Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 1 | //== ObjCSelfInitChecker.cpp - Checker for 'self' initialization -*- C++ -*--=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This defines ObjCSelfInitChecker, a builtin check that checks for uses of |
| 11 | // 'self' before proper initialization. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
| 15 | // This checks initialization methods to verify that they assign 'self' to the |
| 16 | // result of an initialization call (e.g. [super init], or [self initWith..]) |
| 17 | // before using 'self' or any instance variable. |
| 18 | // |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame] | 19 | // To perform the required checking, values are tagged with flags that indicate |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 20 | // 1) if the object is the one pointed to by 'self', and 2) if the object |
| 21 | // is the result of an initializer (e.g. [super init]). |
| 22 | // |
| 23 | // Uses of an object that is true for 1) but not 2) trigger a diagnostic. |
| 24 | // The uses that are currently checked are: |
| 25 | // - Using instance variables. |
| 26 | // - Returning the object. |
| 27 | // |
| 28 | // Note that we don't check for an invalid 'self' that is the receiver of an |
| 29 | // obj-c message expression to cut down false positives where logging functions |
| 30 | // get information from self (like its class) or doing "invalidation" on self |
| 31 | // when the initialization fails. |
| 32 | // |
| 33 | // Because the object that 'self' points to gets invalidated when a call |
| 34 | // receives a reference to 'self', the checker keeps track and passes the flags |
| 35 | // for 1) and 2) to the new object that 'self' points to after the call. |
| 36 | // |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 37 | //===----------------------------------------------------------------------===// |
| 38 | |
Argyrios Kyrtzidis | 027a6ab | 2011-02-15 07:42:33 +0000 | [diff] [blame] | 39 | #include "ClangSACheckers.h" |
Chandler Carruth | 55fc873 | 2012-12-04 09:13:33 +0000 | [diff] [blame] | 40 | #include "clang/AST/ParentMap.h" |
| 41 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 42 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 695fb50 | 2011-02-17 21:39:17 +0000 | [diff] [blame] | 43 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Jordan Rose | f540c54 | 2012-07-26 21:39:41 +0000 | [diff] [blame] | 44 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 45 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 46 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Benjamin Kramer | 9d5a78d | 2012-12-01 17:54:07 +0000 | [diff] [blame] | 47 | #include "llvm/Support/raw_ostream.h" |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 48 | |
| 49 | using namespace clang; |
| 50 | using namespace ento; |
| 51 | |
| 52 | static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND); |
| 53 | static bool isInitializationMethod(const ObjCMethodDecl *MD); |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 54 | static bool isInitMessage(const ObjCMethodCall &Msg); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 55 | static bool isSelfVar(SVal location, CheckerContext &C); |
| 56 | |
| 57 | namespace { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 58 | class ObjCSelfInitChecker : public Checker< check::PostObjCMessage, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 59 | check::PostStmt<ObjCIvarRefExpr>, |
| 60 | check::PreStmt<ReturnStmt>, |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 61 | check::PreCall, |
| 62 | check::PostCall, |
Anna Zaks | 6a2a186 | 2012-05-08 21:19:21 +0000 | [diff] [blame] | 63 | check::Location, |
| 64 | check::Bind > { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 65 | public: |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 66 | void checkPostObjCMessage(const ObjCMethodCall &Msg, CheckerContext &C) const; |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 67 | void checkPostStmt(const ObjCIvarRefExpr *E, CheckerContext &C) const; |
| 68 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 69 | void checkLocation(SVal location, bool isLoad, const Stmt *S, |
| 70 | CheckerContext &C) const; |
Anna Zaks | 6a2a186 | 2012-05-08 21:19:21 +0000 | [diff] [blame] | 71 | void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 72 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 73 | void checkPreCall(const CallEvent &CE, CheckerContext &C) const; |
| 74 | void checkPostCall(const CallEvent &CE, CheckerContext &C) const; |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 75 | |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 76 | void printState(raw_ostream &Out, ProgramStateRef State, |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 77 | const char *NL, const char *Sep) const override; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 78 | }; |
| 79 | } // end anonymous namespace |
| 80 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 81 | namespace { |
| 82 | |
| 83 | class InitSelfBug : public BugType { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 84 | public: |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 85 | InitSelfBug(const CheckerBase *Checker) |
