blob: 5db7038405c3f52a1d8629ffa4ec3269db9febe4 [file] [log] [blame]
Chris Lattner59907c42007-08-10 20:18:51 +00001//===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
2//
3// The LLVM Compiler Infrastructure
4//
Chris Lattner0bc735f2007-12-29 19:59:25 +00005// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
Chris Lattner59907c42007-08-10 20:18:51 +00007//
8//===----------------------------------------------------------------------===//
9//
Mike Stump1eb44332009-09-09 15:08:12 +000010// This file implements extra semantic analysis beyond what is enforced
Chris Lattner59907c42007-08-10 20:18:51 +000011// by the C type system.
12//
13//===----------------------------------------------------------------------===//
14
15#include "Sema.h"
Mike Stumpf8c49212010-01-21 03:59:47 +000016#include "clang/Analysis/CFG.h"
Ted Kremenek1309f9a2010-01-25 04:41:41 +000017#include "clang/Analysis/AnalysisContext.h"
Ted Kremeneke0e53132010-01-28 23:39:18 +000018#include "clang/Analysis/Analyses/PrintfFormatString.h"
Chris Lattner59907c42007-08-10 20:18:51 +000019#include "clang/AST/ASTContext.h"
Ken Dyck199c3d62010-01-11 17:06:35 +000020#include "clang/AST/CharUnits.h"
Daniel Dunbarc4a1dea2008-08-11 05:35:13 +000021#include "clang/AST/DeclObjC.h"
Ted Kremenek23245122007-08-20 16:18:38 +000022#include "clang/AST/ExprCXX.h"
Ted Kremenek7ff22b22008-06-16 18:00:42 +000023#include "clang/AST/ExprObjC.h"
Mike Stumpf8c49212010-01-21 03:59:47 +000024#include "clang/AST/DeclObjC.h"
25#include "clang/AST/StmtCXX.h"
26#include "clang/AST/StmtObjC.h"
Chris Lattner719e6152009-02-18 19:21:10 +000027#include "clang/Lex/LiteralSupport.h"
Chris Lattner59907c42007-08-10 20:18:51 +000028#include "clang/Lex/Preprocessor.h"
Mike Stumpf8c49212010-01-21 03:59:47 +000029#include "llvm/ADT/BitVector.h"
30#include "llvm/ADT/STLExtras.h"
Zhongxing Xua1f3dba2009-05-20 01:55:10 +000031#include <limits>
Mike Stumpf8c49212010-01-21 03:59:47 +000032#include <queue>
Chris Lattner59907c42007-08-10 20:18:51 +000033using namespace clang;
34
Chris Lattner60800082009-02-18 17:49:48 +000035/// getLocationOfStringLiteralByte - Return a source location that points to the
36/// specified byte of the specified string literal.
37///
38/// Strings are amazingly complex. They can be formed from multiple tokens and
39/// can have escape sequences in them in addition to the usual trigraph and
40/// escaped newline business. This routine handles this complexity.
41///
42SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
43 unsigned ByteNo) const {
44 assert(!SL->isWide() && "This doesn't work for wide strings yet");
Mike Stump1eb44332009-09-09 15:08:12 +000045
Chris Lattner60800082009-02-18 17:49:48 +000046 // Loop over all of the tokens in this string until we find the one that
47 // contains the byte we're looking for.
48 unsigned TokNo = 0;
49 while (1) {
50 assert(TokNo < SL->getNumConcatenated() && "Invalid byte number!");
51 SourceLocation StrTokLoc = SL->getStrTokenLoc(TokNo);
Mike Stump1eb44332009-09-09 15:08:12 +000052
Chris Lattner60800082009-02-18 17:49:48 +000053 // Get the spelling of the string so that we can get the data that makes up
54 // the string literal, not the identifier for the macro it is potentially
55 // expanded through.
56 SourceLocation StrTokSpellingLoc = SourceMgr.getSpellingLoc(StrTokLoc);
57
58 // Re-lex the token to get its length and original spelling.
59 std::pair<FileID, unsigned> LocInfo =
60 SourceMgr.getDecomposedLoc(StrTokSpellingLoc);
61 std::pair<const char *,const char *> Buffer =
62 SourceMgr.getBufferData(LocInfo.first);
63 const char *StrData = Buffer.first+LocInfo.second;
Mike Stump1eb44332009-09-09 15:08:12 +000064
Chris Lattner60800082009-02-18 17:49:48 +000065 // Create a langops struct and enable trigraphs. This is sufficient for
66 // relexing tokens.
67 LangOptions LangOpts;
68 LangOpts.Trigraphs = true;
Mike Stump1eb44332009-09-09 15:08:12 +000069
Chris Lattner60800082009-02-18 17:49:48 +000070 // Create a lexer starting at the beginning of this token.
71 Lexer TheLexer(StrTokSpellingLoc, LangOpts, Buffer.first, StrData,
72 Buffer.second);
73 Token TheTok;
74 TheLexer.LexFromRawLexer(TheTok);
Mike Stump1eb44332009-09-09 15:08:12 +000075
Chris Lattner443e53c2009-02-18 19:26:42 +000076 // Use the StringLiteralParser to compute the length of the string in bytes.
77 StringLiteralParser SLP(&TheTok, 1, PP);
78 unsigned TokNumBytes = SLP.GetStringLength();
Mike Stump1eb44332009-09-09 15:08:12 +000079
Chris Lattner2197c962009-02-18 18:52:52 +000080 // If the byte is in this token, return the location of the byte.
Chris Lattner60800082009-02-18 17:49:48 +000081 if (ByteNo < TokNumBytes ||
82 (ByteNo == TokNumBytes && TokNo == SL->getNumConcatenated())) {
Mike Stump1eb44332009-09-09 15:08:12 +000083 unsigned Offset =
Chris Lattner719e6152009-02-18 19:21:10 +000084 StringLiteralParser::getOffsetOfStringByte(TheTok, ByteNo, PP);
Mike Stump1eb44332009-09-09 15:08:12 +000085
Chris Lattner719e6152009-02-18 19:21:10 +000086 // Now that we know the offset of the token in the spelling, use the
87 // preprocessor to get the offset in the original source.
88 return PP.AdvanceToTokenCharacter(StrTokLoc, Offset);
Chris Lattner60800082009-02-18 17:49:48 +000089 }
Mike Stump1eb44332009-09-09 15:08:12 +000090
Chris Lattner60800082009-02-18 17:49:48 +000091 // Move to the next string token.
92 ++TokNo;
93 ByteNo -= TokNumBytes;
94 }
95}
96
Ryan Flynn4403a5e2009-08-06 03:00:50 +000097/// CheckablePrintfAttr - does a function call have a "printf" attribute
98/// and arguments that merit checking?
99bool Sema::CheckablePrintfAttr(const FormatAttr *Format, CallExpr *TheCall) {
100 if (Format->getType() == "printf") return true;
101 if (Format->getType() == "printf0") {
102 // printf0 allows null "format" string; if so don't check format/args
103 unsigned format_idx = Format->getFormatIdx() - 1;
Sebastian Redl4a2614e2009-11-17 18:02:24 +0000104 // Does the index refer to the implicit object argument?
105 if (isa<CXXMemberCallExpr>(TheCall)) {
106 if (format_idx == 0)
107 return false;
108 --format_idx;
109 }
Ryan Flynn4403a5e2009-08-06 03:00:50 +0000110 if (format_idx < TheCall->getNumArgs()) {
111 Expr *Format = TheCall->getArg(format_idx)->IgnoreParenCasts();
Douglas Gregorce940492009-09-25 04:25:58 +0000112 if (!Format->isNullPointerConstant(Context, Expr::NPC_ValueDependentIsNull))
Ryan Flynn4403a5e2009-08-06 03:00:50 +0000113 return true;
114 }
115 }
116 return false;
117}
Chris Lattner60800082009-02-18 17:49:48 +0000118
Sebastian Redl0eb23302009-01-19 00:08:26 +0000119Action::OwningExprResult
Anders Carlssond406bf02009-08-16 01:56:34 +0000120Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
Sebastian Redl0eb23302009-01-19 00:08:26 +0000121 OwningExprResult TheCallResult(Owned(TheCall));
Douglas Gregor2def4832008-11-17 20:34:05 +0000122
Anders Carlssond406bf02009-08-16 01:56:34 +0000123 switch (BuiltinID) {
Chris Lattner30ce3442007-12-19 23:59:04 +0000124 case Builtin::BI__builtin___CFStringMakeConstantString:
Chris Lattner925e60d2007-12-28 05:29:59 +0000125 assert(TheCall->getNumArgs() == 1 &&
Chris Lattner1b9a0792007-12-20 00:26:33 +0000126 "Wrong # arguments to builtin CFStringMakeConstantString");
Chris Lattner69039812009-02-18 06:01:06 +0000127 if (CheckObjCString(TheCall->getArg(0)))
Sebastian Redl0eb23302009-01-19 00:08:26 +0000128 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000129 break;
Ted Kremenek49ff7a12008-07-09 17:58:53 +0000130 case Builtin::BI__builtin_stdarg_start:
Chris Lattner30ce3442007-12-19 23:59:04 +0000131 case Builtin::BI__builtin_va_start:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000132 if (SemaBuiltinVAStart(TheCall))
133 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000134 break;
Chris Lattner1b9a0792007-12-20 00:26:33 +0000135 case Builtin::BI__builtin_isgreater:
136 case Builtin::BI__builtin_isgreaterequal:
137 case Builtin::BI__builtin_isless:
138 case Builtin::BI__builtin_islessequal:
139 case Builtin::BI__builtin_islessgreater:
140 case Builtin::BI__builtin_isunordered:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000141 if (SemaBuiltinUnorderedCompare(TheCall))
142 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000143 break;
Eli Friedman9ac6f622009-08-31 20:06:00 +0000144 case Builtin::BI__builtin_isfinite:
145 case Builtin::BI__builtin_isinf:
146 case Builtin::BI__builtin_isinf_sign:
147 case Builtin::BI__builtin_isnan:
148 case Builtin::BI__builtin_isnormal:
149 if (SemaBuiltinUnaryFP(TheCall))
150 return ExprError();
151 break;
Eli Friedman6cfda232008-05-20 08:23:37 +0000152 case Builtin::BI__builtin_return_address:
153 case Builtin::BI__builtin_frame_address:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000154 if (SemaBuiltinStackAddress(TheCall))
155 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000156 break;
Chris Lattner21fb98e2009-09-23 06:06:36 +0000157 case Builtin::BI__builtin_eh_return_data_regno:
158 if (SemaBuiltinEHReturnDataRegNo(TheCall))
159 return ExprError();
160 break;
Eli Friedmand38617c2008-05-14 19:38:39 +0000161 case Builtin::BI__builtin_shufflevector:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000162 return SemaBuiltinShuffleVector(TheCall);
163 // TheCall will be freed by the smart pointer here, but that's fine, since
164 // SemaBuiltinShuffleVector guts it, but then doesn't release it.
Daniel Dunbar4493f792008-07-21 22:59:13 +0000165 case Builtin::BI__builtin_prefetch:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000166 if (SemaBuiltinPrefetch(TheCall))
167 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000168 break;
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000169 case Builtin::BI__builtin_object_size:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000170 if (SemaBuiltinObjectSize(TheCall))
171 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000172 break;
Eli Friedmand875fed2009-05-03 04:46:36 +0000173 case Builtin::BI__builtin_longjmp:
174 if (SemaBuiltinLongjmp(TheCall))
175 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000176 break;
Chris Lattner5caa3702009-05-08 06:58:22 +0000177 case Builtin::BI__sync_fetch_and_add:
178 case Builtin::BI__sync_fetch_and_sub:
179 case Builtin::BI__sync_fetch_and_or:
180 case Builtin::BI__sync_fetch_and_and:
181 case Builtin::BI__sync_fetch_and_xor:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000182 case Builtin::BI__sync_fetch_and_nand:
Chris Lattner5caa3702009-05-08 06:58:22 +0000183 case Builtin::BI__sync_add_and_fetch:
184 case Builtin::BI__sync_sub_and_fetch:
185 case Builtin::BI__sync_and_and_fetch:
186 case Builtin::BI__sync_or_and_fetch:
187 case Builtin::BI__sync_xor_and_fetch:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000188 case Builtin::BI__sync_nand_and_fetch:
Chris Lattner5caa3702009-05-08 06:58:22 +0000189 case Builtin::BI__sync_val_compare_and_swap:
190 case Builtin::BI__sync_bool_compare_and_swap:
191 case Builtin::BI__sync_lock_test_and_set:
192 case Builtin::BI__sync_lock_release:
193 if (SemaBuiltinAtomicOverloaded(TheCall))
194 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000195 break;
Anders Carlsson71993dd2007-08-17 05:31:46 +0000196 }
Mike Stump1eb44332009-09-09 15:08:12 +0000197
Anders Carlssond406bf02009-08-16 01:56:34 +0000198 return move(TheCallResult);
199}
Daniel Dunbarde454282008-10-02 18:44:07 +0000200
Anders Carlssond406bf02009-08-16 01:56:34 +0000201/// CheckFunctionCall - Check a direct function call for various correctness
202/// and safety properties not strictly enforced by the C type system.
203bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall) {
204 // Get the IdentifierInfo* for the called function.
205 IdentifierInfo *FnInfo = FDecl->getIdentifier();
206
207 // None of the checks below are needed for functions that don't have
208 // simple names (e.g., C++ conversion functions).
209 if (!FnInfo)
210 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000211
Daniel Dunbarde454282008-10-02 18:44:07 +0000212 // FIXME: This mechanism should be abstracted to be less fragile and
213 // more efficient. For example, just map function ids to custom
214 // handlers.
215
Chris Lattner59907c42007-08-10 20:18:51 +0000216 // Printf checking.
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +0000217 if (const FormatAttr *Format = FDecl->getAttr<FormatAttr>()) {
Ryan Flynn4403a5e2009-08-06 03:00:50 +0000218 if (CheckablePrintfAttr(Format, TheCall)) {
Ted Kremenek3d692df2009-02-27 17:58:43 +0000219 bool HasVAListArg = Format->getFirstArg() == 0;
220 if (!HasVAListArg) {
Mike Stump1eb44332009-09-09 15:08:12 +0000221 if (const FunctionProtoType *Proto
John McCall183700f2009-09-21 23:43:11 +0000222 = FDecl->getType()->getAs<FunctionProtoType>())
Sebastian Redl4a2614e2009-11-17 18:02:24 +0000223 HasVAListArg = !Proto->isVariadic();
Ted Kremenek3d692df2009-02-27 17:58:43 +0000224 }
Douglas Gregor3c385e52009-02-14 18:57:46 +0000225 CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
Ted Kremenek3d692df2009-02-27 17:58:43 +0000226 HasVAListArg ? 0 : Format->getFirstArg() - 1);
Douglas Gregor3c385e52009-02-14 18:57:46 +0000227 }
Chris Lattner59907c42007-08-10 20:18:51 +0000228 }
Mike Stump1eb44332009-09-09 15:08:12 +0000229
230 for (const NonNullAttr *NonNull = FDecl->getAttr<NonNullAttr>(); NonNull;
Anders Carlssond406bf02009-08-16 01:56:34 +0000231 NonNull = NonNull->getNext<NonNullAttr>())
232 CheckNonNullArguments(NonNull, TheCall);
Sebastian Redl0eb23302009-01-19 00:08:26 +0000233
Anders Carlssond406bf02009-08-16 01:56:34 +0000234 return false;
Anders Carlsson71993dd2007-08-17 05:31:46 +0000235}
236
Anders Carlssond406bf02009-08-16 01:56:34 +0000237bool Sema::CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall) {
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000238 // Printf checking.
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +0000239 const FormatAttr *Format = NDecl->getAttr<FormatAttr>();
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000240 if (!Format)
Anders Carlssond406bf02009-08-16 01:56:34 +0000241 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000242
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000243 const VarDecl *V = dyn_cast<VarDecl>(NDecl);
244 if (!V)
Anders Carlssond406bf02009-08-16 01:56:34 +0000245 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000246
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000247 QualType Ty = V->getType();
248 if (!Ty->isBlockPointerType())
Anders Carlssond406bf02009-08-16 01:56:34 +0000249 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000250
Anders Carlssond406bf02009-08-16 01:56:34 +0000251 if (!CheckablePrintfAttr(Format, TheCall))
252 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000253
Anders Carlssond406bf02009-08-16 01:56:34 +0000254 bool HasVAListArg = Format->getFirstArg() == 0;
255 if (!HasVAListArg) {
Mike Stump1eb44332009-09-09 15:08:12 +0000256 const FunctionType *FT =
John McCall183700f2009-09-21 23:43:11 +0000257 Ty->getAs<BlockPointerType>()->getPointeeType()->getAs<FunctionType>();
Anders Carlssond406bf02009-08-16 01:56:34 +0000258 if (const FunctionProtoType *Proto = dyn_cast<FunctionProtoType>(FT))
259 HasVAListArg = !Proto->isVariadic();
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000260 }
Anders Carlssond406bf02009-08-16 01:56:34 +0000261 CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
262 HasVAListArg ? 0 : Format->getFirstArg() - 1);
263
264 return false;
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000265}
266
Chris Lattner5caa3702009-05-08 06:58:22 +0000267/// SemaBuiltinAtomicOverloaded - We have a call to a function like
268/// __sync_fetch_and_add, which is an overloaded function based on the pointer
269/// type of its first argument. The main ActOnCallExpr routines have already
270/// promoted the types of arguments because all of these calls are prototyped as
271/// void(...).
272///
273/// This function goes through and does final semantic checking for these
274/// builtins,
275bool Sema::SemaBuiltinAtomicOverloaded(CallExpr *TheCall) {
276 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
277 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
278
279 // Ensure that we have at least one argument to do type inference from.
280 if (TheCall->getNumArgs() < 1)
281 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
282 << 0 << TheCall->getCallee()->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000283
Chris Lattner5caa3702009-05-08 06:58:22 +0000284 // Inspect the first argument of the atomic builtin. This should always be
285 // a pointer type, whose element is an integral scalar or pointer type.
286 // Because it is a pointer type, we don't have to worry about any implicit
287 // casts here.
