blob: 69b331c16cc94d987b36b29fd794eff29f999a61 [file] [log] [blame]
Zhongxing Xud02174c2009-11-24 04:45:44 +00001//===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==//
Zhongxing Xu8958fff2009-11-03 06:46:03 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Zhongxing Xud02174c2009-11-24 04:45:44 +000010// This defines CallAndMessageChecker, a builtin checker that checks for various
11// errors of call and objc message expressions.
Zhongxing Xu8958fff2009-11-03 06:46:03 +000012//
13//===----------------------------------------------------------------------===//
14
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000015#include "ClangSACheckers.h"
Argyrios Kyrtzidisec8605f2011-03-01 01:16:21 +000016#include "clang/StaticAnalyzer/Core/Checker.h"
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000017#include "clang/StaticAnalyzer/Core/CheckerManager.h"
Jordan Rose55037cd2012-07-02 19:27:46 +000018#include "clang/StaticAnalyzer/Core/PathSensitive/Calls.h"
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000019#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
Benjamin Kramer5e2d2c22010-03-27 21:19:47 +000021#include "clang/AST/ParentMap.h"
22#include "clang/Basic/TargetInfo.h"
Benjamin Kramer8fe83e12012-02-04 13:45:25 +000023#include "llvm/ADT/SmallString.h"
Zhongxing Xu8958fff2009-11-03 06:46:03 +000024
25using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000026using namespace ento;
Zhongxing Xu8958fff2009-11-03 06:46:03 +000027
Ted Kremenekf493f492009-11-11 05:50:44 +000028namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +000029class CallAndMessageChecker
Jordan Rosefe6a0112012-07-02 19:28:21 +000030 : public Checker< check::PreStmt<CallExpr>, check::PreObjCMessage,
31 check::PreCall > {
Dylan Noblesmith6f42b622012-02-05 02:12:40 +000032 mutable OwningPtr<BugType> BT_call_null;
33 mutable OwningPtr<BugType> BT_call_undef;
34 mutable OwningPtr<BugType> BT_call_arg;
35 mutable OwningPtr<BugType> BT_msg_undef;
Ted Kremenekb673a412012-02-18 20:53:30 +000036 mutable OwningPtr<BugType> BT_objc_prop_undef;
Dylan Noblesmith6f42b622012-02-05 02:12:40 +000037 mutable OwningPtr<BugType> BT_msg_arg;
38 mutable OwningPtr<BugType> BT_msg_ret;
Ted Kremenekf493f492009-11-11 05:50:44 +000039public:
Zhongxing Xu2055eff2009-11-24 07:06:39 +000040
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000041 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
Jordan Rosede507ea2012-07-02 19:28:04 +000042 void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
Jordan Rosefe6a0112012-07-02 19:28:21 +000043 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
Ted Kremenekfee96e02009-11-24 21:41:28 +000044
Ted Kremenekc79d7d42009-11-21 01:25:37 +000045private:
Jordan Rosefe6a0112012-07-02 19:28:21 +000046 static bool PreVisitProcessArg(CheckerContext &C, SVal V,
47 SourceRange argRange, const Expr *argEx,
Ted Kremeneke4d653b2012-03-05 23:57:14 +000048 const bool checkUninitFields,
Jordan Rosefe6a0112012-07-02 19:28:21 +000049 const char *BT_desc, OwningPtr<BugType> &BT);
Ted Kremenek81337162010-03-18 03:22:29 +000050
