Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 1 | //== ObjCSelfInitChecker.cpp - Checker for 'self' initialization -*- C++ -*--=// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This defines ObjCSelfInitChecker, a builtin check that checks for uses of |
| 11 | // 'self' before proper initialization. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
| 15 | // This checks initialization methods to verify that they assign 'self' to the |
| 16 | // result of an initialization call (e.g. [super init], or [self initWith..]) |
| 17 | // before using 'self' or any instance variable. |
| 18 | // |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame] | 19 | // To perform the required checking, values are tagged with flags that indicate |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 20 | // 1) if the object is the one pointed to by 'self', and 2) if the object |
| 21 | // is the result of an initializer (e.g. [super init]). |
| 22 | // |
| 23 | // Uses of an object that is true for 1) but not 2) trigger a diagnostic. |
| 24 | // The uses that are currently checked are: |
| 25 | // - Using instance variables. |
| 26 | // - Returning the object. |
| 27 | // |
| 28 | // Note that we don't check for an invalid 'self' that is the receiver of an |
| 29 | // obj-c message expression to cut down false positives where logging functions |
| 30 | // get information from self (like its class) or doing "invalidation" on self |
| 31 | // when the initialization fails. |
| 32 | // |
| 33 | // Because the object that 'self' points to gets invalidated when a call |
| 34 | // receives a reference to 'self', the checker keeps track and passes the flags |
| 35 | // for 1) and 2) to the new object that 'self' points to after the call. |
| 36 | // |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 37 | //===----------------------------------------------------------------------===// |
| 38 | |
Argyrios Kyrtzidis | 027a6ab | 2011-02-15 07:42:33 +0000 | [diff] [blame] | 39 | #include "ClangSACheckers.h" |
Argyrios Kyrtzidis | ec8605f | 2011-03-01 01:16:21 +0000 | [diff] [blame] | 40 | #include "clang/StaticAnalyzer/Core/Checker.h" |
Argyrios Kyrtzidis | 695fb50 | 2011-02-17 21:39:17 +0000 | [diff] [blame] | 41 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Jordan Rose | f540c54 | 2012-07-26 21:39:41 +0000 | [diff] [blame] | 42 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 43 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 44 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 45 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 46 | #include "clang/AST/ParentMap.h" |
| 47 | |
| 48 | using namespace clang; |
| 49 | using namespace ento; |
| 50 | |
| 51 | static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND); |
| 52 | static bool isInitializationMethod(const ObjCMethodDecl *MD); |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 53 | static bool isInitMessage(const ObjCMethodCall &Msg); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 54 | static bool isSelfVar(SVal location, CheckerContext &C); |
| 55 | |
| 56 | namespace { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 57 | class ObjCSelfInitChecker : public Checker< check::PostObjCMessage, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 58 | check::PostStmt<ObjCIvarRefExpr>, |
| 59 | check::PreStmt<ReturnStmt>, |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 60 | check::PreCall, |
| 61 | check::PostCall, |
Anna Zaks | 6a2a186 | 2012-05-08 21:19:21 +0000 | [diff] [blame] | 62 | check::Location, |
| 63 | check::Bind > { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 64 | public: |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 65 | void checkPostObjCMessage(const ObjCMethodCall &Msg, CheckerContext &C) const; |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 66 | void checkPostStmt(const ObjCIvarRefExpr *E, CheckerContext &C) const; |
| 67 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 68 | void checkLocation(SVal location, bool isLoad, const Stmt *S, |
| 69 | CheckerContext &C) const; |
Anna Zaks | 6a2a186 | 2012-05-08 21:19:21 +0000 | [diff] [blame] | 70 | void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 71 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 72 | void checkPreCall(const CallEvent &CE, CheckerContext &C) const; |
