clang  9.0.0svn
UninitializedValues.cpp
Go to the documentation of this file.
1 //===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements uninitialized values analysis for source-level CFGs.
10 //
11 //===----------------------------------------------------------------------===//
12 
14 #include "clang/AST/Attr.h"
15 #include "clang/AST/Decl.h"
16 #include "clang/AST/DeclBase.h"
17 #include "clang/AST/Expr.h"
19 #include "clang/AST/Stmt.h"
20 #include "clang/AST/StmtObjC.h"
21 #include "clang/AST/StmtVisitor.h"
22 #include "clang/AST/Type.h"
25 #include "clang/Analysis/CFG.h"
27 #include "clang/Basic/LLVM.h"
28 #include "llvm/ADT/BitVector.h"
29 #include "llvm/ADT/DenseMap.h"
30 #include "llvm/ADT/None.h"
31 #include "llvm/ADT/Optional.h"
32 #include "llvm/ADT/PackedVector.h"
33 #include "llvm/ADT/SmallBitVector.h"
34 #include "llvm/ADT/SmallVector.h"
35 #include "llvm/Support/Casting.h"
36 #include <algorithm>
37 #include <cassert>
38 
39 using namespace clang;
40 
41 #define DEBUG_LOGGING 0
42 
43 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
44  if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
45  !vd->isExceptionVariable() && !vd->isInitCapture() &&
46  !vd->isImplicit() && vd->getDeclContext() == dc) {
47  QualType ty = vd->getType();
48  return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
49  }
50  return false;
51 }
52 
53 //------------------------------------------------------------------------====//
54 // DeclToIndex: a mapping from Decls we track to value indices.
55 //====------------------------------------------------------------------------//
56 
57 namespace {
58 
59 class DeclToIndex {
60  llvm::DenseMap<const VarDecl *, unsigned> map;
61 
62 public:
63  DeclToIndex() = default;
64 
65  /// Compute the actual mapping from declarations to bits.
66  void computeMap(const DeclContext &dc);
67 
68  /// Return the number of declarations in the map.
69  unsigned size() const { return map.size(); }
70 
71  /// Returns the bit vector index for a given declaration.
72  Optional<unsigned> getValueIndex(const VarDecl *d) const;
73 };
74 
75 } // namespace
76 
77 void DeclToIndex::computeMap(const DeclContext &dc) {
78  unsigned count = 0;
80  E(dc.decls_end());
81  for ( ; I != E; ++I) {
82  const VarDecl *vd = *I;
83  if (isTrackedVar(vd, &dc))
84  map[vd] = count++;
85  }
86 }
87 
88 Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
89  llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
90  if (I == map.end())
91  return None;
92  return I->second;
93 }
94 
95 //------------------------------------------------------------------------====//
96 // CFGBlockValues: dataflow values for CFG blocks.
97 //====------------------------------------------------------------------------//
98 
99 // These values are defined in such a way that a merge can be done using
100 // a bitwise OR.
101 enum Value { Unknown = 0x0, /* 00 */
102  Initialized = 0x1, /* 01 */
103  Uninitialized = 0x2, /* 10 */
104  MayUninitialized = 0x3 /* 11 */ };
105 
106 static bool isUninitialized(const Value v) {
107  return v >= Uninitialized;
108 }
109 
110 static bool isAlwaysUninit(const Value v) {
111  return v == Uninitialized;
112 }
113 
114 namespace {
115 
116 using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
117 
118 class CFGBlockValues {
119  const CFG &cfg;
121  ValueVector scratch;
122  DeclToIndex declToIndex;
123 
124 public:
125  CFGBlockValues(const CFG &cfg);
126 
127  unsigned getNumEntries() const { return declToIndex.size(); }
128 
129  void computeSetOfDeclarations(const DeclContext &dc);
130 
131  ValueVector &getValueVector(const CFGBlock *block) {
132  return vals[block->getBlockID()];
133  }
134 
135  void setAllScratchValues(Value V);
136  void mergeIntoScratch(ValueVector const &source, bool isFirst);
137  bool updateValueVectorWithScratch(const CFGBlock *block);
138 
139  bool hasNoDeclarations() const {
140  return declToIndex.size() == 0;
141  }
142 
143  void resetScratch();
144 
145  ValueVector::reference operator[](const VarDecl *vd);
146 
147  Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
148  const VarDecl *vd) {
149  const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
150  assert(idx.hasValue());
151  return getValueVector(block)[idx.getValue()];
152  }
153 };
154 
155 } // namespace
156 
157 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
