Ted Kremenek | 6f34213 | 2011-03-15 03:17:07 +0000 | [diff] [blame] | 1 | //==- UninitializedValues.cpp - Find Uninitialized Values -------*- C++ --*-==// |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file implements uninitialized values analysis for source-level CFGs. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 14 | #include <utility> |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 15 | #include "llvm/ADT/Optional.h" |
| 16 | #include "llvm/ADT/SmallVector.h" |
Argyrios Kyrtzidis | 049f6d0 | 2011-05-31 03:56:09 +0000 | [diff] [blame] | 17 | #include "llvm/ADT/PackedVector.h" |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 18 | #include "llvm/ADT/DenseMap.h" |
| 19 | #include "clang/AST/Decl.h" |
| 20 | #include "clang/Analysis/CFG.h" |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 21 | #include "clang/Analysis/AnalysisContext.h" |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 22 | #include "clang/Analysis/Visitors/CFGRecStmtDeclVisitor.h" |
Ted Kremenek | 6f34213 | 2011-03-15 03:17:07 +0000 | [diff] [blame] | 23 | #include "clang/Analysis/Analyses/UninitializedValues.h" |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 24 | #include "clang/Analysis/Support/SaveAndRestore.h" |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 25 | |
| 26 | using namespace clang; |
| 27 | |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 28 | static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) { |
Ted Kremenek | 1cbc315 | 2011-03-17 03:06:11 +0000 | [diff] [blame] | 29 | if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() && |
Ted Kremenek | a21612f | 2011-04-07 20:02:56 +0000 | [diff] [blame] | 30 | !vd->isExceptionVariable() && |
Ted Kremenek | 1cbc315 | 2011-03-17 03:06:11 +0000 | [diff] [blame] | 31 | vd->getDeclContext() == dc) { |
| 32 | QualType ty = vd->getType(); |
| 33 | return ty->isScalarType() || ty->isVectorType(); |
| 34 | } |
| 35 | return false; |
Ted Kremenek | c104e53 | 2011-01-18 04:53:25 +0000 | [diff] [blame] | 36 | } |
| 37 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 38 | //------------------------------------------------------------------------====// |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 39 | // DeclToIndex: a mapping from Decls we track to value indices. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 40 | //====------------------------------------------------------------------------// |
| 41 | |
| 42 | namespace { |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 43 | class DeclToIndex { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 44 | llvm::DenseMap<const VarDecl *, unsigned> map; |
| 45 | public: |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 46 | DeclToIndex() {} |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 47 | |
| 48 | /// Compute the actual mapping from declarations to bits. |
| 49 | void computeMap(const DeclContext &dc); |
| 50 | |
| 51 | /// Return the number of declarations in the map. |
| 52 | unsigned size() const { return map.size(); } |
| 53 | |
| 54 | /// Returns the bit vector index for a given declaration. |
Ted Kremenek | b831c67 | 2011-03-29 01:40:00 +0000 | [diff] [blame] | 55 | llvm::Optional<unsigned> getValueIndex(const VarDecl *d) const; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 56 | }; |
| 57 | } |
| 58 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 59 | void DeclToIndex::computeMap(const DeclContext &dc) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 60 | unsigned count = 0; |
| 61 | DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()), |
| 62 | E(dc.decls_end()); |
| 63 | for ( ; I != E; ++I) { |
| 64 | const VarDecl *vd = *I; |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 65 | if (isTrackedVar(vd, &dc)) |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 66 | map[vd] = count++; |
| 67 | } |
| 68 | } |
| 69 | |
Ted Kremenek | b831c67 | 2011-03-29 01:40:00 +0000 | [diff] [blame] | 70 | llvm::Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const { |
| 71 | llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 72 | if (I == map.end()) |
| 73 | return llvm::Optional<unsigned>(); |
| 74 | return I->second; |
| 75 | } |
| 76 | |
| 77 | //------------------------------------------------------------------------====// |
| 78 | // CFGBlockValues: dataflow values for CFG blocks. |
| 79 | //====------------------------------------------------------------------------// |
| 80 | |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 81 | // These values are defined in such a way that a merge can be done using |
| 82 | // a bitwise OR. |
| 83 | enum Value { Unknown = 0x0, /* 00 */ |
| 84 | Initialized = 0x1, /* 01 */ |
| 85 | Uninitialized = 0x2, /* 10 */ |
| 86 | MayUninitialized = 0x3 /* 11 */ }; |
| 87 | |
| 88 | static bool isUninitialized(const Value v) { |
| 89 | return v >= Uninitialized; |
| 90 | } |
| 91 | static bool isAlwaysUninit(const Value v) { |
| 92 | return v == Uninitialized; |
| 93 | } |
Ted Kremenek | afb10c4 | 2011-03-15 04:57:29 +0000 | [diff] [blame] | 94 | |
Benjamin Kramer | da57f3e | 2011-03-26 12:38:21 +0000 | [diff] [blame] | 95 | namespace { |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 96 | |