| 73 | void checkPostCall(const CallEvent &CE, CheckerContext &C) const; |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 74 | |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 75 | void printState(raw_ostream &Out, ProgramStateRef State, |
| 76 | const char *NL, const char *Sep) const; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 77 | }; |
| 78 | } // end anonymous namespace |
| 79 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 80 | namespace { |
| 81 | |
| 82 | class InitSelfBug : public BugType { |
| 83 | const std::string desc; |
| 84 | public: |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 85 | InitSelfBug() : BugType("Missing \"self = [(super or self) init...]\"", |
Ted Kremenek | 6fd4505 | 2012-04-05 20:43:28 +0000 | [diff] [blame] | 86 | categories::CoreFoundationObjectiveC) {} |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 87 | }; |
| 88 | |
| 89 | } // end anonymous namespace |
| 90 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 91 | namespace { |
| 92 | enum SelfFlagEnum { |
| 93 | /// \brief No flag set. |
| 94 | SelfFlag_None = 0x0, |
| 95 | /// \brief Value came from 'self'. |
| 96 | SelfFlag_Self = 0x1, |
| 97 | /// \brief Value came from the result of an initializer (e.g. [super init]). |
| 98 | SelfFlag_InitRes = 0x2 |
| 99 | }; |
| 100 | } |
| 101 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 102 | typedef llvm::ImmutableMap<SymbolRef, unsigned> SelfFlag; |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 103 | namespace { struct CalledInit {}; } |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 104 | namespace { struct PreCallSelfFlags {}; } |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 105 | |
| 106 | namespace clang { |
| 107 | namespace ento { |
| 108 | template<> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 109 | struct ProgramStateTrait<SelfFlag> : public ProgramStatePartialTrait<SelfFlag> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 110 | static void *GDMIndex() { static int index = 0; return &index; } |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 111 | }; |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 112 | template <> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 113 | struct ProgramStateTrait<CalledInit> : public ProgramStatePartialTrait<bool> { |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 114 | static void *GDMIndex() { static int index = 0; return &index; } |
| 115 | }; |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 116 | |
| 117 | /// \brief A call receiving a reference to 'self' invalidates the object that |
| 118 | /// 'self' contains. This keeps the "self flags" assigned to the 'self' |
| 119 | /// object before the call so we can assign them to the new object that 'self' |
| 120 | /// points to after the call. |
| 121 | template <> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 122 | struct ProgramStateTrait<PreCallSelfFlags> : public ProgramStatePartialTrait<unsigned> { |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 123 | static void *GDMIndex() { static int index = 0; return &index; } |
| 124 | }; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 125 | } |
| 126 | } |
| 127 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 128 | static SelfFlagEnum getSelfFlags(SVal val, ProgramStateRef state) { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 129 | if (SymbolRef sym = val.getAsSymbol()) |
| 130 | if (const unsigned *attachedFlags = state->get<SelfFlag>(sym)) |
| 131 | return (SelfFlagEnum)*attachedFlags; |
| 132 | return SelfFlag_None; |
| 133 | } |
| 134 | |
| 135 | static SelfFlagEnum getSelfFlags(SVal val, CheckerContext &C) { |
| 136 | return getSelfFlags(val, C.getState()); |
| 137 | } |
| 138 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 139 | static void addSelfFlag(ProgramStateRef state, SVal val, |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 140 | SelfFlagEnum flag, CheckerContext &C) { |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 141 | // We tag the symbol that the SVal wraps. |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 142 | if (SymbolRef sym = val.getAsSymbol()) |
Jordan Rose | 82f2ad4 | 2012-09-08 01:47:28 +0000 | [diff] [blame^] | 143 | state = state->set<SelfFlag>(sym, getSelfFlags(val, state) | flag); |
| 144 | C.addTransition(state); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 145 | } |
| 146 | |
| 147 | static bool hasSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) { |
