154:40 | Constant: (long long)... | negative strictlyNegative |
| test.c:161:7:161:7 | Constant: 3 | positive strictlyPositive |
| test.c:161:17:161:17 | Load: a | positive strictlyPositive |
| test.c:161:22:161:23 | Constant: 11 | positive strictlyPositive |
| test.c:162:13:162:14 | CopyValue: + ... | positive strictlyPositive |
| test.c:162:13:162:14 | Store: + ... | positive strictlyPositive |
| test.c:162:14:162:14 | Load: a | positive strictlyPositive |
| test.c:163:13:163:14 | Negate: - ... | negative strictlyNegative |
| test.c:163:13:163:14 | Store: - ... | negative strictlyNegative |
| test.c:163:14:163:14 | Load: a | positive strictlyPositive |
| test.c:164:14:164:14 | Load: b | positive strictlyPositive |
| test.c:164:16:164:16 | Load: c | negative strictlyNegative |
| test.c:166:17:166:17 | Load: a | positive |
| test.c:166:22:166:23 | Constant: 11 | positive strictlyPositive |
| test.c:167:13:167:14 | CopyValue: + ... | positive |
| test.c:167:13:167:14 | Store: + ... | positive |
| test.c:167:14:167:14 | Load: a | positive |
| test.c:168:13:168:14 | Negate: - ... | negative |
| test.c:168:13:168:14 | Store: - ... | negative |
| test.c:168:14:168:14 | Load: a | positive |
| test.c:169:14:169:14 | Load: b | positive |
| test.c:169:16:169:16 | Load: c | negative |
| test.c:171:7:171:8 | Constant: - ... | negative strictlyNegative |
| test.c:171:23:171:24 | Constant: 11 | positive strictlyPositive |
| test.c:176:7:176:8 | Constant: - ... | negative strictlyNegative |
| test.c:176:23:176:23 | Constant: 1 | positive strictlyPositive |
| test.c:181:7:181:8 | Constant: - ... | negative strictlyNegative |
| test.c:182:13:182:14 | CopyValue: + ... | negative |
| test.c:182:13:182:14 | Store: + ... | negative |
| test.c:182:14:182:14 | Load: a | negative |
| test.c:183:13:183:14 | Negate: - ... | positive |
| test.c:183:13:183:14 | Store: - ... | positive |
| test.c:183:14:183:14 | Load: a | negative |
| test.c:184:14:184:14 | Load: b | negative |
| test.c:184:16:184:16 | Load: c | positive |
| test.c:186:7:186:8 | Constant: - ... | negative strictlyNegative |
| test.c:186:23:186:24 | Constant: - ... | negative strictlyNegative |
| test.c:187:13:187:14 | CopyValue: + ... | negative strictlyNegative |
| test.c:187:13:187:14 | Store: + ... | negative strictlyNegative |
| test.c:187:14:187:14 | Load: a | negative strictlyNegative |
| test.c:188:13:188:14 | Negate: - ... | positive strictlyPositive |
| test.c:188:13:188:14 | Store: - ... | positive strictlyPositive |
| test.c:188:14:188:14 | Load: a | negative strictlyNegative |
| test.c:189:14:189:14 | Load: b | negative strictlyNegative |
| test.c:189:16:189:16 | Load: c | positive strictlyPositive |
| test.c:200:7:200:7 | Constant: 3 | positive strictlyPositive |
| test.c:200:17:200:17 | Load: a | positive strictlyPositive |
| test.c:200:22:200:23 | Constant: 11 | positive strictlyPositive |
| test.c:200:28:200:28 | Constant: 5 | positive strictlyPositive |
| test.c:200:38:200:38 | Load: b | positive strictlyPositive |
| test.c:200:43:200:44 | Constant: 23 | positive strictlyPositive |
| test.c:201:13:201:13 | Load: a | positive strictlyPositive |
| test.c:201:13:201:15 | Mul: ... * ... | positive strictlyPositive |
| test.c:201:13:201:15 | Store: ... * ... | positive strictlyPositive |
| test.c:201:15:201:15 | Load: b | positive strictlyPositive |
| test.c:202:5:202:14 | Add: ... += ... | positive strictlyPositive |
| test.c:202:5:202:14 | Store: ... += ... | positive strictlyPositive |
| test.c:202:14:202:14 | Load: r | positive strictlyPositive |
| test.c:204:7:204:7 | Constant: 3 | positive strictlyPositive |
| test.c:204:7:204:7 | Phi: 3 | positive |
| test.c:204:17:204:17 | Load: a | positive strictlyPositive |
| test.c:204:22:204:23 | Constant: 11 | positive strictlyPositive |
| test.c:204:38:204:38 | Load: b | positive |
| test.c:204:43:204:44 | Constant: 23 | positive strictlyPositive |
| test.c:205:13:205:13 | Load: a | positive strictlyPositive |
| test.c:205:13:205:15 | Mul: ... * ... | positive |
| test.c:205:13:205:15 | Store: ... * ... | positive |
| test.c:205:15:205:15 | Load: b | positive |
| test.c:206:5:206:14 | Add: ... += ... | positive |
| test.c:206:5:206:14 | Load: ... += ... | positive |
| test.c:206:5:206:14 | Store: ... += ... | positive |
| test.c:206:14:206:14 | Load: r | positive |
| test.c:208:7:208:7 | Constant: 3 | positive strictlyPositive |
| test.c:208:7:208:7 | Phi: 3 | positive |
| test.c:208:17:208:17 | Load: a | positive strictlyPositive |
| test.c:208:22:208:23 | Constant: 11 | positive strictlyPositive |
| test.c:208:28:208:30 | Constant: - ... | negative strictlyNegative |
| test.c:208:45:208:46 | Constant: 23 | positive strictlyPositive |
| test.c:209:13:209:13 | Load: a | positive strictlyPositive |
| test.c:210:5:210:14 | Load: ... += ... | positive |
| test.c:212:7:212:7 | Constant: 3 | positive strictlyPositive |
| test.c:212:17:212:17 | Load: a | positive strictlyPositive |
| test.c:212:22:212:23 | Constant: 11 | positive strictlyPositive |
| test.c:212:28:212:30 | Constant: - ... | negative strictlyNegative |
| test.c:213:13:213:13 | Load: a | positive strictlyPositive |
| test.c:213:13:213:15 | Mul: ... * ... | negative |
| test.c:213:13:213:15 | Store: ... * ... | negative |
| test.c:213:15:213:15 | Load: b | negative |
| test.c:214:14:214:14 | Load: r | negative |
| test.c:216:7:216:7 | Constant: 3 | positive strictlyPositive |
| test.c:216:17:216:17 | Load: a | positive strictlyPositive |
