Nick Lewycky | 5d796aa | 2008-08-16 17:46:53 +0000 | [diff] [blame] | 1 | //==- UninitializedValues.cpp - Find Uninitialized Values -------*- C++ --*-==// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
Chris Lattner | 0bc735f | 2007-12-29 19:59:25 +0000 | [diff] [blame] | 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file implements Uninitialized Values analysis for source-level CFGs. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Ted Kremenek | cf6e41b | 2007-12-21 21:42:19 +0000 | [diff] [blame] | 14 | #include "clang/Analysis/Analyses/UninitializedValues.h" |
Ted Kremenek | 11de5cb | 2007-09-20 21:42:55 +0000 | [diff] [blame] | 15 | #include "clang/Analysis/Visitors/CFGRecStmtDeclVisitor.h" |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/LocalCheckers.h" |
Chris Lattner | 500d329 | 2009-01-29 05:15:15 +0000 | [diff] [blame] | 17 | #include "clang/Analysis/AnalysisDiagnostic.h" |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 18 | #include "clang/AST/ASTContext.h" |
Ted Kremenek | 1de632b | 2007-09-25 21:00:24 +0000 | [diff] [blame] | 19 | #include "clang/Analysis/FlowSensitive/DataflowSolver.h" |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 20 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 21 | #include "llvm/ADT/SmallPtrSet.h" |
| 22 | |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 23 | using namespace clang; |
| 24 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 25 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 26 | // Dataflow initialization logic. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 27 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 28 | |
| 29 | namespace { |
| 30 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 31 | class RegisterDecls |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 32 | : public CFGRecStmtDeclVisitor<RegisterDecls> { |
Ted Kremenek | c2b51d8 | 2008-01-08 18:19:08 +0000 | [diff] [blame] | 33 | |
Ted Kremenek | 56d516d | 2007-09-17 17:14:52 +0000 | [diff] [blame] | 34 | UninitializedValues::AnalysisDataTy& AD; |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 35 | public: |
Ted Kremenek | 11e7218 | 2007-10-01 20:33:52 +0000 | [diff] [blame] | 36 | RegisterDecls(UninitializedValues::AnalysisDataTy& ad) : AD(ad) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 37 | |
Ted Kremenek | 606ceee | 2008-04-15 23:02:18 +0000 | [diff] [blame] | 38 | void VisitVarDecl(VarDecl* VD) { AD.Register(VD); } |
Ted Kremenek | 9f9141c | 2007-11-20 03:01:58 +0000 | [diff] [blame] | 39 | CFG& getCFG() { return AD.getCFG(); } |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 40 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 41 | |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 42 | } // end anonymous namespace |
| 43 | |
| 44 | void UninitializedValues::InitializeValues(const CFG& cfg) { |
Ted Kremenek | 11e7218 | 2007-10-01 20:33:52 +0000 | [diff] [blame] | 45 | RegisterDecls R(getAnalysisData()); |
Ted Kremenek | a90b0d1 | 2007-09-18 20:59:00 +0000 | [diff] [blame] | 46 | cfg.VisitBlockStmts(R); |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 47 | } |
| 48 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 49 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 50 | // Transfer functions. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 51 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 52 | |
| 53 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 54 | class TransferFuncs |
Ted Kremenek | c2b51d8 | 2008-01-08 18:19:08 +0000 | [diff] [blame] | 55 | : public CFGStmtVisitor<TransferFuncs,bool> { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 56 | |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 57 | UninitializedValues::ValTy V; |
Ted Kremenek | 56d516d | 2007-09-17 17:14:52 +0000 | [diff] [blame] | 58 | UninitializedValues::AnalysisDataTy& AD; |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 59 | public: |
Ted Kremenek | 7deed0c | 2008-04-15 18:35:30 +0000 | [diff] [blame] | 60 | TransferFuncs(UninitializedValues::AnalysisDataTy& ad) : AD(ad) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 61 | |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 62 | UninitializedValues::ValTy& getVal() { return V; } |
Ted Kremenek | 9f9141c | 2007-11-20 03:01:58 +0000 | [diff] [blame] | 63 | CFG& getCFG() { return AD.getCFG(); } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 64 | |