| 148 | return getSelfFlags(val, C) & flag; |
| 149 | } |
| 150 | |
| 151 | /// \brief Returns true of the value of the expression is the object that 'self' |
| 152 | /// points to and is an object that did not come from the result of calling |
| 153 | /// an initializer. |
| 154 | static bool isInvalidSelf(const Expr *E, CheckerContext &C) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 155 | SVal exprVal = C.getState()->getSVal(E, C.getLocationContext()); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 156 | if (!hasSelfFlag(exprVal, SelfFlag_Self, C)) |
| 157 | return false; // value did not come from 'self'. |
| 158 | if (hasSelfFlag(exprVal, SelfFlag_InitRes, C)) |
| 159 | return false; // 'self' is properly initialized. |
| 160 | |
| 161 | return true; |
| 162 | } |
| 163 | |
| 164 | static void checkForInvalidSelf(const Expr *E, CheckerContext &C, |
| 165 | const char *errorStr) { |
| 166 | if (!E) |
| 167 | return; |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 168 | |
| 169 | if (!C.getState()->get<CalledInit>()) |
| 170 | return; |
| 171 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 172 | if (!isInvalidSelf(E, C)) |
| 173 | return; |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 174 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 175 | // Generate an error node. |
| 176 | ExplodedNode *N = C.generateSink(); |
| 177 | if (!N) |
| 178 | return; |
| 179 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 180 | BugReport *report = |
| 181 | new BugReport(*new InitSelfBug(), errorStr, N); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 182 | C.EmitReport(report); |
| 183 | } |
| 184 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 185 | void ObjCSelfInitChecker::checkPostObjCMessage(const ObjCMethodCall &Msg, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 186 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 187 | // When encountering a message that does initialization (init rule), |
| 188 | // tag the return value so that we know later on that if self has this value |
| 189 | // then it is properly initialized. |
| 190 | |
| 191 | // FIXME: A callback should disable checkers at the start of functions. |
| 192 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 193 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 194 | return; |
| 195 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 196 | if (isInitMessage(Msg)) { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 197 | // Tag the return value as the result of an initializer. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 198 | ProgramStateRef state = C.getState(); |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 199 | |
| 200 | // FIXME this really should be context sensitive, where we record |
| 201 | // the current stack frame (for IPA). Also, we need to clean this |
| 202 | // value out when we return from this method. |
| 203 | state = state->set<CalledInit>(true); |
| 204 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 205 | SVal V = state->getSVal(Msg.getOriginExpr(), C.getLocationContext()); |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 206 | addSelfFlag(state, V, SelfFlag_InitRes, C); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 207 | return; |
| 208 | } |
| 209 | |
| 210 | // We don't check for an invalid 'self' in an obj-c message expression to cut |
| 211 | // down false positives where logging functions get information from self |
| 212 | // (like its class) or doing "invalidation" on self when the initialization |
| 213 | // fails. |
| 214 | } |
| 215 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 216 | void ObjCSelfInitChecker::checkPostStmt(const ObjCIvarRefExpr *E, |
| 217 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 218 | // FIXME: A callback should disable checkers at the start of functions. |
| 219 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 220 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 221 | return; |
| 222 | |
| 223 | checkForInvalidSelf(E->getBase(), C, |
Argyrios Kyrtzidis | be29d8d | 2011-02-01 19:32:55 +0000 | [diff] [blame] | 224 | "Instance variable used while 'self' is not set to the result of " |
Argyrios Kyrtzidis | 4717f16 | 2011-01-26 01:26:41 +0000 | [diff] [blame] | 225 | "'[(super or self) init...]'"); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 226 | } |
