Ted Kremenek | 6f34213 | 2011-03-15 03:17:07 +0000 | [diff] [blame] | 1 | //==- UninitializedValues.cpp - Find Uninitialized Values -------*- C++ --*-==// |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file implements uninitialized values analysis for source-level CFGs. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Richard Smith | 558e887 | 2012-07-13 23:33:44 +0000 | [diff] [blame] | 14 | #include "clang/AST/ASTContext.h" |
Benjamin Kramer | 2fa67ef | 2012-12-01 15:09:41 +0000 | [diff] [blame] | 15 | #include "clang/AST/Attr.h" |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 16 | #include "clang/AST/Decl.h" |
Jordan Rose | d049b40 | 2013-05-15 23:22:55 +0000 | [diff] [blame] | 17 | #include "clang/AST/StmtVisitor.h" |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 18 | #include "clang/Analysis/Analyses/PostOrderCFGView.h" |
Ted Kremenek | 6f34213 | 2011-03-15 03:17:07 +0000 | [diff] [blame] | 19 | #include "clang/Analysis/Analyses/UninitializedValues.h" |
Benjamin Kramer | 2fa67ef | 2012-12-01 15:09:41 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/AnalysisContext.h" |
| 21 | #include "clang/Analysis/CFG.h" |
Ted Kremenek | 25c1d57 | 2012-09-13 00:21:35 +0000 | [diff] [blame] | 22 | #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h" |
Benjamin Kramer | 2fa67ef | 2012-12-01 15:09:41 +0000 | [diff] [blame] | 23 | #include "llvm/ADT/DenseMap.h" |
| 24 | #include "llvm/ADT/Optional.h" |
| 25 | #include "llvm/ADT/PackedVector.h" |
| 26 | #include "llvm/ADT/SmallBitVector.h" |
| 27 | #include "llvm/ADT/SmallVector.h" |
Argyrios Kyrtzidis | b2c60b0 | 2012-03-01 19:45:56 +0000 | [diff] [blame] | 28 | #include "llvm/Support/SaveAndRestore.h" |
Benjamin Kramer | 2fa67ef | 2012-12-01 15:09:41 +0000 | [diff] [blame] | 29 | #include <utility> |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 30 | |
| 31 | using namespace clang; |
| 32 | |
Richard Smith | 558e887 | 2012-07-13 23:33:44 +0000 | [diff] [blame] | 33 | #define DEBUG_LOGGING 0 |
| 34 | |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 35 | static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) { |
Ted Kremenek | 1cbc315 | 2011-03-17 03:06:11 +0000 | [diff] [blame] | 36 | if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() && |
Stephen Hines | c568f1e | 2014-07-21 00:47:37 -0700 | [diff] [blame] | 37 | !vd->isExceptionVariable() && !vd->isInitCapture() && |
Ted Kremenek | 1cbc315 | 2011-03-17 03:06:11 +0000 | [diff] [blame] | 38 | vd->getDeclContext() == dc) { |
| 39 | QualType ty = vd->getType(); |
| 40 | return ty->isScalarType() || ty->isVectorType(); |
| 41 | } |
| 42 | return false; |
Ted Kremenek | c104e53 | 2011-01-18 04:53:25 +0000 | [diff] [blame] | 43 | } |
| 44 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 45 | //------------------------------------------------------------------------====// |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 46 | // DeclToIndex: a mapping from Decls we track to value indices. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 47 | //====------------------------------------------------------------------------// |
| 48 | |
| 49 | namespace { |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 50 | class DeclToIndex { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 51 | llvm::DenseMap<const VarDecl *, unsigned> map; |
| 52 | public: |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 53 | DeclToIndex() {} |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 54 | |
| 55 | /// Compute the actual mapping from declarations to bits. |
| 56 | void computeMap(const DeclContext &dc); |
| 57 | |
| 58 | /// Return the number of declarations in the map. |
| 59 | unsigned size() const { return map.size(); } |
| 60 | |
| 61 | /// Returns the bit vector index for a given declaration. |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 62 | Optional<unsigned> getValueIndex(const VarDecl *d) const; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 63 | }; |
| 64 | } |
| 65 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 66 | void DeclToIndex::computeMap(const DeclContext &dc) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 67 | unsigned count = 0; |
| 68 | DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()), |
| 69 | E(dc.decls_end()); |
| 70 | for ( ; I != E; ++I) { |
David Blaikie | 581deb3 | 2012-06-06 20:45:41 +0000 | [diff] [blame] | 71 | const VarDecl *vd = *I; |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 72 | if (isTrackedVar(vd, &dc)) |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 73 | map[vd] = count++; |
| 74 | } |
| 75 | } |
| 76 | |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 77 | Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const { |
Ted Kremenek | b831c67 | 2011-03-29 01:40:00 +0000 | [diff] [blame] | 78 | llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 79 | if (I == map.end()) |
David Blaikie | 66874fb | 2013-02-21 01:47:18 +0000 | [diff] [blame] | 80 | return None; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 81 | return I->second; |
| 82 | } |
| 83 | |
| 84 | //------------------------------------------------------------------------====// |
| 85 | // CFGBlockValues: dataflow values for CFG blocks. |
| 86 | //====------------------------------------------------------------------------// |
| 87 | |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 88 | // These values are defined in such a way that a merge can be done using |
| 89 | // a bitwise OR. |
| 90 | enum Value { Unknown = 0x0, /* 00 */ |
| 91 | Initialized = 0x1, /* 01 */ |
| 92 | Uninitialized = 0x2, /* 10 */ |
| 93 | MayUninitialized = 0x3 /* 11 */ }; |
| 94 | |
| 95 | static bool isUninitialized(const Value v) { |
| 96 | return v >= Uninitialized; |
| 97 | } |
| 98 | static bool isAlwaysUninit(const Value v) { |
| 99 | return v == Uninitialized; |
| 100 | } |
Ted Kremenek | afb10c4 | 2011-03-15 04:57:29 +0000 | [diff] [blame] | 101 | |
Benjamin Kramer | da57f3e | 2011-03-26 12:38:21 +0000 | [diff] [blame] | 102 | namespace { |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 103 | |