Argyrios Kyrtzidis | 049f6d0 | 2011-05-31 03:56:09 +0000 | [diff] [blame] | 97 | typedef llvm::PackedVector<Value, 2> ValueVector; |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 98 | typedef std::pair<ValueVector *, ValueVector *> BVPair; |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 99 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 100 | class CFGBlockValues { |
| 101 | const CFG &cfg; |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 102 | BVPair *vals; |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 103 | ValueVector scratch; |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 104 | DeclToIndex declToIndex; |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 105 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 106 | ValueVector &lazyCreate(ValueVector *&bv); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 107 | public: |
| 108 | CFGBlockValues(const CFG &cfg); |
| 109 | ~CFGBlockValues(); |
| 110 | |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 111 | unsigned getNumEntries() const { return declToIndex.size(); } |
| 112 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 113 | void computeSetOfDeclarations(const DeclContext &dc); |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 114 | ValueVector &getValueVector(const CFGBlock *block, |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 115 | const CFGBlock *dstBlock); |
| 116 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 117 | BVPair &getValueVectors(const CFGBlock *block, bool shouldLazyCreate); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 118 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 119 | void mergeIntoScratch(ValueVector const &source, bool isFirst); |
| 120 | bool updateValueVectorWithScratch(const CFGBlock *block); |
| 121 | bool updateValueVectors(const CFGBlock *block, const BVPair &newVals); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 122 | |
| 123 | bool hasNoDeclarations() const { |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 124 | return declToIndex.size() == 0; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 125 | } |
Ted Kremenek | e0e2933 | 2011-08-20 01:15:28 +0000 | [diff] [blame] | 126 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 127 | void resetScratch(); |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 128 | ValueVector &getScratch() { return scratch; } |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 129 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 130 | ValueVector::reference operator[](const VarDecl *vd); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 131 | }; |
Benjamin Kramer | da57f3e | 2011-03-26 12:38:21 +0000 | [diff] [blame] | 132 | } // end anonymous namespace |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 133 | |
| 134 | CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) { |
| 135 | unsigned n = cfg.getNumBlockIDs(); |
| 136 | if (!n) |
| 137 | return; |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 138 | vals = new std::pair<ValueVector*, ValueVector*>[n]; |
Chandler Carruth | 75c4064 | 2011-04-28 08:19:45 +0000 | [diff] [blame] | 139 | memset((void*)vals, 0, sizeof(*vals) * n); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 140 | } |
| 141 | |
| 142 | CFGBlockValues::~CFGBlockValues() { |
| 143 | unsigned n = cfg.getNumBlockIDs(); |
| 144 | if (n == 0) |
| 145 | return; |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 146 | for (unsigned i = 0; i < n; ++i) { |
| 147 | delete vals[i].first; |
| 148 | delete vals[i].second; |
| 149 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 150 | delete [] vals; |
| 151 | } |
| 152 | |
| 153 | void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) { |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 154 | declToIndex.computeMap(dc); |
| 155 | scratch.resize(declToIndex.size()); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 156 | } |
| 157 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 158 | ValueVector &CFGBlockValues::lazyCreate(ValueVector *&bv) { |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 159 | if (!bv) |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 160 | bv = new ValueVector(declToIndex.size()); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 161 | return *bv; |
| 162 | } |
| 163 | |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 164 | /// This function pattern matches for a '&&' or '||' that appears at |
| 165 | /// the beginning of a CFGBlock that also (1) has a terminator and |
| 166 | /// (2) has no other elements. If such an expression is found, it is returned. |
Ted Kremenek | f1d10d9 | 2011-08-23 23:05:04 +0000 | [diff] [blame] | 167 | static const BinaryOperator *getLogicalOperatorInChain(const CFGBlock *block) { |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 168 | if (block->empty()) |
| 169 | return 0; |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 170 | |
Ted Kremenek | 3c0349e | 2011-03-01 03:15:10 +0000 | [diff] [blame] | 171 | const CFGStmt *cstmt = block->front().getAs<CFGStmt>(); |
Ted Kremenek | 76709bf | 2011-03-15 05:22:28 +0000 | [diff] [blame] | 172 | if (!cstmt) |
| 173 | return 0; |
| 174 | |
Ted Kremenek | f1d10d9 | 2011-08-23 23:05:04 +0000 | [diff] [blame] | 175 | const BinaryOperator *b = dyn_cast_or_null<BinaryOperator>(cstmt->getStmt()); |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 176 | |