| test.c:216:22:216:23 | Constant: 11 | positive strictlyPositive |
| test.c:216:28:216:30 | Constant: - ... | negative strictlyNegative |
| test.c:216:45:216:46 | Constant: - ... | negative strictlyNegative |
| test.c:217:13:217:13 | Load: a | positive strictlyPositive |
| test.c:217:13:217:15 | Mul: ... * ... | negative strictlyNegative |
| test.c:217:13:217:15 | Store: ... * ... | negative strictlyNegative |
| test.c:217:15:217:15 | Load: b | negative strictlyNegative |
| test.c:218:14:218:14 | Load: r | negative strictlyNegative |
| test.c:228:17:228:17 | Load: a | positive |
| test.c:228:22:228:23 | Constant: 11 | positive strictlyPositive |
| test.c:228:28:228:28 | Constant: 5 | positive strictlyPositive |
| test.c:228:38:228:38 | Load: b | positive strictlyPositive |
| test.c:228:43:228:44 | Constant: 23 | positive strictlyPositive |
| test.c:229:13:229:13 | Load: a | positive |
| test.c:229:13:229:15 | Mul: ... * ... | positive |
| test.c:229:13:229:15 | Store: ... * ... | positive |
| test.c:229:15:229:15 | Load: b | positive strictlyPositive |
| test.c:230:5:230:14 | Add: ... += ... | positive |
| test.c:230:5:230:14 | Store: ... += ... | positive |
| test.c:230:14:230:14 | Load: r | positive |
| test.c:232:7:232:7 | Phi: 0 | positive |
| test.c:232:17:232:17 | Load: a | positive |
| test.c:232:22:232:23 | Constant: 11 | positive strictlyPositive |
| test.c:232:38:232:38 | Load: b | positive |
| test.c:232:43:232:44 | Constant: 23 | positive strictlyPositive |
| test.c:233:13:233:13 | Load: a | positive |
| test.c:233:13:233:15 | Mul: ... * ... | positive |
| test.c:233:13:233:15 | Store: ... * ... | positive |
| test.c:233:15:233:15 | Load: b | positive |
| test.c:234:5:234:14 | Add: ... += ... | positive |
| test.c:234:5:234:14 | Load: ... += ... | positive |
| test.c:234:5:234:14 | Store: ... += ... | positive |
| test.c:234:14:234:14 | Load: r | positive |
| test.c:236:7:236:7 | Phi: 0 | positive |
| test.c:236:17:236:17 | Load: a | positive |
| test.c:236:22:236:23 | Constant: 11 | positive strictlyPositive |
| test.c:236:28:236:30 | Constant: - ... | negative strictlyNegative |
| test.c:236:45:236:46 | Constant: 23 | positive strictlyPositive |
| test.c:237:13:237:13 | Load: a | positive |
| test.c:238:5:238:14 | Load: ... += ... | positive |
| test.c:240:17:240:17 | Load: a | positive |
| test.c:240:22:240:23 | Constant: 11 | positive strictlyPositive |
| test.c:240:28:240:30 | Constant: - ... | negative strictlyNegative |
| test.c:241:13:241:13 | Load: a | positive |
| test.c:241:13:241:15 | Mul: ... * ... | negative |
| test.c:241:13:241:15 | Store: ... * ... | negative |
| test.c:241:15:241:15 | Load: b | negative |
| test.c:242:14:242:14 | Load: r | negative |
| test.c:244:17:244:17 | Load: a | positive |
| test.c:244:22:244:23 | Constant: 11 | positive strictlyPositive |
| test.c:244:28:244:30 | Constant: - ... | negative strictlyNegative |
| test.c:244:45:244:46 | Constant: - ... | negative strictlyNegative |
| test.c:245:13:245:13 | Load: a | positive |
| test.c:245:13:245:15 | Mul: ... * ... | negative |
| test.c:245:13:245:15 | Store: ... * ... | negative |
| test.c:245:15:245:15 | Load: b | negative strictlyNegative |
| test.c:246:14:246:14 | Load: r | negative |
| test.c:256:7:256:9 | Constant: - ... | negative strictlyNegative |
| test.c:256:24:256:25 | Constant: 11 | positive strictlyPositive |
| test.c:256:30:256:30 | Constant: 5 | positive strictlyPositive |
| test.c:256:40:256:40 | Load: b | positive strictlyPositive |
| test.c:256:45:256:46 | Constant: 23 | positive strictlyPositive |
| test.c:257:15:257:15 | Load: b | positive strictlyPositive |
| test.c:260:7:260:9 | Constant: - ... | negative strictlyNegative |
| test.c:260:24:260:25 | Constant: 11 | positive strictlyPositive |
| test.c:260:40:260:40 | Load: b | positive |
| test.c:260:45:260:46 | Constant: 23 | positive strictlyPositive |
| test.c:261:15:261:15 | Load: b | positive |
| test.c:264:7:264:9 | Constant: - ... | negative strictlyNegative |
| test.c:264:24:264:25 | Constant: 11 | positive strictlyPositive |
| test.c:264:30:264:32 | Constant: - ... | negative strictlyNegative |
| test.c:264:47:264:48 | Constant: 23 | positive strictlyPositive |
| test.c:268:7:268:9 | Constant: - ... | negative strictlyNegative |
| test.c:268:24:268:25 | Constant: 11 | positive strictlyPositive |
| test.c:268:30:268:32 | Constant: - ... | negative strictlyNegative |
| test.c:269:15:269:15 | Load: b | negative |
| test.c:272:7:272:9 | Constant: - ... | negative strictlyNegative |
| test.c:272:24:272:25 | Constant: 11 | positive strictlyPositive |
| test.c:272:30:272:32 | Constant: - ... | negative strictlyNegative |
| test.c:272:47:272:48 | Constant: - ... | negative strictlyNegative |
| test.c:273:15:273:15 | Load: b | negative strictlyNegative |
| test.c:284:7:284:9 | Constant: - ... | negative strictlyNegative |
| test.c:284:29:284:29 | Constant: 5 | positive strictlyPositive |
| test.c:284:39:284:39 | Load: b | positive strictlyPositive |
| test.c:284:44:284:45 | Constant: 23 | positive strictlyPositive |
| test.c:285:13:285:13 | Load: a | negative |
| test.c:285:13:285:15 | Mul: ... * ... | negative |
| test.c:285:13:285:15 | Store: ... * ... | negative |
| test.c:285:15:285:15 | Load: b | positive strictlyPositive |
| test.c:286:5:286:14 | Add: ... += ... | negative |
| test.c:286:5:286:14 | Store: ... += ... | negative |
| test.c:286:14:286:14 | Load: r | negative |
| test.c:288:7:288:9 | Constant: - ... | negative strictlyNegative |
