Zhongxing Xu | d02174c | 2009-11-24 04:45:44 +0000 | [diff] [blame] | 1 | //===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==// |
Zhongxing Xu | 8958fff | 2009-11-03 06:46:03 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Zhongxing Xu | d02174c | 2009-11-24 04:45:44 +0000 | [diff] [blame] | 10 | // This defines CallAndMessageChecker, a builtin checker that checks for various |
| 11 | // errors of call and objc message expressions. |
Zhongxing Xu | 8958fff | 2009-11-03 06:46:03 +0000 | [diff] [blame] | 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 16 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 17 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 18 | #include "clang/StaticAnalyzer/Core/PathSensitive/Calls.h" |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
| 20 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Benjamin Kramer | 5e2d2c2 | 2010-03-27 21:19:47 +0000 | [diff] [blame] | 21 | #include "clang/AST/ParentMap.h" |
| 22 | #include "clang/Basic/TargetInfo.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 23 | #include "llvm/ADT/SmallString.h" |
Zhongxing Xu | 8958fff | 2009-11-03 06:46:03 +0000 | [diff] [blame] | 24 | |
| 25 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 26 | using namespace ento; |
Zhongxing Xu | 8958fff | 2009-11-03 06:46:03 +0000 | [diff] [blame] | 27 | |
Ted Kremenek | f493f49 | 2009-11-11 05:50:44 +0000 | [diff] [blame] | 28 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 29 | class CallAndMessageChecker |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 30 | : public Checker< check::PreStmt<CallExpr>, check::PreObjCMessage, |
| 31 | check::PreCall > { |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 32 | mutable OwningPtr<BugType> BT_call_null; |
| 33 | mutable OwningPtr<BugType> BT_call_undef; |
| 34 | mutable OwningPtr<BugType> BT_call_arg; |
| 35 | mutable OwningPtr<BugType> BT_msg_undef; |
Ted Kremenek | b673a41 | 2012-02-18 20:53:30 +0000 | [diff] [blame] | 36 | mutable OwningPtr<BugType> BT_objc_prop_undef; |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 37 | mutable OwningPtr<BugType> BT_msg_arg; |
| 38 | mutable OwningPtr<BugType> BT_msg_ret; |
Ted Kremenek | f493f49 | 2009-11-11 05:50:44 +0000 | [diff] [blame] | 39 | public: |
Zhongxing Xu | 2055eff | 2009-11-24 07:06:39 +0000 | [diff] [blame] | 40 | |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 41 | void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 42 | void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const; |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 43 | void checkPreCall(const CallEvent &Call, CheckerContext &C) const; |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 44 | |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 45 | private: |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 46 | static bool PreVisitProcessArg(CheckerContext &C, SVal V, |
| 47 | SourceRange argRange, const Expr *argEx, |
Ted Kremenek | e4d653b | 2012-03-05 23:57:14 +0000 | [diff] [blame] | 48 | const bool checkUninitFields, |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 49 | const char *BT_desc, OwningPtr<BugType> &BT); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 50 | |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 51 | static void EmitBadCall(BugType *BT, CheckerContext &C, const CallExpr *CE); |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 52 | void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg, |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 53 | ExplodedNode *N) const; |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 54 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 55 | void HandleNilReceiver(CheckerContext &C, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 56 | ProgramStateRef state, |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 57 | const ObjCMethodCall &msg) const; |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 58 | |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 59 | static void LazyInit_BT(const char *desc, OwningPtr<BugType> &BT) { |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 60 | if (!BT) |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 61 | BT.reset(new BuiltinBug(desc)); |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 62 | } |
Ted Kremenek | f493f49 | 2009-11-11 05:50:44 +0000 | [diff] [blame] | 63 | }; |
| 64 | } // end anonymous namespace |
| 65 | |
Zhongxing Xu | d02174c | 2009-11-24 04:45:44 +0000 | [diff] [blame] | 66 | void CallAndMessageChecker::EmitBadCall(BugType *BT, CheckerContext &C, |
| 67 | const CallExpr *CE) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 68 | ExplodedNode *N = C.generateSink(); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 69 | if (!N) |