288 Expr *FirstArg = TheCall->getArg(0);
289 if (!FirstArg->getType()->isPointerType())
290 return Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
291 << FirstArg->getType() << FirstArg->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000292
Ted Kremenek6217b802009-07-29 21:53:49 +0000293 QualType ValType = FirstArg->getType()->getAs<PointerType>()->getPointeeType();
Mike Stump1eb44332009-09-09 15:08:12 +0000294 if (!ValType->isIntegerType() && !ValType->isPointerType() &&
Chris Lattner5caa3702009-05-08 06:58:22 +0000295 !ValType->isBlockPointerType())
296 return Diag(DRE->getLocStart(),
297 diag::err_atomic_builtin_must_be_pointer_intptr)
298 << FirstArg->getType() << FirstArg->getSourceRange();
299
300 // We need to figure out which concrete builtin this maps onto. For example,
301 // __sync_fetch_and_add with a 2 byte object turns into
302 // __sync_fetch_and_add_2.
303#define BUILTIN_ROW(x) \
304 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
305 Builtin::BI##x##_8, Builtin::BI##x##_16 }
Mike Stump1eb44332009-09-09 15:08:12 +0000306
Chris Lattner5caa3702009-05-08 06:58:22 +0000307 static const unsigned BuiltinIndices[][5] = {
308 BUILTIN_ROW(__sync_fetch_and_add),
309 BUILTIN_ROW(__sync_fetch_and_sub),
310 BUILTIN_ROW(__sync_fetch_and_or),
311 BUILTIN_ROW(__sync_fetch_and_and),
312 BUILTIN_ROW(__sync_fetch_and_xor),
Chris Lattnereebd9d22009-05-13 04:37:52 +0000313 BUILTIN_ROW(__sync_fetch_and_nand),
Mike Stump1eb44332009-09-09 15:08:12 +0000314
Chris Lattner5caa3702009-05-08 06:58:22 +0000315 BUILTIN_ROW(__sync_add_and_fetch),
316 BUILTIN_ROW(__sync_sub_and_fetch),
317 BUILTIN_ROW(__sync_and_and_fetch),
318 BUILTIN_ROW(__sync_or_and_fetch),
319 BUILTIN_ROW(__sync_xor_and_fetch),
Chris Lattnereebd9d22009-05-13 04:37:52 +0000320 BUILTIN_ROW(__sync_nand_and_fetch),
Mike Stump1eb44332009-09-09 15:08:12 +0000321
Chris Lattner5caa3702009-05-08 06:58:22 +0000322 BUILTIN_ROW(__sync_val_compare_and_swap),
323 BUILTIN_ROW(__sync_bool_compare_and_swap),
324 BUILTIN_ROW(__sync_lock_test_and_set),
325 BUILTIN_ROW(__sync_lock_release)
326 };
Mike Stump1eb44332009-09-09 15:08:12 +0000327#undef BUILTIN_ROW
328
Chris Lattner5caa3702009-05-08 06:58:22 +0000329 // Determine the index of the size.
330 unsigned SizeIndex;
Ken Dyck199c3d62010-01-11 17:06:35 +0000331 switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
Chris Lattner5caa3702009-05-08 06:58:22 +0000332 case 1: SizeIndex = 0; break;
333 case 2: SizeIndex = 1; break;
334 case 4: SizeIndex = 2; break;
335 case 8: SizeIndex = 3; break;
336 case 16: SizeIndex = 4; break;
337 default:
338 return Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
339 << FirstArg->getType() << FirstArg->getSourceRange();
340 }
Mike Stump1eb44332009-09-09 15:08:12 +0000341
Chris Lattner5caa3702009-05-08 06:58:22 +0000342 // Each of these builtins has one pointer argument, followed by some number of
343 // values (0, 1 or 2) followed by a potentially empty varags list of stuff
344 // that we ignore. Find out which row of BuiltinIndices to read from as well
345 // as the number of fixed args.
Douglas Gregor7814e6d2009-09-12 00:22:50 +0000346 unsigned BuiltinID = FDecl->getBuiltinID();
Chris Lattner5caa3702009-05-08 06:58:22 +0000347 unsigned BuiltinIndex, NumFixed = 1;
348 switch (BuiltinID) {
349 default: assert(0 && "Unknown overloaded atomic builtin!");
350 case Builtin::BI__sync_fetch_and_add: BuiltinIndex = 0; break;
351 case Builtin::BI__sync_fetch_and_sub: BuiltinIndex = 1; break;
352 case Builtin::BI__sync_fetch_and_or: BuiltinIndex = 2; break;
353 case Builtin::BI__sync_fetch_and_and: BuiltinIndex = 3; break;
354 case Builtin::BI__sync_fetch_and_xor: BuiltinIndex = 4; break;
Chris Lattnereebd9d22009-05-13 04:37:52 +0000355 case Builtin::BI__sync_fetch_and_nand:BuiltinIndex = 5; break;
Mike Stump1eb44332009-09-09 15:08:12 +0000356
Chris Lattnereebd9d22009-05-13 04:37:52 +0000357 case Builtin::BI__sync_add_and_fetch: BuiltinIndex = 6; break;
358 case Builtin::BI__sync_sub_and_fetch: BuiltinIndex = 7; break;
359 case Builtin::BI__sync_and_and_fetch: BuiltinIndex = 8; break;
360 case Builtin::BI__sync_or_and_fetch: BuiltinIndex = 9; break;
361 case Builtin::BI__sync_xor_and_fetch: BuiltinIndex =10; break;
362 case Builtin::BI__sync_nand_and_fetch:BuiltinIndex =11; break;
Mike Stump1eb44332009-09-09 15:08:12 +0000363
Chris Lattner5caa3702009-05-08 06:58:22 +0000364 case Builtin::BI__sync_val_compare_and_swap:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000365 BuiltinIndex = 12;
Chris Lattner5caa3702009-05-08 06:58:22 +0000366 NumFixed = 2;
367 break;
368 case Builtin::BI__sync_bool_compare_and_swap:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000369 BuiltinIndex = 13;
Chris Lattner5caa3702009-05-08 06:58:22 +0000370 NumFixed = 2;
371 break;
Chris Lattnereebd9d22009-05-13 04:37:52 +0000372 case Builtin::BI__sync_lock_test_and_set: BuiltinIndex = 14; break;
Chris Lattner5caa3702009-05-08 06:58:22 +0000373 case Builtin::BI__sync_lock_release:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000374 BuiltinIndex = 15;
Chris Lattner5caa3702009-05-08 06:58:22 +0000375 NumFixed = 0;
376 break;
377 }
Mike Stump1eb44332009-09-09 15:08:12 +0000378
Chris Lattner5caa3702009-05-08 06:58:22 +0000379 // Now that we know how many fixed arguments we expect, first check that we
380 // have at least that many.
381 if (TheCall->getNumArgs() < 1+NumFixed)
382 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
383 << 0 << TheCall->getCallee()->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000384
385
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000386 // Get the decl for the concrete builtin from this, we can tell what the
387 // concrete integer type we should convert to is.
388 unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
389 const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
390 IdentifierInfo *NewBuiltinII = PP.getIdentifierInfo(NewBuiltinName);
Mike Stump1eb44332009-09-09 15:08:12 +0000391 FunctionDecl *NewBuiltinDecl =
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000392 cast<FunctionDecl>(LazilyCreateBuiltin(NewBuiltinII, NewBuiltinID,
393 TUScope, false, DRE->getLocStart()));
394 const FunctionProtoType *BuiltinFT =
John McCall183700f2009-09-21 23:43:11 +0000395 NewBuiltinDecl->getType()->getAs<FunctionProtoType>();
Ted Kremenek6217b802009-07-29 21:53:49 +0000396 ValType = BuiltinFT->getArgType(0)->getAs<PointerType>()->getPointeeType();
Mike Stump1eb44332009-09-09 15:08:12 +0000397
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000398 // If the first type needs to be converted (e.g. void** -> int*), do it now.
399 if (BuiltinFT->getArgType(0) != FirstArg->getType()) {
Eli Friedman73c39ab2009-10-20 08:27:19 +0000400 ImpCastExprToType(FirstArg, BuiltinFT->getArgType(0), CastExpr::CK_BitCast);
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000401 TheCall->setArg(0, FirstArg);
402 }
Mike Stump1eb44332009-09-09 15:08:12 +0000403
Chris Lattner5caa3702009-05-08 06:58:22 +0000404 // Next, walk the valid ones promoting to the right type.
405 for (unsigned i = 0; i != NumFixed; ++i) {
406 Expr *Arg = TheCall->getArg(i+1);
Mike Stump1eb44332009-09-09 15:08:12 +0000407
Chris Lattner5caa3702009-05-08 06:58:22 +0000408 // If the argument is an implicit cast, then there was a promotion due to
409 // "...", just remove it now.
410 if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
411 Arg = ICE->getSubExpr();
412 ICE->setSubExpr(0);
413 ICE->Destroy(Context);
414 TheCall->setArg(i+1, Arg);
415 }
Mike Stump1eb44332009-09-09 15:08:12 +0000416
Chris Lattner5caa3702009-05-08 06:58:22 +0000417 // GCC does an implicit conversion to the pointer or integer ValType. This
418 // can fail in some cases (1i -> int**), check for this error case now.
Anders Carlssoncdb61972009-08-07 22:21:05 +0000419 CastExpr::CastKind Kind = CastExpr::CK_Unknown;
Fariborz Jahaniane9f42082009-08-26 18:55:36 +0000420 CXXMethodDecl *ConversionDecl = 0;
421 if (CheckCastTypes(Arg->getSourceRange(), ValType, Arg, Kind,
422 ConversionDecl))
Chris Lattner5caa3702009-05-08 06:58:22 +0000423 return true;
Mike Stump1eb44332009-09-09 15:08:12 +0000424
Chris Lattner5caa3702009-05-08 06:58:22 +0000425 // Okay, we have something that *can* be converted to the right type. Check
426 // to see if there is a potentially weird extension going on here. This can
427 // happen when you do an atomic operation on something like an char* and
428 // pass in 42. The 42 gets converted to char. This is even more strange
429 // for things like 45.123 -> char, etc.
Mike Stump1eb44332009-09-09 15:08:12 +0000430 // FIXME: Do this check.
Anders Carlssoncdb61972009-08-07 22:21:05 +0000431 ImpCastExprToType(Arg, ValType, Kind, /*isLvalue=*/false);
Chris Lattner5caa3702009-05-08 06:58:22 +0000432 TheCall->setArg(i+1, Arg);
433 }
Mike Stump1eb44332009-09-09 15:08:12 +0000434
Chris Lattner5caa3702009-05-08 06:58:22 +0000435 // Switch the DeclRefExpr to refer to the new decl.
436 DRE->setDecl(NewBuiltinDecl);
437 DRE->setType(NewBuiltinDecl->getType());
Mike Stump1eb44332009-09-09 15:08:12 +0000438
Chris Lattner5caa3702009-05-08 06:58:22 +0000439 // Set the callee in the CallExpr.
440 // FIXME: This leaks the original parens and implicit casts.
441 Expr *PromotedCall = DRE;
442 UsualUnaryConversions(PromotedCall);
443 TheCall->setCallee(PromotedCall);
Mike Stump1eb44332009-09-09 15:08:12 +0000444
Chris Lattner5caa3702009-05-08 06:58:22 +0000445
446 // Change the result type of the call to match the result type of the decl.
447 TheCall->setType(NewBuiltinDecl->getResultType());
448 return false;
449}
450
451
Chris Lattner69039812009-02-18 06:01:06 +0000452/// CheckObjCString - Checks that the argument to the builtin
Anders Carlsson71993dd2007-08-17 05:31:46 +0000453/// CFString constructor is correct
Steve Narofffd942622009-04-13 20:26:29 +0000454/// FIXME: GCC currently emits the following warning:
Mike Stump1eb44332009-09-09 15:08:12 +0000455/// "warning: input conversion stopped due to an input byte that does not
Steve Narofffd942622009-04-13 20:26:29 +0000456/// belong to the input codeset UTF-8"
457/// Note: It might also make sense to do the UTF-16 conversion here (would
458/// simplify the backend).
Chris Lattner69039812009-02-18 06:01:06 +0000459bool Sema::CheckObjCString(Expr *Arg) {
Chris Lattner56f34942008-02-13 01:02:39 +0000460 Arg = Arg->IgnoreParenCasts();
Anders Carlsson71993dd2007-08-17 05:31:46 +0000461 StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
462
463 if (!Literal || Literal->isWide()) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000464 Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
465 << Arg->getSourceRange();
Anders Carlsson9cdc4d32007-08-17 15:44:17 +0000466 return true;
Anders Carlsson71993dd2007-08-17 05:31:46 +0000467 }
Mike Stump1eb44332009-09-09 15:08:12 +0000468
Daniel Dunbarf015b032009-09-22 10:03:52 +0000469 const char *Data = Literal->getStrData();
470 unsigned Length = Literal->getByteLength();
Mike Stump1eb44332009-09-09 15:08:12 +0000471
Daniel Dunbarf015b032009-09-22 10:03:52 +0000472 for (unsigned i = 0; i < Length; ++i) {
473 if (!Data[i]) {
474 Diag(getLocationOfStringLiteralByte(Literal, i),
475 diag::warn_cfstring_literal_contains_nul_character)
476 << Arg->getSourceRange();
477 break;
478 }
479 }
Mike Stump1eb44332009-09-09 15:08:12 +0000480
Anders Carlsson9cdc4d32007-08-17 15:44:17 +0000481 return false;
Chris Lattner59907c42007-08-10 20:18:51 +0000482}
483
Chris Lattnerc27c6652007-12-20 00:05:45 +0000484/// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
485/// Emit an error and return true on failure, return false on success.
Chris Lattner925e60d2007-12-28 05:29:59 +0000486bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
487 Expr *Fn = TheCall->getCallee();
488 if (TheCall->getNumArgs() > 2) {
Chris Lattner2c21a072008-11-21 18:44:24 +0000489 Diag(TheCall->getArg(2)->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000490 diag::err_typecheck_call_too_many_args)
Chris Lattner2c21a072008-11-21 18:44:24 +0000491 << 0 /*function call*/ << Fn->getSourceRange()
Mike Stump1eb44332009-09-09 15:08:12 +0000492 << SourceRange(TheCall->getArg(2)->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000493 (*(TheCall->arg_end()-1))->getLocEnd());
Chris Lattner30ce3442007-12-19 23:59:04 +0000494 return true;
495 }
Eli Friedman56f20ae2008-12-15 22:05:35 +0000496
497 if (TheCall->getNumArgs() < 2) {
498 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
499 << 0 /*function call*/;
500 }
501
Chris Lattnerc27c6652007-12-20 00:05:45 +0000502 // Determine whether the current function is variadic or not.
503 bool isVariadic;
Steve Naroffcd9c5142009-04-15 19:33:47 +0000504 if (CurBlock)
505 isVariadic = CurBlock->isVariadic;
506 else if (getCurFunctionDecl()) {
Douglas Gregor72564e72009-02-26 23:50:07 +0000507 if (FunctionProtoType* FTP =
508 dyn_cast<FunctionProtoType>(getCurFunctionDecl()->getType()))
Eli Friedman56f20ae2008-12-15 22:05:35 +0000509 isVariadic = FTP->isVariadic();
510 else
511 isVariadic = false;
512 } else {
Argyrios Kyrtzidis53d0ea52008-06-28 06:07:14 +0000513 isVariadic = getCurMethodDecl()->isVariadic();
Eli Friedman56f20ae2008-12-15 22:05:35 +0000514 }
Mike Stump1eb44332009-09-09 15:08:12 +0000515
Chris Lattnerc27c6652007-12-20 00:05:45 +0000516 if (!isVariadic) {
Chris Lattner30ce3442007-12-19 23:59:04 +0000517 Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
518 return true;
519 }
Mike Stump1eb44332009-09-09 15:08:12 +0000520
Chris Lattner30ce3442007-12-19 23:59:04 +0000521 // Verify that the second argument to the builtin is the last argument of the
522 // current function or method.
523 bool SecondArgIsLastNamedArgument = false;
Anders Carlssone2c14102008-02-13 01:22:59 +0000524 const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
Mike Stump1eb44332009-09-09 15:08:12 +0000525
Anders Carlsson88cf2262008-02-11 04:20:54 +0000526 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
527 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
Chris Lattner30ce3442007-12-19 23:59:04 +0000528 // FIXME: This isn't correct for methods (results in bogus warning).
529 // Get the last formal in the current function.
Anders Carlsson88cf2262008-02-11 04:20:54 +0000530 const ParmVarDecl *LastArg;
Steve Naroffcd9c5142009-04-15 19:33:47 +0000531 if (CurBlock)
532 LastArg = *(CurBlock->TheDecl->param_end()-1);
533 else if (FunctionDecl *FD = getCurFunctionDecl())
Chris Lattner371f2582008-12-04 23:50:19 +0000534 LastArg = *(FD->param_end()-1);
Chris Lattner30ce3442007-12-19 23:59:04 +0000535 else
Argyrios Kyrtzidis53d0ea52008-06-28 06:07:14 +0000536 LastArg = *(getCurMethodDecl()->param_end()-1);
Chris Lattner30ce3442007-12-19 23:59:04 +0000537 SecondArgIsLastNamedArgument = PV == LastArg;
538 }
539 }
Mike Stump1eb44332009-09-09 15:08:12 +0000540
Chris Lattner30ce3442007-12-19 23:59:04 +0000541 if (!SecondArgIsLastNamedArgument)
Mike Stump1eb44332009-09-09 15:08:12 +0000542 Diag(TheCall->getArg(1)->getLocStart(),
Chris Lattner30ce3442007-12-19 23:59:04 +0000543 diag::warn_second_parameter_of_va_start_not_last_named_argument);
544 return false;
Eli Friedman6cfda232008-05-20 08:23:37 +0000545}
Chris Lattner30ce3442007-12-19 23:59:04 +0000546
Chris Lattner1b9a0792007-12-20 00:26:33 +0000547/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
548/// friends. This is declared to take (...), so we have to check everything.
