* validate the pointer with some chance of overlooking safety check * this can create some null/dangling pointer dereferences, which * are used to test static analyzers (not compilers) */
| 465 | * are used to test static analyzers (not compilers) |
| 466 | */ |
| 467 | int |
| 468 | FactPointTo::opportunistic_validate(const Variable* var, const Type* type, const std::vector<const Fact*>& facts) |
| 469 | { |
| 470 | if (var->type->get_indirect_level() <= type->get_indirect_level()) { |
| 471 | return 1; |
| 472 | } |
| 473 | FactPointTo tmp(var->get_collective()); |
| 474 | const FactPointTo* fp = dynamic_cast<const FactPointTo*>(find_related_fact(facts, &tmp)); |
| 475 | if (fp == 0) return 0; |
| 476 | int ret = 0; |
| 477 | if (fp->is_null()) { |
| 478 | if (rnd_flipcoin(CGOptions::null_pointer_dereference_prob())) { |
| 479 | ret = 2; |
| 480 | } else { |
| 481 | return 0; |
| 482 | } |
| 483 | } else { |
| 484 | ret = 1; |
| 485 | } |
| 486 | if (fp->is_dead()) { |
| 487 | if (rnd_flipcoin(CGOptions::dead_pointer_dereference_prob())) { |
| 488 | ret = 2; |
| 489 | } else { |
| 490 | return 0; |
| 491 | } |
| 492 | } |
| 493 | return ret; |
| 494 | } |
| 495 | |
| 496 | /* |
| 497 | * return true if ptr is dangling in the given context |
nothing calls this directly
no test coverage detected