blob: 61d209f683289bb86099b1045d47deaa30628f3b [file] [log] [blame]
Chris Lattnerb87b1b32007-08-10 20:18:51 +00001//===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
2//
3// The LLVM Compiler Infrastructure
4//
Chris Lattner5b12ab82007-12-29 19:59:25 +00005// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
Chris Lattnerb87b1b32007-08-10 20:18:51 +00007//
8//===----------------------------------------------------------------------===//
9//
Mike Stump11289f42009-09-09 15:08:12 +000010// This file implements extra semantic analysis beyond what is enforced
Chris Lattnerb87b1b32007-08-10 20:18:51 +000011// by the C type system.
12//
13//===----------------------------------------------------------------------===//
14
Douglas Gregorc3a6ade2010-08-12 20:07:10 +000015#include "clang/Sema/Sema.h"
Ted Kremenek02087932010-07-16 02:11:22 +000016#include "clang/Analysis/Analyses/FormatString.h"
Chris Lattnerb87b1b32007-08-10 20:18:51 +000017#include "clang/AST/ASTContext.h"
Ken Dyck40775002010-01-11 17:06:35 +000018#include "clang/AST/CharUnits.h"
Daniel Dunbar6e8aa532008-08-11 05:35:13 +000019#include "clang/AST/DeclObjC.h"
Ted Kremenekc81614d2007-08-20 16:18:38 +000020#include "clang/AST/ExprCXX.h"
Ted Kremenek34f664d2008-06-16 18:00:42 +000021#include "clang/AST/ExprObjC.h"
Mike Stump0c2ec772010-01-21 03:59:47 +000022#include "clang/AST/DeclObjC.h"
23#include "clang/AST/StmtCXX.h"
24#include "clang/AST/StmtObjC.h"
Chris Lattnerddb71912009-02-18 19:21:10 +000025#include "clang/Lex/LiteralSupport.h"
Chris Lattnerb87b1b32007-08-10 20:18:51 +000026#include "clang/Lex/Preprocessor.h"
Mike Stump0c2ec772010-01-21 03:59:47 +000027#include "llvm/ADT/BitVector.h"
28#include "llvm/ADT/STLExtras.h"
Tom Careb7042702010-06-09 04:11:11 +000029#include "llvm/Support/raw_ostream.h"
Eric Christopher8d0c6212010-04-17 02:26:23 +000030#include "clang/Basic/TargetBuiltins.h"
Nate Begeman4904e322010-06-08 02:47:44 +000031#include "clang/Basic/TargetInfo.h"
Zhongxing Xu050379b2009-05-20 01:55:10 +000032#include <limits>
Chris Lattnerb87b1b32007-08-10 20:18:51 +000033using namespace clang;
34
Chris Lattnera26fb342009-02-18 17:49:48 +000035/// getLocationOfStringLiteralByte - Return a source location that points to the
36/// specified byte of the specified string literal.
37///
38/// Strings are amazingly complex. They can be formed from multiple tokens and
39/// can have escape sequences in them in addition to the usual trigraph and
40/// escaped newline business. This routine handles this complexity.
41///
42SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
43 unsigned ByteNo) const {
44 assert(!SL->isWide() && "This doesn't work for wide strings yet");
Mike Stump11289f42009-09-09 15:08:12 +000045
Chris Lattnera26fb342009-02-18 17:49:48 +000046 // Loop over all of the tokens in this string until we find the one that
47 // contains the byte we're looking for.
48 unsigned TokNo = 0;
49 while (1) {
50 assert(TokNo < SL->getNumConcatenated() && "Invalid byte number!");
51 SourceLocation StrTokLoc = SL->getStrTokenLoc(TokNo);
Mike Stump11289f42009-09-09 15:08:12 +000052
Chris Lattnera26fb342009-02-18 17:49:48 +000053 // Get the spelling of the string so that we can get the data that makes up
54 // the string literal, not the identifier for the macro it is potentially
55 // expanded through.
56 SourceLocation StrTokSpellingLoc = SourceMgr.getSpellingLoc(StrTokLoc);
57
58 // Re-lex the token to get its length and original spelling.
59 std::pair<FileID, unsigned> LocInfo =
60 SourceMgr.getDecomposedLoc(StrTokSpellingLoc);
Douglas Gregore0fbb832010-03-16 00:06:06 +000061 bool Invalid = false;
Benjamin Kramereb92dc02010-03-16 14:14:31 +000062 llvm::StringRef Buffer = SourceMgr.getBufferData(LocInfo.first, &Invalid);
Douglas Gregore0fbb832010-03-16 00:06:06 +000063 if (Invalid)
Douglas Gregor802b7762010-03-15 22:54:52 +000064 return StrTokSpellingLoc;
65
Benjamin Kramereb92dc02010-03-16 14:14:31 +000066 const char *StrData = Buffer.data()+LocInfo.second;
Mike Stump11289f42009-09-09 15:08:12 +000067
Chris Lattnera26fb342009-02-18 17:49:48 +000068 // Create a langops struct and enable trigraphs. This is sufficient for
69 // relexing tokens.
70 LangOptions LangOpts;
71 LangOpts.Trigraphs = true;
Mike Stump11289f42009-09-09 15:08:12 +000072
Chris Lattnera26fb342009-02-18 17:49:48 +000073 // Create a lexer starting at the beginning of this token.
Benjamin Kramereb92dc02010-03-16 14:14:31 +000074 Lexer TheLexer(StrTokSpellingLoc, LangOpts, Buffer.begin(), StrData,
75 Buffer.end());
Chris Lattnera26fb342009-02-18 17:49:48 +000076 Token TheTok;
77 TheLexer.LexFromRawLexer(TheTok);
Mike Stump11289f42009-09-09 15:08:12 +000078
Chris Lattner3dd56f92009-02-18 19:26:42 +000079 // Use the StringLiteralParser to compute the length of the string in bytes.
Douglas Gregor9af03022010-05-26 05:35:51 +000080 StringLiteralParser SLP(&TheTok, 1, PP, /*Complain=*/false);
Chris Lattner3dd56f92009-02-18 19:26:42 +000081 unsigned TokNumBytes = SLP.GetStringLength();
Mike Stump11289f42009-09-09 15:08:12 +000082
Chris Lattnerec396b52009-02-18 18:52:52 +000083 // If the byte is in this token, return the location of the byte.
Chris Lattnera26fb342009-02-18 17:49:48 +000084 if (ByteNo < TokNumBytes ||
85 (ByteNo == TokNumBytes && TokNo == SL->getNumConcatenated())) {
Mike Stump11289f42009-09-09 15:08:12 +000086 unsigned Offset =
Douglas Gregor9af03022010-05-26 05:35:51 +000087 StringLiteralParser::getOffsetOfStringByte(TheTok, ByteNo, PP,
88 /*Complain=*/false);
Mike Stump11289f42009-09-09 15:08:12 +000089
Chris Lattnerddb71912009-02-18 19:21:10 +000090 // Now that we know the offset of the token in the spelling, use the
91 // preprocessor to get the offset in the original source.
92 return PP.AdvanceToTokenCharacter(StrTokLoc, Offset);
Chris Lattnera26fb342009-02-18 17:49:48 +000093 }
Mike Stump11289f42009-09-09 15:08:12 +000094
Chris Lattnera26fb342009-02-18 17:49:48 +000095 // Move to the next string token.
96 ++TokNo;
97 ByteNo -= TokNumBytes;
98 }
99}
100
Ryan Flynnaa5e5fd2009-08-06 03:00:50 +0000101/// CheckablePrintfAttr - does a function call have a "printf" attribute
102/// and arguments that merit checking?
103bool Sema::CheckablePrintfAttr(const FormatAttr *Format, CallExpr *TheCall) {
104 if (Format->getType() == "printf") return true;
105 if (Format->getType() == "printf0") {
106 // printf0 allows null "format" string; if so don't check format/args
107 unsigned format_idx = Format->getFormatIdx() - 1;
Sebastian Redl6eedcc12009-11-17 18:02:24 +0000108 // Does the index refer to the implicit object argument?
109 if (isa<CXXMemberCallExpr>(TheCall)) {
110 if (format_idx == 0)
111 return false;
112 --format_idx;
113 }
Ryan Flynnaa5e5fd2009-08-06 03:00:50 +0000114 if (format_idx < TheCall->getNumArgs()) {
115 Expr *Format = TheCall->getArg(format_idx)->IgnoreParenCasts();
Ted Kremenekd1668192010-02-27 01:41:03 +0000116 if (!Format->isNullPointerConstant(Context,
117 Expr::NPC_ValueDependentIsNull))
Ryan Flynnaa5e5fd2009-08-06 03:00:50 +0000118 return true;
119 }
120 }
121 return false;
122}
Chris Lattnera26fb342009-02-18 17:49:48 +0000123
John McCalldadc5752010-08-24 06:29:42 +0000124ExprResult
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000125Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
John McCalldadc5752010-08-24 06:29:42 +0000126 ExprResult TheCallResult(Owned(TheCall));
Douglas Gregorae2fbad2008-11-17 20:34:05 +0000127
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000128 switch (BuiltinID) {
Chris Lattner43be2e62007-12-19 23:59:04 +0000129 case Builtin::BI__builtin___CFStringMakeConstantString:
Chris Lattner08464942007-12-28 05:29:59 +0000130 assert(TheCall->getNumArgs() == 1 &&
Chris Lattner2da14fb2007-12-20 00:26:33 +0000131 "Wrong # arguments to builtin CFStringMakeConstantString");
Chris Lattner6436fb62009-02-18 06:01:06 +0000132 if (CheckObjCString(TheCall->getArg(0)))
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000133 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000134 break;
Ted Kremeneka174c522008-07-09 17:58:53 +0000135 case Builtin::BI__builtin_stdarg_start:
Chris Lattner43be2e62007-12-19 23:59:04 +0000136 case Builtin::BI__builtin_va_start:
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000137 if (SemaBuiltinVAStart(TheCall))
138 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000139 break;
Chris Lattner2da14fb2007-12-20 00:26:33 +0000140 case Builtin::BI__builtin_isgreater:
141 case Builtin::BI__builtin_isgreaterequal:
142 case Builtin::BI__builtin_isless:
143 case Builtin::BI__builtin_islessequal:
144 case Builtin::BI__builtin_islessgreater:
145 case Builtin::BI__builtin_isunordered:
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000146 if (SemaBuiltinUnorderedCompare(TheCall))
147 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000148 break;
Benjamin Kramer634fc102010-02-15 22:42:31 +0000149 case Builtin::BI__builtin_fpclassify:
150 if (SemaBuiltinFPClassification(TheCall, 6))
151 return ExprError();
152 break;
Eli Friedman7e4faac2009-08-31 20:06:00 +0000153 case Builtin::BI__builtin_isfinite:
154 case Builtin::BI__builtin_isinf:
155 case Builtin::BI__builtin_isinf_sign:
156 case Builtin::BI__builtin_isnan:
157 case Builtin::BI__builtin_isnormal:
Benjamin Kramer64aae502010-02-16 10:07:31 +0000158 if (SemaBuiltinFPClassification(TheCall, 1))
Eli Friedman7e4faac2009-08-31 20:06:00 +0000159 return ExprError();
160 break;
Eli Friedmanf8353032008-05-20 08:23:37 +0000161 case Builtin::BI__builtin_return_address:
Eric Christopher8d0c6212010-04-17 02:26:23 +0000162 case Builtin::BI__builtin_frame_address: {
163 llvm::APSInt Result;
164 if (SemaBuiltinConstantArg(TheCall, 0, Result))
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000165 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000166 break;
Eric Christopher8d0c6212010-04-17 02:26:23 +0000167 }
168 case Builtin::BI__builtin_eh_return_data_regno: {
169 llvm::APSInt Result;
170 if (SemaBuiltinConstantArg(TheCall, 0, Result))
Chris Lattnerd545ad12009-09-23 06:06:36 +0000171 return ExprError();
172 break;
Eric Christopher8d0c6212010-04-17 02:26:23 +0000173 }
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000174 case Builtin::BI__builtin_shufflevector:
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000175 return SemaBuiltinShuffleVector(TheCall);
176 // TheCall will be freed by the smart pointer here, but that's fine, since
177 // SemaBuiltinShuffleVector guts it, but then doesn't release it.
Daniel Dunbarb7257262008-07-21 22:59:13 +0000178 case Builtin::BI__builtin_prefetch:
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000179 if (SemaBuiltinPrefetch(TheCall))
180 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000181 break;
Daniel Dunbarb0d34c82008-09-03 21:13:56 +0000182 case Builtin::BI__builtin_object_size:
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000183 if (SemaBuiltinObjectSize(TheCall))
184 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000185 break;
Eli Friedmaneed8ad22009-05-03 04:46:36 +0000186 case Builtin::BI__builtin_longjmp:
187 if (SemaBuiltinLongjmp(TheCall))
188 return ExprError();
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000189 break;
Chris Lattnerdc046542009-05-08 06:58:22 +0000190 case Builtin::BI__sync_fetch_and_add:
191 case Builtin::BI__sync_fetch_and_sub:
192 case Builtin::BI__sync_fetch_and_or:
193 case Builtin::BI__sync_fetch_and_and:
194 case Builtin::BI__sync_fetch_and_xor:
195 case Builtin::BI__sync_add_and_fetch:
196 case Builtin::BI__sync_sub_and_fetch:
197 case Builtin::BI__sync_and_and_fetch:
198 case Builtin::BI__sync_or_and_fetch:
199 case Builtin::BI__sync_xor_and_fetch:
200 case Builtin::BI__sync_val_compare_and_swap:
201 case Builtin::BI__sync_bool_compare_and_swap:
202 case Builtin::BI__sync_lock_test_and_set:
203 case Builtin::BI__sync_lock_release:
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000204 return SemaBuiltinAtomicOverloaded(move(TheCallResult));
Nate Begeman4904e322010-06-08 02:47:44 +0000205 }
206
207 // Since the target specific builtins for each arch overlap, only check those
208 // of the arch we are compiling for.
209 if (BuiltinID >= Builtin::FirstTSBuiltin) {
210 switch (Context.Target.getTriple().getArch()) {
211 case llvm::Triple::arm:
212 case llvm::Triple::thumb:
213 if (CheckARMBuiltinFunctionCall(BuiltinID, TheCall))
214 return ExprError();
215 break;
216 case llvm::Triple::x86:
217 case llvm::Triple::x86_64:
218 if (CheckX86BuiltinFunctionCall(BuiltinID, TheCall))
219 return ExprError();
220 break;
221 default:
222 break;
223 }
224 }
225
226 return move(TheCallResult);
227}
228
229bool Sema::CheckX86BuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
230 switch (BuiltinID) {
Eric Christopher8d0c6212010-04-17 02:26:23 +0000231 case X86::BI__builtin_ia32_palignr128:
232 case X86::BI__builtin_ia32_palignr: {
233 llvm::APSInt Result;
234 if (SemaBuiltinConstantArg(TheCall, 2, Result))
Nate Begeman4904e322010-06-08 02:47:44 +0000235 return true;
Eric Christopher8d0c6212010-04-17 02:26:23 +0000236 break;
237 }
Anders Carlsson98f07902007-08-17 05:31:46 +0000238 }
Nate Begeman4904e322010-06-08 02:47:44 +0000239 return false;
240}
Mike Stump11289f42009-09-09 15:08:12 +0000241
Nate Begeman91e1fea2010-06-14 05:21:25 +0000242// Get the valid immediate range for the specified NEON type code.
243static unsigned RFT(unsigned t, bool shift = false) {
244 bool quad = t & 0x10;
245
246 switch (t & 0x7) {
247 case 0: // i8
Nate Begemandbafec12010-06-17 02:26:59 +0000248 return shift ? 7 : (8 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000249 case 1: // i16
Nate Begemandbafec12010-06-17 02:26:59 +0000250 return shift ? 15 : (4 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000251 case 2: // i32
Nate Begemandbafec12010-06-17 02:26:59 +0000252 return shift ? 31 : (2 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000253 case 3: // i64
Nate Begemandbafec12010-06-17 02:26:59 +0000254 return shift ? 63 : (1 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000255 case 4: // f32
256 assert(!shift && "cannot shift float types!");
Nate Begemandbafec12010-06-17 02:26:59 +0000257 return (2 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000258 case 5: // poly8
259 assert(!shift && "cannot shift polynomial types!");
Nate Begemandbafec12010-06-17 02:26:59 +0000260 return (8 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000261 case 6: // poly16
262 assert(!shift && "cannot shift polynomial types!");
Nate Begemandbafec12010-06-17 02:26:59 +0000263 return (4 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000264 case 7: // float16
265 assert(!shift && "cannot shift float types!");
Nate Begemandbafec12010-06-17 02:26:59 +0000266 return (4 << (int)quad) - 1;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000267 }
268 return 0;
269}
270
Nate Begeman4904e322010-06-08 02:47:44 +0000271bool Sema::CheckARMBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
Nate Begeman55483092010-06-09 01:10:23 +0000272 llvm::APSInt Result;
273
Nate Begemand773fe62010-06-13 04:47:52 +0000274 unsigned mask = 0;
Nate Begeman91e1fea2010-06-14 05:21:25 +0000275 unsigned TV = 0;
Nate Begeman55483092010-06-09 01:10:23 +0000276 switch (BuiltinID) {
Nate Begeman35f4c1c2010-06-17 04:17:01 +0000277#define GET_NEON_OVERLOAD_CHECK
278#include "clang/Basic/arm_neon.inc"
279#undef GET_NEON_OVERLOAD_CHECK
Nate Begeman55483092010-06-09 01:10:23 +0000280 }
281
Nate Begemand773fe62010-06-13 04:47:52 +0000282 // For NEON intrinsics which are overloaded on vector element type, validate
283 // the immediate which specifies which variant to emit.
284 if (mask) {
285 unsigned ArgNo = TheCall->getNumArgs()-1;
286 if (SemaBuiltinConstantArg(TheCall, ArgNo, Result))
287 return true;
288
Nate Begeman91e1fea2010-06-14 05:21:25 +0000289 TV = Result.getLimitedValue(32);
290 if ((TV > 31) || (mask & (1 << TV)) == 0)
Nate Begemand773fe62010-06-13 04:47:52 +0000291 return Diag(TheCall->getLocStart(), diag::err_invalid_neon_type_code)
292 << TheCall->getArg(ArgNo)->getSourceRange();
293 }
Nate Begeman55483092010-06-09 01:10:23 +0000294
Nate Begemand773fe62010-06-13 04:47:52 +0000295 // For NEON intrinsics which take an immediate value as part of the
296 // instruction, range check them here.
Nate Begeman91e1fea2010-06-14 05:21:25 +0000297 unsigned i = 0, l = 0, u = 0;
Nate Begemand773fe62010-06-13 04:47:52 +0000298 switch (BuiltinID) {
299 default: return false;
Nate Begeman1194bd22010-07-29 22:48:34 +0000300 case ARM::BI__builtin_arm_ssat: i = 1; l = 1; u = 31; break;
301 case ARM::BI__builtin_arm_usat: i = 1; u = 31; break;
Nate Begemanf568b072010-08-03 21:32:34 +0000302 case ARM::BI__builtin_arm_vcvtr_f:
303 case ARM::BI__builtin_arm_vcvtr_d: i = 1; u = 1; break;
Nate Begeman35f4c1c2010-06-17 04:17:01 +0000304#define GET_NEON_IMMEDIATE_CHECK
305#include "clang/Basic/arm_neon.inc"
306#undef GET_NEON_IMMEDIATE_CHECK
Nate Begemand773fe62010-06-13 04:47:52 +0000307 };
308
Nate Begeman91e1fea2010-06-14 05:21:25 +0000309 // Check that the immediate argument is actually a constant.
Nate Begemand773fe62010-06-13 04:47:52 +0000310 if (SemaBuiltinConstantArg(TheCall, i, Result))
311 return true;
312
Nate Begeman91e1fea2010-06-14 05:21:25 +0000313 // Range check against the upper/lower values for this isntruction.
Nate Begemand773fe62010-06-13 04:47:52 +0000314 unsigned Val = Result.getZExtValue();
Nate Begeman91e1fea2010-06-14 05:21:25 +0000315 if (Val < l || Val > (u + l))
Nate Begemand773fe62010-06-13 04:47:52 +0000316 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Benjamin Kramere8394df2010-08-11 14:47:12 +0000317 << l << u+l << TheCall->getArg(i)->getSourceRange();
Nate Begemand773fe62010-06-13 04:47:52 +0000318
Nate Begemanf568b072010-08-03 21:32:34 +0000319 // FIXME: VFP Intrinsics should error if VFP not present.
Nate Begeman4904e322010-06-08 02:47:44 +0000320 return false;
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000321}
Daniel Dunbardd9b2d12008-10-02 18:44:07 +0000322
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000323/// CheckFunctionCall - Check a direct function call for various correctness
324/// and safety properties not strictly enforced by the C type system.
325bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall) {
326 // Get the IdentifierInfo* for the called function.
327 IdentifierInfo *FnInfo = FDecl->getIdentifier();
328
329 // None of the checks below are needed for functions that don't have
330 // simple names (e.g., C++ conversion functions).