Ted Kremenek | 7deed0c | 2008-04-15 18:35:30 +0000 | [diff] [blame] | 65 | void SetTopValue(UninitializedValues::ValTy& X) { |
Ted Kremenek | e219b8a | 2008-11-11 19:41:42 +0000 | [diff] [blame] | 66 | X.setDeclValues(AD); |
Ted Kremenek | 8d798c7 | 2008-11-14 01:14:18 +0000 | [diff] [blame] | 67 | X.resetBlkExprValues(AD); |
Ted Kremenek | 7deed0c | 2008-04-15 18:35:30 +0000 | [diff] [blame] | 68 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 69 | |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 70 | bool VisitDeclRefExpr(DeclRefExpr* DR); |
| 71 | bool VisitBinaryOperator(BinaryOperator* B); |
| 72 | bool VisitUnaryOperator(UnaryOperator* U); |
| 73 | bool VisitStmt(Stmt* S); |
| 74 | bool VisitCallExpr(CallExpr* C); |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 75 | bool VisitDeclStmt(DeclStmt* D); |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 76 | bool VisitConditionalOperator(ConditionalOperator* C); |
Ted Kremenek | bfcb712 | 2008-11-12 21:58:46 +0000 | [diff] [blame] | 77 | bool BlockStmt_VisitObjCForCollectionStmt(ObjCForCollectionStmt* S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 78 | |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 79 | bool Visit(Stmt *S); |
| 80 | bool BlockStmt_VisitExpr(Expr* E); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 81 | |
Ted Kremenek | 411cdee | 2008-04-16 21:10:48 +0000 | [diff] [blame] | 82 | void VisitTerminator(CFGBlock* B) { } |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 83 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 84 | |
Ted Kremenek | e219b8a | 2008-11-11 19:41:42 +0000 | [diff] [blame] | 85 | static const bool Initialized = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 86 | static const bool Uninitialized = true; |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 87 | |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 88 | bool TransferFuncs::VisitDeclRefExpr(DeclRefExpr* DR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 89 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 90 | if (VarDecl* VD = dyn_cast<VarDecl>(DR->getDecl())) |
| 91 | if (VD->isBlockVarDecl()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 92 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 93 | if (AD.Observer) |
| 94 | AD.Observer->ObserveDeclRefExpr(V, AD, DR, VD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 96 | // Pseudo-hack to prevent cascade of warnings. If an accessed variable |
| 97 | // is uninitialized, then we are already going to flag a warning for |
| 98 | // this variable, which a "source" of uninitialized values. |
| 99 | // We can otherwise do a full "taint" of uninitialized values. The |
| 100 | // client has both options by toggling AD.FullUninitTaint. |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 101 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 102 | if (AD.FullUninitTaint) |
| 103 | return V(VD,AD); |
| 104 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 105 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 106 | return Initialized; |
Ted Kremenek | 43a1698 | 2007-09-18 21:43:18 +0000 | [diff] [blame] | 107 | } |
| 108 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 109 | static VarDecl* FindBlockVarDecl(Expr* E) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 110 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 111 | // Blast through casts and parentheses to find any DeclRefExprs that |
| 112 | // refer to a block VarDecl. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 113 | |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 114 | if (DeclRefExpr* DR = dyn_cast<DeclRefExpr>(E->IgnoreParenCasts())) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 115 | if (VarDecl* VD = dyn_cast<VarDecl>(DR->getDecl())) |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 116 | if (VD->isBlockVarDecl()) return VD; |
| 117 | |
| 118 | return NULL; |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 119 | } |
| 120 | |
| 121 | bool TransferFuncs::VisitBinaryOperator(BinaryOperator* B) { |
Ted Kremenek | 2f868c0 | 2008-04-16 02:59:55 +0000 | [diff] [blame] | 122 | |
| 123 | if (VarDecl* VD = FindBlockVarDecl(B->getLHS())) |
Ted Kremenek | 6ce2b63 | 2007-09-28 21:08:51 +0000 | [diff] [blame] | 124 | if (B->isAssignmentOp()) { |