| 227 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 228 | void ObjCSelfInitChecker::checkPreStmt(const ReturnStmt *S, |
| 229 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 230 | // FIXME: A callback should disable checkers at the start of functions. |
| 231 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
Anna Zaks | 1efcc42 | 2012-02-04 02:31:37 +0000 | [diff] [blame] | 232 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 233 | return; |
| 234 | |
| 235 | checkForInvalidSelf(S->getRetValue(), C, |
Argyrios Kyrtzidis | 63eeade | 2011-02-01 20:33:05 +0000 | [diff] [blame] | 236 | "Returning 'self' while it is not set to the result of " |
Argyrios Kyrtzidis | 4717f16 | 2011-01-26 01:26:41 +0000 | [diff] [blame] | 237 | "'[(super or self) init...]'"); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 238 | } |
| 239 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 240 | // When a call receives a reference to 'self', [Pre/Post]Call pass |
| 241 | // the SelfFlags from the object 'self' points to before the call to the new |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 242 | // object after the call. This is to avoid invalidation of 'self' by logging |
| 243 | // functions. |
| 244 | // Another common pattern in classes with multiple initializers is to put the |
| 245 | // subclass's common initialization bits into a static function that receives |
| 246 | // the value of 'self', e.g: |
| 247 | // @code |
| 248 | // if (!(self = [super init])) |
| 249 | // return nil; |
| 250 | // if (!(self = _commonInit(self))) |
| 251 | // return nil; |
| 252 | // @endcode |
| 253 | // Until we can use inter-procedural analysis, in such a call, transfer the |
| 254 | // SelfFlags to the result of the call. |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 255 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 256 | void ObjCSelfInitChecker::checkPreCall(const CallEvent &CE, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 257 | CheckerContext &C) const { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 258 | // FIXME: A callback should disable checkers at the start of functions. |
| 259 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
| 260 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
| 261 | return; |
Jordan Rose | 55037cd | 2012-07-02 19:27:46 +0000 | [diff] [blame] | 262 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 263 | ProgramStateRef state = C.getState(); |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 264 | unsigned NumArgs = CE.getNumArgs(); |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 265 | // If we passed 'self' as and argument to the call, record it in the state |
| 266 | // to be propagated after the call. |
| 267 | // Note, we could have just given up, but try to be more optimistic here and |
| 268 | // assume that the functions are going to continue initialization or will not |
| 269 | // modify self. |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 270 | for (unsigned i = 0; i < NumArgs; ++i) { |
| 271 | SVal argV = CE.getArgSVal(i); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 272 | if (isSelfVar(argV, C)) { |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 273 | unsigned selfFlags = getSelfFlags(state->getSVal(cast<Loc>(argV)), C); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 274 | C.addTransition(state->set<PreCallSelfFlags>(selfFlags)); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 275 | return; |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 276 | } else if (hasSelfFlag(argV, SelfFlag_Self, C)) { |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 277 | unsigned selfFlags = getSelfFlags(argV, C); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 278 | C.addTransition(state->set<PreCallSelfFlags>(selfFlags)); |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 279 | return; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 280 | } |
| 281 | } |
| 282 | } |
| 283 | |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 284 | void ObjCSelfInitChecker::checkPostCall(const CallEvent &CE, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 285 | CheckerContext &C) const { |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 286 | // FIXME: A callback should disable checkers at the start of functions. |
| 287 | if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( |