| 86 | : BugType(Checker, "Missing \"self = [(super or self) init...]\"", |
| 87 | categories::CoreFoundationObjectiveC) {} |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 88 | }; |
| 89 | |
| 90 | } // end anonymous namespace |
| 91 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 92 | namespace { |
| 93 | enum SelfFlagEnum { |
| 94 | /// \brief No flag set. |
| 95 | SelfFlag_None = 0x0, |
| 96 | /// \brief Value came from 'self'. |
| 97 | SelfFlag_Self = 0x1, |
| 98 | /// \brief Value came from the result of an initializer (e.g. [super init]). |
| 99 | SelfFlag_InitRes = 0x2 |
| 100 | }; |
| 101 | } |
| 102 | |
Jordan Rose | 466224f | 2012-11-02 01:54:42 +0000 | [diff] [blame] | 103 | REGISTER_MAP_WITH_PROGRAMSTATE(SelfFlag, SymbolRef, unsigned) |
| 104 | REGISTER_TRAIT_WITH_PROGRAMSTATE(CalledInit, bool) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 105 | |
Jordan Rose | 466224f | 2012-11-02 01:54:42 +0000 | [diff] [blame] | 106 | /// \brief A call receiving a reference to 'self' invalidates the object that |
| 107 | /// 'self' contains. This keeps the "self flags" assigned to the 'self' |
| 108 | /// object before the call so we can assign them to the new object that 'self' |
| 109 | /// points to after the call. |
| 110 | REGISTER_TRAIT_WITH_PROGRAMSTATE(PreCallSelfFlags, unsigned) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 111 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 112 | static SelfFlagEnum getSelfFlags(SVal val, ProgramStateRef state) { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 113 | if (SymbolRef sym = val.getAsSymbol()) |
| 114 | if (const unsigned *attachedFlags = state->get<SelfFlag>(sym)) |
| 115 | return (SelfFlagEnum)*attachedFlags; |
| 116 | return SelfFlag_None; |
| 117 | } |
| 118 | |
| 119 | static SelfFlagEnum getSelfFlags(SVal val, CheckerContext &C) { |
| 120 | return getSelfFlags(val, C.getState()); |
| 121 | } |
| 122 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 123 | static void addSelfFlag(ProgramStateRef state, SVal val, |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 124 | SelfFlagEnum flag, CheckerContext &C) { |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 125 | // We tag the symbol that the SVal wraps. |
Anna Zaks | 1812652 | 2012-12-13 00:42:19 +0000 | [diff] [blame] | 126 | if (SymbolRef sym = val.getAsSymbol()) { |
Jordan Rose | 82f2ad4 | 2012-09-08 01:47:28 +0000 | [diff] [blame] | 127 | state = state->set<SelfFlag>(sym, getSelfFlags(val, state) | flag); |
Anna Zaks | 1812652 | 2012-12-13 00:42:19 +0000 | [diff] [blame] | 128 | C.addTransition(state); |
| 129 | } |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 130 | } |
| 131 | |
| 132 | static bool hasSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) { |
| 133 | return getSelfFlags(val, C) & flag; |
| 134 | } |
| 135 | |
| 136 | /// \brief Returns true of the value of the expression is the object that 'self' |
| 137 | /// points to and is an object that did not come from the result of calling |
| 138 | /// an initializer. |
| 139 | static bool isInvalidSelf(const Expr *E, CheckerContext &C) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 140 | SVal exprVal = C.getState()->getSVal(E, C.getLocationContext()); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 141 | if (!hasSelfFlag(exprVal, SelfFlag_Self, C)) |
| 142 | return false; // value did not come from 'self'. |
| 143 | if (hasSelfFlag(exprVal, SelfFlag_InitRes, C)) |
| 144 | return false; // 'self' is properly initialized. |
| 145 | |
| 146 | return true; |
| 147 | } |
| 148 | |
| 149 | static void checkForInvalidSelf(const Expr *E, CheckerContext &C, |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 150 | const char *errorStr, |
| 151 | const CheckerBase *Checker) { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 152 | if (!E) |
| 153 | return; |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 154 | |
| 155 | if (!C.getState()->get<CalledInit>()) |
| 156 | return; |
| 157 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 158 | if (!isInvalidSelf(E, C)) |
| 159 | return; |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 160 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 161 | // Generate an error node. |
| 162 | ExplodedNode *N = C.generateSink(); |
| 163 | if (!N) |
| 164 | return; |
| 165 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 166 | BugReport *report = new BugReport(*new InitSelfBug(Checker), errorStr, N); |
Jordan Rose | 785950e | 2012-11-02 01:53:40 +0000 | [diff] [blame] | 167 | C.emitReport(report); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 168 | } |
| 169 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 170 | void ObjCSelfInitChecker::checkPostObjCMessage(const ObjCMethodCall &Msg, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 171 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 172 | // When encountering a message that does initialization (init rule), |
| 173 | // tag the return value so that we know later on that if self has this value |
| 174 | // then it is properly initialized. |
| 175 | |
| 176 | // FIXME: A callback should disable checkers at the start of functions. |