Chris Lattner925e60d2007-12-28 05:29:59 +0000549bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
550 if (TheCall->getNumArgs() < 2)
Chris Lattner2c21a072008-11-21 18:44:24 +0000551 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
552 << 0 /*function call*/;
Chris Lattner925e60d2007-12-28 05:29:59 +0000553 if (TheCall->getNumArgs() > 2)
Mike Stump1eb44332009-09-09 15:08:12 +0000554 return Diag(TheCall->getArg(2)->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000555 diag::err_typecheck_call_too_many_args)
Chris Lattner2c21a072008-11-21 18:44:24 +0000556 << 0 /*function call*/
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000557 << SourceRange(TheCall->getArg(2)->getLocStart(),
558 (*(TheCall->arg_end()-1))->getLocEnd());
Mike Stump1eb44332009-09-09 15:08:12 +0000559
Chris Lattner925e60d2007-12-28 05:29:59 +0000560 Expr *OrigArg0 = TheCall->getArg(0);
561 Expr *OrigArg1 = TheCall->getArg(1);
Douglas Gregorcde01732009-05-19 22:10:17 +0000562
Chris Lattner1b9a0792007-12-20 00:26:33 +0000563 // Do standard promotions between the two arguments, returning their common
564 // type.
Chris Lattner925e60d2007-12-28 05:29:59 +0000565 QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
Daniel Dunbar403bc2b2009-02-19 19:28:43 +0000566
567 // Make sure any conversions are pushed back into the call; this is
568 // type safe since unordered compare builtins are declared as "_Bool
569 // foo(...)".
570 TheCall->setArg(0, OrigArg0);
571 TheCall->setArg(1, OrigArg1);
Mike Stump1eb44332009-09-09 15:08:12 +0000572
Douglas Gregorcde01732009-05-19 22:10:17 +0000573 if (OrigArg0->isTypeDependent() || OrigArg1->isTypeDependent())
574 return false;
575
Chris Lattner1b9a0792007-12-20 00:26:33 +0000576 // If the common type isn't a real floating type, then the arguments were
577 // invalid for this operation.
578 if (!Res->isRealFloatingType())
Mike Stump1eb44332009-09-09 15:08:12 +0000579 return Diag(OrigArg0->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000580 diag::err_typecheck_call_invalid_ordered_compare)
Chris Lattnerd1625842008-11-24 06:25:27 +0000581 << OrigArg0->getType() << OrigArg1->getType()
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000582 << SourceRange(OrigArg0->getLocStart(), OrigArg1->getLocEnd());
Mike Stump1eb44332009-09-09 15:08:12 +0000583
Chris Lattner1b9a0792007-12-20 00:26:33 +0000584 return false;
585}
586
Eli Friedman9ac6f622009-08-31 20:06:00 +0000587/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isnan and
588/// friends. This is declared to take (...), so we have to check everything.
589bool Sema::SemaBuiltinUnaryFP(CallExpr *TheCall) {
590 if (TheCall->getNumArgs() < 1)
591 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
592 << 0 /*function call*/;
593 if (TheCall->getNumArgs() > 1)
Mike Stump1eb44332009-09-09 15:08:12 +0000594 return Diag(TheCall->getArg(1)->getLocStart(),
Eli Friedman9ac6f622009-08-31 20:06:00 +0000595 diag::err_typecheck_call_too_many_args)
596 << 0 /*function call*/
597 << SourceRange(TheCall->getArg(1)->getLocStart(),
598 (*(TheCall->arg_end()-1))->getLocEnd());
599
600 Expr *OrigArg = TheCall->getArg(0);
Mike Stump1eb44332009-09-09 15:08:12 +0000601
Eli Friedman9ac6f622009-08-31 20:06:00 +0000602 if (OrigArg->isTypeDependent())
603 return false;
604
605 // This operation requires a floating-point number
606 if (!OrigArg->getType()->isRealFloatingType())
Mike Stump1eb44332009-09-09 15:08:12 +0000607 return Diag(OrigArg->getLocStart(),
Eli Friedman9ac6f622009-08-31 20:06:00 +0000608 diag::err_typecheck_call_invalid_unary_fp)
609 << OrigArg->getType() << OrigArg->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000610
Eli Friedman9ac6f622009-08-31 20:06:00 +0000611 return false;
612}
613
Eli Friedman6cfda232008-05-20 08:23:37 +0000614bool Sema::SemaBuiltinStackAddress(CallExpr *TheCall) {
615 // The signature for these builtins is exact; the only thing we need
616 // to check is that the argument is a constant.
617 SourceLocation Loc;
Douglas Gregorcde01732009-05-19 22:10:17 +0000618 if (!TheCall->getArg(0)->isTypeDependent() &&
619 !TheCall->getArg(0)->isValueDependent() &&
620 !TheCall->getArg(0)->isIntegerConstantExpr(Context, &Loc))
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000621 return Diag(Loc, diag::err_stack_const_level) << TheCall->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000622
Eli Friedman6cfda232008-05-20 08:23:37 +0000623 return false;
624}
625
Eli Friedmand38617c2008-05-14 19:38:39 +0000626/// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
627// This is declared to take (...), so we have to check everything.
Sebastian Redl0eb23302009-01-19 00:08:26 +0000628Action::OwningExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) {
Eli Friedmand38617c2008-05-14 19:38:39 +0000629 if (TheCall->getNumArgs() < 3)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000630 return ExprError(Diag(TheCall->getLocEnd(),
631 diag::err_typecheck_call_too_few_args)
632 << 0 /*function call*/ << TheCall->getSourceRange());
Eli Friedmand38617c2008-05-14 19:38:39 +0000633
Douglas Gregorcde01732009-05-19 22:10:17 +0000634 unsigned numElements = std::numeric_limits<unsigned>::max();
635 if (!TheCall->getArg(0)->isTypeDependent() &&
636 !TheCall->getArg(1)->isTypeDependent()) {
637 QualType FAType = TheCall->getArg(0)->getType();
638 QualType SAType = TheCall->getArg(1)->getType();
Mike Stump1eb44332009-09-09 15:08:12 +0000639
Douglas Gregorcde01732009-05-19 22:10:17 +0000640 if (!FAType->isVectorType() || !SAType->isVectorType()) {
641 Diag(TheCall->getLocStart(), diag::err_shufflevector_non_vector)
Mike Stump1eb44332009-09-09 15:08:12 +0000642 << SourceRange(TheCall->getArg(0)->getLocStart(),
Douglas Gregorcde01732009-05-19 22:10:17 +0000643 TheCall->getArg(1)->getLocEnd());
644 return ExprError();
645 }
Mike Stump1eb44332009-09-09 15:08:12 +0000646
Douglas Gregora4923eb2009-11-16 21:35:15 +0000647 if (!Context.hasSameUnqualifiedType(FAType, SAType)) {
Douglas Gregorcde01732009-05-19 22:10:17 +0000648 Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
Mike Stump1eb44332009-09-09 15:08:12 +0000649 << SourceRange(TheCall->getArg(0)->getLocStart(),
Douglas Gregorcde01732009-05-19 22:10:17 +0000650 TheCall->getArg(1)->getLocEnd());
651 return ExprError();
652 }
Eli Friedmand38617c2008-05-14 19:38:39 +0000653
John McCall183700f2009-09-21 23:43:11 +0000654 numElements = FAType->getAs<VectorType>()->getNumElements();
Douglas Gregorcde01732009-05-19 22:10:17 +0000655 if (TheCall->getNumArgs() != numElements+2) {
656 if (TheCall->getNumArgs() < numElements+2)
657 return ExprError(Diag(TheCall->getLocEnd(),
658 diag::err_typecheck_call_too_few_args)
659 << 0 /*function call*/ << TheCall->getSourceRange());
Sebastian Redl0eb23302009-01-19 00:08:26 +0000660 return ExprError(Diag(TheCall->getLocEnd(),
Douglas Gregorcde01732009-05-19 22:10:17 +0000661 diag::err_typecheck_call_too_many_args)
662 << 0 /*function call*/ << TheCall->getSourceRange());
663 }
Eli Friedmand38617c2008-05-14 19:38:39 +0000664 }
665
666 for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
Douglas Gregorcde01732009-05-19 22:10:17 +0000667 if (TheCall->getArg(i)->isTypeDependent() ||
668 TheCall->getArg(i)->isValueDependent())
669 continue;
670
Eli Friedmand38617c2008-05-14 19:38:39 +0000671 llvm::APSInt Result(32);
Chris Lattnerd1a0b6d2008-08-10 02:05:13 +0000672 if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context))
Sebastian Redl0eb23302009-01-19 00:08:26 +0000673 return ExprError(Diag(TheCall->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000674 diag::err_shufflevector_nonconstant_argument)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000675 << TheCall->getArg(i)->getSourceRange());
676
Chris Lattnerd1a0b6d2008-08-10 02:05:13 +0000677 if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000678 return ExprError(Diag(TheCall->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000679 diag::err_shufflevector_argument_too_large)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000680 << TheCall->getArg(i)->getSourceRange());
Eli Friedmand38617c2008-05-14 19:38:39 +0000681 }
682
683 llvm::SmallVector<Expr*, 32> exprs;
684
Chris Lattnerd1a0b6d2008-08-10 02:05:13 +0000685 for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
Eli Friedmand38617c2008-05-14 19:38:39 +0000686 exprs.push_back(TheCall->getArg(i));
687 TheCall->setArg(i, 0);
688 }
689
Nate Begemana88dc302009-08-12 02:10:25 +0000690 return Owned(new (Context) ShuffleVectorExpr(Context, exprs.begin(),
691 exprs.size(), exprs[0]->getType(),
Ted Kremenek8189cde2009-02-07 01:47:29 +0000692 TheCall->getCallee()->getLocStart(),
693 TheCall->getRParenLoc()));
Eli Friedmand38617c2008-05-14 19:38:39 +0000694}
Chris Lattner30ce3442007-12-19 23:59:04 +0000695
Daniel Dunbar4493f792008-07-21 22:59:13 +0000696/// SemaBuiltinPrefetch - Handle __builtin_prefetch.
697// This is declared to take (const void*, ...) and can take two
698// optional constant int args.
699bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000700 unsigned NumArgs = TheCall->getNumArgs();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000701
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000702 if (NumArgs > 3)
703 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_many_args)
Chris Lattner2c21a072008-11-21 18:44:24 +0000704 << 0 /*function call*/ << TheCall->getSourceRange();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000705
706 // Argument 0 is checked for us and the remaining arguments must be
707 // constant integers.
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000708 for (unsigned i = 1; i != NumArgs; ++i) {
Daniel Dunbar4493f792008-07-21 22:59:13 +0000709 Expr *Arg = TheCall->getArg(i);
Douglas Gregorcde01732009-05-19 22:10:17 +0000710 if (Arg->isTypeDependent())
711 continue;
712
Eli Friedman9aef7262009-12-04 00:30:06 +0000713 if (!Arg->getType()->isIntegralType())
714 return Diag(TheCall->getLocStart(), diag::err_prefetch_invalid_arg_type)
Chris Lattner21fb98e2009-09-23 06:06:36 +0000715 << Arg->getSourceRange();
Douglas Gregorcde01732009-05-19 22:10:17 +0000716
Eli Friedman9aef7262009-12-04 00:30:06 +0000717 ImpCastExprToType(Arg, Context.IntTy, CastExpr::CK_IntegralCast);
718 TheCall->setArg(i, Arg);
719
Douglas Gregorcde01732009-05-19 22:10:17 +0000720 if (Arg->isValueDependent())
721 continue;
722
Eli Friedman9aef7262009-12-04 00:30:06 +0000723 llvm::APSInt Result;
Douglas Gregorcde01732009-05-19 22:10:17 +0000724 if (!Arg->isIntegerConstantExpr(Result, Context))
Eli Friedman9aef7262009-12-04 00:30:06 +0000725 return Diag(TheCall->getLocStart(), diag::err_prefetch_invalid_arg_ice)
Douglas Gregorcde01732009-05-19 22:10:17 +0000726 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Mike Stump1eb44332009-09-09 15:08:12 +0000727
Daniel Dunbar4493f792008-07-21 22:59:13 +0000728 // FIXME: gcc issues a warning and rewrites these to 0. These
729 // seems especially odd for the third argument since the default
730 // is 3.
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000731 if (i == 1) {
Eli Friedman9aef7262009-12-04 00:30:06 +0000732 if (Result.getLimitedValue() > 1)
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000733 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Chris Lattner21fb98e2009-09-23 06:06:36 +0000734 << "0" << "1" << Arg->getSourceRange();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000735 } else {
Eli Friedman9aef7262009-12-04 00:30:06 +0000736 if (Result.getLimitedValue() > 3)
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000737 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Chris Lattner21fb98e2009-09-23 06:06:36 +0000738 << "0" << "3" << Arg->getSourceRange();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000739 }
740 }
741
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000742 return false;
Daniel Dunbar4493f792008-07-21 22:59:13 +0000743}
744
Chris Lattner21fb98e2009-09-23 06:06:36 +0000745/// SemaBuiltinEHReturnDataRegNo - Handle __builtin_eh_return_data_regno, the
746/// operand must be an integer constant.
747bool Sema::SemaBuiltinEHReturnDataRegNo(CallExpr *TheCall) {
748 llvm::APSInt Result;
749 if (!TheCall->getArg(0)->isIntegerConstantExpr(Result, Context))
750 return Diag(TheCall->getLocStart(), diag::err_expr_not_ice)
751 << TheCall->getArg(0)->getSourceRange();
752
753 return false;
754}
755
756
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000757/// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
758/// int type). This simply type checks that type is one of the defined
759/// constants (0-3).
Eric Christopherfee667f2009-12-23 03:49:37 +0000760// For compatability check 0-3, llvm only handles 0 and 2.
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000761bool Sema::SemaBuiltinObjectSize(CallExpr *TheCall) {
762 Expr *Arg = TheCall->getArg(1);
Douglas Gregorcde01732009-05-19 22:10:17 +0000763 if (Arg->isTypeDependent())
764 return false;
765
Mike Stump1eb44332009-09-09 15:08:12 +0000766 QualType ArgType = Arg->getType();
John McCall183700f2009-09-21 23:43:11 +0000767 const BuiltinType *BT = ArgType->getAs<BuiltinType>();
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000768 llvm::APSInt Result(32);
Douglas Gregorcde01732009-05-19 22:10:17 +0000769 if (!BT || BT->getKind() != BuiltinType::Int)
770 return Diag(TheCall->getLocStart(), diag::err_object_size_invalid_argument)
771 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
772
773 if (Arg->isValueDependent())
774 return false;
775
776 if (!Arg->isIntegerConstantExpr(Result, Context)) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000777 return Diag(TheCall->getLocStart(), diag::err_object_size_invalid_argument)
778 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000779 }
780
781 if (Result.getSExtValue() < 0 || Result.getSExtValue() > 3) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000782 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
783 << "0" << "3" << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000784 }
785
786 return false;
787}
788
Eli Friedman586d6a82009-05-03 06:04:26 +0000789/// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
Eli Friedmand875fed2009-05-03 04:46:36 +0000790/// This checks that val is a constant 1.
791bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
792 Expr *Arg = TheCall->getArg(1);
Douglas Gregorcde01732009-05-19 22:10:17 +0000793 if (Arg->isTypeDependent() || Arg->isValueDependent())
794 return false;
795
Eli Friedmand875fed2009-05-03 04:46:36 +0000796 llvm::APSInt Result(32);
797 if (!Arg->isIntegerConstantExpr(Result, Context) || Result != 1)
798 return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
799 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
800
801 return false;
802}
803
Ted Kremenekd30ef872009-01-12 23:09:09 +0000804// Handle i > 1 ? "x" : "y", recursivelly
Ted Kremenek082d9362009-03-20 21:35:28 +0000805bool Sema::SemaCheckStringLiteral(const Expr *E, const CallExpr *TheCall,
806 bool HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000807 unsigned format_idx, unsigned firstDataArg) {
Douglas Gregorcde01732009-05-19 22:10:17 +0000808 if (E->isTypeDependent() || E->isValueDependent())
809 return false;
Ted Kremenekd30ef872009-01-12 23:09:09 +0000810
811 switch (E->getStmtClass()) {
812 case Stmt::ConditionalOperatorClass: {
Ted Kremenek082d9362009-03-20 21:35:28 +0000813 const ConditionalOperator *C = cast<ConditionalOperator>(E);
Chris Lattner813b70d2009-12-22 06:00:13 +0000814 return SemaCheckStringLiteral(C->getTrueExpr(), TheCall,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000815 HasVAListArg, format_idx, firstDataArg)
Ted Kremenekd30ef872009-01-12 23:09:09 +0000816 && SemaCheckStringLiteral(C->getRHS(), TheCall,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000817 HasVAListArg, format_idx, firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000818 }
819
820 case Stmt::ImplicitCastExprClass: {
Ted Kremenek082d9362009-03-20 21:35:28 +0000821 const ImplicitCastExpr *Expr = cast<ImplicitCastExpr>(E);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000822 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000823 format_idx, firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000824 }
825
826 case Stmt::ParenExprClass: {
Ted Kremenek082d9362009-03-20 21:35:28 +0000827 const ParenExpr *Expr = cast<ParenExpr>(E);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000828 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000829 format_idx, firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000830 }
Mike Stump1eb44332009-09-09 15:08:12 +0000831
Ted Kremenek082d9362009-03-20 21:35:28 +0000832 case Stmt::DeclRefExprClass: {
833 const DeclRefExpr *DR = cast<DeclRefExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +0000834
Ted Kremenek082d9362009-03-20 21:35:28 +0000835 // As an exception, do not flag errors for variables binding to
836 // const string literals.