Benjamin Kramer | da3d76b | 2012-09-28 16:44:29 +0000 | [diff] [blame] | 104 | typedef llvm::PackedVector<Value, 2, llvm::SmallBitVector> ValueVector; |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 105 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 106 | class CFGBlockValues { |
| 107 | const CFG &cfg; |
Benjamin Kramer | da3d76b | 2012-09-28 16:44:29 +0000 | [diff] [blame] | 108 | SmallVector<ValueVector, 8> vals; |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 109 | ValueVector scratch; |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 110 | DeclToIndex declToIndex; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 111 | public: |
| 112 | CFGBlockValues(const CFG &cfg); |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 113 | |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 114 | unsigned getNumEntries() const { return declToIndex.size(); } |
| 115 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 116 | void computeSetOfDeclarations(const DeclContext &dc); |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 117 | ValueVector &getValueVector(const CFGBlock *block) { |
Benjamin Kramer | da3d76b | 2012-09-28 16:44:29 +0000 | [diff] [blame] | 118 | return vals[block->getBlockID()]; |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 119 | } |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 120 | |
Richard Smith | a9e8b9e | 2012-07-02 23:23:04 +0000 | [diff] [blame] | 121 | void setAllScratchValues(Value V); |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 122 | void mergeIntoScratch(ValueVector const &source, bool isFirst); |
| 123 | bool updateValueVectorWithScratch(const CFGBlock *block); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 124 | |
| 125 | bool hasNoDeclarations() const { |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 126 | return declToIndex.size() == 0; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 127 | } |
Ted Kremenek | e0e2933 | 2011-08-20 01:15:28 +0000 | [diff] [blame] | 128 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 129 | void resetScratch(); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 130 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 131 | ValueVector::reference operator[](const VarDecl *vd); |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 132 | |
| 133 | Value getValue(const CFGBlock *block, const CFGBlock *dstBlock, |
| 134 | const VarDecl *vd) { |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 135 | const Optional<unsigned> &idx = declToIndex.getValueIndex(vd); |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 136 | assert(idx.hasValue()); |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 137 | return getValueVector(block)[idx.getValue()]; |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 138 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 139 | }; |
Benjamin Kramer | da57f3e | 2011-03-26 12:38:21 +0000 | [diff] [blame] | 140 | } // end anonymous namespace |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 141 | |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 142 | CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {} |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 143 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 144 | void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) { |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 145 | declToIndex.computeMap(dc); |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 146 | unsigned decls = declToIndex.size(); |
| 147 | scratch.resize(decls); |
| 148 | unsigned n = cfg.getNumBlockIDs(); |
| 149 | if (!n) |
| 150 | return; |
| 151 | vals.resize(n); |
| 152 | for (unsigned i = 0; i < n; ++i) |
Benjamin Kramer | da3d76b | 2012-09-28 16:44:29 +0000 | [diff] [blame] | 153 | vals[i].resize(decls); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 154 | } |
| 155 | |
Richard Smith | 558e887 | 2012-07-13 23:33:44 +0000 | [diff] [blame] | 156 | #if DEBUG_LOGGING |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 157 | static void printVector(const CFGBlock *block, ValueVector &bv, |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 158 | unsigned num) { |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 159 | llvm::errs() << block->getBlockID() << " :"; |
| 160 | for (unsigned i = 0; i < bv.size(); ++i) { |
| 161 | llvm::errs() << ' ' << bv[i]; |
| 162 | } |
| 163 | llvm::errs() << " : " << num << '\n'; |
| 164 | } |
| 165 | #endif |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 166 | |
Richard Smith | a9e8b9e | 2012-07-02 23:23:04 +0000 | [diff] [blame] | 167 | void CFGBlockValues::setAllScratchValues(Value V) { |
| 168 | for (unsigned I = 0, E = scratch.size(); I != E; ++I) |
| 169 | scratch[I] = V; |
| 170 | } |
| 171 | |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 172 | void CFGBlockValues::mergeIntoScratch(ValueVector const &source, |
| 173 | bool isFirst) { |
| 174 | if (isFirst) |
| 175 | scratch = source; |
| 176 | else |
| 177 | scratch |= source; |
| 178 | } |
| 179 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 180 | bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) { |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 181 | ValueVector &dst = getValueVector(block); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 182 | bool changed = (dst != scratch); |
| 183 | if (changed) |
| 184 | dst = scratch; |
Richard Smith | 558e887 | 2012-07-13 23:33:44 +0000 | [diff] [blame] | 185 | #if DEBUG_LOGGING |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 186 | printVector(block, scratch, 0); |
| 187 | #endif |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 188 | return changed; |
| 189 | } |
| 190 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 191 | void CFGBlockValues::resetScratch() { |
| 192 | scratch.reset(); |
| 193 | } |
| 194 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 195 | ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) { |
David Blaikie | dc84cd5 | 2013-02-20 22:23:23 +0000 | [diff] [blame] | 196 | const Optional<unsigned> &idx = declToIndex.getValueIndex(vd); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 197 | assert(idx.hasValue()); |
| 198 | return scratch[idx.getValue()]; |
| 199 | } |
| 200 | |
| 201 | //------------------------------------------------------------------------====// |