158 
159 void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
160  declToIndex.computeMap(dc);
161  unsigned decls = declToIndex.size();
162  scratch.resize(decls);
163  unsigned n = cfg.getNumBlockIDs();
164  if (!n)
165  return;
166  vals.resize(n);
167  for (auto &val : vals)
168  val.resize(decls);
169 }
170 
171 #if DEBUG_LOGGING
172 static void printVector(const CFGBlock *block, ValueVector &bv,
173  unsigned num) {
174  llvm::errs() << block->getBlockID() << " :";
175  for (const auto &i : bv)
176  llvm::errs() << ' ' << i;
177  llvm::errs() << " : " << num << '\n';
178 }
179 #endif
180 
181 void CFGBlockValues::setAllScratchValues(Value V) {
182  for (unsigned I = 0, E = scratch.size(); I != E; ++I)
183  scratch[I] = V;
184 }
185 
186 void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
187  bool isFirst) {
188  if (isFirst)
189  scratch = source;
190  else
191  scratch |= source;
192 }
193 
194 bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
195  ValueVector &dst = getValueVector(block);
196  bool changed = (dst != scratch);
197  if (changed)
198  dst = scratch;
199 #if DEBUG_LOGGING
200  printVector(block, scratch, 0);
201 #endif
202  return changed;
203 }
204 
205 void CFGBlockValues::resetScratch() {
206  scratch.reset();
207 }
208 
209 ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
210  const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
211  assert(idx.hasValue());
212  return scratch[idx.getValue()];
213 }
214 
215 //------------------------------------------------------------------------====//
216 // Worklist: worklist for dataflow analysis.
217 //====------------------------------------------------------------------------//
218 
219 namespace {
220 
221 class DataflowWorklist {
222  PostOrderCFGView::iterator PO_I, PO_E;
224  llvm::BitVector enqueuedBlocks;
225 
226 public:
227  DataflowWorklist(const CFG &cfg, PostOrderCFGView &view)
228  : PO_I(view.begin()), PO_E(view.end()),
229  enqueuedBlocks(cfg.getNumBlockIDs(), true) {
230  // Treat the first block as already analyzed.
231  if (PO_I != PO_E) {
232  assert(*PO_I == &cfg.getEntry());
233  enqueuedBlocks[(*PO_I)->getBlockID()] = false;
234  ++PO_I;
235  }
236  }
237 
238  void enqueueSuccessors(const CFGBlock *block);
239  const CFGBlock *dequeue();
240 };
241 
242 } // namespace
243 
244 void DataflowWorklist::enqueueSuccessors(const CFGBlock *block) {
245  for (CFGBlock::const_succ_iterator I = block->succ_begin(),
246  E = block->succ_end(); I != E; ++I) {
247  const CFGBlock *Successor = *I;
248  if (!Successor || enqueuedBlocks[Successor->getBlockID()])
249  continue;
250  worklist.push_back(Successor);
251  enqueuedBlocks[Successor->getBlockID()] = true;
252  }
253 }
254 
255 const CFGBlock *DataflowWorklist::dequeue() {
256  const CFGBlock *B = nullptr;
257 
258  // First dequeue from the worklist. This can represent
259  // updates along backedges that we want propagated as quickly as possible.
260  if (!worklist.empty())
261  B = worklist.pop_back_val();
262 
263  // Next dequeue from the initial reverse post order. This is the
264  // theoretical ideal in the presence of no back edges.
265  else if (PO_I != PO_E) {
266  B = *PO_I;
267  ++PO_I;
268  }
269  else
270  return nullptr;
271 
272  assert(enqueuedBlocks[B->getBlockID()] == true);
273  enqueuedBlocks[B->getBlockID()] = false;
274  return B;
275 }
276 
277 //------------------------------------------------------------------------====//
278 // Classification of DeclRefExprs as use or initialization.
279 //====------------------------------------------------------------------------//
280 
281 namespace {
282 
283 class FindVarResult {
284  const VarDecl *vd;
285  const DeclRefExpr *dr;
286 
287 public:
288  FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
289 
290  const DeclRefExpr *getDeclRefExpr() const { return dr; }
291  const VarDecl *getDecl() const { return vd; }
292 };
293 
294 } // namespace
295 
296 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
297  while (Ex) {
298  Ex = Ex->IgnoreParenNoopCasts(C);
299  if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
300  if (CE->getCastKind() == CK_LValueBitCast) {
301  Ex = CE->getSubExpr();
302  continue;
303  }
304  }
305  break;
306  }
307  return Ex;
308 }
309 
310 /// If E is an expression comprising a reference to a single variable, find that
311 /// variable.