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000051 static void EmitBadCall(BugType *BT, CheckerContext &C, const CallExpr *CE);
Jordan Rosede507ea2012-07-02 19:28:04 +000052 void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg,
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000053 ExplodedNode *N) const;
Ted Kremenek091b5882010-03-18 02:17:27 +000054
Ted Kremenek18c66fd2011-08-15 22:09:50 +000055 void HandleNilReceiver(CheckerContext &C,
Ted Kremenek8bef8232012-01-26 21:29:00 +000056 ProgramStateRef state,
Jordan Rosede507ea2012-07-02 19:28:04 +000057 const ObjCMethodCall &msg) const;
Ted Kremenek091b5882010-03-18 02:17:27 +000058
Dylan Noblesmith6f42b622012-02-05 02:12:40 +000059 static void LazyInit_BT(const char *desc, OwningPtr<BugType> &BT) {
Ted Kremenek81337162010-03-18 03:22:29 +000060 if (!BT)
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +000061 BT.reset(new BuiltinBug(desc));
Ted Kremenek091b5882010-03-18 02:17:27 +000062 }
Ted Kremenekf493f492009-11-11 05:50:44 +000063};
64} // end anonymous namespace
65
Zhongxing Xud02174c2009-11-24 04:45:44 +000066void CallAndMessageChecker::EmitBadCall(BugType *BT, CheckerContext &C,
67 const CallExpr *CE) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +000068 ExplodedNode *N = C.generateSink();
Ted Kremenekc79d7d42009-11-21 01:25:37 +000069 if (!N)
70 return;
Ted Kremenek091b5882010-03-18 02:17:27 +000071
Anna Zakse172e8b2011-08-17 23:00:25 +000072 BugReport *R = new BugReport(*BT, BT->getName(), N);
Anna Zaks50bbc162011-08-19 22:33:38 +000073 R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N,
Ted Kremenek76aadc32012-03-09 01:13:14 +000074 bugreporter::GetCalleeExpr(N), R));
Ted Kremenekc79d7d42009-11-21 01:25:37 +000075 C.EmitReport(R);
76}
77
Ted Kremenek81337162010-03-18 03:22:29 +000078bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +000079 SVal V, SourceRange argRange,
80 const Expr *argEx,
Ted Kremeneke4d653b2012-03-05 23:57:14 +000081 const bool checkUninitFields,
Ted Kremenek81337162010-03-18 03:22:29 +000082 const char *BT_desc,
Dylan Noblesmith6f42b622012-02-05 02:12:40 +000083 OwningPtr<BugType> &BT) {
Ted Kremenek81337162010-03-18 03:22:29 +000084 if (V.isUndef()) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +000085 if (ExplodedNode *N = C.generateSink()) {
Jordan Rosefe6a0112012-07-02 19:28:21 +000086 LazyInit_BT("Uninitialized argument value", BT);
Ted Kremenek81337162010-03-18 03:22:29 +000087
88 // Generate a report for this bug.
Jordan Rosefe6a0112012-07-02 19:28:21 +000089 BugReport *R = new BugReport(*BT, BT_desc, N);
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +000090 R->addRange(argRange);
91 if (argEx)
Ted Kremenek76aadc32012-03-09 01:13:14 +000092 R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, argEx,
93 R));
Ted Kremenek81337162010-03-18 03:22:29 +000094 C.EmitReport(R);
95 }
96 return true;
97 }
98
Ted Kremeneke4d653b2012-03-05 23:57:14 +000099 if (!checkUninitFields)
100 return false;
101
Ted Kremenek81337162010-03-18 03:22:29 +0000102 if (const nonloc::LazyCompoundVal *LV =
103 dyn_cast<nonloc::LazyCompoundVal>(&V)) {
104
105 class FindUninitializedField {
106 public:
Chris Lattner5f9e2722011-07-23 10:55:15 +0000107 SmallVector<const FieldDecl *, 10> FieldChain;
Ted Kremenek81337162010-03-18 03:22:29 +0000108 private:
Ted Kremenek81337162010-03-18 03:22:29 +0000109 StoreManager &StoreMgr;
110 MemRegionManager &MrMgr;
111 Store store;
112 public:
Benjamin Kramerfacde172012-06-06 17:32:50 +0000113 FindUninitializedField(StoreManager &storeMgr,
Ted Kremenek81337162010-03-18 03:22:29 +0000114 MemRegionManager &mrMgr, Store s)
Benjamin Kramerfacde172012-06-06 17:32:50 +0000115 : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
Ted Kremenek81337162010-03-18 03:22:29 +0000116
Ted Kremenek96979342011-08-12 20:02:48 +0000117 bool Find(const TypedValueRegion *R) {
Zhongxing Xu018220c2010-08-11 06:10:55 +0000118 QualType T = R->getValueType();
Ted Kremenek81337162010-03-18 03:22:29 +0000119 if (const RecordType *RT = T->getAsStructureType()) {
120 const RecordDecl *RD = RT->getDecl()->getDefinition();
121 assert(RD && "Referred record has no definition");
122 for (RecordDecl::field_iterator I =
123 RD->field_begin(), E = RD->field_end(); I!=E; ++I) {
David Blaikie581deb32012-06-06 20:45:41 +0000124 const FieldRegion *FR = MrMgr.getFieldRegion(*I, R);
125 FieldChain.push_back(*I);
David Blaikie262bc182012-04-30 02:36:29 +0000126 T = I->getType();
Ted Kremenek81337162010-03-18 03:22:29 +0000127 if (T->getAsStructureType()) {
128 if (Find(FR))
129 return true;
130 }
131 else {
Anna Zaks14374252012-01-12 02:22:40 +0000132 const SVal &V = StoreMgr.getBinding(store, loc::MemRegionVal(FR));
Ted Kremenek81337162010-03-18 03:22:29 +0000133 if (V.isUndef())
134 return true;
135 }
136 FieldChain.pop_back();
137 }
138 }
139
140 return false;
141 }
142 };
143
144 const LazyCompoundValData *D = LV->getCVData();
Benjamin Kramerfacde172012-06-06 17:32:50 +0000145 FindUninitializedField F(C.getState()->getStateManager().getStoreManager(),
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000146 C.getSValBuilder().getRegionManager(),
Ted Kremenek81337162010-03-18 03:22:29 +0000147 D->getStore());
148
149 if (F.Find(D->getRegion())) {
Ted Kremenekd048c6e2010-12-20 21:19:09 +0000150 if (ExplodedNode *N = C.generateSink()) {
Ted Kremenek81337162010-03-18 03:22:29 +0000151 LazyInit_BT(BT_desc, BT);
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +0000152 SmallString<512> Str;
Ted Kremenek81337162010-03-18 03:22:29 +0000153 llvm::raw_svector_ostream os(Str);
154 os << "Passed-by-value struct argument contains uninitialized data";
155
156 if (F.FieldChain.size() == 1)
Benjamin Kramerb8989f22011-10-14 18:45:37 +0000157 os << " (e.g., field: '" << *F.FieldChain[0] << "')";
Ted Kremenek81337162010-03-18 03:22:29 +0000158 else {
159 os << " (e.g., via the field chain: '";
160 bool first = true;
Chris Lattner5f9e2722011-07-23 10:55:15 +0000161 for (SmallVectorImpl<const FieldDecl *>::iterator
Ted Kremenek81337162010-03-18 03:22:29 +0000162 DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){
163 if (first)
164 first = false;
165 else
166 os << '.';
Benjamin Kramerb8989f22011-10-14 18:45:37 +0000167 os << **DI;
Ted Kremenek81337162010-03-18 03:22:29 +0000168 }
169 os << "')";
170 }
171
172 // Generate a report for this bug.
