blob: cb0e5fb218169f8c9529a9ca69820341cf2da954 [file] [log] [blame]
Chris Lattner59907c42007-08-10 20:18:51 +00001//===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
2//
3// The LLVM Compiler Infrastructure
4//
Chris Lattner0bc735f2007-12-29 19:59:25 +00005// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
Chris Lattner59907c42007-08-10 20:18:51 +00007//
8//===----------------------------------------------------------------------===//
9//
Mike Stump1eb44332009-09-09 15:08:12 +000010// This file implements extra semantic analysis beyond what is enforced
Chris Lattner59907c42007-08-10 20:18:51 +000011// by the C type system.
12//
13//===----------------------------------------------------------------------===//
14
15#include "Sema.h"
Mike Stumpf8c49212010-01-21 03:59:47 +000016#include "clang/Analysis/CFG.h"
Ted Kremenek1309f9a2010-01-25 04:41:41 +000017#include "clang/Analysis/AnalysisContext.h"
Ted Kremeneke0e53132010-01-28 23:39:18 +000018#include "clang/Analysis/Analyses/PrintfFormatString.h"
Chris Lattner59907c42007-08-10 20:18:51 +000019#include "clang/AST/ASTContext.h"
Ken Dyck199c3d62010-01-11 17:06:35 +000020#include "clang/AST/CharUnits.h"
Daniel Dunbarc4a1dea2008-08-11 05:35:13 +000021#include "clang/AST/DeclObjC.h"
Ted Kremenek23245122007-08-20 16:18:38 +000022#include "clang/AST/ExprCXX.h"
Ted Kremenek7ff22b22008-06-16 18:00:42 +000023#include "clang/AST/ExprObjC.h"
Mike Stumpf8c49212010-01-21 03:59:47 +000024#include "clang/AST/DeclObjC.h"
25#include "clang/AST/StmtCXX.h"
26#include "clang/AST/StmtObjC.h"
Chris Lattner719e6152009-02-18 19:21:10 +000027#include "clang/Lex/LiteralSupport.h"
Chris Lattner59907c42007-08-10 20:18:51 +000028#include "clang/Lex/Preprocessor.h"
Mike Stumpf8c49212010-01-21 03:59:47 +000029#include "llvm/ADT/BitVector.h"
30#include "llvm/ADT/STLExtras.h"
Zhongxing Xua1f3dba2009-05-20 01:55:10 +000031#include <limits>
Mike Stumpf8c49212010-01-21 03:59:47 +000032#include <queue>
Chris Lattner59907c42007-08-10 20:18:51 +000033using namespace clang;
34
Chris Lattner60800082009-02-18 17:49:48 +000035/// getLocationOfStringLiteralByte - Return a source location that points to the
36/// specified byte of the specified string literal.
37///
38/// Strings are amazingly complex. They can be formed from multiple tokens and
39/// can have escape sequences in them in addition to the usual trigraph and
40/// escaped newline business. This routine handles this complexity.
41///
42SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
43 unsigned ByteNo) const {
44 assert(!SL->isWide() && "This doesn't work for wide strings yet");
Mike Stump1eb44332009-09-09 15:08:12 +000045
Chris Lattner60800082009-02-18 17:49:48 +000046 // Loop over all of the tokens in this string until we find the one that
47 // contains the byte we're looking for.
48 unsigned TokNo = 0;
49 while (1) {
50 assert(TokNo < SL->getNumConcatenated() && "Invalid byte number!");
51 SourceLocation StrTokLoc = SL->getStrTokenLoc(TokNo);
Mike Stump1eb44332009-09-09 15:08:12 +000052
Chris Lattner60800082009-02-18 17:49:48 +000053 // Get the spelling of the string so that we can get the data that makes up
54 // the string literal, not the identifier for the macro it is potentially
55 // expanded through.
56 SourceLocation StrTokSpellingLoc = SourceMgr.getSpellingLoc(StrTokLoc);
57
58 // Re-lex the token to get its length and original spelling.
59 std::pair<FileID, unsigned> LocInfo =
60 SourceMgr.getDecomposedLoc(StrTokSpellingLoc);
61 std::pair<const char *,const char *> Buffer =
62 SourceMgr.getBufferData(LocInfo.first);
63 const char *StrData = Buffer.first+LocInfo.second;
Mike Stump1eb44332009-09-09 15:08:12 +000064
Chris Lattner60800082009-02-18 17:49:48 +000065 // Create a langops struct and enable trigraphs. This is sufficient for
66 // relexing tokens.
67 LangOptions LangOpts;
68 LangOpts.Trigraphs = true;
Mike Stump1eb44332009-09-09 15:08:12 +000069
Chris Lattner60800082009-02-18 17:49:48 +000070 // Create a lexer starting at the beginning of this token.
71 Lexer TheLexer(StrTokSpellingLoc, LangOpts, Buffer.first, StrData,
72 Buffer.second);
73 Token TheTok;
74 TheLexer.LexFromRawLexer(TheTok);
Mike Stump1eb44332009-09-09 15:08:12 +000075
Chris Lattner443e53c2009-02-18 19:26:42 +000076 // Use the StringLiteralParser to compute the length of the string in bytes.
77 StringLiteralParser SLP(&TheTok, 1, PP);
78 unsigned TokNumBytes = SLP.GetStringLength();
Mike Stump1eb44332009-09-09 15:08:12 +000079
Chris Lattner2197c962009-02-18 18:52:52 +000080 // If the byte is in this token, return the location of the byte.
Chris Lattner60800082009-02-18 17:49:48 +000081 if (ByteNo < TokNumBytes ||
82 (ByteNo == TokNumBytes && TokNo == SL->getNumConcatenated())) {
Mike Stump1eb44332009-09-09 15:08:12 +000083 unsigned Offset =
Chris Lattner719e6152009-02-18 19:21:10 +000084 StringLiteralParser::getOffsetOfStringByte(TheTok, ByteNo, PP);
Mike Stump1eb44332009-09-09 15:08:12 +000085
Chris Lattner719e6152009-02-18 19:21:10 +000086 // Now that we know the offset of the token in the spelling, use the
87 // preprocessor to get the offset in the original source.
88 return PP.AdvanceToTokenCharacter(StrTokLoc, Offset);
Chris Lattner60800082009-02-18 17:49:48 +000089 }
Mike Stump1eb44332009-09-09 15:08:12 +000090
Chris Lattner60800082009-02-18 17:49:48 +000091 // Move to the next string token.
92 ++TokNo;
93 ByteNo -= TokNumBytes;
94 }
95}
96
Ryan Flynn4403a5e2009-08-06 03:00:50 +000097/// CheckablePrintfAttr - does a function call have a "printf" attribute
98/// and arguments that merit checking?
99bool Sema::CheckablePrintfAttr(const FormatAttr *Format, CallExpr *TheCall) {
100 if (Format->getType() == "printf") return true;
101 if (Format->getType() == "printf0") {
102 // printf0 allows null "format" string; if so don't check format/args
103 unsigned format_idx = Format->getFormatIdx() - 1;
Sebastian Redl4a2614e2009-11-17 18:02:24 +0000104 // Does the index refer to the implicit object argument?
105 if (isa<CXXMemberCallExpr>(TheCall)) {
106 if (format_idx == 0)
107 return false;
108 --format_idx;
109 }
Ryan Flynn4403a5e2009-08-06 03:00:50 +0000110 if (format_idx < TheCall->getNumArgs()) {
111 Expr *Format = TheCall->getArg(format_idx)->IgnoreParenCasts();
Douglas Gregorce940492009-09-25 04:25:58 +0000112 if (!Format->isNullPointerConstant(Context, Expr::NPC_ValueDependentIsNull))
Ryan Flynn4403a5e2009-08-06 03:00:50 +0000113 return true;
114 }
115 }
116 return false;
117}
Chris Lattner60800082009-02-18 17:49:48 +0000118
Sebastian Redl0eb23302009-01-19 00:08:26 +0000119Action::OwningExprResult
Anders Carlssond406bf02009-08-16 01:56:34 +0000120Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
Sebastian Redl0eb23302009-01-19 00:08:26 +0000121 OwningExprResult TheCallResult(Owned(TheCall));
Douglas Gregor2def4832008-11-17 20:34:05 +0000122
Anders Carlssond406bf02009-08-16 01:56:34 +0000123 switch (BuiltinID) {
Chris Lattner30ce3442007-12-19 23:59:04 +0000124 case Builtin::BI__builtin___CFStringMakeConstantString:
Chris Lattner925e60d2007-12-28 05:29:59 +0000125 assert(TheCall->getNumArgs() == 1 &&
Chris Lattner1b9a0792007-12-20 00:26:33 +0000126 "Wrong # arguments to builtin CFStringMakeConstantString");
Chris Lattner69039812009-02-18 06:01:06 +0000127 if (CheckObjCString(TheCall->getArg(0)))
Sebastian Redl0eb23302009-01-19 00:08:26 +0000128 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000129 break;
Ted Kremenek49ff7a12008-07-09 17:58:53 +0000130 case Builtin::BI__builtin_stdarg_start:
Chris Lattner30ce3442007-12-19 23:59:04 +0000131 case Builtin::BI__builtin_va_start:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000132 if (SemaBuiltinVAStart(TheCall))
133 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000134 break;
Chris Lattner1b9a0792007-12-20 00:26:33 +0000135 case Builtin::BI__builtin_isgreater:
136 case Builtin::BI__builtin_isgreaterequal:
137 case Builtin::BI__builtin_isless:
138 case Builtin::BI__builtin_islessequal:
139 case Builtin::BI__builtin_islessgreater:
140 case Builtin::BI__builtin_isunordered:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000141 if (SemaBuiltinUnorderedCompare(TheCall))
142 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000143 break;
Eli Friedman9ac6f622009-08-31 20:06:00 +0000144 case Builtin::BI__builtin_isfinite:
145 case Builtin::BI__builtin_isinf:
146 case Builtin::BI__builtin_isinf_sign:
147 case Builtin::BI__builtin_isnan:
148 case Builtin::BI__builtin_isnormal:
149 if (SemaBuiltinUnaryFP(TheCall))
150 return ExprError();
151 break;
Eli Friedman6cfda232008-05-20 08:23:37 +0000152 case Builtin::BI__builtin_return_address:
153 case Builtin::BI__builtin_frame_address:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000154 if (SemaBuiltinStackAddress(TheCall))
155 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000156 break;
Chris Lattner21fb98e2009-09-23 06:06:36 +0000157 case Builtin::BI__builtin_eh_return_data_regno:
158 if (SemaBuiltinEHReturnDataRegNo(TheCall))
159 return ExprError();
160 break;
Eli Friedmand38617c2008-05-14 19:38:39 +0000161 case Builtin::BI__builtin_shufflevector:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000162 return SemaBuiltinShuffleVector(TheCall);
163 // TheCall will be freed by the smart pointer here, but that's fine, since
164 // SemaBuiltinShuffleVector guts it, but then doesn't release it.
Daniel Dunbar4493f792008-07-21 22:59:13 +0000165 case Builtin::BI__builtin_prefetch:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000166 if (SemaBuiltinPrefetch(TheCall))
167 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000168 break;
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000169 case Builtin::BI__builtin_object_size:
Sebastian Redl0eb23302009-01-19 00:08:26 +0000170 if (SemaBuiltinObjectSize(TheCall))
171 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000172 break;
Eli Friedmand875fed2009-05-03 04:46:36 +0000173 case Builtin::BI__builtin_longjmp:
174 if (SemaBuiltinLongjmp(TheCall))
175 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000176 break;
Chris Lattner5caa3702009-05-08 06:58:22 +0000177 case Builtin::BI__sync_fetch_and_add:
178 case Builtin::BI__sync_fetch_and_sub:
179 case Builtin::BI__sync_fetch_and_or:
180 case Builtin::BI__sync_fetch_and_and:
181 case Builtin::BI__sync_fetch_and_xor:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000182 case Builtin::BI__sync_fetch_and_nand:
Chris Lattner5caa3702009-05-08 06:58:22 +0000183 case Builtin::BI__sync_add_and_fetch:
184 case Builtin::BI__sync_sub_and_fetch:
185 case Builtin::BI__sync_and_and_fetch:
186 case Builtin::BI__sync_or_and_fetch:
187 case Builtin::BI__sync_xor_and_fetch:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000188 case Builtin::BI__sync_nand_and_fetch:
Chris Lattner5caa3702009-05-08 06:58:22 +0000189 case Builtin::BI__sync_val_compare_and_swap:
190 case Builtin::BI__sync_bool_compare_and_swap:
191 case Builtin::BI__sync_lock_test_and_set:
192 case Builtin::BI__sync_lock_release:
193 if (SemaBuiltinAtomicOverloaded(TheCall))
194 return ExprError();
Anders Carlssond406bf02009-08-16 01:56:34 +0000195 break;
Anders Carlsson71993dd2007-08-17 05:31:46 +0000196 }
Mike Stump1eb44332009-09-09 15:08:12 +0000197
Anders Carlssond406bf02009-08-16 01:56:34 +0000198 return move(TheCallResult);
199}
Daniel Dunbarde454282008-10-02 18:44:07 +0000200
Anders Carlssond406bf02009-08-16 01:56:34 +0000201/// CheckFunctionCall - Check a direct function call for various correctness
202/// and safety properties not strictly enforced by the C type system.
203bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall) {
204 // Get the IdentifierInfo* for the called function.
205 IdentifierInfo *FnInfo = FDecl->getIdentifier();
206
207 // None of the checks below are needed for functions that don't have
208 // simple names (e.g., C++ conversion functions).
209 if (!FnInfo)
210 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000211
Daniel Dunbarde454282008-10-02 18:44:07 +0000212 // FIXME: This mechanism should be abstracted to be less fragile and
213 // more efficient. For example, just map function ids to custom
214 // handlers.
215
Chris Lattner59907c42007-08-10 20:18:51 +0000216 // Printf checking.
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +0000217 if (const FormatAttr *Format = FDecl->getAttr<FormatAttr>()) {
Ryan Flynn4403a5e2009-08-06 03:00:50 +0000218 if (CheckablePrintfAttr(Format, TheCall)) {
Ted Kremenek3d692df2009-02-27 17:58:43 +0000219 bool HasVAListArg = Format->getFirstArg() == 0;
220 if (!HasVAListArg) {
Mike Stump1eb44332009-09-09 15:08:12 +0000221 if (const FunctionProtoType *Proto
John McCall183700f2009-09-21 23:43:11 +0000222 = FDecl->getType()->getAs<FunctionProtoType>())
Sebastian Redl4a2614e2009-11-17 18:02:24 +0000223 HasVAListArg = !Proto->isVariadic();
Ted Kremenek3d692df2009-02-27 17:58:43 +0000224 }
Douglas Gregor3c385e52009-02-14 18:57:46 +0000225 CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
Ted Kremenek3d692df2009-02-27 17:58:43 +0000226 HasVAListArg ? 0 : Format->getFirstArg() - 1);
Douglas Gregor3c385e52009-02-14 18:57:46 +0000227 }
Chris Lattner59907c42007-08-10 20:18:51 +0000228 }
Mike Stump1eb44332009-09-09 15:08:12 +0000229
230 for (const NonNullAttr *NonNull = FDecl->getAttr<NonNullAttr>(); NonNull;
Anders Carlssond406bf02009-08-16 01:56:34 +0000231 NonNull = NonNull->getNext<NonNullAttr>())
232 CheckNonNullArguments(NonNull, TheCall);
Sebastian Redl0eb23302009-01-19 00:08:26 +0000233
Anders Carlssond406bf02009-08-16 01:56:34 +0000234 return false;
Anders Carlsson71993dd2007-08-17 05:31:46 +0000235}
236
Anders Carlssond406bf02009-08-16 01:56:34 +0000237bool Sema::CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall) {
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000238 // Printf checking.
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +0000239 const FormatAttr *Format = NDecl->getAttr<FormatAttr>();
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000240 if (!Format)
Anders Carlssond406bf02009-08-16 01:56:34 +0000241 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000242
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000243 const VarDecl *V = dyn_cast<VarDecl>(NDecl);
244 if (!V)
Anders Carlssond406bf02009-08-16 01:56:34 +0000245 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000246
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000247 QualType Ty = V->getType();
248 if (!Ty->isBlockPointerType())
Anders Carlssond406bf02009-08-16 01:56:34 +0000249 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000250
Anders Carlssond406bf02009-08-16 01:56:34 +0000251 if (!CheckablePrintfAttr(Format, TheCall))
252 return false;
Mike Stump1eb44332009-09-09 15:08:12 +0000253
Anders Carlssond406bf02009-08-16 01:56:34 +0000254 bool HasVAListArg = Format->getFirstArg() == 0;
255 if (!HasVAListArg) {
Mike Stump1eb44332009-09-09 15:08:12 +0000256 const FunctionType *FT =
John McCall183700f2009-09-21 23:43:11 +0000257 Ty->getAs<BlockPointerType>()->getPointeeType()->getAs<FunctionType>();
Anders Carlssond406bf02009-08-16 01:56:34 +0000258 if (const FunctionProtoType *Proto = dyn_cast<FunctionProtoType>(FT))
259 HasVAListArg = !Proto->isVariadic();
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000260 }
Anders Carlssond406bf02009-08-16 01:56:34 +0000261 CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
262 HasVAListArg ? 0 : Format->getFirstArg() - 1);
263
264 return false;
Fariborz Jahanian725165f2009-05-18 21:05:18 +0000265}
266
Chris Lattner5caa3702009-05-08 06:58:22 +0000267/// SemaBuiltinAtomicOverloaded - We have a call to a function like
268/// __sync_fetch_and_add, which is an overloaded function based on the pointer
269/// type of its first argument. The main ActOnCallExpr routines have already
270/// promoted the types of arguments because all of these calls are prototyped as
271/// void(...).
272///
273/// This function goes through and does final semantic checking for these
274/// builtins,
275bool Sema::SemaBuiltinAtomicOverloaded(CallExpr *TheCall) {
276 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
277 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
278
279 // Ensure that we have at least one argument to do type inference from.
280 if (TheCall->getNumArgs() < 1)
281 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
282 << 0 << TheCall->getCallee()->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000283
Chris Lattner5caa3702009-05-08 06:58:22 +0000284 // Inspect the first argument of the atomic builtin. This should always be
285 // a pointer type, whose element is an integral scalar or pointer type.