837 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
838 bool isConstant = false;
839 QualType T = DR->getType();
Ted Kremenekd30ef872009-01-12 23:09:09 +0000840
Ted Kremenek082d9362009-03-20 21:35:28 +0000841 if (const ArrayType *AT = Context.getAsArrayType(T)) {
842 isConstant = AT->getElementType().isConstant(Context);
Mike Stumpac5fc7c2009-08-04 21:02:39 +0000843 } else if (const PointerType *PT = T->getAs<PointerType>()) {
Mike Stump1eb44332009-09-09 15:08:12 +0000844 isConstant = T.isConstant(Context) &&
Ted Kremenek082d9362009-03-20 21:35:28 +0000845 PT->getPointeeType().isConstant(Context);
846 }
Mike Stump1eb44332009-09-09 15:08:12 +0000847
Ted Kremenek082d9362009-03-20 21:35:28 +0000848 if (isConstant) {
849 const VarDecl *Def = 0;
850 if (const Expr *Init = VD->getDefinition(Def))
851 return SemaCheckStringLiteral(Init, TheCall,
852 HasVAListArg, format_idx, firstDataArg);
853 }
Mike Stump1eb44332009-09-09 15:08:12 +0000854
Anders Carlssond966a552009-06-28 19:55:58 +0000855 // For vprintf* functions (i.e., HasVAListArg==true), we add a
856 // special check to see if the format string is a function parameter
857 // of the function calling the printf function. If the function
858 // has an attribute indicating it is a printf-like function, then we
859 // should suppress warnings concerning non-literals being used in a call
860 // to a vprintf function. For example:
861 //
862 // void
863 // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
864 // va_list ap;
865 // va_start(ap, fmt);
866 // vprintf(fmt, ap); // Do NOT emit a warning about "fmt".
867 // ...
868 //
869 //
870 // FIXME: We don't have full attribute support yet, so just check to see
871 // if the argument is a DeclRefExpr that references a parameter. We'll
872 // add proper support for checking the attribute later.
873 if (HasVAListArg)
874 if (isa<ParmVarDecl>(VD))
875 return true;
Ted Kremenek082d9362009-03-20 21:35:28 +0000876 }
Mike Stump1eb44332009-09-09 15:08:12 +0000877
Ted Kremenek082d9362009-03-20 21:35:28 +0000878 return false;
879 }
Ted Kremenekd30ef872009-01-12 23:09:09 +0000880
Anders Carlsson8f031b32009-06-27 04:05:33 +0000881 case Stmt::CallExprClass: {
882 const CallExpr *CE = cast<CallExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +0000883 if (const ImplicitCastExpr *ICE
Anders Carlsson8f031b32009-06-27 04:05:33 +0000884 = dyn_cast<ImplicitCastExpr>(CE->getCallee())) {
885 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ICE->getSubExpr())) {
886 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(DRE->getDecl())) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +0000887 if (const FormatArgAttr *FA = FD->getAttr<FormatArgAttr>()) {
Anders Carlsson8f031b32009-06-27 04:05:33 +0000888 unsigned ArgIndex = FA->getFormatIdx();
889 const Expr *Arg = CE->getArg(ArgIndex - 1);
Mike Stump1eb44332009-09-09 15:08:12 +0000890
891 return SemaCheckStringLiteral(Arg, TheCall, HasVAListArg,
Anders Carlsson8f031b32009-06-27 04:05:33 +0000892 format_idx, firstDataArg);
893 }
894 }
895 }
896 }
Mike Stump1eb44332009-09-09 15:08:12 +0000897
Anders Carlsson8f031b32009-06-27 04:05:33 +0000898 return false;
899 }
Ted Kremenek082d9362009-03-20 21:35:28 +0000900 case Stmt::ObjCStringLiteralClass:
901 case Stmt::StringLiteralClass: {
902 const StringLiteral *StrE = NULL;
Mike Stump1eb44332009-09-09 15:08:12 +0000903
Ted Kremenek082d9362009-03-20 21:35:28 +0000904 if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
Ted Kremenekd30ef872009-01-12 23:09:09 +0000905 StrE = ObjCFExpr->getString();
906 else
Ted Kremenek082d9362009-03-20 21:35:28 +0000907 StrE = cast<StringLiteral>(E);
Mike Stump1eb44332009-09-09 15:08:12 +0000908
Ted Kremenekd30ef872009-01-12 23:09:09 +0000909 if (StrE) {
Mike Stump1eb44332009-09-09 15:08:12 +0000910 CheckPrintfString(StrE, E, TheCall, HasVAListArg, format_idx,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000911 firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000912 return true;
913 }
Mike Stump1eb44332009-09-09 15:08:12 +0000914
Ted Kremenekd30ef872009-01-12 23:09:09 +0000915 return false;
916 }
Mike Stump1eb44332009-09-09 15:08:12 +0000917
Ted Kremenek082d9362009-03-20 21:35:28 +0000918 default:
919 return false;
Ted Kremenekd30ef872009-01-12 23:09:09 +0000920 }
921}
922
Fariborz Jahaniane898f8a2009-05-21 18:48:51 +0000923void
Mike Stump1eb44332009-09-09 15:08:12 +0000924Sema::CheckNonNullArguments(const NonNullAttr *NonNull,
925 const CallExpr *TheCall) {
Fariborz Jahaniane898f8a2009-05-21 18:48:51 +0000926 for (NonNullAttr::iterator i = NonNull->begin(), e = NonNull->end();
927 i != e; ++i) {
Chris Lattner12b97ff2009-05-25 18:23:36 +0000928 const Expr *ArgExpr = TheCall->getArg(*i);
Douglas Gregorce940492009-09-25 04:25:58 +0000929 if (ArgExpr->isNullPointerConstant(Context,
930 Expr::NPC_ValueDependentIsNotNull))
Chris Lattner12b97ff2009-05-25 18:23:36 +0000931 Diag(TheCall->getCallee()->getLocStart(), diag::warn_null_arg)
932 << ArgExpr->getSourceRange();
Fariborz Jahaniane898f8a2009-05-21 18:48:51 +0000933 }
934}
Ted Kremenekd30ef872009-01-12 23:09:09 +0000935
Chris Lattner59907c42007-08-10 20:18:51 +0000936/// CheckPrintfArguments - Check calls to printf (and similar functions) for
Mike Stump1eb44332009-09-09 15:08:12 +0000937/// correct use of format strings.
Ted Kremenek71895b92007-08-14 17:39:48 +0000938///
939/// HasVAListArg - A predicate indicating whether the printf-like
940/// function is passed an explicit va_arg argument (e.g., vprintf)
941///
942/// format_idx - The index into Args for the format string.
943///
944/// Improper format strings to functions in the printf family can be
945/// the source of bizarre bugs and very serious security holes. A
946/// good source of information is available in the following paper
947/// (which includes additional references):
Chris Lattner59907c42007-08-10 20:18:51 +0000948///
949/// FormatGuard: Automatic Protection From printf Format String
950/// Vulnerabilities, Proceedings of the 10th USENIX Security Symposium, 2001.
Ted Kremenek71895b92007-08-14 17:39:48 +0000951///
952/// Functionality implemented:
953///
954/// We can statically check the following properties for string
955/// literal format strings for non v.*printf functions (where the
956/// arguments are passed directly):
957//
958/// (1) Are the number of format conversions equal to the number of
959/// data arguments?
960///
961/// (2) Does each format conversion correctly match the type of the
962/// corresponding data argument? (TODO)
963///
964/// Moreover, for all printf functions we can:
965///
966/// (3) Check for a missing format string (when not caught by type checking).
967///
968/// (4) Check for no-operation flags; e.g. using "#" with format
969/// conversion 'c' (TODO)
970///
971/// (5) Check the use of '%n', a major source of security holes.
972///
973/// (6) Check for malformed format conversions that don't specify anything.
974///
975/// (7) Check for empty format strings. e.g: printf("");
976///
977/// (8) Check that the format string is a wide literal.
978///
979/// All of these checks can be done by parsing the format string.
980///
981/// For now, we ONLY do (1), (3), (5), (6), (7), and (8).
Chris Lattner59907c42007-08-10 20:18:51 +0000982void
Mike Stump1eb44332009-09-09 15:08:12 +0000983Sema::CheckPrintfArguments(const CallExpr *TheCall, bool HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000984 unsigned format_idx, unsigned firstDataArg) {
Ted Kremenek082d9362009-03-20 21:35:28 +0000985 const Expr *Fn = TheCall->getCallee();
Chris Lattner925e60d2007-12-28 05:29:59 +0000986
Sebastian Redl4a2614e2009-11-17 18:02:24 +0000987 // The way the format attribute works in GCC, the implicit this argument
988 // of member functions is counted. However, it doesn't appear in our own
989 // lists, so decrement format_idx in that case.
990 if (isa<CXXMemberCallExpr>(TheCall)) {
991 // Catch a format attribute mistakenly referring to the object argument.
992 if (format_idx == 0)
993 return;
994 --format_idx;
995 if(firstDataArg != 0)
996 --firstDataArg;
997 }
998
Mike Stump1eb44332009-09-09 15:08:12 +0000999 // CHECK: printf-like function is called with no format string.
Chris Lattner925e60d2007-12-28 05:29:59 +00001000 if (format_idx >= TheCall->getNumArgs()) {
Chris Lattnerdcd5ef12008-11-19 05:27:50 +00001001 Diag(TheCall->getRParenLoc(), diag::warn_printf_missing_format_string)
1002 << Fn->getSourceRange();
Ted Kremenek71895b92007-08-14 17:39:48 +00001003 return;
1004 }
Mike Stump1eb44332009-09-09 15:08:12 +00001005
Ted Kremenek082d9362009-03-20 21:35:28 +00001006 const Expr *OrigFormatExpr = TheCall->getArg(format_idx)->IgnoreParenCasts();
Mike Stump1eb44332009-09-09 15:08:12 +00001007
Chris Lattner59907c42007-08-10 20:18:51 +00001008 // CHECK: format string is not a string literal.
Mike Stump1eb44332009-09-09 15:08:12 +00001009 //
Ted Kremenek71895b92007-08-14 17:39:48 +00001010 // Dynamically generated format strings are difficult to
1011 // automatically vet at compile time. Requiring that format strings
1012 // are string literals: (1) permits the checking of format strings by
1013 // the compiler and thereby (2) can practically remove the source of
1014 // many format string exploits.
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001015
Mike Stump1eb44332009-09-09 15:08:12 +00001016 // Format string can be either ObjC string (e.g. @"%d") or
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001017 // C string (e.g. "%d")
Mike Stump1eb44332009-09-09 15:08:12 +00001018 // ObjC string uses the same format specifiers as C string, so we can use
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001019 // the same format string checking logic for both ObjC and C strings.
Chris Lattner1cd3e1f2009-04-29 04:49:34 +00001020 if (SemaCheckStringLiteral(OrigFormatExpr, TheCall, HasVAListArg, format_idx,
1021 firstDataArg))
1022 return; // Literal format string found, check done!
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001023
Chris Lattner655f1412009-04-29 04:59:47 +00001024 // If there are no arguments specified, warn with -Wformat-security, otherwise
1025 // warn only with -Wformat-nonliteral.
1026 if (TheCall->getNumArgs() == format_idx+1)
Mike Stump1eb44332009-09-09 15:08:12 +00001027 Diag(TheCall->getArg(format_idx)->getLocStart(),
Chris Lattner655f1412009-04-29 04:59:47 +00001028 diag::warn_printf_nonliteral_noargs)
1029 << OrigFormatExpr->getSourceRange();
1030 else
Mike Stump1eb44332009-09-09 15:08:12 +00001031 Diag(TheCall->getArg(format_idx)->getLocStart(),
Chris Lattner655f1412009-04-29 04:59:47 +00001032 diag::warn_printf_nonliteral)
1033 << OrigFormatExpr->getSourceRange();
Ted Kremenekd30ef872009-01-12 23:09:09 +00001034}
Ted Kremenek71895b92007-08-14 17:39:48 +00001035
Ted Kremeneke0e53132010-01-28 23:39:18 +00001036namespace {
Ted Kremenek808015a2010-01-29 03:16:21 +00001037class CheckPrintfHandler : public FormatStringHandler {
Ted Kremeneke0e53132010-01-28 23:39:18 +00001038 Sema &S;
1039 const StringLiteral *FExpr;
1040 const Expr *OrigFormatExpr;
1041 unsigned NumConversions;
1042 const unsigned NumDataArgs;
1043 const bool IsObjCLiteral;
1044 const char *Beg; // Start of format string.
Ted Kremenek0d277352010-01-29 01:06:55 +00001045 const bool HasVAListArg;
1046 const CallExpr *TheCall;
1047 unsigned FormatIdx;
Ted Kremeneke0e53132010-01-28 23:39:18 +00001048public:
1049 CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
1050 const Expr *origFormatExpr,
1051 unsigned numDataArgs, bool isObjCLiteral,
Ted Kremenek0d277352010-01-29 01:06:55 +00001052 const char *beg, bool hasVAListArg,
1053 const CallExpr *theCall, unsigned formatIdx)
Ted Kremeneke0e53132010-01-28 23:39:18 +00001054 : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
1055 NumConversions(0), NumDataArgs(numDataArgs),
Ted Kremenek0d277352010-01-29 01:06:55 +00001056 IsObjCLiteral(isObjCLiteral), Beg(beg),
1057 HasVAListArg(hasVAListArg),
1058 TheCall(theCall), FormatIdx(formatIdx) {}
Ted Kremenek07d161f2010-01-29 01:50:07 +00001059
1060 void DoneProcessing();
Ted Kremenek808015a2010-01-29 03:16:21 +00001061
1062 void HandleIncompleteFormatSpecifier(const char *startSpecifier,
1063 unsigned specifierLen);
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001064
1065 void HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1066 const char *startSpecifier,
1067 unsigned specifierLen);
1068
Ted Kremeneke0e53132010-01-28 23:39:18 +00001069 void HandleNullChar(const char *nullCharacter);
1070
1071 bool HandleFormatSpecifier(const analyze_printf::FormatSpecifier &FS,
1072 const char *startSpecifier,
1073 unsigned specifierLen);
1074private:
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001075 SourceRange getFormatStringRange();
1076 SourceRange getFormatSpecifierRange(const char *startSpecifier,
1077 unsigned specifierLen);
Ted Kremeneke0e53132010-01-28 23:39:18 +00001078 SourceLocation getLocationOfByte(const char *x);
Ted Kremenek0d277352010-01-29 01:06:55 +00001079
1080 bool HandleAmount(const analyze_printf::OptionalAmount &Amt,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001081 unsigned MissingArgDiag, unsigned BadTypeDiag,
1082 const char *startSpecifier, unsigned specifierLen);
Ted Kremenek0d277352010-01-29 01:06:55 +00001083
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001084 bool MatchType(QualType A, QualType B, bool ignoreSign);
1085
Ted Kremenek0d277352010-01-29 01:06:55 +00001086 const Expr *getDataArg(unsigned i) const;
Ted Kremeneke0e53132010-01-28 23:39:18 +00001087};
1088}
1089
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001090SourceRange CheckPrintfHandler::getFormatStringRange() {
Ted Kremeneke0e53132010-01-28 23:39:18 +00001091 return OrigFormatExpr->getSourceRange();
1092}
1093
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001094SourceRange CheckPrintfHandler::
1095getFormatSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
1096 return SourceRange(getLocationOfByte(startSpecifier),
1097 getLocationOfByte(startSpecifier+specifierLen-1));
1098}
1099
Ted Kremeneke0e53132010-01-28 23:39:18 +00001100SourceLocation CheckPrintfHandler::getLocationOfByte(const char *x) {
1101 return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
1102}
1103
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001104void CheckPrintfHandler::
Ted Kremenek808015a2010-01-29 03:16:21 +00001105HandleIncompleteFormatSpecifier(const char *startSpecifier,
1106 unsigned specifierLen) {
1107 SourceLocation Loc = getLocationOfByte(startSpecifier);
1108 S.Diag(Loc, diag::warn_printf_incomplete_specifier)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001109 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek808015a2010-01-29 03:16:21 +00001110}
1111
1112void CheckPrintfHandler::
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001113HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1114 const char *startSpecifier,
1115 unsigned specifierLen) {
1116
1117 ++NumConversions;
Ted Kremenek808015a2010-01-29 03:16:21 +00001118 const analyze_printf::ConversionSpecifier &CS =
1119 FS.getConversionSpecifier();
1120 SourceLocation Loc = getLocationOfByte(CS.getStart());
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001121 S.Diag(Loc, diag::warn_printf_invalid_conversion)
Ted Kremenek808015a2010-01-29 03:16:21 +00001122 << llvm::StringRef(CS.getStart(), CS.getLength())
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001123 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001124}
1125
Ted Kremeneke0e53132010-01-28 23:39:18 +00001126void CheckPrintfHandler::HandleNullChar(const char *nullCharacter) {
1127 // The presence of a null character is likely an error.
1128 S.Diag(getLocationOfByte(nullCharacter),
1129 diag::warn_printf_format_string_contains_null_char)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001130 << getFormatStringRange();
Ted Kremeneke0e53132010-01-28 23:39:18 +00001131}
1132
Ted Kremenek0d277352010-01-29 01:06:55 +00001133const Expr *CheckPrintfHandler::getDataArg(unsigned i) const {
1134 return TheCall->getArg(FormatIdx + i);
1135}
1136
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001137bool CheckPrintfHandler::MatchType(QualType A, QualType B, bool ignoreSign) {
1138 A = S.Context.getCanonicalType(A).getUnqualifiedType();
1139 B = S.Context.getCanonicalType(B).getUnqualifiedType();
1140
1141 if (A == B)
1142 return true;
1143
1144 if (ignoreSign) {
1145 if (const BuiltinType *BT = B->getAs<BuiltinType>()) {
1146 switch (BT->getKind()) {
1147 default:
1148 return false;
1149 case BuiltinType::Char_S:
1150 case BuiltinType::SChar:
1151 return A == S.Context.UnsignedCharTy;
1152 case BuiltinType::Char_U:
1153 case BuiltinType::UChar:
1154 return A == S.Context.SignedCharTy;
1155 case BuiltinType::Short:
1156 return A == S.Context.UnsignedShortTy;
1157 case BuiltinType::UShort:
1158 return A == S.Context.ShortTy;
1159 case BuiltinType::Int:
1160 return A == S.Context.UnsignedIntTy;
1161 case BuiltinType::UInt:
1162 return A == S.Context.IntTy;
1163 case BuiltinType::Long:
1164 return A == S.Context.UnsignedLongTy;
1165 case BuiltinType::ULong:
1166 return A == S.Context.LongTy;
1167 case BuiltinType::LongLong:
1168 return A == S.Context.UnsignedLongLongTy;
1169 case BuiltinType::ULongLong:
1170 return A == S.Context.LongLongTy;
1171 }
1172 return A == B;
1173 }
1174 }
1175 return false;
1176}
1177
Ted Kremenek0d277352010-01-29 01:06:55 +00001178bool
1179CheckPrintfHandler::HandleAmount(const analyze_printf::OptionalAmount &Amt,
1180 unsigned MissingArgDiag,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001181 unsigned BadTypeDiag,
1182 const char *startSpecifier,
1183 unsigned specifierLen) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001184
1185 if (Amt.hasDataArgument()) {
1186 ++NumConversions;
1187 if (!HasVAListArg) {
1188 if (NumConversions > NumDataArgs) {
1189 S.Diag(getLocationOfByte(Amt.getStart()), MissingArgDiag)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001190 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek0d277352010-01-29 01:06:55 +00001191 // Don't do any more checking. We will just emit
1192 // spurious errors.