Ted Kremenek | ff7c538 | 2007-11-24 20:07:36 +0000 | [diff] [blame] | 125 | if (B->getOpcode() == BinaryOperator::Assign) |
| 126 | return V(VD,AD) = Visit(B->getRHS()); |
| 127 | else // Handle +=, -=, *=, etc. We do want '&', not '&&'. |
| 128 | return V(VD,AD) = Visit(B->getLHS()) & Visit(B->getRHS()); |
Ted Kremenek | 6ce2b63 | 2007-09-28 21:08:51 +0000 | [diff] [blame] | 129 | } |
| 130 | |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 131 | return VisitStmt(B); |
| 132 | } |
| 133 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 134 | bool TransferFuncs::VisitDeclStmt(DeclStmt* S) { |
Ted Kremenek | 14f8b4f | 2008-08-05 20:46:55 +0000 | [diff] [blame] | 135 | for (DeclStmt::decl_iterator I=S->decl_begin(), E=S->decl_end(); I!=E; ++I) { |
| 136 | VarDecl *VD = dyn_cast<VarDecl>(*I); |
Steve Naroff | 248a753 | 2008-04-15 22:42:06 +0000 | [diff] [blame] | 137 | if (VD && VD->isBlockVarDecl()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 138 | if (Stmt* I = VD->getInit()) |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 139 | V(VD,AD) = AD.FullUninitTaint ? V(cast<Expr>(I),AD) : Initialized; |
Ted Kremenek | 81a56ec | 2007-12-13 05:14:22 +0000 | [diff] [blame] | 140 | else { |
| 141 | // Special case for declarations of array types. For things like: |
| 142 | // |
| 143 | // char x[10]; |
| 144 | // |
| 145 | // we should treat "x" as being initialized, because the variable |
| 146 | // "x" really refers to the memory block. Clearly x[1] is |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 147 | // uninitialized, but expressions like "(char *) x" really do refer to |
| 148 | // an initialized value. This simple dataflow analysis does not reason |
Ted Kremenek | 81a56ec | 2007-12-13 05:14:22 +0000 | [diff] [blame] | 149 | // about the contents of arrays, although it could be potentially |
| 150 | // extended to do so if the array were of constant size. |
| 151 | if (VD->getType()->isArrayType()) |
| 152 | V(VD,AD) = Initialized; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 153 | else |
Ted Kremenek | 81a56ec | 2007-12-13 05:14:22 +0000 | [diff] [blame] | 154 | V(VD,AD) = Uninitialized; |
| 155 | } |
Ted Kremenek | aead153 | 2007-09-27 18:20:22 +0000 | [diff] [blame] | 156 | } |
Steve Naroff | 248a753 | 2008-04-15 22:42:06 +0000 | [diff] [blame] | 157 | } |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 158 | return Uninitialized; // Value is never consumed. |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 159 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 160 | |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 161 | bool TransferFuncs::VisitCallExpr(CallExpr* C) { |
Ted Kremenek | 59d1827 | 2007-09-18 21:47:41 +0000 | [diff] [blame] | 162 | VisitChildren(C); |
Ted Kremenek | aead153 | 2007-09-27 18:20:22 +0000 | [diff] [blame] | 163 | return Initialized; |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 164 | } |
| 165 | |
| 166 | bool TransferFuncs::VisitUnaryOperator(UnaryOperator* U) { |
Ted Kremenek | 8d9ebae | 2007-12-13 04:47:15 +0000 | [diff] [blame] | 167 | switch (U->getOpcode()) { |
Argyrios Kyrtzidis | 5da6b25 | 2008-04-17 13:52:22 +0000 | [diff] [blame] | 168 | case UnaryOperator::AddrOf: { |
Steve Naroff | 248a753 | 2008-04-15 22:42:06 +0000 | [diff] [blame] | 169 | VarDecl* VD = FindBlockVarDecl(U->getSubExpr()); |
| 170 | if (VD && VD->isBlockVarDecl()) |
Ted Kremenek | 8d9ebae | 2007-12-13 04:47:15 +0000 | [diff] [blame] | 171 | return V(VD,AD) = Initialized; |
Ted Kremenek | 8d9ebae | 2007-12-13 04:47:15 +0000 | [diff] [blame] | 172 | break; |
Argyrios Kyrtzidis | 5da6b25 | 2008-04-17 13:52:22 +0000 | [diff] [blame] | 173 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 174 | |
Ted Kremenek | 8d9ebae | 2007-12-13 04:47:15 +0000 | [diff] [blame] | 175 | default: |
| 176 | break; |
| 177 | } |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 178 | |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 179 | return Visit(U->getSubExpr()); |
| 180 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 181 | |
Ted Kremenek | bfcb712 | 2008-11-12 21:58:46 +0000 | [diff] [blame] | 182 | bool |
| 183 | TransferFuncs::BlockStmt_VisitObjCForCollectionStmt(ObjCForCollectionStmt* S) { |
Ted Kremenek | e219b8a | 2008-11-11 19:41:42 +0000 | [diff] [blame] | 184 | // This represents a use of the 'collection' |