286 // Because it is a pointer type, we don't have to worry about any implicit
287 // casts here.
288 Expr *FirstArg = TheCall->getArg(0);
289 if (!FirstArg->getType()->isPointerType())
290 return Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
291 << FirstArg->getType() << FirstArg->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000292
Ted Kremenek6217b802009-07-29 21:53:49 +0000293 QualType ValType = FirstArg->getType()->getAs<PointerType>()->getPointeeType();
Mike Stump1eb44332009-09-09 15:08:12 +0000294 if (!ValType->isIntegerType() && !ValType->isPointerType() &&
Chris Lattner5caa3702009-05-08 06:58:22 +0000295 !ValType->isBlockPointerType())
296 return Diag(DRE->getLocStart(),
297 diag::err_atomic_builtin_must_be_pointer_intptr)
298 << FirstArg->getType() << FirstArg->getSourceRange();
299
300 // We need to figure out which concrete builtin this maps onto. For example,
301 // __sync_fetch_and_add with a 2 byte object turns into
302 // __sync_fetch_and_add_2.
303#define BUILTIN_ROW(x) \
304 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
305 Builtin::BI##x##_8, Builtin::BI##x##_16 }
Mike Stump1eb44332009-09-09 15:08:12 +0000306
Chris Lattner5caa3702009-05-08 06:58:22 +0000307 static const unsigned BuiltinIndices[][5] = {
308 BUILTIN_ROW(__sync_fetch_and_add),
309 BUILTIN_ROW(__sync_fetch_and_sub),
310 BUILTIN_ROW(__sync_fetch_and_or),
311 BUILTIN_ROW(__sync_fetch_and_and),
312 BUILTIN_ROW(__sync_fetch_and_xor),
Chris Lattnereebd9d22009-05-13 04:37:52 +0000313 BUILTIN_ROW(__sync_fetch_and_nand),
Mike Stump1eb44332009-09-09 15:08:12 +0000314
Chris Lattner5caa3702009-05-08 06:58:22 +0000315 BUILTIN_ROW(__sync_add_and_fetch),
316 BUILTIN_ROW(__sync_sub_and_fetch),
317 BUILTIN_ROW(__sync_and_and_fetch),
318 BUILTIN_ROW(__sync_or_and_fetch),
319 BUILTIN_ROW(__sync_xor_and_fetch),
Chris Lattnereebd9d22009-05-13 04:37:52 +0000320 BUILTIN_ROW(__sync_nand_and_fetch),
Mike Stump1eb44332009-09-09 15:08:12 +0000321
Chris Lattner5caa3702009-05-08 06:58:22 +0000322 BUILTIN_ROW(__sync_val_compare_and_swap),
323 BUILTIN_ROW(__sync_bool_compare_and_swap),
324 BUILTIN_ROW(__sync_lock_test_and_set),
325 BUILTIN_ROW(__sync_lock_release)
326 };
Mike Stump1eb44332009-09-09 15:08:12 +0000327#undef BUILTIN_ROW
328
Chris Lattner5caa3702009-05-08 06:58:22 +0000329 // Determine the index of the size.
330 unsigned SizeIndex;
Ken Dyck199c3d62010-01-11 17:06:35 +0000331 switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
Chris Lattner5caa3702009-05-08 06:58:22 +0000332 case 1: SizeIndex = 0; break;
333 case 2: SizeIndex = 1; break;
334 case 4: SizeIndex = 2; break;
335 case 8: SizeIndex = 3; break;
336 case 16: SizeIndex = 4; break;
337 default:
338 return Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
339 << FirstArg->getType() << FirstArg->getSourceRange();
340 }
Mike Stump1eb44332009-09-09 15:08:12 +0000341
Chris Lattner5caa3702009-05-08 06:58:22 +0000342 // Each of these builtins has one pointer argument, followed by some number of
343 // values (0, 1 or 2) followed by a potentially empty varags list of stuff
344 // that we ignore. Find out which row of BuiltinIndices to read from as well
345 // as the number of fixed args.
Douglas Gregor7814e6d2009-09-12 00:22:50 +0000346 unsigned BuiltinID = FDecl->getBuiltinID();
Chris Lattner5caa3702009-05-08 06:58:22 +0000347 unsigned BuiltinIndex, NumFixed = 1;
348 switch (BuiltinID) {
349 default: assert(0 && "Unknown overloaded atomic builtin!");
350 case Builtin::BI__sync_fetch_and_add: BuiltinIndex = 0; break;
351 case Builtin::BI__sync_fetch_and_sub: BuiltinIndex = 1; break;
352 case Builtin::BI__sync_fetch_and_or: BuiltinIndex = 2; break;
353 case Builtin::BI__sync_fetch_and_and: BuiltinIndex = 3; break;
354 case Builtin::BI__sync_fetch_and_xor: BuiltinIndex = 4; break;
Chris Lattnereebd9d22009-05-13 04:37:52 +0000355 case Builtin::BI__sync_fetch_and_nand:BuiltinIndex = 5; break;
Mike Stump1eb44332009-09-09 15:08:12 +0000356
Chris Lattnereebd9d22009-05-13 04:37:52 +0000357 case Builtin::BI__sync_add_and_fetch: BuiltinIndex = 6; break;
358 case Builtin::BI__sync_sub_and_fetch: BuiltinIndex = 7; break;
359 case Builtin::BI__sync_and_and_fetch: BuiltinIndex = 8; break;
360 case Builtin::BI__sync_or_and_fetch: BuiltinIndex = 9; break;
361 case Builtin::BI__sync_xor_and_fetch: BuiltinIndex =10; break;
362 case Builtin::BI__sync_nand_and_fetch:BuiltinIndex =11; break;
Mike Stump1eb44332009-09-09 15:08:12 +0000363
Chris Lattner5caa3702009-05-08 06:58:22 +0000364 case Builtin::BI__sync_val_compare_and_swap:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000365 BuiltinIndex = 12;
Chris Lattner5caa3702009-05-08 06:58:22 +0000366 NumFixed = 2;
367 break;
368 case Builtin::BI__sync_bool_compare_and_swap:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000369 BuiltinIndex = 13;
Chris Lattner5caa3702009-05-08 06:58:22 +0000370 NumFixed = 2;
371 break;
Chris Lattnereebd9d22009-05-13 04:37:52 +0000372 case Builtin::BI__sync_lock_test_and_set: BuiltinIndex = 14; break;
Chris Lattner5caa3702009-05-08 06:58:22 +0000373 case Builtin::BI__sync_lock_release:
Chris Lattnereebd9d22009-05-13 04:37:52 +0000374 BuiltinIndex = 15;
Chris Lattner5caa3702009-05-08 06:58:22 +0000375 NumFixed = 0;
376 break;
377 }
Mike Stump1eb44332009-09-09 15:08:12 +0000378
Chris Lattner5caa3702009-05-08 06:58:22 +0000379 // Now that we know how many fixed arguments we expect, first check that we
380 // have at least that many.
381 if (TheCall->getNumArgs() < 1+NumFixed)
382 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
383 << 0 << TheCall->getCallee()->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000384
385
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000386 // Get the decl for the concrete builtin from this, we can tell what the
387 // concrete integer type we should convert to is.
388 unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
389 const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
390 IdentifierInfo *NewBuiltinII = PP.getIdentifierInfo(NewBuiltinName);
Mike Stump1eb44332009-09-09 15:08:12 +0000391 FunctionDecl *NewBuiltinDecl =
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000392 cast<FunctionDecl>(LazilyCreateBuiltin(NewBuiltinII, NewBuiltinID,
393 TUScope, false, DRE->getLocStart()));
394 const FunctionProtoType *BuiltinFT =
John McCall183700f2009-09-21 23:43:11 +0000395 NewBuiltinDecl->getType()->getAs<FunctionProtoType>();
Ted Kremenek6217b802009-07-29 21:53:49 +0000396 ValType = BuiltinFT->getArgType(0)->getAs<PointerType>()->getPointeeType();
Mike Stump1eb44332009-09-09 15:08:12 +0000397
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000398 // If the first type needs to be converted (e.g. void** -> int*), do it now.
399 if (BuiltinFT->getArgType(0) != FirstArg->getType()) {
Eli Friedman73c39ab2009-10-20 08:27:19 +0000400 ImpCastExprToType(FirstArg, BuiltinFT->getArgType(0), CastExpr::CK_BitCast);
Chris Lattnere7ac0a92009-05-08 15:36:58 +0000401 TheCall->setArg(0, FirstArg);
402 }
Mike Stump1eb44332009-09-09 15:08:12 +0000403
Chris Lattner5caa3702009-05-08 06:58:22 +0000404 // Next, walk the valid ones promoting to the right type.
405 for (unsigned i = 0; i != NumFixed; ++i) {
406 Expr *Arg = TheCall->getArg(i+1);
Mike Stump1eb44332009-09-09 15:08:12 +0000407
Chris Lattner5caa3702009-05-08 06:58:22 +0000408 // If the argument is an implicit cast, then there was a promotion due to
409 // "...", just remove it now.
410 if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
411 Arg = ICE->getSubExpr();
412 ICE->setSubExpr(0);
413 ICE->Destroy(Context);
414 TheCall->setArg(i+1, Arg);
415 }
Mike Stump1eb44332009-09-09 15:08:12 +0000416
Chris Lattner5caa3702009-05-08 06:58:22 +0000417 // GCC does an implicit conversion to the pointer or integer ValType. This
418 // can fail in some cases (1i -> int**), check for this error case now.
Anders Carlssoncdb61972009-08-07 22:21:05 +0000419 CastExpr::CastKind Kind = CastExpr::CK_Unknown;
Fariborz Jahaniane9f42082009-08-26 18:55:36 +0000420 CXXMethodDecl *ConversionDecl = 0;
421 if (CheckCastTypes(Arg->getSourceRange(), ValType, Arg, Kind,
422 ConversionDecl))
Chris Lattner5caa3702009-05-08 06:58:22 +0000423 return true;
Mike Stump1eb44332009-09-09 15:08:12 +0000424
Chris Lattner5caa3702009-05-08 06:58:22 +0000425 // Okay, we have something that *can* be converted to the right type. Check
426 // to see if there is a potentially weird extension going on here. This can
427 // happen when you do an atomic operation on something like an char* and
428 // pass in 42. The 42 gets converted to char. This is even more strange
429 // for things like 45.123 -> char, etc.
Mike Stump1eb44332009-09-09 15:08:12 +0000430 // FIXME: Do this check.
Anders Carlssoncdb61972009-08-07 22:21:05 +0000431 ImpCastExprToType(Arg, ValType, Kind, /*isLvalue=*/false);
Chris Lattner5caa3702009-05-08 06:58:22 +0000432 TheCall->setArg(i+1, Arg);
433 }
Mike Stump1eb44332009-09-09 15:08:12 +0000434
Chris Lattner5caa3702009-05-08 06:58:22 +0000435 // Switch the DeclRefExpr to refer to the new decl.
436 DRE->setDecl(NewBuiltinDecl);
437 DRE->setType(NewBuiltinDecl->getType());
Mike Stump1eb44332009-09-09 15:08:12 +0000438
Chris Lattner5caa3702009-05-08 06:58:22 +0000439 // Set the callee in the CallExpr.
440 // FIXME: This leaks the original parens and implicit casts.
441 Expr *PromotedCall = DRE;
442 UsualUnaryConversions(PromotedCall);
443 TheCall->setCallee(PromotedCall);
Mike Stump1eb44332009-09-09 15:08:12 +0000444
Chris Lattner5caa3702009-05-08 06:58:22 +0000445
446 // Change the result type of the call to match the result type of the decl.
447 TheCall->setType(NewBuiltinDecl->getResultType());
448 return false;
449}
450
451
Chris Lattner69039812009-02-18 06:01:06 +0000452/// CheckObjCString - Checks that the argument to the builtin
Anders Carlsson71993dd2007-08-17 05:31:46 +0000453/// CFString constructor is correct
Steve Narofffd942622009-04-13 20:26:29 +0000454/// FIXME: GCC currently emits the following warning:
Mike Stump1eb44332009-09-09 15:08:12 +0000455/// "warning: input conversion stopped due to an input byte that does not
Steve Narofffd942622009-04-13 20:26:29 +0000456/// belong to the input codeset UTF-8"
457/// Note: It might also make sense to do the UTF-16 conversion here (would
458/// simplify the backend).
Chris Lattner69039812009-02-18 06:01:06 +0000459bool Sema::CheckObjCString(Expr *Arg) {
Chris Lattner56f34942008-02-13 01:02:39 +0000460 Arg = Arg->IgnoreParenCasts();
Anders Carlsson71993dd2007-08-17 05:31:46 +0000461 StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
462
463 if (!Literal || Literal->isWide()) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000464 Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
465 << Arg->getSourceRange();
Anders Carlsson9cdc4d32007-08-17 15:44:17 +0000466 return true;
Anders Carlsson71993dd2007-08-17 05:31:46 +0000467 }
Mike Stump1eb44332009-09-09 15:08:12 +0000468
Daniel Dunbarf015b032009-09-22 10:03:52 +0000469 const char *Data = Literal->getStrData();
470 unsigned Length = Literal->getByteLength();
Mike Stump1eb44332009-09-09 15:08:12 +0000471
Daniel Dunbarf015b032009-09-22 10:03:52 +0000472 for (unsigned i = 0; i < Length; ++i) {
473 if (!Data[i]) {
474 Diag(getLocationOfStringLiteralByte(Literal, i),
475 diag::warn_cfstring_literal_contains_nul_character)
476 << Arg->getSourceRange();
477 break;
478 }
479 }
Mike Stump1eb44332009-09-09 15:08:12 +0000480
Anders Carlsson9cdc4d32007-08-17 15:44:17 +0000481 return false;
Chris Lattner59907c42007-08-10 20:18:51 +0000482}
483
Chris Lattnerc27c6652007-12-20 00:05:45 +0000484/// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
485/// Emit an error and return true on failure, return false on success.
Chris Lattner925e60d2007-12-28 05:29:59 +0000486bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
487 Expr *Fn = TheCall->getCallee();
488 if (TheCall->getNumArgs() > 2) {
Chris Lattner2c21a072008-11-21 18:44:24 +0000489 Diag(TheCall->getArg(2)->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000490 diag::err_typecheck_call_too_many_args)
Chris Lattner2c21a072008-11-21 18:44:24 +0000491 << 0 /*function call*/ << Fn->getSourceRange()
Mike Stump1eb44332009-09-09 15:08:12 +0000492 << SourceRange(TheCall->getArg(2)->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000493 (*(TheCall->arg_end()-1))->getLocEnd());
Chris Lattner30ce3442007-12-19 23:59:04 +0000494 return true;
495 }
Eli Friedman56f20ae2008-12-15 22:05:35 +0000496
497 if (TheCall->getNumArgs() < 2) {
498 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
499 << 0 /*function call*/;
500 }
501
Chris Lattnerc27c6652007-12-20 00:05:45 +0000502 // Determine whether the current function is variadic or not.
503 bool isVariadic;
Steve Naroffcd9c5142009-04-15 19:33:47 +0000504 if (CurBlock)
505 isVariadic = CurBlock->isVariadic;
506 else if (getCurFunctionDecl()) {
Douglas Gregor72564e72009-02-26 23:50:07 +0000507 if (FunctionProtoType* FTP =
508 dyn_cast<FunctionProtoType>(getCurFunctionDecl()->getType()))
Eli Friedman56f20ae2008-12-15 22:05:35 +0000509 isVariadic = FTP->isVariadic();
510 else
511 isVariadic = false;
512 } else {
Argyrios Kyrtzidis53d0ea52008-06-28 06:07:14 +0000513 isVariadic = getCurMethodDecl()->isVariadic();
Eli Friedman56f20ae2008-12-15 22:05:35 +0000514 }
Mike Stump1eb44332009-09-09 15:08:12 +0000515
Chris Lattnerc27c6652007-12-20 00:05:45 +0000516 if (!isVariadic) {
Chris Lattner30ce3442007-12-19 23:59:04 +0000517 Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
518 return true;
519 }
Mike Stump1eb44332009-09-09 15:08:12 +0000520
Chris Lattner30ce3442007-12-19 23:59:04 +0000521 // Verify that the second argument to the builtin is the last argument of the
522 // current function or method.
523 bool SecondArgIsLastNamedArgument = false;
Anders Carlssone2c14102008-02-13 01:22:59 +0000524 const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
Mike Stump1eb44332009-09-09 15:08:12 +0000525
Anders Carlsson88cf2262008-02-11 04:20:54 +0000526 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
527 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
Chris Lattner30ce3442007-12-19 23:59:04 +0000528 // FIXME: This isn't correct for methods (results in bogus warning).
529 // Get the last formal in the current function.
Anders Carlsson88cf2262008-02-11 04:20:54 +0000530 const ParmVarDecl *LastArg;
Steve Naroffcd9c5142009-04-15 19:33:47 +0000531 if (CurBlock)
532 LastArg = *(CurBlock->TheDecl->param_end()-1);
533 else if (FunctionDecl *FD = getCurFunctionDecl())
Chris Lattner371f2582008-12-04 23:50:19 +0000534 LastArg = *(FD->param_end()-1);
Chris Lattner30ce3442007-12-19 23:59:04 +0000535 else
Argyrios Kyrtzidis53d0ea52008-06-28 06:07:14 +0000536 LastArg = *(getCurMethodDecl()->param_end()-1);
Chris Lattner30ce3442007-12-19 23:59:04 +0000537 SecondArgIsLastNamedArgument = PV == LastArg;
538 }
539 }
Mike Stump1eb44332009-09-09 15:08:12 +0000540
Chris Lattner30ce3442007-12-19 23:59:04 +0000541 if (!SecondArgIsLastNamedArgument)
Mike Stump1eb44332009-09-09 15:08:12 +0000542 Diag(TheCall->getArg(1)->getLocStart(),
Chris Lattner30ce3442007-12-19 23:59:04 +0000543 diag::warn_second_parameter_of_va_start_not_last_named_argument);
544 return false;
Eli Friedman6cfda232008-05-20 08:23:37 +0000545}
Chris Lattner30ce3442007-12-19 23:59:04 +0000546
Chris Lattner1b9a0792007-12-20 00:26:33 +0000547/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
548/// friends. This is declared to take (...), so we have to check everything.