| 202 | // Worklist: worklist for dataflow analysis. |
| 203 | //====------------------------------------------------------------------------// |
| 204 | |
| 205 | namespace { |
| 206 | class DataflowWorklist { |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 207 | PostOrderCFGView::iterator PO_I, PO_E; |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 208 | SmallVector<const CFGBlock *, 20> worklist; |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 209 | llvm::BitVector enqueuedBlocks; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 210 | public: |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 211 | DataflowWorklist(const CFG &cfg, PostOrderCFGView &view) |
| 212 | : PO_I(view.begin()), PO_E(view.end()), |
| 213 | enqueuedBlocks(cfg.getNumBlockIDs(), true) { |
| 214 | // Treat the first block as already analyzed. |
| 215 | if (PO_I != PO_E) { |
| 216 | assert(*PO_I == &cfg.getEntry()); |
| 217 | enqueuedBlocks[(*PO_I)->getBlockID()] = false; |
| 218 | ++PO_I; |
| 219 | } |
| 220 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 221 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 222 | void enqueueSuccessors(const CFGBlock *block); |
| 223 | const CFGBlock *dequeue(); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 224 | }; |
| 225 | } |
| 226 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 227 | void DataflowWorklist::enqueueSuccessors(const clang::CFGBlock *block) { |
| 228 | for (CFGBlock::const_succ_iterator I = block->succ_begin(), |
| 229 | E = block->succ_end(); I != E; ++I) { |
Chandler Carruth | 8052050 | 2011-07-08 11:19:06 +0000 | [diff] [blame] | 230 | const CFGBlock *Successor = *I; |
| 231 | if (!Successor || enqueuedBlocks[Successor->getBlockID()]) |
| 232 | continue; |
| 233 | worklist.push_back(Successor); |
| 234 | enqueuedBlocks[Successor->getBlockID()] = true; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 235 | } |
| 236 | } |
| 237 | |
| 238 | const CFGBlock *DataflowWorklist::dequeue() { |
Stephen Hines | 6bcf27b | 2014-05-29 04:14:42 -0700 | [diff] [blame] | 239 | const CFGBlock *B = nullptr; |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 240 | |
| 241 | // First dequeue from the worklist. This can represent |
| 242 | // updates along backedges that we want propagated as quickly as possible. |
Robert Wilhelm | 344472e | 2013-08-23 16:11:15 +0000 | [diff] [blame] | 243 | if (!worklist.empty()) |
| 244 | B = worklist.pop_back_val(); |
| 245 | |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 246 | // Next dequeue from the initial reverse post order. This is the |
| 247 | // theoretical ideal in the presence of no back edges. |
| 248 | else if (PO_I != PO_E) { |
| 249 | B = *PO_I; |
| 250 | ++PO_I; |
| 251 | } |
| 252 | else { |
Stephen Hines | 6bcf27b | 2014-05-29 04:14:42 -0700 | [diff] [blame] | 253 | return nullptr; |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 254 | } |
| 255 | |
| 256 | assert(enqueuedBlocks[B->getBlockID()] == true); |
| 257 | enqueuedBlocks[B->getBlockID()] = false; |
| 258 | return B; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 259 | } |
| 260 | |
| 261 | //------------------------------------------------------------------------====// |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 262 | // Classification of DeclRefExprs as use or initialization. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 263 | //====------------------------------------------------------------------------// |
| 264 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 265 | namespace { |
| 266 | class FindVarResult { |
| 267 | const VarDecl *vd; |
| 268 | const DeclRefExpr *dr; |
| 269 | public: |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 270 | FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {} |
| 271 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 272 | const DeclRefExpr *getDeclRefExpr() const { return dr; } |
| 273 | const VarDecl *getDecl() const { return vd; } |
| 274 | }; |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 275 | |
| 276 | static const Expr *stripCasts(ASTContext &C, const Expr *Ex) { |
| 277 | while (Ex) { |
| 278 | Ex = Ex->IgnoreParenNoopCasts(C); |
| 279 | if (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { |
| 280 | if (CE->getCastKind() == CK_LValueBitCast) { |
| 281 | Ex = CE->getSubExpr(); |
| 282 | continue; |
| 283 | } |
| 284 | } |
| 285 | break; |
| 286 | } |
| 287 | return Ex; |
| 288 | } |
| 289 | |
| 290 | /// If E is an expression comprising a reference to a single variable, find that |
| 291 | /// variable. |
| 292 | static FindVarResult findVar(const Expr *E, const DeclContext *DC) { |
| 293 | if (const DeclRefExpr *DRE = |
| 294 | dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E))) |
| 295 | if (const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl())) |
| 296 | if (isTrackedVar(VD, DC)) |
| 297 | return FindVarResult(VD, DRE); |
Stephen Hines | 6bcf27b | 2014-05-29 04:14:42 -0700 | [diff] [blame] | 298 | return FindVarResult(nullptr, nullptr); |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 299 | } |
| 300 | |
| 301 | /// \brief Classify each DeclRefExpr as an initialization or a use. Any |
| 302 | /// DeclRefExpr which isn't explicitly classified will be assumed to have |
| 303 | /// escaped the analysis and will be treated as an initialization. |
| 304 | class ClassifyRefs : public StmtVisitor<ClassifyRefs> { |
| 305 | public: |
| 306 | enum Class { |
| 307 | Init, |
| 308 | Use, |
| 309 | SelfInit, |
| 310 | Ignore |
| 311 | }; |
| 312 | |
| 313 | private: |
| 314 | const DeclContext *DC; |
| 315 | llvm::DenseMap<const DeclRefExpr*, Class> Classification; |
| 316 | |
| 317 | bool isTrackedVar(const VarDecl *VD) const { |
| 318 | return ::isTrackedVar(VD, DC); |
| 319 | } |
| 320 | |
| 321 | void classify(const Expr *E, Class C); |
| 322 | |
| 323 | public: |
| 324 | ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {} |
| 325 | |
| 326 | void VisitDeclStmt(DeclStmt *DS); |
| 327 | void VisitUnaryOperator(UnaryOperator *UO); |
| 328 | void VisitBinaryOperator(BinaryOperator *BO); |
| 329 | void VisitCallExpr(CallExpr *CE); |
| 330 | void VisitCastExpr(CastExpr *CE); |
| 331 | |