331 if (!FnInfo)
332 return false;
Mike Stump11289f42009-09-09 15:08:12 +0000333
Daniel Dunbardd9b2d12008-10-02 18:44:07 +0000334 // FIXME: This mechanism should be abstracted to be less fragile and
335 // more efficient. For example, just map function ids to custom
336 // handlers.
337
Chris Lattnerb87b1b32007-08-10 20:18:51 +0000338 // Printf checking.
Argyrios Kyrtzidisb4b64ca2009-06-30 02:34:44 +0000339 if (const FormatAttr *Format = FDecl->getAttr<FormatAttr>()) {
Ted Kremenek02087932010-07-16 02:11:22 +0000340 const bool b = Format->getType() == "scanf";
341 if (b || CheckablePrintfAttr(Format, TheCall)) {
Ted Kremenek9723bcf2009-02-27 17:58:43 +0000342 bool HasVAListArg = Format->getFirstArg() == 0;
Ted Kremenek02087932010-07-16 02:11:22 +0000343 CheckPrintfScanfArguments(TheCall, HasVAListArg,
344 Format->getFormatIdx() - 1,
345 HasVAListArg ? 0 : Format->getFirstArg() - 1,
346 !b);
Douglas Gregore711f702009-02-14 18:57:46 +0000347 }
Chris Lattnerb87b1b32007-08-10 20:18:51 +0000348 }
Mike Stump11289f42009-09-09 15:08:12 +0000349
Alexis Huntdcfba7b2010-08-18 23:23:40 +0000350 specific_attr_iterator<NonNullAttr>
351 i = FDecl->specific_attr_begin<NonNullAttr>(),
352 e = FDecl->specific_attr_end<NonNullAttr>();
353
354 for (; i != e; ++i)
355 CheckNonNullArguments(*i, TheCall);
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000356
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000357 return false;
Anders Carlsson98f07902007-08-17 05:31:46 +0000358}
359
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000360bool Sema::CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall) {
Fariborz Jahanianc1585be2009-05-18 21:05:18 +0000361 // Printf checking.
Argyrios Kyrtzidisb4b64ca2009-06-30 02:34:44 +0000362 const FormatAttr *Format = NDecl->getAttr<FormatAttr>();
Fariborz Jahanianc1585be2009-05-18 21:05:18 +0000363 if (!Format)
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000364 return false;
Mike Stump11289f42009-09-09 15:08:12 +0000365
Fariborz Jahanianc1585be2009-05-18 21:05:18 +0000366 const VarDecl *V = dyn_cast<VarDecl>(NDecl);
367 if (!V)
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000368 return false;
Mike Stump11289f42009-09-09 15:08:12 +0000369
Fariborz Jahanianc1585be2009-05-18 21:05:18 +0000370 QualType Ty = V->getType();
371 if (!Ty->isBlockPointerType())
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000372 return false;
Mike Stump11289f42009-09-09 15:08:12 +0000373
Ted Kremenek02087932010-07-16 02:11:22 +0000374 const bool b = Format->getType() == "scanf";
375 if (!b && !CheckablePrintfAttr(Format, TheCall))
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000376 return false;
Mike Stump11289f42009-09-09 15:08:12 +0000377
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000378 bool HasVAListArg = Format->getFirstArg() == 0;
Ted Kremenek02087932010-07-16 02:11:22 +0000379 CheckPrintfScanfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
380 HasVAListArg ? 0 : Format->getFirstArg() - 1, !b);
Anders Carlssonbc4c1072009-08-16 01:56:34 +0000381
382 return false;
Fariborz Jahanianc1585be2009-05-18 21:05:18 +0000383}
384
Chris Lattnerdc046542009-05-08 06:58:22 +0000385/// SemaBuiltinAtomicOverloaded - We have a call to a function like
386/// __sync_fetch_and_add, which is an overloaded function based on the pointer
387/// type of its first argument. The main ActOnCallExpr routines have already
388/// promoted the types of arguments because all of these calls are prototyped as
389/// void(...).
390///
391/// This function goes through and does final semantic checking for these
392/// builtins,
John McCalldadc5752010-08-24 06:29:42 +0000393ExprResult
394Sema::SemaBuiltinAtomicOverloaded(ExprResult TheCallResult) {
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000395 CallExpr *TheCall = (CallExpr *)TheCallResult.get();
Chris Lattnerdc046542009-05-08 06:58:22 +0000396 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
397 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
398
399 // Ensure that we have at least one argument to do type inference from.
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000400 if (TheCall->getNumArgs() < 1) {
401 Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least)
402 << 0 << 1 << TheCall->getNumArgs()
403 << TheCall->getCallee()->getSourceRange();
404 return ExprError();
405 }
Mike Stump11289f42009-09-09 15:08:12 +0000406
Chris Lattnerdc046542009-05-08 06:58:22 +0000407 // Inspect the first argument of the atomic builtin. This should always be
408 // a pointer type, whose element is an integral scalar or pointer type.
409 // Because it is a pointer type, we don't have to worry about any implicit
410 // casts here.
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000411 // FIXME: We don't allow floating point scalars as input.
Chris Lattnerdc046542009-05-08 06:58:22 +0000412 Expr *FirstArg = TheCall->getArg(0);
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000413 if (!FirstArg->getType()->isPointerType()) {
414 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
415 << FirstArg->getType() << FirstArg->getSourceRange();
416 return ExprError();
417 }
Mike Stump11289f42009-09-09 15:08:12 +0000418
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000419 QualType ValType =
420 FirstArg->getType()->getAs<PointerType>()->getPointeeType();
Mike Stump11289f42009-09-09 15:08:12 +0000421 if (!ValType->isIntegerType() && !ValType->isPointerType() &&
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000422 !ValType->isBlockPointerType()) {
423 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intptr)
424 << FirstArg->getType() << FirstArg->getSourceRange();
425 return ExprError();
426 }
Chris Lattnerdc046542009-05-08 06:58:22 +0000427
Chandler Carruth3973af72010-07-18 20:54:12 +0000428 // The majority of builtins return a value, but a few have special return
429 // types, so allow them to override appropriately below.
430 QualType ResultType = ValType;
431
Chris Lattnerdc046542009-05-08 06:58:22 +0000432 // We need to figure out which concrete builtin this maps onto. For example,
433 // __sync_fetch_and_add with a 2 byte object turns into
434 // __sync_fetch_and_add_2.
435#define BUILTIN_ROW(x) \
436 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
437 Builtin::BI##x##_8, Builtin::BI##x##_16 }
Mike Stump11289f42009-09-09 15:08:12 +0000438
Chris Lattnerdc046542009-05-08 06:58:22 +0000439 static const unsigned BuiltinIndices[][5] = {
440 BUILTIN_ROW(__sync_fetch_and_add),
441 BUILTIN_ROW(__sync_fetch_and_sub),
442 BUILTIN_ROW(__sync_fetch_and_or),
443 BUILTIN_ROW(__sync_fetch_and_and),
444 BUILTIN_ROW(__sync_fetch_and_xor),
Mike Stump11289f42009-09-09 15:08:12 +0000445
Chris Lattnerdc046542009-05-08 06:58:22 +0000446 BUILTIN_ROW(__sync_add_and_fetch),
447 BUILTIN_ROW(__sync_sub_and_fetch),
448 BUILTIN_ROW(__sync_and_and_fetch),
449 BUILTIN_ROW(__sync_or_and_fetch),
450 BUILTIN_ROW(__sync_xor_and_fetch),
Mike Stump11289f42009-09-09 15:08:12 +0000451
Chris Lattnerdc046542009-05-08 06:58:22 +0000452 BUILTIN_ROW(__sync_val_compare_and_swap),
453 BUILTIN_ROW(__sync_bool_compare_and_swap),
454 BUILTIN_ROW(__sync_lock_test_and_set),
455 BUILTIN_ROW(__sync_lock_release)
456 };
Mike Stump11289f42009-09-09 15:08:12 +0000457#undef BUILTIN_ROW
458
Chris Lattnerdc046542009-05-08 06:58:22 +0000459 // Determine the index of the size.
460 unsigned SizeIndex;
Ken Dyck40775002010-01-11 17:06:35 +0000461 switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
Chris Lattnerdc046542009-05-08 06:58:22 +0000462 case 1: SizeIndex = 0; break;
463 case 2: SizeIndex = 1; break;
464 case 4: SizeIndex = 2; break;
465 case 8: SizeIndex = 3; break;
466 case 16: SizeIndex = 4; break;
467 default:
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000468 Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
469 << FirstArg->getType() << FirstArg->getSourceRange();
470 return ExprError();
Chris Lattnerdc046542009-05-08 06:58:22 +0000471 }
Mike Stump11289f42009-09-09 15:08:12 +0000472
Chris Lattnerdc046542009-05-08 06:58:22 +0000473 // Each of these builtins has one pointer argument, followed by some number of
474 // values (0, 1 or 2) followed by a potentially empty varags list of stuff
475 // that we ignore. Find out which row of BuiltinIndices to read from as well
476 // as the number of fixed args.
Douglas Gregor15fc9562009-09-12 00:22:50 +0000477 unsigned BuiltinID = FDecl->getBuiltinID();
Chris Lattnerdc046542009-05-08 06:58:22 +0000478 unsigned BuiltinIndex, NumFixed = 1;
479 switch (BuiltinID) {
480 default: assert(0 && "Unknown overloaded atomic builtin!");
481 case Builtin::BI__sync_fetch_and_add: BuiltinIndex = 0; break;
482 case Builtin::BI__sync_fetch_and_sub: BuiltinIndex = 1; break;
483 case Builtin::BI__sync_fetch_and_or: BuiltinIndex = 2; break;
484 case Builtin::BI__sync_fetch_and_and: BuiltinIndex = 3; break;
485 case Builtin::BI__sync_fetch_and_xor: BuiltinIndex = 4; break;
Mike Stump11289f42009-09-09 15:08:12 +0000486
Daniel Dunbar3f540c0d2010-03-25 17:13:09 +0000487 case Builtin::BI__sync_add_and_fetch: BuiltinIndex = 5; break;
488 case Builtin::BI__sync_sub_and_fetch: BuiltinIndex = 6; break;
489 case Builtin::BI__sync_and_and_fetch: BuiltinIndex = 7; break;
490 case Builtin::BI__sync_or_and_fetch: BuiltinIndex = 8; break;
491 case Builtin::BI__sync_xor_and_fetch: BuiltinIndex = 9; break;
Mike Stump11289f42009-09-09 15:08:12 +0000492
Chris Lattnerdc046542009-05-08 06:58:22 +0000493 case Builtin::BI__sync_val_compare_and_swap:
Daniel Dunbar3f540c0d2010-03-25 17:13:09 +0000494 BuiltinIndex = 10;
Chris Lattnerdc046542009-05-08 06:58:22 +0000495 NumFixed = 2;
496 break;
497 case Builtin::BI__sync_bool_compare_and_swap:
Daniel Dunbar3f540c0d2010-03-25 17:13:09 +0000498 BuiltinIndex = 11;
Chris Lattnerdc046542009-05-08 06:58:22 +0000499 NumFixed = 2;
Chandler Carruth3973af72010-07-18 20:54:12 +0000500 ResultType = Context.BoolTy;
Chris Lattnerdc046542009-05-08 06:58:22 +0000501 break;
Daniel Dunbar3f540c0d2010-03-25 17:13:09 +0000502 case Builtin::BI__sync_lock_test_and_set: BuiltinIndex = 12; break;
Chris Lattnerdc046542009-05-08 06:58:22 +0000503 case Builtin::BI__sync_lock_release:
Daniel Dunbar3f540c0d2010-03-25 17:13:09 +0000504 BuiltinIndex = 13;
Chris Lattnerdc046542009-05-08 06:58:22 +0000505 NumFixed = 0;
Chandler Carruth3973af72010-07-18 20:54:12 +0000506 ResultType = Context.VoidTy;
Chris Lattnerdc046542009-05-08 06:58:22 +0000507 break;
508 }
Mike Stump11289f42009-09-09 15:08:12 +0000509
Chris Lattnerdc046542009-05-08 06:58:22 +0000510 // Now that we know how many fixed arguments we expect, first check that we
511 // have at least that many.
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000512 if (TheCall->getNumArgs() < 1+NumFixed) {
513 Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least)
514 << 0 << 1+NumFixed << TheCall->getNumArgs()
515 << TheCall->getCallee()->getSourceRange();
516 return ExprError();
517 }
Mike Stump11289f42009-09-09 15:08:12 +0000518
Chris Lattner5b9241b2009-05-08 15:36:58 +0000519 // Get the decl for the concrete builtin from this, we can tell what the
520 // concrete integer type we should convert to is.
521 unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
522 const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
523 IdentifierInfo *NewBuiltinII = PP.getIdentifierInfo(NewBuiltinName);
Mike Stump11289f42009-09-09 15:08:12 +0000524 FunctionDecl *NewBuiltinDecl =
Chris Lattner5b9241b2009-05-08 15:36:58 +0000525 cast<FunctionDecl>(LazilyCreateBuiltin(NewBuiltinII, NewBuiltinID,
526 TUScope, false, DRE->getLocStart()));
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000527
John McCallcf142162010-08-07 06:22:56 +0000528 // The first argument --- the pointer --- has a fixed type; we
529 // deduce the types of the rest of the arguments accordingly. Walk
530 // the remaining arguments, converting them to the deduced value type.
Chris Lattnerdc046542009-05-08 06:58:22 +0000531 for (unsigned i = 0; i != NumFixed; ++i) {
532 Expr *Arg = TheCall->getArg(i+1);
Mike Stump11289f42009-09-09 15:08:12 +0000533
Chris Lattnerdc046542009-05-08 06:58:22 +0000534 // If the argument is an implicit cast, then there was a promotion due to
535 // "...", just remove it now.
536 if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
537 Arg = ICE->getSubExpr();
538 ICE->setSubExpr(0);
Chris Lattnerdc046542009-05-08 06:58:22 +0000539 TheCall->setArg(i+1, Arg);
540 }
Mike Stump11289f42009-09-09 15:08:12 +0000541
Chris Lattnerdc046542009-05-08 06:58:22 +0000542 // GCC does an implicit conversion to the pointer or integer ValType. This
543 // can fail in some cases (1i -> int**), check for this error case now.
Anders Carlssonf10e4142009-08-07 22:21:05 +0000544 CastExpr::CastKind Kind = CastExpr::CK_Unknown;
John McCallcf142162010-08-07 06:22:56 +0000545 CXXCastPath BasePath;
Anders Carlssona70cff62010-04-24 19:06:50 +0000546 if (CheckCastTypes(Arg->getSourceRange(), ValType, Arg, Kind, BasePath))
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000547 return ExprError();
Mike Stump11289f42009-09-09 15:08:12 +0000548
Chris Lattnerdc046542009-05-08 06:58:22 +0000549 // Okay, we have something that *can* be converted to the right type. Check
550 // to see if there is a potentially weird extension going on here. This can
551 // happen when you do an atomic operation on something like an char* and
552 // pass in 42. The 42 gets converted to char. This is even more strange
553 // for things like 45.123 -> char, etc.
Mike Stump11289f42009-09-09 15:08:12 +0000554 // FIXME: Do this check.
John McCallcf142162010-08-07 06:22:56 +0000555 ImpCastExprToType(Arg, ValType, Kind, ImplicitCastExpr::RValue, &BasePath);
Chris Lattnerdc046542009-05-08 06:58:22 +0000556 TheCall->setArg(i+1, Arg);
557 }
Mike Stump11289f42009-09-09 15:08:12 +0000558
Chris Lattnerdc046542009-05-08 06:58:22 +0000559 // Switch the DeclRefExpr to refer to the new decl.
560 DRE->setDecl(NewBuiltinDecl);
561 DRE->setType(NewBuiltinDecl->getType());
Mike Stump11289f42009-09-09 15:08:12 +0000562
Chris Lattnerdc046542009-05-08 06:58:22 +0000563 // Set the callee in the CallExpr.
564 // FIXME: This leaks the original parens and implicit casts.
565 Expr *PromotedCall = DRE;
566 UsualUnaryConversions(PromotedCall);
567 TheCall->setCallee(PromotedCall);
Mike Stump11289f42009-09-09 15:08:12 +0000568
Chandler Carruthbc8cab12010-07-18 07:23:17 +0000569 // Change the result type of the call to match the original value type. This
570 // is arbitrary, but the codegen for these builtins ins design to handle it
571 // gracefully.
Chandler Carruth3973af72010-07-18 20:54:12 +0000572 TheCall->setType(ResultType);
Chandler Carruth741e5ce2010-07-09 18:59:35 +0000573
574 return move(TheCallResult);
Chris Lattnerdc046542009-05-08 06:58:22 +0000575}
576
577
Chris Lattner6436fb62009-02-18 06:01:06 +0000578/// CheckObjCString - Checks that the argument to the builtin
Anders Carlsson98f07902007-08-17 05:31:46 +0000579/// CFString constructor is correct
Steve Narofffb46e862009-04-13 20:26:29 +0000580/// FIXME: GCC currently emits the following warning:
Mike Stump11289f42009-09-09 15:08:12 +0000581/// "warning: input conversion stopped due to an input byte that does not
Steve Narofffb46e862009-04-13 20:26:29 +0000582/// belong to the input codeset UTF-8"
583/// Note: It might also make sense to do the UTF-16 conversion here (would
584/// simplify the backend).
Chris Lattner6436fb62009-02-18 06:01:06 +0000585bool Sema::CheckObjCString(Expr *Arg) {
Chris Lattnerf2660962008-02-13 01:02:39 +0000586 Arg = Arg->IgnoreParenCasts();
Anders Carlsson98f07902007-08-17 05:31:46 +0000587 StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
588
589 if (!Literal || Literal->isWide()) {
Chris Lattner3b054132008-11-19 05:08:23 +0000590 Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
591 << Arg->getSourceRange();
Anders Carlssona3a9c432007-08-17 15:44:17 +0000592 return true;
Anders Carlsson98f07902007-08-17 05:31:46 +0000593 }
Mike Stump11289f42009-09-09 15:08:12 +0000594
Benjamin Kramer35b077e2010-08-17 12:54:38 +0000595 size_t NulPos = Literal->getString().find('\0');
596 if (NulPos != llvm::StringRef::npos) {
597 Diag(getLocationOfStringLiteralByte(Literal, NulPos),
598 diag::warn_cfstring_literal_contains_nul_character)
599 << Arg->getSourceRange();
Daniel Dunbarb879c3c2009-09-22 10:03:52 +0000600 }
Mike Stump11289f42009-09-09 15:08:12 +0000601
Anders Carlssona3a9c432007-08-17 15:44:17 +0000602 return false;
Chris Lattnerb87b1b32007-08-10 20:18:51 +0000603}
604
Chris Lattnere202e6a2007-12-20 00:05:45 +0000605/// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
606/// Emit an error and return true on failure, return false on success.
Chris Lattner08464942007-12-28 05:29:59 +0000607bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
608 Expr *Fn = TheCall->getCallee();
609 if (TheCall->getNumArgs() > 2) {
Chris Lattnercedef8d2008-11-21 18:44:24 +0000610 Diag(TheCall->getArg(2)->getLocStart(),
Chris Lattner3b054132008-11-19 05:08:23 +0000611 diag::err_typecheck_call_too_many_args)
Eric Christopher2a5aaff2010-04-16 04:56:46 +0000612 << 0 /*function call*/ << 2 << TheCall->getNumArgs()
613 << Fn->getSourceRange()
Mike Stump11289f42009-09-09 15:08:12 +0000614 << SourceRange(TheCall->getArg(2)->getLocStart(),
Chris Lattner3b054132008-11-19 05:08:23 +0000615 (*(TheCall->arg_end()-1))->getLocEnd());
Chris Lattner43be2e62007-12-19 23:59:04 +0000616 return true;
617 }
Eli Friedmanbb2b3be2008-12-15 22:05:35 +0000618
619 if (TheCall->getNumArgs() < 2) {
Eric Christopherabf1e182010-04-16 04:48:22 +0000620 return Diag(TheCall->getLocEnd(),
621 diag::err_typecheck_call_too_few_args_at_least)
622 << 0 /*function call*/ << 2 << TheCall->getNumArgs();
Eli Friedmanbb2b3be2008-12-15 22:05:35 +0000623 }
624
Chris Lattnere202e6a2007-12-20 00:05:45 +0000625 // Determine whether the current function is variadic or not.
Douglas Gregor9a28e842010-03-01 23:15:13 +0000626 BlockScopeInfo *CurBlock = getCurBlock();
Chris Lattnere202e6a2007-12-20 00:05:45 +0000627 bool isVariadic;
Steve Naroff439a3e42009-04-15 19:33:47 +0000628 if (CurBlock)
John McCall8e346702010-06-04 19:02:56 +0000629 isVariadic = CurBlock->TheDecl->isVariadic();
Ted Kremenek186a0742010-04-29 16:49:01 +0000630 else if (FunctionDecl *FD = getCurFunctionDecl())
631 isVariadic = FD->isVariadic();
632 else
Argyrios Kyrtzidis853fbea2008-06-28 06:07:14 +0000633 isVariadic = getCurMethodDecl()->isVariadic();
Mike Stump11289f42009-09-09 15:08:12 +0000634
Chris Lattnere202e6a2007-12-20 00:05:45 +0000635 if (!isVariadic) {
Chris Lattner43be2e62007-12-19 23:59:04 +0000636 Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
637 return true;
638 }
Mike Stump11289f42009-09-09 15:08:12 +0000639
Chris Lattner43be2e62007-12-19 23:59:04 +0000640 // Verify that the second argument to the builtin is the last argument of the
641 // current function or method.