| test.c:288:7:288:9 | Phi: - ... | negative |
| test.c:288:39:288:39 | Load: b | positive |
| test.c:288:44:288:45 | Constant: 23 | positive strictlyPositive |
| test.c:289:13:289:13 | Load: a | negative |
| test.c:289:13:289:15 | Mul: ... * ... | negative |
| test.c:289:13:289:15 | Store: ... * ... | negative |
| test.c:289:15:289:15 | Load: b | positive |
| test.c:290:5:290:14 | Add: ... += ... | negative |
| test.c:290:5:290:14 | Load: ... += ... | negative |
| test.c:290:5:290:14 | Store: ... += ... | negative |
| test.c:290:14:290:14 | Load: r | negative |
| test.c:292:7:292:9 | Constant: - ... | negative strictlyNegative |
| test.c:292:7:292:9 | Phi: - ... | negative |
| test.c:292:29:292:31 | Constant: - ... | negative strictlyNegative |
| test.c:292:46:292:47 | Constant: 23 | positive strictlyPositive |
| test.c:293:13:293:13 | Load: a | negative |
| test.c:294:5:294:14 | Load: ... += ... | negative |
| test.c:296:7:296:9 | Constant: - ... | negative strictlyNegative |
| test.c:296:29:296:31 | Constant: - ... | negative strictlyNegative |
| test.c:297:13:297:13 | Load: a | negative |
| test.c:297:13:297:15 | Mul: ... * ... | positive |
| test.c:297:13:297:15 | Store: ... * ... | positive |
| test.c:297:15:297:15 | Load: b | negative |
| test.c:298:14:298:14 | Load: r | positive |
| test.c:300:7:300:9 | Constant: - ... | negative strictlyNegative |
| test.c:300:29:300:31 | Constant: - ... | negative strictlyNegative |
| test.c:300:46:300:47 | Constant: - ... | negative strictlyNegative |
| test.c:301:13:301:13 | Load: a | negative |
| test.c:301:13:301:15 | Mul: ... * ... | positive |
| test.c:301:13:301:15 | Store: ... * ... | positive |
| test.c:301:15:301:15 | Load: b | negative strictlyNegative |
| test.c:302:14:302:14 | Load: r | positive |
| test.c:312:7:312:9 | Constant: - ... | negative strictlyNegative |
| test.c:312:24:312:25 | Constant: - ... | negative strictlyNegative |
| test.c:312:30:312:30 | Constant: 5 | positive strictlyPositive |
| test.c:312:40:312:40 | Load: b | positive strictlyPositive |
| test.c:312:45:312:46 | Constant: 23 | positive strictlyPositive |
| test.c:313:13:313:13 | Load: a | negative strictlyNegative |
| test.c:313:13:313:15 | Mul: ... * ... | negative strictlyNegative |
| test.c:313:13:313:15 | Store: ... * ... | negative strictlyNegative |
| test.c:313:15:313:15 | Load: b | positive strictlyPositive |
| test.c:314:5:314:14 | Add: ... += ... | negative strictlyNegative |
| test.c:314:5:314:14 | Store: ... += ... | negative strictlyNegative |
| test.c:314:14:314:14 | Load: r | negative strictlyNegative |
| test.c:316:7:316:9 | Constant: - ... | negative strictlyNegative |
| test.c:316:7:316:9 | Phi: - ... | negative |
| test.c:316:24:316:25 | Constant: - ... | negative strictlyNegative |
| test.c:316:40:316:40 | Load: b | positive |
| test.c:316:45:316:46 | Constant: 23 | positive strictlyPositive |
| test.c:317:13:317:13 | Load: a | negative strictlyNegative |
| test.c:317:13:317:15 | Mul: ... * ... | negative |
| test.c:317:13:317:15 | Store: ... * ... | negative |
| test.c:317:15:317:15 | Load: b | positive |
| test.c:318:5:318:14 | Add: ... += ... | negative |
| test.c:318:5:318:14 | Load: ... += ... | negative |
| test.c:318:5:318:14 | Store: ... += ... | negative |
| test.c:318:14:318:14 | Load: r | negative |
| test.c:320:7:320:9 | Constant: - ... | negative strictlyNegative |
| test.c:320:7:320:9 | Phi: - ... | negative |
| test.c:320:24:320:25 | Constant: - ... | negative strictlyNegative |
| test.c:320:30:320:32 | Constant: - ... | negative strictlyNegative |
| test.c:320:47:320:48 | Constant: 23 | positive strictlyPositive |
| test.c:321:13:321:13 | Load: a | negative strictlyNegative |
| test.c:322:5:322:14 | Load: ... += ... | negative |
| test.c:324:7:324:9 | Constant: - ... | negative strictlyNegative |
| test.c:324:24:324:25 | Constant: - ... | negative strictlyNegative |
| test.c:324:30:324:32 | Constant: - ... | negative strictlyNegative |
| test.c:325:13:325:13 | Load: a | negative strictlyNegative |
| test.c:325:13:325:15 | Mul: ... * ... | positive |
| test.c:325:13:325:15 | Store: ... * ... | positive |
| test.c:325:15:325:15 | Load: b | negative |
| test.c:326:14:326:14 | Load: r | positive |
| test.c:328:7:328:9 | Constant: - ... | negative strictlyNegative |
| test.c:328:24:328:25 | Constant: - ... | negative strictlyNegative |
| test.c:328:30:328:32 | Constant: - ... | negative strictlyNegative |
| test.c:328:47:328:48 | Constant: - ... | negative strictlyNegative |
| test.c:329:13:329:13 | Load: a | negative strictlyNegative |
| test.c:329:13:329:15 | Mul: ... * ... | positive strictlyPositive |
| test.c:329:13:329:15 | Store: ... * ... | positive strictlyPositive |
| test.c:329:15:329:15 | Load: b | negative strictlyNegative |
| test.c:330:14:330:14 | Load: r | positive strictlyPositive |
| test.c:339:12:339:13 | Constant: - ... | negative strictlyNegative |
| test.c:339:12:339:13 | Store: - ... | negative strictlyNegative |
| test.c:342:10:342:10 | Load: i | positive |
| test.c:342:10:342:10 | Phi: i | positive |
| test.c:342:14:342:14 | Constant: 3 | positive strictlyPositive |
| test.c:343:5:343:7 | Add: ... ++ | positive strictlyPositive |
| test.c:343:5:343:7 | Constant: ... ++ | positive strictlyPositive |
| test.c:343:5:343:7 | Load: ... ++ | positive |
| test.c:343:5:343:7 | Store: ... ++ | positive strictlyPositive |
| test.c:345:3:345:7 | Store: ... = ... | positive |
| test.c:345:7:345:7 | Load: i | positive |
| test.c:346:7:346:7 | Load: x | positive |