| 332 | void operator()(Stmt *S) { Visit(S); } |
| 333 | |
| 334 | Class get(const DeclRefExpr *DRE) const { |
| 335 | llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I |
| 336 | = Classification.find(DRE); |
| 337 | if (I != Classification.end()) |
| 338 | return I->second; |
| 339 | |
| 340 | const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl()); |
| 341 | if (!VD || !isTrackedVar(VD)) |
| 342 | return Ignore; |
| 343 | |
| 344 | return Init; |
| 345 | } |
| 346 | }; |
| 347 | } |
| 348 | |
| 349 | static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) { |
| 350 | if (Expr *Init = VD->getInit()) { |
| 351 | const DeclRefExpr *DRE |
| 352 | = dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init)); |
| 353 | if (DRE && DRE->getDecl() == VD) |
| 354 | return DRE; |
| 355 | } |
Stephen Hines | 6bcf27b | 2014-05-29 04:14:42 -0700 | [diff] [blame] | 356 | return nullptr; |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 357 | } |
| 358 | |
| 359 | void ClassifyRefs::classify(const Expr *E, Class C) { |
Ted Kremenek | 77fd3c0 | 2013-01-19 00:25:06 +0000 | [diff] [blame] | 360 | // The result of a ?: could also be an lvalue. |
| 361 | E = E->IgnoreParens(); |
| 362 | if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) { |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 363 | classify(CO->getTrueExpr(), C); |
Ted Kremenek | 77fd3c0 | 2013-01-19 00:25:06 +0000 | [diff] [blame] | 364 | classify(CO->getFalseExpr(), C); |
| 365 | return; |
| 366 | } |
| 367 | |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 368 | if (const BinaryConditionalOperator *BCO = |
| 369 | dyn_cast<BinaryConditionalOperator>(E)) { |
| 370 | classify(BCO->getFalseExpr(), C); |
| 371 | return; |
| 372 | } |
| 373 | |
| 374 | if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) { |
| 375 | classify(OVE->getSourceExpr(), C); |
| 376 | return; |
| 377 | } |
| 378 | |
| 379 | if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) { |
| 380 | if (BO->getOpcode() == BO_Comma) |
| 381 | classify(BO->getRHS(), C); |
| 382 | return; |
| 383 | } |
| 384 | |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 385 | FindVarResult Var = findVar(E, DC); |
| 386 | if (const DeclRefExpr *DRE = Var.getDeclRefExpr()) |
| 387 | Classification[DRE] = std::max(Classification[DRE], C); |
| 388 | } |
| 389 | |
| 390 | void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) { |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 391 | for (auto *DI : DS->decls()) { |
| 392 | VarDecl *VD = dyn_cast<VarDecl>(DI); |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 393 | if (VD && isTrackedVar(VD)) |
| 394 | if (const DeclRefExpr *DRE = getSelfInitExpr(VD)) |
| 395 | Classification[DRE] = SelfInit; |
| 396 | } |
| 397 | } |
| 398 | |
| 399 | void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) { |
| 400 | // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this |
| 401 | // is not a compound-assignment, we will treat it as initializing the variable |
| 402 | // when TransferFunctions visits it. A compound-assignment does not affect |
| 403 | // whether a variable is uninitialized, and there's no point counting it as a |
| 404 | // use. |
Richard Smith | 6cfa78f | 2012-07-17 01:27:33 +0000 | [diff] [blame] | 405 | if (BO->isCompoundAssignmentOp()) |
| 406 | classify(BO->getLHS(), Use); |
| 407 | else if (BO->getOpcode() == BO_Assign) |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 408 | classify(BO->getLHS(), Ignore); |
| 409 | } |
| 410 | |
| 411 | void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) { |
| 412 | // Increment and decrement are uses despite there being no lvalue-to-rvalue |
| 413 | // conversion. |
| 414 | if (UO->isIncrementDecrementOp()) |
| 415 | classify(UO->getSubExpr(), Use); |
| 416 | } |
| 417 | |
| 418 | void ClassifyRefs::VisitCallExpr(CallExpr *CE) { |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 419 | // Classify arguments to std::move as used. |
| 420 | if (CE->getNumArgs() == 1) { |
| 421 | if (FunctionDecl *FD = CE->getDirectCallee()) { |
Stephen Hines | 0e2c34f | 2015-03-23 12:09:02 -0700 | [diff] [blame^] | 422 | if (FD->isInStdNamespace() && FD->getIdentifier() && |
| 423 | FD->getIdentifier()->isStr("move")) { |
Stephen Hines | 176edba | 2014-12-01 14:53:08 -0800 | [diff] [blame] | 424 | classify(CE->getArg(0), Use); |
| 425 | return; |
| 426 | } |
| 427 | } |
| 428 | } |
| 429 | |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 430 | // If a value is passed by const reference to a function, we should not assume |
| 431 | // that it is initialized by the call, and we conservatively do not assume |
| 432 | // that it is used. |
| 433 | for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end(); |
| 434 | I != E; ++I) |
| 435 | if ((*I)->getType().isConstQualified() && (*I)->isGLValue()) |
| 436 | classify(*I, Ignore); |
| 437 | } |
| 438 | |
| 439 | void ClassifyRefs::VisitCastExpr(CastExpr *CE) { |
| 440 | if (CE->getCastKind() == CK_LValueToRValue) |
| 441 | classify(CE->getSubExpr(), Use); |
| 442 | else if (CStyleCastExpr *CSE = dyn_cast<CStyleCastExpr>(CE)) { |
| 443 | if (CSE->getType()->isVoidType()) { |
| 444 | // Squelch any detected load of an uninitialized value if |
| 445 | // we cast it to void. |
| 446 | // e.g. (void) x; |
| 447 | classify(CSE->getSubExpr(), Ignore); |
| 448 | } |
| 449 | } |
| 450 | } |
| 451 | |
| 452 | //------------------------------------------------------------------------====// |
| 453 | // Transfer function for uninitialized values analysis. |
| 454 | //====------------------------------------------------------------------------// |
| 455 | |
| 456 | namespace { |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 457 | class TransferFunctions : public StmtVisitor<TransferFunctions> { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 458 | CFGBlockValues &vals; |
| 459 | const CFG &cfg; |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 460 | const CFGBlock *block; |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 461 | AnalysisDeclContext ∾ |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 462 | const ClassifyRefs &classification; |