312 static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
313  if (const auto *DRE =
314  dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
315  if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
316  if (isTrackedVar(VD, DC))
317  return FindVarResult(VD, DRE);
318  return FindVarResult(nullptr, nullptr);
319 }
320 
321 namespace {
322 
323 /// Classify each DeclRefExpr as an initialization or a use. Any
324 /// DeclRefExpr which isn't explicitly classified will be assumed to have
325 /// escaped the analysis and will be treated as an initialization.
326 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
327 public:
328  enum Class {
329  Init,
330  Use,
331  SelfInit,
332  Ignore
333  };
334 
335 private:
336  const DeclContext *DC;
337  llvm::DenseMap<const DeclRefExpr *, Class> Classification;
338 
339  bool isTrackedVar(const VarDecl *VD) const {
340  return ::isTrackedVar(VD, DC);
341  }
342 
343  void classify(const Expr *E, Class C);
344 
345 public:
346  ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
347 
348  void VisitDeclStmt(DeclStmt *DS);
349  void VisitUnaryOperator(UnaryOperator *UO);
350  void VisitBinaryOperator(BinaryOperator *BO);
351  void VisitCallExpr(CallExpr *CE);
352  void VisitCastExpr(CastExpr *CE);
353 
354  void operator()(Stmt *S) { Visit(S); }
355 
356  Class get(const DeclRefExpr *DRE) const {
357  llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
358  = Classification.find(DRE);
359  if (I != Classification.end())
360  return I->second;
361 
362  const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
363  if (!VD || !isTrackedVar(VD))
364  return Ignore;
365 
366  return Init;
367  }
368 };
369 
370 } // namespace
371 
372 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
373  if (VD->getType()->isRecordType())
374  return nullptr;
375  if (Expr *Init = VD->getInit()) {
376  const auto *DRE =
377  dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
378  if (DRE && DRE->getDecl() == VD)
379  return DRE;
380  }
381  return nullptr;
382 }
383 
384 void ClassifyRefs::classify(const Expr *E, Class C) {
385  // The result of a ?: could also be an lvalue.
386  E = E->IgnoreParens();
387  if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
388  classify(CO->getTrueExpr(), C);
389  classify(CO->getFalseExpr(), C);
390  return;
391  }
392 
393  if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
394  classify(BCO->getFalseExpr(), C);
395  return;
396  }
397 
398  if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
399  classify(OVE->getSourceExpr(), C);
400  return;
401  }
402 
403  if (const auto *ME = dyn_cast<MemberExpr>(E)) {
404  if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
405  if (!VD->isStaticDataMember())
406  classify(ME->getBase(), C);
407  }
408  return;
409  }
410 
411  if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
412  switch (BO->getOpcode()) {
413  case BO_PtrMemD:
414  case BO_PtrMemI:
415  classify(BO->getLHS(), C);
416  return;
417  case BO_Comma:
418  classify(BO->getRHS(), C);
419  return;
420  default:
421  return;
422  }
423  }
424 
425  FindVarResult Var = findVar(E, DC);
426  if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
427  Classification[DRE] = std::max(Classification[DRE], C);
428 }
429 
430 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
431  for (auto *DI : DS->decls()) {
432  auto *VD = dyn_cast<VarDecl>(DI);
433  if (VD && isTrackedVar(VD))
434  if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
435  Classification[DRE] = SelfInit;
436  }
437 }
438 
439 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
440  // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
441  // is not a compound-assignment, we will treat it as initializing the variable
442  // when TransferFunctions visits it. A compound-assignment does not affect
443  // whether a variable is uninitialized, and there's no point counting it as a
444  // use.
445  if (BO->isCompoundAssignmentOp())
446  classify(BO->getLHS(), Use);
447  else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
448  classify(BO->getLHS(), Ignore);
449 }
450 
451 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
452  // Increment and decrement are uses despite there being no lvalue-to-rvalue
453  // conversion.
454  if (UO->isIncrementDecrementOp())
455  classify(UO->getSubExpr(), Use);
456 }
457 
458 static bool isPointerToConst(const QualType &QT) {
459  return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
460 }
461 
462 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
463  // Classify arguments to std::move as used.