Chris Lattner925e60d2007-12-28 05:29:59 +0000549bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
550 if (TheCall->getNumArgs() < 2)
Chris Lattner2c21a072008-11-21 18:44:24 +0000551 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
552 << 0 /*function call*/;
Chris Lattner925e60d2007-12-28 05:29:59 +0000553 if (TheCall->getNumArgs() > 2)
Mike Stump1eb44332009-09-09 15:08:12 +0000554 return Diag(TheCall->getArg(2)->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000555 diag::err_typecheck_call_too_many_args)
Chris Lattner2c21a072008-11-21 18:44:24 +0000556 << 0 /*function call*/
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000557 << SourceRange(TheCall->getArg(2)->getLocStart(),
558 (*(TheCall->arg_end()-1))->getLocEnd());
Mike Stump1eb44332009-09-09 15:08:12 +0000559
Chris Lattner925e60d2007-12-28 05:29:59 +0000560 Expr *OrigArg0 = TheCall->getArg(0);
561 Expr *OrigArg1 = TheCall->getArg(1);
Douglas Gregorcde01732009-05-19 22:10:17 +0000562
Chris Lattner1b9a0792007-12-20 00:26:33 +0000563 // Do standard promotions between the two arguments, returning their common
564 // type.
Chris Lattner925e60d2007-12-28 05:29:59 +0000565 QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
Daniel Dunbar403bc2b2009-02-19 19:28:43 +0000566
567 // Make sure any conversions are pushed back into the call; this is
568 // type safe since unordered compare builtins are declared as "_Bool
569 // foo(...)".
570 TheCall->setArg(0, OrigArg0);
571 TheCall->setArg(1, OrigArg1);
Mike Stump1eb44332009-09-09 15:08:12 +0000572
Douglas Gregorcde01732009-05-19 22:10:17 +0000573 if (OrigArg0->isTypeDependent() || OrigArg1->isTypeDependent())
574 return false;
575
Chris Lattner1b9a0792007-12-20 00:26:33 +0000576 // If the common type isn't a real floating type, then the arguments were
577 // invalid for this operation.
578 if (!Res->isRealFloatingType())
Mike Stump1eb44332009-09-09 15:08:12 +0000579 return Diag(OrigArg0->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000580 diag::err_typecheck_call_invalid_ordered_compare)
Chris Lattnerd1625842008-11-24 06:25:27 +0000581 << OrigArg0->getType() << OrigArg1->getType()
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000582 << SourceRange(OrigArg0->getLocStart(), OrigArg1->getLocEnd());
Mike Stump1eb44332009-09-09 15:08:12 +0000583
Chris Lattner1b9a0792007-12-20 00:26:33 +0000584 return false;
585}
586
Eli Friedman9ac6f622009-08-31 20:06:00 +0000587/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isnan and
588/// friends. This is declared to take (...), so we have to check everything.
589bool Sema::SemaBuiltinUnaryFP(CallExpr *TheCall) {
590 if (TheCall->getNumArgs() < 1)
591 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
592 << 0 /*function call*/;
593 if (TheCall->getNumArgs() > 1)
Mike Stump1eb44332009-09-09 15:08:12 +0000594 return Diag(TheCall->getArg(1)->getLocStart(),
Eli Friedman9ac6f622009-08-31 20:06:00 +0000595 diag::err_typecheck_call_too_many_args)
596 << 0 /*function call*/
597 << SourceRange(TheCall->getArg(1)->getLocStart(),
598 (*(TheCall->arg_end()-1))->getLocEnd());
599
600 Expr *OrigArg = TheCall->getArg(0);
Mike Stump1eb44332009-09-09 15:08:12 +0000601
Eli Friedman9ac6f622009-08-31 20:06:00 +0000602 if (OrigArg->isTypeDependent())
603 return false;
604
605 // This operation requires a floating-point number
606 if (!OrigArg->getType()->isRealFloatingType())
Mike Stump1eb44332009-09-09 15:08:12 +0000607 return Diag(OrigArg->getLocStart(),
Eli Friedman9ac6f622009-08-31 20:06:00 +0000608 diag::err_typecheck_call_invalid_unary_fp)
609 << OrigArg->getType() << OrigArg->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000610
Eli Friedman9ac6f622009-08-31 20:06:00 +0000611 return false;
612}
613
Eli Friedman6cfda232008-05-20 08:23:37 +0000614bool Sema::SemaBuiltinStackAddress(CallExpr *TheCall) {
615 // The signature for these builtins is exact; the only thing we need
616 // to check is that the argument is a constant.
617 SourceLocation Loc;
Douglas Gregorcde01732009-05-19 22:10:17 +0000618 if (!TheCall->getArg(0)->isTypeDependent() &&
619 !TheCall->getArg(0)->isValueDependent() &&
620 !TheCall->getArg(0)->isIntegerConstantExpr(Context, &Loc))
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000621 return Diag(Loc, diag::err_stack_const_level) << TheCall->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +0000622
Eli Friedman6cfda232008-05-20 08:23:37 +0000623 return false;
624}
625
Eli Friedmand38617c2008-05-14 19:38:39 +0000626/// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
627// This is declared to take (...), so we have to check everything.
Sebastian Redl0eb23302009-01-19 00:08:26 +0000628Action::OwningExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) {
Eli Friedmand38617c2008-05-14 19:38:39 +0000629 if (TheCall->getNumArgs() < 3)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000630 return ExprError(Diag(TheCall->getLocEnd(),
631 diag::err_typecheck_call_too_few_args)
632 << 0 /*function call*/ << TheCall->getSourceRange());
Eli Friedmand38617c2008-05-14 19:38:39 +0000633
Douglas Gregorcde01732009-05-19 22:10:17 +0000634 unsigned numElements = std::numeric_limits<unsigned>::max();
635 if (!TheCall->getArg(0)->isTypeDependent() &&
636 !TheCall->getArg(1)->isTypeDependent()) {
637 QualType FAType = TheCall->getArg(0)->getType();
638 QualType SAType = TheCall->getArg(1)->getType();
Mike Stump1eb44332009-09-09 15:08:12 +0000639
Douglas Gregorcde01732009-05-19 22:10:17 +0000640 if (!FAType->isVectorType() || !SAType->isVectorType()) {
641 Diag(TheCall->getLocStart(), diag::err_shufflevector_non_vector)
Mike Stump1eb44332009-09-09 15:08:12 +0000642 << SourceRange(TheCall->getArg(0)->getLocStart(),
Douglas Gregorcde01732009-05-19 22:10:17 +0000643 TheCall->getArg(1)->getLocEnd());
644 return ExprError();
645 }
Mike Stump1eb44332009-09-09 15:08:12 +0000646
Douglas Gregora4923eb2009-11-16 21:35:15 +0000647 if (!Context.hasSameUnqualifiedType(FAType, SAType)) {
Douglas Gregorcde01732009-05-19 22:10:17 +0000648 Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
Mike Stump1eb44332009-09-09 15:08:12 +0000649 << SourceRange(TheCall->getArg(0)->getLocStart(),
Douglas Gregorcde01732009-05-19 22:10:17 +0000650 TheCall->getArg(1)->getLocEnd());
651 return ExprError();
652 }
Eli Friedmand38617c2008-05-14 19:38:39 +0000653
John McCall183700f2009-09-21 23:43:11 +0000654 numElements = FAType->getAs<VectorType>()->getNumElements();
Douglas Gregorcde01732009-05-19 22:10:17 +0000655 if (TheCall->getNumArgs() != numElements+2) {
656 if (TheCall->getNumArgs() < numElements+2)
657 return ExprError(Diag(TheCall->getLocEnd(),
658 diag::err_typecheck_call_too_few_args)
659 << 0 /*function call*/ << TheCall->getSourceRange());
Sebastian Redl0eb23302009-01-19 00:08:26 +0000660 return ExprError(Diag(TheCall->getLocEnd(),
Douglas Gregorcde01732009-05-19 22:10:17 +0000661 diag::err_typecheck_call_too_many_args)
662 << 0 /*function call*/ << TheCall->getSourceRange());
663 }
Eli Friedmand38617c2008-05-14 19:38:39 +0000664 }
665
666 for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
Douglas Gregorcde01732009-05-19 22:10:17 +0000667 if (TheCall->getArg(i)->isTypeDependent() ||
668 TheCall->getArg(i)->isValueDependent())
669 continue;
670
Eli Friedmand38617c2008-05-14 19:38:39 +0000671 llvm::APSInt Result(32);
Chris Lattnerd1a0b6d2008-08-10 02:05:13 +0000672 if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context))
Sebastian Redl0eb23302009-01-19 00:08:26 +0000673 return ExprError(Diag(TheCall->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000674 diag::err_shufflevector_nonconstant_argument)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000675 << TheCall->getArg(i)->getSourceRange());
676
Chris Lattnerd1a0b6d2008-08-10 02:05:13 +0000677 if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000678 return ExprError(Diag(TheCall->getLocStart(),
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000679 diag::err_shufflevector_argument_too_large)
Sebastian Redl0eb23302009-01-19 00:08:26 +0000680 << TheCall->getArg(i)->getSourceRange());
Eli Friedmand38617c2008-05-14 19:38:39 +0000681 }
682
683 llvm::SmallVector<Expr*, 32> exprs;
684
Chris Lattnerd1a0b6d2008-08-10 02:05:13 +0000685 for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
Eli Friedmand38617c2008-05-14 19:38:39 +0000686 exprs.push_back(TheCall->getArg(i));
687 TheCall->setArg(i, 0);
688 }
689
Nate Begemana88dc302009-08-12 02:10:25 +0000690 return Owned(new (Context) ShuffleVectorExpr(Context, exprs.begin(),
691 exprs.size(), exprs[0]->getType(),
Ted Kremenek8189cde2009-02-07 01:47:29 +0000692 TheCall->getCallee()->getLocStart(),
693 TheCall->getRParenLoc()));
Eli Friedmand38617c2008-05-14 19:38:39 +0000694}
Chris Lattner30ce3442007-12-19 23:59:04 +0000695
Daniel Dunbar4493f792008-07-21 22:59:13 +0000696/// SemaBuiltinPrefetch - Handle __builtin_prefetch.
697// This is declared to take (const void*, ...) and can take two
698// optional constant int args.
699bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000700 unsigned NumArgs = TheCall->getNumArgs();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000701
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000702 if (NumArgs > 3)
703 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_many_args)
Chris Lattner2c21a072008-11-21 18:44:24 +0000704 << 0 /*function call*/ << TheCall->getSourceRange();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000705
706 // Argument 0 is checked for us and the remaining arguments must be
707 // constant integers.
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000708 for (unsigned i = 1; i != NumArgs; ++i) {
Daniel Dunbar4493f792008-07-21 22:59:13 +0000709 Expr *Arg = TheCall->getArg(i);
Douglas Gregorcde01732009-05-19 22:10:17 +0000710 if (Arg->isTypeDependent())
711 continue;
712
Eli Friedman9aef7262009-12-04 00:30:06 +0000713 if (!Arg->getType()->isIntegralType())
714 return Diag(TheCall->getLocStart(), diag::err_prefetch_invalid_arg_type)
Chris Lattner21fb98e2009-09-23 06:06:36 +0000715 << Arg->getSourceRange();
Douglas Gregorcde01732009-05-19 22:10:17 +0000716
Eli Friedman9aef7262009-12-04 00:30:06 +0000717 ImpCastExprToType(Arg, Context.IntTy, CastExpr::CK_IntegralCast);
718 TheCall->setArg(i, Arg);
719
Douglas Gregorcde01732009-05-19 22:10:17 +0000720 if (Arg->isValueDependent())
721 continue;
722
Eli Friedman9aef7262009-12-04 00:30:06 +0000723 llvm::APSInt Result;
Douglas Gregorcde01732009-05-19 22:10:17 +0000724 if (!Arg->isIntegerConstantExpr(Result, Context))
Eli Friedman9aef7262009-12-04 00:30:06 +0000725 return Diag(TheCall->getLocStart(), diag::err_prefetch_invalid_arg_ice)
Douglas Gregorcde01732009-05-19 22:10:17 +0000726 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Mike Stump1eb44332009-09-09 15:08:12 +0000727
Daniel Dunbar4493f792008-07-21 22:59:13 +0000728 // FIXME: gcc issues a warning and rewrites these to 0. These
729 // seems especially odd for the third argument since the default
730 // is 3.
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000731 if (i == 1) {
Eli Friedman9aef7262009-12-04 00:30:06 +0000732 if (Result.getLimitedValue() > 1)
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000733 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Chris Lattner21fb98e2009-09-23 06:06:36 +0000734 << "0" << "1" << Arg->getSourceRange();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000735 } else {
Eli Friedman9aef7262009-12-04 00:30:06 +0000736 if (Result.getLimitedValue() > 3)
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000737 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Chris Lattner21fb98e2009-09-23 06:06:36 +0000738 << "0" << "3" << Arg->getSourceRange();
Daniel Dunbar4493f792008-07-21 22:59:13 +0000739 }
740 }
741
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000742 return false;
Daniel Dunbar4493f792008-07-21 22:59:13 +0000743}
744
Chris Lattner21fb98e2009-09-23 06:06:36 +0000745/// SemaBuiltinEHReturnDataRegNo - Handle __builtin_eh_return_data_regno, the
746/// operand must be an integer constant.
747bool Sema::SemaBuiltinEHReturnDataRegNo(CallExpr *TheCall) {
748 llvm::APSInt Result;
749 if (!TheCall->getArg(0)->isIntegerConstantExpr(Result, Context))
750 return Diag(TheCall->getLocStart(), diag::err_expr_not_ice)
751 << TheCall->getArg(0)->getSourceRange();
752
753 return false;
754}
755
756
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000757/// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
758/// int type). This simply type checks that type is one of the defined
759/// constants (0-3).
Eric Christopherfee667f2009-12-23 03:49:37 +0000760// For compatability check 0-3, llvm only handles 0 and 2.
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000761bool Sema::SemaBuiltinObjectSize(CallExpr *TheCall) {
762 Expr *Arg = TheCall->getArg(1);
Douglas Gregorcde01732009-05-19 22:10:17 +0000763 if (Arg->isTypeDependent())
764 return false;
765
Mike Stump1eb44332009-09-09 15:08:12 +0000766 QualType ArgType = Arg->getType();
John McCall183700f2009-09-21 23:43:11 +0000767 const BuiltinType *BT = ArgType->getAs<BuiltinType>();
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000768 llvm::APSInt Result(32);
Douglas Gregorcde01732009-05-19 22:10:17 +0000769 if (!BT || BT->getKind() != BuiltinType::Int)
770 return Diag(TheCall->getLocStart(), diag::err_object_size_invalid_argument)
771 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
772
773 if (Arg->isValueDependent())
774 return false;
775
776 if (!Arg->isIntegerConstantExpr(Result, Context)) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000777 return Diag(TheCall->getLocStart(), diag::err_object_size_invalid_argument)
778 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000779 }
780
781 if (Result.getSExtValue() < 0 || Result.getSExtValue() > 3) {
Chris Lattnerfa25bbb2008-11-19 05:08:23 +0000782 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
783 << "0" << "3" << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Daniel Dunbard5f8a4f2008-09-03 21:13:56 +0000784 }
785
786 return false;
787}
788
Eli Friedman586d6a82009-05-03 06:04:26 +0000789/// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
Eli Friedmand875fed2009-05-03 04:46:36 +0000790/// This checks that val is a constant 1.
791bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
792 Expr *Arg = TheCall->getArg(1);
Douglas Gregorcde01732009-05-19 22:10:17 +0000793 if (Arg->isTypeDependent() || Arg->isValueDependent())
794 return false;
795
Eli Friedmand875fed2009-05-03 04:46:36 +0000796 llvm::APSInt Result(32);
797 if (!Arg->isIntegerConstantExpr(Result, Context) || Result != 1)
798 return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
799 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
800
801 return false;
802}
803
Ted Kremenekd30ef872009-01-12 23:09:09 +0000804// Handle i > 1 ? "x" : "y", recursivelly
Ted Kremenek082d9362009-03-20 21:35:28 +0000805bool Sema::SemaCheckStringLiteral(const Expr *E, const CallExpr *TheCall,
806 bool HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000807 unsigned format_idx, unsigned firstDataArg) {
Douglas Gregorcde01732009-05-19 22:10:17 +0000808 if (E->isTypeDependent() || E->isValueDependent())
809 return false;
Ted Kremenekd30ef872009-01-12 23:09:09 +0000810
811 switch (E->getStmtClass()) {
812 case Stmt::ConditionalOperatorClass: {
Ted Kremenek082d9362009-03-20 21:35:28 +0000813 const ConditionalOperator *C = cast<ConditionalOperator>(E);
Chris Lattner813b70d2009-12-22 06:00:13 +0000814 return SemaCheckStringLiteral(C->getTrueExpr(), TheCall,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000815 HasVAListArg, format_idx, firstDataArg)
Ted Kremenekd30ef872009-01-12 23:09:09 +0000816 && SemaCheckStringLiteral(C->getRHS(), TheCall,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000817 HasVAListArg, format_idx, firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000818 }
819
820 case Stmt::ImplicitCastExprClass: {
Ted Kremenek082d9362009-03-20 21:35:28 +0000821 const ImplicitCastExpr *Expr = cast<ImplicitCastExpr>(E);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000822 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000823 format_idx, firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000824 }
825
826 case Stmt::ParenExprClass: {
Ted Kremenek082d9362009-03-20 21:35:28 +0000827 const ParenExpr *Expr = cast<ParenExpr>(E);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000828 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000829 format_idx, firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000830 }
Mike Stump1eb44332009-09-09 15:08:12 +0000831
Ted Kremenek082d9362009-03-20 21:35:28 +0000832 case Stmt::DeclRefExprClass: {
833 const DeclRefExpr *DR = cast<DeclRefExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +0000834
Ted Kremenek082d9362009-03-20 21:35:28 +0000835 // As an exception, do not flag errors for variables binding to
836 // const string literals.