| 177 | if (!b || !b->isLogicalOp()) |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 178 | return 0; |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 179 | |
Ted Kremenek | e6c2803 | 2011-05-10 22:10:35 +0000 | [diff] [blame] | 180 | if (block->pred_size() == 2) { |
| 181 | if (block->getTerminatorCondition() == b) { |
| 182 | if (block->succ_size() == 2) |
| 183 | return b; |
| 184 | } |
| 185 | else if (block->size() == 1) |
| 186 | return b; |
| 187 | } |
| 188 | |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 189 | return 0; |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 190 | } |
| 191 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 192 | ValueVector &CFGBlockValues::getValueVector(const CFGBlock *block, |
| 193 | const CFGBlock *dstBlock) { |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 194 | unsigned idx = block->getBlockID(); |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 195 | if (dstBlock && getLogicalOperatorInChain(block)) { |
| 196 | if (*block->succ_begin() == dstBlock) |
| 197 | return lazyCreate(vals[idx].first); |
| 198 | assert(*(block->succ_begin()+1) == dstBlock); |
| 199 | return lazyCreate(vals[idx].second); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 200 | } |
| 201 | |
| 202 | assert(vals[idx].second == 0); |
| 203 | return lazyCreate(vals[idx].first); |
| 204 | } |
| 205 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 206 | BVPair &CFGBlockValues::getValueVectors(const clang::CFGBlock *block, |
| 207 | bool shouldLazyCreate) { |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 208 | unsigned idx = block->getBlockID(); |
| 209 | lazyCreate(vals[idx].first); |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 210 | if (shouldLazyCreate) |
| 211 | lazyCreate(vals[idx].second); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 212 | return vals[idx]; |
| 213 | } |
| 214 | |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 215 | #if 0 |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 216 | static void printVector(const CFGBlock *block, ValueVector &bv, |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 217 | unsigned num) { |
| 218 | |
| 219 | llvm::errs() << block->getBlockID() << " :"; |
| 220 | for (unsigned i = 0; i < bv.size(); ++i) { |
| 221 | llvm::errs() << ' ' << bv[i]; |
| 222 | } |
| 223 | llvm::errs() << " : " << num << '\n'; |
| 224 | } |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 225 | |
| 226 | static void printVector(const char *name, ValueVector const &bv) { |
| 227 | llvm::errs() << name << " : "; |
| 228 | for (unsigned i = 0; i < bv.size(); ++i) { |
| 229 | llvm::errs() << ' ' << bv[i]; |
| 230 | } |
| 231 | llvm::errs() << "\n"; |
| 232 | } |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 233 | #endif |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 234 | |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 235 | void CFGBlockValues::mergeIntoScratch(ValueVector const &source, |
| 236 | bool isFirst) { |
| 237 | if (isFirst) |
| 238 | scratch = source; |
| 239 | else |
| 240 | scratch |= source; |
| 241 | } |
| 242 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 243 | bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) { |
| 244 | ValueVector &dst = getValueVector(block, 0); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 245 | bool changed = (dst != scratch); |
| 246 | if (changed) |
| 247 | dst = scratch; |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 248 | #if 0 |
| 249 | printVector(block, scratch, 0); |
| 250 | #endif |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 251 | return changed; |
| 252 | } |
| 253 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 254 | bool CFGBlockValues::updateValueVectors(const CFGBlock *block, |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 255 | const BVPair &newVals) { |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 256 | BVPair &vals = getValueVectors(block, true); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 257 | bool changed = *newVals.first != *vals.first || |
| 258 | *newVals.second != *vals.second; |
| 259 | *vals.first = *newVals.first; |
| 260 | *vals.second = *newVals.second; |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 261 | #if 0 |
| 262 | printVector(block, *vals.first, 1); |
| 263 | printVector(block, *vals.second, 2); |
| 264 | #endif |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 265 | return changed; |
| 266 | } |
| 267 | |
| 268 | void CFGBlockValues::resetScratch() { |
| 269 | scratch.reset(); |
| 270 | } |
| 271 | |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 272 | ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) { |
Ted Kremenek | 4ddb387 | 2011-03-15 05:30:12 +0000 | [diff] [blame] | 273 | const llvm::Optional<unsigned> &idx = declToIndex.getValueIndex(vd); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 274 | assert(idx.hasValue()); |
| 275 | return scratch[idx.getValue()]; |
| 276 | } |
| 277 | |
| 278 | //------------------------------------------------------------------------====// |
| 279 | // Worklist: worklist for dataflow analysis. |
| 280 | //====------------------------------------------------------------------------// |
| 281 | |
| 282 | namespace { |
