clang  8.0.0svn
NullabilityChecker.cpp
Go to the documentation of this file.
1 //== Nullabilityhecker.cpp - Nullability checker ----------------*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker tries to find nullability violations. There are several kinds of
11 // possible violations:
12 // * Null pointer is passed to a pointer which has a _Nonnull type.
13 // * Null pointer is returned from a function which has a _Nonnull return type.
14 // * Nullable pointer is passed to a pointer which has a _Nonnull type.
15 // * Nullable pointer is returned from a function which has a _Nonnull return
16 // type.
17 // * Nullable pointer is dereferenced.
18 //
19 // This checker propagates the nullability information of the pointers and looks
20 // for the patterns that are described above. Explicit casts are trusted and are
21 // considered a way to suppress false positives for this checker. The other way
22 // to suppress warnings would be to add asserts or guarding if statements to the
23 // code. In addition to the nullability propagation this checker also uses some
24 // heuristics to suppress potential false positives.
25 //
26 //===----------------------------------------------------------------------===//
27 
28 #include "ClangSACheckers.h"
29 
36 
37 #include "llvm/ADT/StringExtras.h"
38 #include "llvm/Support/Path.h"
39 
40 using namespace clang;
41 using namespace ento;
42 
43 namespace {
44 
45 /// Returns the most nullable nullability. This is used for message expressions
46 /// like [receiver method], where the nullability of this expression is either
47 /// the nullability of the receiver or the nullability of the return type of the
48 /// method, depending on which is more nullable. Contradicted is considered to
49 /// be the most nullable, to avoid false positive results.
50 Nullability getMostNullable(Nullability Lhs, Nullability Rhs) {
51  return static_cast<Nullability>(
52  std::min(static_cast<char>(Lhs), static_cast<char>(Rhs)));
53 }
54 
55 const char *getNullabilityString(Nullability Nullab) {
56  switch (Nullab) {
58  return "contradicted";
60  return "nullable";
62  return "unspecified";
64  return "nonnull";
65  }
66  llvm_unreachable("Unexpected enumeration.");
67  return "";
68 }
69 
70 // These enums are used as an index to ErrorMessages array.
71 enum class ErrorKind : int {
72  NilAssignedToNonnull,
73  NilPassedToNonnull,
74  NilReturnedToNonnull,
75  NullableAssignedToNonnull,
76  NullableReturnedToNonnull,
77  NullableDereferenced,
78  NullablePassedToNonnull
79 };
80 
81 class NullabilityChecker
82  : public Checker<check::Bind, check::PreCall, check::PreStmt<ReturnStmt>,
83  check::PostCall, check::PostStmt<ExplicitCastExpr>,
84  check::PostObjCMessage, check::DeadSymbols,
85  check::Event<ImplicitNullDerefEvent>> {
86  mutable std::unique_ptr<BugType> BT;
87 
88 public:
89  // If true, the checker will not diagnose nullabilility issues for calls
90  // to system headers. This option is motivated by the observation that large
91  // projects may have many nullability warnings. These projects may
92  // find warnings about nullability annotations that they have explicitly
93  // added themselves higher priority to fix than warnings on calls to system
94  // libraries.
95  DefaultBool NoDiagnoseCallsToSystemHeaders;
96 
97  void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const;
98  void checkPostStmt(const ExplicitCastExpr *CE, CheckerContext &C) const;
99  void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
100  void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
101  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
102  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
103  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
104  void checkEvent(ImplicitNullDerefEvent Event) const;
105 
106  void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
107  const char *Sep) const override;
108 
109  struct NullabilityChecksFilter {
110  DefaultBool CheckNullPassedToNonnull;
111  DefaultBool CheckNullReturnedFromNonnull;
112  DefaultBool CheckNullableDereferenced;
113  DefaultBool CheckNullablePassedToNonnull;
114  DefaultBool CheckNullableReturnedFromNonnull;
115 
116  CheckName CheckNameNullPassedToNonnull;
117  CheckName CheckNameNullReturnedFromNonnull;
118  CheckName CheckNameNullableDereferenced;
119  CheckName CheckNameNullablePassedToNonnull;
120  CheckName CheckNameNullableReturnedFromNonnull;
121  };
122 
123  NullabilityChecksFilter Filter;
124  // When set to false no nullability information will be tracked in
125  // NullabilityMap. It is possible to catch errors like passing a null pointer
126  // to a callee that expects nonnull argument without the information that is
127  // stroed in the NullabilityMap. This is an optimization.
128  DefaultBool NeedTracking;
129 
130 private:
131  class NullabilityBugVisitor : public BugReporterVisitor {
132  public:
133  NullabilityBugVisitor(const MemRegion *M) : Region(M) {}
134 
135  void Profile(llvm::FoldingSetNodeID &ID) const override {
136  static int X = 0;
137  ID.AddPointer(&X);
138  ID.AddPointer(Region);
139  }
140 
141  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
142  BugReporterContext &BRC,
143  BugReport &BR) override;
144 
145  private:
146  // The tracked region.
147  const MemRegion *Region;
148  };
149 
150  /// When any of the nonnull arguments of the analyzed function is null, do not
151  /// report anything and turn off the check.
152  ///
153  /// When \p SuppressPath is set to true, no more bugs will be reported on this
154  /// path by this checker.
155  void reportBugIfInvariantHolds(StringRef Msg, ErrorKind Error,
156  ExplodedNode *N, const MemRegion *Region,
157  CheckerContext &C,
158  const Stmt *ValueExpr = nullptr,
159  bool SuppressPath = false) const;
160 
161  void reportBug(StringRef Msg, ErrorKind Error, ExplodedNode *N,
162  const MemRegion *Region, BugReporter &BR,
163  const Stmt *ValueExpr = nullptr) const {
164  if (!BT)
165  BT.reset(new BugType(this, "Nullability", categories::MemoryError));
166 
167  auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
168  if (Region) {
169  R->markInteresting(Region);
170  R->addVisitor(llvm::make_unique<NullabilityBugVisitor>(Region));
171  }
172  if (ValueExpr) {
173  R->addRange(ValueExpr->getSourceRange());
174  if (Error == ErrorKind::NilAssignedToNonnull ||
175  Error == ErrorKind::NilPassedToNonnull ||
176  Error == ErrorKind::NilReturnedToNonnull)
177  if (const auto *Ex = dyn_cast<Expr>(ValueExpr))
178  bugreporter::trackExpressionValue(N, Ex, *R);
179  }
180  BR.emitReport(std::move(R));
181  }
182 
183  /// If an SVal wraps a region that should be tracked, it will return a pointer
184  /// to the wrapped region. Otherwise it will return a nullptr.