| test.c:347:9:347:9 | Load: d | positive |
| test.c:348:14:348:14 | Constant: 1 | positive strictlyPositive |
| test.c:348:14:348:14 | Store: 1 | positive strictlyPositive |
| test.c:355:42:355:42 | InitializeParameter: x | positive |
| test.c:356:16:356:17 | Uninitialized: definition of y1 | positive |
| test.c:356:20:356:21 | Uninitialized: definition of y2 | positive |
| test.c:356:24:356:25 | Uninitialized: definition of y3 | positive |
| test.c:356:28:356:29 | Uninitialized: definition of y4 | positive |
| test.c:356:32:356:33 | Uninitialized: definition of y5 | positive |
| test.c:356:36:356:37 | Uninitialized: definition of y6 | positive |
| test.c:356:40:356:41 | Uninitialized: definition of y7 | positive |
| test.c:356:44:356:45 | Uninitialized: definition of y8 | positive |
| test.c:357:3:357:23 | Store: ... = ... | positive |
| test.c:357:8:357:8 | Load: x | positive |
| test.c:357:8:357:23 | Load: ... ? ... : ... | positive |
| test.c:357:8:357:23 | Phi: ... ? ... : ... | positive |
| test.c:357:8:357:23 | Store: ... ? ... : ... | positive |
| test.c:357:8:357:23 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:357:12:357:14 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:357:18:357:18 | Load: x | positive |
| test.c:357:22:357:23 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:358:3:358:24 | Store: ... = ... | positive |
| test.c:358:8:358:8 | Load: x | positive |
| test.c:358:8:358:24 | Load: ... ? ... : ... | positive |
| test.c:358:8:358:24 | Phi: ... ? ... : ... | positive |
| test.c:358:8:358:24 | Store: ... ? ... : ... | positive |
| test.c:358:8:358:24 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:358:13:358:15 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:358:19:358:20 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:358:24:358:24 | Load: x | positive |
| test.c:365:7:365:7 | Load: x | positive |
| test.c:365:11:365:13 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:366:5:366:15 | Store: ... = ... | positive |
| test.c:366:10:366:10 | Load: x | positive |
| test.c:366:10:366:15 | Load: ... ? ... : ... | positive |
| test.c:366:10:366:15 | Phi: ... ? ... : ... | positive |
| test.c:366:10:366:15 | Store: ... ? ... : ... | positive |
| test.c:366:10:366:15 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:366:15:366:15 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:367:5:367:17 | Store: ... = ... | positive |
| test.c:367:10:367:10 | Load: x | positive |
| test.c:367:10:367:17 | Load: ... ? ... : ... | positive |
| test.c:367:10:367:17 | Phi: ... ? ... : ... | positive |
| test.c:367:10:367:17 | Store: ... ? ... : ... | positive |
| test.c:367:10:367:17 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:367:15:367:17 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:368:5:368:21 | Store: ... = ... | positive strictlyPositive |
| test.c:368:10:368:21 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:368:10:368:21 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:368:10:368:21 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:368:11:368:11 | Load: x | positive |
| test.c:368:11:368:13 | Add: ... + ... | positive strictlyPositive |
| test.c:368:13:368:13 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:368:19:368:21 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:369:5:369:36 | Store: ... = ... | positive strictlyPositive |
| test.c:369:10:369:36 | Convert: (unsigned int)... | positive strictlyPositive |
| test.c:369:10:369:36 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:369:10:369:36 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:369:10:369:36 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:369:11:369:30 | Convert: (unsigned char)... | positive |
| test.c:369:27:369:27 | Load: x | positive |
| test.c:369:27:369:29 | Add: ... + ... | positive strictlyPositive |
| test.c:369:29:369:29 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:369:36:369:36 | Constant: 5 | positive strictlyPositive |
| test.c:370:5:370:38 | Store: ... = ... | positive strictlyPositive |
| test.c:370:10:370:38 | Convert: (unsigned int)... | positive strictlyPositive |
| test.c:370:10:370:38 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:370:10:370:38 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:370:10:370:38 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:370:11:370:30 | Convert: (unsigned char)... | positive |
| test.c:370:27:370:27 | Load: x | positive |
| test.c:370:27:370:29 | Add: ... + ... | positive strictlyPositive |
| test.c:370:29:370:29 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:370:36:370:38 | Constant: 500 | positive strictlyPositive |
| test.c:371:5:371:39 | Store: ... = ... | positive strictlyPositive |
| test.c:371:10:371:39 | Convert: (unsigned int)... | positive strictlyPositive |
| test.c:371:10:371:39 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:371:10:371:39 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:371:10:371:39 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:371:11:371:31 | Convert: (unsigned short)... | positive |
| test.c:371:28:371:28 | Load: x | positive |
| test.c:371:28:371:30 | Add: ... + ... | positive strictlyPositive |
| test.c:371:30:371:30 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:371:37:371:39 | Constant: 500 | positive strictlyPositive |
| test.c:373:3:373:47 | Phi: return ... | positive |
| test.c:373:3:373:47 | Phi: return ... | positive |
| test.c:373:3:373:47 | Phi: return ... | positive |