837 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
838 bool isConstant = false;
839 QualType T = DR->getType();
Ted Kremenekd30ef872009-01-12 23:09:09 +0000840
Ted Kremenek082d9362009-03-20 21:35:28 +0000841 if (const ArrayType *AT = Context.getAsArrayType(T)) {
842 isConstant = AT->getElementType().isConstant(Context);
Mike Stumpac5fc7c2009-08-04 21:02:39 +0000843 } else if (const PointerType *PT = T->getAs<PointerType>()) {
Mike Stump1eb44332009-09-09 15:08:12 +0000844 isConstant = T.isConstant(Context) &&
Ted Kremenek082d9362009-03-20 21:35:28 +0000845 PT->getPointeeType().isConstant(Context);
846 }
Mike Stump1eb44332009-09-09 15:08:12 +0000847
Ted Kremenek082d9362009-03-20 21:35:28 +0000848 if (isConstant) {
Sebastian Redl31310a22010-02-01 20:16:42 +0000849 if (const Expr *Init = VD->getAnyInitializer())
Ted Kremenek082d9362009-03-20 21:35:28 +0000850 return SemaCheckStringLiteral(Init, TheCall,
851 HasVAListArg, format_idx, firstDataArg);
852 }
Mike Stump1eb44332009-09-09 15:08:12 +0000853
Anders Carlssond966a552009-06-28 19:55:58 +0000854 // For vprintf* functions (i.e., HasVAListArg==true), we add a
855 // special check to see if the format string is a function parameter
856 // of the function calling the printf function. If the function
857 // has an attribute indicating it is a printf-like function, then we
858 // should suppress warnings concerning non-literals being used in a call
859 // to a vprintf function. For example:
860 //
861 // void
862 // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
863 // va_list ap;
864 // va_start(ap, fmt);
865 // vprintf(fmt, ap); // Do NOT emit a warning about "fmt".
866 // ...
867 //
868 //
869 // FIXME: We don't have full attribute support yet, so just check to see
870 // if the argument is a DeclRefExpr that references a parameter. We'll
871 // add proper support for checking the attribute later.
872 if (HasVAListArg)
873 if (isa<ParmVarDecl>(VD))
874 return true;
Ted Kremenek082d9362009-03-20 21:35:28 +0000875 }
Mike Stump1eb44332009-09-09 15:08:12 +0000876
Ted Kremenek082d9362009-03-20 21:35:28 +0000877 return false;
878 }
Ted Kremenekd30ef872009-01-12 23:09:09 +0000879
Anders Carlsson8f031b32009-06-27 04:05:33 +0000880 case Stmt::CallExprClass: {
881 const CallExpr *CE = cast<CallExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +0000882 if (const ImplicitCastExpr *ICE
Anders Carlsson8f031b32009-06-27 04:05:33 +0000883 = dyn_cast<ImplicitCastExpr>(CE->getCallee())) {
884 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ICE->getSubExpr())) {
885 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(DRE->getDecl())) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +0000886 if (const FormatArgAttr *FA = FD->getAttr<FormatArgAttr>()) {
Anders Carlsson8f031b32009-06-27 04:05:33 +0000887 unsigned ArgIndex = FA->getFormatIdx();
888 const Expr *Arg = CE->getArg(ArgIndex - 1);
Mike Stump1eb44332009-09-09 15:08:12 +0000889
890 return SemaCheckStringLiteral(Arg, TheCall, HasVAListArg,
Anders Carlsson8f031b32009-06-27 04:05:33 +0000891 format_idx, firstDataArg);
892 }
893 }
894 }
895 }
Mike Stump1eb44332009-09-09 15:08:12 +0000896
Anders Carlsson8f031b32009-06-27 04:05:33 +0000897 return false;
898 }
Ted Kremenek082d9362009-03-20 21:35:28 +0000899 case Stmt::ObjCStringLiteralClass:
900 case Stmt::StringLiteralClass: {
901 const StringLiteral *StrE = NULL;
Mike Stump1eb44332009-09-09 15:08:12 +0000902
Ted Kremenek082d9362009-03-20 21:35:28 +0000903 if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
Ted Kremenekd30ef872009-01-12 23:09:09 +0000904 StrE = ObjCFExpr->getString();
905 else
Ted Kremenek082d9362009-03-20 21:35:28 +0000906 StrE = cast<StringLiteral>(E);
Mike Stump1eb44332009-09-09 15:08:12 +0000907
Ted Kremenekd30ef872009-01-12 23:09:09 +0000908 if (StrE) {
Mike Stump1eb44332009-09-09 15:08:12 +0000909 CheckPrintfString(StrE, E, TheCall, HasVAListArg, format_idx,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000910 firstDataArg);
Ted Kremenekd30ef872009-01-12 23:09:09 +0000911 return true;
912 }
Mike Stump1eb44332009-09-09 15:08:12 +0000913
Ted Kremenekd30ef872009-01-12 23:09:09 +0000914 return false;
915 }
Mike Stump1eb44332009-09-09 15:08:12 +0000916
Ted Kremenek082d9362009-03-20 21:35:28 +0000917 default:
918 return false;
Ted Kremenekd30ef872009-01-12 23:09:09 +0000919 }
920}
921
Fariborz Jahaniane898f8a2009-05-21 18:48:51 +0000922void
Mike Stump1eb44332009-09-09 15:08:12 +0000923Sema::CheckNonNullArguments(const NonNullAttr *NonNull,
924 const CallExpr *TheCall) {
Fariborz Jahaniane898f8a2009-05-21 18:48:51 +0000925 for (NonNullAttr::iterator i = NonNull->begin(), e = NonNull->end();
926 i != e; ++i) {
Chris Lattner12b97ff2009-05-25 18:23:36 +0000927 const Expr *ArgExpr = TheCall->getArg(*i);
Douglas Gregorce940492009-09-25 04:25:58 +0000928 if (ArgExpr->isNullPointerConstant(Context,
929 Expr::NPC_ValueDependentIsNotNull))
Chris Lattner12b97ff2009-05-25 18:23:36 +0000930 Diag(TheCall->getCallee()->getLocStart(), diag::warn_null_arg)
931 << ArgExpr->getSourceRange();
Fariborz Jahaniane898f8a2009-05-21 18:48:51 +0000932 }
933}
Ted Kremenekd30ef872009-01-12 23:09:09 +0000934
Chris Lattner59907c42007-08-10 20:18:51 +0000935/// CheckPrintfArguments - Check calls to printf (and similar functions) for
Mike Stump1eb44332009-09-09 15:08:12 +0000936/// correct use of format strings.
Ted Kremenek71895b92007-08-14 17:39:48 +0000937///
938/// HasVAListArg - A predicate indicating whether the printf-like
939/// function is passed an explicit va_arg argument (e.g., vprintf)
940///
941/// format_idx - The index into Args for the format string.
942///
943/// Improper format strings to functions in the printf family can be
944/// the source of bizarre bugs and very serious security holes. A
945/// good source of information is available in the following paper
946/// (which includes additional references):
Chris Lattner59907c42007-08-10 20:18:51 +0000947///
948/// FormatGuard: Automatic Protection From printf Format String
949/// Vulnerabilities, Proceedings of the 10th USENIX Security Symposium, 2001.
Ted Kremenek71895b92007-08-14 17:39:48 +0000950///
951/// Functionality implemented:
952///
953/// We can statically check the following properties for string
954/// literal format strings for non v.*printf functions (where the
955/// arguments are passed directly):
956//
957/// (1) Are the number of format conversions equal to the number of
958/// data arguments?
959///
960/// (2) Does each format conversion correctly match the type of the
961/// corresponding data argument? (TODO)
962///
963/// Moreover, for all printf functions we can:
964///
965/// (3) Check for a missing format string (when not caught by type checking).
966///
967/// (4) Check for no-operation flags; e.g. using "#" with format
968/// conversion 'c' (TODO)
969///
970/// (5) Check the use of '%n', a major source of security holes.
971///
972/// (6) Check for malformed format conversions that don't specify anything.
973///
974/// (7) Check for empty format strings. e.g: printf("");
975///
976/// (8) Check that the format string is a wide literal.
977///
978/// All of these checks can be done by parsing the format string.
979///
980/// For now, we ONLY do (1), (3), (5), (6), (7), and (8).
Chris Lattner59907c42007-08-10 20:18:51 +0000981void
Mike Stump1eb44332009-09-09 15:08:12 +0000982Sema::CheckPrintfArguments(const CallExpr *TheCall, bool HasVAListArg,
Douglas Gregor3c385e52009-02-14 18:57:46 +0000983 unsigned format_idx, unsigned firstDataArg) {
Ted Kremenek082d9362009-03-20 21:35:28 +0000984 const Expr *Fn = TheCall->getCallee();
Chris Lattner925e60d2007-12-28 05:29:59 +0000985
Sebastian Redl4a2614e2009-11-17 18:02:24 +0000986 // The way the format attribute works in GCC, the implicit this argument
987 // of member functions is counted. However, it doesn't appear in our own
988 // lists, so decrement format_idx in that case.
989 if (isa<CXXMemberCallExpr>(TheCall)) {
990 // Catch a format attribute mistakenly referring to the object argument.
991 if (format_idx == 0)
992 return;
993 --format_idx;
994 if(firstDataArg != 0)
995 --firstDataArg;
996 }
997
Mike Stump1eb44332009-09-09 15:08:12 +0000998 // CHECK: printf-like function is called with no format string.
Chris Lattner925e60d2007-12-28 05:29:59 +0000999 if (format_idx >= TheCall->getNumArgs()) {
Chris Lattnerdcd5ef12008-11-19 05:27:50 +00001000 Diag(TheCall->getRParenLoc(), diag::warn_printf_missing_format_string)
1001 << Fn->getSourceRange();
Ted Kremenek71895b92007-08-14 17:39:48 +00001002 return;
1003 }
Mike Stump1eb44332009-09-09 15:08:12 +00001004
Ted Kremenek082d9362009-03-20 21:35:28 +00001005 const Expr *OrigFormatExpr = TheCall->getArg(format_idx)->IgnoreParenCasts();
Mike Stump1eb44332009-09-09 15:08:12 +00001006
Chris Lattner59907c42007-08-10 20:18:51 +00001007 // CHECK: format string is not a string literal.
Mike Stump1eb44332009-09-09 15:08:12 +00001008 //
Ted Kremenek71895b92007-08-14 17:39:48 +00001009 // Dynamically generated format strings are difficult to
1010 // automatically vet at compile time. Requiring that format strings
1011 // are string literals: (1) permits the checking of format strings by
1012 // the compiler and thereby (2) can practically remove the source of
1013 // many format string exploits.
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001014
Mike Stump1eb44332009-09-09 15:08:12 +00001015 // Format string can be either ObjC string (e.g. @"%d") or
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001016 // C string (e.g. "%d")
Mike Stump1eb44332009-09-09 15:08:12 +00001017 // ObjC string uses the same format specifiers as C string, so we can use
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001018 // the same format string checking logic for both ObjC and C strings.
Chris Lattner1cd3e1f2009-04-29 04:49:34 +00001019 if (SemaCheckStringLiteral(OrigFormatExpr, TheCall, HasVAListArg, format_idx,
1020 firstDataArg))
1021 return; // Literal format string found, check done!
Ted Kremenek7ff22b22008-06-16 18:00:42 +00001022
Chris Lattner655f1412009-04-29 04:59:47 +00001023 // If there are no arguments specified, warn with -Wformat-security, otherwise
1024 // warn only with -Wformat-nonliteral.
1025 if (TheCall->getNumArgs() == format_idx+1)
Mike Stump1eb44332009-09-09 15:08:12 +00001026 Diag(TheCall->getArg(format_idx)->getLocStart(),
Chris Lattner655f1412009-04-29 04:59:47 +00001027 diag::warn_printf_nonliteral_noargs)
1028 << OrigFormatExpr->getSourceRange();
1029 else
Mike Stump1eb44332009-09-09 15:08:12 +00001030 Diag(TheCall->getArg(format_idx)->getLocStart(),
Chris Lattner655f1412009-04-29 04:59:47 +00001031 diag::warn_printf_nonliteral)
1032 << OrigFormatExpr->getSourceRange();
Ted Kremenekd30ef872009-01-12 23:09:09 +00001033}
Ted Kremenek71895b92007-08-14 17:39:48 +00001034
Ted Kremeneke0e53132010-01-28 23:39:18 +00001035namespace {
Ted Kremenek808015a2010-01-29 03:16:21 +00001036class CheckPrintfHandler : public FormatStringHandler {
Ted Kremeneke0e53132010-01-28 23:39:18 +00001037 Sema &S;
1038 const StringLiteral *FExpr;
1039 const Expr *OrigFormatExpr;
1040 unsigned NumConversions;
1041 const unsigned NumDataArgs;
1042 const bool IsObjCLiteral;
1043 const char *Beg; // Start of format string.
Ted Kremenek0d277352010-01-29 01:06:55 +00001044 const bool HasVAListArg;
1045 const CallExpr *TheCall;
1046 unsigned FormatIdx;
Ted Kremeneke0e53132010-01-28 23:39:18 +00001047public:
1048 CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
1049 const Expr *origFormatExpr,
1050 unsigned numDataArgs, bool isObjCLiteral,
Ted Kremenek0d277352010-01-29 01:06:55 +00001051 const char *beg, bool hasVAListArg,
1052 const CallExpr *theCall, unsigned formatIdx)
Ted Kremeneke0e53132010-01-28 23:39:18 +00001053 : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
1054 NumConversions(0), NumDataArgs(numDataArgs),
Ted Kremenek0d277352010-01-29 01:06:55 +00001055 IsObjCLiteral(isObjCLiteral), Beg(beg),
1056 HasVAListArg(hasVAListArg),
1057 TheCall(theCall), FormatIdx(formatIdx) {}
Ted Kremenek07d161f2010-01-29 01:50:07 +00001058
1059 void DoneProcessing();
Ted Kremenek808015a2010-01-29 03:16:21 +00001060
1061 void HandleIncompleteFormatSpecifier(const char *startSpecifier,
1062 unsigned specifierLen);
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001063
1064 void HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1065 const char *startSpecifier,
1066 unsigned specifierLen);
1067
Ted Kremeneke0e53132010-01-28 23:39:18 +00001068 void HandleNullChar(const char *nullCharacter);
1069
1070 bool HandleFormatSpecifier(const analyze_printf::FormatSpecifier &FS,
1071 const char *startSpecifier,
1072 unsigned specifierLen);
1073private:
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001074 SourceRange getFormatStringRange();
1075 SourceRange getFormatSpecifierRange(const char *startSpecifier,
1076 unsigned specifierLen);
Ted Kremeneke0e53132010-01-28 23:39:18 +00001077 SourceLocation getLocationOfByte(const char *x);
Ted Kremenek0d277352010-01-29 01:06:55 +00001078
1079 bool HandleAmount(const analyze_printf::OptionalAmount &Amt,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001080 unsigned MissingArgDiag, unsigned BadTypeDiag,
1081 const char *startSpecifier, unsigned specifierLen);
Ted Kremenek0d277352010-01-29 01:06:55 +00001082
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001083 bool MatchType(QualType A, QualType B, bool ignoreSign);
1084
Ted Kremenek0d277352010-01-29 01:06:55 +00001085 const Expr *getDataArg(unsigned i) const;
Ted Kremeneke0e53132010-01-28 23:39:18 +00001086};
1087}
1088
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001089SourceRange CheckPrintfHandler::getFormatStringRange() {
Ted Kremeneke0e53132010-01-28 23:39:18 +00001090 return OrigFormatExpr->getSourceRange();
1091}
1092
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001093SourceRange CheckPrintfHandler::
1094getFormatSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
1095 return SourceRange(getLocationOfByte(startSpecifier),
1096 getLocationOfByte(startSpecifier+specifierLen-1));
1097}
1098
Ted Kremeneke0e53132010-01-28 23:39:18 +00001099SourceLocation CheckPrintfHandler::getLocationOfByte(const char *x) {
1100 return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
1101}
1102
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001103void CheckPrintfHandler::
Ted Kremenek808015a2010-01-29 03:16:21 +00001104HandleIncompleteFormatSpecifier(const char *startSpecifier,
1105 unsigned specifierLen) {
1106 SourceLocation Loc = getLocationOfByte(startSpecifier);
1107 S.Diag(Loc, diag::warn_printf_incomplete_specifier)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001108 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek808015a2010-01-29 03:16:21 +00001109}
1110
1111void CheckPrintfHandler::
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001112HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1113 const char *startSpecifier,
1114 unsigned specifierLen) {
1115
1116 ++NumConversions;
Ted Kremenek808015a2010-01-29 03:16:21 +00001117 const analyze_printf::ConversionSpecifier &CS =
1118 FS.getConversionSpecifier();
1119 SourceLocation Loc = getLocationOfByte(CS.getStart());
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001120 S.Diag(Loc, diag::warn_printf_invalid_conversion)
Ted Kremenek808015a2010-01-29 03:16:21 +00001121 << llvm::StringRef(CS.getStart(), CS.getLength())
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001122 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001123}
1124
Ted Kremeneke0e53132010-01-28 23:39:18 +00001125void CheckPrintfHandler::HandleNullChar(const char *nullCharacter) {
1126 // The presence of a null character is likely an error.
1127 S.Diag(getLocationOfByte(nullCharacter),
1128 diag::warn_printf_format_string_contains_null_char)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001129 << getFormatStringRange();
Ted Kremeneke0e53132010-01-28 23:39:18 +00001130}
1131
Ted Kremenek0d277352010-01-29 01:06:55 +00001132const Expr *CheckPrintfHandler::getDataArg(unsigned i) const {
1133 return TheCall->getArg(FormatIdx + i);
1134}
1135
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001136bool CheckPrintfHandler::MatchType(QualType A, QualType B, bool ignoreSign) {
1137 A = S.Context.getCanonicalType(A).getUnqualifiedType();
1138 B = S.Context.getCanonicalType(B).getUnqualifiedType();
1139
1140 if (A == B)
1141 return true;
1142
1143 if (ignoreSign) {
1144 if (const BuiltinType *BT = B->getAs<BuiltinType>()) {
1145 switch (BT->getKind()) {
1146 default:
1147 return false;
1148 case BuiltinType::Char_S:
1149 case BuiltinType::SChar:
1150 return A == S.Context.UnsignedCharTy;
1151 case BuiltinType::Char_U:
1152 case BuiltinType::UChar:
1153 return A == S.Context.SignedCharTy;
1154 case BuiltinType::Short:
1155 return A == S.Context.UnsignedShortTy;
1156 case BuiltinType::UShort:
1157 return A == S.Context.ShortTy;
1158 case BuiltinType::Int:
1159 return A == S.Context.UnsignedIntTy;
1160 case BuiltinType::UInt:
1161 return A == S.Context.IntTy;
1162 case BuiltinType::Long:
1163 return A == S.Context.UnsignedLongTy;
1164 case BuiltinType::ULong:
1165 return A == S.Context.LongTy;
1166 case BuiltinType::LongLong:
1167 return A == S.Context.UnsignedLongLongTy;
1168 case BuiltinType::ULongLong:
1169 return A == S.Context.LongLongTy;
1170 }
1171 return A == B;
1172 }
1173 }
1174 return false;
1175}
1176
Ted Kremenek0d277352010-01-29 01:06:55 +00001177bool
1178CheckPrintfHandler::HandleAmount(const analyze_printf::OptionalAmount &Amt,
1179 unsigned MissingArgDiag,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001180 unsigned BadTypeDiag,
1181 const char *startSpecifier,
1182 unsigned specifierLen) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001183
1184 if (Amt.hasDataArgument()) {
1185 ++NumConversions;
1186 if (!HasVAListArg) {
1187 if (NumConversions > NumDataArgs) {
1188 S.Diag(getLocationOfByte(Amt.getStart()), MissingArgDiag)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001189 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek0d277352010-01-29 01:06:55 +00001190 // Don't do any more checking. We will just emit
1191 // spurious errors.