185  const SymbolicRegion *getTrackRegion(SVal Val,
186  bool CheckSuperRegion = false) const;
187 
188  /// Returns true if the call is diagnosable in the currrent analyzer
189  /// configuration.
190  bool isDiagnosableCall(const CallEvent &Call) const {
191  if (NoDiagnoseCallsToSystemHeaders && Call.isInSystemHeader())
192  return false;
193 
194  return true;
195  }
196 };
197 
198 class NullabilityState {
199 public:
200  NullabilityState(Nullability Nullab, const Stmt *Source = nullptr)
201  : Nullab(Nullab), Source(Source) {}
202 
203  const Stmt *getNullabilitySource() const { return Source; }
204 
205  Nullability getValue() const { return Nullab; }
206 
207  void Profile(llvm::FoldingSetNodeID &ID) const {
208  ID.AddInteger(static_cast<char>(Nullab));
209  ID.AddPointer(Source);
210  }
211 
212  void print(raw_ostream &Out) const {
213  Out << getNullabilityString(Nullab) << "\n";
214  }
215 
216 private:
217  Nullability Nullab;
218  // Source is the expression which determined the nullability. For example in a
219  // message like [nullable nonnull_returning] has nullable nullability, because
220  // the receiver is nullable. Here the receiver will be the source of the
221  // nullability. This is useful information when the diagnostics are generated.
222  const Stmt *Source;
223 };
224 
225 bool operator==(NullabilityState Lhs, NullabilityState Rhs) {
226  return Lhs.getValue() == Rhs.getValue() &&
227  Lhs.getNullabilitySource() == Rhs.getNullabilitySource();
228 }
229 
230 } // end anonymous namespace
231 
232 REGISTER_MAP_WITH_PROGRAMSTATE(NullabilityMap, const MemRegion *,
233  NullabilityState)
234 
235 // We say "the nullability type invariant is violated" when a location with a
236 // non-null type contains NULL or a function with a non-null return type returns
237 // NULL. Violations of the nullability type invariant can be detected either
238 // directly (for example, when NULL is passed as an argument to a nonnull
239 // parameter) or indirectly (for example, when, inside a function, the
240 // programmer defensively checks whether a nonnull parameter contains NULL and
241 // finds that it does).
242 //
243 // As a matter of policy, the nullability checker typically warns on direct
244 // violations of the nullability invariant (although it uses various
245 // heuristics to suppress warnings in some cases) but will not warn if the
246 // invariant has already been violated along the path (either directly or
247 // indirectly). As a practical matter, this prevents the analyzer from
248 // (1) warning on defensive code paths where a nullability precondition is
249 // determined to have been violated, (2) warning additional times after an
250 // initial direct violation has been discovered, and (3) warning after a direct
251 // violation that has been implicitly or explicitly suppressed (for
252 // example, with a cast of NULL to _Nonnull). In essence, once an invariant
253 // violation is detected on a path, this checker will be essentially turned off
254 // for the rest of the analysis
255 //
256 // The analyzer takes this approach (rather than generating a sink node) to
257 // ensure coverage of defensive paths, which may be important for backwards
258 // compatibility in codebases that were developed without nullability in mind.
259 REGISTER_TRAIT_WITH_PROGRAMSTATE(InvariantViolated, bool)
260 
261 enum class NullConstraint { IsNull, IsNotNull, Unknown };
262 
263 static NullConstraint getNullConstraint(DefinedOrUnknownSVal Val,
265  ConditionTruthVal Nullness = State->isNull(Val);
266  if (Nullness.isConstrainedFalse())
267  return NullConstraint::IsNotNull;
268  if (Nullness.isConstrainedTrue())
269  return NullConstraint::IsNull;
271 }
272 
273 const SymbolicRegion *
274 NullabilityChecker::getTrackRegion(SVal Val, bool CheckSuperRegion) const {
275  if (!NeedTracking)
276  return nullptr;
277 
278  auto RegionSVal = Val.getAs<loc::MemRegionVal>();
279  if (!RegionSVal)
280  return nullptr;
281 
282  const MemRegion *Region = RegionSVal->getRegion();
283 
284  if (CheckSuperRegion) {
285  if (auto FieldReg = Region->getAs<FieldRegion>())
286  return dyn_cast<SymbolicRegion>(FieldReg->getSuperRegion());
287  if (auto ElementReg = Region->getAs<ElementRegion>())
288  return dyn_cast<SymbolicRegion>(ElementReg->getSuperRegion());
289  }
290 
291  return dyn_cast<SymbolicRegion>(Region);
292 }
293 
294 std::shared_ptr<PathDiagnosticPiece>
295 NullabilityChecker::NullabilityBugVisitor::VisitNode(const ExplodedNode *N,
296  BugReporterContext &BRC,
297  BugReport &BR) {
298  ProgramStateRef State = N->getState();
299  ProgramStateRef StatePrev = N->getFirstPred()->getState();
300 
301  const NullabilityState *TrackedNullab = State->get<NullabilityMap>(Region);
302  const NullabilityState *TrackedNullabPrev =
303  StatePrev->get<NullabilityMap>(Region);
304  if (!TrackedNullab)
305  return nullptr;
306 
307  if (TrackedNullabPrev &&
308  TrackedNullabPrev->getValue() == TrackedNullab->getValue())
309  return nullptr;
310 
311  // Retrieve the associated statement.
312  const Stmt *S = TrackedNullab->getNullabilitySource();
313  if (!S || S->getBeginLoc().isInvalid()) {
315  }
316 
317  if (!S)
318  return nullptr;
319 
320  std::string InfoText =
321  (llvm::Twine("Nullability '") +
322  getNullabilityString(TrackedNullab->getValue()) + "' is inferred")
323  .str();
324 
325  // Generate the extra diagnostic.
326  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
327  N->getLocationContext());
328  return std::make_shared<PathDiagnosticEventPiece>(Pos, InfoText, true,
329  nullptr);
330 }
331 
332 /// Returns true when the value stored at the given location is null
333 /// and the passed in type is nonnnull.