| 185 | bool x = Visit(S->getCollection()); |
| 186 | |
| 187 | if (x == Uninitialized) |
| 188 | return Uninitialized; |
| 189 | |
| 190 | // This represents an initialization of the 'element' value. |
| 191 | Stmt* Element = S->getElement(); |
| 192 | VarDecl* VD = 0; |
| 193 | |
| 194 | if (DeclStmt* DS = dyn_cast<DeclStmt>(Element)) |
Chris Lattner | 7e24e82 | 2009-03-28 06:33:19 +0000 | [diff] [blame] | 195 | VD = cast<VarDecl>(DS->getSingleDecl()); |
Ted Kremenek | c2813f7 | 2008-11-14 18:21:25 +0000 | [diff] [blame] | 196 | else { |
| 197 | Expr* ElemExpr = cast<Expr>(Element)->IgnoreParens(); |
Ted Kremenek | e219b8a | 2008-11-11 19:41:42 +0000 | [diff] [blame] | 198 | |
Ted Kremenek | c2813f7 | 2008-11-14 18:21:25 +0000 | [diff] [blame] | 199 | // Initialize the value of the reference variable. |
| 200 | if (DeclRefExpr* DR = dyn_cast<DeclRefExpr>(ElemExpr)) |
| 201 | VD = cast<VarDecl>(DR->getDecl()); |
| 202 | else |
| 203 | return Visit(ElemExpr); |
| 204 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 205 | |
Ted Kremenek | e219b8a | 2008-11-11 19:41:42 +0000 | [diff] [blame] | 206 | V(VD,AD) = Initialized; |
| 207 | return Initialized; |
| 208 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 209 | |
| 210 | |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 211 | bool TransferFuncs::VisitConditionalOperator(ConditionalOperator* C) { |
| 212 | Visit(C->getCond()); |
Anders Carlsson | 3907323 | 2007-11-30 19:04:31 +0000 | [diff] [blame] | 213 | |
| 214 | bool rhsResult = Visit(C->getRHS()); |
| 215 | // Handle the GNU extension for missing LHS. |
| 216 | if (Expr *lhs = C->getLHS()) |
| 217 | return Visit(lhs) & rhsResult; // Yes: we want &, not &&. |
| 218 | else |
| 219 | return rhsResult; |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 220 | } |
| 221 | |
| 222 | bool TransferFuncs::VisitStmt(Stmt* S) { |
Ted Kremenek | aead153 | 2007-09-27 18:20:22 +0000 | [diff] [blame] | 223 | bool x = Initialized; |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 224 | |
| 225 | // We don't stop at the first subexpression that is Uninitialized because |
| 226 | // evaluating some subexpressions may result in propogating "Uninitialized" |
| 227 | // or "Initialized" to variables referenced in the other subexpressions. |
| 228 | for (Stmt::child_iterator I=S->child_begin(), E=S->child_end(); I!=E; ++I) |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 229 | if (*I && Visit(*I) == Uninitialized) x = Uninitialized; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 230 | |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 231 | return x; |
| 232 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 233 | |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 234 | bool TransferFuncs::Visit(Stmt *S) { |
| 235 | if (AD.isTracked(static_cast<Expr*>(S))) return V(static_cast<Expr*>(S),AD); |
| 236 | else return static_cast<CFGStmtVisitor<TransferFuncs,bool>*>(this)->Visit(S); |
| 237 | } |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 238 | |
| 239 | bool TransferFuncs::BlockStmt_VisitExpr(Expr* E) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 240 | bool x = static_cast<CFGStmtVisitor<TransferFuncs,bool>*>(this)->Visit(E); |
Ted Kremenek | 33d4aab | 2008-01-26 00:03:27 +0000 | [diff] [blame] | 241 | if (AD.isTracked(E)) V(E,AD) = x; |
| 242 | return x; |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 243 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 244 | |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 245 | } // end anonymous namespace |
| 246 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 247 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 248 | // Merge operator. |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 249 | // |
| 250 | // In our transfer functions we take the approach that any |
Nick Lewycky | 5d796aa | 2008-08-16 17:46:53 +0000 | [diff] [blame] | 251 | // combination of uninitialized values, e.g. |
| 252 | // Uninitialized + ___ = Uninitialized. |
Ted Kremenek | 20ee4fb | 2007-09-17 18:31:23 +0000 | [diff] [blame] | 253 | // |
Ted Kremenek | 7deed0c | 2008-04-15 18:35:30 +0000 | [diff] [blame] | 254 | // Merges take the same approach, preferring soundness. At a confluence point, |
| 255 | // if any predecessor has a variable marked uninitialized, the value is |