Ted Kremenek | 25c1d57 | 2012-09-13 00:21:35 +0000 | [diff] [blame] | 463 | ObjCNoReturn objCNoRet; |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 464 | UninitVariablesHandler &handler; |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 465 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 466 | public: |
| 467 | TransferFunctions(CFGBlockValues &vals, const CFG &cfg, |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 468 | const CFGBlock *block, AnalysisDeclContext &ac, |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 469 | const ClassifyRefs &classification, |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 470 | UninitVariablesHandler &handler) |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 471 | : vals(vals), cfg(cfg), block(block), ac(ac), |
Ted Kremenek | 25c1d57 | 2012-09-13 00:21:35 +0000 | [diff] [blame] | 472 | classification(classification), objCNoRet(ac.getASTContext()), |
| 473 | handler(handler) {} |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 474 | |
Richard Smith | 8189188 | 2012-05-24 23:45:35 +0000 | [diff] [blame] | 475 | void reportUse(const Expr *ex, const VarDecl *vd); |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 476 | |
Ted Kremenek | 25c1d57 | 2012-09-13 00:21:35 +0000 | [diff] [blame] | 477 | void VisitBinaryOperator(BinaryOperator *bo); |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 478 | void VisitBlockExpr(BlockExpr *be); |
Richard Smith | a9e8b9e | 2012-07-02 23:23:04 +0000 | [diff] [blame] | 479 | void VisitCallExpr(CallExpr *ce); |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 480 | void VisitDeclRefExpr(DeclRefExpr *dr); |
Ted Kremenek | 25c1d57 | 2012-09-13 00:21:35 +0000 | [diff] [blame] | 481 | void VisitDeclStmt(DeclStmt *ds); |
| 482 | void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS); |
| 483 | void VisitObjCMessageExpr(ObjCMessageExpr *ME); |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 484 | |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 485 | bool isTrackedVar(const VarDecl *vd) { |
| 486 | return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl())); |
| 487 | } |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 488 | |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 489 | FindVarResult findVar(const Expr *ex) { |
| 490 | return ::findVar(ex, cast<DeclContext>(ac.getDecl())); |
| 491 | } |
| 492 | |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 493 | UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) { |
| 494 | UninitUse Use(ex, isAlwaysUninit(v)); |
| 495 | |
| 496 | assert(isUninitialized(v)); |
| 497 | if (Use.getKind() == UninitUse::Always) |
| 498 | return Use; |
| 499 | |
| 500 | // If an edge which leads unconditionally to this use did not initialize |
| 501 | // the variable, we can say something stronger than 'may be uninitialized': |
| 502 | // we can say 'either it's used uninitialized or you have dead code'. |
| 503 | // |
| 504 | // We track the number of successors of a node which have been visited, and |
| 505 | // visit a node once we have visited all of its successors. Only edges where |
| 506 | // the variable might still be uninitialized are followed. Since a variable |
| 507 | // can't transfer from being initialized to being uninitialized, this will |
| 508 | // trace out the subgraph which inevitably leads to the use and does not |
| 509 | // initialize the variable. We do not want to skip past loops, since their |
| 510 | // non-termination might be correlated with the initialization condition. |
| 511 | // |
| 512 | // For example: |
| 513 | // |
| 514 | // void f(bool a, bool b) { |
| 515 | // block1: int n; |
| 516 | // if (a) { |
| 517 | // block2: if (b) |
| 518 | // block3: n = 1; |
| 519 | // block4: } else if (b) { |
| 520 | // block5: while (!a) { |
| 521 | // block6: do_work(&a); |
| 522 | // n = 2; |
| 523 | // } |
| 524 | // } |
| 525 | // block7: if (a) |
| 526 | // block8: g(); |
| 527 | // block9: return n; |
| 528 | // } |
| 529 | // |
| 530 | // Starting from the maybe-uninitialized use in block 9: |
| 531 | // * Block 7 is not visited because we have only visited one of its two |
| 532 | // successors. |
| 533 | // * Block 8 is visited because we've visited its only successor. |
| 534 | // From block 8: |
| 535 | // * Block 7 is visited because we've now visited both of its successors. |
| 536 | // From block 7: |
| 537 | // * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all |
| 538 | // of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively). |
| 539 | // * Block 3 is not visited because it initializes 'n'. |
| 540 | // Now the algorithm terminates, having visited blocks 7 and 8, and having |
| 541 | // found the frontier is blocks 2, 4, and 5. |
| 542 | // |
| 543 | // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2 |
| 544 | // and 4), so we report that any time either of those edges is taken (in |
| 545 | // each case when 'b == false'), 'n' is used uninitialized. |
Dmitri Gribenko | cfa88f8 | 2013-01-12 19:30:44 +0000 | [diff] [blame] | 546 | SmallVector<const CFGBlock*, 32> Queue; |
| 547 | SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0); |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 548 | Queue.push_back(block); |
| 549 | // Specify that we've already visited all successors of the starting block. |
| 550 | // This has the dual purpose of ensuring we never add it to the queue, and |
| 551 | // of marking it as not being a candidate element of the frontier. |
| 552 | SuccsVisited[block->getBlockID()] = block->succ_size(); |
| 553 | while (!Queue.empty()) { |
Robert Wilhelm | 344472e | 2013-08-23 16:11:15 +0000 | [diff] [blame] | 554 | const CFGBlock *B = Queue.pop_back_val(); |
Richard Smith | 8a1fdfc | 2013-09-12 18:49:10 +0000 | [diff] [blame] | 555 | |
| 556 | // If the use is always reached from the entry block, make a note of that. |
| 557 | if (B == &cfg.getEntry()) |
| 558 | Use.setUninitAfterCall(); |
| 559 | |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 560 | for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end(); |
| 561 | I != E; ++I) { |
| 562 | const CFGBlock *Pred = *I; |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 563 | if (!Pred) |
| 564 | continue; |
| 565 | |