335  SVal LV, QualType T) {
337  return false;
338 
339  auto RegionVal = LV.getAs<loc::MemRegionVal>();
340  if (!RegionVal)
341  return false;
342 
343  auto StoredVal =
344  State->getSVal(RegionVal->getRegion()).getAs<DefinedOrUnknownSVal>();
345  if (!StoredVal)
346  return false;
347 
348  if (getNullConstraint(*StoredVal, State) == NullConstraint::IsNull)
349  return true;
350 
351  return false;
352 }
353 
354 static bool
357  const LocationContext *LocCtxt) {
358  for (const auto *ParamDecl : Params) {
359  if (ParamDecl->isParameterPack())
360  break;
361 
362  SVal LV = State->getLValue(ParamDecl, LocCtxt);
364  ParamDecl->getType())) {
365  return true;
366  }
367  }
368  return false;
369 }
370 
371 static bool
373  const LocationContext *LocCtxt) {
374  auto *MD = dyn_cast<ObjCMethodDecl>(LocCtxt->getDecl());
375  if (!MD || !MD->isInstanceMethod())
376  return false;
377 
378  const ImplicitParamDecl *SelfDecl = LocCtxt->getSelfDecl();
379  if (!SelfDecl)
380  return false;
381 
382  SVal SelfVal = State->getSVal(State->getRegion(SelfDecl, LocCtxt));
383 
384  const ObjCObjectPointerType *SelfType =
385  dyn_cast<ObjCObjectPointerType>(SelfDecl->getType());
386  if (!SelfType)
387  return false;
388 
389  const ObjCInterfaceDecl *ID = SelfType->getInterfaceDecl();
390  if (!ID)
391  return false;
392 
393  for (const auto *IvarDecl : ID->ivars()) {
394  SVal LV = State->getLValue(IvarDecl, SelfVal);
395  if (checkValueAtLValForInvariantViolation(State, LV, IvarDecl->getType())) {
396  return true;
397  }
398  }
399  return false;
400 }
401 
402 static bool checkInvariantViolation(ProgramStateRef State, ExplodedNode *N,
403  CheckerContext &C) {
404  if (State->get<InvariantViolated>())
405  return true;
406 
407  const LocationContext *LocCtxt = C.getLocationContext();
408  const Decl *D = LocCtxt->getDecl();
409  if (!D)
410  return false;
411 
412  ArrayRef<ParmVarDecl*> Params;
413  if (const auto *BD = dyn_cast<BlockDecl>(D))
414  Params = BD->parameters();
415  else if (const auto *FD = dyn_cast<FunctionDecl>(D))
416  Params = FD->parameters();
417  else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
418  Params = MD->parameters();
419  else
420  return false;
421 
422  if (checkParamsForPreconditionViolation(Params, State, LocCtxt) ||
423  checkSelfIvarsForInvariantViolation(State, LocCtxt)) {
424  if (!N->isSink())
425  C.addTransition(State->set<InvariantViolated>(true), N);
426  return true;
427  }
428  return false;
429 }
430 
431 void NullabilityChecker::reportBugIfInvariantHolds(StringRef Msg,
432  ErrorKind Error, ExplodedNode *N, const MemRegion *Region,
433  CheckerContext &C, const Stmt *ValueExpr, bool SuppressPath) const {
434  ProgramStateRef OriginalState = N->getState();
435 
436  if (checkInvariantViolation(OriginalState, N, C))
437  return;
438  if (SuppressPath) {
439  OriginalState = OriginalState->set<InvariantViolated>(true);
440  N = C.addTransition(OriginalState, N);
441  }
442 
443  reportBug(Msg, Error, N, Region, C.getBugReporter(), ValueExpr);
444 }
445 
446 /// Cleaning up the program state.
447 void NullabilityChecker::checkDeadSymbols(SymbolReaper &SR,
448  CheckerContext &C) const {
449  if (!SR.hasDeadSymbols())
450  return;
451 
452  ProgramStateRef State = C.getState();
453  NullabilityMapTy Nullabilities = State->get<NullabilityMap>();
454  for (NullabilityMapTy::iterator I = Nullabilities.begin(),
455  E = Nullabilities.end();
456  I != E; ++I) {
457  const auto *Region = I->first->getAs<SymbolicRegion>();
458  assert(Region && "Non-symbolic region is tracked.");
459  if (SR.isDead(Region->getSymbol())) {
460  State = State->remove<NullabilityMap>(I->first);
461  }
462  }
463  // When one of the nonnull arguments are constrained to be null, nullability
464  // preconditions are violated. It is not enough to check this only when we
465  // actually report an error, because at that time interesting symbols might be
466  // reaped.
467  if (checkInvariantViolation(State, C.getPredecessor(), C))
468  return;
469  C.addTransition(State);
470 }
471 
472 /// This callback triggers when a pointer is dereferenced and the analyzer does
473 /// not know anything about the value of that pointer. When that pointer is
474 /// nullable, this code emits a warning.
475 void NullabilityChecker::checkEvent(ImplicitNullDerefEvent Event) const {
476  if (Event.SinkNode->getState()->get<InvariantViolated>())
477  return;
478 
479  const MemRegion *Region =
480  getTrackRegion(Event.Location, /*CheckSuperregion=*/true);
481  if (!Region)
482  return;
483 
484  ProgramStateRef State = Event.SinkNode->getState();
485  const NullabilityState *TrackedNullability =
486  State->get<NullabilityMap>(Region);
487 
488  if (!TrackedNullability)
489  return;
490 
491  if (Filter.CheckNullableDereferenced &&
492  TrackedNullability->getValue() == Nullability::Nullable) {
493  BugReporter &BR = *Event.BR;
494  // Do not suppress errors on defensive code paths, because dereferencing
495  // a nullable pointer is always an error.
496  if (Event.IsDirectDereference)
497  reportBug("Nullable pointer is dereferenced",
498  ErrorKind::NullableDereferenced, Event.SinkNode, Region, BR);
499  else {
500  reportBug("Nullable pointer is passed to a callee that requires a "
501  "non-null", ErrorKind::NullablePassedToNonnull,
502  Event.SinkNode, Region, BR);
503  }
504  }
505 }
506 
507 /// Find the outermost subexpression of E that is not an implicit cast.
508 /// This looks through the implicit casts to _Nonnull that ARC adds to
509 /// return expressions of ObjC types when the return type of the function or
510 /// method is non-null but the express is not.
511 static const Expr *lookThroughImplicitCasts(const Expr *E) {
512  assert(E);
513 
514  while (auto *ICE = dyn_cast<ImplicitCastExpr>(E)) {
515  E = ICE->getSubExpr();
516  }
517 
518  return E;
519 }
520 
521 /// This method check when nullable pointer or null value is returned from a
522 /// function that has nonnull return type.