| 283 | class DataflowWorklist { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 284 | SmallVector<const CFGBlock *, 20> worklist; |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 285 | llvm::BitVector enqueuedBlocks; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 286 | public: |
| 287 | DataflowWorklist(const CFG &cfg) : enqueuedBlocks(cfg.getNumBlockIDs()) {} |
| 288 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 289 | void enqueueSuccessors(const CFGBlock *block); |
| 290 | const CFGBlock *dequeue(); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 291 | }; |
| 292 | } |
| 293 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 294 | void DataflowWorklist::enqueueSuccessors(const clang::CFGBlock *block) { |
Chandler Carruth | 8052050 | 2011-07-08 11:19:06 +0000 | [diff] [blame] | 295 | unsigned OldWorklistSize = worklist.size(); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 296 | for (CFGBlock::const_succ_iterator I = block->succ_begin(), |
| 297 | E = block->succ_end(); I != E; ++I) { |
Chandler Carruth | 8052050 | 2011-07-08 11:19:06 +0000 | [diff] [blame] | 298 | const CFGBlock *Successor = *I; |
| 299 | if (!Successor || enqueuedBlocks[Successor->getBlockID()]) |
| 300 | continue; |
| 301 | worklist.push_back(Successor); |
| 302 | enqueuedBlocks[Successor->getBlockID()] = true; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 303 | } |
Chandler Carruth | 8052050 | 2011-07-08 11:19:06 +0000 | [diff] [blame] | 304 | if (OldWorklistSize == 0 || OldWorklistSize == worklist.size()) |
| 305 | return; |
| 306 | |
| 307 | // Rotate the newly added blocks to the start of the worklist so that it forms |
| 308 | // a proper queue when we pop off the end of the worklist. |
| 309 | std::rotate(worklist.begin(), worklist.begin() + OldWorklistSize, |
| 310 | worklist.end()); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 311 | } |
| 312 | |
| 313 | const CFGBlock *DataflowWorklist::dequeue() { |
| 314 | if (worklist.empty()) |
| 315 | return 0; |
| 316 | const CFGBlock *b = worklist.back(); |
| 317 | worklist.pop_back(); |
| 318 | enqueuedBlocks[b->getBlockID()] = false; |
| 319 | return b; |
| 320 | } |
| 321 | |
| 322 | //------------------------------------------------------------------------====// |
| 323 | // Transfer function for uninitialized values analysis. |
| 324 | //====------------------------------------------------------------------------// |
| 325 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 326 | namespace { |
| 327 | class FindVarResult { |
| 328 | const VarDecl *vd; |
| 329 | const DeclRefExpr *dr; |
| 330 | public: |
| 331 | FindVarResult(VarDecl *vd, DeclRefExpr *dr) : vd(vd), dr(dr) {} |
| 332 | |
| 333 | const DeclRefExpr *getDeclRefExpr() const { return dr; } |
| 334 | const VarDecl *getDecl() const { return vd; } |
| 335 | }; |
| 336 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 337 | class TransferFunctions : public StmtVisitor<TransferFunctions> { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 338 | CFGBlockValues &vals; |
| 339 | const CFG &cfg; |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 340 | AnalysisDeclContext ∾ |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 341 | UninitVariablesHandler *handler; |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 342 | |
| 343 | /// The last DeclRefExpr seen when analyzing a block. Used to |
| 344 | /// cheat when detecting cases when the address of a variable is taken. |
| 345 | DeclRefExpr *lastDR; |
| 346 | |
| 347 | /// The last lvalue-to-rvalue conversion of a variable whose value |
| 348 | /// was uninitialized. Normally this results in a warning, but it is |
| 349 | /// possible to either silence the warning in some cases, or we |
| 350 | /// propagate the uninitialized value. |
| 351 | CastExpr *lastLoad; |
Ted Kremenek | 57fb591 | 2011-08-04 22:40:57 +0000 | [diff] [blame] | 352 | |
| 353 | /// For some expressions, we want to ignore any post-processing after |
| 354 | /// visitation. |
| 355 | bool skipProcessUses; |
| 356 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 357 | public: |
| 358 | TransferFunctions(CFGBlockValues &vals, const CFG &cfg, |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 359 | AnalysisDeclContext &ac, |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 360 | UninitVariablesHandler *handler) |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 361 | : vals(vals), cfg(cfg), ac(ac), handler(handler), |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 362 | lastDR(0), lastLoad(0), |
Ted Kremenek | 57fb591 | 2011-08-04 22:40:57 +0000 | [diff] [blame] | 363 | skipProcessUses(false) {} |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 364 | |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 365 | void reportUninit(const DeclRefExpr *ex, const VarDecl *vd, |
| 366 | bool isAlwaysUninit); |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 367 | |
| 368 | void VisitBlockExpr(BlockExpr *be); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 369 | void VisitDeclStmt(DeclStmt *ds); |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 370 | void VisitDeclRefExpr(DeclRefExpr *dr); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 371 | void VisitUnaryOperator(UnaryOperator *uo); |
| 372 | void VisitBinaryOperator(BinaryOperator *bo); |