| test.c:373:3:373:47 | Phi: return ... | positive |
| test.c:373:3:373:47 | Phi: return ... | positive |
| test.c:373:3:373:47 | Phi: return ... | positive |
| test.c:373:10:373:11 | Load: y1 | positive |
| test.c:373:10:373:16 | Add: ... + ... | positive |
| test.c:373:10:373:21 | Add: ... + ... | positive |
| test.c:373:10:373:26 | Add: ... + ... | positive |
| test.c:373:10:373:31 | Add: ... + ... | positive |
| test.c:373:10:373:36 | Add: ... + ... | positive |
| test.c:373:10:373:41 | Add: ... + ... | positive |
| test.c:373:10:373:46 | Add: ... + ... | positive |
| test.c:373:10:373:46 | Store: ... + ... | positive |
| test.c:373:15:373:16 | Load: y2 | positive |
| test.c:373:20:373:21 | Load: y3 | positive |
| test.c:373:25:373:26 | Load: y4 | positive |
| test.c:373:30:373:31 | Load: y5 | positive |
| test.c:373:35:373:36 | Load: y6 | positive |
| test.c:373:40:373:41 | Load: y7 | positive |
| test.c:373:45:373:46 | Load: y8 | positive |
| test.c:377:42:377:42 | InitializeParameter: x | positive |
| test.c:378:16:378:17 | Uninitialized: definition of y1 | positive |
| test.c:378:20:378:21 | Uninitialized: definition of y2 | positive |
| test.c:378:24:378:25 | Uninitialized: definition of y3 | positive |
| test.c:378:28:378:29 | Uninitialized: definition of y4 | positive |
| test.c:378:32:378:33 | Uninitialized: definition of y5 | positive |
| test.c:379:3:379:24 | Store: ... = ... | positive strictlyPositive |
| test.c:379:8:379:8 | Load: x | positive |
| test.c:379:8:379:24 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:379:8:379:24 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:379:8:379:24 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:379:8:379:24 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:379:12:379:14 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:379:18:379:18 | Load: x | positive strictlyPositive |
| test.c:379:22:379:24 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:380:3:380:25 | Store: ... = ... | positive strictlyPositive |
| test.c:380:8:380:8 | Load: x | positive |
| test.c:380:8:380:25 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:380:8:380:25 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:380:8:380:25 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:380:8:380:25 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:380:13:380:15 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:380:19:380:21 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:380:25:380:25 | Load: x | positive strictlyPositive |
| test.c:381:3:381:11 | Store: ... = ... | positive strictlyPositive |
| test.c:381:8:381:11 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:382:3:382:11 | Store: ... = ... | positive strictlyPositive |
| test.c:382:8:382:11 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:383:3:383:11 | Store: ... = ... | positive strictlyPositive |
| test.c:383:8:383:11 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:384:7:384:7 | Load: x | positive |
| test.c:384:12:384:14 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:385:5:385:21 | Store: ... = ... | positive strictlyPositive |
| test.c:385:10:385:21 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:385:10:385:21 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:385:10:385:21 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:385:11:385:11 | Load: x | positive strictlyPositive |
| test.c:385:11:385:15 | Sub: ... - ... | positive |
| test.c:385:13:385:15 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:385:21:385:21 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:386:5:386:21 | Store: ... = ... | positive strictlyPositive |
| test.c:386:10:386:21 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:386:10:386:21 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:386:10:386:21 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:386:11:386:11 | Load: x | positive strictlyPositive |
| test.c:386:11:386:15 | Sub: ... - ... | positive |
| test.c:386:13:386:15 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:386:21:386:21 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:387:5:387:38 | Store: ... = ... | positive strictlyPositive |
| test.c:387:10:387:38 | Convert: (unsigned int)... | positive strictlyPositive |
| test.c:387:10:387:38 | Load: ... ? ... : ... | positive strictlyPositive |
| test.c:387:10:387:38 | Phi: ... ? ... : ... | positive strictlyPositive |
| test.c:387:10:387:38 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:387:11:387:32 | Convert: (unsigned char)... | positive |
| test.c:387:27:387:27 | Load: x | positive strictlyPositive |
| test.c:387:27:387:31 | Sub: ... - ... | positive |
| test.c:387:29:387:31 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:387:38:387:38 | Constant: 5 | positive strictlyPositive |
| test.c:389:3:389:32 | Phi: return ... | positive strictlyPositive |
| test.c:389:3:389:32 | Phi: return ... | positive strictlyPositive |
| test.c:389:3:389:32 | Phi: return ... | positive strictlyPositive |
| test.c:389:10:389:11 | Load: y1 | positive strictlyPositive |
| test.c:389:10:389:16 | Add: ... + ... | positive strictlyPositive |
| test.c:389:10:389:21 | Add: ... + ... | positive strictlyPositive |
| test.c:389:10:389:26 | Add: ... + ... | positive strictlyPositive |
| test.c:389:10:389:31 | Add: ... + ... | positive strictlyPositive |
| test.c:389:10:389:31 | Store: ... + ... | positive strictlyPositive |
| test.c:389:15:389:16 | Load: y2 | positive strictlyPositive |