523 void NullabilityChecker::checkPreStmt(const ReturnStmt *S,
524  CheckerContext &C) const {
525  auto RetExpr = S->getRetValue();
526  if (!RetExpr)
527  return;
528 
529  if (!RetExpr->getType()->isAnyPointerType())
530  return;
531 
532  ProgramStateRef State = C.getState();
533  if (State->get<InvariantViolated>())
534  return;
535 
536  auto RetSVal = C.getSVal(S).getAs<DefinedOrUnknownSVal>();
537  if (!RetSVal)
538  return;
539 
540  bool InSuppressedMethodFamily = false;
541 
542  QualType RequiredRetType;
543  AnalysisDeclContext *DeclCtxt =
544  C.getLocationContext()->getAnalysisDeclContext();
545  const Decl *D = DeclCtxt->getDecl();
546  if (auto *MD = dyn_cast<ObjCMethodDecl>(D)) {
547  // HACK: This is a big hammer to avoid warning when there are defensive
548  // nil checks in -init and -copy methods. We should add more sophisticated
549  // logic here to suppress on common defensive idioms but still
550  // warn when there is a likely problem.
551  ObjCMethodFamily Family = MD->getMethodFamily();
552  if (OMF_init == Family || OMF_copy == Family || OMF_mutableCopy == Family)
553  InSuppressedMethodFamily = true;
554 
555  RequiredRetType = MD->getReturnType();
556  } else if (auto *FD = dyn_cast<FunctionDecl>(D)) {
557  RequiredRetType = FD->getReturnType();
558  } else {
559  return;
560  }
561 
562  NullConstraint Nullness = getNullConstraint(*RetSVal, State);
563 
564  Nullability RequiredNullability = getNullabilityAnnotation(RequiredRetType);
565 
566  // If the returned value is null but the type of the expression
567  // generating it is nonnull then we will suppress the diagnostic.
568  // This enables explicit suppression when returning a nil literal in a
569  // function with a _Nonnull return type:
570  // return (NSString * _Nonnull)0;
571  Nullability RetExprTypeLevelNullability =
573 
574  bool NullReturnedFromNonNull = (RequiredNullability == Nullability::Nonnull &&
575  Nullness == NullConstraint::IsNull);
576  if (Filter.CheckNullReturnedFromNonnull &&
577  NullReturnedFromNonNull &&
578  RetExprTypeLevelNullability != Nullability::Nonnull &&
579  !InSuppressedMethodFamily &&
580  C.getLocationContext()->inTopFrame()) {
581  static CheckerProgramPointTag Tag(this, "NullReturnedFromNonnull");
582  ExplodedNode *N = C.generateErrorNode(State, &Tag);
583  if (!N)
584  return;
585 
586  SmallString<256> SBuf;
587  llvm::raw_svector_ostream OS(SBuf);
588  OS << (RetExpr->getType()->isObjCObjectPointerType() ? "nil" : "Null");
589  OS << " returned from a " << C.getDeclDescription(D) <<
590  " that is expected to return a non-null value";
591  reportBugIfInvariantHolds(OS.str(),
592  ErrorKind::NilReturnedToNonnull, N, nullptr, C,
593  RetExpr);
594  return;
595  }
596 
597  // If null was returned from a non-null function, mark the nullability
598  // invariant as violated even if the diagnostic was suppressed.
599  if (NullReturnedFromNonNull) {
600  State = State->set<InvariantViolated>(true);
601  C.addTransition(State);
602  return;
603  }
604 
605  const MemRegion *Region = getTrackRegion(*RetSVal);
606  if (!Region)
607  return;
608 
609  const NullabilityState *TrackedNullability =
610  State->get<NullabilityMap>(Region);
611  if (TrackedNullability) {
612  Nullability TrackedNullabValue = TrackedNullability->getValue();
613  if (Filter.CheckNullableReturnedFromNonnull &&
614  Nullness != NullConstraint::IsNotNull &&
615  TrackedNullabValue == Nullability::Nullable &&
616  RequiredNullability == Nullability::Nonnull) {
617  static CheckerProgramPointTag Tag(this, "NullableReturnedFromNonnull");
618  ExplodedNode *N = C.addTransition(State, C.getPredecessor(), &Tag);
619 
620  SmallString<256> SBuf;
621  llvm::raw_svector_ostream OS(SBuf);
622  OS << "Nullable pointer is returned from a " << C.getDeclDescription(D) <<
623  " that is expected to return a non-null value";
624 
625  reportBugIfInvariantHolds(OS.str(),
626  ErrorKind::NullableReturnedToNonnull, N,
627  Region, C);
628  }
629  return;
630  }
631  if (RequiredNullability == Nullability::Nullable) {
632  State = State->set<NullabilityMap>(Region,
633  NullabilityState(RequiredNullability,
634  S));
635  C.addTransition(State);
636  }
637 }
638 
639 /// This callback warns when a nullable pointer or a null value is passed to a
640 /// function that expects its argument to be nonnull.