| 373 | void VisitCastExpr(CastExpr *ce); |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 374 | void VisitObjCForCollectionStmt(ObjCForCollectionStmt *fs); |
| 375 | void Visit(Stmt *s); |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 376 | |
| 377 | bool isTrackedVar(const VarDecl *vd) { |
| 378 | return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl())); |
| 379 | } |
| 380 | |
| 381 | FindVarResult findBlockVarDecl(Expr *ex); |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 382 | |
| 383 | void ProcessUses(Stmt *s = 0); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 384 | }; |
| 385 | } |
| 386 | |
Ted Kremenek | de091ae | 2011-08-08 21:43:08 +0000 | [diff] [blame] | 387 | static const Expr *stripCasts(ASTContext &C, const Expr *Ex) { |
| 388 | while (Ex) { |
| 389 | Ex = Ex->IgnoreParenNoopCasts(C); |
| 390 | if (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { |
| 391 | if (CE->getCastKind() == CK_LValueBitCast) { |
| 392 | Ex = CE->getSubExpr(); |
| 393 | continue; |
| 394 | } |
| 395 | } |
| 396 | break; |
| 397 | } |
| 398 | return Ex; |
| 399 | } |
| 400 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 401 | void TransferFunctions::reportUninit(const DeclRefExpr *ex, |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 402 | const VarDecl *vd, bool isAlwaysUnit) { |
| 403 | if (handler) handler->handleUseOfUninitVariable(ex, vd, isAlwaysUnit); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 404 | } |
| 405 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 406 | FindVarResult TransferFunctions::findBlockVarDecl(Expr *ex) { |
| 407 | if (DeclRefExpr *dr = dyn_cast<DeclRefExpr>(ex->IgnoreParenCasts())) |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 408 | if (VarDecl *vd = dyn_cast<VarDecl>(dr->getDecl())) |
| 409 | if (isTrackedVar(vd)) |
Ted Kremenek | 40900ee | 2011-01-27 02:29:34 +0000 | [diff] [blame] | 410 | return FindVarResult(vd, dr); |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 411 | return FindVarResult(0, 0); |
| 412 | } |
| 413 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 414 | void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *fs) { |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 415 | // This represents an initialization of the 'element' value. |
| 416 | Stmt *element = fs->getElement(); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 417 | const VarDecl *vd = 0; |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 418 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 419 | if (DeclStmt *ds = dyn_cast<DeclStmt>(element)) { |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 420 | vd = cast<VarDecl>(ds->getSingleDecl()); |
| 421 | if (!isTrackedVar(vd)) |
| 422 | vd = 0; |
Chad Rosier | 3060178 | 2011-08-17 23:08:45 +0000 | [diff] [blame] | 423 | } else { |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 424 | // Initialize the value of the reference variable. |
| 425 | const FindVarResult &res = findBlockVarDecl(cast<Expr>(element)); |
| 426 | vd = res.getDecl(); |
Ted Kremenek | 1ea800c | 2011-01-27 02:01:31 +0000 | [diff] [blame] | 427 | } |
| 428 | |
| 429 | if (vd) |
| 430 | vals[vd] = Initialized; |
| 431 | } |
| 432 | |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 433 | void TransferFunctions::VisitBlockExpr(BlockExpr *be) { |
Ted Kremenek | bc8b44c | 2011-03-31 22:32:41 +0000 | [diff] [blame] | 434 | const BlockDecl *bd = be->getBlockDecl(); |
| 435 | for (BlockDecl::capture_const_iterator i = bd->capture_begin(), |
| 436 | e = bd->capture_end() ; i != e; ++i) { |
| 437 | const VarDecl *vd = i->getVariable(); |
Ted Kremenek | bc8b44c | 2011-03-31 22:32:41 +0000 | [diff] [blame] | 438 | if (!isTrackedVar(vd)) |
| 439 | continue; |
| 440 | if (i->isByRef()) { |
| 441 | vals[vd] = Initialized; |
| 442 | continue; |
| 443 | } |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 444 | Value v = vals[vd]; |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 445 | if (handler && isUninitialized(v)) |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 446 | handler->handleUseOfUninitVariable(be, vd, isAlwaysUninit(v)); |
Ted Kremenek | a8c17a5 | 2011-01-25 19:13:48 +0000 | [diff] [blame] | 447 | } |
| 448 | } |
| 449 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 450 | void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) { |
| 451 | // Record the last DeclRefExpr seen. This is an lvalue computation. |
| 452 | // We use this value to later detect if a variable "escapes" the analysis. |
| 453 | if (const VarDecl *vd = dyn_cast<VarDecl>(dr->getDecl())) |
Ted Kremenek | dd4286b | 2011-07-20 19:49:47 +0000 | [diff] [blame] | 454 | if (isTrackedVar(vd)) { |
| 455 | ProcessUses(); |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 456 | lastDR = dr; |
Ted Kremenek | dd4286b | 2011-07-20 19:49:47 +0000 | [diff] [blame] | 457 | } |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 458 | } |
| 459 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 460 | void TransferFunctions::VisitDeclStmt(DeclStmt *ds) { |
| 461 | for (DeclStmt::decl_iterator DI = ds->decl_begin(), DE = ds->decl_end(); |
| 462 | DI != DE; ++DI) { |
| 463 | if (VarDecl *vd = dyn_cast<VarDecl>(*DI)) { |
Ted Kremenek | 4dccb90 | 2011-01-18 05:00:42 +0000 | [diff] [blame] | 464 | if (isTrackedVar(vd)) { |