1192 return false;
1193 }
1194
1195 // Type check the data argument. It should be an 'int'.
Ted Kremenek31f8e322010-01-29 23:32:22 +00001196 // Although not in conformance with C99, we also allow the argument to be
1197 // an 'unsigned int' as that is a reasonably safe case. GCC also
1198 // doesn't emit a warning for that case.
Ted Kremenek0d277352010-01-29 01:06:55 +00001199 const Expr *Arg = getDataArg(NumConversions);
1200 QualType T = Arg->getType();
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001201 if (!MatchType(T, S.Context.IntTy, true)) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001202 S.Diag(getLocationOfByte(Amt.getStart()), BadTypeDiag)
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001203 << S.Context.IntTy << T
1204 << getFormatSpecifierRange(startSpecifier, specifierLen)
1205 << Arg->getSourceRange();
Ted Kremenek0d277352010-01-29 01:06:55 +00001206 // Don't do any more checking. We will just emit
1207 // spurious errors.
1208 return false;
1209 }
1210 }
1211 }
1212 return true;
1213}
Ted Kremenek0d277352010-01-29 01:06:55 +00001214
Ted Kremeneke0e53132010-01-28 23:39:18 +00001215bool
1216CheckPrintfHandler::HandleFormatSpecifier(const analyze_printf::FormatSpecifier &FS,
1217 const char *startSpecifier,
1218 unsigned specifierLen) {
1219
1220 using namespace analyze_printf;
1221 const ConversionSpecifier &CS = FS.getConversionSpecifier();
1222
Ted Kremenek0d277352010-01-29 01:06:55 +00001223 // First check if the field width, precision, and conversion specifier
1224 // have matching data arguments.
1225 if (!HandleAmount(FS.getFieldWidth(),
1226 diag::warn_printf_asterisk_width_missing_arg,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001227 diag::warn_printf_asterisk_width_wrong_type,
1228 startSpecifier, specifierLen)) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001229 return false;
1230 }
1231
1232 if (!HandleAmount(FS.getPrecision(),
1233 diag::warn_printf_asterisk_precision_missing_arg,
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001234 diag::warn_printf_asterisk_precision_wrong_type,
1235 startSpecifier, specifierLen)) {
Ted Kremenek0d277352010-01-29 01:06:55 +00001236 return false;
1237 }
1238
Ted Kremeneke0e53132010-01-28 23:39:18 +00001239 // Check for using an Objective-C specific conversion specifier
1240 // in a non-ObjC literal.
1241 if (!IsObjCLiteral && CS.isObjCArg()) {
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001242 HandleInvalidConversionSpecifier(FS, startSpecifier, specifierLen);
Ted Kremeneke0e53132010-01-28 23:39:18 +00001243
1244 // Continue checking the other format specifiers.
1245 return true;
1246 }
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001247
1248 if (!CS.consumesDataArgument()) {
1249 // FIXME: Technically specifying a precision or field width here
1250 // makes no sense. Worth issuing a warning at some point.
1251 return true;
1252 }
Ted Kremeneke82d8042010-01-29 01:35:25 +00001253
Ted Kremenek26ac2e02010-01-29 02:40:24 +00001254 ++NumConversions;
1255
Ted Kremeneke82d8042010-01-29 01:35:25 +00001256 // Are we using '%n'? Issue a warning about this being
1257 // a possible security issue.
1258 if (CS.getKind() == ConversionSpecifier::OutIntPtrArg) {
1259 S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_write_back)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001260 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremeneke82d8042010-01-29 01:35:25 +00001261 // Continue checking the other format specifiers.
1262 return true;
1263 }
1264
Ted Kremenekda51f0d2010-01-29 01:43:31 +00001265
1266 // The remaining checks depend on the data arguments.
1267 if (HasVAListArg)
1268 return true;
1269
1270 if (NumConversions > NumDataArgs) {
1271 S.Diag(getLocationOfByte(CS.getStart()),
1272 diag::warn_printf_insufficient_data_args)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001273 << getFormatSpecifierRange(startSpecifier, specifierLen);
Ted Kremenekda51f0d2010-01-29 01:43:31 +00001274 // Don't do any more checking.
1275 return false;
1276 }
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001277
1278 // Now type check the data expression that matches the
1279 // format specifier.
1280 const Expr *Ex = getDataArg(NumConversions);
1281 const analyze_printf::ArgTypeResult &ATR = FS.getArgType(S.Context);
Ted Kremenek180f2842010-02-01 19:28:15 +00001282
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001283 if (const QualType *T = ATR.getSpecificType()) {
1284 if (!MatchType(*T, Ex->getType(), true)) {
Ted Kremenek180f2842010-02-01 19:28:15 +00001285 // Check if we didn't match because of an implicit cast from a 'char'
1286 // or 'short' to an 'int'. This is done because printf is a varargs
1287 // function.
Ted Kremenek180f2842010-02-01 19:28:15 +00001288 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Ex))
Ted Kremenek105d41c2010-02-01 19:38:10 +00001289 if (ICE->getType() == S.Context.IntTy)
1290 if (MatchType(*T, ICE->getSubExpr()->getType(), true))
1291 return true;
1292
1293 S.Diag(getLocationOfByte(CS.getStart()),
1294 diag::warn_printf_conversion_argument_type_mismatch)
1295 << *T << Ex->getType()
1296 << getFormatSpecifierRange(startSpecifier, specifierLen)
1297 << Ex->getSourceRange();
Ted Kremenekd635c5f2010-01-30 00:49:51 +00001298 }
1299 return true;
1300 }
Ted Kremeneke0e53132010-01-28 23:39:18 +00001301
1302 return true;
1303}
1304
Ted Kremenek07d161f2010-01-29 01:50:07 +00001305void CheckPrintfHandler::DoneProcessing() {
1306 // Does the number of data arguments exceed the number of
1307 // format conversions in the format string?
1308 if (!HasVAListArg && NumConversions < NumDataArgs)
1309 S.Diag(getDataArg(NumConversions+1)->getLocStart(),
1310 diag::warn_printf_too_many_data_args)
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001311 << getFormatStringRange();
Ted Kremenek07d161f2010-01-29 01:50:07 +00001312}
Ted Kremeneke0e53132010-01-28 23:39:18 +00001313
Ted Kremenekf88c8e02010-01-29 20:55:36 +00001314void Sema::CheckPrintfString(const StringLiteral *FExpr,
1315 const Expr *OrigFormatExpr,
1316 const CallExpr *TheCall, bool HasVAListArg,
1317 unsigned format_idx, unsigned firstDataArg) {
Ted Kremenekce7024e2010-01-28 01:18:22 +00001318
Ted Kremeneke0e53132010-01-28 23:39:18 +00001319 // CHECK: is the format string a wide literal?
1320 if (FExpr->isWide()) {
1321 Diag(FExpr->getLocStart(),
1322 diag::warn_printf_format_string_is_wide_literal)
1323 << OrigFormatExpr->getSourceRange();
1324 return;
1325 }
Ted Kremenekce7024e2010-01-28 01:18:22 +00001326
Ted Kremeneke0e53132010-01-28 23:39:18 +00001327 // Str - The format string. NOTE: this is NOT null-terminated!
1328 const char *Str = FExpr->getStrData();
1329
1330 // CHECK: empty format string?
1331 unsigned StrLen = FExpr->getByteLength();
1332
1333 if (StrLen == 0) {
1334 Diag(FExpr->getLocStart(), diag::warn_printf_empty_format_string)
1335 << OrigFormatExpr->getSourceRange();
1336 return;
1337 }
1338
1339 CheckPrintfHandler H(*this, FExpr, OrigFormatExpr,
1340 TheCall->getNumArgs() - firstDataArg,
Ted Kremenek0d277352010-01-29 01:06:55 +00001341 isa<ObjCStringLiteral>(OrigFormatExpr), Str,
1342 HasVAListArg, TheCall, format_idx);
Ted Kremeneke0e53132010-01-28 23:39:18 +00001343
Ted Kremenek808015a2010-01-29 03:16:21 +00001344 if (!ParseFormatString(H, Str, Str + StrLen))
1345 H.DoneProcessing();
Ted Kremenekce7024e2010-01-28 01:18:22 +00001346}
1347
Ted Kremenek06de2762007-08-17 16:46:58 +00001348//===--- CHECK: Return Address of Stack Variable --------------------------===//
1349
1350static DeclRefExpr* EvalVal(Expr *E);
1351static DeclRefExpr* EvalAddr(Expr* E);
1352
1353/// CheckReturnStackAddr - Check if a return statement returns the address
1354/// of a stack variable.
1355void
1356Sema::CheckReturnStackAddr(Expr *RetValExp, QualType lhsType,
1357 SourceLocation ReturnLoc) {
Mike Stump1eb44332009-09-09 15:08:12 +00001358
Ted Kremenek06de2762007-08-17 16:46:58 +00001359 // Perform checking for returned stack addresses.
Steve Naroffdd972f22008-09-05 22:11:13 +00001360 if (lhsType->isPointerType() || lhsType->isBlockPointerType()) {
Ted Kremenek06de2762007-08-17 16:46:58 +00001361 if (DeclRefExpr *DR = EvalAddr(RetValExp))
Chris Lattner3c73c412008-11-19 08:23:25 +00001362 Diag(DR->getLocStart(), diag::warn_ret_stack_addr)
Chris Lattner08631c52008-11-23 21:45:46 +00001363 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
Mike Stump1eb44332009-09-09 15:08:12 +00001364
Steve Naroffc50a4a52008-09-16 22:25:10 +00001365 // Skip over implicit cast expressions when checking for block expressions.
Chris Lattner4ca606e2009-09-08 00:36:37 +00001366 RetValExp = RetValExp->IgnoreParenCasts();
Steve Naroffc50a4a52008-09-16 22:25:10 +00001367
Chris Lattner9e6b37a2009-10-30 04:01:58 +00001368 if (BlockExpr *C = dyn_cast<BlockExpr>(RetValExp))
Mike Stump397195b2009-04-17 00:09:41 +00001369 if (C->hasBlockDeclRefExprs())
1370 Diag(C->getLocStart(), diag::err_ret_local_block)
1371 << C->getSourceRange();
Chris Lattner9e6b37a2009-10-30 04:01:58 +00001372
1373 if (AddrLabelExpr *ALE = dyn_cast<AddrLabelExpr>(RetValExp))
1374 Diag(ALE->getLocStart(), diag::warn_ret_addr_label)
1375 << ALE->getSourceRange();
1376
Mike Stumpac5fc7c2009-08-04 21:02:39 +00001377 } else if (lhsType->isReferenceType()) {
1378 // Perform checking for stack values returned by reference.
Douglas Gregor49badde2008-10-27 19:41:14 +00001379 // Check for a reference to the stack
1380 if (DeclRefExpr *DR = EvalVal(RetValExp))
Chris Lattnerdcd5ef12008-11-19 05:27:50 +00001381 Diag(DR->getLocStart(), diag::warn_ret_stack_ref)
Chris Lattner08631c52008-11-23 21:45:46 +00001382 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
Ted Kremenek06de2762007-08-17 16:46:58 +00001383 }
1384}
1385
1386/// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
1387/// check if the expression in a return statement evaluates to an address
1388/// to a location on the stack. The recursion is used to traverse the
1389/// AST of the return expression, with recursion backtracking when we
1390/// encounter a subexpression that (1) clearly does not lead to the address
1391/// of a stack variable or (2) is something we cannot determine leads to
1392/// the address of a stack variable based on such local checking.
1393///
Ted Kremeneke8c600f2007-08-28 17:02:55 +00001394/// EvalAddr processes expressions that are pointers that are used as
1395/// references (and not L-values). EvalVal handles all other values.
Mike Stump1eb44332009-09-09 15:08:12 +00001396/// At the base case of the recursion is a check for a DeclRefExpr* in
Ted Kremenek06de2762007-08-17 16:46:58 +00001397/// the refers to a stack variable.
1398///
1399/// This implementation handles:
1400///
1401/// * pointer-to-pointer casts
1402/// * implicit conversions from array references to pointers
1403/// * taking the address of fields
1404/// * arbitrary interplay between "&" and "*" operators
1405/// * pointer arithmetic from an address of a stack variable
1406/// * taking the address of an array element where the array is on the stack
1407static DeclRefExpr* EvalAddr(Expr *E) {
Ted Kremenek06de2762007-08-17 16:46:58 +00001408 // We should only be called for evaluating pointer expressions.
David Chisnall0f436562009-08-17 16:35:33 +00001409 assert((E->getType()->isAnyPointerType() ||
Steve Naroffdd972f22008-09-05 22:11:13 +00001410 E->getType()->isBlockPointerType() ||
Ted Kremeneka526c5c2008-01-07 19:49:32 +00001411 E->getType()->isObjCQualifiedIdType()) &&
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001412 "EvalAddr only works on pointers");
Mike Stump1eb44332009-09-09 15:08:12 +00001413
Ted Kremenek06de2762007-08-17 16:46:58 +00001414 // Our "symbolic interpreter" is just a dispatch off the currently
1415 // viewed AST node. We then recursively traverse the AST by calling
1416 // EvalAddr and EvalVal appropriately.
1417 switch (E->getStmtClass()) {
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001418 case Stmt::ParenExprClass:
1419 // Ignore parentheses.
1420 return EvalAddr(cast<ParenExpr>(E)->getSubExpr());
Ted Kremenek06de2762007-08-17 16:46:58 +00001421
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001422 case Stmt::UnaryOperatorClass: {
1423 // The only unary operator that make sense to handle here
1424 // is AddrOf. All others don't make sense as pointers.
1425 UnaryOperator *U = cast<UnaryOperator>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001426
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001427 if (U->getOpcode() == UnaryOperator::AddrOf)
1428 return EvalVal(U->getSubExpr());
1429 else
Ted Kremenek06de2762007-08-17 16:46:58 +00001430 return NULL;
1431 }
Mike Stump1eb44332009-09-09 15:08:12 +00001432
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001433 case Stmt::BinaryOperatorClass: {
1434 // Handle pointer arithmetic. All other binary operators are not valid
1435 // in this context.
1436 BinaryOperator *B = cast<BinaryOperator>(E);
1437 BinaryOperator::Opcode op = B->getOpcode();
Mike Stump1eb44332009-09-09 15:08:12 +00001438
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001439 if (op != BinaryOperator::Add && op != BinaryOperator::Sub)
1440 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001441
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001442 Expr *Base = B->getLHS();
1443
1444 // Determine which argument is the real pointer base. It could be
1445 // the RHS argument instead of the LHS.
1446 if (!Base->getType()->isPointerType()) Base = B->getRHS();
Mike Stump1eb44332009-09-09 15:08:12 +00001447
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001448 assert (Base->getType()->isPointerType());
1449 return EvalAddr(Base);
1450 }
Steve Naroff61f40a22008-09-10 19:17:48 +00001451
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001452 // For conditional operators we need to see if either the LHS or RHS are
1453 // valid DeclRefExpr*s. If one of them is valid, we return it.
1454 case Stmt::ConditionalOperatorClass: {
1455 ConditionalOperator *C = cast<ConditionalOperator>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001456
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001457 // Handle the GNU extension for missing LHS.
1458 if (Expr *lhsExpr = C->getLHS())
1459 if (DeclRefExpr* LHS = EvalAddr(lhsExpr))
1460 return LHS;
1461
1462 return EvalAddr(C->getRHS());
1463 }
Mike Stump1eb44332009-09-09 15:08:12 +00001464
Ted Kremenek54b52742008-08-07 00:49:01 +00001465 // For casts, we need to handle conversions from arrays to
1466 // pointer values, and pointer-to-pointer conversions.
Douglas Gregor49badde2008-10-27 19:41:14 +00001467 case Stmt::ImplicitCastExprClass:
Douglas Gregor6eec8e82008-10-28 15:36:24 +00001468 case Stmt::CStyleCastExprClass:
Douglas Gregor49badde2008-10-27 19:41:14 +00001469 case Stmt::CXXFunctionalCastExprClass: {
Argyrios Kyrtzidis0835a3c2008-08-18 23:01:59 +00001470 Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
Ted Kremenek54b52742008-08-07 00:49:01 +00001471 QualType T = SubExpr->getType();
Mike Stump1eb44332009-09-09 15:08:12 +00001472
Steve Naroffdd972f22008-09-05 22:11:13 +00001473 if (SubExpr->getType()->isPointerType() ||
1474 SubExpr->getType()->isBlockPointerType() ||
1475 SubExpr->getType()->isObjCQualifiedIdType())
Ted Kremenek54b52742008-08-07 00:49:01 +00001476 return EvalAddr(SubExpr);
1477 else if (T->isArrayType())
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001478 return EvalVal(SubExpr);
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001479 else
Ted Kremenek54b52742008-08-07 00:49:01 +00001480 return 0;
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001481 }
Mike Stump1eb44332009-09-09 15:08:12 +00001482
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001483 // C++ casts. For dynamic casts, static casts, and const casts, we
1484 // are always converting from a pointer-to-pointer, so we just blow
Douglas Gregor49badde2008-10-27 19:41:14 +00001485 // through the cast. In the case the dynamic cast doesn't fail (and
1486 // return NULL), we take the conservative route and report cases
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001487 // where we return the address of a stack variable. For Reinterpre
Douglas Gregor49badde2008-10-27 19:41:14 +00001488 // FIXME: The comment about is wrong; we're not always converting
1489 // from pointer to pointer. I'm guessing that this code should also
Mike Stump1eb44332009-09-09 15:08:12 +00001490 // handle references to objects.