642 bool SecondArgIsLastNamedArgument = false;
Anders Carlsson73cc5072008-02-13 01:22:59 +0000643 const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
Mike Stump11289f42009-09-09 15:08:12 +0000644
Anders Carlsson6a8350b2008-02-11 04:20:54 +0000645 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
646 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
Chris Lattner43be2e62007-12-19 23:59:04 +0000647 // FIXME: This isn't correct for methods (results in bogus warning).
648 // Get the last formal in the current function.
Anders Carlsson6a8350b2008-02-11 04:20:54 +0000649 const ParmVarDecl *LastArg;
Steve Naroff439a3e42009-04-15 19:33:47 +0000650 if (CurBlock)
651 LastArg = *(CurBlock->TheDecl->param_end()-1);
652 else if (FunctionDecl *FD = getCurFunctionDecl())
Chris Lattner79413952008-12-04 23:50:19 +0000653 LastArg = *(FD->param_end()-1);
Chris Lattner43be2e62007-12-19 23:59:04 +0000654 else
Argyrios Kyrtzidis853fbea2008-06-28 06:07:14 +0000655 LastArg = *(getCurMethodDecl()->param_end()-1);
Chris Lattner43be2e62007-12-19 23:59:04 +0000656 SecondArgIsLastNamedArgument = PV == LastArg;
657 }
658 }
Mike Stump11289f42009-09-09 15:08:12 +0000659
Chris Lattner43be2e62007-12-19 23:59:04 +0000660 if (!SecondArgIsLastNamedArgument)
Mike Stump11289f42009-09-09 15:08:12 +0000661 Diag(TheCall->getArg(1)->getLocStart(),
Chris Lattner43be2e62007-12-19 23:59:04 +0000662 diag::warn_second_parameter_of_va_start_not_last_named_argument);
663 return false;
Eli Friedmanf8353032008-05-20 08:23:37 +0000664}
Chris Lattner43be2e62007-12-19 23:59:04 +0000665
Chris Lattner2da14fb2007-12-20 00:26:33 +0000666/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
667/// friends. This is declared to take (...), so we have to check everything.
Chris Lattner08464942007-12-28 05:29:59 +0000668bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
669 if (TheCall->getNumArgs() < 2)
Chris Lattnercedef8d2008-11-21 18:44:24 +0000670 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
Eric Christopherabf1e182010-04-16 04:48:22 +0000671 << 0 << 2 << TheCall->getNumArgs()/*function call*/;
Chris Lattner08464942007-12-28 05:29:59 +0000672 if (TheCall->getNumArgs() > 2)
Mike Stump11289f42009-09-09 15:08:12 +0000673 return Diag(TheCall->getArg(2)->getLocStart(),
Chris Lattner3b054132008-11-19 05:08:23 +0000674 diag::err_typecheck_call_too_many_args)
Eric Christopher2a5aaff2010-04-16 04:56:46 +0000675 << 0 /*function call*/ << 2 << TheCall->getNumArgs()
Chris Lattner3b054132008-11-19 05:08:23 +0000676 << SourceRange(TheCall->getArg(2)->getLocStart(),
677 (*(TheCall->arg_end()-1))->getLocEnd());
Mike Stump11289f42009-09-09 15:08:12 +0000678
Chris Lattner08464942007-12-28 05:29:59 +0000679 Expr *OrigArg0 = TheCall->getArg(0);
680 Expr *OrigArg1 = TheCall->getArg(1);
Douglas Gregorc25f7662009-05-19 22:10:17 +0000681
Chris Lattner2da14fb2007-12-20 00:26:33 +0000682 // Do standard promotions between the two arguments, returning their common
683 // type.
Chris Lattner08464942007-12-28 05:29:59 +0000684 QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
Daniel Dunbar96f86772009-02-19 19:28:43 +0000685
686 // Make sure any conversions are pushed back into the call; this is
687 // type safe since unordered compare builtins are declared as "_Bool
688 // foo(...)".
689 TheCall->setArg(0, OrigArg0);
690 TheCall->setArg(1, OrigArg1);
Mike Stump11289f42009-09-09 15:08:12 +0000691
Douglas Gregorc25f7662009-05-19 22:10:17 +0000692 if (OrigArg0->isTypeDependent() || OrigArg1->isTypeDependent())
693 return false;
694
Chris Lattner2da14fb2007-12-20 00:26:33 +0000695 // If the common type isn't a real floating type, then the arguments were
696 // invalid for this operation.
697 if (!Res->isRealFloatingType())
Mike Stump11289f42009-09-09 15:08:12 +0000698 return Diag(OrigArg0->getLocStart(),
Chris Lattner3b054132008-11-19 05:08:23 +0000699 diag::err_typecheck_call_invalid_ordered_compare)
Chris Lattner1e5665e2008-11-24 06:25:27 +0000700 << OrigArg0->getType() << OrigArg1->getType()
Chris Lattner3b054132008-11-19 05:08:23 +0000701 << SourceRange(OrigArg0->getLocStart(), OrigArg1->getLocEnd());
Mike Stump11289f42009-09-09 15:08:12 +0000702
Chris Lattner2da14fb2007-12-20 00:26:33 +0000703 return false;
704}
705
Benjamin Kramer634fc102010-02-15 22:42:31 +0000706/// SemaBuiltinSemaBuiltinFPClassification - Handle functions like
707/// __builtin_isnan and friends. This is declared to take (...), so we have
Benjamin Kramer64aae502010-02-16 10:07:31 +0000708/// to check everything. We expect the last argument to be a floating point
709/// value.
710bool Sema::SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs) {
711 if (TheCall->getNumArgs() < NumArgs)
Eli Friedman7e4faac2009-08-31 20:06:00 +0000712 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
Eric Christopherabf1e182010-04-16 04:48:22 +0000713 << 0 << NumArgs << TheCall->getNumArgs()/*function call*/;
Benjamin Kramer64aae502010-02-16 10:07:31 +0000714 if (TheCall->getNumArgs() > NumArgs)
715 return Diag(TheCall->getArg(NumArgs)->getLocStart(),
Eli Friedman7e4faac2009-08-31 20:06:00 +0000716 diag::err_typecheck_call_too_many_args)
Eric Christopher2a5aaff2010-04-16 04:56:46 +0000717 << 0 /*function call*/ << NumArgs << TheCall->getNumArgs()
Benjamin Kramer64aae502010-02-16 10:07:31 +0000718 << SourceRange(TheCall->getArg(NumArgs)->getLocStart(),
Eli Friedman7e4faac2009-08-31 20:06:00 +0000719 (*(TheCall->arg_end()-1))->getLocEnd());
720
Benjamin Kramer64aae502010-02-16 10:07:31 +0000721 Expr *OrigArg = TheCall->getArg(NumArgs-1);
Mike Stump11289f42009-09-09 15:08:12 +0000722
Eli Friedman7e4faac2009-08-31 20:06:00 +0000723 if (OrigArg->isTypeDependent())
724 return false;
725
Chris Lattner68784ef2010-05-06 05:50:07 +0000726 // This operation requires a non-_Complex floating-point number.
Eli Friedman7e4faac2009-08-31 20:06:00 +0000727 if (!OrigArg->getType()->isRealFloatingType())
Mike Stump11289f42009-09-09 15:08:12 +0000728 return Diag(OrigArg->getLocStart(),
Eli Friedman7e4faac2009-08-31 20:06:00 +0000729 diag::err_typecheck_call_invalid_unary_fp)
730 << OrigArg->getType() << OrigArg->getSourceRange();
Mike Stump11289f42009-09-09 15:08:12 +0000731
Chris Lattner68784ef2010-05-06 05:50:07 +0000732 // If this is an implicit conversion from float -> double, remove it.
733 if (ImplicitCastExpr *Cast = dyn_cast<ImplicitCastExpr>(OrigArg)) {
734 Expr *CastArg = Cast->getSubExpr();
735 if (CastArg->getType()->isSpecificBuiltinType(BuiltinType::Float)) {
736 assert(Cast->getType()->isSpecificBuiltinType(BuiltinType::Double) &&
737 "promotion from float to double is the only expected cast here");
738 Cast->setSubExpr(0);
Chris Lattner68784ef2010-05-06 05:50:07 +0000739 TheCall->setArg(NumArgs-1, CastArg);
740 OrigArg = CastArg;
741 }
742 }
743
Eli Friedman7e4faac2009-08-31 20:06:00 +0000744 return false;
745}
746
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000747/// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
748// This is declared to take (...), so we have to check everything.
John McCalldadc5752010-08-24 06:29:42 +0000749ExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) {
Nate Begemana0110022010-06-08 00:16:34 +0000750 if (TheCall->getNumArgs() < 2)
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000751 return ExprError(Diag(TheCall->getLocEnd(),
Eric Christopherabf1e182010-04-16 04:48:22 +0000752 diag::err_typecheck_call_too_few_args_at_least)
Nate Begemana0110022010-06-08 00:16:34 +0000753 << 0 /*function call*/ << 2 << TheCall->getNumArgs()
Eric Christopherabf1e182010-04-16 04:48:22 +0000754 << TheCall->getSourceRange());
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000755
Nate Begemana0110022010-06-08 00:16:34 +0000756 // Determine which of the following types of shufflevector we're checking:
757 // 1) unary, vector mask: (lhs, mask)
758 // 2) binary, vector mask: (lhs, rhs, mask)
759 // 3) binary, scalar mask: (lhs, rhs, index, ..., index)
760 QualType resType = TheCall->getArg(0)->getType();
761 unsigned numElements = 0;
762
Douglas Gregorc25f7662009-05-19 22:10:17 +0000763 if (!TheCall->getArg(0)->isTypeDependent() &&
764 !TheCall->getArg(1)->isTypeDependent()) {
Nate Begemana0110022010-06-08 00:16:34 +0000765 QualType LHSType = TheCall->getArg(0)->getType();
766 QualType RHSType = TheCall->getArg(1)->getType();
767
768 if (!LHSType->isVectorType() || !RHSType->isVectorType()) {
Douglas Gregorc25f7662009-05-19 22:10:17 +0000769 Diag(TheCall->getLocStart(), diag::err_shufflevector_non_vector)
Mike Stump11289f42009-09-09 15:08:12 +0000770 << SourceRange(TheCall->getArg(0)->getLocStart(),
Douglas Gregorc25f7662009-05-19 22:10:17 +0000771 TheCall->getArg(1)->getLocEnd());
772 return ExprError();
773 }
Nate Begemana0110022010-06-08 00:16:34 +0000774
775 numElements = LHSType->getAs<VectorType>()->getNumElements();
776 unsigned numResElements = TheCall->getNumArgs() - 2;
Mike Stump11289f42009-09-09 15:08:12 +0000777
Nate Begemana0110022010-06-08 00:16:34 +0000778 // Check to see if we have a call with 2 vector arguments, the unary shuffle
779 // with mask. If so, verify that RHS is an integer vector type with the
780 // same number of elts as lhs.
781 if (TheCall->getNumArgs() == 2) {
Douglas Gregor5cc2c8b2010-07-23 15:58:24 +0000782 if (!RHSType->hasIntegerRepresentation() ||
Nate Begemana0110022010-06-08 00:16:34 +0000783 RHSType->getAs<VectorType>()->getNumElements() != numElements)
784 Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
785 << SourceRange(TheCall->getArg(1)->getLocStart(),
786 TheCall->getArg(1)->getLocEnd());
787 numResElements = numElements;
788 }
789 else if (!Context.hasSameUnqualifiedType(LHSType, RHSType)) {
Douglas Gregorc25f7662009-05-19 22:10:17 +0000790 Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
Mike Stump11289f42009-09-09 15:08:12 +0000791 << SourceRange(TheCall->getArg(0)->getLocStart(),
Douglas Gregorc25f7662009-05-19 22:10:17 +0000792 TheCall->getArg(1)->getLocEnd());
793 return ExprError();
Nate Begemana0110022010-06-08 00:16:34 +0000794 } else if (numElements != numResElements) {
795 QualType eltType = LHSType->getAs<VectorType>()->getElementType();
Chris Lattner37141f42010-06-23 06:00:24 +0000796 resType = Context.getVectorType(eltType, numResElements,
797 VectorType::NotAltiVec);
Douglas Gregorc25f7662009-05-19 22:10:17 +0000798 }
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000799 }
800
801 for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
Douglas Gregorc25f7662009-05-19 22:10:17 +0000802 if (TheCall->getArg(i)->isTypeDependent() ||
803 TheCall->getArg(i)->isValueDependent())
804 continue;
805
Nate Begemana0110022010-06-08 00:16:34 +0000806 llvm::APSInt Result(32);
807 if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context))
808 return ExprError(Diag(TheCall->getLocStart(),
809 diag::err_shufflevector_nonconstant_argument)
810 << TheCall->getArg(i)->getSourceRange());
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000811
Chris Lattner7ab824e2008-08-10 02:05:13 +0000812 if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000813 return ExprError(Diag(TheCall->getLocStart(),
Chris Lattner3b054132008-11-19 05:08:23 +0000814 diag::err_shufflevector_argument_too_large)
Sebastian Redlc215cfc2009-01-19 00:08:26 +0000815 << TheCall->getArg(i)->getSourceRange());
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000816 }
817
818 llvm::SmallVector<Expr*, 32> exprs;
819
Chris Lattner7ab824e2008-08-10 02:05:13 +0000820 for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000821 exprs.push_back(TheCall->getArg(i));
822 TheCall->setArg(i, 0);
823 }
824
Nate Begemanf485fb52009-08-12 02:10:25 +0000825 return Owned(new (Context) ShuffleVectorExpr(Context, exprs.begin(),
Nate Begemana0110022010-06-08 00:16:34 +0000826 exprs.size(), resType,
Ted Kremenek5a201952009-02-07 01:47:29 +0000827 TheCall->getCallee()->getLocStart(),
828 TheCall->getRParenLoc()));
Eli Friedmana1b4ed82008-05-14 19:38:39 +0000829}
Chris Lattner43be2e62007-12-19 23:59:04 +0000830
Daniel Dunbarb7257262008-07-21 22:59:13 +0000831/// SemaBuiltinPrefetch - Handle __builtin_prefetch.
832// This is declared to take (const void*, ...) and can take two
833// optional constant int args.
834bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
Chris Lattner3b054132008-11-19 05:08:23 +0000835 unsigned NumArgs = TheCall->getNumArgs();
Daniel Dunbarb7257262008-07-21 22:59:13 +0000836
Chris Lattner3b054132008-11-19 05:08:23 +0000837 if (NumArgs > 3)
Eric Christopher2a5aaff2010-04-16 04:56:46 +0000838 return Diag(TheCall->getLocEnd(),
839 diag::err_typecheck_call_too_many_args_at_most)
840 << 0 /*function call*/ << 3 << NumArgs
841 << TheCall->getSourceRange();
Daniel Dunbarb7257262008-07-21 22:59:13 +0000842
843 // Argument 0 is checked for us and the remaining arguments must be
844 // constant integers.
Chris Lattner3b054132008-11-19 05:08:23 +0000845 for (unsigned i = 1; i != NumArgs; ++i) {
Daniel Dunbarb7257262008-07-21 22:59:13 +0000846 Expr *Arg = TheCall->getArg(i);
Eric Christopher8d0c6212010-04-17 02:26:23 +0000847
Eli Friedman5efba262009-12-04 00:30:06 +0000848 llvm::APSInt Result;
Eric Christopher8d0c6212010-04-17 02:26:23 +0000849 if (SemaBuiltinConstantArg(TheCall, i, Result))
850 return true;
Mike Stump11289f42009-09-09 15:08:12 +0000851
Daniel Dunbarb7257262008-07-21 22:59:13 +0000852 // FIXME: gcc issues a warning and rewrites these to 0. These
853 // seems especially odd for the third argument since the default
854 // is 3.
Chris Lattner3b054132008-11-19 05:08:23 +0000855 if (i == 1) {
Eli Friedman5efba262009-12-04 00:30:06 +0000856 if (Result.getLimitedValue() > 1)
Chris Lattner3b054132008-11-19 05:08:23 +0000857 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Chris Lattnerd545ad12009-09-23 06:06:36 +0000858 << "0" << "1" << Arg->getSourceRange();
Daniel Dunbarb7257262008-07-21 22:59:13 +0000859 } else {
Eli Friedman5efba262009-12-04 00:30:06 +0000860 if (Result.getLimitedValue() > 3)
Chris Lattner3b054132008-11-19 05:08:23 +0000861 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
Chris Lattnerd545ad12009-09-23 06:06:36 +0000862 << "0" << "3" << Arg->getSourceRange();
Daniel Dunbarb7257262008-07-21 22:59:13 +0000863 }
864 }
865
Chris Lattner3b054132008-11-19 05:08:23 +0000866 return false;
Daniel Dunbarb7257262008-07-21 22:59:13 +0000867}
868
Eric Christopher8d0c6212010-04-17 02:26:23 +0000869/// SemaBuiltinConstantArg - Handle a check if argument ArgNum of CallExpr
870/// TheCall is a constant expression.
871bool Sema::SemaBuiltinConstantArg(CallExpr *TheCall, int ArgNum,
872 llvm::APSInt &Result) {
873 Expr *Arg = TheCall->getArg(ArgNum);
874 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
875 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
876
877 if (Arg->isTypeDependent() || Arg->isValueDependent()) return false;
878
879 if (!Arg->isIntegerConstantExpr(Result, Context))
880 return Diag(TheCall->getLocStart(), diag::err_constant_integer_arg_type)
Eric Christopher63448c32010-04-19 18:23:02 +0000881 << FDecl->getDeclName() << Arg->getSourceRange();
Eric Christopher8d0c6212010-04-17 02:26:23 +0000882
Chris Lattnerd545ad12009-09-23 06:06:36 +0000883 return false;
884}
885
Daniel Dunbarb0d34c82008-09-03 21:13:56 +0000886/// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
887/// int type). This simply type checks that type is one of the defined
888/// constants (0-3).
Eric Christopherc8791562009-12-23 03:49:37 +0000889// For compatability check 0-3, llvm only handles 0 and 2.
Daniel Dunbarb0d34c82008-09-03 21:13:56 +0000890bool Sema::SemaBuiltinObjectSize(CallExpr *TheCall) {
Eric Christopher8d0c6212010-04-17 02:26:23 +0000891 llvm::APSInt Result;
892
893 // Check constant-ness first.
894 if (SemaBuiltinConstantArg(TheCall, 1, Result))
895 return true;
896
Daniel Dunbarb0d34c82008-09-03 21:13:56 +0000897 Expr *Arg = TheCall->getArg(1);
Daniel Dunbarb0d34c82008-09-03 21:13:56 +0000898 if (Result.getSExtValue() < 0 || Result.getSExtValue() > 3) {
Chris Lattner3b054132008-11-19 05:08:23 +0000899 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
900 << "0" << "3" << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
Daniel Dunbarb0d34c82008-09-03 21:13:56 +0000901 }
902
903 return false;
904}
905
Eli Friedmanc97d0142009-05-03 06:04:26 +0000906/// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
Eli Friedmaneed8ad22009-05-03 04:46:36 +0000907/// This checks that val is a constant 1.
908bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
909 Expr *Arg = TheCall->getArg(1);
Eric Christopher8d0c6212010-04-17 02:26:23 +0000910 llvm::APSInt Result;
Douglas Gregorc25f7662009-05-19 22:10:17 +0000911
Eric Christopher8d0c6212010-04-17 02:26:23 +0000912 // TODO: This is less than ideal. Overload this to take a value.
913 if (SemaBuiltinConstantArg(TheCall, 1, Result))
914 return true;
915
916 if (Result != 1)
Eli Friedmaneed8ad22009-05-03 04:46:36 +0000917 return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
918 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
919
920 return false;
921}
922
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000923// Handle i > 1 ? "x" : "y", recursivelly
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000924bool Sema::SemaCheckStringLiteral(const Expr *E, const CallExpr *TheCall,
925 bool HasVAListArg,
Ted Kremenek02087932010-07-16 02:11:22 +0000926 unsigned format_idx, unsigned firstDataArg,
927 bool isPrintf) {
928
Douglas Gregorc25f7662009-05-19 22:10:17 +0000929 if (E->isTypeDependent() || E->isValueDependent())
930 return false;
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000931
932 switch (E->getStmtClass()) {
933 case Stmt::ConditionalOperatorClass: {
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000934 const ConditionalOperator *C = cast<ConditionalOperator>(E);
Ted Kremenek02087932010-07-16 02:11:22 +0000935 return SemaCheckStringLiteral(C->getTrueExpr(), TheCall, HasVAListArg,
936 format_idx, firstDataArg, isPrintf)
937 && SemaCheckStringLiteral(C->getRHS(), TheCall, HasVAListArg,
938 format_idx, firstDataArg, isPrintf);
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000939 }
940
941 case Stmt::ImplicitCastExprClass: {
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000942 const ImplicitCastExpr *Expr = cast<ImplicitCastExpr>(E);
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000943 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
Ted Kremenek02087932010-07-16 02:11:22 +0000944 format_idx, firstDataArg, isPrintf);
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000945 }
946
947 case Stmt::ParenExprClass: {
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000948 const ParenExpr *Expr = cast<ParenExpr>(E);
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000949 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
Ted Kremenek02087932010-07-16 02:11:22 +0000950 format_idx, firstDataArg, isPrintf);
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000951 }
Mike Stump11289f42009-09-09 15:08:12 +0000952
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000953 case Stmt::DeclRefExprClass: {
954 const DeclRefExpr *DR = cast<DeclRefExpr>(E);
Mike Stump11289f42009-09-09 15:08:12 +0000955
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000956 // As an exception, do not flag errors for variables binding to
957 // const string literals.