Anna Zakse172e8b2011-08-17 23:00:25 +0000173 BugReport *R = new BugReport(*BT, os.str(), N);
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +0000174 R->addRange(argRange);
Ted Kremenek81337162010-03-18 03:22:29 +0000175
176 // FIXME: enhance track back for uninitialized value for arbitrary
177 // memregions
178 C.EmitReport(R);
179 }
180 return true;
181 }
182 }
183
184 return false;
185}
186
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000187void CallAndMessageChecker::checkPreStmt(const CallExpr *CE,
188 CheckerContext &C) const{
Ted Kremenek091b5882010-03-18 02:17:27 +0000189
Ted Kremenekc79d7d42009-11-21 01:25:37 +0000190 const Expr *Callee = CE->getCallee()->IgnoreParens();
Jordan Rose55037cd2012-07-02 19:27:46 +0000191 ProgramStateRef State = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +0000192 const LocationContext *LCtx = C.getLocationContext();
Jordan Rose55037cd2012-07-02 19:27:46 +0000193 SVal L = State->getSVal(Callee, LCtx);
Ted Kremenek091b5882010-03-18 02:17:27 +0000194
Ted Kremenekc79d7d42009-11-21 01:25:37 +0000195 if (L.isUndef()) {
196 if (!BT_call_undef)
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000197 BT_call_undef.reset(new BuiltinBug("Called function pointer is an "
198 "uninitalized pointer value"));
199 EmitBadCall(BT_call_undef.get(), C, CE);
Ted Kremenekc79d7d42009-11-21 01:25:37 +0000200 return;
201 }
Ted Kremenek091b5882010-03-18 02:17:27 +0000202
Jordan Rose55037cd2012-07-02 19:27:46 +0000203 if (L.isZeroConstant()) {
Ted Kremenekc79d7d42009-11-21 01:25:37 +0000204 if (!BT_call_null)
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000205 BT_call_null.reset(
206 new BuiltinBug("Called function pointer is null (null dereference)"));
207 EmitBadCall(BT_call_null.get(), C, CE);
Ted Kremenek091b5882010-03-18 02:17:27 +0000208 }
Jordan Rosefe6a0112012-07-02 19:28:21 +0000209}
Ted Kremenek091b5882010-03-18 02:17:27 +0000210
Jordan Rosefe6a0112012-07-02 19:28:21 +0000211void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
212 CheckerContext &C) const {
213 // Don't check for uninitialized field values in arguments if the
214 // caller has a body that is available and we have the chance to inline it.
215 // This is a hack, but is a reasonable compromise betweens sometimes warning
216 // and sometimes not depending on if we decide to inline a function.
217 const Decl *D = Call.getDecl();
218 const bool checkUninitFields =
219 !(C.getAnalysisManager().shouldInlineCall() &&
220 (D && D->getBody()));
221
222 OwningPtr<BugType> *BT;
223 const char *Desc;
224
225 switch (Call.getKind()) {
226 case CE_ObjCPropertyAccess:
227 BT = &BT_msg_arg;
228 // Getters do not have arguments, so we don't need to worry about this.
229 Desc = "Argument for property setter is an uninitialized value";
230 break;
231 case CE_ObjCMessage:
232 BT = &BT_msg_arg;
233 Desc = "Argument in message expression is an uninitialized value";
234 break;
235 case CE_Block:
236 BT = &BT_call_arg;
237 Desc = "Block call argument is an uninitialized value";
238 break;
239 default:
240 BT = &BT_call_arg;
241 Desc = "Function call argument is an uninitialized value";
242 break;
Jordan Rose55037cd2012-07-02 19:27:46 +0000243 }
Jordan Rosefe6a0112012-07-02 19:28:21 +0000244
245 for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i)
246 if (PreVisitProcessArg(C, Call.getArgSVal(i),
247 Call.getArgSourceRange(i), Call.getArgExpr(i),
248 checkUninitFields, Desc, *BT))
249 return;
Ted Kremenek64fa8582009-11-21 00:49:41 +0000250}
251
Jordan Rosede507ea2012-07-02 19:28:04 +0000252void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000253 CheckerContext &C) const {
Jordan Rosede507ea2012-07-02 19:28:04 +0000254 SVal recVal = msg.getReceiverSVal();
255 if (recVal.isUndef()) {
256 if (ExplodedNode *N = C.generateSink()) {
257 BugType *BT = 0;
258 if (isa<ObjCPropertyAccess>(msg)) {
259 if (!BT_objc_prop_undef)
260 BT_objc_prop_undef.reset(new BuiltinBug("Property access on an "
261 "uninitialized object pointer"));
262 BT = BT_objc_prop_undef.get();
263 } else {
264 if (!BT_msg_undef)
265 BT_msg_undef.reset(new BuiltinBug("Receiver in message expression "
266 "is an uninitialized value"));
267 BT = BT_msg_undef.get();
268 }
269 BugReport *R = new BugReport(*BT, BT->getName(), N);
270 R->addRange(msg.getReceiverSourceRange());
Ted Kremenek64fa8582009-11-21 00:49:41 +0000271
Jordan Rosede507ea2012-07-02 19:28:04 +0000272 // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet.