1491 case Stmt::CXXStaticCastExprClass:
1492 case Stmt::CXXDynamicCastExprClass:
Douglas Gregor49badde2008-10-27 19:41:14 +00001493 case Stmt::CXXConstCastExprClass:
1494 case Stmt::CXXReinterpretCastExprClass: {
1495 Expr *S = cast<CXXNamedCastExpr>(E)->getSubExpr();
Steve Naroffdd972f22008-09-05 22:11:13 +00001496 if (S->getType()->isPointerType() || S->getType()->isBlockPointerType())
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001497 return EvalAddr(S);
1498 else
1499 return NULL;
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001500 }
Mike Stump1eb44332009-09-09 15:08:12 +00001501
Chris Lattnerfae3f1f2007-12-28 05:31:15 +00001502 // Everything else: we simply don't reason about them.
1503 default:
1504 return NULL;
1505 }
Ted Kremenek06de2762007-08-17 16:46:58 +00001506}
Mike Stump1eb44332009-09-09 15:08:12 +00001507
Ted Kremenek06de2762007-08-17 16:46:58 +00001508
1509/// EvalVal - This function is complements EvalAddr in the mutual recursion.
1510/// See the comments for EvalAddr for more details.
1511static DeclRefExpr* EvalVal(Expr *E) {
Mike Stump1eb44332009-09-09 15:08:12 +00001512
Ted Kremeneke8c600f2007-08-28 17:02:55 +00001513 // We should only be called for evaluating non-pointer expressions, or
1514 // expressions with a pointer type that are not used as references but instead
1515 // are l-values (e.g., DeclRefExpr with a pointer type).
Mike Stump1eb44332009-09-09 15:08:12 +00001516
Ted Kremenek06de2762007-08-17 16:46:58 +00001517 // Our "symbolic interpreter" is just a dispatch off the currently
1518 // viewed AST node. We then recursively traverse the AST by calling
1519 // EvalAddr and EvalVal appropriately.
1520 switch (E->getStmtClass()) {
Douglas Gregora2813ce2009-10-23 18:54:35 +00001521 case Stmt::DeclRefExprClass: {
Ted Kremenek06de2762007-08-17 16:46:58 +00001522 // DeclRefExpr: the base case. When we hit a DeclRefExpr we are looking
1523 // at code that refers to a variable's name. We check if it has local
1524 // storage within the function, and if so, return the expression.
1525 DeclRefExpr *DR = cast<DeclRefExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001526
Ted Kremenek06de2762007-08-17 16:46:58 +00001527 if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
Mike Stump1eb44332009-09-09 15:08:12 +00001528 if (V->hasLocalStorage() && !V->getType()->isReferenceType()) return DR;
1529
Ted Kremenek06de2762007-08-17 16:46:58 +00001530 return NULL;
1531 }
Mike Stump1eb44332009-09-09 15:08:12 +00001532
Ted Kremenek06de2762007-08-17 16:46:58 +00001533 case Stmt::ParenExprClass:
1534 // Ignore parentheses.
1535 return EvalVal(cast<ParenExpr>(E)->getSubExpr());
Mike Stump1eb44332009-09-09 15:08:12 +00001536
Ted Kremenek06de2762007-08-17 16:46:58 +00001537 case Stmt::UnaryOperatorClass: {
1538 // The only unary operator that make sense to handle here
1539 // is Deref. All others don't resolve to a "name." This includes
1540 // handling all sorts of rvalues passed to a unary operator.
1541 UnaryOperator *U = cast<UnaryOperator>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001542
Ted Kremenek06de2762007-08-17 16:46:58 +00001543 if (U->getOpcode() == UnaryOperator::Deref)
1544 return EvalAddr(U->getSubExpr());
1545
1546 return NULL;
1547 }
Mike Stump1eb44332009-09-09 15:08:12 +00001548
Ted Kremenek06de2762007-08-17 16:46:58 +00001549 case Stmt::ArraySubscriptExprClass: {
1550 // Array subscripts are potential references to data on the stack. We
1551 // retrieve the DeclRefExpr* for the array variable if it indeed
1552 // has local storage.
Ted Kremenek23245122007-08-20 16:18:38 +00001553 return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase());
Ted Kremenek06de2762007-08-17 16:46:58 +00001554 }
Mike Stump1eb44332009-09-09 15:08:12 +00001555
Ted Kremenek06de2762007-08-17 16:46:58 +00001556 case Stmt::ConditionalOperatorClass: {
1557 // For conditional operators we need to see if either the LHS or RHS are
1558 // non-NULL DeclRefExpr's. If one is non-NULL, we return it.
1559 ConditionalOperator *C = cast<ConditionalOperator>(E);
1560
Anders Carlsson39073232007-11-30 19:04:31 +00001561 // Handle the GNU extension for missing LHS.
1562 if (Expr *lhsExpr = C->getLHS())
1563 if (DeclRefExpr *LHS = EvalVal(lhsExpr))
1564 return LHS;
1565
1566 return EvalVal(C->getRHS());
Ted Kremenek06de2762007-08-17 16:46:58 +00001567 }
Mike Stump1eb44332009-09-09 15:08:12 +00001568
Ted Kremenek06de2762007-08-17 16:46:58 +00001569 // Accesses to members are potential references to data on the stack.
Douglas Gregor83f6faf2009-08-31 23:41:50 +00001570 case Stmt::MemberExprClass: {
Ted Kremenek06de2762007-08-17 16:46:58 +00001571 MemberExpr *M = cast<MemberExpr>(E);
Mike Stump1eb44332009-09-09 15:08:12 +00001572
Ted Kremenek06de2762007-08-17 16:46:58 +00001573 // Check for indirect access. We only want direct field accesses.
1574 if (!M->isArrow())
1575 return EvalVal(M->getBase());
1576 else
1577 return NULL;
1578 }
Mike Stump1eb44332009-09-09 15:08:12 +00001579
Ted Kremenek06de2762007-08-17 16:46:58 +00001580 // Everything else: we simply don't reason about them.
1581 default:
1582 return NULL;
1583 }
1584}
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001585
1586//===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
1587
1588/// Check for comparisons of floating point operands using != and ==.
1589/// Issue a warning if these are no self-comparisons, as they are not likely
1590/// to do what the programmer intended.
1591void Sema::CheckFloatComparison(SourceLocation loc, Expr* lex, Expr *rex) {
1592 bool EmitWarning = true;
Mike Stump1eb44332009-09-09 15:08:12 +00001593
Ted Kremenek4e99a5f2008-01-17 16:57:34 +00001594 Expr* LeftExprSansParen = lex->IgnoreParens();
Ted Kremenek32e97b62008-01-17 17:55:13 +00001595 Expr* RightExprSansParen = rex->IgnoreParens();
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001596
1597 // Special case: check for x == x (which is OK).
1598 // Do not emit warnings for such cases.
1599 if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
1600 if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
1601 if (DRL->getDecl() == DRR->getDecl())
1602 EmitWarning = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001603
1604
Ted Kremenek1b500bb2007-11-29 00:59:04 +00001605 // Special case: check for comparisons against literals that can be exactly
1606 // represented by APFloat. In such cases, do not emit a warning. This
1607 // is a heuristic: often comparison against such literals are used to
1608 // detect if a value in a variable has not changed. This clearly can
1609 // lead to false negatives.
1610 if (EmitWarning) {
1611 if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
1612 if (FLL->isExact())
1613 EmitWarning = false;
Mike Stumpac5fc7c2009-08-04 21:02:39 +00001614 } else
Ted Kremenek1b500bb2007-11-29 00:59:04 +00001615 if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)){
1616 if (FLR->isExact())
1617 EmitWarning = false;
1618 }
1619 }
Mike Stump1eb44332009-09-09 15:08:12 +00001620
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001621 // Check for comparisons with builtin types.
Sebastian Redl0eb23302009-01-19 00:08:26 +00001622 if (EmitWarning)
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001623 if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
Douglas Gregor3c385e52009-02-14 18:57:46 +00001624 if (CL->isBuiltinCall(Context))
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001625 EmitWarning = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001626
Sebastian Redl0eb23302009-01-19 00:08:26 +00001627 if (EmitWarning)
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001628 if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
Douglas Gregor3c385e52009-02-14 18:57:46 +00001629 if (CR->isBuiltinCall(Context))
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001630 EmitWarning = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001631
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001632 // Emit the diagnostic.
1633 if (EmitWarning)
Chris Lattnerfa25bbb2008-11-19 05:08:23 +00001634 Diag(loc, diag::warn_floatingpoint_eq)
1635 << lex->getSourceRange() << rex->getSourceRange();
Ted Kremenek588e5eb2007-11-25 00:58:00 +00001636}
John McCallba26e582010-01-04 23:21:16 +00001637
John McCallf2370c92010-01-06 05:24:50 +00001638//===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
1639//===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
John McCallba26e582010-01-04 23:21:16 +00001640
John McCallf2370c92010-01-06 05:24:50 +00001641namespace {
John McCallba26e582010-01-04 23:21:16 +00001642
John McCallf2370c92010-01-06 05:24:50 +00001643/// Structure recording the 'active' range of an integer-valued
1644/// expression.
1645struct IntRange {
1646 /// The number of bits active in the int.
1647 unsigned Width;
John McCallba26e582010-01-04 23:21:16 +00001648
John McCallf2370c92010-01-06 05:24:50 +00001649 /// True if the int is known not to have negative values.
1650 bool NonNegative;
John McCallba26e582010-01-04 23:21:16 +00001651
John McCallf2370c92010-01-06 05:24:50 +00001652 IntRange() {}
1653 IntRange(unsigned Width, bool NonNegative)
1654 : Width(Width), NonNegative(NonNegative)
1655 {}
John McCallba26e582010-01-04 23:21:16 +00001656
John McCallf2370c92010-01-06 05:24:50 +00001657 // Returns the range of the bool type.
1658 static IntRange forBoolType() {
1659 return IntRange(1, true);
John McCall51313c32010-01-04 23:31:57 +00001660 }
1661
John McCallf2370c92010-01-06 05:24:50 +00001662 // Returns the range of an integral type.
1663 static IntRange forType(ASTContext &C, QualType T) {
1664 return forCanonicalType(C, T->getCanonicalTypeInternal().getTypePtr());
John McCall51313c32010-01-04 23:31:57 +00001665 }
1666
John McCallf2370c92010-01-06 05:24:50 +00001667 // Returns the range of an integeral type based on its canonical
1668 // representation.
1669 static IntRange forCanonicalType(ASTContext &C, const Type *T) {
1670 assert(T->isCanonicalUnqualified());
1671
1672 if (const VectorType *VT = dyn_cast<VectorType>(T))
1673 T = VT->getElementType().getTypePtr();
1674 if (const ComplexType *CT = dyn_cast<ComplexType>(T))
1675 T = CT->getElementType().getTypePtr();
1676 if (const EnumType *ET = dyn_cast<EnumType>(T))
1677 T = ET->getDecl()->getIntegerType().getTypePtr();
1678
1679 const BuiltinType *BT = cast<BuiltinType>(T);
1680 assert(BT->isInteger());
1681
1682 return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
1683 }
1684
1685 // Returns the supremum of two ranges: i.e. their conservative merge.
1686 static IntRange join(const IntRange &L, const IntRange &R) {
1687 return IntRange(std::max(L.Width, R.Width),
John McCall60fad452010-01-06 22:07:33 +00001688 L.NonNegative && R.NonNegative);
1689 }
1690
1691 // Returns the infinum of two ranges: i.e. their aggressive merge.
1692 static IntRange meet(const IntRange &L, const IntRange &R) {
1693 return IntRange(std::min(L.Width, R.Width),
1694 L.NonNegative || R.NonNegative);
John McCallf2370c92010-01-06 05:24:50 +00001695 }
1696};
1697
1698IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, unsigned MaxWidth) {
1699 if (value.isSigned() && value.isNegative())
1700 return IntRange(value.getMinSignedBits(), false);
1701
1702 if (value.getBitWidth() > MaxWidth)
1703 value.trunc(MaxWidth);
1704
1705 // isNonNegative() just checks the sign bit without considering
1706 // signedness.
1707 return IntRange(value.getActiveBits(), true);
1708}
1709
John McCall0acc3112010-01-06 22:57:21 +00001710IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
John McCallf2370c92010-01-06 05:24:50 +00001711 unsigned MaxWidth) {
1712 if (result.isInt())
1713 return GetValueRange(C, result.getInt(), MaxWidth);
1714
1715 if (result.isVector()) {
John McCall0acc3112010-01-06 22:57:21 +00001716 IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
1717 for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
1718 IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
1719 R = IntRange::join(R, El);
1720 }
John McCallf2370c92010-01-06 05:24:50 +00001721 return R;
1722 }
1723
1724 if (result.isComplexInt()) {
1725 IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
1726 IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
1727 return IntRange::join(R, I);
John McCall51313c32010-01-04 23:31:57 +00001728 }
1729
1730 // This can happen with lossless casts to intptr_t of "based" lvalues.
1731 // Assume it might use arbitrary bits.
John McCall0acc3112010-01-06 22:57:21 +00001732 // FIXME: The only reason we need to pass the type in here is to get
1733 // the sign right on this one case. It would be nice if APValue
1734 // preserved this.
John McCallf2370c92010-01-06 05:24:50 +00001735 assert(result.isLValue());
John McCall0acc3112010-01-06 22:57:21 +00001736 return IntRange(MaxWidth, Ty->isUnsignedIntegerType());
John McCall51313c32010-01-04 23:31:57 +00001737}
John McCallf2370c92010-01-06 05:24:50 +00001738
1739/// Pseudo-evaluate the given integer expression, estimating the
1740/// range of values it might take.
1741///
1742/// \param MaxWidth - the width to which the value will be truncated
1743IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
1744 E = E->IgnoreParens();
1745
1746 // Try a full evaluation first.
1747 Expr::EvalResult result;
1748 if (E->Evaluate(result, C))
John McCall0acc3112010-01-06 22:57:21 +00001749 return GetValueRange(C, result.Val, E->getType(), MaxWidth);
John McCallf2370c92010-01-06 05:24:50 +00001750
1751 // I think we only want to look through implicit casts here; if the
1752 // user has an explicit widening cast, we should treat the value as
1753 // being of the new, wider type.
1754 if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
1755 if (CE->getCastKind() == CastExpr::CK_NoOp)
1756 return GetExprRange(C, CE->getSubExpr(), MaxWidth);
1757
1758 IntRange OutputTypeRange = IntRange::forType(C, CE->getType());
1759
John McCall60fad452010-01-06 22:07:33 +00001760 bool isIntegerCast = (CE->getCastKind() == CastExpr::CK_IntegralCast);
1761 if (!isIntegerCast && CE->getCastKind() == CastExpr::CK_Unknown)
1762 isIntegerCast = CE->getSubExpr()->getType()->isIntegerType();
1763
John McCallf2370c92010-01-06 05:24:50 +00001764 // Assume that non-integer casts can span the full range of the type.
John McCall60fad452010-01-06 22:07:33 +00001765 if (!isIntegerCast)
John McCallf2370c92010-01-06 05:24:50 +00001766 return OutputTypeRange;
1767
1768 IntRange SubRange
1769 = GetExprRange(C, CE->getSubExpr(),
1770 std::min(MaxWidth, OutputTypeRange.Width));
1771
1772 // Bail out if the subexpr's range is as wide as the cast type.
1773 if (SubRange.Width >= OutputTypeRange.Width)
1774 return OutputTypeRange;
1775
1776 // Otherwise, we take the smaller width, and we're non-negative if
1777 // either the output type or the subexpr is.
1778 return IntRange(SubRange.Width,
1779 SubRange.NonNegative || OutputTypeRange.NonNegative);
1780 }
1781
1782 if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
1783 // If we can fold the condition, just take that operand.
1784 bool CondResult;
1785 if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
1786 return GetExprRange(C, CondResult ? CO->getTrueExpr()
1787 : CO->getFalseExpr(),
1788 MaxWidth);
1789
1790 // Otherwise, conservatively merge.
1791 IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
1792 IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
1793 return IntRange::join(L, R);
1794 }
1795
1796 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
1797 switch (BO->getOpcode()) {
1798
1799 // Boolean-valued operations are single-bit and positive.
1800 case BinaryOperator::LAnd:
1801 case BinaryOperator::LOr:
1802 case BinaryOperator::LT:
1803 case BinaryOperator::GT:
1804 case BinaryOperator::LE:
1805 case BinaryOperator::GE:
1806 case BinaryOperator::EQ:
1807 case BinaryOperator::NE:
1808 return IntRange::forBoolType();
1809
1810 // Operations with opaque sources are black-listed.
1811 case BinaryOperator::PtrMemD:
1812 case BinaryOperator::PtrMemI:
1813 return IntRange::forType(C, E->getType());
1814
John McCall60fad452010-01-06 22:07:33 +00001815 // Bitwise-and uses the *infinum* of the two source ranges.
1816 case BinaryOperator::And:
1817 return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
1818 GetExprRange(C, BO->getRHS(), MaxWidth));
1819
John McCallf2370c92010-01-06 05:24:50 +00001820 // Left shift gets black-listed based on a judgement call.
1821 case BinaryOperator::Shl:
1822 return IntRange::forType(C, E->getType());
1823
John McCall60fad452010-01-06 22:07:33 +00001824 // Right shift by a constant can narrow its left argument.
1825 case BinaryOperator::Shr: {
1826 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1827
1828 // If the shift amount is a positive constant, drop the width by
1829 // that much.
1830 llvm::APSInt shift;
1831 if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
1832 shift.isNonNegative()) {
1833 unsigned zext = shift.getZExtValue();
1834 if (zext >= L.Width)
1835 L.Width = (L.NonNegative ? 0 : 1);
1836 else
1837 L.Width -= zext;
1838 }
1839
1840 return L;
1841 }
1842
1843 // Comma acts as its right operand.
John McCallf2370c92010-01-06 05:24:50 +00001844 case BinaryOperator::Comma:
1845 return GetExprRange(C, BO->getRHS(), MaxWidth);
1846
John McCall60fad452010-01-06 22:07:33 +00001847 // Black-list pointer subtractions.