| 288 | C.getCurrentAnalysisDeclContext()->getDecl()))) |
| 289 | return; |
| 290 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 291 | ProgramStateRef state = C.getState(); |
Jordan Rose | fe6a011 | 2012-07-02 19:28:21 +0000 | [diff] [blame] | 292 | SelfFlagEnum prevFlags = (SelfFlagEnum)state->get<PreCallSelfFlags>(); |
| 293 | if (!prevFlags) |
| 294 | return; |
| 295 | state = state->remove<PreCallSelfFlags>(); |
| 296 | |
Anna Zaks | f420fe3 | 2012-03-05 18:58:25 +0000 | [diff] [blame] | 297 | unsigned NumArgs = CE.getNumArgs(); |
| 298 | for (unsigned i = 0; i < NumArgs; ++i) { |
| 299 | SVal argV = CE.getArgSVal(i); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 300 | if (isSelfVar(argV, C)) { |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 301 | // If the address of 'self' is being passed to the call, assume that the |
| 302 | // 'self' after the call will have the same flags. |
| 303 | // EX: log(&self) |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 304 | addSelfFlag(state, state->getSVal(cast<Loc>(argV)), prevFlags, C); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 305 | return; |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 306 | } else if (hasSelfFlag(argV, SelfFlag_Self, C)) { |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 307 | // If 'self' is passed to the call by value, assume that the function |
| 308 | // returns 'self'. So assign the flags, which were set on 'self' to the |
| 309 | // return value. |
| 310 | // EX: self = performMoreInitialization(self) |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 311 | const Expr *CallExpr = CE.getOriginExpr(); |
| 312 | if (CallExpr) |
| 313 | addSelfFlag(state, state->getSVal(CallExpr, C.getLocationContext()), |
Jordan Rose | 82f2ad4 | 2012-09-08 01:47:28 +0000 | [diff] [blame^] | 314 | prevFlags, C); |
Argyrios Kyrtzidis | 0ca1040 | 2011-02-05 05:54:53 +0000 | [diff] [blame] | 315 | return; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 316 | } |
| 317 | } |
| 318 | } |
| 319 | |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 320 | void ObjCSelfInitChecker::checkLocation(SVal location, bool isLoad, |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 321 | const Stmt *S, |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 322 | CheckerContext &C) const { |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 323 | // Tag the result of a load from 'self' so that we can easily know that the |
| 324 | // value is the object that 'self' points to. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 325 | ProgramStateRef state = C.getState(); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 326 | if (isSelfVar(location, C)) |
Ted Kremenek | b715a7c | 2011-02-12 03:03:54 +0000 | [diff] [blame] | 327 | addSelfFlag(state, state->getSVal(cast<Loc>(location)), SelfFlag_Self, C); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 328 | } |
| 329 | |
Anna Zaks | 6a2a186 | 2012-05-08 21:19:21 +0000 | [diff] [blame] | 330 | |
| 331 | void ObjCSelfInitChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
| 332 | CheckerContext &C) const { |
| 333 | // Allow assignment of anything to self. Self is a local variable in the |
| 334 | // initializer, so it is legal to assign anything to it, like results of |
| 335 | // static functions/method calls. After self is assigned something we cannot |
| 336 | // reason about, stop enforcing the rules. |
| 337 | // (Only continue checking if the assigned value should be treated as self.) |
| 338 | if ((isSelfVar(loc, C)) && |
| 339 | !hasSelfFlag(val, SelfFlag_InitRes, C) && |
| 340 | !hasSelfFlag(val, SelfFlag_Self, C) && |
| 341 | !isSelfVar(val, C)) { |
| 342 | |
| 343 | // Stop tracking the checker-specific state in the state. |
| 344 | ProgramStateRef State = C.getState(); |
| 345 | State = State->remove<CalledInit>(); |
| 346 | if (SymbolRef sym = loc.getAsSymbol()) |
| 347 | State = State->remove<SelfFlag>(sym); |
| 348 | C.addTransition(State); |
| 349 | } |
| 350 | } |
| 351 | |
Jordan Rose | a435e69 | 2012-09-08 01:47:11 +0000 | [diff] [blame] | 352 | void ObjCSelfInitChecker::printState(raw_ostream &Out, ProgramStateRef State, |
| 353 | const char *NL, const char *Sep) const { |
| 354 | SelfFlag FlagMap = State->get<SelfFlag>(); |
| 355 | bool DidCallInit = State->get<CalledInit>(); |
| 356 | SelfFlagEnum PreCallFlags = (SelfFlagEnum)State->get<PreCallSelfFlags>(); |
| 357 | |