958 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
959 bool isConstant = false;
960 QualType T = DR->getType();
Ted Kremenek6dfeb552009-01-12 23:09:09 +0000961
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000962 if (const ArrayType *AT = Context.getAsArrayType(T)) {
963 isConstant = AT->getElementType().isConstant(Context);
Mike Stump12b8ce12009-08-04 21:02:39 +0000964 } else if (const PointerType *PT = T->getAs<PointerType>()) {
Mike Stump11289f42009-09-09 15:08:12 +0000965 isConstant = T.isConstant(Context) &&
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000966 PT->getPointeeType().isConstant(Context);
967 }
Mike Stump11289f42009-09-09 15:08:12 +0000968
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000969 if (isConstant) {
Sebastian Redl5ca79842010-02-01 20:16:42 +0000970 if (const Expr *Init = VD->getAnyInitializer())
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000971 return SemaCheckStringLiteral(Init, TheCall,
Ted Kremenek02087932010-07-16 02:11:22 +0000972 HasVAListArg, format_idx, firstDataArg,
973 isPrintf);
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000974 }
Mike Stump11289f42009-09-09 15:08:12 +0000975
Anders Carlssonb012ca92009-06-28 19:55:58 +0000976 // For vprintf* functions (i.e., HasVAListArg==true), we add a
977 // special check to see if the format string is a function parameter
978 // of the function calling the printf function. If the function
979 // has an attribute indicating it is a printf-like function, then we
980 // should suppress warnings concerning non-literals being used in a call
981 // to a vprintf function. For example:
982 //
983 // void
984 // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
985 // va_list ap;
986 // va_start(ap, fmt);
987 // vprintf(fmt, ap); // Do NOT emit a warning about "fmt".
988 // ...
989 //
990 //
991 // FIXME: We don't have full attribute support yet, so just check to see
992 // if the argument is a DeclRefExpr that references a parameter. We'll
993 // add proper support for checking the attribute later.
994 if (HasVAListArg)
995 if (isa<ParmVarDecl>(VD))
996 return true;
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000997 }
Mike Stump11289f42009-09-09 15:08:12 +0000998
Ted Kremenekdfd72c22009-03-20 21:35:28 +0000999 return false;
1000 }
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001001
Anders Carlssonf0a7f3b2009-06-27 04:05:33 +00001002 case Stmt::CallExprClass: {
1003 const CallExpr *CE = cast<CallExpr>(E);
Mike Stump11289f42009-09-09 15:08:12 +00001004 if (const ImplicitCastExpr *ICE
Anders Carlssonf0a7f3b2009-06-27 04:05:33 +00001005 = dyn_cast<ImplicitCastExpr>(CE->getCallee())) {
1006 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ICE->getSubExpr())) {
1007 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(DRE->getDecl())) {
Argyrios Kyrtzidisb4b64ca2009-06-30 02:34:44 +00001008 if (const FormatArgAttr *FA = FD->getAttr<FormatArgAttr>()) {
Anders Carlssonf0a7f3b2009-06-27 04:05:33 +00001009 unsigned ArgIndex = FA->getFormatIdx();
1010 const Expr *Arg = CE->getArg(ArgIndex - 1);
Mike Stump11289f42009-09-09 15:08:12 +00001011
1012 return SemaCheckStringLiteral(Arg, TheCall, HasVAListArg,
Ted Kremenek02087932010-07-16 02:11:22 +00001013 format_idx, firstDataArg, isPrintf);
Anders Carlssonf0a7f3b2009-06-27 04:05:33 +00001014 }
1015 }
1016 }
1017 }
Mike Stump11289f42009-09-09 15:08:12 +00001018
Anders Carlssonf0a7f3b2009-06-27 04:05:33 +00001019 return false;
1020 }
Ted Kremenekdfd72c22009-03-20 21:35:28 +00001021 case Stmt::ObjCStringLiteralClass:
1022 case Stmt::StringLiteralClass: {
1023 const StringLiteral *StrE = NULL;
Mike Stump11289f42009-09-09 15:08:12 +00001024
Ted Kremenekdfd72c22009-03-20 21:35:28 +00001025 if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001026 StrE = ObjCFExpr->getString();
1027 else
Ted Kremenekdfd72c22009-03-20 21:35:28 +00001028 StrE = cast<StringLiteral>(E);
Mike Stump11289f42009-09-09 15:08:12 +00001029
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001030 if (StrE) {
Ted Kremenek02087932010-07-16 02:11:22 +00001031 CheckFormatString(StrE, E, TheCall, HasVAListArg, format_idx,
1032 firstDataArg, isPrintf);
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001033 return true;
1034 }
Mike Stump11289f42009-09-09 15:08:12 +00001035
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001036 return false;
1037 }
Mike Stump11289f42009-09-09 15:08:12 +00001038
Ted Kremenekdfd72c22009-03-20 21:35:28 +00001039 default:
1040 return false;
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001041 }
1042}
1043
Fariborz Jahaniancd1a88d2009-05-21 18:48:51 +00001044void
Mike Stump11289f42009-09-09 15:08:12 +00001045Sema::CheckNonNullArguments(const NonNullAttr *NonNull,
1046 const CallExpr *TheCall) {
Alexis Huntdcfba7b2010-08-18 23:23:40 +00001047 for (NonNullAttr::args_iterator i = NonNull->args_begin(),
1048 e = NonNull->args_end();
Fariborz Jahaniancd1a88d2009-05-21 18:48:51 +00001049 i != e; ++i) {
Chris Lattner23464b82009-05-25 18:23:36 +00001050 const Expr *ArgExpr = TheCall->getArg(*i);
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001051 if (ArgExpr->isNullPointerConstant(Context,
Douglas Gregor56751b52009-09-25 04:25:58 +00001052 Expr::NPC_ValueDependentIsNotNull))
Chris Lattner23464b82009-05-25 18:23:36 +00001053 Diag(TheCall->getCallee()->getLocStart(), diag::warn_null_arg)
1054 << ArgExpr->getSourceRange();
Fariborz Jahaniancd1a88d2009-05-21 18:48:51 +00001055 }
1056}
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001057
Ted Kremenek02087932010-07-16 02:11:22 +00001058/// CheckPrintfScanfArguments - Check calls to printf and scanf (and similar
1059/// functions) for correct use of format strings.
Chris Lattnerb87b1b32007-08-10 20:18:51 +00001060void
Ted Kremenek02087932010-07-16 02:11:22 +00001061Sema::CheckPrintfScanfArguments(const CallExpr *TheCall, bool HasVAListArg,
1062 unsigned format_idx, unsigned firstDataArg,
1063 bool isPrintf) {
1064
Ted Kremenekdfd72c22009-03-20 21:35:28 +00001065 const Expr *Fn = TheCall->getCallee();
Chris Lattner08464942007-12-28 05:29:59 +00001066
Sebastian Redl6eedcc12009-11-17 18:02:24 +00001067 // The way the format attribute works in GCC, the implicit this argument
1068 // of member functions is counted. However, it doesn't appear in our own
1069 // lists, so decrement format_idx in that case.
1070 if (isa<CXXMemberCallExpr>(TheCall)) {
1071 // Catch a format attribute mistakenly referring to the object argument.
1072 if (format_idx == 0)
1073 return;
1074 --format_idx;
1075 if(firstDataArg != 0)
1076 --firstDataArg;
1077 }
1078
Ted Kremenek02087932010-07-16 02:11:22 +00001079 // CHECK: printf/scanf-like function is called with no format string.
Chris Lattner08464942007-12-28 05:29:59 +00001080 if (format_idx >= TheCall->getNumArgs()) {
Ted Kremenek02087932010-07-16 02:11:22 +00001081 Diag(TheCall->getRParenLoc(), diag::warn_missing_format_string)
Chris Lattnerf490e152008-11-19 05:27:50 +00001082 << Fn->getSourceRange();
Ted Kremeneke68f1aa2007-08-14 17:39:48 +00001083 return;
1084 }
Mike Stump11289f42009-09-09 15:08:12 +00001085
Ted Kremenekdfd72c22009-03-20 21:35:28 +00001086 const Expr *OrigFormatExpr = TheCall->getArg(format_idx)->IgnoreParenCasts();
Mike Stump11289f42009-09-09 15:08:12 +00001087
Chris Lattnerb87b1b32007-08-10 20:18:51 +00001088 // CHECK: format string is not a string literal.
Mike Stump11289f42009-09-09 15:08:12 +00001089 //
Ted Kremeneke68f1aa2007-08-14 17:39:48 +00001090 // Dynamically generated format strings are difficult to
1091 // automatically vet at compile time. Requiring that format strings
1092 // are string literals: (1) permits the checking of format strings by
1093 // the compiler and thereby (2) can practically remove the source of
1094 // many format string exploits.
Ted Kremenek34f664d2008-06-16 18:00:42 +00001095
Mike Stump11289f42009-09-09 15:08:12 +00001096 // Format string can be either ObjC string (e.g. @"%d") or
Ted Kremenek34f664d2008-06-16 18:00:42 +00001097 // C string (e.g. "%d")
Mike Stump11289f42009-09-09 15:08:12 +00001098 // ObjC string uses the same format specifiers as C string, so we can use
Ted Kremenek34f664d2008-06-16 18:00:42 +00001099 // the same format string checking logic for both ObjC and C strings.
Chris Lattnere009a882009-04-29 04:49:34 +00001100 if (SemaCheckStringLiteral(OrigFormatExpr, TheCall, HasVAListArg, format_idx,
Ted Kremenek02087932010-07-16 02:11:22 +00001101 firstDataArg, isPrintf))
Chris Lattnere009a882009-04-29 04:49:34 +00001102 return; // Literal format string found, check done!
Ted Kremenek34f664d2008-06-16 18:00:42 +00001103
Chris Lattnercc5d1c22009-04-29 04:59:47 +00001104 // If there are no arguments specified, warn with -Wformat-security, otherwise
1105 // warn only with -Wformat-nonliteral.
1106 if (TheCall->getNumArgs() == format_idx+1)
Mike Stump11289f42009-09-09 15:08:12 +00001107 Diag(TheCall->getArg(format_idx)->getLocStart(),
Ted Kremenek02087932010-07-16 02:11:22 +00001108 diag::warn_format_nonliteral_noargs)
Chris Lattnercc5d1c22009-04-29 04:59:47 +00001109 << OrigFormatExpr->getSourceRange();
1110 else
Mike Stump11289f42009-09-09 15:08:12 +00001111 Diag(TheCall->getArg(format_idx)->getLocStart(),
Ted Kremenek02087932010-07-16 02:11:22 +00001112 diag::warn_format_nonliteral)
Chris Lattnercc5d1c22009-04-29 04:59:47 +00001113 << OrigFormatExpr->getSourceRange();
Ted Kremenek6dfeb552009-01-12 23:09:09 +00001114}
Ted Kremeneke68f1aa2007-08-14 17:39:48 +00001115
Ted Kremenekab278de2010-01-28 23:39:18 +00001116namespace {
Ted Kremenek02087932010-07-16 02:11:22 +00001117class CheckFormatHandler : public analyze_format_string::FormatStringHandler {
1118protected:
Ted Kremenekab278de2010-01-28 23:39:18 +00001119 Sema &S;
1120 const StringLiteral *FExpr;
1121 const Expr *OrigFormatExpr;
Ted Kremenek4d745dd2010-03-25 03:59:12 +00001122 const unsigned FirstDataArg;
Ted Kremenekab278de2010-01-28 23:39:18 +00001123 const unsigned NumDataArgs;
1124 const bool IsObjCLiteral;
1125 const char *Beg; // Start of format string.
Ted Kremenek5739de72010-01-29 01:06:55 +00001126 const bool HasVAListArg;
1127 const CallExpr *TheCall;
1128 unsigned FormatIdx;
Ted Kremenek4a49d982010-02-26 19:18:41 +00001129 llvm::BitVector CoveredArgs;
Ted Kremenekd1668192010-02-27 01:41:03 +00001130 bool usesPositionalArgs;
1131 bool atFirstArg;
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001132public:
Ted Kremenek02087932010-07-16 02:11:22 +00001133 CheckFormatHandler(Sema &s, const StringLiteral *fexpr,
Ted Kremenek4d745dd2010-03-25 03:59:12 +00001134 const Expr *origFormatExpr, unsigned firstDataArg,
Ted Kremenekab278de2010-01-28 23:39:18 +00001135 unsigned numDataArgs, bool isObjCLiteral,
Ted Kremenek5739de72010-01-29 01:06:55 +00001136 const char *beg, bool hasVAListArg,
1137 const CallExpr *theCall, unsigned formatIdx)
Ted Kremenekab278de2010-01-28 23:39:18 +00001138 : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
Ted Kremenek4d745dd2010-03-25 03:59:12 +00001139 FirstDataArg(firstDataArg),
Ted Kremenek4a49d982010-02-26 19:18:41 +00001140 NumDataArgs(numDataArgs),
Ted Kremenek5739de72010-01-29 01:06:55 +00001141 IsObjCLiteral(isObjCLiteral), Beg(beg),
1142 HasVAListArg(hasVAListArg),
Ted Kremenekd1668192010-02-27 01:41:03 +00001143 TheCall(theCall), FormatIdx(formatIdx),
1144 usesPositionalArgs(false), atFirstArg(true) {
Ted Kremenek4a49d982010-02-26 19:18:41 +00001145 CoveredArgs.resize(numDataArgs);
1146 CoveredArgs.reset();
1147 }
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001148
Ted Kremenek019d2242010-01-29 01:50:07 +00001149 void DoneProcessing();
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001150
Ted Kremenek02087932010-07-16 02:11:22 +00001151 void HandleIncompleteSpecifier(const char *startSpecifier,
1152 unsigned specifierLen);
1153
Ted Kremenekd1668192010-02-27 01:41:03 +00001154 virtual void HandleInvalidPosition(const char *startSpecifier,
1155 unsigned specifierLen,
Ted Kremenek02087932010-07-16 02:11:22 +00001156 analyze_format_string::PositionContext p);
Ted Kremenekd1668192010-02-27 01:41:03 +00001157
1158 virtual void HandleZeroPosition(const char *startPos, unsigned posLen);
1159
Ted Kremenekab278de2010-01-28 23:39:18 +00001160 void HandleNullChar(const char *nullCharacter);
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001161
Ted Kremenek02087932010-07-16 02:11:22 +00001162protected:
Ted Kremenekce815422010-07-19 21:25:57 +00001163 bool HandleInvalidConversionSpecifier(unsigned argIndex, SourceLocation Loc,
1164 const char *startSpec,
1165 unsigned specifierLen,
1166 const char *csStart, unsigned csLen);
1167
Ted Kremenek8d9842d2010-01-29 20:55:36 +00001168 SourceRange getFormatStringRange();
Ted Kremenek02087932010-07-16 02:11:22 +00001169 CharSourceRange getSpecifierRange(const char *startSpecifier,
1170 unsigned specifierLen);
Ted Kremenekab278de2010-01-28 23:39:18 +00001171 SourceLocation getLocationOfByte(const char *x);
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001172
Ted Kremenek5739de72010-01-29 01:06:55 +00001173 const Expr *getDataArg(unsigned i) const;
Ted Kremenek6adb7e32010-07-26 19:45:42 +00001174
1175 bool CheckNumArgs(const analyze_format_string::FormatSpecifier &FS,
1176 const analyze_format_string::ConversionSpecifier &CS,
1177 const char *startSpecifier, unsigned specifierLen,
1178 unsigned argIndex);
Ted Kremenekab278de2010-01-28 23:39:18 +00001179};
1180}
1181
Ted Kremenek02087932010-07-16 02:11:22 +00001182SourceRange CheckFormatHandler::getFormatStringRange() {
Ted Kremenekab278de2010-01-28 23:39:18 +00001183 return OrigFormatExpr->getSourceRange();
1184}
1185
Ted Kremenek02087932010-07-16 02:11:22 +00001186CharSourceRange CheckFormatHandler::
1187getSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
Tom Care3f272b82010-06-21 21:21:01 +00001188 SourceLocation Start = getLocationOfByte(startSpecifier);
1189 SourceLocation End = getLocationOfByte(startSpecifier + specifierLen - 1);
1190
1191 // Advance the end SourceLocation by one due to half-open ranges.
1192 End = End.getFileLocWithOffset(1);
1193
1194 return CharSourceRange::getCharRange(Start, End);
Ted Kremenek8d9842d2010-01-29 20:55:36 +00001195}
1196
Ted Kremenek02087932010-07-16 02:11:22 +00001197SourceLocation CheckFormatHandler::getLocationOfByte(const char *x) {
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001198 return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
Ted Kremenekab278de2010-01-28 23:39:18 +00001199}
1200
Ted Kremenek02087932010-07-16 02:11:22 +00001201void CheckFormatHandler::HandleIncompleteSpecifier(const char *startSpecifier,
1202 unsigned specifierLen){
Ted Kremenekc22f78d2010-01-29 03:16:21 +00001203 SourceLocation Loc = getLocationOfByte(startSpecifier);
1204 S.Diag(Loc, diag::warn_printf_incomplete_specifier)
Ted Kremenek02087932010-07-16 02:11:22 +00001205 << getSpecifierRange(startSpecifier, specifierLen);
Ted Kremenekc22f78d2010-01-29 03:16:21 +00001206}
1207
Ted Kremenekd1668192010-02-27 01:41:03 +00001208void
Ted Kremenek02087932010-07-16 02:11:22 +00001209CheckFormatHandler::HandleInvalidPosition(const char *startPos, unsigned posLen,
1210 analyze_format_string::PositionContext p) {
Ted Kremenekd1668192010-02-27 01:41:03 +00001211 SourceLocation Loc = getLocationOfByte(startPos);
Ted Kremenek02087932010-07-16 02:11:22 +00001212 S.Diag(Loc, diag::warn_format_invalid_positional_specifier)
1213 << (unsigned) p << getSpecifierRange(startPos, posLen);
Ted Kremenekd1668192010-02-27 01:41:03 +00001214}
1215
Ted Kremenek02087932010-07-16 02:11:22 +00001216void CheckFormatHandler::HandleZeroPosition(const char *startPos,
Ted Kremenekd1668192010-02-27 01:41:03 +00001217 unsigned posLen) {
1218 SourceLocation Loc = getLocationOfByte(startPos);
Ted Kremenek02087932010-07-16 02:11:22 +00001219 S.Diag(Loc, diag::warn_format_zero_positional_specifier)
1220 << getSpecifierRange(startPos, posLen);
Ted Kremenekd1668192010-02-27 01:41:03 +00001221}
1222
Ted Kremenek02087932010-07-16 02:11:22 +00001223void CheckFormatHandler::HandleNullChar(const char *nullCharacter) {
1224 // The presence of a null character is likely an error.
1225 S.Diag(getLocationOfByte(nullCharacter),
1226 diag::warn_printf_format_string_contains_null_char)
1227 << getFormatStringRange();
1228}
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001229
Ted Kremenek02087932010-07-16 02:11:22 +00001230const Expr *CheckFormatHandler::getDataArg(unsigned i) const {
1231 return TheCall->getArg(FirstDataArg + i);
1232}
1233
1234void CheckFormatHandler::DoneProcessing() {
1235 // Does the number of data arguments exceed the number of
1236 // format conversions in the format string?
1237 if (!HasVAListArg) {
1238 // Find any arguments that weren't covered.
1239 CoveredArgs.flip();
1240 signed notCoveredArg = CoveredArgs.find_first();
1241 if (notCoveredArg >= 0) {
1242 assert((unsigned)notCoveredArg < NumDataArgs);
1243 S.Diag(getDataArg((unsigned) notCoveredArg)->getLocStart(),
1244 diag::warn_printf_data_arg_not_used)
1245 << getFormatStringRange();
1246 }
1247 }
1248}
1249
Ted Kremenekce815422010-07-19 21:25:57 +00001250bool
1251CheckFormatHandler::HandleInvalidConversionSpecifier(unsigned argIndex,
1252 SourceLocation Loc,
1253 const char *startSpec,
1254 unsigned specifierLen,
1255 const char *csStart,
1256 unsigned csLen) {
1257
1258 bool keepGoing = true;
1259 if (argIndex < NumDataArgs) {
1260 // Consider the argument coverered, even though the specifier doesn't
1261 // make sense.
1262 CoveredArgs.set(argIndex);
1263 }
1264 else {
1265 // If argIndex exceeds the number of data arguments we
1266 // don't issue a warning because that is just a cascade of warnings (and
1267 // they may have intended '%%' anyway). We don't want to continue processing
1268 // the format string after this point, however, as we will like just get
1269 // gibberish when trying to match arguments.