John McCallf2370c92010-01-06 05:24:50 +00001848 case BinaryOperator::Sub:
1849 if (BO->getLHS()->getType()->isPointerType())
1850 return IntRange::forType(C, E->getType());
1851 // fallthrough
1852
1853 default:
1854 break;
1855 }
1856
1857 // Treat every other operator as if it were closed on the
1858 // narrowest type that encompasses both operands.
1859 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1860 IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
1861 return IntRange::join(L, R);
1862 }
1863
1864 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
1865 switch (UO->getOpcode()) {
1866 // Boolean-valued operations are white-listed.
1867 case UnaryOperator::LNot:
1868 return IntRange::forBoolType();
1869
1870 // Operations with opaque sources are black-listed.
1871 case UnaryOperator::Deref:
1872 case UnaryOperator::AddrOf: // should be impossible
1873 case UnaryOperator::OffsetOf:
1874 return IntRange::forType(C, E->getType());
1875
1876 default:
1877 return GetExprRange(C, UO->getSubExpr(), MaxWidth);
1878 }
1879 }
1880
1881 FieldDecl *BitField = E->getBitField();
1882 if (BitField) {
1883 llvm::APSInt BitWidthAP = BitField->getBitWidth()->EvaluateAsInt(C);
1884 unsigned BitWidth = BitWidthAP.getZExtValue();
1885
1886 return IntRange(BitWidth, BitField->getType()->isUnsignedIntegerType());
1887 }
1888
1889 return IntRange::forType(C, E->getType());
1890}
John McCall51313c32010-01-04 23:31:57 +00001891
1892/// Checks whether the given value, which currently has the given
1893/// source semantics, has the same value when coerced through the
1894/// target semantics.
John McCallf2370c92010-01-06 05:24:50 +00001895bool IsSameFloatAfterCast(const llvm::APFloat &value,
1896 const llvm::fltSemantics &Src,
1897 const llvm::fltSemantics &Tgt) {
John McCall51313c32010-01-04 23:31:57 +00001898 llvm::APFloat truncated = value;
1899
1900 bool ignored;
1901 truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
1902 truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
1903
1904 return truncated.bitwiseIsEqual(value);
1905}
1906
1907/// Checks whether the given value, which currently has the given
1908/// source semantics, has the same value when coerced through the
1909/// target semantics.
1910///
1911/// The value might be a vector of floats (or a complex number).
John McCallf2370c92010-01-06 05:24:50 +00001912bool IsSameFloatAfterCast(const APValue &value,
1913 const llvm::fltSemantics &Src,
1914 const llvm::fltSemantics &Tgt) {
John McCall51313c32010-01-04 23:31:57 +00001915 if (value.isFloat())
1916 return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
1917
1918 if (value.isVector()) {
1919 for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
1920 if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
1921 return false;
1922 return true;
1923 }
1924
1925 assert(value.isComplexFloat());
1926 return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
1927 IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
1928}
1929
John McCallf2370c92010-01-06 05:24:50 +00001930} // end anonymous namespace
John McCall51313c32010-01-04 23:31:57 +00001931
John McCallba26e582010-01-04 23:21:16 +00001932/// \brief Implements -Wsign-compare.
1933///
1934/// \param lex the left-hand expression
1935/// \param rex the right-hand expression
1936/// \param OpLoc the location of the joining operator
1937/// \param Equality whether this is an "equality-like" join, which
1938/// suppresses the warning in some cases
1939void Sema::CheckSignCompare(Expr *lex, Expr *rex, SourceLocation OpLoc,
1940 const PartialDiagnostic &PD, bool Equality) {
1941 // Don't warn if we're in an unevaluated context.
1942 if (ExprEvalContexts.back().Context == Unevaluated)
1943 return;
1944
John McCallf2370c92010-01-06 05:24:50 +00001945 // If either expression is value-dependent, don't warn. We'll get another
1946 // chance at instantiation time.
1947 if (lex->isValueDependent() || rex->isValueDependent())
1948 return;
1949
John McCallba26e582010-01-04 23:21:16 +00001950 QualType lt = lex->getType(), rt = rex->getType();
1951
1952 // Only warn if both operands are integral.
1953 if (!lt->isIntegerType() || !rt->isIntegerType())
1954 return;
1955
John McCallf2370c92010-01-06 05:24:50 +00001956 // In C, the width of a bitfield determines its type, and the
1957 // declared type only contributes the signedness. This duplicates
1958 // the work that will later be done by UsualUnaryConversions.
1959 // Eventually, this check will be reorganized in a way that avoids
1960 // this duplication.
1961 if (!getLangOptions().CPlusPlus) {
1962 QualType tmp;
1963 tmp = Context.isPromotableBitField(lex);
1964 if (!tmp.isNull()) lt = tmp;
1965 tmp = Context.isPromotableBitField(rex);
1966 if (!tmp.isNull()) rt = tmp;
1967 }
John McCallba26e582010-01-04 23:21:16 +00001968
1969 // The rule is that the signed operand becomes unsigned, so isolate the
1970 // signed operand.
John McCallf2370c92010-01-06 05:24:50 +00001971 Expr *signedOperand = lex, *unsignedOperand = rex;
1972 QualType signedType = lt, unsignedType = rt;
John McCallba26e582010-01-04 23:21:16 +00001973 if (lt->isSignedIntegerType()) {
1974 if (rt->isSignedIntegerType()) return;
John McCallba26e582010-01-04 23:21:16 +00001975 } else {
1976 if (!rt->isSignedIntegerType()) return;
John McCallf2370c92010-01-06 05:24:50 +00001977 std::swap(signedOperand, unsignedOperand);
1978 std::swap(signedType, unsignedType);
John McCallba26e582010-01-04 23:21:16 +00001979 }
1980
John McCallf2370c92010-01-06 05:24:50 +00001981 unsigned unsignedWidth = Context.getIntWidth(unsignedType);
1982 unsigned signedWidth = Context.getIntWidth(signedType);
1983
John McCallba26e582010-01-04 23:21:16 +00001984 // If the unsigned type is strictly smaller than the signed type,
1985 // then (1) the result type will be signed and (2) the unsigned
1986 // value will fit fully within the signed type, and thus the result
1987 // of the comparison will be exact.
John McCallf2370c92010-01-06 05:24:50 +00001988 if (signedWidth > unsignedWidth)
John McCallba26e582010-01-04 23:21:16 +00001989 return;
1990
John McCallf2370c92010-01-06 05:24:50 +00001991 // Otherwise, calculate the effective ranges.
1992 IntRange signedRange = GetExprRange(Context, signedOperand, signedWidth);
1993 IntRange unsignedRange = GetExprRange(Context, unsignedOperand, unsignedWidth);
1994
1995 // We should never be unable to prove that the unsigned operand is
1996 // non-negative.
1997 assert(unsignedRange.NonNegative && "unsigned range includes negative?");
1998
1999 // If the signed operand is non-negative, then the signed->unsigned
2000 // conversion won't change it.
2001 if (signedRange.NonNegative)
John McCallba26e582010-01-04 23:21:16 +00002002 return;
2003
2004 // For (in)equality comparisons, if the unsigned operand is a
2005 // constant which cannot collide with a overflowed signed operand,
2006 // then reinterpreting the signed operand as unsigned will not
2007 // change the result of the comparison.
John McCallf2370c92010-01-06 05:24:50 +00002008 if (Equality && unsignedRange.Width < unsignedWidth)
John McCallba26e582010-01-04 23:21:16 +00002009 return;
2010
2011 Diag(OpLoc, PD)
John McCallf2370c92010-01-06 05:24:50 +00002012 << lt << rt << lex->getSourceRange() << rex->getSourceRange();
John McCallba26e582010-01-04 23:21:16 +00002013}
2014
John McCall51313c32010-01-04 23:31:57 +00002015/// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
2016static void DiagnoseImpCast(Sema &S, Expr *E, QualType T, unsigned diag) {
2017 S.Diag(E->getExprLoc(), diag) << E->getType() << T << E->getSourceRange();
2018}
2019
2020/// Implements -Wconversion.
2021void Sema::CheckImplicitConversion(Expr *E, QualType T) {
2022 // Don't diagnose in unevaluated contexts.
2023 if (ExprEvalContexts.back().Context == Sema::Unevaluated)
2024 return;
2025
2026 // Don't diagnose for value-dependent expressions.
2027 if (E->isValueDependent())
2028 return;
2029
2030 const Type *Source = Context.getCanonicalType(E->getType()).getTypePtr();
2031 const Type *Target = Context.getCanonicalType(T).getTypePtr();
2032
2033 // Never diagnose implicit casts to bool.
2034 if (Target->isSpecificBuiltinType(BuiltinType::Bool))
2035 return;
2036
2037 // Strip vector types.
2038 if (isa<VectorType>(Source)) {
2039 if (!isa<VectorType>(Target))
2040 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_vector_scalar);
2041
2042 Source = cast<VectorType>(Source)->getElementType().getTypePtr();
2043 Target = cast<VectorType>(Target)->getElementType().getTypePtr();
2044 }
2045
2046 // Strip complex types.
2047 if (isa<ComplexType>(Source)) {
2048 if (!isa<ComplexType>(Target))
2049 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_complex_scalar);
2050
2051 Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
2052 Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
2053 }
2054
2055 const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
2056 const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
2057
2058 // If the source is floating point...
2059 if (SourceBT && SourceBT->isFloatingPoint()) {
2060 // ...and the target is floating point...
2061 if (TargetBT && TargetBT->isFloatingPoint()) {
2062 // ...then warn if we're dropping FP rank.
2063
2064 // Builtin FP kinds are ordered by increasing FP rank.
2065 if (SourceBT->getKind() > TargetBT->getKind()) {
2066 // Don't warn about float constants that are precisely
2067 // representable in the target type.
2068 Expr::EvalResult result;
2069 if (E->Evaluate(result, Context)) {
2070 // Value might be a float, a float vector, or a float complex.
2071 if (IsSameFloatAfterCast(result.Val,
2072 Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
2073 Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
2074 return;
2075 }
2076
2077 DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_precision);
2078 }
2079 return;
2080 }
2081
2082 // If the target is integral, always warn.
2083 if ((TargetBT && TargetBT->isInteger()))
2084 // TODO: don't warn for integer values?
2085 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_integer);
2086
2087 return;
2088 }
2089
John McCallf2370c92010-01-06 05:24:50 +00002090 if (!Source->isIntegerType() || !Target->isIntegerType())
John McCall51313c32010-01-04 23:31:57 +00002091 return;
2092
John McCallf2370c92010-01-06 05:24:50 +00002093 IntRange SourceRange = GetExprRange(Context, E, Context.getIntWidth(E->getType()));
2094 IntRange TargetRange = IntRange::forCanonicalType(Context, Target);
John McCall51313c32010-01-04 23:31:57 +00002095
John McCallf2370c92010-01-06 05:24:50 +00002096 // FIXME: also signed<->unsigned?
2097
2098 if (SourceRange.Width > TargetRange.Width) {
John McCall51313c32010-01-04 23:31:57 +00002099 // People want to build with -Wshorten-64-to-32 and not -Wconversion
2100 // and by god we'll let them.
John McCallf2370c92010-01-06 05:24:50 +00002101 if (SourceRange.Width == 64 && TargetRange.Width == 32)
John McCall51313c32010-01-04 23:31:57 +00002102 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_64_32);
2103 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_precision);
2104 }
2105
2106 return;
2107}
2108
Mike Stumpf8c49212010-01-21 03:59:47 +00002109// MarkLive - Mark all the blocks reachable from e as live. Returns the total
2110// number of blocks just marked live.
2111static unsigned MarkLive(CFGBlock *e, llvm::BitVector &live) {
2112 unsigned count = 0;
2113 std::queue<CFGBlock*> workq;
2114 // Prep work queue
2115 live.set(e->getBlockID());
2116 ++count;
2117 workq.push(e);
2118 // Solve
2119 while (!workq.empty()) {
2120 CFGBlock *item = workq.front();
2121 workq.pop();
2122 for (CFGBlock::succ_iterator I=item->succ_begin(),
2123 E=item->succ_end();
2124 I != E;
2125 ++I) {
2126 if ((*I) && !live[(*I)->getBlockID()]) {
2127 live.set((*I)->getBlockID());
2128 ++count;
2129 workq.push(*I);
2130 }
2131 }
2132 }
2133 return count;
2134}
2135
Mike Stump55f988e2010-01-21 17:21:23 +00002136static SourceLocation GetUnreachableLoc(CFGBlock &b, SourceRange &R1,
2137 SourceRange &R2) {
Mike Stumpf8c49212010-01-21 03:59:47 +00002138 Stmt *S;
Mike Stumpe5fba702010-01-21 19:44:04 +00002139 unsigned sn = 0;
2140 R1 = R2 = SourceRange();
2141
2142 top:
2143 if (sn < b.size())
2144 S = b[sn].getStmt();
Mike Stumpf8c49212010-01-21 03:59:47 +00002145 else if (b.getTerminator())
2146 S = b.getTerminator();
2147 else
2148 return SourceLocation();
2149
2150 switch (S->getStmtClass()) {
2151 case Expr::BinaryOperatorClass: {
Mike Stump55f988e2010-01-21 17:21:23 +00002152 BinaryOperator *BO = cast<BinaryOperator>(S);
2153 if (BO->getOpcode() == BinaryOperator::Comma) {
Mike Stumpe5fba702010-01-21 19:44:04 +00002154 if (sn+1 < b.size())
2155 return b[sn+1].getStmt()->getLocStart();
Mike Stumpf8c49212010-01-21 03:59:47 +00002156 CFGBlock *n = &b;
2157 while (1) {
2158 if (n->getTerminator())
2159 return n->getTerminator()->getLocStart();
2160 if (n->succ_size() != 1)
2161 return SourceLocation();
2162 n = n[0].succ_begin()[0];
2163 if (n->pred_size() != 1)
2164 return SourceLocation();
2165 if (!n->empty())
2166 return n[0][0].getStmt()->getLocStart();
2167 }
2168 }
Mike Stump55f988e2010-01-21 17:21:23 +00002169 R1 = BO->getLHS()->getSourceRange();
2170 R2 = BO->getRHS()->getSourceRange();
2171 return BO->getOperatorLoc();
2172 }
2173 case Expr::UnaryOperatorClass: {
2174 const UnaryOperator *UO = cast<UnaryOperator>(S);
2175 R1 = UO->getSubExpr()->getSourceRange();
2176 return UO->getOperatorLoc();
Mike Stumpf8c49212010-01-21 03:59:47 +00002177 }
Mike Stump45db90d2010-01-21 17:31:41 +00002178 case Expr::CompoundAssignOperatorClass: {
2179 const CompoundAssignOperator *CAO = cast<CompoundAssignOperator>(S);
2180 R1 = CAO->getLHS()->getSourceRange();
2181 R2 = CAO->getRHS()->getSourceRange();
2182 return CAO->getOperatorLoc();
2183 }
Mike Stumpe5fba702010-01-21 19:44:04 +00002184 case Expr::ConditionalOperatorClass: {
2185 const ConditionalOperator *CO = cast<ConditionalOperator>(S);
2186 return CO->getQuestionLoc();
2187 }
Mike Stumpb5c77552010-01-21 23:15:53 +00002188 case Expr::MemberExprClass: {
2189 const MemberExpr *ME = cast<MemberExpr>(S);
2190 R1 = ME->getSourceRange();
2191 return ME->getMemberLoc();
2192 }
2193 case Expr::ArraySubscriptExprClass: {
2194 const ArraySubscriptExpr *ASE = cast<ArraySubscriptExpr>(S);
2195 R1 = ASE->getLHS()->getSourceRange();
2196 R2 = ASE->getRHS()->getSourceRange();
2197 return ASE->getRBracketLoc();
2198 }
Mike Stump44582302010-01-21 19:51:34 +00002199 case Expr::CStyleCastExprClass: {
2200 const CStyleCastExpr *CSC = cast<CStyleCastExpr>(S);
2201 R1 = CSC->getSubExpr()->getSourceRange();
2202 return CSC->getLParenLoc();
2203 }
Mike Stump2d6ceab2010-01-21 22:12:18 +00002204 case Expr::CXXFunctionalCastExprClass: {
2205 const CXXFunctionalCastExpr *CE = cast <CXXFunctionalCastExpr>(S);
2206 R1 = CE->getSubExpr()->getSourceRange();
2207 return CE->getTypeBeginLoc();
2208 }
Mike Stumpe5fba702010-01-21 19:44:04 +00002209 case Expr::ImplicitCastExprClass:
2210 ++sn;
2211 goto top;
Mike Stump4c45aa12010-01-21 15:20:48 +00002212 case Stmt::CXXTryStmtClass: {
2213 return cast<CXXTryStmt>(S)->getHandler(0)->getCatchLoc();
2214 }
Mike Stumpf8c49212010-01-21 03:59:47 +00002215 default: ;
2216 }
Mike Stumpb5c77552010-01-21 23:15:53 +00002217 R1 = S->getSourceRange();
Mike Stumpf8c49212010-01-21 03:59:47 +00002218 return S->getLocStart();
2219}
2220
2221static SourceLocation MarkLiveTop(CFGBlock *e, llvm::BitVector &live,
2222 SourceManager &SM) {
2223 std::queue<CFGBlock*> workq;
2224 // Prep work queue
2225 workq.push(e);
Mike Stump55f988e2010-01-21 17:21:23 +00002226 SourceRange R1, R2;
2227 SourceLocation top = GetUnreachableLoc(*e, R1, R2);
Mike Stumpf8c49212010-01-21 03:59:47 +00002228 bool FromMainFile = false;
2229 bool FromSystemHeader = false;
2230 bool TopValid = false;
2231 if (top.isValid()) {
2232 FromMainFile = SM.isFromMainFile(top);
2233 FromSystemHeader = SM.isInSystemHeader(top);
2234 TopValid = true;
2235 }
2236 // Solve
2237 while (!workq.empty()) {
2238 CFGBlock *item = workq.front();
2239 workq.pop();
Mike Stump55f988e2010-01-21 17:21:23 +00002240 SourceLocation c = GetUnreachableLoc(*item, R1, R2);
Mike Stumpf8c49212010-01-21 03:59:47 +00002241 if (c.isValid()
2242 && (!TopValid
2243 || (SM.isFromMainFile(c) && !FromMainFile)
2244 || (FromSystemHeader && !SM.isInSystemHeader(c))
2245 || SM.isBeforeInTranslationUnit(c, top))) {
2246 top = c;
2247 FromMainFile = SM.isFromMainFile(top);
2248 FromSystemHeader = SM.isInSystemHeader(top);
2249 }
2250 live.set(item->getBlockID());
2251 for (CFGBlock::succ_iterator I=item->succ_begin(),
2252 E=item->succ_end();
2253 I != E;
2254 ++I) {
2255 if ((*I) && !live[(*I)->getBlockID()]) {
2256 live.set((*I)->getBlockID());
2257 workq.push(*I);
2258 }
2259 }
2260 }
2261 return top;
2262}
2263
2264static int LineCmp(const void *p1, const void *p2) {
2265 SourceLocation *Line1 = (SourceLocation *)p1;
2266 SourceLocation *Line2 = (SourceLocation *)p2;
2267 return !(*Line1 < *Line2);
2268}
2269
Mike Stump4a415672010-01-21 23:49:01 +00002270namespace {
2271 struct ErrLoc {
2272 SourceLocation Loc;
2273 SourceRange R1;
2274 SourceRange R2;
2275 ErrLoc(SourceLocation l, SourceRange r1, SourceRange r2)
2276 : Loc(l), R1(r1), R2(r2) { }
2277 };
2278}
2279
Mike Stumpf8c49212010-01-21 03:59:47 +00002280/// CheckUnreachable - Check for unreachable code.