| 70 | return; |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 71 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 72 | BugReport *R = new BugReport(*BT, BT->getName(), N); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 73 | R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 74 | bugreporter::GetCalleeExpr(N), R)); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 75 | C.EmitReport(R); |
| 76 | } |
| 77 | |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 78 | bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C, |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 79 | SVal V, SourceRange argRange, |
| 80 | const Expr *argEx, |
Ted Kremenek | e4d653b | 2012-03-05 23:57:14 +0000 | [diff] [blame] | 81 | const bool checkUninitFields, |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 82 | const char *BT_desc, |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 83 | OwningPtr<BugType> &BT) { |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 84 | if (V.isUndef()) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 85 | if (ExplodedNode *N = C.generateSink()) { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 86 | LazyInit_BT("Uninitialized argument value", BT); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 87 | |
| 88 | // Generate a report for this bug. |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 89 | BugReport *R = new BugReport(*BT, BT_desc, N); |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 90 | R->addRange(argRange); |
| 91 | if (argEx) |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 92 | R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, argEx, |
| 93 | R)); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 94 | C.EmitReport(R); |
| 95 | } |
| 96 | return true; |
| 97 | } |
| 98 | |
Ted Kremenek | e4d653b | 2012-03-05 23:57:14 +0000 | [diff] [blame] | 99 | if (!checkUninitFields) |
| 100 | return false; |
| 101 | |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 102 | if (const nonloc::LazyCompoundVal *LV = |
| 103 | dyn_cast<nonloc::LazyCompoundVal>(&V)) { |
| 104 | |
| 105 | class FindUninitializedField { |
| 106 | public: |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 107 | SmallVector<const FieldDecl *, 10> FieldChain; |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 108 | private: |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 109 | StoreManager &StoreMgr; |
| 110 | MemRegionManager &MrMgr; |
| 111 | Store store; |
| 112 | public: |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 113 | FindUninitializedField(StoreManager &storeMgr, |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 114 | MemRegionManager &mrMgr, Store s) |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 115 | : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {} |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 116 | |
Ted Kremenek | 9697934 | 2011-08-12 20:02:48 +0000 | [diff] [blame] | 117 | bool Find(const TypedValueRegion *R) { |
Zhongxing Xu | 018220c | 2010-08-11 06:10:55 +0000 | [diff] [blame] | 118 | QualType T = R->getValueType(); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 119 | if (const RecordType *RT = T->getAsStructureType()) { |
| 120 | const RecordDecl *RD = RT->getDecl()->getDefinition(); |
| 121 | assert(RD && "Referred record has no definition"); |
| 122 | for (RecordDecl::field_iterator I = |
| 123 | RD->field_begin(), E = RD->field_end(); I!=E; ++I) { |
David Blaikie | 581deb3 | 2012-06-06 20:45:41 +0000 | [diff] [blame] | 124 | const FieldRegion *FR = MrMgr.getFieldRegion(*I, R); |
| 125 | FieldChain.push_back(*I); |
David Blaikie | 262bc18 | 2012-04-30 02:36:29 +0000 | [diff] [blame] | 126 | T = I->getType(); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 127 | if (T->getAsStructureType()) { |
| 128 | if (Find(FR)) |
| 129 | return true; |
| 130 | } |
| 131 | else { |
Anna Zaks | 1437425 | 2012-01-12 02:22:40 +0000 | [diff] [blame] | 132 | const SVal &V = StoreMgr.getBinding(store, loc::MemRegionVal(FR)); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 133 | if (V.isUndef()) |
| 134 | return true; |
| 135 | } |
| 136 | FieldChain.pop_back(); |
| 137 | } |
| 138 | } |
| 139 | |
| 140 | return false; |
| 141 | } |
| 142 | }; |
| 143 | |
| 144 | const LazyCompoundValData *D = LV->getCVData(); |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 145 | FindUninitializedField F(C.getState()->getStateManager().getStoreManager(), |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 146 | C.getSValBuilder().getRegionManager(), |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 147 | D->getStore()); |
| 148 | |
| 149 | if (F.Find(D->getRegion())) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 150 | if (ExplodedNode *N = C.generateSink()) { |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 151 | LazyInit_BT(BT_desc, BT); |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 152 | SmallString<512> Str; |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 153 | llvm::raw_svector_ostream os(Str); |