1270 keepGoing = false;
1271 }
1272
1273 S.Diag(Loc, diag::warn_format_invalid_conversion)
1274 << llvm::StringRef(csStart, csLen)
1275 << getSpecifierRange(startSpec, specifierLen);
1276
1277 return keepGoing;
1278}
1279
Ted Kremenek6adb7e32010-07-26 19:45:42 +00001280bool
1281CheckFormatHandler::CheckNumArgs(
1282 const analyze_format_string::FormatSpecifier &FS,
1283 const analyze_format_string::ConversionSpecifier &CS,
1284 const char *startSpecifier, unsigned specifierLen, unsigned argIndex) {
1285
1286 if (argIndex >= NumDataArgs) {
1287 if (FS.usesPositionalArg()) {
1288 S.Diag(getLocationOfByte(CS.getStart()),
1289 diag::warn_printf_positional_arg_exceeds_data_args)
1290 << (argIndex+1) << NumDataArgs
1291 << getSpecifierRange(startSpecifier, specifierLen);
1292 }
1293 else {
1294 S.Diag(getLocationOfByte(CS.getStart()),
1295 diag::warn_printf_insufficient_data_args)
1296 << getSpecifierRange(startSpecifier, specifierLen);
1297 }
1298
1299 return false;
1300 }
1301 return true;
1302}
1303
Ted Kremenek02087932010-07-16 02:11:22 +00001304//===--- CHECK: Printf format string checking ------------------------------===//
1305
1306namespace {
1307class CheckPrintfHandler : public CheckFormatHandler {
1308public:
1309 CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
1310 const Expr *origFormatExpr, unsigned firstDataArg,
1311 unsigned numDataArgs, bool isObjCLiteral,
1312 const char *beg, bool hasVAListArg,
1313 const CallExpr *theCall, unsigned formatIdx)
1314 : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg,
1315 numDataArgs, isObjCLiteral, beg, hasVAListArg,
1316 theCall, formatIdx) {}
1317
1318
1319 bool HandleInvalidPrintfConversionSpecifier(
1320 const analyze_printf::PrintfSpecifier &FS,
1321 const char *startSpecifier,
1322 unsigned specifierLen);
1323
1324 bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
1325 const char *startSpecifier,
1326 unsigned specifierLen);
1327
1328 bool HandleAmount(const analyze_format_string::OptionalAmount &Amt, unsigned k,
1329 const char *startSpecifier, unsigned specifierLen);
1330 void HandleInvalidAmount(const analyze_printf::PrintfSpecifier &FS,
1331 const analyze_printf::OptionalAmount &Amt,
1332 unsigned type,
1333 const char *startSpecifier, unsigned specifierLen);
1334 void HandleFlag(const analyze_printf::PrintfSpecifier &FS,
1335 const analyze_printf::OptionalFlag &flag,
1336 const char *startSpecifier, unsigned specifierLen);
1337 void HandleIgnoredFlag(const analyze_printf::PrintfSpecifier &FS,
1338 const analyze_printf::OptionalFlag &ignoredFlag,
1339 const analyze_printf::OptionalFlag &flag,
1340 const char *startSpecifier, unsigned specifierLen);
1341};
1342}
1343
1344bool CheckPrintfHandler::HandleInvalidPrintfConversionSpecifier(
1345 const analyze_printf::PrintfSpecifier &FS,
1346 const char *startSpecifier,
1347 unsigned specifierLen) {
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001348 const analyze_printf::PrintfConversionSpecifier &CS =
Ted Kremenekce815422010-07-19 21:25:57 +00001349 FS.getConversionSpecifier();
Ted Kremenek02087932010-07-16 02:11:22 +00001350
Ted Kremenekce815422010-07-19 21:25:57 +00001351 return HandleInvalidConversionSpecifier(FS.getArgIndex(),
1352 getLocationOfByte(CS.getStart()),
1353 startSpecifier, specifierLen,
1354 CS.getStart(), CS.getLength());
Ted Kremenek94af5752010-01-29 02:40:24 +00001355}
1356
Ted Kremenek02087932010-07-16 02:11:22 +00001357bool CheckPrintfHandler::HandleAmount(
1358 const analyze_format_string::OptionalAmount &Amt,
1359 unsigned k, const char *startSpecifier,
1360 unsigned specifierLen) {
Ted Kremenek5739de72010-01-29 01:06:55 +00001361
1362 if (Amt.hasDataArgument()) {
Ted Kremenek5739de72010-01-29 01:06:55 +00001363 if (!HasVAListArg) {
Ted Kremenek4a49d982010-02-26 19:18:41 +00001364 unsigned argIndex = Amt.getArgIndex();
1365 if (argIndex >= NumDataArgs) {
Ted Kremenekd1668192010-02-27 01:41:03 +00001366 S.Diag(getLocationOfByte(Amt.getStart()),
1367 diag::warn_printf_asterisk_missing_arg)
Ted Kremenek02087932010-07-16 02:11:22 +00001368 << k << getSpecifierRange(startSpecifier, specifierLen);
Ted Kremenek5739de72010-01-29 01:06:55 +00001369 // Don't do any more checking. We will just emit
1370 // spurious errors.
1371 return false;
1372 }
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001373
Ted Kremenek5739de72010-01-29 01:06:55 +00001374 // Type check the data argument. It should be an 'int'.
Ted Kremenek605b0112010-01-29 23:32:22 +00001375 // Although not in conformance with C99, we also allow the argument to be
1376 // an 'unsigned int' as that is a reasonably safe case. GCC also
1377 // doesn't emit a warning for that case.
Ted Kremenek4a49d982010-02-26 19:18:41 +00001378 CoveredArgs.set(argIndex);
1379 const Expr *Arg = getDataArg(argIndex);
Ted Kremenek5739de72010-01-29 01:06:55 +00001380 QualType T = Arg->getType();
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001381
1382 const analyze_printf::ArgTypeResult &ATR = Amt.getArgType(S.Context);
1383 assert(ATR.isValid());
1384
1385 if (!ATR.matchesType(S.Context, T)) {
Ted Kremenekd1668192010-02-27 01:41:03 +00001386 S.Diag(getLocationOfByte(Amt.getStart()),
1387 diag::warn_printf_asterisk_wrong_type)
1388 << k
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001389 << ATR.getRepresentativeType(S.Context) << T
Ted Kremenek02087932010-07-16 02:11:22 +00001390 << getSpecifierRange(startSpecifier, specifierLen)
Ted Kremenekc3bdff72010-01-30 00:49:51 +00001391 << Arg->getSourceRange();
Ted Kremenek5739de72010-01-29 01:06:55 +00001392 // Don't do any more checking. We will just emit
1393 // spurious errors.
1394 return false;
1395 }
1396 }
1397 }
1398 return true;
1399}
Ted Kremenek5739de72010-01-29 01:06:55 +00001400
Tom Careb49ec692010-06-17 19:00:27 +00001401void CheckPrintfHandler::HandleInvalidAmount(
Ted Kremenek02087932010-07-16 02:11:22 +00001402 const analyze_printf::PrintfSpecifier &FS,
Tom Careb49ec692010-06-17 19:00:27 +00001403 const analyze_printf::OptionalAmount &Amt,
1404 unsigned type,
1405 const char *startSpecifier,
1406 unsigned specifierLen) {
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001407 const analyze_printf::PrintfConversionSpecifier &CS =
1408 FS.getConversionSpecifier();
Tom Careb49ec692010-06-17 19:00:27 +00001409 switch (Amt.getHowSpecified()) {
1410 case analyze_printf::OptionalAmount::Constant:
1411 S.Diag(getLocationOfByte(Amt.getStart()),
1412 diag::warn_printf_nonsensical_optional_amount)
1413 << type
1414 << CS.toString()
Ted Kremenek02087932010-07-16 02:11:22 +00001415 << getSpecifierRange(startSpecifier, specifierLen)
1416 << FixItHint::CreateRemoval(getSpecifierRange(Amt.getStart(),
Tom Careb49ec692010-06-17 19:00:27 +00001417 Amt.getConstantLength()));
1418 break;
1419
1420 default:
1421 S.Diag(getLocationOfByte(Amt.getStart()),
1422 diag::warn_printf_nonsensical_optional_amount)
1423 << type
1424 << CS.toString()
Ted Kremenek02087932010-07-16 02:11:22 +00001425 << getSpecifierRange(startSpecifier, specifierLen);
Tom Careb49ec692010-06-17 19:00:27 +00001426 break;
1427 }
1428}
1429
Ted Kremenek02087932010-07-16 02:11:22 +00001430void CheckPrintfHandler::HandleFlag(const analyze_printf::PrintfSpecifier &FS,
Tom Careb49ec692010-06-17 19:00:27 +00001431 const analyze_printf::OptionalFlag &flag,
1432 const char *startSpecifier,
1433 unsigned specifierLen) {
1434 // Warn about pointless flag with a fixit removal.
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001435 const analyze_printf::PrintfConversionSpecifier &CS =
1436 FS.getConversionSpecifier();
Tom Careb49ec692010-06-17 19:00:27 +00001437 S.Diag(getLocationOfByte(flag.getPosition()),
1438 diag::warn_printf_nonsensical_flag)
1439 << flag.toString() << CS.toString()
Ted Kremenek02087932010-07-16 02:11:22 +00001440 << getSpecifierRange(startSpecifier, specifierLen)
1441 << FixItHint::CreateRemoval(getSpecifierRange(flag.getPosition(), 1));
Tom Careb49ec692010-06-17 19:00:27 +00001442}
1443
1444void CheckPrintfHandler::HandleIgnoredFlag(
Ted Kremenek02087932010-07-16 02:11:22 +00001445 const analyze_printf::PrintfSpecifier &FS,
Tom Careb49ec692010-06-17 19:00:27 +00001446 const analyze_printf::OptionalFlag &ignoredFlag,
1447 const analyze_printf::OptionalFlag &flag,
1448 const char *startSpecifier,
1449 unsigned specifierLen) {
1450 // Warn about ignored flag with a fixit removal.
1451 S.Diag(getLocationOfByte(ignoredFlag.getPosition()),
1452 diag::warn_printf_ignored_flag)
1453 << ignoredFlag.toString() << flag.toString()
Ted Kremenek02087932010-07-16 02:11:22 +00001454 << getSpecifierRange(startSpecifier, specifierLen)
1455 << FixItHint::CreateRemoval(getSpecifierRange(
Tom Careb49ec692010-06-17 19:00:27 +00001456 ignoredFlag.getPosition(), 1));
1457}
1458
Ted Kremenekab278de2010-01-28 23:39:18 +00001459bool
Ted Kremenek02087932010-07-16 02:11:22 +00001460CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
Ted Kremenekd31b2632010-02-11 09:27:41 +00001461 &FS,
Ted Kremenekab278de2010-01-28 23:39:18 +00001462 const char *startSpecifier,
1463 unsigned specifierLen) {
1464
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001465 using namespace analyze_format_string;
Ted Kremenekd1668192010-02-27 01:41:03 +00001466 using namespace analyze_printf;
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001467 const PrintfConversionSpecifier &CS = FS.getConversionSpecifier();
Ted Kremenekab278de2010-01-28 23:39:18 +00001468
Ted Kremenek6cd69422010-07-19 22:01:06 +00001469 if (FS.consumesDataArgument()) {
1470 if (atFirstArg) {
1471 atFirstArg = false;
1472 usesPositionalArgs = FS.usesPositionalArg();
1473 }
1474 else if (usesPositionalArgs != FS.usesPositionalArg()) {
1475 // Cannot mix-and-match positional and non-positional arguments.
1476 S.Diag(getLocationOfByte(CS.getStart()),
1477 diag::warn_format_mix_positional_nonpositional_args)
1478 << getSpecifierRange(startSpecifier, specifierLen);
1479 return false;
1480 }
Ted Kremenek5739de72010-01-29 01:06:55 +00001481 }
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001482
Ted Kremenekd1668192010-02-27 01:41:03 +00001483 // First check if the field width, precision, and conversion specifier
1484 // have matching data arguments.
1485 if (!HandleAmount(FS.getFieldWidth(), /* field width */ 0,
1486 startSpecifier, specifierLen)) {
1487 return false;
1488 }
1489
1490 if (!HandleAmount(FS.getPrecision(), /* precision */ 1,
1491 startSpecifier, specifierLen)) {
Ted Kremenek5739de72010-01-29 01:06:55 +00001492 return false;
1493 }
1494
Ted Kremenek8d9842d2010-01-29 20:55:36 +00001495 if (!CS.consumesDataArgument()) {
1496 // FIXME: Technically specifying a precision or field width here
1497 // makes no sense. Worth issuing a warning at some point.
Ted Kremenekfb45d352010-02-10 02:16:30 +00001498 return true;
Ted Kremenek8d9842d2010-01-29 20:55:36 +00001499 }
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001500
Ted Kremenek4a49d982010-02-26 19:18:41 +00001501 // Consume the argument.
1502 unsigned argIndex = FS.getArgIndex();
Ted Kremenek09597b42010-02-27 08:34:51 +00001503 if (argIndex < NumDataArgs) {
1504 // The check to see if the argIndex is valid will come later.
1505 // We set the bit here because we may exit early from this
1506 // function if we encounter some other error.
1507 CoveredArgs.set(argIndex);
1508 }
Ted Kremenek4a49d982010-02-26 19:18:41 +00001509
1510 // Check for using an Objective-C specific conversion specifier
1511 // in a non-ObjC literal.
1512 if (!IsObjCLiteral && CS.isObjCArg()) {
Ted Kremenek02087932010-07-16 02:11:22 +00001513 return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier,
1514 specifierLen);
Ted Kremenek4a49d982010-02-26 19:18:41 +00001515 }
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001516
Tom Careb49ec692010-06-17 19:00:27 +00001517 // Check for invalid use of field width
1518 if (!FS.hasValidFieldWidth()) {
Tom Care3f272b82010-06-21 21:21:01 +00001519 HandleInvalidAmount(FS, FS.getFieldWidth(), /* field width */ 0,
Tom Careb49ec692010-06-17 19:00:27 +00001520 startSpecifier, specifierLen);
1521 }
1522
1523 // Check for invalid use of precision
1524 if (!FS.hasValidPrecision()) {
1525 HandleInvalidAmount(FS, FS.getPrecision(), /* precision */ 1,
1526 startSpecifier, specifierLen);
1527 }
1528
1529 // Check each flag does not conflict with any other component.
1530 if (!FS.hasValidLeadingZeros())
1531 HandleFlag(FS, FS.hasLeadingZeros(), startSpecifier, specifierLen);
1532 if (!FS.hasValidPlusPrefix())
1533 HandleFlag(FS, FS.hasPlusPrefix(), startSpecifier, specifierLen);
Tom Care3f272b82010-06-21 21:21:01 +00001534 if (!FS.hasValidSpacePrefix())
1535 HandleFlag(FS, FS.hasSpacePrefix(), startSpecifier, specifierLen);
Tom Careb49ec692010-06-17 19:00:27 +00001536 if (!FS.hasValidAlternativeForm())
1537 HandleFlag(FS, FS.hasAlternativeForm(), startSpecifier, specifierLen);
1538 if (!FS.hasValidLeftJustified())
1539 HandleFlag(FS, FS.isLeftJustified(), startSpecifier, specifierLen);
1540
1541 // Check that flags are not ignored by another flag
Tom Care3f272b82010-06-21 21:21:01 +00001542 if (FS.hasSpacePrefix() && FS.hasPlusPrefix()) // ' ' ignored by '+'
1543 HandleIgnoredFlag(FS, FS.hasSpacePrefix(), FS.hasPlusPrefix(),
1544 startSpecifier, specifierLen);
Tom Careb49ec692010-06-17 19:00:27 +00001545 if (FS.hasLeadingZeros() && FS.isLeftJustified()) // '0' ignored by '-'
1546 HandleIgnoredFlag(FS, FS.hasLeadingZeros(), FS.isLeftJustified(),
1547 startSpecifier, specifierLen);
1548
1549 // Check the length modifier is valid with the given conversion specifier.
1550 const LengthModifier &LM = FS.getLengthModifier();
1551 if (!FS.hasValidLengthModifier())
1552 S.Diag(getLocationOfByte(LM.getStart()),
Ted Kremenekb65a9d52010-07-20 20:03:43 +00001553 diag::warn_format_nonsensical_length)
Tom Careb49ec692010-06-17 19:00:27 +00001554 << LM.toString() << CS.toString()
Ted Kremenek02087932010-07-16 02:11:22 +00001555 << getSpecifierRange(startSpecifier, specifierLen)
1556 << FixItHint::CreateRemoval(getSpecifierRange(LM.getStart(),
Tom Careb49ec692010-06-17 19:00:27 +00001557 LM.getLength()));
1558
1559 // Are we using '%n'?
Ted Kremenek516ef222010-07-20 20:04:10 +00001560 if (CS.getKind() == ConversionSpecifier::nArg) {
Tom Careb49ec692010-06-17 19:00:27 +00001561 // Issue a warning about this being a possible security issue.
Ted Kremenekd5fd0fa2010-01-29 01:35:25 +00001562 S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_write_back)
Ted Kremenek02087932010-07-16 02:11:22 +00001563 << getSpecifierRange(startSpecifier, specifierLen);
Ted Kremenekd5fd0fa2010-01-29 01:35:25 +00001564 // Continue checking the other format specifiers.
1565 return true;
1566 }
Ted Kremenekd31b2632010-02-11 09:27:41 +00001567
Ted Kremenek9fcd8302010-01-29 01:43:31 +00001568 // The remaining checks depend on the data arguments.
1569 if (HasVAListArg)
1570 return true;
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001571
Ted Kremenek6adb7e32010-07-26 19:45:42 +00001572 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
Ted Kremenek9fcd8302010-01-29 01:43:31 +00001573 return false;
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001574
Michael J. Spencer2c35bc12010-07-27 04:46:02 +00001575 // Now type check the data expression that matches the
1576 // format specifier.
1577 const Expr *Ex = getDataArg(argIndex);
1578 const analyze_printf::ArgTypeResult &ATR = FS.getArgType(S.Context);
1579 if (ATR.isValid() && !ATR.matchesType(S.Context, Ex->getType())) {
1580 // Check if we didn't match because of an implicit cast from a 'char'
1581 // or 'short' to an 'int'. This is done because printf is a varargs
1582 // function.
1583 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Ex))
1584 if (ICE->getType() == S.Context.IntTy)
1585 if (ATR.matchesType(S.Context, ICE->getSubExpr()->getType()))
1586 return true;
1587
1588 // We may be able to offer a FixItHint if it is a supported type.
1589 PrintfSpecifier fixedFS = FS;
1590 bool success = fixedFS.fixType(Ex->getType());
1591
1592 if (success) {
1593 // Get the fix string from the fixed format specifier
1594 llvm::SmallString<128> buf;
1595 llvm::raw_svector_ostream os(buf);
1596 fixedFS.toString(os);
1597
Ted Kremenek5f0c0662010-08-24 22:24:51 +00001598 // FIXME: getRepresentativeType() perhaps should return a string
1599 // instead of a QualType to better handle when the representative
1600 // type is 'wint_t' (which is defined in the system headers).