Chandler Carruth | b88fb02 | 2011-04-05 21:36:30 +0000 | [diff] [blame] | 465 | if (Expr *init = vd->getInit()) { |
Chandler Carruth | b88fb02 | 2011-04-05 21:36:30 +0000 | [diff] [blame] | 466 | // If the initializer consists solely of a reference to itself, we |
| 467 | // explicitly mark the variable as uninitialized. This allows code |
| 468 | // like the following: |
| 469 | // |
| 470 | // int x = x; |
| 471 | // |
| 472 | // to deliberately leave a variable uninitialized. Different analysis |
| 473 | // clients can detect this pattern and adjust their reporting |
| 474 | // appropriately, but we need to continue to analyze subsequent uses |
| 475 | // of the variable. |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 476 | if (init == lastLoad) { |
Ted Kremenek | de091ae | 2011-08-08 21:43:08 +0000 | [diff] [blame] | 477 | const DeclRefExpr *DR |
| 478 | = cast<DeclRefExpr>(stripCasts(ac.getASTContext(), |
| 479 | lastLoad->getSubExpr())); |
Ted Kremenek | 62d126e | 2011-07-19 21:41:51 +0000 | [diff] [blame] | 480 | if (DR->getDecl() == vd) { |
| 481 | // int x = x; |
| 482 | // Propagate uninitialized value, but don't immediately report |
| 483 | // a problem. |
| 484 | vals[vd] = Uninitialized; |
| 485 | lastLoad = 0; |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 486 | lastDR = 0; |
Ted Kremenek | 9e76172 | 2011-10-13 18:50:06 +0000 | [diff] [blame] | 487 | if (handler) |
| 488 | handler->handleSelfInit(vd); |
Ted Kremenek | 62d126e | 2011-07-19 21:41:51 +0000 | [diff] [blame] | 489 | return; |
| 490 | } |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 491 | } |
Ted Kremenek | 62d126e | 2011-07-19 21:41:51 +0000 | [diff] [blame] | 492 | |
| 493 | // All other cases: treat the new variable as initialized. |
Ted Kremenek | 9e76172 | 2011-10-13 18:50:06 +0000 | [diff] [blame] | 494 | // This is a minor optimization to reduce the propagation |
| 495 | // of the analysis, since we will have already reported |
| 496 | // the use of the uninitialized value (which visiting the |
| 497 | // initializer). |
Ted Kremenek | 62d126e | 2011-07-19 21:41:51 +0000 | [diff] [blame] | 498 | vals[vd] = Initialized; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 499 | } |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 500 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 501 | } |
| 502 | } |
| 503 | } |
| 504 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 505 | void TransferFunctions::VisitBinaryOperator(clang::BinaryOperator *bo) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 506 | if (bo->isAssignmentOp()) { |
| 507 | const FindVarResult &res = findBlockVarDecl(bo->getLHS()); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 508 | if (const VarDecl *vd = res.getDecl()) { |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 509 | ValueVector::reference val = vals[vd]; |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 510 | if (isUninitialized(val)) { |
Chandler Carruth | 8435069 | 2011-07-16 22:27:02 +0000 | [diff] [blame] | 511 | if (bo->getOpcode() != BO_Assign) |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 512 | reportUninit(res.getDeclRefExpr(), vd, isAlwaysUninit(val)); |
Chandler Carruth | d837c0d | 2011-07-22 05:27:52 +0000 | [diff] [blame] | 513 | else |
| 514 | val = Initialized; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 515 | } |
| 516 | } |
| 517 | } |
| 518 | } |
| 519 | |
| 520 | void TransferFunctions::VisitUnaryOperator(clang::UnaryOperator *uo) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 521 | switch (uo->getOpcode()) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 522 | case clang::UO_PostDec: |
| 523 | case clang::UO_PostInc: |
| 524 | case clang::UO_PreDec: |
| 525 | case clang::UO_PreInc: { |
| 526 | const FindVarResult &res = findBlockVarDecl(uo->getSubExpr()); |
| 527 | if (const VarDecl *vd = res.getDecl()) { |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 528 | assert(res.getDeclRefExpr() == lastDR); |
| 529 | // We null out lastDR to indicate we have fully processed it |
| 530 | // and we don't want the auto-value setting in Visit(). |
| 531 | lastDR = 0; |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 532 | |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 533 | ValueVector::reference val = vals[vd]; |
Chandler Carruth | d837c0d | 2011-07-22 05:27:52 +0000 | [diff] [blame] | 534 | if (isUninitialized(val)) |
Ted Kremenek | f7bafc7 | 2011-03-15 04:57:38 +0000 | [diff] [blame] | 535 | reportUninit(res.getDeclRefExpr(), vd, isAlwaysUninit(val)); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 536 | } |
| 537 | break; |
| 538 | } |
| 539 | default: |
| 540 | break; |
| 541 | } |
| 542 | } |
| 543 | |
| 544 | void TransferFunctions::VisitCastExpr(clang::CastExpr *ce) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 545 | if (ce->getCastKind() == CK_LValueToRValue) { |
| 546 | const FindVarResult &res = findBlockVarDecl(ce->getSubExpr()); |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 547 | if (res.getDecl()) { |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 548 | assert(res.getDeclRefExpr() == lastDR); |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 549 | lastLoad = ce; |
Ted Kremenek | c21fed3 | 2011-01-18 21:18:58 +0000 | [diff] [blame] | 550 | } |