| 154 | os << "Passed-by-value struct argument contains uninitialized data"; |
| 155 | |
| 156 | if (F.FieldChain.size() == 1) |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 157 | os << " (e.g., field: '" << *F.FieldChain[0] << "')"; |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 158 | else { |
| 159 | os << " (e.g., via the field chain: '"; |
| 160 | bool first = true; |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 161 | for (SmallVectorImpl<const FieldDecl *>::iterator |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 162 | DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){ |
| 163 | if (first) |
| 164 | first = false; |
| 165 | else |
| 166 | os << '.'; |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 167 | os << **DI; |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 168 | } |
| 169 | os << "')"; |
| 170 | } |
| 171 | |
| 172 | // Generate a report for this bug. |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 173 | BugReport *R = new BugReport(*BT, os.str(), N); |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 174 | R->addRange(argRange); |
Ted Kremenek | 8133716 | 2010-03-18 03:22:29 +0000 | [diff] [blame] | 175 | |
| 176 | // FIXME: enhance track back for uninitialized value for arbitrary |
| 177 | // memregions |
| 178 | C.EmitReport(R); |
| 179 | } |
| 180 | return true; |
| 181 | } |
| 182 | } |
| 183 | |
| 184 | return false; |
| 185 | } |
| 186 | |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 187 | void CallAndMessageChecker::checkPreStmt(const CallExpr *CE, |
| 188 | CheckerContext &C) const{ |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 189 | |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 190 | const Expr *Callee = CE->getCallee()->IgnoreParens(); |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 191 | ProgramStateRef State = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 192 | const LocationContext *LCtx = C.getLocationContext(); |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 193 | SVal L = State->getSVal(Callee, LCtx); |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 194 | |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 195 | if (L.isUndef()) { |
| 196 | if (!BT_call_undef) |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 197 | BT_call_undef.reset(new BuiltinBug("Called function pointer is an " |
| 198 | "uninitalized pointer value")); |
| 199 | EmitBadCall(BT_call_undef.get(), C, CE); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 200 | return; |
| 201 | } |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 202 | |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 203 | if (L.isZeroConstant()) { |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 204 | if (!BT_call_null) |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 205 | BT_call_null.reset( |
| 206 | new BuiltinBug("Called function pointer is null (null dereference)")); |
| 207 | EmitBadCall(BT_call_null.get(), C, CE); |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 208 | } |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 209 | } |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 210 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 211 | void CallAndMessageChecker::checkPreCall(const CallEvent &Call, |
| 212 | CheckerContext &C) const { |
| 213 | // Don't check for uninitialized field values in arguments if the |
| 214 | // caller has a body that is available and we have the chance to inline it. |
| 215 | // This is a hack, but is a reasonable compromise betweens sometimes warning |
| 216 | // and sometimes not depending on if we decide to inline a function. |
| 217 | const Decl *D = Call.getDecl(); |
| 218 | const bool checkUninitFields = |
| 219 | !(C.getAnalysisManager().shouldInlineCall() && |
| 220 | (D && D->getBody())); |
| 221 | |
| 222 | OwningPtr<BugType> *BT; |
| 223 | const char *Desc; |
| 224 | |
| 225 | switch (Call.getKind()) { |
| 226 | case CE_ObjCPropertyAccess: |
| 227 | BT = &BT_msg_arg; |
| 228 | // Getters do not have arguments, so we don't need to worry about this. |
| 229 | Desc = "Argument for property setter is an uninitialized value"; |
| 230 | break; |
| 231 | case CE_ObjCMessage: |
| 232 | BT = &BT_msg_arg; |
| 233 | Desc = "Argument in message expression is an uninitialized value"; |
| 234 | break; |
| 235 | case CE_Block: |
| 236 | BT = &BT_call_arg; |
| 237 | Desc = "Block call argument is an uninitialized value"; |
| 238 | break; |
| 239 | default: |
| 240 | BT = &BT_call_arg; |
| 241 | Desc = "Function call argument is an uninitialized value"; |
| 242 | break; |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 243 | } |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 244 | |
| 245 | for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i) |