464  if (CE->isCallToStdMove()) {
465  // RecordTypes are handled in SemaDeclCXX.cpp.
466  if (!CE->getArg(0)->getType()->isRecordType())
467  classify(CE->getArg(0), Use);
468  return;
469  }
470 
471  // If a value is passed by const pointer or by const reference to a function,
472  // we should not assume that it is initialized by the call, and we
473  // conservatively do not assume that it is used.
474  for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
475  I != E; ++I) {
476  if ((*I)->isGLValue()) {
477  if ((*I)->getType().isConstQualified())
478  classify((*I), Ignore);
479  } else if (isPointerToConst((*I)->getType())) {
480  const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
481  const auto *UO = dyn_cast<UnaryOperator>(Ex);
482  if (UO && UO->getOpcode() == UO_AddrOf)
483  Ex = UO->getSubExpr();
484  classify(Ex, Ignore);
485  }
486  }
487 }
488 
489 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
490  if (CE->getCastKind() == CK_LValueToRValue)
491  classify(CE->getSubExpr(), Use);
492  else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
493  if (CSE->getType()->isVoidType()) {
494  // Squelch any detected load of an uninitialized value if
495  // we cast it to void.
496  // e.g. (void) x;
497  classify(CSE->getSubExpr(), Ignore);
498  }
499  }
500 }
501 
502 //------------------------------------------------------------------------====//
503 // Transfer function for uninitialized values analysis.
504 //====------------------------------------------------------------------------//
505 
506 namespace {
507 
508 class TransferFunctions : public StmtVisitor<TransferFunctions> {
509  CFGBlockValues &vals;
510  const CFG &cfg;
511  const CFGBlock *block;
513  const ClassifyRefs &classification;
514  ObjCNoReturn objCNoRet;
515  UninitVariablesHandler &handler;
516 
517 public:
518  TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
519  const CFGBlock *block, AnalysisDeclContext &ac,
520  const ClassifyRefs &classification,
521  UninitVariablesHandler &handler)
522  : vals(vals), cfg(cfg), block(block), ac(ac),
523  classification(classification), objCNoRet(ac.getASTContext()),
524  handler(handler) {}
525 
526  void reportUse(const Expr *ex, const VarDecl *vd);
527 
528  void VisitBinaryOperator(BinaryOperator *bo);
529  void VisitBlockExpr(BlockExpr *be);
530  void VisitCallExpr(CallExpr *ce);
531  void VisitDeclRefExpr(DeclRefExpr *dr);
532  void VisitDeclStmt(DeclStmt *ds);
533  void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
534  void VisitObjCMessageExpr(ObjCMessageExpr *ME);
535 
536  bool isTrackedVar(const VarDecl *vd) {
537  return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
538  }
539 
540  FindVarResult findVar(const Expr *ex) {
541  return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
542  }
543 
544  UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
545  UninitUse Use(ex, isAlwaysUninit(v));
546 
547  assert(isUninitialized(v));
548  if (Use.getKind() == UninitUse::Always)
549  return Use;
550 
551  // If an edge which leads unconditionally to this use did not initialize
552  // the variable, we can say something stronger than 'may be uninitialized':
553  // we can say 'either it's used uninitialized or you have dead code'.
554  //
555  // We track the number of successors of a node which have been visited, and
556  // visit a node once we have visited all of its successors. Only edges where
557  // the variable might still be uninitialized are followed. Since a variable
558  // can't transfer from being initialized to being uninitialized, this will
559  // trace out the subgraph which inevitably leads to the use and does not
560  // initialize the variable. We do not want to skip past loops, since their
561  // non-termination might be correlated with the initialization condition.
562  //
563  // For example:
564  //
565  // void f(bool a, bool b) {
566  // block1: int n;
567  // if (a) {
568  // block2: if (b)
569  // block3: n = 1;
570  // block4: } else if (b) {
571  // block5: while (!a) {
572  // block6: do_work(&a);
573  // n = 2;
574  // }
575  // }
576  // block7: if (a)
577  // block8: g();
578  // block9: return n;
579  // }
580  //
581  // Starting from the maybe-uninitialized use in block 9:
582  // * Block 7 is not visited because we have only visited one of its two
583  // successors.
584  // * Block 8 is visited because we've visited its only successor.
585  // From block 8:
586  // * Block 7 is visited because we've now visited both of its successors.