1193 return false;
1194 }
1195
1196 // Type check the data argument. It should be an 'int'.
Ted Kremenek31f8e322010-01-29 23:32:22 +00001197 // Although not in conformance with C99, we also allow the argument to be
1198 // an 'unsigned int' as that is a reasonably safe case. GCC also
1199 // doesn't emit a warning for that case.
Ted Kremenek0d277352010-01-29 01:06:55 +00001200 const Expr *Arg = getDataArg(NumConversions);
1201 QualType T = Arg->getType();
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001202 if (!MatchType(T, S.Context.IntTy, true)) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001203 S.Diag(getLocationOfByte(Amt.getStart()), BadTypeDiag)
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001204 << S.Context.IntTy << T
1205 << getFormatSpecifierRange(startSpecifier, specifierLen)
1206 << Arg->getSourceRange();
Ted Kremenek0d277352010-01-29 01:06:55 +00001207 // Don't do any more checking. We will just emit
1208 // spurious errors.
1209 return false;
1210 }
1211 }
1212 }
1213 return true;
1214}
Ted Kremenek0d277352010-01-29 01:06:55 +00001215
Ted Kremeneke0e53132010-01-28 23:39:18 +00001216bool
1217CheckPrintfHandler::HandleFormatSpecifier(const analyze_printf::FormatSpecifier &FS,
1218 const char *startSpecifier,
1219 unsigned specifierLen) {
1220
1221 using namespace analyze_printf;
1222 const ConversionSpecifier &CS = FS.getConversionSpecifier();
1223
Ted Kremenek0d277352010-01-29 01:06:55 +00001224 // First check if the field width, precision, and conversion specifier
1225 // have matching data arguments.
1226 if (!HandleAmount(FS.getFieldWidth(),
1227 diag::warn_printf_asterisk_width_missing_arg,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001228 diag::warn_printf_asterisk_width_wrong_type,
1229 startSpecifier, specifierLen)) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001230 return false;
1231 }
1232
1233 if (!HandleAmount(FS.getPrecision(),
1234 diag::warn_printf_asterisk_precision_missing_arg,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001235 diag::warn_printf_asterisk_precision_wrong_type,
1236 startSpecifier, specifierLen)) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001237 return false;
1238 }
1239
Ted Kremeneke0e53132010-01-28 23:39:18 +00001240 // Check for using an Objective-C specific conversion specifier
1241 // in a non-ObjC literal.
1242 if (!IsObjCLiteral && CS.isObjCArg()) {
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001243 HandleInvalidConversionSpecifier(FS, startSpecifier, specifierLen);
Ted Kremeneke0e53132010-01-28 23:39:18 +00001244
1245 // Continue checking the other format specifiers.
1246 return true;
1247 }
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001248
1249 if (!CS.consumesDataArgument()) {
1250 // FIXME: Technically specifying a precision or field width here
1251 // makes no sense. Worth issuing a warning at some point.
1252 return true;
1253 }
Ted Kremeneke82d8042010-01-29 01:35:25 +00001254
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001255 ++NumConversions;
1256
Ted Kremeneke82d8042010-01-29 01:35:25 +00001257 // Are we using '%n'? Issue a warning about this being
1258 // a possible security issue.
1259 if (CS.getKind() == ConversionSpecifier::OutIntPtrArg) {
1260 S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_write_back)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001261 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremeneke82d8042010-01-29 01:35:25 +00001262 // Continue checking the other format specifiers.
1263 return true;
1264 }
1265
Ted Kremenekda51f0d2010-01-29 01:43:31 +00001266
1267 // The remaining checks depend on the data arguments.
1268 if (HasVAListArg)
1269 return true;
1270
1271 if (NumConversions > NumDataArgs) {
1272 S.Diag(getLocationOfByte(CS.getStart()),
1273 diag::warn_printf_insufficient_data_args)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001274 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenekda51f0d2010-01-29 01:43:31 +00001275 // Don't do any more checking.
1276 return false;
1277 }
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001278
1279 // Now type check the data expression that matches the
1280 // format specifier.
1281 const Expr *Ex = getDataArg(NumConversions);
1282 const analyze_printf::ArgTypeResult &ATR = FS.getArgType(S.Context);
Ted Kremenek180f2842010-02-01 19:28:15 +00001283
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001284 if (const QualType *T = ATR.getSpecificType()) {
1285 if (!MatchType(*T, Ex->getType(), true)) {
Ted Kremenek180f2842010-02-01 19:28:15 +00001286 // Check if we didn't match because of an implicit cast from a 'char'
1287 // or 'short' to an 'int'. This is done because printf is a varargs
1288 // function.
1289 bool hasError = true;
1290 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Ex))
1291 if (ICE->getType() == S.Context.IntTy) {
1292 Ex = ICE->getSubExpr();
1293 hasError = !MatchType(*T, Ex->getType(), true);
1294 }
1295
1296 if (hasError)
1297 S.Diag(getLocationOfByte(CS.getStart()),
1298 diag::warn_printf_conversion_argument_type_mismatch)
1299 << *T << Ex->getType()
1300 << getFormatSpecifierRange(startSpecifier, specifierLen)
1301 << Ex->getSourceRange();
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001302 }
1303 return true;
1304 }
Ted Kremeneke0e53132010-01-28 23:39:18 +00001305
1306 return true;
1307}
1308
Ted Kremenek07d161f2010-01-29 01:50:07 +00001309void CheckPrintfHandler::DoneProcessing() {
1310 // Does the number of data arguments exceed the number of
1311 // format conversions in the format string?
1312 if (!HasVAListArg && NumConversions < NumDataArgs)
1313 S.Diag(getDataArg(NumConversions+1)->getLocStart(),
1314 diag::warn_printf_too_many_data_args)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001315 << getFormatStringRange();
Ted Kremenek07d161f2010-01-29 01:50:07 +00001316}
Ted Kremeneke0e53132010-01-28 23:39:18 +00001317
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001318void Sema::CheckPrintfString(const StringLiteral *FExpr,
1319 const Expr *OrigFormatExpr,
1320 const CallExpr *TheCall, bool HasVAListArg,
1321 unsigned format_idx, unsigned firstDataArg) {
Ted Kremenekce7024e2010-01-28 01:18:22 +00001322
Ted Kremeneke0e53132010-01-28 23:39:18 +00001323 // CHECK: is the format string a wide literal?
1324 if (FExpr->isWide()) {
1325 Diag(FExpr->getLocStart(),
1326 diag::warn_printf_format_string_is_wide_literal)
1327 << OrigFormatExpr->getSourceRange();
1328 return;
1329 }
Ted Kremenekce7024e2010-01-28 01:18:22 +00001330
Ted Kremeneke0e53132010-01-28 23:39:18 +00001331 // Str - The format string. NOTE: this is NOT null-terminated!
1332 const char *Str = FExpr->getStrData();
1333
1334 // CHECK: empty format string?
1335 unsigned StrLen = FExpr->getByteLength();
1336
1337 if (StrLen == 0) {
1338 Diag(FExpr->getLocStart(), diag::warn_printf_empty_format_string)
1339 << OrigFormatExpr->getSourceRange();
1340 return;
1341 }
1342
1343 CheckPrintfHandler H(*this, FExpr, OrigFormatExpr,
1344 TheCall->getNumArgs() - firstDataArg,
Ted Kremenek0d277352010-01-29 01:06:55 +00001345 isa<ObjCStringLiteral>(OrigFormatExpr), Str,
1346 HasVAListArg, TheCall, format_idx);
Ted Kremeneke0e53132010-01-28 23:39:18 +00001347
Ted Kremenek808015a2010-01-29 03:16:21 +00001348 if (!ParseFormatString(H, Str, Str + StrLen))
1349 H.DoneProcessing();
Ted Kremenekce7024e2010-01-28 01:18:22 +00001350}
1351
Ted Kremenek06de2762007-08-17 16:46:58 +00001352//===--- CHECK: Return Address of Stack Variable --------------------------===//
1353
1354static DeclRefExpr* EvalVal(Expr *E);
1355static DeclRefExpr* EvalAddr(Expr* E);
1356
1357/// CheckReturnStackAddr - Check if a return statement returns the address
1358/// of a stack variable.
1359void
1360Sema::CheckReturnStackAddr(Expr *RetValExp, QualType lhsType,
1361 SourceLocation ReturnLoc) {
Mike Stump1eb44332009-09-09 15:08:12 +00001362
Ted Kremenek06de2762007-08-17 16:46:58 +00001363 // Perform checking for returned stack addresses.
Steve Naroffdd972f22008-09-05 22:11:13 +00001364 if (lhsType->isPointerType() || lhsType->isBlockPointerType()) {
Ted Kremenek06de2762007-08-17 16:46:58 +00001365 if (DeclRefExpr *DR = EvalAddr(RetValExp))
Chris Lattner3c73c412008-11-19 08:23:25 +00001366 Diag(DR->getLocStart(), diag::warn_ret_stack_addr)
Chris Lattner08631c52008-11-23 21:45:46 +00001367 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +00001368
Steve Naroffc50a4a52008-09-16 22:25:10 +00001369 // Skip over implicit cast expressions when checking for block expressions.
Chris Lattner4ca606e2009-09-08 00:36:37 +00001370 RetValExp = RetValExp->IgnoreParenCasts();
Steve Naroffc50a4a52008-09-16 22:25:10 +00001371
Chris Lattner9e6b37a2009-10-30 04:01:58 +00001372 if (BlockExpr *C = dyn_cast<BlockExpr>(RetValExp))
Mike Stump397195b2009-04-17 00:09:41 +00001373 if (C->hasBlockDeclRefExprs())
1374 Diag(C->getLocStart(), diag::err_ret_local_block)
1375 << C->getSourceRange();
Chris Lattner9e6b37a2009-10-30 04:01:58 +00001376
1377 if (AddrLabelExpr *ALE = dyn_cast<AddrLabelExpr>(RetValExp))
1378 Diag(ALE->getLocStart(), diag::warn_ret_addr_label)
1379 << ALE->getSourceRange();
1380
Mike Stumpac5fc7c2009-08-04 21:02:39 +00001381 } else if (lhsType->isReferenceType()) {
1382 // Perform checking for stack values returned by reference.
Douglas Gregor49badde2008-10-27 19:41:14 +00001383 // Check for a reference to the stack
1384 if (DeclRefExpr *DR = EvalVal(RetValExp))
Chris Lattnerdcd5ef12008-11-19 05:27:50 +00001385 Diag(DR->getLocStart(), diag::warn_ret_stack_ref)
Chris Lattner08631c52008-11-23 21:45:46 +00001386 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
Ted Kremenek06de2762007-08-17 16:46:58 +00001387 }
1388}
1389
1390/// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
1391/// check if the expression in a return statement evaluates to an address
1392/// to a location on the stack. The recursion is used to traverse the
1393/// AST of the return expression, with recursion backtracking when we
1394/// encounter a subexpression that (1) clearly does not lead to the address
1395/// of a stack variable or (2) is something we cannot determine leads to
1396/// the address of a stack variable based on such local checking.
1397///
Ted Kremeneke8c600f2007-08-28 17:02:55 +00001398/// EvalAddr processes expressions that are pointers that are used as
1399/// references (and not L-values). EvalVal handles all other values.
Mike Stump1eb44332009-09-09 15:08:12 +00001400/// At the base case of the recursion is a check for a DeclRefExpr* in
Ted Kremenek06de2762007-08-17 16:46:58 +00001401/// the refers to a stack variable.
1402///
1403/// This implementation handles:
1404///
1405/// * pointer-to-pointer casts
1406/// * implicit conversions from array references to pointers
1407/// * taking the address of fields
1408/// * arbitrary interplay between "&" and "*" operators
1409/// * pointer arithmetic from an address of a stack variable
1410/// * taking the address of an array element where the array is on the stack
1411static DeclRefExpr* EvalAddr(Expr *E) {
Ted Kremenek06de2762007-08-17 16:46:58 +00001412 // We should only be called for evaluating pointer expressions.
David Chisnall0f436562009-08-17 16:35:33 +00001413 assert((E->getType()->isAnyPointerType() ||
Steve Naroffdd972f22008-09-05 22:11:13 +00001414 E->getType()->isBlockPointerType() ||
Ted Kremeneka526c5c2008-01-07 19:49:32 +00001415 E->getType()->isObjCQualifiedIdType()) &&
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001416 "EvalAddr only works on pointers");
Mike Stump1eb44332009-09-09 15:08:12 +00001417
Ted Kremenek06de2762007-08-17 16:46:58 +00001418 // Our "symbolic interpreter" is just a dispatch off the currently
1419 // viewed AST node. We then recursively traverse the AST by calling
1420 // EvalAddr and EvalVal appropriately.
1421 switch (E->getStmtClass()) {
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001422 case Stmt::ParenExprClass:
1423 // Ignore parentheses.
1424 return EvalAddr(cast<ParenExpr>(E)->getSubExpr());
Ted Kremenek06de2762007-08-17 16:46:58 +00001425
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001426 case Stmt::UnaryOperatorClass: {
1427 // The only unary operator that make sense to handle here
1428 // is AddrOf. All others don't make sense as pointers.
1429 UnaryOperator *U = cast<UnaryOperator>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001430
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001431 if (U->getOpcode() == UnaryOperator::AddrOf)
1432 return EvalVal(U->getSubExpr());
1433 else
Ted Kremenek06de2762007-08-17 16:46:58 +00001434 return NULL;
1435 }
Mike Stump1eb44332009-09-09 15:08:12 +00001436
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001437 case Stmt::BinaryOperatorClass: {
1438 // Handle pointer arithmetic. All other binary operators are not valid
1439 // in this context.
1440 BinaryOperator *B = cast<BinaryOperator>(E);
1441 BinaryOperator::Opcode op = B->getOpcode();
Mike Stump1eb44332009-09-09 15:08:12 +00001442
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001443 if (op != BinaryOperator::Add && op != BinaryOperator::Sub)
1444 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001445
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001446 Expr *Base = B->getLHS();
1447
1448 // Determine which argument is the real pointer base. It could be
1449 // the RHS argument instead of the LHS.
1450 if (!Base->getType()->isPointerType()) Base = B->getRHS();
Mike Stump1eb44332009-09-09 15:08:12 +00001451
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001452 assert (Base->getType()->isPointerType());
1453 return EvalAddr(Base);
1454 }
Steve Naroff61f40a22008-09-10 19:17:48 +00001455
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001456 // For conditional operators we need to see if either the LHS or RHS are
1457 // valid DeclRefExpr*s. If one of them is valid, we return it.
1458 case Stmt::ConditionalOperatorClass: {
1459 ConditionalOperator *C = cast<ConditionalOperator>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001460
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001461 // Handle the GNU extension for missing LHS.
1462 if (Expr *lhsExpr = C->getLHS())
1463 if (DeclRefExpr* LHS = EvalAddr(lhsExpr))
1464 return LHS;
1465
1466 return EvalAddr(C->getRHS());
1467 }
Mike Stump1eb44332009-09-09 15:08:12 +00001468
Ted Kremenek54b52742008-08-07 00:49:01 +00001469 // For casts, we need to handle conversions from arrays to
1470 // pointer values, and pointer-to-pointer conversions.
Douglas Gregor49badde2008-10-27 19:41:14 +00001471 case Stmt::ImplicitCastExprClass:
Douglas Gregor6eec8e82008-10-28 15:36:24 +00001472 case Stmt::CStyleCastExprClass:
Douglas Gregor49badde2008-10-27 19:41:14 +00001473 case Stmt::CXXFunctionalCastExprClass: {
Argyrios Kyrtzidis0835a3c2008-08-18 23:01:59 +00001474 Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
Ted Kremenek54b52742008-08-07 00:49:01 +00001475 QualType T = SubExpr->getType();
Mike Stump1eb44332009-09-09 15:08:12 +00001476
Steve Naroffdd972f22008-09-05 22:11:13 +00001477 if (SubExpr->getType()->isPointerType() ||
1478 SubExpr->getType()->isBlockPointerType() ||
1479 SubExpr->getType()->isObjCQualifiedIdType())
Ted Kremenek54b52742008-08-07 00:49:01 +00001480 return EvalAddr(SubExpr);
1481 else if (T->isArrayType())
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001482 return EvalVal(SubExpr);
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001483 else
Ted Kremenek54b52742008-08-07 00:49:01 +00001484 return 0;
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001485 }
Mike Stump1eb44332009-09-09 15:08:12 +00001486
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001487 // C++ casts. For dynamic casts, static casts, and const casts, we
1488 // are always converting from a pointer-to-pointer, so we just blow
Douglas Gregor49badde2008-10-27 19:41:14 +00001489 // through the cast. In the case the dynamic cast doesn't fail (and
1490 // return NULL), we take the conservative route and report cases
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001491 // where we return the address of a stack variable. For Reinterpre
Douglas Gregor49badde2008-10-27 19:41:14 +00001492 // FIXME: The comment about is wrong; we're not always converting
1493 // from pointer to pointer. I'm guessing that this code should also
Mike Stump1eb44332009-09-09 15:08:12 +00001494 // handle references to objects.