Richard Smith | 8a1fdfc | 2013-09-12 18:49:10 +0000 | [diff] [blame] | 566 | Value AtPredExit = vals.getValue(Pred, B, vd); |
| 567 | if (AtPredExit == Initialized) |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 568 | // This block initializes the variable. |
| 569 | continue; |
Richard Smith | 8a1fdfc | 2013-09-12 18:49:10 +0000 | [diff] [blame] | 570 | if (AtPredExit == MayUninitialized && |
Stephen Hines | 6bcf27b | 2014-05-29 04:14:42 -0700 | [diff] [blame] | 571 | vals.getValue(B, nullptr, vd) == Uninitialized) { |
Richard Smith | 8a1fdfc | 2013-09-12 18:49:10 +0000 | [diff] [blame] | 572 | // This block declares the variable (uninitialized), and is reachable |
| 573 | // from a block that initializes the variable. We can't guarantee to |
| 574 | // give an earlier location for the diagnostic (and it appears that |
| 575 | // this code is intended to be reachable) so give a diagnostic here |
| 576 | // and go no further down this path. |
| 577 | Use.setUninitAfterDecl(); |
| 578 | continue; |
| 579 | } |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 580 | |
Richard Smith | 558e887 | 2012-07-13 23:33:44 +0000 | [diff] [blame] | 581 | unsigned &SV = SuccsVisited[Pred->getBlockID()]; |
| 582 | if (!SV) { |
| 583 | // When visiting the first successor of a block, mark all NULL |
| 584 | // successors as having been visited. |
| 585 | for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(), |
| 586 | SE = Pred->succ_end(); |
| 587 | SI != SE; ++SI) |
| 588 | if (!*SI) |
| 589 | ++SV; |
| 590 | } |
| 591 | |
| 592 | if (++SV == Pred->succ_size()) |
Richard Smith | 2815e1a | 2012-05-25 02:17:09 +0000 | [diff] [blame] | 593 | // All paths from this block lead to the use and don't initialize the |
| 594 | // variable. |
| 595 | Queue.push_back(Pred); |
| 596 | } |
| 597 | } |
| 598 | |
| 599 | // Scan the frontier, looking for blocks where the variable was |
| 600 | // uninitialized. |
| 601 | for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) { |
| 602 | const CFGBlock *Block = *BI; |
| 603 | unsigned BlockID = Block->getBlockID(); |
| 604 | const Stmt *Term = Block->getTerminator(); |
| 605 | if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() && |
| 606 | Term) { |
| 607 | // This block inevitably leads to the use. If we have an edge from here |
| 608 | // to a post-dominator block, and the variable is uninitialized on that |
| 609 | // edge, we have found a bug. |
| 610 | for (CFGBlock::const_succ_iterator I = Block->succ_begin(), |
| 611 | E = Block->succ_end(); I != E; ++I) { |
| 612 | const CFGBlock *Succ = *I; |
| 613 | if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() && |
| 614 | vals.getValue(Block, Succ, vd) == Uninitialized) { |
| 615 | // Switch cases are a special case: report the label to the caller |
| 616 | // as the 'terminator', not the switch statement itself. Suppress |
| 617 | // situations where no label matched: we can't be sure that's |
| 618 | // possible. |
| 619 | if (isa<SwitchStmt>(Term)) { |
| 620 | const Stmt *Label = Succ->getLabel(); |
| 621 | if (!Label || !isa<SwitchCase>(Label)) |
| 622 | // Might not be possible. |
| 623 | continue; |
| 624 | UninitUse::Branch Branch; |
| 625 | Branch.Terminator = Label; |
| 626 | Branch.Output = 0; // Ignored. |
| 627 | Use.addUninitBranch(Branch); |
| 628 | } else { |
| 629 | UninitUse::Branch Branch; |
| 630 | Branch.Terminator = Term; |
| 631 | Branch.Output = I - Block->succ_begin(); |
| 632 | Use.addUninitBranch(Branch); |
| 633 | } |
| 634 | } |
| 635 | } |
| 636 | } |
| 637 | } |
| 638 | |
| 639 | return Use; |
| 640 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 641 | }; |
| 642 | } |
| 643 | |
Richard Smith | 8189188 | 2012-05-24 23:45:35 +0000 | [diff] [blame] | 644 | void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) { |
Richard Smith | 8189188 | 2012-05-24 23:45:35 +0000 | [diff] [blame] | 645 | Value v = vals[vd]; |
| 646 | if (isUninitialized(v)) |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 647 | handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v)); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 648 | } |
| 649 | |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 650 | void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) { |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 651 | // This represents an initialization of the 'element' value. |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 652 | if (DeclStmt *DS = dyn_cast<DeclStmt>(FS->getElement())) { |
| 653 | const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl()); |
| 654 | if (isTrackedVar(VD)) |
| 655 | vals[VD] = Initialized; |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 656 | } |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 657 | } |
| 658 | |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 659 | void TransferFunctions::VisitBlockExpr(BlockExpr *be) { |
Ted Kremenek | bc8b44c | 2011-03-31 22:32:41 +0000 | [diff] [blame] | 660 | const BlockDecl *bd = be->getBlockDecl(); |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 661 | for (const auto &I : bd->captures()) { |
| 662 | const VarDecl *vd = I.getVariable(); |
Ted Kremenek | bc8b44c | 2011-03-31 22:32:41 +0000 | [diff] [blame] | 663 | if (!isTrackedVar(vd)) |
| 664 | continue; |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 665 | if (I.isByRef()) { |
Ted Kremenek | bc8b44c | 2011-03-31 22:32:41 +0000 | [diff] [blame] | 666 | vals[vd] = Initialized; |
| 667 | continue; |
| 668 | } |
Richard Smith | 8189188 | 2012-05-24 23:45:35 +0000 | [diff] [blame] | 669 | reportUse(be, vd); |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 670 | } |
| 671 | } |
| 672 | |
Richard Smith | a9e8b9e | 2012-07-02 23:23:04 +0000 | [diff] [blame] | 673 | void TransferFunctions::VisitCallExpr(CallExpr *ce) { |
Ted Kremenek | 44ca53f | 2012-09-12 05:53:43 +0000 | [diff] [blame] | 674 | if (Decl *Callee = ce->getCalleeDecl()) { |
| 675 | if (Callee->hasAttr<ReturnsTwiceAttr>()) { |
| 676 | // After a call to a function like setjmp or vfork, any variable which is |
| 677 | // initialized anywhere within this function may now be initialized. For |
| 678 | // now, just assume such a call initializes all variables. FIXME: Only |