| 177 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 178 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 179 | return; |
| 180 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 181 | if (isInitMessage(Msg)) { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 182 | // Tag the return value as the result of an initializer. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 183 | ProgramStateRef state = C.getState(); |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 184 | |
| 185 | // FIXME this really should be context sensitive, where we record |
| 186 | // the current stack frame (for IPA). Also, we need to clean this |
| 187 | // value out when we return from this method. |
| 188 | state = state->set<CalledInit>(true); |
| 189 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 190 | SVal V = state->getSVal(Msg.getOriginExpr(), C.getLocationContext()); |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 191 | addSelfFlag(state, V, SelfFlag_InitRes, C); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 192 | return; |
| 193 | } |
| 194 | |
| 195 | // We don't check for an invalid 'self' in an obj-c message expression to cut |
| 196 | // down false positives where logging functions get information from self |
| 197 | // (like its class) or doing "invalidation" on self when the initialization |
| 198 | // fails. |
| 199 | } |
| 200 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 201 | void ObjCSelfInitChecker::checkPostStmt(const ObjCIvarRefExpr *E, |
| 202 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 203 | // FIXME: A callback should disable checkers at the start of functions. |
| 204 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 205 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 206 | return; |
| 207 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 208 | checkForInvalidSelf( |
| 209 | E->getBase(), C, |
| 210 | "Instance variable used while 'self' is not set to the result of " |
| 211 | "'[(super or self) init...]'", |
| 212 | this); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 213 | } |
| 214 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 215 | void ObjCSelfInitChecker::checkPreStmt(const ReturnStmt *S, |
| 216 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 217 | // FIXME: A callback should disable checkers at the start of functions. |
| 218 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 219 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 220 | return; |
| 221 | |
| 222 | checkForInvalidSelf(S->getRetValue(), C, |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 223 | "Returning 'self' while it is not set to the result of " |
| 224 | "'[(super or self) init...]'", |
| 225 | this); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 226 | } |
| 227 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 228 | // When a call receives a reference to 'self', [Pre/Post]Call pass |
| 229 | // the SelfFlags from the object 'self' points to before the call to the new |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 230 | // object after the call. This is to avoid invalidation of 'self' by logging |
| 231 | // functions. |
| 232 | // Another common pattern in classes with multiple initializers is to put the |
| 233 | // subclass's common initialization bits into a static function that receives |
| 234 | // the value of 'self', e.g: |
| 235 | // @code |
| 236 | // if (!(self = [super init])) |
| 237 | // return nil; |
| 238 | // if (!(self = _commonInit(self))) |
| 239 | // return nil; |
| 240 | // @endcode |
| 241 | // Until we can use inter-procedural analysis, in such a call, transfer the |
| 242 | // SelfFlags to the result of the call. |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 243 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 244 | void ObjCSelfInitChecker::checkPreCall(const CallEvent &CE, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 245 | CheckerContext &C) const { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 246 | // FIXME: A callback should disable checkers at the start of functions. |
| 247 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
| 248 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
| 249 | return; |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 250 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 251 | ProgramStateRef state = C.getState(); |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 252 | unsigned NumArgs = CE.getNumArgs(); |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 253 | // If we passed 'self' as and argument to the call, record it in the state |
| 254 | // to be propagated after the call. |
| 255 | // Note, we could have just given up, but try to be more optimistic here and |
| 256 | // assume that the functions are going to continue initialization or will not |
| 257 | // modify self. |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 258 | for (unsigned i = 0; i < NumArgs; ++i) { |