1495 case Stmt::CXXStaticCastExprClass:
1496 case Stmt::CXXDynamicCastExprClass:
Douglas Gregor49badde2008-10-27 19:41:14 +00001497 case Stmt::CXXConstCastExprClass:
1498 case Stmt::CXXReinterpretCastExprClass: {
1499 Expr *S = cast<CXXNamedCastExpr>(E)->getSubExpr();
Steve Naroffdd972f22008-09-05 22:11:13 +00001500 if (S->getType()->isPointerType() || S->getType()->isBlockPointerType())
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001501 return EvalAddr(S);
1502 else
1503 return NULL;
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001504 }
Mike Stump1eb44332009-09-09 15:08:12 +00001505
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001506 // Everything else: we simply don't reason about them.
1507 default:
1508 return NULL;
1509 }
Ted Kremenek06de2762007-08-17 16:46:58 +00001510}
Mike Stump1eb44332009-09-09 15:08:12 +00001511
Ted Kremenek06de2762007-08-17 16:46:58 +00001512
1513/// EvalVal - This function is complements EvalAddr in the mutual recursion.
1514/// See the comments for EvalAddr for more details.
1515static DeclRefExpr* EvalVal(Expr *E) {
Mike Stump1eb44332009-09-09 15:08:12 +00001516
Ted Kremeneke8c600f2007-08-28 17:02:55 +00001517 // We should only be called for evaluating non-pointer expressions, or
1518 // expressions with a pointer type that are not used as references but instead
1519 // are l-values (e.g., DeclRefExpr with a pointer type).
Mike Stump1eb44332009-09-09 15:08:12 +00001520
Ted Kremenek06de2762007-08-17 16:46:58 +00001521 // Our "symbolic interpreter" is just a dispatch off the currently
1522 // viewed AST node. We then recursively traverse the AST by calling
1523 // EvalAddr and EvalVal appropriately.
1524 switch (E->getStmtClass()) {
Douglas Gregora2813ce2009-10-23 18:54:35 +00001525 case Stmt::DeclRefExprClass: {
Ted Kremenek06de2762007-08-17 16:46:58 +00001526 // DeclRefExpr: the base case. When we hit a DeclRefExpr we are looking
1527 // at code that refers to a variable's name. We check if it has local
1528 // storage within the function, and if so, return the expression.
1529 DeclRefExpr *DR = cast<DeclRefExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001530
Ted Kremenek06de2762007-08-17 16:46:58 +00001531 if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
Mike Stump1eb44332009-09-09 15:08:12 +00001532 if (V->hasLocalStorage() && !V->getType()->isReferenceType()) return DR;
1533
Ted Kremenek06de2762007-08-17 16:46:58 +00001534 return NULL;
1535 }
Mike Stump1eb44332009-09-09 15:08:12 +00001536
Ted Kremenek06de2762007-08-17 16:46:58 +00001537 case Stmt::ParenExprClass:
1538 // Ignore parentheses.
1539 return EvalVal(cast<ParenExpr>(E)->getSubExpr());
Mike Stump1eb44332009-09-09 15:08:12 +00001540
Ted Kremenek06de2762007-08-17 16:46:58 +00001541 case Stmt::UnaryOperatorClass: {
1542 // The only unary operator that make sense to handle here
1543 // is Deref. All others don't resolve to a "name." This includes
1544 // handling all sorts of rvalues passed to a unary operator.
1545 UnaryOperator *U = cast<UnaryOperator>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001546
Ted Kremenek06de2762007-08-17 16:46:58 +00001547 if (U->getOpcode() == UnaryOperator::Deref)
1548 return EvalAddr(U->getSubExpr());
1549
1550 return NULL;
1551 }
Mike Stump1eb44332009-09-09 15:08:12 +00001552
Ted Kremenek06de2762007-08-17 16:46:58 +00001553 case Stmt::ArraySubscriptExprClass: {
1554 // Array subscripts are potential references to data on the stack. We
1555 // retrieve the DeclRefExpr* for the array variable if it indeed
1556 // has local storage.
Ted Kremenek23245122007-08-20 16:18:38 +00001557 return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase());
Ted Kremenek06de2762007-08-17 16:46:58 +00001558 }
Mike Stump1eb44332009-09-09 15:08:12 +00001559
Ted Kremenek06de2762007-08-17 16:46:58 +00001560 case Stmt::ConditionalOperatorClass: {
1561 // For conditional operators we need to see if either the LHS or RHS are
1562 // non-NULL DeclRefExpr's. If one is non-NULL, we return it.
1563 ConditionalOperator *C = cast<ConditionalOperator>(E);
1564
Anders Carlsson39073232007-11-30 19:04:31 +00001565 // Handle the GNU extension for missing LHS.
1566 if (Expr *lhsExpr = C->getLHS())
1567 if (DeclRefExpr *LHS = EvalVal(lhsExpr))
1568 return LHS;
1569
1570 return EvalVal(C->getRHS());
Ted Kremenek06de2762007-08-17 16:46:58 +00001571 }
Mike Stump1eb44332009-09-09 15:08:12 +00001572
Ted Kremenek06de2762007-08-17 16:46:58 +00001573 // Accesses to members are potential references to data on the stack.
Douglas Gregor83f6faf2009-08-31 23:41:50 +00001574 case Stmt::MemberExprClass: {
Ted Kremenek06de2762007-08-17 16:46:58 +00001575 MemberExpr *M = cast<MemberExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001576
Ted Kremenek06de2762007-08-17 16:46:58 +00001577 // Check for indirect access. We only want direct field accesses.
1578 if (!M->isArrow())
1579 return EvalVal(M->getBase());
1580 else
1581 return NULL;
1582 }
Mike Stump1eb44332009-09-09 15:08:12 +00001583
Ted Kremenek06de2762007-08-17 16:46:58 +00001584 // Everything else: we simply don't reason about them.
1585 default:
1586 return NULL;
1587 }
1588}
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001589
1590//===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
1591
1592/// Check for comparisons of floating point operands using != and ==.
1593/// Issue a warning if these are no self-comparisons, as they are not likely
1594/// to do what the programmer intended.
1595void Sema::CheckFloatComparison(SourceLocation loc, Expr* lex, Expr *rex) {
1596 bool EmitWarning = true;
Mike Stump1eb44332009-09-09 15:08:12 +00001597
Ted Kremenek4e99a5f2008-01-17 16:57:34 +00001598 Expr* LeftExprSansParen = lex->IgnoreParens();
Ted Kremenek32e97b62008-01-17 17:55:13 +00001599 Expr* RightExprSansParen = rex->IgnoreParens();
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001600
1601 // Special case: check for x == x (which is OK).
1602 // Do not emit warnings for such cases.
1603 if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
1604 if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
1605 if (DRL->getDecl() == DRR->getDecl())
1606 EmitWarning = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001607
1608
Ted Kremenek1b500bb2007-11-29 00:59:04 +00001609 // Special case: check for comparisons against literals that can be exactly
1610 // represented by APFloat. In such cases, do not emit a warning. This
1611 // is a heuristic: often comparison against such literals are used to
1612 // detect if a value in a variable has not changed. This clearly can
1613 // lead to false negatives.
1614 if (EmitWarning) {
1615 if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
1616 if (FLL->isExact())
1617 EmitWarning = false;
Mike Stumpac5fc7c2009-08-04 21:02:39 +00001618 } else
Ted Kremenek1b500bb2007-11-29 00:59:04 +00001619 if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)){
1620 if (FLR->isExact())
1621 EmitWarning = false;
1622 }
1623 }
Mike Stump1eb44332009-09-09 15:08:12 +00001624
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001625 // Check for comparisons with builtin types.
Sebastian Redl0eb23302009-01-19 00:08:26 +00001626 if (EmitWarning)
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001627 if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
Douglas Gregor3c385e52009-02-14 18:57:46 +00001628 if (CL->isBuiltinCall(Context))
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001629 EmitWarning = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001630
Sebastian Redl0eb23302009-01-19 00:08:26 +00001631 if (EmitWarning)
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001632 if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
Douglas Gregor3c385e52009-02-14 18:57:46 +00001633 if (CR->isBuiltinCall(Context))
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001634 EmitWarning = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001635
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001636 // Emit the diagnostic.
1637 if (EmitWarning)
Chris Lattnerfa25bbb2008-11-19 05:08:23 +00001638 Diag(loc, diag::warn_floatingpoint_eq)
1639 << lex->getSourceRange() << rex->getSourceRange();
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001640}
John McCallba26e582010-01-04 23:21:16 +00001641
John McCallf2370c92010-01-06 05:24:50 +00001642//===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
1643//===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
John McCallba26e582010-01-04 23:21:16 +00001644
John McCallf2370c92010-01-06 05:24:50 +00001645namespace {
John McCallba26e582010-01-04 23:21:16 +00001646
John McCallf2370c92010-01-06 05:24:50 +00001647/// Structure recording the 'active' range of an integer-valued
1648/// expression.
1649struct IntRange {
1650 /// The number of bits active in the int.
1651 unsigned Width;
John McCallba26e582010-01-04 23:21:16 +00001652
John McCallf2370c92010-01-06 05:24:50 +00001653 /// True if the int is known not to have negative values.
1654 bool NonNegative;
John McCallba26e582010-01-04 23:21:16 +00001655
John McCallf2370c92010-01-06 05:24:50 +00001656 IntRange() {}
1657 IntRange(unsigned Width, bool NonNegative)
1658 : Width(Width), NonNegative(NonNegative)
1659 {}
John McCallba26e582010-01-04 23:21:16 +00001660
John McCallf2370c92010-01-06 05:24:50 +00001661 // Returns the range of the bool type.
1662 static IntRange forBoolType() {
1663 return IntRange(1, true);
John McCall51313c32010-01-04 23:31:57 +00001664 }
1665
John McCallf2370c92010-01-06 05:24:50 +00001666 // Returns the range of an integral type.
1667 static IntRange forType(ASTContext &C, QualType T) {
1668 return forCanonicalType(C, T->getCanonicalTypeInternal().getTypePtr());
John McCall51313c32010-01-04 23:31:57 +00001669 }
1670
John McCallf2370c92010-01-06 05:24:50 +00001671 // Returns the range of an integeral type based on its canonical
1672 // representation.
1673 static IntRange forCanonicalType(ASTContext &C, const Type *T) {
1674 assert(T->isCanonicalUnqualified());
1675
1676 if (const VectorType *VT = dyn_cast<VectorType>(T))
1677 T = VT->getElementType().getTypePtr();
1678 if (const ComplexType *CT = dyn_cast<ComplexType>(T))
1679 T = CT->getElementType().getTypePtr();
1680 if (const EnumType *ET = dyn_cast<EnumType>(T))
1681 T = ET->getDecl()->getIntegerType().getTypePtr();
1682
1683 const BuiltinType *BT = cast<BuiltinType>(T);
1684 assert(BT->isInteger());
1685
1686 return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
1687 }
1688
1689 // Returns the supremum of two ranges: i.e. their conservative merge.
1690 static IntRange join(const IntRange &L, const IntRange &R) {
1691 return IntRange(std::max(L.Width, R.Width),
John McCall60fad452010-01-06 22:07:33 +00001692 L.NonNegative && R.NonNegative);
1693 }
1694
1695 // Returns the infinum of two ranges: i.e. their aggressive merge.
1696 static IntRange meet(const IntRange &L, const IntRange &R) {
1697 return IntRange(std::min(L.Width, R.Width),
1698 L.NonNegative || R.NonNegative);
John McCallf2370c92010-01-06 05:24:50 +00001699 }
1700};
1701
1702IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, unsigned MaxWidth) {
1703 if (value.isSigned() && value.isNegative())
1704 return IntRange(value.getMinSignedBits(), false);
1705
1706 if (value.getBitWidth() > MaxWidth)
1707 value.trunc(MaxWidth);
1708
1709 // isNonNegative() just checks the sign bit without considering
1710 // signedness.
1711 return IntRange(value.getActiveBits(), true);
1712}
1713
John McCall0acc3112010-01-06 22:57:21 +00001714IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
John McCallf2370c92010-01-06 05:24:50 +00001715 unsigned MaxWidth) {
1716 if (result.isInt())
1717 return GetValueRange(C, result.getInt(), MaxWidth);
1718
1719 if (result.isVector()) {
John McCall0acc3112010-01-06 22:57:21 +00001720 IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
1721 for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
1722 IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
1723 R = IntRange::join(R, El);
1724 }
John McCallf2370c92010-01-06 05:24:50 +00001725 return R;
1726 }
1727
1728 if (result.isComplexInt()) {
1729 IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
1730 IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
1731 return IntRange::join(R, I);
John McCall51313c32010-01-04 23:31:57 +00001732 }
1733
1734 // This can happen with lossless casts to intptr_t of "based" lvalues.
1735 // Assume it might use arbitrary bits.
John McCall0acc3112010-01-06 22:57:21 +00001736 // FIXME: The only reason we need to pass the type in here is to get
1737 // the sign right on this one case. It would be nice if APValue
1738 // preserved this.
John McCallf2370c92010-01-06 05:24:50 +00001739 assert(result.isLValue());
John McCall0acc3112010-01-06 22:57:21 +00001740 return IntRange(MaxWidth, Ty->isUnsignedIntegerType());
John McCall51313c32010-01-04 23:31:57 +00001741}
John McCallf2370c92010-01-06 05:24:50 +00001742
1743/// Pseudo-evaluate the given integer expression, estimating the
1744/// range of values it might take.
1745///
1746/// \param MaxWidth - the width to which the value will be truncated
1747IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
1748 E = E->IgnoreParens();
1749
1750 // Try a full evaluation first.
1751 Expr::EvalResult result;
1752 if (E->Evaluate(result, C))
John McCall0acc3112010-01-06 22:57:21 +00001753 return GetValueRange(C, result.Val, E->getType(), MaxWidth);
John McCallf2370c92010-01-06 05:24:50 +00001754
1755 // I think we only want to look through implicit casts here; if the
1756 // user has an explicit widening cast, we should treat the value as
1757 // being of the new, wider type.
1758 if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
1759 if (CE->getCastKind() == CastExpr::CK_NoOp)
1760 return GetExprRange(C, CE->getSubExpr(), MaxWidth);
1761
1762 IntRange OutputTypeRange = IntRange::forType(C, CE->getType());
1763
John McCall60fad452010-01-06 22:07:33 +00001764 bool isIntegerCast = (CE->getCastKind() == CastExpr::CK_IntegralCast);
1765 if (!isIntegerCast && CE->getCastKind() == CastExpr::CK_Unknown)
1766 isIntegerCast = CE->getSubExpr()->getType()->isIntegerType();
1767
John McCallf2370c92010-01-06 05:24:50 +00001768 // Assume that non-integer casts can span the full range of the type.
John McCall60fad452010-01-06 22:07:33 +00001769 if (!isIntegerCast)
John McCallf2370c92010-01-06 05:24:50 +00001770 return OutputTypeRange;
1771
1772 IntRange SubRange
1773 = GetExprRange(C, CE->getSubExpr(),
1774 std::min(MaxWidth, OutputTypeRange.Width));
1775
1776 // Bail out if the subexpr's range is as wide as the cast type.
1777 if (SubRange.Width >= OutputTypeRange.Width)
1778 return OutputTypeRange;
1779
1780 // Otherwise, we take the smaller width, and we're non-negative if
1781 // either the output type or the subexpr is.
1782 return IntRange(SubRange.Width,
1783 SubRange.NonNegative || OutputTypeRange.NonNegative);
1784 }
1785
1786 if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
1787 // If we can fold the condition, just take that operand.
1788 bool CondResult;
1789 if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
1790 return GetExprRange(C, CondResult ? CO->getTrueExpr()
1791 : CO->getFalseExpr(),
1792 MaxWidth);
1793
1794 // Otherwise, conservatively merge.
1795 IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
1796 IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
1797 return IntRange::join(L, R);
1798 }
1799
1800 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
1801 switch (BO->getOpcode()) {
1802
1803 // Boolean-valued operations are single-bit and positive.
1804 case BinaryOperator::LAnd:
1805 case BinaryOperator::LOr:
1806 case BinaryOperator::LT:
1807 case BinaryOperator::GT:
1808 case BinaryOperator::LE:
1809 case BinaryOperator::GE:
1810 case BinaryOperator::EQ:
1811 case BinaryOperator::NE:
1812 return IntRange::forBoolType();
1813
1814 // Operations with opaque sources are black-listed.
1815 case BinaryOperator::PtrMemD:
1816 case BinaryOperator::PtrMemI:
1817 return IntRange::forType(C, E->getType());
1818
John McCall60fad452010-01-06 22:07:33 +00001819 // Bitwise-and uses the *infinum* of the two source ranges.
1820 case BinaryOperator::And:
1821 return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
1822 GetExprRange(C, BO->getRHS(), MaxWidth));
1823
John McCallf2370c92010-01-06 05:24:50 +00001824 // Left shift gets black-listed based on a judgement call.
1825 case BinaryOperator::Shl:
1826 return IntRange::forType(C, E->getType());
1827
John McCall60fad452010-01-06 22:07:33 +00001828 // Right shift by a constant can narrow its left argument.
1829 case BinaryOperator::Shr: {
1830 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1831
1832 // If the shift amount is a positive constant, drop the width by
1833 // that much.
1834 llvm::APSInt shift;
1835 if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
1836 shift.isNonNegative()) {
1837 unsigned zext = shift.getZExtValue();
1838 if (zext >= L.Width)
1839 L.Width = (L.NonNegative ? 0 : 1);
1840 else
1841 L.Width -= zext;
1842 }
1843
1844 return L;
1845 }
1846
1847 // Comma acts as its right operand.
John McCallf2370c92010-01-06 05:24:50 +00001848 case BinaryOperator::Comma:
1849 return GetExprRange(C, BO->getRHS(), MaxWidth);
1850
John McCall60fad452010-01-06 22:07:33 +00001851 // Black-list pointer subtractions.
John McCallf2370c92010-01-06 05:24:50 +00001852 case BinaryOperator::Sub:
1853 if (BO->getLHS()->getType()->isPointerType())
1854 return IntRange::forType(C, E->getType());
1855 // fallthrough
1856
1857 default:
1858 break;
1859 }
1860
1861 // Treat every other operator as if it were closed on the
1862 // narrowest type that encompasses both operands.