641 void NullabilityChecker::checkPreCall(const CallEvent &Call,
642  CheckerContext &C) const {
643  if (!Call.getDecl())
644  return;
645 
646  ProgramStateRef State = C.getState();
647  if (State->get<InvariantViolated>())
648  return;
649 
650  ProgramStateRef OrigState = State;
651 
652  unsigned Idx = 0;
653  for (const ParmVarDecl *Param : Call.parameters()) {
654  if (Param->isParameterPack())
655  break;
656 
657  if (Idx >= Call.getNumArgs())
658  break;
659 
660  const Expr *ArgExpr = Call.getArgExpr(Idx);
661  auto ArgSVal = Call.getArgSVal(Idx++).getAs<DefinedOrUnknownSVal>();
662  if (!ArgSVal)
663  continue;
664 
665  if (!Param->getType()->isAnyPointerType() &&
666  !Param->getType()->isReferenceType())
667  continue;
668 
669  NullConstraint Nullness = getNullConstraint(*ArgSVal, State);
670 
671  Nullability RequiredNullability =
672  getNullabilityAnnotation(Param->getType());
673  Nullability ArgExprTypeLevelNullability =
674  getNullabilityAnnotation(ArgExpr->getType());
675 
676  unsigned ParamIdx = Param->getFunctionScopeIndex() + 1;
677 
678  if (Filter.CheckNullPassedToNonnull && Nullness == NullConstraint::IsNull &&
679  ArgExprTypeLevelNullability != Nullability::Nonnull &&
680  RequiredNullability == Nullability::Nonnull &&
681  isDiagnosableCall(Call)) {
682  ExplodedNode *N = C.generateErrorNode(State);
683  if (!N)
684  return;
685 
686  SmallString<256> SBuf;
687  llvm::raw_svector_ostream OS(SBuf);
688  OS << (Param->getType()->isObjCObjectPointerType() ? "nil" : "Null");
689  OS << " passed to a callee that requires a non-null " << ParamIdx
690  << llvm::getOrdinalSuffix(ParamIdx) << " parameter";
691  reportBugIfInvariantHolds(OS.str(), ErrorKind::NilPassedToNonnull, N,
692  nullptr, C,
693  ArgExpr, /*SuppressPath=*/false);
694  return;
695  }
696 
697  const MemRegion *Region = getTrackRegion(*ArgSVal);
698  if (!Region)
699  continue;
700 
701  const NullabilityState *TrackedNullability =
702  State->get<NullabilityMap>(Region);
703 
704  if (TrackedNullability) {
705  if (Nullness == NullConstraint::IsNotNull ||
706  TrackedNullability->getValue() != Nullability::Nullable)
707  continue;
708 
709  if (Filter.CheckNullablePassedToNonnull &&
710  RequiredNullability == Nullability::Nonnull &&
711  isDiagnosableCall(Call)) {
712  ExplodedNode *N = C.addTransition(State);
713  SmallString<256> SBuf;
714  llvm::raw_svector_ostream OS(SBuf);
715  OS << "Nullable pointer is passed to a callee that requires a non-null "
716  << ParamIdx << llvm::getOrdinalSuffix(ParamIdx) << " parameter";
717  reportBugIfInvariantHolds(OS.str(),
718  ErrorKind::NullablePassedToNonnull, N,
719  Region, C, ArgExpr, /*SuppressPath=*/true);
720  return;
721  }
722  if (Filter.CheckNullableDereferenced &&
723  Param->getType()->isReferenceType()) {
724  ExplodedNode *N = C.addTransition(State);
725  reportBugIfInvariantHolds("Nullable pointer is dereferenced",
726  ErrorKind::NullableDereferenced, N, Region,
727  C, ArgExpr, /*SuppressPath=*/true);
728  return;
729  }
730  continue;
731  }
732  // No tracked nullability yet.
733  if (ArgExprTypeLevelNullability != Nullability::Nullable)
734  continue;
735  State = State->set<NullabilityMap>(
736  Region, NullabilityState(ArgExprTypeLevelNullability, ArgExpr));
737  }
738  if (State != OrigState)
739  C.addTransition(State);
740 }
741 
742 /// Suppress the nullability warnings for some functions.
743 void NullabilityChecker::checkPostCall(const CallEvent &Call,
744  CheckerContext &C) const {
745  auto Decl = Call.getDecl();
746  if (!Decl)
747  return;
748  // ObjC Messages handles in a different callback.
749  if (Call.getKind() == CE_ObjCMessage)
750  return;
751  const FunctionType *FuncType = Decl->getFunctionType();
752  if (!FuncType)
753  return;
754  QualType ReturnType = FuncType->getReturnType();
755  if (!ReturnType->isAnyPointerType())
756  return;
757  ProgramStateRef State = C.getState();
758  if (State->get<InvariantViolated>())
759  return;
760 
761  const MemRegion *Region = getTrackRegion(Call.getReturnValue());
762  if (!Region)
763  return;
764 
765  // CG headers are misannotated. Do not warn for symbols that are the results
766  // of CG calls.
767  const SourceManager &SM = C.getSourceManager();
768  StringRef FilePath = SM.getFilename(SM.getSpellingLoc(Decl->getBeginLoc()));
769  if (llvm::sys::path::filename(FilePath).startswith("CG")) {
770  State = State->set<NullabilityMap>(Region, Nullability::Contradicted);
771  C.addTransition(State);
772  return;
773  }
774 
775  const NullabilityState *TrackedNullability =
776  State->get<NullabilityMap>(Region);
777 
778  if (!TrackedNullability &&
780  State = State->set<NullabilityMap>(Region, Nullability::Nullable);
781  C.addTransition(State);
782  }
783 }
784 
787  if (M.isReceiverSelfOrSuper()) {
788  // For super and super class receivers we assume that the receiver is
789  // nonnull.
790  return Nullability::Nonnull;
791  }
792  // Otherwise look up nullability in the state.
793  SVal Receiver = M.getReceiverSVal();
794  if (auto DefOrUnknown = Receiver.getAs<DefinedOrUnknownSVal>()) {
795  // If the receiver is constrained to be nonnull, assume that it is nonnull
796  // regardless of its type.
797  NullConstraint Nullness = getNullConstraint(*DefOrUnknown, State);
798  if (Nullness == NullConstraint::IsNotNull)
799  return Nullability::Nonnull;
800  }
801  auto ValueRegionSVal = Receiver.getAs<loc::MemRegionVal>();
802  if (ValueRegionSVal) {
803  const MemRegion *SelfRegion = ValueRegionSVal->getRegion();
804  assert(SelfRegion);
805 
806  const NullabilityState *TrackedSelfNullability =
807  State->get<NullabilityMap>(SelfRegion);
808  if (TrackedSelfNullability)
809  return TrackedSelfNullability->getValue();
810  }
812 }
813 
814 /// Calculate the nullability of the result of a message expr based on the
815 /// nullability of the receiver, the nullability of the return value, and the
816 /// constraints.
817 void NullabilityChecker::checkPostObjCMessage(const ObjCMethodCall &M,
818  CheckerContext &C) const {
819  auto Decl = M.getDecl();
820  if (!Decl)
821  return;
822  QualType RetType = Decl->getReturnType();
823  if (!RetType->isAnyPointerType())
824  return;
825 
826  ProgramStateRef State = C.getState();
827  if (State->get<InvariantViolated>())
828  return;
829 
830  const MemRegion *ReturnRegion = getTrackRegion(M.getReturnValue());
831  if (!ReturnRegion)
832  return;
833 
834  auto Interface = Decl->getClassInterface();
835  auto Name = Interface ? Interface->getName() : "";
836  // In order to reduce the noise in the diagnostics generated by this checker,
837  // some framework and programming style based heuristics are used. These
838  // heuristics are for Cocoa APIs which have NS prefix.
839  if (Name.startswith("NS")) {
840  // Developers rely on dynamic invariants such as an item should be available
841  // in a collection, or a collection is not empty often. Those invariants can
842  // not be inferred by any static analysis tool. To not to bother the users
843  // with too many false positives, every item retrieval function should be
844  // ignored for collections. The instance methods of dictionaries in Cocoa
845  // are either item retrieval related or not interesting nullability wise.
