Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 1 | //== ObjCAtSyncChecker.cpp - nil mutex checker for @synchronized -*- C++ -*--=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This defines ObjCAtSyncChecker, a builtin check that checks for null pointers |
| 11 | // used as mutexes for @synchronized. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Argyrios Kyrtzidis | 027a6ab | 2011-02-15 07:42:33 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Benjamin Kramer | c35fb7d | 2012-01-28 12:06:22 +0000 | [diff] [blame] | 16 | #include "clang/AST/StmtObjC.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 17 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 695fb50 | 2011-02-17 21:39:17 +0000 | [diff] [blame] | 18 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 20 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Ted Kremenek | 2114258 | 2010-12-23 19:38:26 +0000 | [diff] [blame] | 21 | #include "clang/StaticAnalyzer/Checkers/DereferenceChecker.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" |
Benjamin Kramer | 00bd44d | 2012-02-04 12:31:12 +0000 | [diff] [blame] | 23 | #include "llvm/ADT/STLExtras.h" |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 24 | |
| 25 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 26 | using namespace ento; |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 27 | |
| 28 | namespace { |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 29 | class ObjCAtSyncChecker |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 30 | : public Checker< check::PreStmt<ObjCAtSynchronizedStmt> > { |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 31 | mutable llvm::OwningPtr<BuiltinBug> BT_null; |
| 32 | mutable llvm::OwningPtr<BuiltinBug> BT_undef; |
| 33 | |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 34 | public: |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 35 | void checkPreStmt(const ObjCAtSynchronizedStmt *S, CheckerContext &C) const; |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 36 | }; |
| 37 | } // end anonymous namespace |
| 38 | |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 39 | void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S, |
| 40 | CheckerContext &C) const { |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 41 | |
| 42 | const Expr *Ex = S->getSynchExpr(); |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 43 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 44 | SVal V = state->getSVal(Ex, C.getLocationContext()); |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 45 | |
| 46 | // Uninitialized value used for the mutex? |
| 47 | if (isa<UndefinedVal>(V)) { |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 48 | if (ExplodedNode *N = C.generateSink()) { |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 49 | if (!BT_undef) |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 50 | BT_undef.reset(new BuiltinBug("Uninitialized value used as mutex " |
| 51 | "for @synchronized")); |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 52 | BugReport *report = |
| 53 | new BugReport(*BT_undef, BT_undef->getDescription(), N); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 54 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, Ex)); |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 55 | C.EmitReport(report); |
| 56 | } |
| 57 | return; |
| 58 | } |
| 59 | |
Ted Kremenek | 0d4f767 | 2010-10-25 20:20:56 +0000 | [diff] [blame] | 60 | if (V.isUnknown()) |
| 61 | return; |
| 62 | |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 63 | // Check for null mutexes. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 64 | ProgramStateRef notNullState, nullState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 65 | llvm::tie(notNullState, nullState) = state->assume(cast<DefinedSVal>(V)); |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 66 | |
| 67 | if (nullState) { |
| 68 | if (!notNullState) { |
| 69 | // Generate an error node. This isn't a sink since |
| 70 | // a null mutex just means no synchronization occurs. |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 71 | if (ExplodedNode *N = C.addTransition(nullState)) { |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 72 | if (!BT_null) |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 73 | BT_null.reset(new BuiltinBug("Nil value used as mutex for @synchronized() " |
| 74 | "(no synchronization will occur)")); |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 75 | BugReport *report = |
| 76 | new BugReport(*BT_null, BT_null->getDescription(), N); |
Anna Zaks | 50bbc16 | 2011-08-19 22:33:38 +0000 | [diff] [blame] | 77 | report->addVisitor(bugreporter::getTrackNullOrUndefValueVisitor(N, Ex)); |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 78 | |
| 79 | C.EmitReport(report); |
Ted Kremenek | 1adee4b | 2010-10-21 15:38:55 +0000 | [diff] [blame] | 80 | return; |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 81 | } |
| 82 | } |
Ted Kremenek | 1adee4b | 2010-10-21 15:38:55 +0000 | [diff] [blame] | 83 | // Don't add a transition for 'nullState'. If the value is |
| 84 | // under-constrained to be null or non-null, assume it is non-null |
| 85 | // afterwards. |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 86 | } |
| 87 | |
| 88 | if (notNullState) |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 89 | C.addTransition(notNullState); |
Ted Kremenek | 942e24d | 2010-09-10 03:45:29 +0000 | [diff] [blame] | 90 | } |
Ted Kremenek | 1adee4b | 2010-10-21 15:38:55 +0000 | [diff] [blame] | 91 | |
Argyrios Kyrtzidis | 45d9b4e | 2011-02-23 07:19:18 +0000 | [diff] [blame] | 92 | void ento::registerObjCAtSyncChecker(CheckerManager &mgr) { |
| 93 | if (mgr.getLangOptions().ObjC2) |
| 94 | mgr.registerChecker<ObjCAtSyncChecker>(); |
| 95 | } |