| 256 | // uninitialized at the confluence point. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 257 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 258 | |
| 259 | namespace { |
Ted Kremenek | 8d798c7 | 2008-11-14 01:14:18 +0000 | [diff] [blame] | 260 | typedef StmtDeclBitVector_Types::Union Merge; |
Ted Kremenek | aead153 | 2007-09-27 18:20:22 +0000 | [diff] [blame] | 261 | typedef DataflowSolver<UninitializedValues,TransferFuncs,Merge> Solver; |
| 262 | } |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 263 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 264 | //===----------------------------------------------------------------------===// |
Nick Lewycky | 5d796aa | 2008-08-16 17:46:53 +0000 | [diff] [blame] | 265 | // Uninitialized values checker. Scan an AST and flag variable uses |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 266 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 267 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 268 | UninitializedValues_ValueTypes::ObserverTy::~ObserverTy() {} |
| 269 | |
| 270 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 271 | class UninitializedValuesChecker |
Ted Kremenek | c2b51d8 | 2008-01-08 18:19:08 +0000 | [diff] [blame] | 272 | : public UninitializedValues::ObserverTy { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 273 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 274 | ASTContext &Ctx; |
| 275 | Diagnostic &Diags; |
Steve Naroff | 248a753 | 2008-04-15 22:42:06 +0000 | [diff] [blame] | 276 | llvm::SmallPtrSet<VarDecl*,10> AlreadyWarned; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 277 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 278 | public: |
| 279 | UninitializedValuesChecker(ASTContext &ctx, Diagnostic &diags) |
| 280 | : Ctx(ctx), Diags(diags) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 281 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 282 | virtual void ObserveDeclRefExpr(UninitializedValues::ValTy& V, |
| 283 | UninitializedValues::AnalysisDataTy& AD, |
Steve Naroff | 248a753 | 2008-04-15 22:42:06 +0000 | [diff] [blame] | 284 | DeclRefExpr* DR, VarDecl* VD) { |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 285 | |
Ted Kremenek | 43a1698 | 2007-09-18 21:43:18 +0000 | [diff] [blame] | 286 | assert ( AD.isTracked(VD) && "Unknown VarDecl."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 287 | |
Ted Kremenek | aead153 | 2007-09-27 18:20:22 +0000 | [diff] [blame] | 288 | if (V(VD,AD) == Uninitialized) |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 289 | if (AlreadyWarned.insert(VD)) |
Ted Kremenek | 9c728dc | 2007-12-12 22:39:36 +0000 | [diff] [blame] | 290 | Diags.Report(Ctx.getFullLoc(DR->getSourceRange().getBegin()), |
| 291 | diag::warn_uninit_val); |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 292 | } |
| 293 | }; |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 294 | } // end anonymous namespace |
| 295 | |
Ted Kremenek | 2bf5514 | 2007-09-17 20:49:30 +0000 | [diff] [blame] | 296 | namespace clang { |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 297 | void CheckUninitializedValues(CFG& cfg, ASTContext &Ctx, Diagnostic &Diags, |
| 298 | bool FullUninitTaint) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 299 | |
Nick Lewycky | 5d796aa | 2008-08-16 17:46:53 +0000 | [diff] [blame] | 300 | // Compute the uninitialized values information. |
Ted Kremenek | 11e7218 | 2007-10-01 20:33:52 +0000 | [diff] [blame] | 301 | UninitializedValues U(cfg); |
Ted Kremenek | a1de8c7 | 2007-09-28 00:09:38 +0000 | [diff] [blame] | 302 | U.getAnalysisData().FullUninitTaint = FullUninitTaint; |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 303 | Solver S(U); |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 304 | S.runOnCFG(cfg); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 305 | |
Ted Kremenek | cd5860c | 2007-09-17 19:59:27 +0000 | [diff] [blame] | 306 | // Scan for DeclRefExprs that use uninitialized values. |
| 307 | UninitializedValuesChecker Observer(Ctx,Diags); |
| 308 | U.getAnalysisData().Observer = &Observer; |
Ted Kremenek | 294a7c9 | 2007-09-18 21:08:21 +0000 | [diff] [blame] | 309 | S.runOnAllBlocks(cfg); |
Ted Kremenek | 13ed7fe | 2007-09-14 22:49:21 +0000 | [diff] [blame] | 310 | } |
Ted Kremenek | 294a7c9 | 2007-09-18 21:08:21 +0000 | [diff] [blame] | 311 | } // end namespace clang |