273 if (const Expr *ReceiverE = msg.getInstanceReceiverExpr())
Anna Zaks50bbc162011-08-19 22:33:38 +0000274 R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N,
Jordan Rosede507ea2012-07-02 19:28:04 +0000275 ReceiverE,
Ted Kremenek76aadc32012-03-09 01:13:14 +0000276 R));
Jordan Rosede507ea2012-07-02 19:28:04 +0000277 C.EmitReport(R);
278 }
279 return;
280 } else {
281 // Bifurcate the state into nil and non-nil ones.
282 DefinedOrUnknownSVal receiverVal = cast<DefinedOrUnknownSVal>(recVal);
283
284 ProgramStateRef state = C.getState();
285 ProgramStateRef notNilState, nilState;
286 llvm::tie(notNilState, nilState) = state->assume(receiverVal);
287
288 // Handle receiver must be nil.
289 if (nilState && !notNilState) {
290 HandleNilReceiver(C, state, msg);
Ted Kremenekc79d7d42009-11-21 01:25:37 +0000291 return;
292 }
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000293 }
Zhongxing Xua46e4d92009-12-02 05:49:12 +0000294}
Zhongxing Xu2055eff2009-11-24 07:06:39 +0000295
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000296void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
Jordan Rosede507ea2012-07-02 19:28:04 +0000297 const ObjCMethodCall &msg,
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000298 ExplodedNode *N) const {
Ted Kremenek091b5882010-03-18 02:17:27 +0000299
Ted Kremenekfee96e02009-11-24 21:41:28 +0000300 if (!BT_msg_ret)
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000301 BT_msg_ret.reset(
Ted Kremenekfee96e02009-11-24 21:41:28 +0000302 new BuiltinBug("Receiver in message expression is "
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000303 "'nil' and returns a garbage value"));
Ted Kremenek091b5882010-03-18 02:17:27 +0000304
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +0000305 SmallString<200> buf;
Ted Kremenekfee96e02009-11-24 21:41:28 +0000306 llvm::raw_svector_ostream os(buf);
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +0000307 os << "The receiver of message '" << msg.getSelector().getAsString()
Jordan Rosede507ea2012-07-02 19:28:04 +0000308 << "' is nil and returns a value of type '";
309 msg.getResultType().print(os, C.getLangOpts());
310 os << "' that will be garbage";
Ted Kremenek091b5882010-03-18 02:17:27 +0000311
Anna Zakse172e8b2011-08-17 23:00:25 +0000312 BugReport *report = new BugReport(*BT_msg_ret, os.str(), N);
Jordan Rosefb3cc8b2012-07-02 21:41:56 +0000313 report->addRange(msg.getReceiverSourceRange());
Jordan Rosede507ea2012-07-02 19:28:04 +0000314 // FIXME: This won't track "self" in messages to super.
315 if (const Expr *receiver = msg.getInstanceReceiverExpr()) {
Anna Zaks50bbc162011-08-19 22:33:38 +0000316 report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N,
Ted Kremenek76aadc32012-03-09 01:13:14 +0000317 receiver,
318 report));
Douglas Gregor04badcf2010-04-21 00:45:42 +0000319 }
Ted Kremenek091b5882010-03-18 02:17:27 +0000320 C.EmitReport(report);
Ted Kremenekfee96e02009-11-24 21:41:28 +0000321}
322
Ted Kremenekc8413fd2010-12-02 07:49:45 +0000323static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
Bob Wilson8f1e6562012-01-31 23:52:54 +0000324 return (triple.getVendor() == llvm::Triple::Apple &&
325 (triple.getOS() == llvm::Triple::IOS ||
326 !triple.isMacOSXVersionLT(10,5)));
Ted Kremenekf81330c2009-11-24 22:48:18 +0000327}
328
Ted Kremenekfee96e02009-11-24 21:41:28 +0000329void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
Ted Kremenek8bef8232012-01-26 21:29:00 +0000330 ProgramStateRef state,
Jordan Rosede507ea2012-07-02 19:28:04 +0000331 const ObjCMethodCall &Msg) const {
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +0000332 ASTContext &Ctx = C.getASTContext();
Ted Kremenek091b5882010-03-18 02:17:27 +0000333
Ted Kremenekfee96e02009-11-24 21:41:28 +0000334 // Check the return type of the message expression. A message to nil will
335 // return different values depending on the return type and the architecture.