| test.c:389:20:389:21 | Load: y3 | positive strictlyPositive |
| test.c:389:25:389:26 | Load: y4 | positive strictlyPositive |
| test.c:389:30:389:31 | Load: y5 | positive strictlyPositive |
| test.c:393:40:393:40 | InitializeParameter: x | positive |
| test.c:394:20:394:20 | Load: x | positive |
| test.c:394:20:394:36 | Load: ... ? ... : ... | positive |
| test.c:394:20:394:36 | Phi: ... ? ... : ... | positive |
| test.c:394:20:394:36 | Store: ... ? ... : ... | positive |
| test.c:394:20:394:36 | Store: ... ? ... : ... | positive |
| test.c:394:20:394:36 | Store: ... ? ... : ... | positive strictlyPositive |
| test.c:394:24:394:26 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:394:30:394:30 | Load: x | positive |
| test.c:394:34:394:36 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:395:16:395:17 | Uninitialized: definition of y1 | positive |
| test.c:396:16:396:17 | Uninitialized: definition of y2 | positive |
| test.c:397:3:397:15 | Store: ... = ... | positive strictlyPositive |
| test.c:397:9:397:11 | Add: ++ ... | positive strictlyPositive |
| test.c:397:9:397:11 | Constant: ++ ... | positive strictlyPositive |
| test.c:397:9:397:11 | Load: ++ ... | positive |
| test.c:397:9:397:11 | Store: ++ ... | positive strictlyPositive |
| test.c:397:14:397:14 | Load: y | positive strictlyPositive |
| test.c:398:3:398:23 | Store: ... = ... | positive strictlyPositive |
| test.c:398:9:398:11 | Add: ... ++ | positive strictlyPositive |
| test.c:398:9:398:11 | Constant: ... ++ | positive strictlyPositive |
| test.c:398:9:398:11 | Load: ... ++ | positive strictlyPositive |
| test.c:398:9:398:11 | Store: ... ++ | positive strictlyPositive |
| test.c:398:14:398:19 | Add: ... += ... | positive strictlyPositive |
| test.c:398:14:398:19 | Load: ... += ... | positive strictlyPositive |
| test.c:398:14:398:19 | Store: ... += ... | positive strictlyPositive |
| test.c:398:19:398:19 | Constant: (unsigned int)... | positive strictlyPositive |
| test.c:398:22:398:22 | Load: y | positive strictlyPositive |
| test.c:399:10:399:11 | Load: y1 | positive strictlyPositive |
| test.c:399:10:399:16 | Add: ... + ... | positive strictlyPositive |
| test.c:399:10:399:16 | Store: ... + ... | positive strictlyPositive |
| test.c:399:15:399:16 | Load: y2 | positive strictlyPositive |
| test.cpp:9:11:9:12 | Constant: - ... | negative strictlyNegative |
| test.cpp:9:11:9:12 | Store: - ... | negative strictlyNegative |
| test.cpp:11:13:11:13 | Constant: 3 | positive strictlyPositive |
| test.cpp:30:12:30:13 | Constant: - ... | negative strictlyNegative |
| test.cpp:31:5:31:10 | Store: ... = ... | negative strictlyNegative |
| test.cpp:31:9:31:10 | Constant: - ... | negative strictlyNegative |
| test.cpp:33:12:33:12 | Constant: 1 | positive strictlyPositive |
| test.cpp:34:5:34:9 | Store: ... = ... | positive strictlyPositive |
| test.cpp:34:9:34:9 | Constant: 1 | positive strictlyPositive |
| test.cpp:36:12:36:15 | Constant: - ... | negative strictlyNegative |
| test.cpp:37:5:37:12 | Store: ... = ... | negative strictlyNegative |
| test.cpp:37:9:37:12 | Constant: - ... | negative strictlyNegative |
| test.cpp:39:12:39:14 | Constant: 128 | positive strictlyPositive |
| test.cpp:40:5:40:11 | Store: ... = ... | positive strictlyPositive |
| test.cpp:40:9:40:11 | Constant: 128 | positive strictlyPositive |
| test.cpp:42:12:42:16 | Constant: - ... | negative strictlyNegative |
| test.cpp:43:5:43:13 | Store: ... = ... | negative strictlyNegative |
| test.cpp:43:9:43:13 | Constant: - ... | negative strictlyNegative |
| test.cpp:45:12:45:15 | Constant: 1024 | positive strictlyPositive |
| test.cpp:46:5:46:12 | Store: ... = ... | positive strictlyPositive |
| test.cpp:46:9:46:12 | Constant: 1024 | positive strictlyPositive |
| test.cpp:69:10:69:21 | Constant: ... \|\| ... | positive strictlyPositive |
| test.cpp:69:10:69:21 | Load: ... \|\| ... | positive |
| test.cpp:69:10:69:21 | Phi: ... \|\| ... | positive |
| test.cpp:69:10:69:21 | Store: ... \|\| ... | positive |
| test.cpp:69:10:69:21 | Store: ... \|\| ... | positive strictlyPositive |

19
cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.ql Normal file
View File

@@ -0,0 +1,19 @@
import semmle.code.cpp.rangeanalysis.SignAnalysis
import semmle.code.cpp.ir.IR
string getASignString(Instruction i) {
positiveInstruction(i) and
result = "positive"
or
negativeInstruction(i) and
result = "negative"
or
strictlyPositiveInstruction(i) and
result = "strictlyPositive"
or
strictlyNegativeInstruction(i) and
result = "strictlyNegative"
}
from Instruction i
select i, strictconcat(string s | s = getASignString(i) | s, " ")

8
cpp/ql/test/library-tests/rangeanalysis/signanalysis/binary_logical_operator.c Normal file
View File

@@ -0,0 +1,8 @@
int test01(int x, int y) {
int b = x > 10 && y < 0;
if (b) {
return x;
} else {
return y;
}
}

19
cpp/ql/test/library-tests/rangeanalysis/signanalysis/bounded_bounds.c Normal file
View File

@@ -0,0 +1,19 @@
int f(int x, int y) {
if (x < 0) {
return x;
}
if (x < y) {
return y; // y is strictly positive because of the bound on x above
}
return 0;
}
int g(int x, int y) {
if (x < y) {
return y;
}
if (x < 0) {
return x;
}
return 0;
}

24
cpp/ql/test/library-tests/rangeanalysis/signanalysis/inline_assembly.c Normal file
View File

@@ -0,0 +1,24 @@
// The ASM statements are
// causing problems, because our SSA analysis does not notice that they
// might change the value of `x`. This was a latent bug that came out
// of the woodwork when we added support for statement expressions.