| 679 | // mark variables as initialized if they have an initializer which is |
| 680 | // reachable from here. |
| 681 | vals.setAllScratchValues(Initialized); |
| 682 | } |
| 683 | else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) { |
| 684 | // Functions labeled like "analyzer_noreturn" are often used to denote |
| 685 | // "panic" functions that in special debug situations can still return, |
| 686 | // but for the most part should not be treated as returning. This is a |
| 687 | // useful annotation borrowed from the static analyzer that is useful for |
| 688 | // suppressing branch-specific false positives when we call one of these |
| 689 | // functions but keep pretending the path continues (when in reality the |
| 690 | // user doesn't care). |
| 691 | vals.setAllScratchValues(Unknown); |
| 692 | } |
| 693 | } |
Richard Smith | a9e8b9e | 2012-07-02 23:23:04 +0000 | [diff] [blame] | 694 | } |
| 695 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 696 | void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) { |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 697 | switch (classification.get(dr)) { |
| 698 | case ClassifyRefs::Ignore: |
| 699 | break; |
| 700 | case ClassifyRefs::Use: |
| 701 | reportUse(dr, cast<VarDecl>(dr->getDecl())); |
| 702 | break; |
| 703 | case ClassifyRefs::Init: |
| 704 | vals[cast<VarDecl>(dr->getDecl())] = Initialized; |
| 705 | break; |
| 706 | case ClassifyRefs::SelfInit: |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 707 | handler.handleSelfInit(cast<VarDecl>(dr->getDecl())); |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 708 | break; |
| 709 | } |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 710 | } |
| 711 | |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 712 | void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) { |
| 713 | if (BO->getOpcode() == BO_Assign) { |
| 714 | FindVarResult Var = findVar(BO->getLHS()); |
| 715 | if (const VarDecl *VD = Var.getDecl()) |
| 716 | vals[VD] = Initialized; |
| 717 | } |
| 718 | } |
| 719 | |
| 720 | void TransferFunctions::VisitDeclStmt(DeclStmt *DS) { |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 721 | for (auto *DI : DS->decls()) { |
| 722 | VarDecl *VD = dyn_cast<VarDecl>(DI); |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 723 | if (VD && isTrackedVar(VD)) { |
| 724 | if (getSelfInitExpr(VD)) { |
| 725 | // If the initializer consists solely of a reference to itself, we |
| 726 | // explicitly mark the variable as uninitialized. This allows code |
| 727 | // like the following: |
| 728 | // |
| 729 | // int x = x; |
| 730 | // |
| 731 | // to deliberately leave a variable uninitialized. Different analysis |
| 732 | // clients can detect this pattern and adjust their reporting |
| 733 | // appropriately, but we need to continue to analyze subsequent uses |
| 734 | // of the variable. |
| 735 | vals[VD] = Uninitialized; |
| 736 | } else if (VD->getInit()) { |
| 737 | // Treat the new variable as initialized. |
| 738 | vals[VD] = Initialized; |
| 739 | } else { |
| 740 | // No initializer: the variable is now uninitialized. This matters |
| 741 | // for cases like: |
| 742 | // while (...) { |
| 743 | // int n; |
| 744 | // use(n); |
| 745 | // n = 0; |
| 746 | // } |
| 747 | // FIXME: Mark the variable as uninitialized whenever its scope is |
| 748 | // left, since its scope could be re-entered by a jump over the |
| 749 | // declaration. |
| 750 | vals[VD] = Uninitialized; |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 751 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 752 | } |
| 753 | } |
| 754 | } |
| 755 | |
Ted Kremenek | 25c1d57 | 2012-09-13 00:21:35 +0000 | [diff] [blame] | 756 | void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) { |
| 757 | // If the Objective-C message expression is an implicit no-return that |
| 758 | // is not modeled in the CFG, set the tracked dataflow values to Unknown. |
| 759 | if (objCNoRet.isImplicitNoReturn(ME)) { |
| 760 | vals.setAllScratchValues(Unknown); |
| 761 | } |
| 762 | } |
| 763 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 764 | //------------------------------------------------------------------------====// |
| 765 | // High-level "driver" logic for uninitialized values analysis. |
| 766 | //====------------------------------------------------------------------------// |
| 767 | |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 768 | static bool runOnBlock(const CFGBlock *block, const CFG &cfg, |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 769 | AnalysisDeclContext &ac, CFGBlockValues &vals, |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 770 | const ClassifyRefs &classification, |
Ted Kremenek | f8adeef | 2011-04-04 20:30:58 +0000 | [diff] [blame] | 771 | llvm::BitVector &wasAnalyzed, |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 772 | UninitVariablesHandler &handler) { |
Ted Kremenek | f8adeef | 2011-04-04 20:30:58 +0000 | [diff] [blame] | 773 | wasAnalyzed[block->getBlockID()] = true; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 774 | vals.resetScratch(); |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 775 | // Merge in values of predecessor blocks. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 776 | bool isFirst = true; |
| 777 | for (CFGBlock::const_pred_iterator I = block->pred_begin(), |
| 778 | E = block->pred_end(); I != E; ++I) { |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 779 | const CFGBlock *pred = *I; |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 780 | if (!pred) |
| 781 | continue; |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 782 | if (wasAnalyzed[pred->getBlockID()]) { |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 783 | vals.mergeIntoScratch(vals.getValueVector(pred), isFirst); |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 784 | isFirst = false; |
| 785 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 786 | } |
| 787 | // Apply the transfer function. |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 788 | TransferFunctions tf(vals, cfg, block, ac, classification, handler); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 789 | for (CFGBlock::const_iterator I = block->begin(), E = block->end(); |