| 246 | if (PreVisitProcessArg(C, Call.getArgSVal(i), |
| 247 | Call.getArgSourceRange(i), Call.getArgExpr(i), |
| 248 | checkUninitFields, Desc, *BT)) |
| 249 | return; |
Ted Kremenek | 64fa858 | 2009-11-21 00:49:41 +0000 | [diff] [blame] | 250 | } |
| 251 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 252 | void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg, |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 253 | CheckerContext &C) const { |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 254 | SVal recVal = msg.getReceiverSVal(); |
| 255 | if (recVal.isUndef()) { |
| 256 | if (ExplodedNode *N = C.generateSink()) { |
| 257 | BugType *BT = 0; |
| 258 | if (isa<ObjCPropertyAccess>(msg)) { |
| 259 | if (!BT_objc_prop_undef) |
| 260 | BT_objc_prop_undef.reset(new BuiltinBug("Property access on an " |
| 261 | "uninitialized object pointer")); |
| 262 | BT = BT_objc_prop_undef.get(); |
| 263 | } else { |
| 264 | if (!BT_msg_undef) |
| 265 | BT_msg_undef.reset(new BuiltinBug("Receiver in message expression " |
| 266 | "is an uninitialized value")); |
| 267 | BT = BT_msg_undef.get(); |
| 268 | } |
| 269 | BugReport *R = new BugReport(*BT, BT->getName(), N); |
| 270 | R->addRange(msg.getReceiverSourceRange()); |
Ted Kremenek | 64fa858 | 2009-11-21 00:49:41 +0000 | [diff] [blame] | 271 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 272 | // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet. |
| 273 | if (const Expr *ReceiverE = msg.getInstanceReceiverExpr()) |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 274 | R->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 275 | ReceiverE, |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 276 | R)); |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 277 | C.EmitReport(R); |
| 278 | } |
| 279 | return; |
| 280 | } else { |
| 281 | // Bifurcate the state into nil and non-nil ones. |
| 282 | DefinedOrUnknownSVal receiverVal = cast<DefinedOrUnknownSVal>(recVal); |
| 283 | |
| 284 | ProgramStateRef state = C.getState(); |
| 285 | ProgramStateRef notNilState, nilState; |
| 286 | llvm::tie(notNilState, nilState) = state->assume(receiverVal); |
| 287 | |
| 288 | // Handle receiver must be nil. |
| 289 | if (nilState && !notNilState) { |
| 290 | HandleNilReceiver(C, state, msg); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 291 | return; |
| 292 | } |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 293 | } |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 294 | } |
Zhongxing Xu | 2055eff | 2009-11-24 07:06:39 +0000 | [diff] [blame] | 295 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 296 | void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C, |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 297 | const ObjCMethodCall &msg, |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 298 | ExplodedNode *N) const { |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 299 | |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 300 | if (!BT_msg_ret) |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 301 | BT_msg_ret.reset( |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 302 | new BuiltinBug("Receiver in message expression is " |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 303 | "'nil' and returns a garbage value")); |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 304 | |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 305 | SmallString<200> buf; |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 306 | llvm::raw_svector_ostream os(buf); |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 307 | os << "The receiver of message '" << msg.getSelector().getAsString() |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 308 | << "' is nil and returns a value of type '"; |
| 309 | msg.getResultType().print(os, C.getLangOpts()); |
| 310 | os << "' that will be garbage"; |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 311 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 312 | BugReport *report = new BugReport(*BT_msg_ret, os.str(), N); |
Jordan Rose | fb3cc8b | 2012-07-02 21:41:56 +0000 | [diff] [blame] | 313 | report->addRange(msg.getReceiverSourceRange()); |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 314 | // FIXME: This won't track "self" in messages to super. |
| 315 | if (const Expr *receiver = msg.getInstanceReceiverExpr()) { |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 316 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 317 | receiver, |
| 318 | report)); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 319 | } |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 320 | C.EmitReport(report); |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 321 | } |
| 322 | |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 323 | static bool supportsNilWithFloatRet(const llvm::Triple &triple) { |