2281void Sema::CheckUnreachable(AnalysisContext &AC) {
2282 unsigned count;
2283 // We avoid checking when there are errors, as the CFG won't faithfully match
2284 // the user's code.
2285 if (getDiagnostics().hasErrorOccurred())
2286 return;
2287 if (Diags.getDiagnosticLevel(diag::warn_unreachable) == Diagnostic::Ignored)
2288 return;
2289
2290 CFG *cfg = AC.getCFG();
2291 if (cfg == 0)
2292 return;
2293
2294 llvm::BitVector live(cfg->getNumBlockIDs());
2295 // Mark all live things first.
2296 count = MarkLive(&cfg->getEntry(), live);
2297
2298 if (count == cfg->getNumBlockIDs())
2299 // If there are no dead blocks, we're done.
2300 return;
2301
Mike Stump55f988e2010-01-21 17:21:23 +00002302 SourceRange R1, R2;
2303
Mike Stump4a415672010-01-21 23:49:01 +00002304 llvm::SmallVector<ErrLoc, 24> lines;
Mike Stump4c45aa12010-01-21 15:20:48 +00002305 bool AddEHEdges = AC.getAddEHEdges();
Mike Stumpf8c49212010-01-21 03:59:47 +00002306 // First, give warnings for blocks with no predecessors, as they
2307 // can't be part of a loop.
2308 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2309 CFGBlock &b = **I;
2310 if (!live[b.getBlockID()]) {
2311 if (b.pred_begin() == b.pred_end()) {
Mike Stump4c45aa12010-01-21 15:20:48 +00002312 if (!AddEHEdges && b.getTerminator()
2313 && isa<CXXTryStmt>(b.getTerminator())) {
2314 // When not adding EH edges from calls, catch clauses
2315 // can otherwise seem dead. Avoid noting them as dead.
2316 count += MarkLive(&b, live);
2317 continue;
2318 }
Mike Stump55f988e2010-01-21 17:21:23 +00002319 SourceLocation c = GetUnreachableLoc(b, R1, R2);
Mike Stumpf8c49212010-01-21 03:59:47 +00002320 if (!c.isValid()) {
2321 // Blocks without a location can't produce a warning, so don't mark
2322 // reachable blocks from here as live.
2323 live.set(b.getBlockID());
2324 ++count;
2325 continue;
2326 }
Mike Stump4a415672010-01-21 23:49:01 +00002327 lines.push_back(ErrLoc(c, R1, R2));
Mike Stumpf8c49212010-01-21 03:59:47 +00002328 // Avoid excessive errors by marking everything reachable from here
2329 count += MarkLive(&b, live);
2330 }
2331 }
2332 }
2333
2334 if (count < cfg->getNumBlockIDs()) {
2335 // And then give warnings for the tops of loops.
2336 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2337 CFGBlock &b = **I;
2338 if (!live[b.getBlockID()])
2339 // Avoid excessive errors by marking everything reachable from here
Ted Kremenek8acc9f62010-01-28 01:04:48 +00002340 lines.push_back(ErrLoc(MarkLiveTop(&b, live,
2341 Context.getSourceManager()),
2342 SourceRange(), SourceRange()));
Mike Stumpf8c49212010-01-21 03:59:47 +00002343 }
2344 }
2345
2346 llvm::array_pod_sort(lines.begin(), lines.end(), LineCmp);
Mike Stump4a415672010-01-21 23:49:01 +00002347 for (llvm::SmallVector<ErrLoc, 24>::iterator I = lines.begin(),
Mike Stumpf8c49212010-01-21 03:59:47 +00002348 E = lines.end();
2349 I != E;
2350 ++I)
Mike Stump4a415672010-01-21 23:49:01 +00002351 if (I->Loc.isValid())
2352 Diag(I->Loc, diag::warn_unreachable) << I->R1 << I->R2;
Mike Stumpf8c49212010-01-21 03:59:47 +00002353}
2354
2355/// CheckFallThrough - Check that we don't fall off the end of a
2356/// Statement that should return a value.
2357///
2358/// \returns AlwaysFallThrough iff we always fall off the end of the statement,
2359/// MaybeFallThrough iff we might or might not fall off the end,
2360/// NeverFallThroughOrReturn iff we never fall off the end of the statement or
2361/// return. We assume NeverFallThrough iff we never fall off the end of the
2362/// statement but we may return. We assume that functions not marked noreturn
2363/// will return.
2364Sema::ControlFlowKind Sema::CheckFallThrough(AnalysisContext &AC) {
2365 CFG *cfg = AC.getCFG();
2366 if (cfg == 0)
2367 // FIXME: This should be NeverFallThrough
2368 return NeverFallThroughOrReturn;
2369
Mike Stump4c45aa12010-01-21 15:20:48 +00002370 // The CFG leaves in dead things, and we don't want the dead code paths to
Mike Stumpf8c49212010-01-21 03:59:47 +00002371 // confuse us, so we mark all live things first.
2372 std::queue<CFGBlock*> workq;
2373 llvm::BitVector live(cfg->getNumBlockIDs());
Mike Stump4c45aa12010-01-21 15:20:48 +00002374 unsigned count = MarkLive(&cfg->getEntry(), live);
2375
2376 bool AddEHEdges = AC.getAddEHEdges();
2377 if (!AddEHEdges && count != cfg->getNumBlockIDs())
2378 // When there are things remaining dead, and we didn't add EH edges
2379 // from CallExprs to the catch clauses, we have to go back and
2380 // mark them as live.
2381 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2382 CFGBlock &b = **I;
2383 if (!live[b.getBlockID()]) {
2384 if (b.pred_begin() == b.pred_end()) {
2385 if (b.getTerminator() && isa<CXXTryStmt>(b.getTerminator()))
2386 // When not adding EH edges from calls, catch clauses
2387 // can otherwise seem dead. Avoid noting them as dead.
2388 count += MarkLive(&b, live);
2389 continue;
2390 }
2391 }
2392 }
Mike Stumpf8c49212010-01-21 03:59:47 +00002393
2394 // Now we know what is live, we check the live precessors of the exit block
2395 // and look for fall through paths, being careful to ignore normal returns,
2396 // and exceptional paths.
2397 bool HasLiveReturn = false;
2398 bool HasFakeEdge = false;
2399 bool HasPlainEdge = false;
2400 bool HasAbnormalEdge = false;
2401 for (CFGBlock::pred_iterator I=cfg->getExit().pred_begin(),
2402 E = cfg->getExit().pred_end();
2403 I != E;
2404 ++I) {
2405 CFGBlock& B = **I;
2406 if (!live[B.getBlockID()])
2407 continue;
2408 if (B.size() == 0) {
Mike Stump4c45aa12010-01-21 15:20:48 +00002409 if (B.getTerminator() && isa<CXXTryStmt>(B.getTerminator())) {
2410 HasAbnormalEdge = true;
2411 continue;
2412 }
2413
Mike Stumpf8c49212010-01-21 03:59:47 +00002414 // A labeled empty statement, or the entry block...
2415 HasPlainEdge = true;
2416 continue;
2417 }
2418 Stmt *S = B[B.size()-1];
2419 if (isa<ReturnStmt>(S)) {
2420 HasLiveReturn = true;
2421 continue;
2422 }
2423 if (isa<ObjCAtThrowStmt>(S)) {
2424 HasFakeEdge = true;
2425 continue;
2426 }
2427 if (isa<CXXThrowExpr>(S)) {
2428 HasFakeEdge = true;
2429 continue;
2430 }
2431 if (const AsmStmt *AS = dyn_cast<AsmStmt>(S)) {
2432 if (AS->isMSAsm()) {
2433 HasFakeEdge = true;
2434 HasLiveReturn = true;
2435 continue;
2436 }
2437 }
2438 if (isa<CXXTryStmt>(S)) {
2439 HasAbnormalEdge = true;
2440 continue;
2441 }
2442
2443 bool NoReturnEdge = false;
2444 if (CallExpr *C = dyn_cast<CallExpr>(S)) {
2445 if (B.succ_begin()[0] != &cfg->getExit()) {
2446 HasAbnormalEdge = true;
2447 continue;
2448 }
2449 Expr *CEE = C->getCallee()->IgnoreParenCasts();
2450 if (CEE->getType().getNoReturnAttr()) {
2451 NoReturnEdge = true;
2452 HasFakeEdge = true;
2453 } else if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(CEE)) {
2454 ValueDecl *VD = DRE->getDecl();
2455 if (VD->hasAttr<NoReturnAttr>()) {
2456 NoReturnEdge = true;
2457 HasFakeEdge = true;
2458 }
2459 }
2460 }
2461 // FIXME: Add noreturn message sends.
2462 if (NoReturnEdge == false)
2463 HasPlainEdge = true;
2464 }
2465 if (!HasPlainEdge) {
2466 if (HasLiveReturn)
2467 return NeverFallThrough;
2468 return NeverFallThroughOrReturn;
2469 }
2470 if (HasAbnormalEdge || HasFakeEdge || HasLiveReturn)
2471 return MaybeFallThrough;
2472 // This says AlwaysFallThrough for calls to functions that are not marked
2473 // noreturn, that don't return. If people would like this warning to be more
2474 // accurate, such functions should be marked as noreturn.
2475 return AlwaysFallThrough;
2476}
2477
2478/// CheckFallThroughForFunctionDef - Check that we don't fall off the end of a
2479/// function that should return a value. Check that we don't fall off the end
2480/// of a noreturn function. We assume that functions and blocks not marked
2481/// noreturn will return.
2482void Sema::CheckFallThroughForFunctionDef(Decl *D, Stmt *Body,
2483 AnalysisContext &AC) {
2484 // FIXME: Would be nice if we had a better way to control cascading errors,
2485 // but for now, avoid them. The problem is that when Parse sees:
2486 // int foo() { return a; }
2487 // The return is eaten and the Sema code sees just:
2488 // int foo() { }
2489 // which this code would then warn about.
2490 if (getDiagnostics().hasErrorOccurred())
2491 return;
2492
2493 bool ReturnsVoid = false;
2494 bool HasNoReturn = false;
2495 if (FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
2496 // If the result type of the function is a dependent type, we don't know
2497 // whether it will be void or not, so don't
2498 if (FD->getResultType()->isDependentType())
2499 return;
2500 if (FD->getResultType()->isVoidType())
2501 ReturnsVoid = true;
2502 if (FD->hasAttr<NoReturnAttr>())
2503 HasNoReturn = true;
2504 } else if (ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2505 if (MD->getResultType()->isVoidType())
2506 ReturnsVoid = true;
2507 if (MD->hasAttr<NoReturnAttr>())
2508 HasNoReturn = true;
2509 }
2510
2511 // Short circuit for compilation speed.
2512 if ((Diags.getDiagnosticLevel(diag::warn_maybe_falloff_nonvoid_function)
2513 == Diagnostic::Ignored || ReturnsVoid)
2514 && (Diags.getDiagnosticLevel(diag::warn_noreturn_function_has_return_expr)
2515 == Diagnostic::Ignored || !HasNoReturn)
2516 && (Diags.getDiagnosticLevel(diag::warn_suggest_noreturn_block)
2517 == Diagnostic::Ignored || !ReturnsVoid))
2518 return;
2519 // FIXME: Function try block
2520 if (CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) {
2521 switch (CheckFallThrough(AC)) {
2522 case MaybeFallThrough:
2523 if (HasNoReturn)
2524 Diag(Compound->getRBracLoc(), diag::warn_falloff_noreturn_function);
2525 else if (!ReturnsVoid)
2526 Diag(Compound->getRBracLoc(),diag::warn_maybe_falloff_nonvoid_function);
2527 break;
2528 case AlwaysFallThrough:
2529 if (HasNoReturn)
2530 Diag(Compound->getRBracLoc(), diag::warn_falloff_noreturn_function);
2531 else if (!ReturnsVoid)
2532 Diag(Compound->getRBracLoc(), diag::warn_falloff_nonvoid_function);
2533 break;
2534 case NeverFallThroughOrReturn:
2535 if (ReturnsVoid && !HasNoReturn)
2536 Diag(Compound->getLBracLoc(), diag::warn_suggest_noreturn_function);
2537 break;
2538 case NeverFallThrough:
2539 break;
2540 }
2541 }
2542}
2543
2544/// CheckFallThroughForBlock - Check that we don't fall off the end of a block
2545/// that should return a value. Check that we don't fall off the end of a
2546/// noreturn block. We assume that functions and blocks not marked noreturn
2547/// will return.
2548void Sema::CheckFallThroughForBlock(QualType BlockTy, Stmt *Body,
2549 AnalysisContext &AC) {
2550 // FIXME: Would be nice if we had a better way to control cascading errors,
2551 // but for now, avoid them. The problem is that when Parse sees:
2552 // int foo() { return a; }
2553 // The return is eaten and the Sema code sees just:
2554 // int foo() { }
2555 // which this code would then warn about.
2556 if (getDiagnostics().hasErrorOccurred())
2557 return;
2558 bool ReturnsVoid = false;
2559 bool HasNoReturn = false;
2560 if (const FunctionType *FT =BlockTy->getPointeeType()->getAs<FunctionType>()){
2561 if (FT->getResultType()->isVoidType())
2562 ReturnsVoid = true;
2563 if (FT->getNoReturnAttr())
2564 HasNoReturn = true;
2565 }
2566
2567 // Short circuit for compilation speed.
2568 if (ReturnsVoid
2569 && !HasNoReturn
2570 && (Diags.getDiagnosticLevel(diag::warn_suggest_noreturn_block)
2571 == Diagnostic::Ignored || !ReturnsVoid))
2572 return;
2573 // FIXME: Funtion try block
2574 if (CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) {
2575 switch (CheckFallThrough(AC)) {
2576 case MaybeFallThrough:
2577 if (HasNoReturn)
2578 Diag(Compound->getRBracLoc(), diag::err_noreturn_block_has_return_expr);
2579 else if (!ReturnsVoid)
2580 Diag(Compound->getRBracLoc(), diag::err_maybe_falloff_nonvoid_block);
2581 break;
2582 case AlwaysFallThrough:
2583 if (HasNoReturn)
2584 Diag(Compound->getRBracLoc(), diag::err_noreturn_block_has_return_expr);
2585 else if (!ReturnsVoid)
2586 Diag(Compound->getRBracLoc(), diag::err_falloff_nonvoid_block);
2587 break;
2588 case NeverFallThroughOrReturn:
2589 if (ReturnsVoid)
2590 Diag(Compound->getLBracLoc(), diag::warn_suggest_noreturn_block);
2591 break;
2592 case NeverFallThrough:
2593 break;
2594 }
2595 }
2596}
2597
2598/// CheckParmsForFunctionDef - Check that the parameters of the given
2599/// function are appropriate for the definition of a function. This
2600/// takes care of any checks that cannot be performed on the
2601/// declaration itself, e.g., that the types of each of the function
2602/// parameters are complete.
2603bool Sema::CheckParmsForFunctionDef(FunctionDecl *FD) {
2604 bool HasInvalidParm = false;
2605 for (unsigned p = 0, NumParams = FD->getNumParams(); p < NumParams; ++p) {
2606 ParmVarDecl *Param = FD->getParamDecl(p);
2607
2608 // C99 6.7.5.3p4: the parameters in a parameter type list in a
2609 // function declarator that is part of a function definition of
2610 // that function shall not have incomplete type.
2611 //
2612 // This is also C++ [dcl.fct]p6.
2613 if (!Param->isInvalidDecl() &&
2614 RequireCompleteType(Param->getLocation(), Param->getType(),
2615 diag::err_typecheck_decl_incomplete_type)) {
2616 Param->setInvalidDecl();
2617 HasInvalidParm = true;
2618 }
2619
2620 // C99 6.9.1p5: If the declarator includes a parameter type list, the
2621 // declaration of each parameter shall include an identifier.
2622 if (Param->getIdentifier() == 0 &&
2623 !Param->isImplicit() &&
2624 !getLangOptions().CPlusPlus)
2625 Diag(Param->getLocation(), diag::err_parameter_name_omitted);
Sam Weinigd17e3402010-02-01 05:02:49 +00002626
2627 // C99 6.7.5.3p12:
2628 // If the function declarator is not part of a definition of that
2629 // function, parameters may have incomplete type and may use the [*]
2630 // notation in their sequences of declarator specifiers to specify
2631 // variable length array types.
2632 QualType PType = Param->getOriginalType();
2633 if (const ArrayType *AT = Context.getAsArrayType(PType)) {
2634 if (AT->getSizeModifier() == ArrayType::Star) {
2635 // FIXME: This diagnosic should point the the '[*]' if source-location
2636 // information is added for it.
2637 Diag(Param->getLocation(), diag::err_array_star_in_function_definition);
2638 }
2639 }
John McCall4f9506a2010-02-02 08:45:54 +00002640
John McCall68c6c9a2010-02-02 09:10:11 +00002641 if (getLangOptions().CPlusPlus)
2642 if (const RecordType *RT = Param->getType()->getAs<RecordType>())
2643 FinalizeVarWithDestructor(Param, RT);
Mike Stumpf8c49212010-01-21 03:59:47 +00002644 }
2645
2646 return HasInvalidParm;
2647}