846  // Using this fact, to keep the code easier to read just ignore the return
847  // value of every instance method of dictionaries.
848  if (M.isInstanceMessage() && Name.contains("Dictionary")) {
849  State =
850  State->set<NullabilityMap>(ReturnRegion, Nullability::Contradicted);
851  C.addTransition(State);
852  return;
853  }
854  // For similar reasons ignore some methods of Cocoa arrays.
855  StringRef FirstSelectorSlot = M.getSelector().getNameForSlot(0);
856  if (Name.contains("Array") &&
857  (FirstSelectorSlot == "firstObject" ||
858  FirstSelectorSlot == "lastObject")) {
859  State =
860  State->set<NullabilityMap>(ReturnRegion, Nullability::Contradicted);
861  C.addTransition(State);
862  return;
863  }
864 
865  // Encoding related methods of string should not fail when lossless
866  // encodings are used. Using lossless encodings is so frequent that ignoring
867  // this class of methods reduced the emitted diagnostics by about 30% on
868  // some projects (and all of that was false positives).
869  if (Name.contains("String")) {
870  for (auto Param : M.parameters()) {
871  if (Param->getName() == "encoding") {
872  State = State->set<NullabilityMap>(ReturnRegion,
874  C.addTransition(State);
875  return;
876  }
877  }
878  }
879  }
880 
881  const ObjCMessageExpr *Message = M.getOriginExpr();
882  Nullability SelfNullability = getReceiverNullability(M, State);
883 
884  const NullabilityState *NullabilityOfReturn =
885  State->get<NullabilityMap>(ReturnRegion);
886 
887  if (NullabilityOfReturn) {
888  // When we have a nullability tracked for the return value, the nullability
889  // of the expression will be the most nullable of the receiver and the
890  // return value.
891  Nullability RetValTracked = NullabilityOfReturn->getValue();
892  Nullability ComputedNullab =
893  getMostNullable(RetValTracked, SelfNullability);
894  if (ComputedNullab != RetValTracked &&
895  ComputedNullab != Nullability::Unspecified) {
896  const Stmt *NullabilitySource =
897  ComputedNullab == RetValTracked
898  ? NullabilityOfReturn->getNullabilitySource()
899  : Message->getInstanceReceiver();
900  State = State->set<NullabilityMap>(
901  ReturnRegion, NullabilityState(ComputedNullab, NullabilitySource));
902  C.addTransition(State);
903  }
904  return;
905  }
906 
907  // No tracked information. Use static type information for return value.
908  Nullability RetNullability = getNullabilityAnnotation(RetType);
909 
910  // Properties might be computed. For this reason the static analyzer creates a
911  // new symbol each time an unknown property is read. To avoid false pozitives
912  // do not treat unknown properties as nullable, even when they explicitly
913  // marked nullable.
914  if (M.getMessageKind() == OCM_PropertyAccess && !C.wasInlined)
915  RetNullability = Nullability::Nonnull;
916 
917  Nullability ComputedNullab = getMostNullable(RetNullability, SelfNullability);
918  if (ComputedNullab == Nullability::Nullable) {
919  const Stmt *NullabilitySource = ComputedNullab == RetNullability
920  ? Message
921  : Message->getInstanceReceiver();
922  State = State->set<NullabilityMap>(
923  ReturnRegion, NullabilityState(ComputedNullab, NullabilitySource));
924  C.addTransition(State);
925  }
926 }
927 
928 /// Explicit casts are trusted. If there is a disagreement in the nullability
929 /// annotations in the destination and the source or '0' is casted to nonnull
930 /// track the value as having contraditory nullability. This will allow users to
931 /// suppress warnings.
932 void NullabilityChecker::checkPostStmt(const ExplicitCastExpr *CE,
933  CheckerContext &C) const {
934  QualType OriginType = CE->getSubExpr()->getType();
935  QualType DestType = CE->getType();
936  if (!OriginType->isAnyPointerType())
937  return;
938  if (!DestType->isAnyPointerType())
939  return;
940 
941  ProgramStateRef State = C.getState();
942  if (State->get<InvariantViolated>())
943  return;
944 
945  Nullability DestNullability = getNullabilityAnnotation(DestType);
946 
947  // No explicit nullability in the destination type, so this cast does not
948  // change the nullability.
949  if (DestNullability == Nullability::Unspecified)
950  return;
951 
952  auto RegionSVal = C.getSVal(CE).getAs<DefinedOrUnknownSVal>();
953  const MemRegion *Region = getTrackRegion(*RegionSVal);
954  if (!Region)
955  return;
956 
957  // When 0 is converted to nonnull mark it as contradicted.
958  if (DestNullability == Nullability::Nonnull) {
959  NullConstraint Nullness = getNullConstraint(*RegionSVal, State);
960  if (Nullness == NullConstraint::IsNull) {
961  State = State->set<NullabilityMap>(Region, Nullability::Contradicted);
962  C.addTransition(State);
963  return;
964  }
965  }
966 
967  const NullabilityState *TrackedNullability =
968  State->get<NullabilityMap>(Region);
969 
970  if (!TrackedNullability) {
971  if (DestNullability != Nullability::Nullable)
972  return;
973  State = State->set<NullabilityMap>(Region,
974  NullabilityState(DestNullability, CE));
975  C.addTransition(State);
976  return;
977  }
978 
979  if (TrackedNullability->getValue() != DestNullability &&
980  TrackedNullability->getValue() != Nullability::Contradicted) {
981  State = State->set<NullabilityMap>(Region, Nullability::Contradicted);
982  C.addTransition(State);
983  }
984 }
985 
986 /// For a given statement performing a bind, attempt to syntactically
987 /// match the expression resulting in the bound value.
988 static const Expr * matchValueExprForBind(const Stmt *S) {
989  // For `x = e` the value expression is the right-hand side.
990  if (auto *BinOp = dyn_cast<BinaryOperator>(S)) {
991  if (BinOp->getOpcode() == BO_Assign)
992  return BinOp->getRHS();
993  }
994 
995  // For `int x = e` the value expression is the initializer.
996  if (auto *DS = dyn_cast<DeclStmt>(S)) {
997  if (DS->isSingleDecl()) {
998  auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
999  if (!VD)
1000  return nullptr;
1001 
1002  if (const Expr *Init = VD->getInit())
1003  return Init;
1004  }
1005  }
1006 
1007  return nullptr;
1008 }
1009 
1010 /// Returns true if \param S is a DeclStmt for a local variable that
1011 /// ObjC automated reference counting initialized with zero.