| 790 | I != E; ++I) { |
David Blaikie | b078054 | 2013-02-23 00:29:34 +0000 | [diff] [blame] | 791 | if (Optional<CFGStmt> cs = I->getAs<CFGStmt>()) |
| 792 | tf.Visit(const_cast<Stmt*>(cs->getStmt())); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 793 | } |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 794 | return vals.updateValueVectorWithScratch(block); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 795 | } |
| 796 | |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 797 | /// PruneBlocksHandler is a special UninitVariablesHandler that is used |
| 798 | /// to detect when a CFGBlock has any *potential* use of an uninitialized |
| 799 | /// variable. It is mainly used to prune out work during the final |
| 800 | /// reporting pass. |
| 801 | namespace { |
| 802 | struct PruneBlocksHandler : public UninitVariablesHandler { |
| 803 | PruneBlocksHandler(unsigned numBlocks) |
| 804 | : hadUse(numBlocks, false), hadAnyUse(false), |
| 805 | currentBlock(0) {} |
| 806 | |
| 807 | virtual ~PruneBlocksHandler() {} |
| 808 | |
| 809 | /// Records if a CFGBlock had a potential use of an uninitialized variable. |
| 810 | llvm::BitVector hadUse; |
| 811 | |
| 812 | /// Records if any CFGBlock had a potential use of an uninitialized variable. |
| 813 | bool hadAnyUse; |
| 814 | |
| 815 | /// The current block to scribble use information. |
| 816 | unsigned currentBlock; |
| 817 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 818 | void handleUseOfUninitVariable(const VarDecl *vd, |
| 819 | const UninitUse &use) override { |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 820 | hadUse[currentBlock] = true; |
| 821 | hadAnyUse = true; |
| 822 | } |
| 823 | |
| 824 | /// Called when the uninitialized variable analysis detects the |
| 825 | /// idiom 'int x = x'. All other uses of 'x' within the initializer |
| 826 | /// are handled by handleUseOfUninitVariable. |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 827 | void handleSelfInit(const VarDecl *vd) override { |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 828 | hadUse[currentBlock] = true; |
| 829 | hadAnyUse = true; |
| 830 | } |
| 831 | }; |
| 832 | } |
| 833 | |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 834 | void clang::runUninitializedVariablesAnalysis( |
| 835 | const DeclContext &dc, |
| 836 | const CFG &cfg, |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 837 | AnalysisDeclContext &ac, |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 838 | UninitVariablesHandler &handler, |
| 839 | UninitVariablesAnalysisStats &stats) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 840 | CFGBlockValues vals(cfg); |
| 841 | vals.computeSetOfDeclarations(dc); |
| 842 | if (vals.hasNoDeclarations()) |
| 843 | return; |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 844 | |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 845 | stats.NumVariablesAnalyzed = vals.getNumEntries(); |
| 846 | |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 847 | // Precompute which expressions are uses and which are initializations. |
| 848 | ClassifyRefs classification(ac); |
| 849 | cfg.VisitBlockStmts(classification); |
| 850 | |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 851 | // Mark all variables uninitialized at the entry. |
| 852 | const CFGBlock &entry = cfg.getEntry(); |
Ted Kremenek | eee18c3 | 2012-07-19 04:59:05 +0000 | [diff] [blame] | 853 | ValueVector &vec = vals.getValueVector(&entry); |
| 854 | const unsigned n = vals.getNumEntries(); |
| 855 | for (unsigned j = 0; j < n ; ++j) { |
| 856 | vec[j] = Uninitialized; |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 857 | } |
| 858 | |
| 859 | // Proceed with the workist. |
Ted Kremenek | c160258 | 2012-11-17 02:00:00 +0000 | [diff] [blame] | 860 | DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>()); |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 861 | llvm::BitVector previouslyVisited(cfg.getNumBlockIDs()); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 862 | worklist.enqueueSuccessors(&cfg.getEntry()); |
Ted Kremenek | f8adeef | 2011-04-04 20:30:58 +0000 | [diff] [blame] | 863 | llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false); |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 864 | wasAnalyzed[cfg.getEntry().getBlockID()] = true; |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 865 | PruneBlocksHandler PBH(cfg.getNumBlockIDs()); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 866 | |
| 867 | while (const CFGBlock *block = worklist.dequeue()) { |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 868 | PBH.currentBlock = block->getBlockID(); |
| 869 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 870 | // Did the block change? |
Richard Smith | 9532e0d | 2012-07-17 00:06:14 +0000 | [diff] [blame] | 871 | bool changed = runOnBlock(block, cfg, ac, vals, |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 872 | classification, wasAnalyzed, PBH); |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 873 | ++stats.NumBlockVisits; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 874 | if (changed || !previouslyVisited[block->getBlockID()]) |
| 875 | worklist.enqueueSuccessors(block); |
| 876 | previouslyVisited[block->getBlockID()] = true; |
| 877 | } |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 878 | |
| 879 | if (!PBH.hadAnyUse) |
| 880 | return; |
| 881 | |
Enea Zaffanella | 67d472c | 2013-01-11 11:37:08 +0000 | [diff] [blame] | 882 | // Run through the blocks one more time, and report uninitialized variables. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 883 | for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) { |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 884 | const CFGBlock *block = *BI; |
Ted Kremenek | eba76a4 | 2012-11-17 07:18:30 +0000 | [diff] [blame] | 885 | if (PBH.hadUse[block->getBlockID()]) { |
| 886 | runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler); |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 887 | ++stats.NumBlockVisits; |
| 888 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 889 | } |
| 890 | } |
| 891 | |
| 892 | UninitVariablesHandler::~UninitVariablesHandler() {} |