| 259 | SVal argV = CE.getArgSVal(i); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 260 | if (isSelfVar(argV, C)) { |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 261 | unsigned selfFlags = getSelfFlags(state->getSVal(argV.castAs<Loc>()), C); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 262 | C.addTransition(state->set<PreCallSelfFlags>(selfFlags)); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 263 | return; |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 264 | } else if (hasSelfFlag(argV, SelfFlag_Self, C)) { |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 265 | unsigned selfFlags = getSelfFlags(argV, C); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 266 | C.addTransition(state->set<PreCallSelfFlags>(selfFlags)); |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 267 | return; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 268 | } |
| 269 | } |
| 270 | } |
| 271 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 272 | void ObjCSelfInitChecker::checkPostCall(const CallEvent &CE, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 273 | CheckerContext &C) const { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 274 | // FIXME: A callback should disable checkers at the start of functions. |
| 275 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
| 276 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
| 277 | return; |
| 278 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 279 | ProgramStateRef state = C.getState(); |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 280 | SelfFlagEnum prevFlags = (SelfFlagEnum)state->get<PreCallSelfFlags>(); |
| 281 | if (!prevFlags) |
| 282 | return; |
| 283 | state = state->remove<PreCallSelfFlags>(); |
| 284 | |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 285 | unsigned NumArgs = CE.getNumArgs(); |
| 286 | for (unsigned i = 0; i < NumArgs; ++i) { |
| 287 | SVal argV = CE.getArgSVal(i); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 288 | if (isSelfVar(argV, C)) { |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 289 | // If the address of 'self' is being passed to the call, assume that the |
| 290 | // 'self' after the call will have the same flags. |
| 291 | // EX: log(&self) |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 292 | addSelfFlag(state, state->getSVal(argV.castAs<Loc>()), prevFlags, C); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 293 | return; |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 294 | } else if (hasSelfFlag(argV, SelfFlag_Self, C)) { |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 295 | // If 'self' is passed to the call by value, assume that the function |
| 296 | // returns 'self'. So assign the flags, which were set on 'self' to the |
| 297 | // return value. |
| 298 | // EX: self = performMoreInitialization(self) |
Jordan Rose | 2f3017f | 2012-11-02 23:49:29 +0000 | [diff] [blame] | 299 | addSelfFlag(state, CE.getReturnValue(), prevFlags, C); |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 300 | return; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 301 | } |
| 302 | } |
Jordan Rose | 2f3017f | 2012-11-02 23:49:29 +0000 | [diff] [blame] | 303 | |
| 304 | C.addTransition(state); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 305 | } |
| 306 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 307 | void ObjCSelfInitChecker::checkLocation(SVal location, bool isLoad, |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 308 | const Stmt *S, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 309 | CheckerContext &C) const { |
Anna Zaks | 1812652 | 2012-12-13 00:42:19 +0000 | [diff] [blame] | 310 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
| 311 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
| 312 | return; |
| 313 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 314 | // Tag the result of a load from 'self' so that we can easily know that the |
| 315 | // value is the object that 'self' points to. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 316 | ProgramStateRef state = C.getState(); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 317 | if (isSelfVar(location, C)) |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 318 | addSelfFlag(state, state->getSVal(location.castAs<Loc>()), SelfFlag_Self, |
| 319 | C); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 320 | } |
| 321 | |
Anna Zaks | 6a2a186 | 2012-05-08 21:19:21 +0000 | [diff] [blame] | 322 | |
| 323 | void ObjCSelfInitChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
| 324 | CheckerContext &C) const { |
| 325 | // Allow assignment of anything to self. Self is a local variable in the |
| 326 | // initializer, so it is legal to assign anything to it, like results of |
| 327 | // static functions/method calls. After self is assigned something we cannot |
| 328 | // reason about, stop enforcing the rules. |
| 329 | // (Only continue checking if the assigned value should be treated as self.) |
| 330 | if ((isSelfVar(loc, C)) && |
| 331 | !hasSelfFlag(val, SelfFlag_InitRes, C) && |
| 332 | !hasSelfFlag(val, SelfFlag_Self, C) && |
| 333 | !isSelfVar(val, C)) { |
| 334 | |
| 335 | // Stop tracking the checker-specific state in the state. |
| 336 | ProgramStateRef State = C.getState(); |
| 337 | State = State->remove<CalledInit>(); |
| 338 | if (SymbolRef sym = loc.getAsSymbol()) |
| 339 | State = State->remove<SelfFlag>(sym); |
| 340 | C.addTransition(State); |
| 341 | } |
| 342 | } |