1012 static bool isARCNilInitializedLocal(CheckerContext &C, const Stmt *S) {
1013  // We suppress diagnostics for ARC zero-initialized _Nonnull locals. This
1014  // prevents false positives when a _Nonnull local variable cannot be
1015  // initialized with an initialization expression:
1016  // NSString * _Nonnull s; // no-warning
1017  // @autoreleasepool {
1018  // s = ...
1019  // }
1020  //
1021  // FIXME: We should treat implicitly zero-initialized _Nonnull locals as
1022  // uninitialized in Sema's UninitializedValues analysis to warn when a use of
1023  // the zero-initialized definition will unexpectedly yield nil.
1024 
1025  // Locals are only zero-initialized when automated reference counting
1026  // is turned on.
1027  if (!C.getASTContext().getLangOpts().ObjCAutoRefCount)
1028  return false;
1029 
1030  auto *DS = dyn_cast<DeclStmt>(S);
1031  if (!DS || !DS->isSingleDecl())
1032  return false;
1033 
1034  auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
1035  if (!VD)
1036  return false;
1037 
1038  // Sema only zero-initializes locals with ObjCLifetimes.
1039  if(!VD->getType().getQualifiers().hasObjCLifetime())
1040  return false;
1041 
1042  const Expr *Init = VD->getInit();
1043  assert(Init && "ObjC local under ARC without initializer");
1044 
1045  // Return false if the local is explicitly initialized (e.g., with '= nil').
1046  if (!isa<ImplicitValueInitExpr>(Init))
1047  return false;
1048 
1049  return true;
1050 }
1051 
1052 /// Propagate the nullability information through binds and warn when nullable
1053 /// pointer or null symbol is assigned to a pointer with a nonnull type.
1054 void NullabilityChecker::checkBind(SVal L, SVal V, const Stmt *S,
1055  CheckerContext &C) const {
1056  const TypedValueRegion *TVR =
1057  dyn_cast_or_null<TypedValueRegion>(L.getAsRegion());
1058  if (!TVR)
1059  return;
1060 
1061  QualType LocType = TVR->getValueType();
1062  if (!LocType->isAnyPointerType())
1063  return;
1064 
1065  ProgramStateRef State = C.getState();
1066  if (State->get<InvariantViolated>())
1067  return;
1068 
1069  auto ValDefOrUnknown = V.getAs<DefinedOrUnknownSVal>();
1070  if (!ValDefOrUnknown)
1071  return;
1072 
1073  NullConstraint RhsNullness = getNullConstraint(*ValDefOrUnknown, State);
1074 
1075  Nullability ValNullability = Nullability::Unspecified;
1076  if (SymbolRef Sym = ValDefOrUnknown->getAsSymbol())
1077  ValNullability = getNullabilityAnnotation(Sym->getType());
1078 
1079  Nullability LocNullability = getNullabilityAnnotation(LocType);
1080 
1081  // If the type of the RHS expression is nonnull, don't warn. This
1082  // enables explicit suppression with a cast to nonnull.
1083  Nullability ValueExprTypeLevelNullability = Nullability::Unspecified;
1084  const Expr *ValueExpr = matchValueExprForBind(S);
1085  if (ValueExpr) {
1086  ValueExprTypeLevelNullability =
1087  getNullabilityAnnotation(lookThroughImplicitCasts(ValueExpr)->getType());
1088  }
1089 
1090  bool NullAssignedToNonNull = (LocNullability == Nullability::Nonnull &&
1091  RhsNullness == NullConstraint::IsNull);
1092  if (Filter.CheckNullPassedToNonnull &&
1093  NullAssignedToNonNull &&
1094  ValNullability != Nullability::Nonnull &&
1095  ValueExprTypeLevelNullability != Nullability::Nonnull &&
1096  !isARCNilInitializedLocal(C, S)) {
1097  static CheckerProgramPointTag Tag(this, "NullPassedToNonnull");
1098  ExplodedNode *N = C.generateErrorNode(State, &Tag);
1099  if (!N)
1100  return;
1101 
1102 
1103  const Stmt *ValueStmt = S;
1104  if (ValueExpr)
1105  ValueStmt = ValueExpr;
1106 
1107  SmallString<256> SBuf;
1108  llvm::raw_svector_ostream OS(SBuf);
1109  OS << (LocType->isObjCObjectPointerType() ? "nil" : "Null");
1110  OS << " assigned to a pointer which is expected to have non-null value";
1111  reportBugIfInvariantHolds(OS.str(),
1112  ErrorKind::NilAssignedToNonnull, N, nullptr, C,
1113  ValueStmt);
1114  return;
1115  }
1116 
1117  // If null was returned from a non-null function, mark the nullability
1118  // invariant as violated even if the diagnostic was suppressed.
1119  if (NullAssignedToNonNull) {
1120  State = State->set<InvariantViolated>(true);
1121  C.addTransition(State);
1122  return;
1123  }
1124 
1125  // Intentionally missing case: '0' is bound to a reference. It is handled by
1126  // the DereferenceChecker.
1127 
1128  const MemRegion *ValueRegion = getTrackRegion(*ValDefOrUnknown);
1129  if (!ValueRegion)
1130  return;
1131 
1132  const NullabilityState *TrackedNullability =
1133  State->get<NullabilityMap>(ValueRegion);
1134 
1135  if (TrackedNullability) {
1136  if (RhsNullness == NullConstraint::IsNotNull ||
1137  TrackedNullability->getValue() != Nullability::Nullable)
1138  return;
1139  if (Filter.CheckNullablePassedToNonnull &&
1140  LocNullability == Nullability::Nonnull) {
1141  static CheckerProgramPointTag Tag(this, "NullablePassedToNonnull");
1142  ExplodedNode *N = C.addTransition(State, C.getPredecessor(), &Tag);
1143  reportBugIfInvariantHolds("Nullable pointer is assigned to a pointer "
1144  "which is expected to have non-null value",
1145  ErrorKind::NullableAssignedToNonnull, N,
1146  ValueRegion, C);
1147  }
1148  return;
1149  }
1150 
1151  const auto *BinOp = dyn_cast<BinaryOperator>(S);
1152 
1153  if (ValNullability == Nullability::Nullable) {
1154  // Trust the static information of the value more than the static
1155  // information on the location.