Michael J. Spencer2c35bc12010-07-27 04:46:02 +00001601 S.Diag(getLocationOfByte(CS.getStart()),
1602 diag::warn_printf_conversion_argument_type_mismatch)
1603 << ATR.getRepresentativeType(S.Context) << Ex->getType()
1604 << getSpecifierRange(startSpecifier, specifierLen)
1605 << Ex->getSourceRange()
1606 << FixItHint::CreateReplacement(
1607 getSpecifierRange(startSpecifier, specifierLen),
1608 os.str());
1609 }
1610 else {
1611 S.Diag(getLocationOfByte(CS.getStart()),
1612 diag::warn_printf_conversion_argument_type_mismatch)
1613 << ATR.getRepresentativeType(S.Context) << Ex->getType()
1614 << getSpecifierRange(startSpecifier, specifierLen)
1615 << Ex->getSourceRange();
1616 }
1617 }
1618
Ted Kremenekab278de2010-01-28 23:39:18 +00001619 return true;
1620}
1621
Ted Kremenek02087932010-07-16 02:11:22 +00001622//===--- CHECK: Scanf format string checking ------------------------------===//
1623
1624namespace {
1625class CheckScanfHandler : public CheckFormatHandler {
1626public:
1627 CheckScanfHandler(Sema &s, const StringLiteral *fexpr,
1628 const Expr *origFormatExpr, unsigned firstDataArg,
1629 unsigned numDataArgs, bool isObjCLiteral,
1630 const char *beg, bool hasVAListArg,
1631 const CallExpr *theCall, unsigned formatIdx)
1632 : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg,
1633 numDataArgs, isObjCLiteral, beg, hasVAListArg,
1634 theCall, formatIdx) {}
1635
1636 bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,
1637 const char *startSpecifier,
1638 unsigned specifierLen);
Ted Kremenekce815422010-07-19 21:25:57 +00001639
1640 bool HandleInvalidScanfConversionSpecifier(
1641 const analyze_scanf::ScanfSpecifier &FS,
1642 const char *startSpecifier,
1643 unsigned specifierLen);
Ted Kremenekd7b31cc2010-07-16 18:28:03 +00001644
1645 void HandleIncompleteScanList(const char *start, const char *end);
Ted Kremenek02087932010-07-16 02:11:22 +00001646};
Ted Kremenek019d2242010-01-29 01:50:07 +00001647}
Ted Kremenekab278de2010-01-28 23:39:18 +00001648
Ted Kremenekd7b31cc2010-07-16 18:28:03 +00001649void CheckScanfHandler::HandleIncompleteScanList(const char *start,
1650 const char *end) {
1651 S.Diag(getLocationOfByte(end), diag::warn_scanf_scanlist_incomplete)
1652 << getSpecifierRange(start, end - start);
1653}
1654
Ted Kremenekce815422010-07-19 21:25:57 +00001655bool CheckScanfHandler::HandleInvalidScanfConversionSpecifier(
1656 const analyze_scanf::ScanfSpecifier &FS,
1657 const char *startSpecifier,
1658 unsigned specifierLen) {
1659
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001660 const analyze_scanf::ScanfConversionSpecifier &CS =
Ted Kremenekce815422010-07-19 21:25:57 +00001661 FS.getConversionSpecifier();
1662
1663 return HandleInvalidConversionSpecifier(FS.getArgIndex(),
1664 getLocationOfByte(CS.getStart()),
1665 startSpecifier, specifierLen,
1666 CS.getStart(), CS.getLength());
1667}
1668
Ted Kremenek02087932010-07-16 02:11:22 +00001669bool CheckScanfHandler::HandleScanfSpecifier(
1670 const analyze_scanf::ScanfSpecifier &FS,
1671 const char *startSpecifier,
1672 unsigned specifierLen) {
1673
1674 using namespace analyze_scanf;
1675 using namespace analyze_format_string;
1676
Ted Kremenekf03e6d852010-07-20 20:04:27 +00001677 const ScanfConversionSpecifier &CS = FS.getConversionSpecifier();
Ted Kremenek02087932010-07-16 02:11:22 +00001678
Ted Kremenek6cd69422010-07-19 22:01:06 +00001679 // Handle case where '%' and '*' don't consume an argument. These shouldn't
1680 // be used to decide if we are using positional arguments consistently.
1681 if (FS.consumesDataArgument()) {
1682 if (atFirstArg) {
1683 atFirstArg = false;
1684 usesPositionalArgs = FS.usesPositionalArg();
1685 }
1686 else if (usesPositionalArgs != FS.usesPositionalArg()) {
1687 // Cannot mix-and-match positional and non-positional arguments.
1688 S.Diag(getLocationOfByte(CS.getStart()),
1689 diag::warn_format_mix_positional_nonpositional_args)
1690 << getSpecifierRange(startSpecifier, specifierLen);
1691 return false;
1692 }
Ted Kremenek02087932010-07-16 02:11:22 +00001693 }
1694
1695 // Check if the field with is non-zero.
1696 const OptionalAmount &Amt = FS.getFieldWidth();
1697 if (Amt.getHowSpecified() == OptionalAmount::Constant) {
1698 if (Amt.getConstantAmount() == 0) {
1699 const CharSourceRange &R = getSpecifierRange(Amt.getStart(),
1700 Amt.getConstantLength());
1701 S.Diag(getLocationOfByte(Amt.getStart()),
1702 diag::warn_scanf_nonzero_width)
1703 << R << FixItHint::CreateRemoval(R);
1704 }
1705 }
1706
1707 if (!FS.consumesDataArgument()) {
1708 // FIXME: Technically specifying a precision or field width here
1709 // makes no sense. Worth issuing a warning at some point.
1710 return true;
1711 }
1712
1713 // Consume the argument.
1714 unsigned argIndex = FS.getArgIndex();
1715 if (argIndex < NumDataArgs) {
1716 // The check to see if the argIndex is valid will come later.
1717 // We set the bit here because we may exit early from this
1718 // function if we encounter some other error.
1719 CoveredArgs.set(argIndex);
1720 }
1721
Ted Kremenek4407ea42010-07-20 20:04:47 +00001722 // Check the length modifier is valid with the given conversion specifier.
1723 const LengthModifier &LM = FS.getLengthModifier();
1724 if (!FS.hasValidLengthModifier()) {
1725 S.Diag(getLocationOfByte(LM.getStart()),
1726 diag::warn_format_nonsensical_length)
1727 << LM.toString() << CS.toString()
1728 << getSpecifierRange(startSpecifier, specifierLen)
1729 << FixItHint::CreateRemoval(getSpecifierRange(LM.getStart(),
1730 LM.getLength()));
1731 }
1732
Ted Kremenek02087932010-07-16 02:11:22 +00001733 // The remaining checks depend on the data arguments.
1734 if (HasVAListArg)
1735 return true;
1736
Ted Kremenek6adb7e32010-07-26 19:45:42 +00001737 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
Ted Kremenek02087932010-07-16 02:11:22 +00001738 return false;
Ted Kremenek02087932010-07-16 02:11:22 +00001739
1740 // FIXME: Check that the argument type matches the format specifier.
1741
1742 return true;
1743}
1744
1745void Sema::CheckFormatString(const StringLiteral *FExpr,
Ted Kremenekfb45d352010-02-10 02:16:30 +00001746 const Expr *OrigFormatExpr,
1747 const CallExpr *TheCall, bool HasVAListArg,
Ted Kremenek02087932010-07-16 02:11:22 +00001748 unsigned format_idx, unsigned firstDataArg,
1749 bool isPrintf) {
1750
Ted Kremenekab278de2010-01-28 23:39:18 +00001751 // CHECK: is the format string a wide literal?
1752 if (FExpr->isWide()) {
1753 Diag(FExpr->getLocStart(),
Ted Kremenek02087932010-07-16 02:11:22 +00001754 diag::warn_format_string_is_wide_literal)
Ted Kremenekab278de2010-01-28 23:39:18 +00001755 << OrigFormatExpr->getSourceRange();
1756 return;
1757 }
Ted Kremenek02087932010-07-16 02:11:22 +00001758
Ted Kremenekab278de2010-01-28 23:39:18 +00001759 // Str - The format string. NOTE: this is NOT null-terminated!
Benjamin Kramer35b077e2010-08-17 12:54:38 +00001760 llvm::StringRef StrRef = FExpr->getString();
1761 const char *Str = StrRef.data();
1762 unsigned StrLen = StrRef.size();
Ted Kremenek02087932010-07-16 02:11:22 +00001763
Ted Kremenekab278de2010-01-28 23:39:18 +00001764 // CHECK: empty format string?
Ted Kremenekab278de2010-01-28 23:39:18 +00001765 if (StrLen == 0) {
Ted Kremenek02087932010-07-16 02:11:22 +00001766 Diag(FExpr->getLocStart(), diag::warn_empty_format_string)
Ted Kremenekab278de2010-01-28 23:39:18 +00001767 << OrigFormatExpr->getSourceRange();
1768 return;
1769 }
Ted Kremenek02087932010-07-16 02:11:22 +00001770
1771 if (isPrintf) {
1772 CheckPrintfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg,
1773 TheCall->getNumArgs() - firstDataArg,
1774 isa<ObjCStringLiteral>(OrigFormatExpr), Str,
1775 HasVAListArg, TheCall, format_idx);
1776
1777 if (!analyze_format_string::ParsePrintfString(H, Str, Str + StrLen))
1778 H.DoneProcessing();
1779 }
1780 else {
1781 CheckScanfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg,
1782 TheCall->getNumArgs() - firstDataArg,
1783 isa<ObjCStringLiteral>(OrigFormatExpr), Str,
1784 HasVAListArg, TheCall, format_idx);
1785
1786 if (!analyze_format_string::ParseScanfString(H, Str, Str + StrLen))
1787 H.DoneProcessing();
1788 }
Ted Kremenekc70ee862010-01-28 01:18:22 +00001789}
1790
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001791//===--- CHECK: Return Address of Stack Variable --------------------------===//
1792
1793static DeclRefExpr* EvalVal(Expr *E);
1794static DeclRefExpr* EvalAddr(Expr* E);
1795
1796/// CheckReturnStackAddr - Check if a return statement returns the address
1797/// of a stack variable.
1798void
1799Sema::CheckReturnStackAddr(Expr *RetValExp, QualType lhsType,
1800 SourceLocation ReturnLoc) {
Mike Stump11289f42009-09-09 15:08:12 +00001801
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001802 // Perform checking for returned stack addresses.
Steve Naroff8de9c3a2008-09-05 22:11:13 +00001803 if (lhsType->isPointerType() || lhsType->isBlockPointerType()) {
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001804 if (DeclRefExpr *DR = EvalAddr(RetValExp))
Chris Lattner4bd8dd82008-11-19 08:23:25 +00001805 Diag(DR->getLocStart(), diag::warn_ret_stack_addr)
Chris Lattnere3d20d92008-11-23 21:45:46 +00001806 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
Mike Stump11289f42009-09-09 15:08:12 +00001807
Steve Naroff3b1e1722008-09-16 22:25:10 +00001808 // Skip over implicit cast expressions when checking for block expressions.
Chris Lattner870158e2009-09-08 00:36:37 +00001809 RetValExp = RetValExp->IgnoreParenCasts();
Steve Naroff3b1e1722008-09-16 22:25:10 +00001810
Chris Lattner252d36e2009-10-30 04:01:58 +00001811 if (BlockExpr *C = dyn_cast<BlockExpr>(RetValExp))
Mike Stump5c3285b2009-04-17 00:09:41 +00001812 if (C->hasBlockDeclRefExprs())
1813 Diag(C->getLocStart(), diag::err_ret_local_block)
1814 << C->getSourceRange();
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001815
Chris Lattner252d36e2009-10-30 04:01:58 +00001816 if (AddrLabelExpr *ALE = dyn_cast<AddrLabelExpr>(RetValExp))
1817 Diag(ALE->getLocStart(), diag::warn_ret_addr_label)
1818 << ALE->getSourceRange();
Ted Kremenekc8b188d2010-02-16 01:46:59 +00001819
Mike Stump12b8ce12009-08-04 21:02:39 +00001820 } else if (lhsType->isReferenceType()) {
1821 // Perform checking for stack values returned by reference.
Douglas Gregore200adc2008-10-27 19:41:14 +00001822 // Check for a reference to the stack
1823 if (DeclRefExpr *DR = EvalVal(RetValExp))
Chris Lattnerf490e152008-11-19 05:27:50 +00001824 Diag(DR->getLocStart(), diag::warn_ret_stack_ref)
Chris Lattnere3d20d92008-11-23 21:45:46 +00001825 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001826 }
1827}
1828
1829/// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
1830/// check if the expression in a return statement evaluates to an address
1831/// to a location on the stack. The recursion is used to traverse the
1832/// AST of the return expression, with recursion backtracking when we
1833/// encounter a subexpression that (1) clearly does not lead to the address
1834/// of a stack variable or (2) is something we cannot determine leads to
1835/// the address of a stack variable based on such local checking.
1836///
Ted Kremeneke07a8cd2007-08-28 17:02:55 +00001837/// EvalAddr processes expressions that are pointers that are used as
1838/// references (and not L-values). EvalVal handles all other values.
Mike Stump11289f42009-09-09 15:08:12 +00001839/// At the base case of the recursion is a check for a DeclRefExpr* in
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001840/// the refers to a stack variable.
1841///
1842/// This implementation handles:
1843///
1844/// * pointer-to-pointer casts
1845/// * implicit conversions from array references to pointers
1846/// * taking the address of fields
1847/// * arbitrary interplay between "&" and "*" operators
1848/// * pointer arithmetic from an address of a stack variable
1849/// * taking the address of an array element where the array is on the stack
1850static DeclRefExpr* EvalAddr(Expr *E) {
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001851 // We should only be called for evaluating pointer expressions.
David Chisnall9f57c292009-08-17 16:35:33 +00001852 assert((E->getType()->isAnyPointerType() ||
Steve Naroff8de9c3a2008-09-05 22:11:13 +00001853 E->getType()->isBlockPointerType() ||
Ted Kremenek1b0ea822008-01-07 19:49:32 +00001854 E->getType()->isObjCQualifiedIdType()) &&
Chris Lattner934edb22007-12-28 05:31:15 +00001855 "EvalAddr only works on pointers");
Mike Stump11289f42009-09-09 15:08:12 +00001856
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001857 // Our "symbolic interpreter" is just a dispatch off the currently
1858 // viewed AST node. We then recursively traverse the AST by calling
1859 // EvalAddr and EvalVal appropriately.
1860 switch (E->getStmtClass()) {
Chris Lattner934edb22007-12-28 05:31:15 +00001861 case Stmt::ParenExprClass:
1862 // Ignore parentheses.
1863 return EvalAddr(cast<ParenExpr>(E)->getSubExpr());
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001864
Chris Lattner934edb22007-12-28 05:31:15 +00001865 case Stmt::UnaryOperatorClass: {
1866 // The only unary operator that make sense to handle here
1867 // is AddrOf. All others don't make sense as pointers.
1868 UnaryOperator *U = cast<UnaryOperator>(E);
Mike Stump11289f42009-09-09 15:08:12 +00001869
Chris Lattner934edb22007-12-28 05:31:15 +00001870 if (U->getOpcode() == UnaryOperator::AddrOf)
1871 return EvalVal(U->getSubExpr());
1872 else
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001873 return NULL;
1874 }
Mike Stump11289f42009-09-09 15:08:12 +00001875
Chris Lattner934edb22007-12-28 05:31:15 +00001876 case Stmt::BinaryOperatorClass: {
1877 // Handle pointer arithmetic. All other binary operators are not valid
1878 // in this context.
1879 BinaryOperator *B = cast<BinaryOperator>(E);
1880 BinaryOperator::Opcode op = B->getOpcode();
Mike Stump11289f42009-09-09 15:08:12 +00001881
Chris Lattner934edb22007-12-28 05:31:15 +00001882 if (op != BinaryOperator::Add && op != BinaryOperator::Sub)
1883 return NULL;
Mike Stump11289f42009-09-09 15:08:12 +00001884
Chris Lattner934edb22007-12-28 05:31:15 +00001885 Expr *Base = B->getLHS();
1886
1887 // Determine which argument is the real pointer base. It could be
1888 // the RHS argument instead of the LHS.
1889 if (!Base->getType()->isPointerType()) Base = B->getRHS();
Mike Stump11289f42009-09-09 15:08:12 +00001890
Chris Lattner934edb22007-12-28 05:31:15 +00001891 assert (Base->getType()->isPointerType());
1892 return EvalAddr(Base);
1893 }
Steve Naroff2752a172008-09-10 19:17:48 +00001894
Chris Lattner934edb22007-12-28 05:31:15 +00001895 // For conditional operators we need to see if either the LHS or RHS are
1896 // valid DeclRefExpr*s. If one of them is valid, we return it.
1897 case Stmt::ConditionalOperatorClass: {
1898 ConditionalOperator *C = cast<ConditionalOperator>(E);
Mike Stump11289f42009-09-09 15:08:12 +00001899
Chris Lattner934edb22007-12-28 05:31:15 +00001900 // Handle the GNU extension for missing LHS.
1901 if (Expr *lhsExpr = C->getLHS())
1902 if (DeclRefExpr* LHS = EvalAddr(lhsExpr))
1903 return LHS;
1904
1905 return EvalAddr(C->getRHS());
1906 }
Mike Stump11289f42009-09-09 15:08:12 +00001907
Ted Kremenekc3b4c522008-08-07 00:49:01 +00001908 // For casts, we need to handle conversions from arrays to
1909 // pointer values, and pointer-to-pointer conversions.
Douglas Gregore200adc2008-10-27 19:41:14 +00001910 case Stmt::ImplicitCastExprClass:
Douglas Gregorf19b2312008-10-28 15:36:24 +00001911 case Stmt::CStyleCastExprClass:
Douglas Gregore200adc2008-10-27 19:41:14 +00001912 case Stmt::CXXFunctionalCastExprClass: {
Argyrios Kyrtzidis3bab3d22008-08-18 23:01:59 +00001913 Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
Ted Kremenekc3b4c522008-08-07 00:49:01 +00001914 QualType T = SubExpr->getType();
Mike Stump11289f42009-09-09 15:08:12 +00001915
Steve Naroff8de9c3a2008-09-05 22:11:13 +00001916 if (SubExpr->getType()->isPointerType() ||
1917 SubExpr->getType()->isBlockPointerType() ||
1918 SubExpr->getType()->isObjCQualifiedIdType())
Ted Kremenekc3b4c522008-08-07 00:49:01 +00001919 return EvalAddr(SubExpr);
1920 else if (T->isArrayType())
Chris Lattner934edb22007-12-28 05:31:15 +00001921 return EvalVal(SubExpr);
Chris Lattner934edb22007-12-28 05:31:15 +00001922 else
Ted Kremenekc3b4c522008-08-07 00:49:01 +00001923 return 0;
Chris Lattner934edb22007-12-28 05:31:15 +00001924 }
Mike Stump11289f42009-09-09 15:08:12 +00001925
Chris Lattner934edb22007-12-28 05:31:15 +00001926 // C++ casts. For dynamic casts, static casts, and const casts, we
1927 // are always converting from a pointer-to-pointer, so we just blow
Douglas Gregore200adc2008-10-27 19:41:14 +00001928 // through the cast. In the case the dynamic cast doesn't fail (and
1929 // return NULL), we take the conservative route and report cases
Chris Lattner934edb22007-12-28 05:31:15 +00001930 // where we return the address of a stack variable. For Reinterpre
Douglas Gregore200adc2008-10-27 19:41:14 +00001931 // FIXME: The comment about is wrong; we're not always converting
1932 // from pointer to pointer. I'm guessing that this code should also
Mike Stump11289f42009-09-09 15:08:12 +00001933 // handle references to objects.
1934 case Stmt::CXXStaticCastExprClass:
1935 case Stmt::CXXDynamicCastExprClass:
Douglas Gregore200adc2008-10-27 19:41:14 +00001936 case Stmt::CXXConstCastExprClass:
1937 case Stmt::CXXReinterpretCastExprClass: {
1938 Expr *S = cast<CXXNamedCastExpr>(E)->getSubExpr();
Steve Naroff8de9c3a2008-09-05 22:11:13 +00001939 if (S->getType()->isPointerType() || S->getType()->isBlockPointerType())
Chris Lattner934edb22007-12-28 05:31:15 +00001940 return EvalAddr(S);
1941 else
1942 return NULL;
Chris Lattner934edb22007-12-28 05:31:15 +00001943 }
Mike Stump11289f42009-09-09 15:08:12 +00001944
Chris Lattner934edb22007-12-28 05:31:15 +00001945 // Everything else: we simply don't reason about them.
1946 default:
1947 return NULL;
1948 }
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001949}
Mike Stump11289f42009-09-09 15:08:12 +00001950
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001951
1952/// EvalVal - This function is complements EvalAddr in the mutual recursion.
1953/// See the comments for EvalAddr for more details.
1954static DeclRefExpr* EvalVal(Expr *E) {
Ted Kremenekb7861562010-08-04 20:01:07 +00001955do {
Ted Kremeneke07a8cd2007-08-28 17:02:55 +00001956 // We should only be called for evaluating non-pointer expressions, or
1957 // expressions with a pointer type that are not used as references but instead
1958 // are l-values (e.g., DeclRefExpr with a pointer type).
Mike Stump11289f42009-09-09 15:08:12 +00001959
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001960 // Our "symbolic interpreter" is just a dispatch off the currently
1961 // viewed AST node. We then recursively traverse the AST by calling
1962 // EvalAddr and EvalVal appropriately.
1963 switch (E->getStmtClass()) {
Ted Kremenekb7861562010-08-04 20:01:07 +00001964 case Stmt::ImplicitCastExprClass: {
1965 ImplicitCastExpr *IE = cast<ImplicitCastExpr>(E);
1966 if (IE->getCategory() == ImplicitCastExpr::LValue) {
1967 E = IE->getSubExpr();
1968 continue;
1969 }
1970 return NULL;
1971 }
1972
Douglas Gregor4bd90e52009-10-23 18:54:35 +00001973 case Stmt::DeclRefExprClass: {
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001974 // DeclRefExpr: the base case. When we hit a DeclRefExpr we are looking
1975 // at code that refers to a variable's name. We check if it has local
1976 // storage within the function, and if so, return the expression.
1977 DeclRefExpr *DR = cast<DeclRefExpr>(E);
Mike Stump11289f42009-09-09 15:08:12 +00001978
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001979 if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
Mike Stump11289f42009-09-09 15:08:12 +00001980 if (V->hasLocalStorage() && !V->getType()->isReferenceType()) return DR;
1981
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001982 return NULL;
1983 }
Mike Stump11289f42009-09-09 15:08:12 +00001984
Ted Kremenekb7861562010-08-04 20:01:07 +00001985 case Stmt::ParenExprClass: {
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001986 // Ignore parentheses.
Ted Kremenekb7861562010-08-04 20:01:07 +00001987 E = cast<ParenExpr>(E)->getSubExpr();
1988 continue;
1989 }
Mike Stump11289f42009-09-09 15:08:12 +00001990
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001991 case Stmt::UnaryOperatorClass: {
1992 // The only unary operator that make sense to handle here
1993 // is Deref. All others don't resolve to a "name." This includes
1994 // handling all sorts of rvalues passed to a unary operator.