int printf(const char *format, ...);
int main() {
unsigned int x = 0, y;
y = 1;
printf("x = %i y = %i\n", x, y); // 0, 1
// exchange x and y
asm volatile ( "xchg %0, %1\n"
: "+r" (x), "+a" (y) // outputs (x and y)
:
:
);
printf("x = %i y = %i\n", x, y); // 1, 0 (but without analysing the ASM: unknown, unknown)
return 0;
}

27
cpp/ql/test/library-tests/rangeanalysis/signanalysis/minmax.c Normal file
View File

@@ -0,0 +1,27 @@
// semmle-extractor-options: --gnu_version 40400
// Note: this file uses statement expressions, which are a GNU extension,
// so it has an options file to specify the compiler version. The statement
// expression extension is described here:
// https://gcc.gnu.org/onlinedocs/gcc/Statement-Exprs.html
int printf(const char *format, ...);
// The & operator is
// causing problems, because it disables SSA. Also, range analysis did not
// have support for the statement expression language feature that is used
// here.
void minmax()
{
int x = 1, y = 2, z = 3;
printf("x = %i, y = %i, z = %i\n", x, y, z); // 1, 2, 3
z = ({
int t = 0;
if (&x != &y) {t = x;} // t = 1
t;
});
printf("x = %i, y = %i, z = %i\n", x, y, z); // 1, 2, 1
}

400
cpp/ql/test/library-tests/rangeanalysis/signanalysis/test.c Normal file
View File

@@ -0,0 +1,400 @@
struct List {
struct List* next;
};
int test1(struct List* p) {
int count = 0;
for (; p; p = p->next) {
count = count+1;
}
return count;
}
int test2(struct List* p) {
int count = 0;
for (; p; p = p->next) {
count = (count+1) % 10;
}
return count;
}
int test3(struct List* p) {
int count = 0;
for (; p; p = p->next) {
count++;
count = count % 10;
}
return count;
}
int test4() {
int i = 0;
int total = 0;
for (i = 0; i < 2; i = i+1) {
total += i;
}
return total + i;
}
int test5() {
int i = 0;
int total = 0;
for (i = 0; i < 2; i++) {
total += i;
}
return total + i;
}
int test6() {
int i = 0;
int total = 0;
for (i = 0; i+2 < 4; i = i+1) {
total += i;
}
return total + i;
}
int test7(int i) {
if (i < 4) {
if (i < 5) {
return i;
}
}
return 1;
}
int test8(int x, int y) {
if (-1000 < y && y < 10) {
if (x < y-2) {
return x;
}
}
return y;
}
int test9(int x, int y) {
if (y == 0) {
if (x < 4) {
return 0;
}
} else {
if (x < 4) {
return 1;
}
}
return x;
}
int test10(int x, int y) {
if (y > 7) {
if (x < y) {
return 0;
}
return x;
}
return 1;
}
int test11(char *p) {
char c;
c = *p;
if (c != '\0')
*p++ = '\0';
if (c == ':') {
c = *p;
if (c != '\0')
*p++ = '\0';
if (c != ',')
return 1;
}
return 0;
}
typedef unsigned long long size_type;
size_type test12_helper() {
static size_type n = 0;
return n++;
}
int test12() {
size_type Start = 0;
while (Start <= test12_helper()-1)
{
const size_type Length = test12_helper();
Start += Length + 1;
}
return 1;
}
// Tests for overflow conditions.
int test13(char c, int i) {
unsigned char uc = c;
unsigned int x = 0;
unsigned int y = x-1;
int z = i+1;
return (double)(c + i + uc + x + y + z);
}
// Regression test for ODASA-6013.
int test14(int x) {
int x0 = (int)(char)x;
int x1 = (int)(unsigned char)x;
int x2 = (int)(unsigned short)x;
int x3 = (int)(unsigned int)x;
char c0 = x;
unsigned short s0 = x;
return x0 + x1 + x2 + x3 + c0 + s0;
}
long long test15(long long x) {
return (x > 0 && x == (int)x) ? x : -1;
}
// Tests for unary operators.
int test_unary(int a) {
int total = 0;
if (3 <= a && a <= 11) {
int b = +a;
int c = -a;
total += b+c;
}
if (0 <= a && a <= 11) {
int b = +a;
int c = -a;
total += b+c;
}
if (-7 <= a && a <= 11) {
int b = +a;
int c = -a;
total += b+c;
}
if (-7 <= a && a <= 1) {
int b = +a;
int c = -a;
total += b+c;
}
if (-7 <= a && a <= 0) {
int b = +a;
int c = -a;
total += b+c;
}
if (-7 <= a && a <= -2) {
int b = +a;
int c = -a;
total += b+c;
}
return total;
}
// Tests for multiplication.
int test_mult01(int a, int b) {
int total = 0;
if (3 <= a && a <= 11 && 5 <= b && b <= 23) {
int r = a*b; // 15 .. 253
total += r;
}
if (3 <= a && a <= 11 && 0 <= b && b <= 23) {
int r = a*b; // 0 .. 253
total += r;
}
if (3 <= a && a <= 11 && -13 <= b && b <= 23) {
int r = a*b; // -143 .. 253
total += r;
}
if (3 <= a && a <= 11 && -13 <= b && b <= 0) {
int r = a*b; // -143 .. 0
total += r;
}
if (3 <= a && a <= 11 && -13 <= b && b <= -7) {
int r = a*b; // -143 .. -21
total += r;
}
return total;
}
// Tests for multiplication.
int test_mult02(int a, int b) {
int total = 0;
if (0 <= a && a <= 11 && 5 <= b && b <= 23) {
int r = a*b; // 0 .. 253
total += r;
}
if (0 <= a && a <= 11 && 0 <= b && b <= 23) {
int r = a*b; // 0 .. 253
total += r;
}
if (0 <= a && a <= 11 && -13 <= b && b <= 23) {
int r = a*b; // -143 .. 253
total += r;
}
if (0 <= a && a <= 11 && -13 <= b && b <= 0) {
int r = a*b; // -143 .. 0
total += r;
}
if (0 <= a && a <= 11 && -13 <= b && b <= -7) {
int r = a*b; // -143 .. 0
total += r;
}
return total;
}
// Tests for multiplication.