| 358 | if (FlagMap.isEmpty() && !DidCallInit && !PreCallFlags) |
| 359 | return; |
| 360 | |
| 361 | Out << Sep << NL << "ObjCSelfInitChecker:" << NL; |
| 362 | |
| 363 | if (DidCallInit) |
| 364 | Out << " An init method has been called." << NL; |
| 365 | |
| 366 | if (PreCallFlags != SelfFlag_None) { |
| 367 | if (PreCallFlags & SelfFlag_Self) { |
| 368 | Out << " An argument of the current call came from the 'self' variable." |
| 369 | << NL; |
| 370 | } |
| 371 | if (PreCallFlags & SelfFlag_InitRes) { |
| 372 | Out << " An argument of the current call came from an init method." |
| 373 | << NL; |
| 374 | } |
| 375 | } |
| 376 | |
| 377 | Out << NL; |
| 378 | for (SelfFlag::iterator I = FlagMap.begin(), E = FlagMap.end(); I != E; ++I) { |
| 379 | Out << I->first << " : "; |
| 380 | |
| 381 | if (I->second == SelfFlag_None) |
| 382 | Out << "none"; |
| 383 | |
| 384 | if (I->second & SelfFlag_Self) |
| 385 | Out << "self variable"; |
| 386 | |
| 387 | if (I->second & SelfFlag_InitRes) { |
| 388 | if (I->second != SelfFlag_InitRes) |
| 389 | Out << " | "; |
| 390 | Out << "result of init method"; |
| 391 | } |
| 392 | |
| 393 | Out << NL; |
| 394 | } |
| 395 | } |
| 396 | |
| 397 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 398 | // FIXME: A callback should disable checkers at the start of functions. |
| 399 | static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND) { |
| 400 | if (!ND) |
| 401 | return false; |
| 402 | |
| 403 | const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(ND); |
| 404 | if (!MD) |
| 405 | return false; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 406 | if (!isInitializationMethod(MD)) |
| 407 | return false; |
| 408 | |
Argyrios Kyrtzidis | eaf969b | 2011-01-25 23:54:44 +0000 | [diff] [blame] | 409 | // self = [super init] applies only to NSObject subclasses. |
| 410 | // For instance, NSProxy doesn't implement -init. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 411 | ASTContext &Ctx = MD->getASTContext(); |
Argyrios Kyrtzidis | eaf969b | 2011-01-25 23:54:44 +0000 | [diff] [blame] | 412 | IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 413 | ObjCInterfaceDecl *ID = MD->getClassInterface()->getSuperClass(); |
Argyrios Kyrtzidis | eaf969b | 2011-01-25 23:54:44 +0000 | [diff] [blame] | 414 | for ( ; ID ; ID = ID->getSuperClass()) { |
| 415 | IdentifierInfo *II = ID->getIdentifier(); |
| 416 | |
| 417 | if (II == NSObjectII) |
| 418 | break; |
| 419 | } |
| 420 | if (!ID) |
| 421 | return false; |
| 422 | |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 423 | return true; |
| 424 | } |
| 425 | |
| 426 | /// \brief Returns true if the location is 'self'. |
| 427 | static bool isSelfVar(SVal location, CheckerContext &C) { |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 428 | AnalysisDeclContext *analCtx = C.getCurrentAnalysisDeclContext(); |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 429 | if (!analCtx->getSelfDecl()) |
| 430 | return false; |
| 431 | if (!isa<loc::MemRegionVal>(location)) |
| 432 | return false; |
| 433 | |
| 434 | loc::MemRegionVal MRV = cast<loc::MemRegionVal>(location); |
Anna Zaks | 9a70cdd | 2012-04-16 21:51:09 +0000 | [diff] [blame] | 435 | if (const DeclRegion *DR = dyn_cast<DeclRegion>(MRV.stripCasts())) |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 436 | return (DR->getDecl() == analCtx->getSelfDecl()); |
| 437 | |
| 438 | return false; |
| 439 | } |
| 440 | |
| 441 | static bool isInitializationMethod(const ObjCMethodDecl *MD) { |
John McCall | 85f3d76 | 2011-03-02 01:50:55 +0000 | [diff] [blame] | 442 | return MD->getMethodFamily() == OMF_init; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 443 | } |
| 444 | |
Jordan Rose | de507ea | 2012-07-02 19:28:04 +0000 | [diff] [blame] | 445 | static bool isInitMessage(const ObjCMethodCall &Call) { |
| 446 | return Call.getMethodFamily() == OMF_init; |
Argyrios Kyrtzidis | d7a31ba | 2011-01-11 19:45:25 +0000 | [diff] [blame] | 447 | } |
Argyrios Kyrtzidis | 769ce3e | 2011-02-22 17:30:38 +0000 | [diff] [blame] | 448 | |
| 449 | //===----------------------------------------------------------------------===// |
| 450 | // Registration. |
| 451 | //===----------------------------------------------------------------------===// |
| 452 | |
| 453 | void ento::registerObjCSelfInitChecker(CheckerManager &mgr) { |
| 454 | mgr.registerChecker<ObjCSelfInitChecker>(); |
| 455 | } |