1995 UnaryOperator *U = cast<UnaryOperator>(E);
Mike Stump11289f42009-09-09 15:08:12 +00001996
Ted Kremenekcff94fa2007-08-17 16:46:58 +00001997 if (U->getOpcode() == UnaryOperator::Deref)
1998 return EvalAddr(U->getSubExpr());
1999
2000 return NULL;
2001 }
Mike Stump11289f42009-09-09 15:08:12 +00002002
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002003 case Stmt::ArraySubscriptExprClass: {
2004 // Array subscripts are potential references to data on the stack. We
2005 // retrieve the DeclRefExpr* for the array variable if it indeed
2006 // has local storage.
Ted Kremenekc81614d2007-08-20 16:18:38 +00002007 return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase());
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002008 }
Mike Stump11289f42009-09-09 15:08:12 +00002009
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002010 case Stmt::ConditionalOperatorClass: {
2011 // For conditional operators we need to see if either the LHS or RHS are
2012 // non-NULL DeclRefExpr's. If one is non-NULL, we return it.
2013 ConditionalOperator *C = cast<ConditionalOperator>(E);
2014
Anders Carlsson801c5c72007-11-30 19:04:31 +00002015 // Handle the GNU extension for missing LHS.
2016 if (Expr *lhsExpr = C->getLHS())
2017 if (DeclRefExpr *LHS = EvalVal(lhsExpr))
2018 return LHS;
2019
2020 return EvalVal(C->getRHS());
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002021 }
Mike Stump11289f42009-09-09 15:08:12 +00002022
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002023 // Accesses to members are potential references to data on the stack.
Douglas Gregorf405d7e2009-08-31 23:41:50 +00002024 case Stmt::MemberExprClass: {
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002025 MemberExpr *M = cast<MemberExpr>(E);
Mike Stump11289f42009-09-09 15:08:12 +00002026
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002027 // Check for indirect access. We only want direct field accesses.
2028 if (!M->isArrow())
2029 return EvalVal(M->getBase());
2030 else
2031 return NULL;
2032 }
Mike Stump11289f42009-09-09 15:08:12 +00002033
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002034 // Everything else: we simply don't reason about them.
2035 default:
2036 return NULL;
2037 }
Ted Kremenekb7861562010-08-04 20:01:07 +00002038} while (true);
Ted Kremenekcff94fa2007-08-17 16:46:58 +00002039}
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002040
2041//===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
2042
2043/// Check for comparisons of floating point operands using != and ==.
2044/// Issue a warning if these are no self-comparisons, as they are not likely
2045/// to do what the programmer intended.
2046void Sema::CheckFloatComparison(SourceLocation loc, Expr* lex, Expr *rex) {
2047 bool EmitWarning = true;
Mike Stump11289f42009-09-09 15:08:12 +00002048
Ted Kremenekfff70962008-01-17 16:57:34 +00002049 Expr* LeftExprSansParen = lex->IgnoreParens();
Ted Kremenek32a33582008-01-17 17:55:13 +00002050 Expr* RightExprSansParen = rex->IgnoreParens();
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002051
2052 // Special case: check for x == x (which is OK).
2053 // Do not emit warnings for such cases.
2054 if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
2055 if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
2056 if (DRL->getDecl() == DRR->getDecl())
2057 EmitWarning = false;
Mike Stump11289f42009-09-09 15:08:12 +00002058
2059
Ted Kremenekeda40e22007-11-29 00:59:04 +00002060 // Special case: check for comparisons against literals that can be exactly
2061 // represented by APFloat. In such cases, do not emit a warning. This
2062 // is a heuristic: often comparison against such literals are used to
2063 // detect if a value in a variable has not changed. This clearly can
2064 // lead to false negatives.
2065 if (EmitWarning) {
2066 if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
2067 if (FLL->isExact())
2068 EmitWarning = false;
Mike Stump12b8ce12009-08-04 21:02:39 +00002069 } else
Ted Kremenekeda40e22007-11-29 00:59:04 +00002070 if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)){
2071 if (FLR->isExact())
2072 EmitWarning = false;
2073 }
2074 }
Mike Stump11289f42009-09-09 15:08:12 +00002075
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002076 // Check for comparisons with builtin types.
Sebastian Redlc215cfc2009-01-19 00:08:26 +00002077 if (EmitWarning)
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002078 if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
Douglas Gregore711f702009-02-14 18:57:46 +00002079 if (CL->isBuiltinCall(Context))
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002080 EmitWarning = false;
Mike Stump11289f42009-09-09 15:08:12 +00002081
Sebastian Redlc215cfc2009-01-19 00:08:26 +00002082 if (EmitWarning)
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002083 if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
Douglas Gregore711f702009-02-14 18:57:46 +00002084 if (CR->isBuiltinCall(Context))
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002085 EmitWarning = false;
Mike Stump11289f42009-09-09 15:08:12 +00002086
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002087 // Emit the diagnostic.
2088 if (EmitWarning)
Chris Lattner3b054132008-11-19 05:08:23 +00002089 Diag(loc, diag::warn_floatingpoint_eq)
2090 << lex->getSourceRange() << rex->getSourceRange();
Ted Kremenek43fb8b02007-11-25 00:58:00 +00002091}
John McCallca01b222010-01-04 23:21:16 +00002092
John McCall70aa5392010-01-06 05:24:50 +00002093//===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
2094//===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
John McCallca01b222010-01-04 23:21:16 +00002095
John McCall70aa5392010-01-06 05:24:50 +00002096namespace {
John McCallca01b222010-01-04 23:21:16 +00002097
John McCall70aa5392010-01-06 05:24:50 +00002098/// Structure recording the 'active' range of an integer-valued
2099/// expression.
2100struct IntRange {
2101 /// The number of bits active in the int.
2102 unsigned Width;
John McCallca01b222010-01-04 23:21:16 +00002103
John McCall70aa5392010-01-06 05:24:50 +00002104 /// True if the int is known not to have negative values.
2105 bool NonNegative;
John McCallca01b222010-01-04 23:21:16 +00002106
John McCall70aa5392010-01-06 05:24:50 +00002107 IntRange(unsigned Width, bool NonNegative)
2108 : Width(Width), NonNegative(NonNegative)
2109 {}
John McCallca01b222010-01-04 23:21:16 +00002110
John McCall70aa5392010-01-06 05:24:50 +00002111 // Returns the range of the bool type.
2112 static IntRange forBoolType() {
2113 return IntRange(1, true);
John McCall263a48b2010-01-04 23:31:57 +00002114 }
2115
John McCall70aa5392010-01-06 05:24:50 +00002116 // Returns the range of an integral type.
2117 static IntRange forType(ASTContext &C, QualType T) {
2118 return forCanonicalType(C, T->getCanonicalTypeInternal().getTypePtr());
John McCall263a48b2010-01-04 23:31:57 +00002119 }
2120
John McCall70aa5392010-01-06 05:24:50 +00002121 // Returns the range of an integeral type based on its canonical
2122 // representation.
2123 static IntRange forCanonicalType(ASTContext &C, const Type *T) {
2124 assert(T->isCanonicalUnqualified());
2125
2126 if (const VectorType *VT = dyn_cast<VectorType>(T))
2127 T = VT->getElementType().getTypePtr();
2128 if (const ComplexType *CT = dyn_cast<ComplexType>(T))
2129 T = CT->getElementType().getTypePtr();
John McCallcc7e5bf2010-05-06 08:58:33 +00002130
2131 if (const EnumType *ET = dyn_cast<EnumType>(T)) {
2132 EnumDecl *Enum = ET->getDecl();
2133 unsigned NumPositive = Enum->getNumPositiveBits();
2134 unsigned NumNegative = Enum->getNumNegativeBits();
2135
2136 return IntRange(std::max(NumPositive, NumNegative), NumNegative == 0);
2137 }
John McCall70aa5392010-01-06 05:24:50 +00002138
2139 const BuiltinType *BT = cast<BuiltinType>(T);
2140 assert(BT->isInteger());
2141
2142 return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
2143 }
2144
2145 // Returns the supremum of two ranges: i.e. their conservative merge.
John McCallff96ccd2010-02-23 19:22:29 +00002146 static IntRange join(IntRange L, IntRange R) {
John McCall70aa5392010-01-06 05:24:50 +00002147 return IntRange(std::max(L.Width, R.Width),
John McCall2ce81ad2010-01-06 22:07:33 +00002148 L.NonNegative && R.NonNegative);
2149 }
2150
2151 // Returns the infinum of two ranges: i.e. their aggressive merge.
John McCallff96ccd2010-02-23 19:22:29 +00002152 static IntRange meet(IntRange L, IntRange R) {
John McCall2ce81ad2010-01-06 22:07:33 +00002153 return IntRange(std::min(L.Width, R.Width),
2154 L.NonNegative || R.NonNegative);
John McCall70aa5392010-01-06 05:24:50 +00002155 }
2156};
2157
2158IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, unsigned MaxWidth) {
2159 if (value.isSigned() && value.isNegative())
2160 return IntRange(value.getMinSignedBits(), false);
2161
2162 if (value.getBitWidth() > MaxWidth)
2163 value.trunc(MaxWidth);
2164
2165 // isNonNegative() just checks the sign bit without considering
2166 // signedness.
2167 return IntRange(value.getActiveBits(), true);
2168}
2169
John McCall74430522010-01-06 22:57:21 +00002170IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
John McCall70aa5392010-01-06 05:24:50 +00002171 unsigned MaxWidth) {
2172 if (result.isInt())
2173 return GetValueRange(C, result.getInt(), MaxWidth);
2174
2175 if (result.isVector()) {
John McCall74430522010-01-06 22:57:21 +00002176 IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
2177 for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
2178 IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
2179 R = IntRange::join(R, El);
2180 }
John McCall70aa5392010-01-06 05:24:50 +00002181 return R;
2182 }
2183
2184 if (result.isComplexInt()) {
2185 IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
2186 IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
2187 return IntRange::join(R, I);
John McCall263a48b2010-01-04 23:31:57 +00002188 }
2189
2190 // This can happen with lossless casts to intptr_t of "based" lvalues.
2191 // Assume it might use arbitrary bits.
John McCall74430522010-01-06 22:57:21 +00002192 // FIXME: The only reason we need to pass the type in here is to get
2193 // the sign right on this one case. It would be nice if APValue
2194 // preserved this.
John McCall70aa5392010-01-06 05:24:50 +00002195 assert(result.isLValue());
John McCall74430522010-01-06 22:57:21 +00002196 return IntRange(MaxWidth, Ty->isUnsignedIntegerType());
John McCall263a48b2010-01-04 23:31:57 +00002197}
John McCall70aa5392010-01-06 05:24:50 +00002198
2199/// Pseudo-evaluate the given integer expression, estimating the
2200/// range of values it might take.
2201///
2202/// \param MaxWidth - the width to which the value will be truncated
2203IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
2204 E = E->IgnoreParens();
2205
2206 // Try a full evaluation first.
2207 Expr::EvalResult result;
2208 if (E->Evaluate(result, C))
John McCall74430522010-01-06 22:57:21 +00002209 return GetValueRange(C, result.Val, E->getType(), MaxWidth);
John McCall70aa5392010-01-06 05:24:50 +00002210
2211 // I think we only want to look through implicit casts here; if the
2212 // user has an explicit widening cast, we should treat the value as
2213 // being of the new, wider type.
2214 if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
2215 if (CE->getCastKind() == CastExpr::CK_NoOp)
2216 return GetExprRange(C, CE->getSubExpr(), MaxWidth);
2217
2218 IntRange OutputTypeRange = IntRange::forType(C, CE->getType());
2219
John McCall2ce81ad2010-01-06 22:07:33 +00002220 bool isIntegerCast = (CE->getCastKind() == CastExpr::CK_IntegralCast);
2221 if (!isIntegerCast && CE->getCastKind() == CastExpr::CK_Unknown)
2222 isIntegerCast = CE->getSubExpr()->getType()->isIntegerType();
2223
John McCall70aa5392010-01-06 05:24:50 +00002224 // Assume that non-integer casts can span the full range of the type.
John McCall2ce81ad2010-01-06 22:07:33 +00002225 if (!isIntegerCast)
John McCall70aa5392010-01-06 05:24:50 +00002226 return OutputTypeRange;
2227
2228 IntRange SubRange
2229 = GetExprRange(C, CE->getSubExpr(),
2230 std::min(MaxWidth, OutputTypeRange.Width));
2231
2232 // Bail out if the subexpr's range is as wide as the cast type.
2233 if (SubRange.Width >= OutputTypeRange.Width)
2234 return OutputTypeRange;
2235
2236 // Otherwise, we take the smaller width, and we're non-negative if
2237 // either the output type or the subexpr is.
2238 return IntRange(SubRange.Width,
2239 SubRange.NonNegative || OutputTypeRange.NonNegative);
2240 }
2241
2242 if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
2243 // If we can fold the condition, just take that operand.
2244 bool CondResult;
2245 if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
2246 return GetExprRange(C, CondResult ? CO->getTrueExpr()
2247 : CO->getFalseExpr(),
2248 MaxWidth);
2249
2250 // Otherwise, conservatively merge.
2251 IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
2252 IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
2253 return IntRange::join(L, R);
2254 }
2255
2256 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
2257 switch (BO->getOpcode()) {
2258
2259 // Boolean-valued operations are single-bit and positive.
2260 case BinaryOperator::LAnd:
2261 case BinaryOperator::LOr:
2262 case BinaryOperator::LT:
2263 case BinaryOperator::GT:
2264 case BinaryOperator::LE:
2265 case BinaryOperator::GE:
2266 case BinaryOperator::EQ:
2267 case BinaryOperator::NE:
2268 return IntRange::forBoolType();
2269
John McCallff96ccd2010-02-23 19:22:29 +00002270 // The type of these compound assignments is the type of the LHS,
2271 // so the RHS is not necessarily an integer.
2272 case BinaryOperator::MulAssign:
2273 case BinaryOperator::DivAssign:
2274 case BinaryOperator::RemAssign:
2275 case BinaryOperator::AddAssign:
2276 case BinaryOperator::SubAssign:
2277 return IntRange::forType(C, E->getType());
2278
John McCall70aa5392010-01-06 05:24:50 +00002279 // Operations with opaque sources are black-listed.
2280 case BinaryOperator::PtrMemD:
2281 case BinaryOperator::PtrMemI:
2282 return IntRange::forType(C, E->getType());
2283
John McCall2ce81ad2010-01-06 22:07:33 +00002284 // Bitwise-and uses the *infinum* of the two source ranges.
2285 case BinaryOperator::And:
John McCallff96ccd2010-02-23 19:22:29 +00002286 case BinaryOperator::AndAssign:
John McCall2ce81ad2010-01-06 22:07:33 +00002287 return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
2288 GetExprRange(C, BO->getRHS(), MaxWidth));
2289
John McCall70aa5392010-01-06 05:24:50 +00002290 // Left shift gets black-listed based on a judgement call.
2291 case BinaryOperator::Shl:
John McCall1bff9932010-04-07 01:14:35 +00002292 // ...except that we want to treat '1 << (blah)' as logically
2293 // positive. It's an important idiom.
2294 if (IntegerLiteral *I
2295 = dyn_cast<IntegerLiteral>(BO->getLHS()->IgnoreParenCasts())) {
2296 if (I->getValue() == 1) {
2297 IntRange R = IntRange::forType(C, E->getType());
2298 return IntRange(R.Width, /*NonNegative*/ true);
2299 }
2300 }
2301 // fallthrough
2302
John McCallff96ccd2010-02-23 19:22:29 +00002303 case BinaryOperator::ShlAssign:
John McCall70aa5392010-01-06 05:24:50 +00002304 return IntRange::forType(C, E->getType());
2305
John McCall2ce81ad2010-01-06 22:07:33 +00002306 // Right shift by a constant can narrow its left argument.
John McCallff96ccd2010-02-23 19:22:29 +00002307 case BinaryOperator::Shr:
2308 case BinaryOperator::ShrAssign: {
John McCall2ce81ad2010-01-06 22:07:33 +00002309 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
2310
2311 // If the shift amount is a positive constant, drop the width by
2312 // that much.
2313 llvm::APSInt shift;
2314 if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
2315 shift.isNonNegative()) {
2316 unsigned zext = shift.getZExtValue();
2317 if (zext >= L.Width)
2318 L.Width = (L.NonNegative ? 0 : 1);
2319 else
2320 L.Width -= zext;
2321 }
2322
2323 return L;
2324 }
2325
2326 // Comma acts as its right operand.
John McCall70aa5392010-01-06 05:24:50 +00002327 case BinaryOperator::Comma:
2328 return GetExprRange(C, BO->getRHS(), MaxWidth);
2329
John McCall2ce81ad2010-01-06 22:07:33 +00002330 // Black-list pointer subtractions.
John McCall70aa5392010-01-06 05:24:50 +00002331 case BinaryOperator::Sub:
2332 if (BO->getLHS()->getType()->isPointerType())
2333 return IntRange::forType(C, E->getType());
2334 // fallthrough
Ted Kremenekc8b188d2010-02-16 01:46:59 +00002335
John McCall70aa5392010-01-06 05:24:50 +00002336 default:
2337 break;
2338 }
2339
2340 // Treat every other operator as if it were closed on the
2341 // narrowest type that encompasses both operands.
2342 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
2343 IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
2344 return IntRange::join(L, R);
2345 }
2346
2347 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
2348 switch (UO->getOpcode()) {
2349 // Boolean-valued operations are white-listed.
2350 case UnaryOperator::LNot:
2351 return IntRange::forBoolType();
2352
2353 // Operations with opaque sources are black-listed.
2354 case UnaryOperator::Deref:
2355 case UnaryOperator::AddrOf: // should be impossible
John McCall70aa5392010-01-06 05:24:50 +00002356 return IntRange::forType(C, E->getType());
2357
2358 default:
2359 return GetExprRange(C, UO->getSubExpr(), MaxWidth);
2360 }
2361 }
Douglas Gregor882211c2010-04-28 22:16:22 +00002362
2363 if (dyn_cast<OffsetOfExpr>(E)) {
2364 IntRange::forType(C, E->getType());
2365 }
John McCall70aa5392010-01-06 05:24:50 +00002366
2367 FieldDecl *BitField = E->getBitField();
2368 if (BitField) {
2369 llvm::APSInt BitWidthAP = BitField->getBitWidth()->EvaluateAsInt(C);
2370 unsigned BitWidth = BitWidthAP.getZExtValue();
2371
2372 return IntRange(BitWidth, BitField->getType()->isUnsignedIntegerType());
2373 }
2374
2375 return IntRange::forType(C, E->getType());
2376}
John McCall263a48b2010-01-04 23:31:57 +00002377
John McCallcc7e5bf2010-05-06 08:58:33 +00002378IntRange GetExprRange(ASTContext &C, Expr *E) {
2379 return GetExprRange(C, E, C.getIntWidth(E->getType()));
2380}
2381
John McCall263a48b2010-01-04 23:31:57 +00002382/// Checks whether the given value, which currently has the given
2383/// source semantics, has the same value when coerced through the
2384/// target semantics.
John McCall70aa5392010-01-06 05:24:50 +00002385bool IsSameFloatAfterCast(const llvm::APFloat &value,
2386 const llvm::fltSemantics &Src,
2387 const llvm::fltSemantics &Tgt) {
John McCall263a48b2010-01-04 23:31:57 +00002388 llvm::APFloat truncated = value;
2389
2390 bool ignored;
2391 truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
2392 truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
2393
2394 return truncated.bitwiseIsEqual(value);
2395}
2396
2397/// Checks whether the given value, which currently has the given
2398/// source semantics, has the same value when coerced through the
2399/// target semantics.
2400///
2401/// The value might be a vector of floats (or a complex number).
John McCall70aa5392010-01-06 05:24:50 +00002402bool IsSameFloatAfterCast(const APValue &value,
2403 const llvm::fltSemantics &Src,
2404 const llvm::fltSemantics &Tgt) {
John McCall263a48b2010-01-04 23:31:57 +00002405 if (value.isFloat())
2406 return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
2407
2408 if (value.isVector()) {
2409 for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
2410 if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
2411 return false;
2412 return true;
2413 }
2414
2415 assert(value.isComplexFloat());
2416 return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
2417 IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
2418}
2419
John McCallcc7e5bf2010-05-06 08:58:33 +00002420void AnalyzeImplicitConversions(Sema &S, Expr *E);
2421
2422bool IsZero(Sema &S, Expr *E) {
2423 llvm::APSInt Value;
2424 return E->isIntegerConstantExpr(Value, S.Context) && Value == 0;
2425}
2426
2427void CheckTrivialUnsignedComparison(Sema &S, BinaryOperator *E) {
2428 BinaryOperator::Opcode op = E->getOpcode();
2429 if (op == BinaryOperator::LT && IsZero(S, E->getRHS())) {
2430 S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison)
2431 << "< 0" << "false"
2432 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
2433 } else if (op == BinaryOperator::GE && IsZero(S, E->getRHS())) {
2434 S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison)
2435 << ">= 0" << "true"
2436 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
2437 } else if (op == BinaryOperator::GT && IsZero(S, E->getLHS())) {
2438 S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison)
2439 << "0 >" << "false"
2440 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
2441 } else if (op == BinaryOperator::LE && IsZero(S, E->getLHS())) {
2442 S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison)
2443 << "0 <=" << "true"
2444 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
2445 }
2446}
2447
2448/// Analyze the operands of the given comparison. Implements the
2449/// fallback case from AnalyzeComparison.