| 343 | |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 344 | void ObjCSelfInitChecker::printState(raw_ostream &Out, ProgramStateRef State, |
| 345 | const char *NL, const char *Sep) const { |
Jordan Rose | 466224f | 2012-11-02 01:54:42 +0000 | [diff] [blame] | 346 | SelfFlagTy FlagMap = State->get<SelfFlag>(); |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 347 | bool DidCallInit = State->get<CalledInit>(); |
| 348 | SelfFlagEnum PreCallFlags = (SelfFlagEnum)State->get<PreCallSelfFlags>(); |
| 349 | |
| 350 | if (FlagMap.isEmpty() && !DidCallInit && !PreCallFlags) |
| 351 | return; |
| 352 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame^] | 353 | Out << Sep << NL << *this << " :" << NL; |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 354 | |
| 355 | if (DidCallInit) |
| 356 | Out << " An init method has been called." << NL; |
| 357 | |
| 358 | if (PreCallFlags != SelfFlag_None) { |
| 359 | if (PreCallFlags & SelfFlag_Self) { |
| 360 | Out << " An argument of the current call came from the 'self' variable." |
| 361 | << NL; |
| 362 | } |
| 363 | if (PreCallFlags & SelfFlag_InitRes) { |
| 364 | Out << " An argument of the current call came from an init method." |
| 365 | << NL; |
| 366 | } |
| 367 | } |
| 368 | |
| 369 | Out << NL; |
Jordan Rose | 466224f | 2012-11-02 01:54:42 +0000 | [diff] [blame] | 370 | for (SelfFlagTy::iterator I = FlagMap.begin(), E = FlagMap.end(); |
| 371 | I != E; ++I) { |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 372 | Out << I->first << " : "; |
| 373 | |
| 374 | if (I->second == SelfFlag_None) |
| 375 | Out << "none"; |
| 376 | |
| 377 | if (I->second & SelfFlag_Self) |
| 378 | Out << "self variable"; |
| 379 | |
| 380 | if (I->second & SelfFlag_InitRes) { |
| 381 | if (I->second != SelfFlag_InitRes) |
| 382 | Out << " | "; |
| 383 | Out << "result of init method"; |
| 384 | } |
| 385 | |
| 386 | Out << NL; |
| 387 | } |
| 388 | } |
| 389 | |
| 390 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 391 | // FIXME: A callback should disable checkers at the start of functions. |
| 392 | static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND) { |
| 393 | if (!ND) |
| 394 | return false; |
| 395 | |
| 396 | const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(ND); |
| 397 | if (!MD) |
| 398 | return false; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 399 | if (!isInitializationMethod(MD)) |
| 400 | return false; |
| 401 | |
Argyrios Kyrtzidis | eaf969b | 2011-01-25 23:54:44 +0000 | [diff] [blame] | 402 | // self = [super init] applies only to NSObject subclasses. |
| 403 | // For instance, NSProxy doesn't implement -init. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 404 | ASTContext &Ctx = MD->getASTContext(); |
Argyrios Kyrtzidis | eaf969b | 2011-01-25 23:54:44 +0000 | [diff] [blame] | 405 | IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 406 | ObjCInterfaceDecl *ID = MD->getClassInterface()->getSuperClass(); |
Argyrios Kyrtzidis | eaf969b | 2011-01-25 23:54:44 +0000 | [diff] [blame] | 407 | for ( ; ID ; ID = ID->getSuperClass()) { |
| 408 | IdentifierInfo *II = ID->getIdentifier(); |
| 409 | |
| 410 | if (II == NSObjectII) |
| 411 | break; |
| 412 | } |
| 413 | if (!ID) |
| 414 | return false; |
| 415 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 416 | return true; |
| 417 | } |
| 418 | |
| 419 | /// \brief Returns true if the location is 'self'. |
| 420 | static bool isSelfVar(SVal location, CheckerContext &C) { |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 421 | AnalysisDeclContext *analCtx = C.getCurrentAnalysisDeclContext(); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 422 | if (!analCtx->getSelfDecl()) |
| 423 | return false; |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 424 | if (!location.getAs<loc::MemRegionVal>()) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 425 | return false; |
| 426 | |
David Blaikie | 5251abe | 2013-02-20 05:52:05 +0000 | [diff] [blame] | 427 | loc::MemRegionVal MRV = location.castAs<loc::MemRegionVal>(); |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 428 | if (const DeclRegion *DR = dyn_cast<DeclRegion>(MRV.stripCasts())) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 429 | return (DR->getDecl() == analCtx->getSelfDecl()); |
| 430 | |
| 431 | return false; |
| 432 | } |
| 433 | |
| 434 | static bool isInitializationMethod(const ObjCMethodDecl *MD) { |
John McCall | 85f3d76 | 2011-03-02 01:50:55 +0000 | [diff] [blame] | 435 | return MD->getMethodFamily() == OMF_init; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 436 | } |
| 437 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 438 | static bool isInitMessage(const ObjCMethodCall &Call) { |
| 439 | return Call.getMethodFamily() == OMF_init; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 440 | } |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 441 | |
| 442 | //===----------------------------------------------------------------------===// |
| 443 | // Registration. |
| 444 | //===----------------------------------------------------------------------===// |
| 445 | |
| 446 | void ento::registerObjCSelfInitChecker(CheckerManager &mgr) { |
| 447 | mgr.registerChecker<ObjCSelfInitChecker>(); |
| 448 | } |