Jordan Rosede507ea2012-07-02 19:28:04 +0000336 QualType RetTy = Msg.getResultType();
Ted Kremenekf81330c2009-11-24 22:48:18 +0000337 CanQualType CanRetTy = Ctx.getCanonicalType(RetTy);
Ted Kremenek5eca4822012-01-06 22:09:28 +0000338 const LocationContext *LCtx = C.getLocationContext();
Ted Kremenekfee96e02009-11-24 21:41:28 +0000339
Douglas Gregorfb87b892010-04-26 21:31:17 +0000340 if (CanRetTy->isStructureOrClassType()) {
Ted Kremenek4a037c72011-10-28 19:05:10 +0000341 // Structure returns are safe since the compiler zeroes them out.
Jordan Rosede507ea2012-07-02 19:28:04 +0000342 SVal V = C.getSValBuilder().makeZeroVal(RetTy);
343 C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V));
Ted Kremenekfee96e02009-11-24 21:41:28 +0000344 return;
345 }
346
Ted Kremenek4a037c72011-10-28 19:05:10 +0000347 // Other cases: check if sizeof(return type) > sizeof(void*)
Anna Zaksa2a86032011-11-01 22:41:01 +0000348 if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap()
Jordan Rosede507ea2012-07-02 19:28:04 +0000349 .isConsumedExpr(Msg.getOriginExpr())) {
Ted Kremenekfee96e02009-11-24 21:41:28 +0000350 // Compute: sizeof(void *) and sizeof(return type)
Ted Kremenek091b5882010-03-18 02:17:27 +0000351 const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy);
Ted Kremenekf81330c2009-11-24 22:48:18 +0000352 const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy);
Ted Kremenekfee96e02009-11-24 21:41:28 +0000353
Ted Kremenekf81330c2009-11-24 22:48:18 +0000354 if (voidPtrSize < returnTypeSize &&
Douglas Gregorbcfd1f52011-09-02 00:18:52 +0000355 !(supportsNilWithFloatRet(Ctx.getTargetInfo().getTriple()) &&
Ted Kremenekf81330c2009-11-24 22:48:18 +0000356 (Ctx.FloatTy == CanRetTy ||
357 Ctx.DoubleTy == CanRetTy ||
358 Ctx.LongDoubleTy == CanRetTy ||
Ted Kremenek61238742010-09-30 00:37:10 +0000359 Ctx.LongLongTy == CanRetTy ||
360 Ctx.UnsignedLongLongTy == CanRetTy))) {
Ted Kremenek9c378f72011-08-12 23:37:29 +0000361 if (ExplodedNode *N = C.generateSink(state))
Jordan Rosede507ea2012-07-02 19:28:04 +0000362 emitNilReceiverBug(C, Msg, N);
Ted Kremenekfee96e02009-11-24 21:41:28 +0000363 return;
364 }
365
366 // Handle the safe cases where the return value is 0 if the
367 // receiver is nil.
368 //
369 // FIXME: For now take the conservative approach that we only
370 // return null values if we *know* that the receiver is nil.
371 // This is because we can have surprises like:
372 //
373 // ... = [[NSScreens screens] objectAtIndex:0];
374 //
375 // What can happen is that [... screens] could return nil, but
376 // it most likely isn't nil. We should assume the semantics
377 // of this case unless we have *a lot* more knowledge.
378 //
Jordan Rosede507ea2012-07-02 19:28:04 +0000379 SVal V = C.getSValBuilder().makeZeroVal(RetTy);
380 C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V));
Ted Kremenekfee96e02009-11-24 21:41:28 +0000381 return;
382 }
Ted Kremenek091b5882010-03-18 02:17:27 +0000383
Anna Zaks0bd6b112011-10-26 21:06:34 +0000384 C.addTransition(state);
Zhongxing Xu8958fff2009-11-03 06:46:03 +0000385}
Argyrios Kyrtzidisd84f4222011-02-28 01:28:13 +0000386
387void ento::registerCallAndMessageChecker(CheckerManager &mgr) {
388 mgr.registerChecker<CallAndMessageChecker>();
389}