2450void AnalyzeImpConvsInComparison(Sema &S, BinaryOperator *E) {
2451 AnalyzeImplicitConversions(S, E->getLHS());
2452 AnalyzeImplicitConversions(S, E->getRHS());
2453}
John McCall263a48b2010-01-04 23:31:57 +00002454
John McCallca01b222010-01-04 23:21:16 +00002455/// \brief Implements -Wsign-compare.
2456///
2457/// \param lex the left-hand expression
2458/// \param rex the right-hand expression
2459/// \param OpLoc the location of the joining operator
John McCall71d8d9b2010-03-11 19:43:18 +00002460/// \param BinOpc binary opcode or 0
John McCallcc7e5bf2010-05-06 08:58:33 +00002461void AnalyzeComparison(Sema &S, BinaryOperator *E) {
2462 // The type the comparison is being performed in.
2463 QualType T = E->getLHS()->getType();
2464 assert(S.Context.hasSameUnqualifiedType(T, E->getRHS()->getType())
2465 && "comparison with mismatched types");
John McCallca01b222010-01-04 23:21:16 +00002466
John McCallcc7e5bf2010-05-06 08:58:33 +00002467 // We don't do anything special if this isn't an unsigned integral
2468 // comparison: we're only interested in integral comparisons, and
2469 // signed comparisons only happen in cases we don't care to warn about.
Douglas Gregor5cc2c8b2010-07-23 15:58:24 +00002470 if (!T->hasUnsignedIntegerRepresentation())
John McCallcc7e5bf2010-05-06 08:58:33 +00002471 return AnalyzeImpConvsInComparison(S, E);
John McCall70aa5392010-01-06 05:24:50 +00002472
John McCallcc7e5bf2010-05-06 08:58:33 +00002473 Expr *lex = E->getLHS()->IgnoreParenImpCasts();
2474 Expr *rex = E->getRHS()->IgnoreParenImpCasts();
John McCallca01b222010-01-04 23:21:16 +00002475
John McCallcc7e5bf2010-05-06 08:58:33 +00002476 // Check to see if one of the (unmodified) operands is of different
2477 // signedness.
2478 Expr *signedOperand, *unsignedOperand;
Douglas Gregor5cc2c8b2010-07-23 15:58:24 +00002479 if (lex->getType()->hasSignedIntegerRepresentation()) {
2480 assert(!rex->getType()->hasSignedIntegerRepresentation() &&
John McCallcc7e5bf2010-05-06 08:58:33 +00002481 "unsigned comparison between two signed integer expressions?");
2482 signedOperand = lex;
2483 unsignedOperand = rex;
Douglas Gregor5cc2c8b2010-07-23 15:58:24 +00002484 } else if (rex->getType()->hasSignedIntegerRepresentation()) {
John McCallcc7e5bf2010-05-06 08:58:33 +00002485 signedOperand = rex;
2486 unsignedOperand = lex;
John McCallca01b222010-01-04 23:21:16 +00002487 } else {
John McCallcc7e5bf2010-05-06 08:58:33 +00002488 CheckTrivialUnsignedComparison(S, E);
2489 return AnalyzeImpConvsInComparison(S, E);
John McCallca01b222010-01-04 23:21:16 +00002490 }
2491
John McCallcc7e5bf2010-05-06 08:58:33 +00002492 // Otherwise, calculate the effective range of the signed operand.
2493 IntRange signedRange = GetExprRange(S.Context, signedOperand);
John McCall70aa5392010-01-06 05:24:50 +00002494
John McCallcc7e5bf2010-05-06 08:58:33 +00002495 // Go ahead and analyze implicit conversions in the operands. Note
2496 // that we skip the implicit conversions on both sides.
2497 AnalyzeImplicitConversions(S, lex);
2498 AnalyzeImplicitConversions(S, rex);
John McCallca01b222010-01-04 23:21:16 +00002499
John McCallcc7e5bf2010-05-06 08:58:33 +00002500 // If the signed range is non-negative, -Wsign-compare won't fire,
2501 // but we should still check for comparisons which are always true
2502 // or false.
2503 if (signedRange.NonNegative)
2504 return CheckTrivialUnsignedComparison(S, E);
John McCallca01b222010-01-04 23:21:16 +00002505
2506 // For (in)equality comparisons, if the unsigned operand is a
2507 // constant which cannot collide with a overflowed signed operand,
2508 // then reinterpreting the signed operand as unsigned will not
2509 // change the result of the comparison.
John McCallcc7e5bf2010-05-06 08:58:33 +00002510 if (E->isEqualityOp()) {
2511 unsigned comparisonWidth = S.Context.getIntWidth(T);
2512 IntRange unsignedRange = GetExprRange(S.Context, unsignedOperand);
John McCallca01b222010-01-04 23:21:16 +00002513
John McCallcc7e5bf2010-05-06 08:58:33 +00002514 // We should never be unable to prove that the unsigned operand is
2515 // non-negative.
2516 assert(unsignedRange.NonNegative && "unsigned range includes negative?");
2517
2518 if (unsignedRange.Width < comparisonWidth)
2519 return;
2520 }
2521
2522 S.Diag(E->getOperatorLoc(), diag::warn_mixed_sign_comparison)
2523 << lex->getType() << rex->getType()
2524 << lex->getSourceRange() << rex->getSourceRange();
John McCallca01b222010-01-04 23:21:16 +00002525}
2526
John McCall263a48b2010-01-04 23:31:57 +00002527/// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
John McCallcc7e5bf2010-05-06 08:58:33 +00002528void DiagnoseImpCast(Sema &S, Expr *E, QualType T, unsigned diag) {
John McCall263a48b2010-01-04 23:31:57 +00002529 S.Diag(E->getExprLoc(), diag) << E->getType() << T << E->getSourceRange();
2530}
2531
John McCallcc7e5bf2010-05-06 08:58:33 +00002532void CheckImplicitConversion(Sema &S, Expr *E, QualType T,
2533 bool *ICContext = 0) {
2534 if (E->isTypeDependent() || E->isValueDependent()) return;
John McCall263a48b2010-01-04 23:31:57 +00002535
John McCallcc7e5bf2010-05-06 08:58:33 +00002536 const Type *Source = S.Context.getCanonicalType(E->getType()).getTypePtr();
2537 const Type *Target = S.Context.getCanonicalType(T).getTypePtr();
2538 if (Source == Target) return;
2539 if (Target->isDependentType()) return;
John McCall263a48b2010-01-04 23:31:57 +00002540
2541 // Never diagnose implicit casts to bool.
2542 if (Target->isSpecificBuiltinType(BuiltinType::Bool))
2543 return;
2544
2545 // Strip vector types.
2546 if (isa<VectorType>(Source)) {
2547 if (!isa<VectorType>(Target))
John McCallcc7e5bf2010-05-06 08:58:33 +00002548 return DiagnoseImpCast(S, E, T, diag::warn_impcast_vector_scalar);
John McCall263a48b2010-01-04 23:31:57 +00002549
2550 Source = cast<VectorType>(Source)->getElementType().getTypePtr();
2551 Target = cast<VectorType>(Target)->getElementType().getTypePtr();
2552 }
2553
2554 // Strip complex types.
2555 if (isa<ComplexType>(Source)) {
2556 if (!isa<ComplexType>(Target))
John McCallcc7e5bf2010-05-06 08:58:33 +00002557 return DiagnoseImpCast(S, E, T, diag::warn_impcast_complex_scalar);
John McCall263a48b2010-01-04 23:31:57 +00002558
2559 Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
2560 Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
2561 }
2562
2563 const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
2564 const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
2565
2566 // If the source is floating point...
2567 if (SourceBT && SourceBT->isFloatingPoint()) {
2568 // ...and the target is floating point...
2569 if (TargetBT && TargetBT->isFloatingPoint()) {
2570 // ...then warn if we're dropping FP rank.
2571
2572 // Builtin FP kinds are ordered by increasing FP rank.
2573 if (SourceBT->getKind() > TargetBT->getKind()) {
2574 // Don't warn about float constants that are precisely
2575 // representable in the target type.
2576 Expr::EvalResult result;
John McCallcc7e5bf2010-05-06 08:58:33 +00002577 if (E->Evaluate(result, S.Context)) {
John McCall263a48b2010-01-04 23:31:57 +00002578 // Value might be a float, a float vector, or a float complex.
2579 if (IsSameFloatAfterCast(result.Val,
John McCallcc7e5bf2010-05-06 08:58:33 +00002580 S.Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
2581 S.Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
John McCall263a48b2010-01-04 23:31:57 +00002582 return;
2583 }
2584
John McCallcc7e5bf2010-05-06 08:58:33 +00002585 DiagnoseImpCast(S, E, T, diag::warn_impcast_float_precision);
John McCall263a48b2010-01-04 23:31:57 +00002586 }
2587 return;
2588 }
2589
2590 // If the target is integral, always warn.
2591 if ((TargetBT && TargetBT->isInteger()))
2592 // TODO: don't warn for integer values?
John McCallcc7e5bf2010-05-06 08:58:33 +00002593 DiagnoseImpCast(S, E, T, diag::warn_impcast_float_integer);
John McCall263a48b2010-01-04 23:31:57 +00002594
2595 return;
2596 }
2597
John McCall70aa5392010-01-06 05:24:50 +00002598 if (!Source->isIntegerType() || !Target->isIntegerType())
John McCall263a48b2010-01-04 23:31:57 +00002599 return;
2600
John McCallcc7e5bf2010-05-06 08:58:33 +00002601 IntRange SourceRange = GetExprRange(S.Context, E);
2602 IntRange TargetRange = IntRange::forCanonicalType(S.Context, Target);
John McCall70aa5392010-01-06 05:24:50 +00002603
2604 if (SourceRange.Width > TargetRange.Width) {
John McCall263a48b2010-01-04 23:31:57 +00002605 // People want to build with -Wshorten-64-to-32 and not -Wconversion
2606 // and by god we'll let them.
John McCall70aa5392010-01-06 05:24:50 +00002607 if (SourceRange.Width == 64 && TargetRange.Width == 32)
John McCallcc7e5bf2010-05-06 08:58:33 +00002608 return DiagnoseImpCast(S, E, T, diag::warn_impcast_integer_64_32);
2609 return DiagnoseImpCast(S, E, T, diag::warn_impcast_integer_precision);
2610 }
2611
2612 if ((TargetRange.NonNegative && !SourceRange.NonNegative) ||
2613 (!TargetRange.NonNegative && SourceRange.NonNegative &&
2614 SourceRange.Width == TargetRange.Width)) {
2615 unsigned DiagID = diag::warn_impcast_integer_sign;
2616
2617 // Traditionally, gcc has warned about this under -Wsign-compare.
2618 // We also want to warn about it in -Wconversion.
2619 // So if -Wconversion is off, use a completely identical diagnostic
2620 // in the sign-compare group.
2621 // The conditional-checking code will
2622 if (ICContext) {
2623 DiagID = diag::warn_impcast_integer_sign_conditional;
2624 *ICContext = true;
2625 }
2626
2627 return DiagnoseImpCast(S, E, T, DiagID);
John McCall263a48b2010-01-04 23:31:57 +00002628 }
2629
2630 return;
2631}
2632
John McCallcc7e5bf2010-05-06 08:58:33 +00002633void CheckConditionalOperator(Sema &S, ConditionalOperator *E, QualType T);
2634
2635void CheckConditionalOperand(Sema &S, Expr *E, QualType T,
2636 bool &ICContext) {
2637 E = E->IgnoreParenImpCasts();
2638
2639 if (isa<ConditionalOperator>(E))
2640 return CheckConditionalOperator(S, cast<ConditionalOperator>(E), T);
2641
2642 AnalyzeImplicitConversions(S, E);
2643 if (E->getType() != T)
2644 return CheckImplicitConversion(S, E, T, &ICContext);
2645 return;
2646}
2647
2648void CheckConditionalOperator(Sema &S, ConditionalOperator *E, QualType T) {
2649 AnalyzeImplicitConversions(S, E->getCond());
2650
2651 bool Suspicious = false;
2652 CheckConditionalOperand(S, E->getTrueExpr(), T, Suspicious);
2653 CheckConditionalOperand(S, E->getFalseExpr(), T, Suspicious);
2654
2655 // If -Wconversion would have warned about either of the candidates
2656 // for a signedness conversion to the context type...
2657 if (!Suspicious) return;
2658
2659 // ...but it's currently ignored...
2660 if (S.Diags.getDiagnosticLevel(diag::warn_impcast_integer_sign_conditional))
2661 return;
2662
2663 // ...and -Wsign-compare isn't...
2664 if (!S.Diags.getDiagnosticLevel(diag::warn_mixed_sign_conditional))
2665 return;
2666
2667 // ...then check whether it would have warned about either of the
2668 // candidates for a signedness conversion to the condition type.
2669 if (E->getType() != T) {
2670 Suspicious = false;
2671 CheckImplicitConversion(S, E->getTrueExpr()->IgnoreParenImpCasts(),
2672 E->getType(), &Suspicious);
2673 if (!Suspicious)
2674 CheckImplicitConversion(S, E->getFalseExpr()->IgnoreParenImpCasts(),
2675 E->getType(), &Suspicious);
2676 if (!Suspicious)
2677 return;
2678 }
2679
2680 // If so, emit a diagnostic under -Wsign-compare.
2681 Expr *lex = E->getTrueExpr()->IgnoreParenImpCasts();
2682 Expr *rex = E->getFalseExpr()->IgnoreParenImpCasts();
2683 S.Diag(E->getQuestionLoc(), diag::warn_mixed_sign_conditional)
2684 << lex->getType() << rex->getType()
2685 << lex->getSourceRange() << rex->getSourceRange();
2686}
2687
2688/// AnalyzeImplicitConversions - Find and report any interesting
2689/// implicit conversions in the given expression. There are a couple
2690/// of competing diagnostics here, -Wconversion and -Wsign-compare.
2691void AnalyzeImplicitConversions(Sema &S, Expr *OrigE) {
2692 QualType T = OrigE->getType();
2693 Expr *E = OrigE->IgnoreParenImpCasts();
2694
2695 // For conditional operators, we analyze the arguments as if they
2696 // were being fed directly into the output.
2697 if (isa<ConditionalOperator>(E)) {
2698 ConditionalOperator *CO = cast<ConditionalOperator>(E);
2699 CheckConditionalOperator(S, CO, T);
2700 return;
2701 }
2702
2703 // Go ahead and check any implicit conversions we might have skipped.
2704 // The non-canonical typecheck is just an optimization;
2705 // CheckImplicitConversion will filter out dead implicit conversions.
2706 if (E->getType() != T)
2707 CheckImplicitConversion(S, E, T);
2708
2709 // Now continue drilling into this expression.
2710
2711 // Skip past explicit casts.
2712 if (isa<ExplicitCastExpr>(E)) {
2713 E = cast<ExplicitCastExpr>(E)->getSubExpr()->IgnoreParenImpCasts();
2714 return AnalyzeImplicitConversions(S, E);
2715 }
2716
2717 // Do a somewhat different check with comparison operators.
2718 if (isa<BinaryOperator>(E) && cast<BinaryOperator>(E)->isComparisonOp())
2719 return AnalyzeComparison(S, cast<BinaryOperator>(E));
2720
2721 // These break the otherwise-useful invariant below. Fortunately,
2722 // we don't really need to recurse into them, because any internal
2723 // expressions should have been analyzed already when they were
2724 // built into statements.
2725 if (isa<StmtExpr>(E)) return;
2726
2727 // Don't descend into unevaluated contexts.
2728 if (isa<SizeOfAlignOfExpr>(E)) return;
2729
2730 // Now just recurse over the expression's children.
2731 for (Stmt::child_iterator I = E->child_begin(), IE = E->child_end();
2732 I != IE; ++I)
2733 AnalyzeImplicitConversions(S, cast<Expr>(*I));
2734}
2735
2736} // end anonymous namespace
2737
2738/// Diagnoses "dangerous" implicit conversions within the given
2739/// expression (which is a full expression). Implements -Wconversion
2740/// and -Wsign-compare.
2741void Sema::CheckImplicitConversions(Expr *E) {
2742 // Don't diagnose in unevaluated contexts.
2743 if (ExprEvalContexts.back().Context == Sema::Unevaluated)
2744 return;
2745
2746 // Don't diagnose for value- or type-dependent expressions.
2747 if (E->isTypeDependent() || E->isValueDependent())
2748 return;
2749
2750 AnalyzeImplicitConversions(*this, E);
2751}
2752
Mike Stump0c2ec772010-01-21 03:59:47 +00002753/// CheckParmsForFunctionDef - Check that the parameters of the given
2754/// function are appropriate for the definition of a function. This
2755/// takes care of any checks that cannot be performed on the
2756/// declaration itself, e.g., that the types of each of the function
2757/// parameters are complete.
2758bool Sema::CheckParmsForFunctionDef(FunctionDecl *FD) {
2759 bool HasInvalidParm = false;
2760 for (unsigned p = 0, NumParams = FD->getNumParams(); p < NumParams; ++p) {
2761 ParmVarDecl *Param = FD->getParamDecl(p);
2762
2763 // C99 6.7.5.3p4: the parameters in a parameter type list in a
2764 // function declarator that is part of a function definition of
2765 // that function shall not have incomplete type.
2766 //
2767 // This is also C++ [dcl.fct]p6.
2768 if (!Param->isInvalidDecl() &&
2769 RequireCompleteType(Param->getLocation(), Param->getType(),
2770 diag::err_typecheck_decl_incomplete_type)) {
2771 Param->setInvalidDecl();
2772 HasInvalidParm = true;
2773 }
2774
2775 // C99 6.9.1p5: If the declarator includes a parameter type list, the
2776 // declaration of each parameter shall include an identifier.
2777 if (Param->getIdentifier() == 0 &&
2778 !Param->isImplicit() &&
2779 !getLangOptions().CPlusPlus)
2780 Diag(Param->getLocation(), diag::err_parameter_name_omitted);
Sam Weinigdeb55d52010-02-01 05:02:49 +00002781
2782 // C99 6.7.5.3p12:
2783 // If the function declarator is not part of a definition of that
2784 // function, parameters may have incomplete type and may use the [*]
2785 // notation in their sequences of declarator specifiers to specify
2786 // variable length array types.
2787 QualType PType = Param->getOriginalType();
2788 if (const ArrayType *AT = Context.getAsArrayType(PType)) {
2789 if (AT->getSizeModifier() == ArrayType::Star) {
2790 // FIXME: This diagnosic should point the the '[*]' if source-location
2791 // information is added for it.
2792 Diag(Param->getLocation(), diag::err_array_star_in_function_definition);
2793 }
2794 }
Mike Stump0c2ec772010-01-21 03:59:47 +00002795 }
2796
2797 return HasInvalidParm;
2798}
John McCall2b5c1b22010-08-12 21:44:57 +00002799
2800/// CheckCastAlign - Implements -Wcast-align, which warns when a
2801/// pointer cast increases the alignment requirements.
2802void Sema::CheckCastAlign(Expr *Op, QualType T, SourceRange TRange) {
2803 // This is actually a lot of work to potentially be doing on every
2804 // cast; don't do it if we're ignoring -Wcast_align (as is the default).
2805 if (getDiagnostics().getDiagnosticLevel(diag::warn_cast_align)
2806 == Diagnostic::Ignored)
2807 return;
2808
2809 // Ignore dependent types.
2810 if (T->isDependentType() || Op->getType()->isDependentType())
2811 return;
2812
2813 // Require that the destination be a pointer type.
2814 const PointerType *DestPtr = T->getAs<PointerType>();
2815 if (!DestPtr) return;
2816
2817 // If the destination has alignment 1, we're done.
2818 QualType DestPointee = DestPtr->getPointeeType();
2819 if (DestPointee->isIncompleteType()) return;
2820 CharUnits DestAlign = Context.getTypeAlignInChars(DestPointee);
2821 if (DestAlign.isOne()) return;
2822
2823 // Require that the source be a pointer type.
2824 const PointerType *SrcPtr = Op->getType()->getAs<PointerType>();
2825 if (!SrcPtr) return;
2826 QualType SrcPointee = SrcPtr->getPointeeType();
2827
2828 // Whitelist casts from cv void*. We already implicitly
2829 // whitelisted casts to cv void*, since they have alignment 1.
2830 // Also whitelist casts involving incomplete types, which implicitly
2831 // includes 'void'.
2832 if (SrcPointee->isIncompleteType()) return;
2833
2834 CharUnits SrcAlign = Context.getTypeAlignInChars(SrcPointee);
2835 if (SrcAlign >= DestAlign) return;
2836
2837 Diag(TRange.getBegin(), diag::warn_cast_align)
2838 << Op->getType() << T
2839 << static_cast<unsigned>(SrcAlign.getQuantity())
2840 << static_cast<unsigned>(DestAlign.getQuantity())
2841 << TRange << Op->getSourceRange();
2842}
2843