int test_mult03(int a, int b) {
int total = 0;
if (-17 <= a && a <= 11 && 5 <= b && b <= 23) {
int r = a*b; // -391 .. 253
total += r;
}
if (-17 <= a && a <= 11 && 0 <= b && b <= 23) {
int r = a*b; // -391 .. 253
total += r;
}
if (-17 <= a && a <= 11 && -13 <= b && b <= 23) {
int r = a*b; // -391 .. 253
total += r;
}
if (-17 <= a && a <= 11 && -13 <= b && b <= 0) {
int r = a*b; // -143 .. 221
total += r;
}
if (-17 <= a && a <= 11 && -13 <= b && b <= -7) {
int r = a*b; // -143 .. 221
total += r;
}
return total;
}
// Tests for multiplication.
int test_mult04(int a, int b) {
int total = 0;
if (-17 <= a && a <= 0 && 5 <= b && b <= 23) {
int r = a*b; // -391 .. 0
total += r;
}
if (-17 <= a && a <= 0 && 0 <= b && b <= 23) {
int r = a*b; // -391 .. 0
total += r;
}
if (-17 <= a && a <= 0 && -13 <= b && b <= 23) {
int r = a*b; // -391 .. 221
total += r;
}
if (-17 <= a && a <= 0 && -13 <= b && b <= 0) {
int r = a*b; // 0 .. 221
total += r;
}
if (-17 <= a && a <= 0 && -13 <= b && b <= -7) {
int r = a*b; // 0 .. 221
total += r;
}
return total;
}
// Tests for multiplication.
int test_mult05(int a, int b) {
int total = 0;
if (-17 <= a && a <= -2 && 5 <= b && b <= 23) {
int r = a*b; // -391 .. -10
total += r;
}
if (-17 <= a && a <= -2 && 0 <= b && b <= 23) {
int r = a*b; // -391 .. 0
total += r;
}
if (-17 <= a && a <= -2 && -13 <= b && b <= 23) {
int r = a*b; // -391 .. 221
total += r;
}
if (-17 <= a && a <= -2 && -13 <= b && b <= 0) {
int r = a*b; // 0 .. 221
total += r;
}
if (-17 <= a && a <= -2 && -13 <= b && b <= -7) {
int r = a*b; // 14 .. 221
total += r;
}
return total;
}
int test16(int x) {
int d, i = 0;
if (x < 0) {
return -1;
}
while (i < 3) {
i++;
}
d = i;
if (x < 0) { // Comparison is always false.
if (d > -x) { // Unreachable code.
return 1;
}
}
return 0;
}
// Test ternary expression upper bounds.
unsigned int test_ternary01(unsigned int x) {
unsigned int y1, y2, y3, y4, y5, y6, y7, y8;
y1 = x < 100 ? x : 10; // y1 < 100
y2 = x >= 100 ? 10 : x; // y2 < 100
y3 = 0;
y4 = 0;
y5 = 0;
y6 = 0;
y7 = 0;
y8 = 0;
if (x < 300) {
y3 = x ?: 5; // y3 < 300
y4 = x ?: 500; // y4 <= 500
y5 = (x+1) ?: 500; // y5 <= 300
y6 = ((unsigned char)(x+1)) ?: 5; // y6 < 256
y7 = ((unsigned char)(x+1)) ?: 500; // y7 <= 500
y8 = ((unsigned short)(x+1)) ?: 500; // y8 <= 300
}
return y1 + y2 + y3 + y4 + y5 + y6 + y7 + y8;
}
// Test ternary expression lower bounds.
unsigned int test_ternary02(unsigned int x) {
unsigned int y1, y2, y3, y4, y5;
y1 = x > 100 ? x : 110; // y1 > 100
y2 = x <= 100 ? 110 : x; // y2 > 100
y3 = 1000;
y4 = 1000;
y5 = 1000;
if (x >= 300) {
y3 = (x-300) ?: 5; // y3 >= 0
y4 = (x-200) ?: 5; // y4 >= 100
y5 = ((unsigned char)(x-200)) ?: 5; // y6 >= 0
}
return y1 + y2 + y3 + y4 + y5;
}
// Test the comma expression.
unsigned int test_comma01(unsigned int x) {
unsigned int y = x < 100 ? x : 100;
unsigned int y1;
unsigned int y2;
y1 = (++y, y);
y2 = (y++, y += 3, y);
return y1 + y2;
}

70
cpp/ql/test/library-tests/rangeanalysis/signanalysis/test.cpp Normal file
View File

@@ -0,0 +1,70 @@
template <typename T>
class vector {
public:
T& operator[](int);
const T& operator[](int) const;
};
int test1(vector<int> vec, int b) {
int x = -1;
if (b) {
x = vec[3];
}
return x;
}
// Regression test for ODASA-6013.
int test2(int x) {
int x0 = static_cast<char>(x);
return x0;
}
// Tests for conversion to bool
bool test3(bool b, int x, int y) {
// The purpose the assignments to `x` below is to generate a lot of
// potential upper and lower bounds for `x`, so that the logic in
// boolConversionLowerBound and boolConversionUpperBound gets exercized.
if (y == 0) {
x = 0;
}
if (y == -1) {
x = -1;
}
if (y == 1) {
x = 1;
}
if (y == -128) {
x = -128;
}
if (y == 128) {
x = 128;
}
if (y == -1024) {
x = -1024;
}
if (y == 1024) {
x = 1024;
}
int t = 0;
if (x == 0) {
bool xb = (bool)x; // (bool)x == false
t += (int)xb;
}
if (x > 0) {
bool xb = (bool)x; // (bool)x == true
t += (int)xb;
}
if (x < 0) {
bool xb = (bool)x; // (bool)x == true
t += (int)xb;
}
bool xb = (bool)x; // Value of (bool)x is unknown.
t += (int)xb;
return b || (bool)t;
}