1863 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1864 IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
1865 return IntRange::join(L, R);
1866 }
1867
1868 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
1869 switch (UO->getOpcode()) {
1870 // Boolean-valued operations are white-listed.
1871 case UnaryOperator::LNot:
1872 return IntRange::forBoolType();
1873
1874 // Operations with opaque sources are black-listed.
1875 case UnaryOperator::Deref:
1876 case UnaryOperator::AddrOf: // should be impossible
1877 case UnaryOperator::OffsetOf:
1878 return IntRange::forType(C, E->getType());
1879
1880 default:
1881 return GetExprRange(C, UO->getSubExpr(), MaxWidth);
1882 }
1883 }
1884
1885 FieldDecl *BitField = E->getBitField();
1886 if (BitField) {
1887 llvm::APSInt BitWidthAP = BitField->getBitWidth()->EvaluateAsInt(C);
1888 unsigned BitWidth = BitWidthAP.getZExtValue();
1889
1890 return IntRange(BitWidth, BitField->getType()->isUnsignedIntegerType());
1891 }
1892
1893 return IntRange::forType(C, E->getType());
1894}
John McCall51313c32010-01-04 23:31:57 +00001895
1896/// Checks whether the given value, which currently has the given
1897/// source semantics, has the same value when coerced through the
1898/// target semantics.
John McCallf2370c92010-01-06 05:24:50 +00001899bool IsSameFloatAfterCast(const llvm::APFloat &value,
1900 const llvm::fltSemantics &Src,
1901 const llvm::fltSemantics &Tgt) {
John McCall51313c32010-01-04 23:31:57 +00001902 llvm::APFloat truncated = value;
1903
1904 bool ignored;
1905 truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
1906 truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
1907
1908 return truncated.bitwiseIsEqual(value);
1909}
1910
1911/// Checks whether the given value, which currently has the given
1912/// source semantics, has the same value when coerced through the
1913/// target semantics.
1914///
1915/// The value might be a vector of floats (or a complex number).
John McCallf2370c92010-01-06 05:24:50 +00001916bool IsSameFloatAfterCast(const APValue &value,
1917 const llvm::fltSemantics &Src,
1918 const llvm::fltSemantics &Tgt) {
John McCall51313c32010-01-04 23:31:57 +00001919 if (value.isFloat())
1920 return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
1921
1922 if (value.isVector()) {
1923 for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
1924 if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
1925 return false;
1926 return true;
1927 }
1928
1929 assert(value.isComplexFloat());
1930 return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
1931 IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
1932}
1933
John McCallf2370c92010-01-06 05:24:50 +00001934} // end anonymous namespace
John McCall51313c32010-01-04 23:31:57 +00001935
John McCallba26e582010-01-04 23:21:16 +00001936/// \brief Implements -Wsign-compare.
1937///
1938/// \param lex the left-hand expression
1939/// \param rex the right-hand expression
1940/// \param OpLoc the location of the joining operator
1941/// \param Equality whether this is an "equality-like" join, which
1942/// suppresses the warning in some cases
1943void Sema::CheckSignCompare(Expr *lex, Expr *rex, SourceLocation OpLoc,
1944 const PartialDiagnostic &PD, bool Equality) {
1945 // Don't warn if we're in an unevaluated context.
1946 if (ExprEvalContexts.back().Context == Unevaluated)
1947 return;
1948
John McCallf2370c92010-01-06 05:24:50 +00001949 // If either expression is value-dependent, don't warn. We'll get another
1950 // chance at instantiation time.
1951 if (lex->isValueDependent() || rex->isValueDependent())
1952 return;
1953
John McCallba26e582010-01-04 23:21:16 +00001954 QualType lt = lex->getType(), rt = rex->getType();
1955
1956 // Only warn if both operands are integral.
1957 if (!lt->isIntegerType() || !rt->isIntegerType())
1958 return;
1959
John McCallf2370c92010-01-06 05:24:50 +00001960 // In C, the width of a bitfield determines its type, and the
1961 // declared type only contributes the signedness. This duplicates
1962 // the work that will later be done by UsualUnaryConversions.
1963 // Eventually, this check will be reorganized in a way that avoids
1964 // this duplication.
1965 if (!getLangOptions().CPlusPlus) {
1966 QualType tmp;
1967 tmp = Context.isPromotableBitField(lex);
1968 if (!tmp.isNull()) lt = tmp;
1969 tmp = Context.isPromotableBitField(rex);
1970 if (!tmp.isNull()) rt = tmp;
1971 }
John McCallba26e582010-01-04 23:21:16 +00001972
1973 // The rule is that the signed operand becomes unsigned, so isolate the
1974 // signed operand.
John McCallf2370c92010-01-06 05:24:50 +00001975 Expr *signedOperand = lex, *unsignedOperand = rex;
1976 QualType signedType = lt, unsignedType = rt;
John McCallba26e582010-01-04 23:21:16 +00001977 if (lt->isSignedIntegerType()) {
1978 if (rt->isSignedIntegerType()) return;
John McCallba26e582010-01-04 23:21:16 +00001979 } else {
1980 if (!rt->isSignedIntegerType()) return;
John McCallf2370c92010-01-06 05:24:50 +00001981 std::swap(signedOperand, unsignedOperand);
1982 std::swap(signedType, unsignedType);
John McCallba26e582010-01-04 23:21:16 +00001983 }
1984
John McCallf2370c92010-01-06 05:24:50 +00001985 unsigned unsignedWidth = Context.getIntWidth(unsignedType);
1986 unsigned signedWidth = Context.getIntWidth(signedType);
1987
John McCallba26e582010-01-04 23:21:16 +00001988 // If the unsigned type is strictly smaller than the signed type,
1989 // then (1) the result type will be signed and (2) the unsigned
1990 // value will fit fully within the signed type, and thus the result
1991 // of the comparison will be exact.
John McCallf2370c92010-01-06 05:24:50 +00001992 if (signedWidth > unsignedWidth)
John McCallba26e582010-01-04 23:21:16 +00001993 return;
1994
John McCallf2370c92010-01-06 05:24:50 +00001995 // Otherwise, calculate the effective ranges.
1996 IntRange signedRange = GetExprRange(Context, signedOperand, signedWidth);
1997 IntRange unsignedRange = GetExprRange(Context, unsignedOperand, unsignedWidth);
1998
1999 // We should never be unable to prove that the unsigned operand is
2000 // non-negative.
2001 assert(unsignedRange.NonNegative && "unsigned range includes negative?");
2002
2003 // If the signed operand is non-negative, then the signed->unsigned
2004 // conversion won't change it.
2005 if (signedRange.NonNegative)
John McCallba26e582010-01-04 23:21:16 +00002006 return;
2007
2008 // For (in)equality comparisons, if the unsigned operand is a
2009 // constant which cannot collide with a overflowed signed operand,
2010 // then reinterpreting the signed operand as unsigned will not
2011 // change the result of the comparison.
John McCallf2370c92010-01-06 05:24:50 +00002012 if (Equality && unsignedRange.Width < unsignedWidth)
John McCallba26e582010-01-04 23:21:16 +00002013 return;
2014
2015 Diag(OpLoc, PD)
John McCallf2370c92010-01-06 05:24:50 +00002016 << lt << rt << lex->getSourceRange() << rex->getSourceRange();
John McCallba26e582010-01-04 23:21:16 +00002017}
2018
John McCall51313c32010-01-04 23:31:57 +00002019/// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
2020static void DiagnoseImpCast(Sema &S, Expr *E, QualType T, unsigned diag) {
2021 S.Diag(E->getExprLoc(), diag) << E->getType() << T << E->getSourceRange();
2022}
2023
2024/// Implements -Wconversion.
2025void Sema::CheckImplicitConversion(Expr *E, QualType T) {
2026 // Don't diagnose in unevaluated contexts.
2027 if (ExprEvalContexts.back().Context == Sema::Unevaluated)
2028 return;
2029
2030 // Don't diagnose for value-dependent expressions.
2031 if (E->isValueDependent())
2032 return;
2033
2034 const Type *Source = Context.getCanonicalType(E->getType()).getTypePtr();
2035 const Type *Target = Context.getCanonicalType(T).getTypePtr();
2036
2037 // Never diagnose implicit casts to bool.
2038 if (Target->isSpecificBuiltinType(BuiltinType::Bool))
2039 return;
2040
2041 // Strip vector types.
2042 if (isa<VectorType>(Source)) {
2043 if (!isa<VectorType>(Target))
2044 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_vector_scalar);
2045
2046 Source = cast<VectorType>(Source)->getElementType().getTypePtr();
2047 Target = cast<VectorType>(Target)->getElementType().getTypePtr();
2048 }
2049
2050 // Strip complex types.
2051 if (isa<ComplexType>(Source)) {
2052 if (!isa<ComplexType>(Target))
2053 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_complex_scalar);
2054
2055 Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
2056 Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
2057 }
2058
2059 const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
2060 const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
2061
2062 // If the source is floating point...
2063 if (SourceBT && SourceBT->isFloatingPoint()) {
2064 // ...and the target is floating point...
2065 if (TargetBT && TargetBT->isFloatingPoint()) {
2066 // ...then warn if we're dropping FP rank.
2067
2068 // Builtin FP kinds are ordered by increasing FP rank.
2069 if (SourceBT->getKind() > TargetBT->getKind()) {
2070 // Don't warn about float constants that are precisely
2071 // representable in the target type.
2072 Expr::EvalResult result;
2073 if (E->Evaluate(result, Context)) {
2074 // Value might be a float, a float vector, or a float complex.
2075 if (IsSameFloatAfterCast(result.Val,
2076 Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
2077 Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
2078 return;
2079 }
2080
2081 DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_precision);
2082 }
2083 return;
2084 }
2085
2086 // If the target is integral, always warn.
2087 if ((TargetBT && TargetBT->isInteger()))
2088 // TODO: don't warn for integer values?
2089 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_integer);
2090
2091 return;
2092 }
2093
John McCallf2370c92010-01-06 05:24:50 +00002094 if (!Source->isIntegerType() || !Target->isIntegerType())
John McCall51313c32010-01-04 23:31:57 +00002095 return;
2096
John McCallf2370c92010-01-06 05:24:50 +00002097 IntRange SourceRange = GetExprRange(Context, E, Context.getIntWidth(E->getType()));
2098 IntRange TargetRange = IntRange::forCanonicalType(Context, Target);
John McCall51313c32010-01-04 23:31:57 +00002099
John McCallf2370c92010-01-06 05:24:50 +00002100 // FIXME: also signed<->unsigned?
2101
2102 if (SourceRange.Width > TargetRange.Width) {
John McCall51313c32010-01-04 23:31:57 +00002103 // People want to build with -Wshorten-64-to-32 and not -Wconversion
2104 // and by god we'll let them.
John McCallf2370c92010-01-06 05:24:50 +00002105 if (SourceRange.Width == 64 && TargetRange.Width == 32)
John McCall51313c32010-01-04 23:31:57 +00002106 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_64_32);
2107 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_precision);
2108 }
2109
2110 return;
2111}
2112
Mike Stumpf8c49212010-01-21 03:59:47 +00002113// MarkLive - Mark all the blocks reachable from e as live. Returns the total
2114// number of blocks just marked live.
2115static unsigned MarkLive(CFGBlock *e, llvm::BitVector &live) {
2116 unsigned count = 0;
2117 std::queue<CFGBlock*> workq;
2118 // Prep work queue
2119 live.set(e->getBlockID());
2120 ++count;
2121 workq.push(e);
2122 // Solve
2123 while (!workq.empty()) {
2124 CFGBlock *item = workq.front();
2125 workq.pop();
2126 for (CFGBlock::succ_iterator I=item->succ_begin(),
2127 E=item->succ_end();
2128 I != E;
2129 ++I) {
2130 if ((*I) && !live[(*I)->getBlockID()]) {
2131 live.set((*I)->getBlockID());
2132 ++count;
2133 workq.push(*I);
2134 }
2135 }
2136 }
2137 return count;
2138}
2139
Mike Stump55f988e2010-01-21 17:21:23 +00002140static SourceLocation GetUnreachableLoc(CFGBlock &b, SourceRange &R1,
2141 SourceRange &R2) {
Mike Stumpf8c49212010-01-21 03:59:47 +00002142 Stmt *S;
Mike Stumpe5fba702010-01-21 19:44:04 +00002143 unsigned sn = 0;
2144 R1 = R2 = SourceRange();
2145
2146 top:
2147 if (sn < b.size())
2148 S = b[sn].getStmt();
Mike Stumpf8c49212010-01-21 03:59:47 +00002149 else if (b.getTerminator())
2150 S = b.getTerminator();
2151 else
2152 return SourceLocation();
2153
2154 switch (S->getStmtClass()) {
2155 case Expr::BinaryOperatorClass: {
Mike Stump55f988e2010-01-21 17:21:23 +00002156 BinaryOperator *BO = cast<BinaryOperator>(S);
2157 if (BO->getOpcode() == BinaryOperator::Comma) {
Mike Stumpe5fba702010-01-21 19:44:04 +00002158 if (sn+1 < b.size())
2159 return b[sn+1].getStmt()->getLocStart();
Mike Stumpf8c49212010-01-21 03:59:47 +00002160 CFGBlock *n = &b;
2161 while (1) {
2162 if (n->getTerminator())
2163 return n->getTerminator()->getLocStart();
2164 if (n->succ_size() != 1)
2165 return SourceLocation();
2166 n = n[0].succ_begin()[0];
2167 if (n->pred_size() != 1)
2168 return SourceLocation();
2169 if (!n->empty())
2170 return n[0][0].getStmt()->getLocStart();
2171 }
2172 }
Mike Stump55f988e2010-01-21 17:21:23 +00002173 R1 = BO->getLHS()->getSourceRange();
2174 R2 = BO->getRHS()->getSourceRange();
2175 return BO->getOperatorLoc();
2176 }
2177 case Expr::UnaryOperatorClass: {
2178 const UnaryOperator *UO = cast<UnaryOperator>(S);
2179 R1 = UO->getSubExpr()->getSourceRange();
2180 return UO->getOperatorLoc();
Mike Stumpf8c49212010-01-21 03:59:47 +00002181 }
Mike Stump45db90d2010-01-21 17:31:41 +00002182 case Expr::CompoundAssignOperatorClass: {
2183 const CompoundAssignOperator *CAO = cast<CompoundAssignOperator>(S);
2184 R1 = CAO->getLHS()->getSourceRange();
2185 R2 = CAO->getRHS()->getSourceRange();
2186 return CAO->getOperatorLoc();
2187 }
Mike Stumpe5fba702010-01-21 19:44:04 +00002188 case Expr::ConditionalOperatorClass: {
2189 const ConditionalOperator *CO = cast<ConditionalOperator>(S);
2190 return CO->getQuestionLoc();
2191 }
Mike Stumpb5c77552010-01-21 23:15:53 +00002192 case Expr::MemberExprClass: {
2193 const MemberExpr *ME = cast<MemberExpr>(S);
2194 R1 = ME->getSourceRange();
2195 return ME->getMemberLoc();
2196 }
2197 case Expr::ArraySubscriptExprClass: {
2198 const ArraySubscriptExpr *ASE = cast<ArraySubscriptExpr>(S);
2199 R1 = ASE->getLHS()->getSourceRange();
2200 R2 = ASE->getRHS()->getSourceRange();
2201 return ASE->getRBracketLoc();
2202 }
Mike Stump44582302010-01-21 19:51:34 +00002203 case Expr::CStyleCastExprClass: {
2204 const CStyleCastExpr *CSC = cast<CStyleCastExpr>(S);
2205 R1 = CSC->getSubExpr()->getSourceRange();
2206 return CSC->getLParenLoc();
2207 }
Mike Stump2d6ceab2010-01-21 22:12:18 +00002208 case Expr::CXXFunctionalCastExprClass: {
2209 const CXXFunctionalCastExpr *CE = cast <CXXFunctionalCastExpr>(S);
2210 R1 = CE->getSubExpr()->getSourceRange();
2211 return CE->getTypeBeginLoc();
2212 }
Mike Stumpe5fba702010-01-21 19:44:04 +00002213 case Expr::ImplicitCastExprClass:
2214 ++sn;
2215 goto top;
Mike Stump4c45aa12010-01-21 15:20:48 +00002216 case Stmt::CXXTryStmtClass: {
2217 return cast<CXXTryStmt>(S)->getHandler(0)->getCatchLoc();
2218 }
Mike Stumpf8c49212010-01-21 03:59:47 +00002219 default: ;
2220 }
Mike Stumpb5c77552010-01-21 23:15:53 +00002221 R1 = S->getSourceRange();
Mike Stumpf8c49212010-01-21 03:59:47 +00002222 return S->getLocStart();
2223}
2224
2225static SourceLocation MarkLiveTop(CFGBlock *e, llvm::BitVector &live,
2226 SourceManager &SM) {
2227 std::queue<CFGBlock*> workq;
2228 // Prep work queue
2229 workq.push(e);
Mike Stump55f988e2010-01-21 17:21:23 +00002230 SourceRange R1, R2;
2231 SourceLocation top = GetUnreachableLoc(*e, R1, R2);
Mike Stumpf8c49212010-01-21 03:59:47 +00002232 bool FromMainFile = false;
2233 bool FromSystemHeader = false;
2234 bool TopValid = false;
2235 if (top.isValid()) {
2236 FromMainFile = SM.isFromMainFile(top);
2237 FromSystemHeader = SM.isInSystemHeader(top);
2238 TopValid = true;
2239 }
2240 // Solve
2241 while (!workq.empty()) {
2242 CFGBlock *item = workq.front();
2243 workq.pop();
Mike Stump55f988e2010-01-21 17:21:23 +00002244 SourceLocation c = GetUnreachableLoc(*item, R1, R2);
Mike Stumpf8c49212010-01-21 03:59:47 +00002245 if (c.isValid()
2246 && (!TopValid
2247 || (SM.isFromMainFile(c) && !FromMainFile)
2248 || (FromSystemHeader && !SM.isInSystemHeader(c))
2249 || SM.isBeforeInTranslationUnit(c, top))) {
2250 top = c;
2251 FromMainFile = SM.isFromMainFile(top);
2252 FromSystemHeader = SM.isInSystemHeader(top);
2253 }
2254 live.set(item->getBlockID());
2255 for (CFGBlock::succ_iterator I=item->succ_begin(),
2256 E=item->succ_end();
2257 I != E;
2258 ++I) {
2259 if ((*I) && !live[(*I)->getBlockID()]) {
2260 live.set((*I)->getBlockID());
2261 workq.push(*I);
2262 }
2263 }
2264 }
2265 return top;
2266}
2267
2268static int LineCmp(const void *p1, const void *p2) {
2269 SourceLocation *Line1 = (SourceLocation *)p1;
2270 SourceLocation *Line2 = (SourceLocation *)p2;
2271 return !(*Line1 < *Line2);
2272}
2273
Mike Stump4a415672010-01-21 23:49:01 +00002274namespace {
2275 struct ErrLoc {
2276 SourceLocation Loc;
2277 SourceRange R1;
2278 SourceRange R2;
2279 ErrLoc(SourceLocation l, SourceRange r1, SourceRange r2)
2280 : Loc(l), R1(r1), R2(r2) { }
2281 };
2282}
2283
Mike Stumpf8c49212010-01-21 03:59:47 +00002284/// CheckUnreachable - Check for unreachable code.