Ted Kremenek | dd0f794 | 2011-01-26 04:49:43 +0000 | [diff] [blame] | 551 | } |
Ted Kremenek | de091ae | 2011-08-08 21:43:08 +0000 | [diff] [blame] | 552 | else if (ce->getCastKind() == CK_NoOp || |
| 553 | ce->getCastKind() == CK_LValueBitCast) { |
Ted Kremenek | 57fb591 | 2011-08-04 22:40:57 +0000 | [diff] [blame] | 554 | skipProcessUses = true; |
| 555 | } |
Ted Kremenek | dd0f794 | 2011-01-26 04:49:43 +0000 | [diff] [blame] | 556 | else if (CStyleCastExpr *cse = dyn_cast<CStyleCastExpr>(ce)) { |
| 557 | if (cse->getType()->isVoidType()) { |
| 558 | // e.g. (void) x; |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 559 | if (lastLoad == cse->getSubExpr()) { |
| 560 | // Squelch any detected load of an uninitialized value if |
| 561 | // we cast it to void. |
| 562 | lastLoad = 0; |
| 563 | lastDR = 0; |
| 564 | } |
| 565 | } |
| 566 | } |
| 567 | } |
| 568 | |
| 569 | void TransferFunctions::Visit(clang::Stmt *s) { |
Ted Kremenek | 57fb591 | 2011-08-04 22:40:57 +0000 | [diff] [blame] | 570 | skipProcessUses = false; |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 571 | StmtVisitor<TransferFunctions>::Visit(s); |
Ted Kremenek | 57fb591 | 2011-08-04 22:40:57 +0000 | [diff] [blame] | 572 | if (!skipProcessUses) |
| 573 | ProcessUses(s); |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 574 | } |
| 575 | |
| 576 | void TransferFunctions::ProcessUses(Stmt *s) { |
| 577 | // This method is typically called after visiting a CFGElement statement |
| 578 | // in the CFG. We delay processing of reporting many loads of uninitialized |
| 579 | // values until here. |
| 580 | if (lastLoad) { |
| 581 | // If we just visited the lvalue-to-rvalue cast, there is nothing |
| 582 | // left to do. |
| 583 | if (lastLoad == s) |
| 584 | return; |
| 585 | |
Ted Kremenek | de091ae | 2011-08-08 21:43:08 +0000 | [diff] [blame] | 586 | const DeclRefExpr *DR = |
| 587 | cast<DeclRefExpr>(stripCasts(ac.getASTContext(), |
| 588 | lastLoad->getSubExpr())); |
| 589 | const VarDecl *VD = cast<VarDecl>(DR->getDecl()); |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 590 | |
| 591 | // If we reach here, we may have seen a load of an uninitialized value |
| 592 | // and it hasn't been casted to void or otherwise handled. In this |
| 593 | // situation, report the incident. |
| 594 | if (isUninitialized(vals[VD])) |
| 595 | reportUninit(DR, VD, isAlwaysUninit(vals[VD])); |
| 596 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 597 | lastLoad = 0; |
Ted Kremenek | c5f740e | 2011-10-07 00:42:48 +0000 | [diff] [blame] | 598 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 599 | if (DR == lastDR) { |
| 600 | lastDR = 0; |
Ted Kremenek | dd0f794 | 2011-01-26 04:49:43 +0000 | [diff] [blame] | 601 | return; |
| 602 | } |
| 603 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 604 | |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 605 | // Any other uses of 'lastDR' involve taking an lvalue of variable. |
| 606 | // In this case, it "escapes" the analysis. |
| 607 | if (lastDR && lastDR != s) { |
| 608 | vals[cast<VarDecl>(lastDR->getDecl())] = Initialized; |
| 609 | lastDR = 0; |
Chandler Carruth | 8668494 | 2011-04-13 08:18:42 +0000 | [diff] [blame] | 610 | } |
| 611 | } |
| 612 | |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 613 | //------------------------------------------------------------------------====// |
| 614 | // High-level "driver" logic for uninitialized values analysis. |
| 615 | //====------------------------------------------------------------------------// |
| 616 | |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 617 | static bool runOnBlock(const CFGBlock *block, const CFG &cfg, |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 618 | AnalysisDeclContext &ac, CFGBlockValues &vals, |
Ted Kremenek | f8adeef | 2011-04-04 20:30:58 +0000 | [diff] [blame] | 619 | llvm::BitVector &wasAnalyzed, |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 620 | UninitVariablesHandler *handler = 0) { |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 621 | |
Ted Kremenek | f8adeef | 2011-04-04 20:30:58 +0000 | [diff] [blame] | 622 | wasAnalyzed[block->getBlockID()] = true; |
| 623 | |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 624 | if (const BinaryOperator *b = getLogicalOperatorInChain(block)) { |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 625 | CFGBlock::const_pred_iterator itr = block->pred_begin(); |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 626 | BVPair vA = vals.getValueVectors(*itr, false); |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 627 | ++itr; |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 628 | BVPair vB = vals.getValueVectors(*itr, false); |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 629 | |
| 630 | BVPair valsAB; |
| 631 | |
| 632 | if (b->getOpcode() == BO_LAnd) { |
| 633 | // Merge the 'F' bits from the first and second. |
| 634 | vals.mergeIntoScratch(*(vA.second ? vA.second : vA.first), true); |
| 635 | vals.mergeIntoScratch(*(vB.second ? vB.second : vB.first), false); |
| 636 | valsAB.first = vA.first; |
Ted Kremenek | 2d4bed1 | 2011-01-20 21:25:31 +0000 | [diff] [blame] | 637 | valsAB.second = &vals.getScratch(); |
Chad Rosier | 3060178 | 2011-08-17 23:08:45 +0000 | [diff] [blame] | 638 | } else { |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 639 | // Merge the 'T' bits from the first and second. |