1156  const Stmt *NullabilitySource = BinOp ? BinOp->getRHS() : S;
1157  State = State->set<NullabilityMap>(
1158  ValueRegion, NullabilityState(ValNullability, NullabilitySource));
1159  C.addTransition(State);
1160  return;
1161  }
1162 
1163  if (LocNullability == Nullability::Nullable) {
1164  const Stmt *NullabilitySource = BinOp ? BinOp->getLHS() : S;
1165  State = State->set<NullabilityMap>(
1166  ValueRegion, NullabilityState(LocNullability, NullabilitySource));
1167  C.addTransition(State);
1168  }
1169 }
1170 
1171 void NullabilityChecker::printState(raw_ostream &Out, ProgramStateRef State,
1172  const char *NL, const char *Sep) const {
1173 
1174  NullabilityMapTy B = State->get<NullabilityMap>();
1175 
1176  if (B.isEmpty())
1177  return;
1178 
1179  Out << Sep << NL;
1180 
1181  for (NullabilityMapTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
1182  Out << I->first << " : ";
1183  I->second.print(Out);
1184  Out << NL;
1185  }
1186 }
1187 
1188 #define REGISTER_CHECKER(name, trackingRequired) \
1189  void ento::register##name##Checker(CheckerManager &mgr) { \
1190  NullabilityChecker *checker = mgr.registerChecker<NullabilityChecker>(); \
1191  checker->Filter.Check##name = true; \
1192  checker->Filter.CheckName##name = mgr.getCurrentCheckName(); \
1193  checker->NeedTracking = checker->NeedTracking || trackingRequired; \
1194  checker->NoDiagnoseCallsToSystemHeaders = \
1195  checker->NoDiagnoseCallsToSystemHeaders || \
1196  mgr.getAnalyzerOptions().getCheckerBooleanOption( \
1197  "NoDiagnoseCallsToSystemHeaders", false, checker, true); \
1198  }
1199 
1200 // The checks are likely to be turned on by default and it is possible to do
1201 // them without tracking any nullability related information. As an optimization
1202 // no nullability information will be tracked when only these two checks are
1203 // enables.
1204 REGISTER_CHECKER(NullPassedToNonnull, false)
1205 REGISTER_CHECKER(NullReturnedFromNonnull, false)
1206 
1207 REGISTER_CHECKER(NullableDereferenced, true)
1208 REGISTER_CHECKER(NullablePassedToNonnull, true)
1209 REGISTER_CHECKER(NullableReturnedFromNonnull, true)
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:959
static bool checkParamsForPreconditionViolation(ArrayRef< ParmVarDecl *> Params, ProgramStateRef State, const LocationContext *LocCtxt)
A (possibly-)qualified type.
Definition: Type.h:642
bool operator==(CanQual< T > x, CanQual< U > y)
const SymExpr * SymbolRef
Stmt - This represents one statement.
Definition: Stmt.h:66
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3361
static bool checkValueAtLValForInvariantViolation(ProgramStateRef State, SVal LV, QualType T)
Returns true when the value stored at the given location is null and the passed in type is nonnnull...
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:87
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: DeclBase.h:410
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
ivar_range ivars() const
Definition: DeclObjC.h:1450
static Nullability getReceiverNullability(const ObjCMethodCall &M, ProgramStateRef State)
Represents a variable declaration or definition.
Definition: Decl.h:812
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
Represents a parameter to a function.
Definition: Decl.h:1551
static NullConstraint getNullConstraint(DefinedOrUnknownSVal Val, ProgramStateRef State)
LineState State
ObjCMethodFamily
A family of Objective-C methods.
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Stmt.cpp:280
AnalysisDeclContext contains the context data for the function or method under analysis.
Expr * getSubExpr()
Definition: Expr.h:2968
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:970
const ImplicitParamDecl * getSelfDecl() const
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3219
SourceLocation getSpellingLoc(SourceLocation Loc) const
Given a SourceLocation object, return the spelling location referenced by the ID. ...
Represents an ObjC class declaration.
Definition: DeclObjC.h:1164
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to &#39;self&#39; or &#39;super&#39;.
Definition: CallEvent.cpp:975
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:919
const FunctionType * getFunctionType(bool BlocksToo=true) const
Looks through the Decl&#39;s underlying type to extract a FunctionType when possible. ...
Definition: DeclBase.cpp:964
A single parameter index whose accessors require each use to make explicit the parameter index encodi...
Definition: Attr.h:213
This represents one expression.
Definition: Expr.h:106
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
QualType getType() const
Definition: Expr.h:128
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2177
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:904
#define REGISTER_CHECKER(name, trackingRequired)
const SourceManager & SM
Definition: Format.cpp:1490
REGISTER_MAP_WITH_PROGRAMSTATE(NullabilityMap, const MemRegion *, NullabilityState) enum class NullConstraint
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
StringRef getFilename(SourceLocation SpellingLoc) const
Return the filename of the file containing a SourceLocation.
llvm::cl::opt< std::string > Filter
#define false
Definition: stdbool.h:33
#define REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, Type)
Declares a program state trait for type Type called Name, and introduce a type named NameTy...
QualType getReturnType() const
Definition: Type.h:3617
Expr * getRetValue()
Definition: Stmt.h:2210
static bool isARCNilInitializedLocal(CheckerContext &C, const Stmt *S)
Returns true if.
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:877
static const Expr * lookThroughImplicitCasts(const Expr *E)
Find the outermost subexpression of E that is not an implicit cast.
const Decl * getDecl() const
bool isObjCObjectPointerType() const
Definition: Type.h:6379
bool isAnyPointerType() const
Definition: Type.h:6286
static bool checkInvariantViolation(ProgramStateRef State, ExplodedNode *N, CheckerContext &C)
static const Expr * matchValueExprForBind(const Stmt *S)
For a given statement performing a bind, attempt to syntactically match the expression resulting in t...
const ObjCMethodDecl * getDecl() const override
Definition: CallEvent.h:998
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1207
virtual const ObjCMessageExpr * getOriginExpr() const
Definition: CallEvent.h:994
Selector getSelector() const
Definition: CallEvent.h:1018
Dataflow Directional Tag Classes.
Nullability getNullabilityAnnotation(QualType Type)
Get nullability annotation for a given type.
ExplicitCastExpr - An explicit cast written in the source code.
Definition: Expr.h:3117
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1019
const Decl * getDecl() const
Represents a pointer to an Objective C object.
Definition: Type.h:5780
bool isInstanceMessage() const
Definition: CallEvent.h:1010
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5836
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13853
static bool checkSelfIvarsForInvariantViolation(ProgramStateRef State, const LocationContext *LocCtxt)
__DEVICE__ int min(int __a, int __b)
QualType getType() const
Definition: Decl.h:647
#define true
Definition: stdbool.h:32
This class handles loading and caching of source files into memory.