2285void Sema::CheckUnreachable(AnalysisContext &AC) {
2286 unsigned count;
2287 // We avoid checking when there are errors, as the CFG won't faithfully match
2288 // the user's code.
2289 if (getDiagnostics().hasErrorOccurred())
2290 return;
2291 if (Diags.getDiagnosticLevel(diag::warn_unreachable) == Diagnostic::Ignored)
2292 return;
2293
2294 CFG *cfg = AC.getCFG();
2295 if (cfg == 0)
2296 return;
2297
2298 llvm::BitVector live(cfg->getNumBlockIDs());
2299 // Mark all live things first.
2300 count = MarkLive(&cfg->getEntry(), live);
2301
2302 if (count == cfg->getNumBlockIDs())
2303 // If there are no dead blocks, we're done.
2304 return;
2305
Mike Stump55f988e2010-01-21 17:21:23 +00002306 SourceRange R1, R2;
2307
Mike Stump4a415672010-01-21 23:49:01 +00002308 llvm::SmallVector<ErrLoc, 24> lines;
Mike Stump4c45aa12010-01-21 15:20:48 +00002309 bool AddEHEdges = AC.getAddEHEdges();
Mike Stumpf8c49212010-01-21 03:59:47 +00002310 // First, give warnings for blocks with no predecessors, as they
2311 // can't be part of a loop.
2312 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2313 CFGBlock &b = **I;
2314 if (!live[b.getBlockID()]) {
2315 if (b.pred_begin() == b.pred_end()) {
Mike Stump4c45aa12010-01-21 15:20:48 +00002316 if (!AddEHEdges && b.getTerminator()
2317 && isa<CXXTryStmt>(b.getTerminator())) {
2318 // When not adding EH edges from calls, catch clauses
2319 // can otherwise seem dead. Avoid noting them as dead.
2320 count += MarkLive(&b, live);
2321 continue;
2322 }
Mike Stump55f988e2010-01-21 17:21:23 +00002323 SourceLocation c = GetUnreachableLoc(b, R1, R2);
Mike Stumpf8c49212010-01-21 03:59:47 +00002324 if (!c.isValid()) {
2325 // Blocks without a location can't produce a warning, so don't mark
2326 // reachable blocks from here as live.
2327 live.set(b.getBlockID());
2328 ++count;
2329 continue;
2330 }
Mike Stump4a415672010-01-21 23:49:01 +00002331 lines.push_back(ErrLoc(c, R1, R2));
Mike Stumpf8c49212010-01-21 03:59:47 +00002332 // Avoid excessive errors by marking everything reachable from here
2333 count += MarkLive(&b, live);
2334 }
2335 }
2336 }
2337
2338 if (count < cfg->getNumBlockIDs()) {
2339 // And then give warnings for the tops of loops.
2340 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2341 CFGBlock &b = **I;
2342 if (!live[b.getBlockID()])
2343 // Avoid excessive errors by marking everything reachable from here
Ted Kremenek8acc9f62010-01-28 01:04:48 +00002344 lines.push_back(ErrLoc(MarkLiveTop(&b, live,
2345 Context.getSourceManager()),
2346 SourceRange(), SourceRange()));
Mike Stumpf8c49212010-01-21 03:59:47 +00002347 }
2348 }
2349
2350 llvm::array_pod_sort(lines.begin(), lines.end(), LineCmp);
Mike Stump4a415672010-01-21 23:49:01 +00002351 for (llvm::SmallVector<ErrLoc, 24>::iterator I = lines.begin(),
Mike Stumpf8c49212010-01-21 03:59:47 +00002352 E = lines.end();
2353 I != E;
2354 ++I)
Mike Stump4a415672010-01-21 23:49:01 +00002355 if (I->Loc.isValid())
2356 Diag(I->Loc, diag::warn_unreachable) << I->R1 << I->R2;
Mike Stumpf8c49212010-01-21 03:59:47 +00002357}
2358
2359/// CheckFallThrough - Check that we don't fall off the end of a
2360/// Statement that should return a value.
2361///
2362/// \returns AlwaysFallThrough iff we always fall off the end of the statement,
2363/// MaybeFallThrough iff we might or might not fall off the end,
2364/// NeverFallThroughOrReturn iff we never fall off the end of the statement or
2365/// return. We assume NeverFallThrough iff we never fall off the end of the
2366/// statement but we may return. We assume that functions not marked noreturn
2367/// will return.
2368Sema::ControlFlowKind Sema::CheckFallThrough(AnalysisContext &AC) {
2369 CFG *cfg = AC.getCFG();
2370 if (cfg == 0)
2371 // FIXME: This should be NeverFallThrough
2372 return NeverFallThroughOrReturn;
2373
Mike Stump4c45aa12010-01-21 15:20:48 +00002374 // The CFG leaves in dead things, and we don't want the dead code paths to
Mike Stumpf8c49212010-01-21 03:59:47 +00002375 // confuse us, so we mark all live things first.
2376 std::queue<CFGBlock*> workq;
2377 llvm::BitVector live(cfg->getNumBlockIDs());
Mike Stump4c45aa12010-01-21 15:20:48 +00002378 unsigned count = MarkLive(&cfg->getEntry(), live);
2379
2380 bool AddEHEdges = AC.getAddEHEdges();
2381 if (!AddEHEdges && count != cfg->getNumBlockIDs())
2382 // When there are things remaining dead, and we didn't add EH edges
2383 // from CallExprs to the catch clauses, we have to go back and
2384 // mark them as live.
2385 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2386 CFGBlock &b = **I;
2387 if (!live[b.getBlockID()]) {
2388 if (b.pred_begin() == b.pred_end()) {
2389 if (b.getTerminator() && isa<CXXTryStmt>(b.getTerminator()))
2390 // When not adding EH edges from calls, catch clauses
2391 // can otherwise seem dead. Avoid noting them as dead.
2392 count += MarkLive(&b, live);
2393 continue;
2394 }
2395 }
2396 }
Mike Stumpf8c49212010-01-21 03:59:47 +00002397
2398 // Now we know what is live, we check the live precessors of the exit block
2399 // and look for fall through paths, being careful to ignore normal returns,
2400 // and exceptional paths.
2401 bool HasLiveReturn = false;
2402 bool HasFakeEdge = false;
2403 bool HasPlainEdge = false;
2404 bool HasAbnormalEdge = false;
2405 for (CFGBlock::pred_iterator I=cfg->getExit().pred_begin(),
2406 E = cfg->getExit().pred_end();
2407 I != E;
2408 ++I) {
2409 CFGBlock& B = **I;
2410 if (!live[B.getBlockID()])
2411 continue;
2412 if (B.size() == 0) {
Mike Stump4c45aa12010-01-21 15:20:48 +00002413 if (B.getTerminator() && isa<CXXTryStmt>(B.getTerminator())) {
2414 HasAbnormalEdge = true;
2415 continue;
2416 }
2417
Mike Stumpf8c49212010-01-21 03:59:47 +00002418 // A labeled empty statement, or the entry block...
2419 HasPlainEdge = true;
2420 continue;
2421 }
2422 Stmt *S = B[B.size()-1];
2423 if (isa<ReturnStmt>(S)) {
2424 HasLiveReturn = true;
2425 continue;
2426 }
2427 if (isa<ObjCAtThrowStmt>(S)) {
2428 HasFakeEdge = true;
2429 continue;
2430 }
2431 if (isa<CXXThrowExpr>(S)) {
2432 HasFakeEdge = true;
2433 continue;
2434 }
2435 if (const AsmStmt *AS = dyn_cast<AsmStmt>(S)) {
2436 if (AS->isMSAsm()) {
2437 HasFakeEdge = true;
2438 HasLiveReturn = true;
2439 continue;
2440 }
2441 }
2442 if (isa<CXXTryStmt>(S)) {
2443 HasAbnormalEdge = true;
2444 continue;
2445 }
2446
2447 bool NoReturnEdge = false;
2448 if (CallExpr *C = dyn_cast<CallExpr>(S)) {
2449 if (B.succ_begin()[0] != &cfg->getExit()) {
2450 HasAbnormalEdge = true;
2451 continue;
2452 }
2453 Expr *CEE = C->getCallee()->IgnoreParenCasts();
2454 if (CEE->getType().getNoReturnAttr()) {
2455 NoReturnEdge = true;
2456 HasFakeEdge = true;
2457 } else if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(CEE)) {
2458 ValueDecl *VD = DRE->getDecl();
2459 if (VD->hasAttr<NoReturnAttr>()) {
2460 NoReturnEdge = true;
2461 HasFakeEdge = true;
2462 }
2463 }
2464 }
2465 // FIXME: Add noreturn message sends.
2466 if (NoReturnEdge == false)
2467 HasPlainEdge = true;
2468 }
2469 if (!HasPlainEdge) {
2470 if (HasLiveReturn)
2471 return NeverFallThrough;
2472 return NeverFallThroughOrReturn;
2473 }
2474 if (HasAbnormalEdge || HasFakeEdge || HasLiveReturn)
2475 return MaybeFallThrough;
2476 // This says AlwaysFallThrough for calls to functions that are not marked
2477 // noreturn, that don't return. If people would like this warning to be more
2478 // accurate, such functions should be marked as noreturn.
2479 return AlwaysFallThrough;
2480}
2481
2482/// CheckFallThroughForFunctionDef - Check that we don't fall off the end of a
2483/// function that should return a value. Check that we don't fall off the end
2484/// of a noreturn function. We assume that functions and blocks not marked
2485/// noreturn will return.
2486void Sema::CheckFallThroughForFunctionDef(Decl *D, Stmt *Body,
2487 AnalysisContext &AC) {
2488 // FIXME: Would be nice if we had a better way to control cascading errors,
2489 // but for now, avoid them. The problem is that when Parse sees:
2490 // int foo() { return a; }
2491 // The return is eaten and the Sema code sees just:
2492 // int foo() { }
2493 // which this code would then warn about.
2494 if (getDiagnostics().hasErrorOccurred())
2495 return;
2496
2497 bool ReturnsVoid = false;
2498 bool HasNoReturn = false;
2499 if (FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
2500 // If the result type of the function is a dependent type, we don't know
2501 // whether it will be void or not, so don't
2502 if (FD->getResultType()->isDependentType())
2503 return;
2504 if (FD->getResultType()->isVoidType())
2505 ReturnsVoid = true;
2506 if (FD->hasAttr<NoReturnAttr>())
2507 HasNoReturn = true;
2508 } else if (ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2509 if (MD->getResultType()->isVoidType())
2510 ReturnsVoid = true;
2511 if (MD->hasAttr<NoReturnAttr>())
2512 HasNoReturn = true;
2513 }
2514
2515 // Short circuit for compilation speed.
2516 if ((Diags.getDiagnosticLevel(diag::warn_maybe_falloff_nonvoid_function)
2517 == Diagnostic::Ignored || ReturnsVoid)
2518 && (Diags.getDiagnosticLevel(diag::warn_noreturn_function_has_return_expr)
2519 == Diagnostic::Ignored || !HasNoReturn)
2520 && (Diags.getDiagnosticLevel(diag::warn_suggest_noreturn_block)
2521 == Diagnostic::Ignored || !ReturnsVoid))
2522 return;
2523 // FIXME: Function try block
2524 if (CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) {
2525 switch (CheckFallThrough(AC)) {
2526 case MaybeFallThrough:
2527 if (HasNoReturn)
2528 Diag(Compound->getRBracLoc(), diag::warn_falloff_noreturn_function);
2529 else if (!ReturnsVoid)
2530 Diag(Compound->getRBracLoc(),diag::warn_maybe_falloff_nonvoid_function);
2531 break;
2532 case AlwaysFallThrough:
2533 if (HasNoReturn)
2534 Diag(Compound->getRBracLoc(), diag::warn_falloff_noreturn_function);
2535 else if (!ReturnsVoid)
2536 Diag(Compound->getRBracLoc(), diag::warn_falloff_nonvoid_function);
2537 break;
2538 case NeverFallThroughOrReturn:
2539 if (ReturnsVoid && !HasNoReturn)
2540 Diag(Compound->getLBracLoc(), diag::warn_suggest_noreturn_function);
2541 break;
2542 case NeverFallThrough:
2543 break;
2544 }
2545 }
2546}
2547
2548/// CheckFallThroughForBlock - Check that we don't fall off the end of a block
2549/// that should return a value. Check that we don't fall off the end of a
2550/// noreturn block. We assume that functions and blocks not marked noreturn
2551/// will return.
2552void Sema::CheckFallThroughForBlock(QualType BlockTy, Stmt *Body,
2553 AnalysisContext &AC) {
2554 // FIXME: Would be nice if we had a better way to control cascading errors,
2555 // but for now, avoid them. The problem is that when Parse sees:
2556 // int foo() { return a; }
2557 // The return is eaten and the Sema code sees just:
2558 // int foo() { }
2559 // which this code would then warn about.
2560 if (getDiagnostics().hasErrorOccurred())
2561 return;
2562 bool ReturnsVoid = false;
2563 bool HasNoReturn = false;
2564 if (const FunctionType *FT =BlockTy->getPointeeType()->getAs<FunctionType>()){
2565 if (FT->getResultType()->isVoidType())
2566 ReturnsVoid = true;
2567 if (FT->getNoReturnAttr())
2568 HasNoReturn = true;
2569 }
2570
2571 // Short circuit for compilation speed.
2572 if (ReturnsVoid
2573 && !HasNoReturn
2574 && (Diags.getDiagnosticLevel(diag::warn_suggest_noreturn_block)
2575 == Diagnostic::Ignored || !ReturnsVoid))
2576 return;
2577 // FIXME: Funtion try block
2578 if (CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) {
2579 switch (CheckFallThrough(AC)) {
2580 case MaybeFallThrough:
2581 if (HasNoReturn)
2582 Diag(Compound->getRBracLoc(), diag::err_noreturn_block_has_return_expr);
2583 else if (!ReturnsVoid)
2584 Diag(Compound->getRBracLoc(), diag::err_maybe_falloff_nonvoid_block);
2585 break;
2586 case AlwaysFallThrough:
2587 if (HasNoReturn)
2588 Diag(Compound->getRBracLoc(), diag::err_noreturn_block_has_return_expr);
2589 else if (!ReturnsVoid)
2590 Diag(Compound->getRBracLoc(), diag::err_falloff_nonvoid_block);
2591 break;
2592 case NeverFallThroughOrReturn:
2593 if (ReturnsVoid)
2594 Diag(Compound->getLBracLoc(), diag::warn_suggest_noreturn_block);
2595 break;
2596 case NeverFallThrough:
2597 break;
2598 }
2599 }
2600}
2601
2602/// CheckParmsForFunctionDef - Check that the parameters of the given
2603/// function are appropriate for the definition of a function. This
2604/// takes care of any checks that cannot be performed on the
2605/// declaration itself, e.g., that the types of each of the function
2606/// parameters are complete.
2607bool Sema::CheckParmsForFunctionDef(FunctionDecl *FD) {
2608 bool HasInvalidParm = false;
2609 for (unsigned p = 0, NumParams = FD->getNumParams(); p < NumParams; ++p) {
2610 ParmVarDecl *Param = FD->getParamDecl(p);
2611
2612 // C99 6.7.5.3p4: the parameters in a parameter type list in a
2613 // function declarator that is part of a function definition of
2614 // that function shall not have incomplete type.
2615 //
2616 // This is also C++ [dcl.fct]p6.
2617 if (!Param->isInvalidDecl() &&
2618 RequireCompleteType(Param->getLocation(), Param->getType(),
2619 diag::err_typecheck_decl_incomplete_type)) {
2620 Param->setInvalidDecl();
2621 HasInvalidParm = true;
2622 }
2623
2624 // C99 6.9.1p5: If the declarator includes a parameter type list, the
2625 // declaration of each parameter shall include an identifier.
2626 if (Param->getIdentifier() == 0 &&
2627 !Param->isImplicit() &&
2628 !getLangOptions().CPlusPlus)
2629 Diag(Param->getLocation(), diag::err_parameter_name_omitted);
Sam Weinigd17e3402010-02-01 05:02:49 +00002630
2631 // C99 6.7.5.3p12:
2632 // If the function declarator is not part of a definition of that
2633 // function, parameters may have incomplete type and may use the [*]
2634 // notation in their sequences of declarator specifiers to specify
2635 // variable length array types.
2636 QualType PType = Param->getOriginalType();
2637 if (const ArrayType *AT = Context.getAsArrayType(PType)) {
2638 if (AT->getSizeModifier() == ArrayType::Star) {
2639 // FIXME: This diagnosic should point the the '[*]' if source-location
2640 // information is added for it.
2641 Diag(Param->getLocation(), diag::err_array_star_in_function_definition);
2642 }
2643 }
Mike Stumpf8c49212010-01-21 03:59:47 +00002644 }
2645
2646 return HasInvalidParm;
2647}