| 640 | assert(b->getOpcode() == BO_LOr); |
| 641 | vals.mergeIntoScratch(*vA.first, true); |
| 642 | vals.mergeIntoScratch(*vB.first, false); |
| 643 | valsAB.first = &vals.getScratch(); |
| 644 | valsAB.second = vA.second ? vA.second : vA.first; |
| 645 | } |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 646 | return vals.updateValueVectors(block, valsAB); |
Ted Kremenek | 13bd423 | 2011-01-20 17:37:17 +0000 | [diff] [blame] | 647 | } |
| 648 | |
Ted Kremenek | 9fcbcee | 2011-02-01 17:43:18 +0000 | [diff] [blame] | 649 | // Default behavior: merge in values of predecessor blocks. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 650 | vals.resetScratch(); |
| 651 | bool isFirst = true; |
| 652 | for (CFGBlock::const_pred_iterator I = block->pred_begin(), |
| 653 | E = block->pred_end(); I != E; ++I) { |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 654 | const CFGBlock *pred = *I; |
| 655 | if (wasAnalyzed[pred->getBlockID()]) { |
| 656 | vals.mergeIntoScratch(vals.getValueVector(pred, block), isFirst); |
| 657 | isFirst = false; |
| 658 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 659 | } |
| 660 | // Apply the transfer function. |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 661 | TransferFunctions tf(vals, cfg, ac, handler); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 662 | for (CFGBlock::const_iterator I = block->begin(), E = block->end(); |
| 663 | I != E; ++I) { |
| 664 | if (const CFGStmt *cs = dyn_cast<CFGStmt>(&*I)) { |
Ted Kremenek | f1d10d9 | 2011-08-23 23:05:04 +0000 | [diff] [blame] | 665 | tf.Visit(const_cast<Stmt*>(cs->getStmt())); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 666 | } |
| 667 | } |
Ted Kremenek | 0c8e5a0 | 2011-07-19 14:18:48 +0000 | [diff] [blame] | 668 | tf.ProcessUses(); |
Ted Kremenek | 136f8f2 | 2011-03-15 04:57:27 +0000 | [diff] [blame] | 669 | return vals.updateValueVectorWithScratch(block); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 670 | } |
| 671 | |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 672 | void clang::runUninitializedVariablesAnalysis( |
| 673 | const DeclContext &dc, |
| 674 | const CFG &cfg, |
Ted Kremenek | 1d26f48 | 2011-10-24 01:32:45 +0000 | [diff] [blame] | 675 | AnalysisDeclContext &ac, |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 676 | UninitVariablesHandler &handler, |
| 677 | UninitVariablesAnalysisStats &stats) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 678 | CFGBlockValues vals(cfg); |
| 679 | vals.computeSetOfDeclarations(dc); |
| 680 | if (vals.hasNoDeclarations()) |
| 681 | return; |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 682 | |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 683 | stats.NumVariablesAnalyzed = vals.getNumEntries(); |
| 684 | |
Ted Kremenek | d40066b | 2011-04-04 23:29:12 +0000 | [diff] [blame] | 685 | // Mark all variables uninitialized at the entry. |
| 686 | const CFGBlock &entry = cfg.getEntry(); |
| 687 | for (CFGBlock::const_succ_iterator i = entry.succ_begin(), |
| 688 | e = entry.succ_end(); i != e; ++i) { |
| 689 | if (const CFGBlock *succ = *i) { |
| 690 | ValueVector &vec = vals.getValueVector(&entry, succ); |
| 691 | const unsigned n = vals.getNumEntries(); |
| 692 | for (unsigned j = 0; j < n ; ++j) { |
| 693 | vec[j] = Uninitialized; |
| 694 | } |
| 695 | } |
| 696 | } |
| 697 | |
| 698 | // Proceed with the workist. |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 699 | DataflowWorklist worklist(cfg); |
Ted Kremenek | 496398d | 2011-03-15 04:57:32 +0000 | [diff] [blame] | 700 | llvm::BitVector previouslyVisited(cfg.getNumBlockIDs()); |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 701 | worklist.enqueueSuccessors(&cfg.getEntry()); |
Ted Kremenek | f8adeef | 2011-04-04 20:30:58 +0000 | [diff] [blame] | 702 | llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false); |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 703 | wasAnalyzed[cfg.getEntry().getBlockID()] = true; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 704 | |
| 705 | while (const CFGBlock *block = worklist.dequeue()) { |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 706 | // Did the block change? |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 707 | bool changed = runOnBlock(block, cfg, ac, vals, wasAnalyzed); |
| 708 | ++stats.NumBlockVisits; |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 709 | if (changed || !previouslyVisited[block->getBlockID()]) |
| 710 | worklist.enqueueSuccessors(block); |
| 711 | previouslyVisited[block->getBlockID()] = true; |
| 712 | } |
| 713 | |
| 714 | // Run through the blocks one more time, and report uninitialized variabes. |
| 715 | for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) { |
Ted Kremenek | 6f27542 | 2011-09-02 19:39:26 +0000 | [diff] [blame] | 716 | const CFGBlock *block = *BI; |
| 717 | if (wasAnalyzed[block->getBlockID()]) { |
| 718 | runOnBlock(block, cfg, ac, vals, wasAnalyzed, &handler); |
Chandler Carruth | 5d98994 | 2011-07-06 16:21:37 +0000 | [diff] [blame] | 719 | ++stats.NumBlockVisits; |
| 720 | } |
Ted Kremenek | 610068c | 2011-01-15 02:58:47 +0000 | [diff] [blame] | 721 | } |
| 722 | } |
| 723 | |
| 724 | UninitVariablesHandler::~UninitVariablesHandler() {} |