Bob Wilson | 8f1e656 | 2012-01-31 23:52:54 +0000 | [diff] [blame] | 324 | return (triple.getVendor() == llvm::Triple::Apple && |
| 325 | (triple.getOS() == llvm::Triple::IOS || |
| 326 | !triple.isMacOSXVersionLT(10,5))); |
Ted Kremenek | f81330c | 2009-11-24 22:48:18 +0000 | [diff] [blame] | 327 | } |
| 328 | |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 329 | void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 330 | ProgramStateRef state, |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 331 | const ObjCMethodCall &Msg) const { |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 332 | ASTContext &Ctx = C.getASTContext(); |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 333 | |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 334 | // Check the return type of the message expression. A message to nil will |
| 335 | // return different values depending on the return type and the architecture. |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 336 | QualType RetTy = Msg.getResultType(); |
Ted Kremenek | f81330c | 2009-11-24 22:48:18 +0000 | [diff] [blame] | 337 | CanQualType CanRetTy = Ctx.getCanonicalType(RetTy); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 338 | const LocationContext *LCtx = C.getLocationContext(); |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 339 | |
Douglas Gregor | fb87b89 | 2010-04-26 21:31:17 +0000 | [diff] [blame] | 340 | if (CanRetTy->isStructureOrClassType()) { |
Ted Kremenek | 4a037c7 | 2011-10-28 19:05:10 +0000 | [diff] [blame] | 341 | // Structure returns are safe since the compiler zeroes them out. |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 342 | SVal V = C.getSValBuilder().makeZeroVal(RetTy); |
| 343 | C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V)); |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 344 | return; |
| 345 | } |
| 346 | |
Ted Kremenek | 4a037c7 | 2011-10-28 19:05:10 +0000 | [diff] [blame] | 347 | // Other cases: check if sizeof(return type) > sizeof(void*) |
Anna Zaks | a2a8603 | 2011-11-01 22:41:01 +0000 | [diff] [blame] | 348 | if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap() |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 349 | .isConsumedExpr(Msg.getOriginExpr())) { |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 350 | // Compute: sizeof(void *) and sizeof(return type) |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 351 | const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy); |
Ted Kremenek | f81330c | 2009-11-24 22:48:18 +0000 | [diff] [blame] | 352 | const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy); |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 353 | |
Ted Kremenek | f81330c | 2009-11-24 22:48:18 +0000 | [diff] [blame] | 354 | if (voidPtrSize < returnTypeSize && |
Douglas Gregor | bcfd1f5 | 2011-09-02 00:18:52 +0000 | [diff] [blame] | 355 | !(supportsNilWithFloatRet(Ctx.getTargetInfo().getTriple()) && |
Ted Kremenek | f81330c | 2009-11-24 22:48:18 +0000 | [diff] [blame] | 356 | (Ctx.FloatTy == CanRetTy || |
| 357 | Ctx.DoubleTy == CanRetTy || |
| 358 | Ctx.LongDoubleTy == CanRetTy || |
Ted Kremenek | 6123874 | 2010-09-30 00:37:10 +0000 | [diff] [blame] | 359 | Ctx.LongLongTy == CanRetTy || |
| 360 | Ctx.UnsignedLongLongTy == CanRetTy))) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 361 | if (ExplodedNode *N = C.generateSink(state)) |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 362 | emitNilReceiverBug(C, Msg, N); |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 363 | return; |
| 364 | } |
| 365 | |
| 366 | // Handle the safe cases where the return value is 0 if the |
| 367 | // receiver is nil. |
| 368 | // |
| 369 | // FIXME: For now take the conservative approach that we only |
| 370 | // return null values if we *know* that the receiver is nil. |
| 371 | // This is because we can have surprises like: |
| 372 | // |
| 373 | // ... = [[NSScreens screens] objectAtIndex:0]; |
| 374 | // |
| 375 | // What can happen is that [... screens] could return nil, but |
| 376 | // it most likely isn't nil. We should assume the semantics |
| 377 | // of this case unless we have *a lot* more knowledge. |
| 378 | // |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 379 | SVal V = C.getSValBuilder().makeZeroVal(RetTy); |
| 380 | C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V)); |
Ted Kremenek | fee96e0 | 2009-11-24 21:41:28 +0000 | [diff] [blame] | 381 | return; |
| 382 | } |
Ted Kremenek | 091b588 | 2010-03-18 02:17:27 +0000 | [diff] [blame] | 383 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 384 | C.addTransition(state); |
Zhongxing Xu | 8958fff | 2009-11-03 06:46:03 +0000 | [diff] [blame] | 385 | } |
Argyrios Kyrtzidis | d84f422 | 2011-02-28 01:28:13 +0000 | [diff] [blame] | 386 | |
| 387 | void ento::registerCallAndMessageChecker(CheckerManager &mgr) { |
| 388 | mgr.registerChecker<CallAndMessageChecker>(); |
| 389 | } |