587  // From block 7:
588  // * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
589  // of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
590  // * Block 3 is not visited because it initializes 'n'.
591  // Now the algorithm terminates, having visited blocks 7 and 8, and having
592  // found the frontier is blocks 2, 4, and 5.
593  //
594  // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
595  // and 4), so we report that any time either of those edges is taken (in
596  // each case when 'b == false'), 'n' is used uninitialized.
598  SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
599  Queue.push_back(block);
600  // Specify that we've already visited all successors of the starting block.
601  // This has the dual purpose of ensuring we never add it to the queue, and
602  // of marking it as not being a candidate element of the frontier.
603  SuccsVisited[block->getBlockID()] = block->succ_size();
604  while (!Queue.empty()) {
605  const CFGBlock *B = Queue.pop_back_val();
606 
607  // If the use is always reached from the entry block, make a note of that.
608  if (B == &cfg.getEntry())
609  Use.setUninitAfterCall();
610 
611  for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
612  I != E; ++I) {
613  const CFGBlock *Pred = *I;
614  if (!Pred)
615  continue;
616 
617  Value AtPredExit = vals.getValue(Pred, B, vd);
618  if (AtPredExit == Initialized)
619  // This block initializes the variable.
620  continue;
621  if (AtPredExit == MayUninitialized &&
622  vals.getValue(B, nullptr, vd) == Uninitialized) {
623  // This block declares the variable (uninitialized), and is reachable
624  // from a block that initializes the variable. We can't guarantee to
625  // give an earlier location for the diagnostic (and it appears that
626  // this code is intended to be reachable) so give a diagnostic here
627  // and go no further down this path.
628  Use.setUninitAfterDecl();
629  continue;
630  }
631 
632  unsigned &SV = SuccsVisited[Pred->getBlockID()];
633  if (!SV) {
634  // When visiting the first successor of a block, mark all NULL
635  // successors as having been visited.
636  for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
637  SE = Pred->succ_end();
638  SI != SE; ++SI)
639  if (!*SI)
640  ++SV;
641  }
642 
643  if (++SV == Pred->succ_size())
644  // All paths from this block lead to the use and don't initialize the
645  // variable.
646  Queue.push_back(Pred);
647  }
648  }
649 
650  // Scan the frontier, looking for blocks where the variable was
651  // uninitialized.
652  for (const auto *Block : cfg) {
653  unsigned BlockID = Block->getBlockID();
654  const Stmt *Term = Block->getTerminator();
655  if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
656  Term) {
657  // This block inevitably leads to the use. If we have an edge from here
658  // to a post-dominator block, and the variable is uninitialized on that
659  // edge, we have found a bug.
660  for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
661  E = Block->succ_end(); I != E; ++I) {
662  const CFGBlock *Succ = *I;
663  if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
664  vals.getValue(Block, Succ, vd) == Uninitialized) {
665  // Switch cases are a special case: report the label to the caller
666  // as the 'terminator', not the switch statement itself. Suppress
667  // situations where no label matched: we can't be sure that's
668  // possible.
669  if (isa<SwitchStmt>(Term)) {
670  const Stmt *Label = Succ->getLabel();
671  if (!Label || !isa<SwitchCase>(Label))
672  // Might not be possible.
673  continue;
674  UninitUse::Branch Branch;
675  Branch.Terminator = Label;
676  Branch.Output = 0; // Ignored.
677  Use.addUninitBranch(Branch);
678  } else {
679  UninitUse::Branch Branch;
680  Branch.Terminator = Term;
681  Branch.Output = I - Block->succ_begin();
682  Use.addUninitBranch(Branch);
683  }
684  }
685  }
686  }
687  }
688 
689  return Use;
690  }
691 };
692 
693 } // namespace
694 
695 void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
696  Value v = vals[vd];
697  if (isUninitialized(v))
698  handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
699 }
700 
701 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
702  // This represents an initialization of the 'element' value.
703  if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
704  const auto *VD = cast<VarDecl>(DS->getSingleDecl());
705  if (isTrackedVar(VD))
706  vals[VD] = Initialized;
707  }
708 }
709 
710 void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
711  const BlockDecl *bd = be->getBlockDecl();
712  for (const auto &I : bd->captures()) {
713  const VarDecl *vd = I.getVariable();
714  if (!isTrackedVar(vd))
715  continue;
716  if (I.isByRef()) {
717  vals[vd] = Initialized;
718  continue;
719  }
720  reportUse(be, vd);
721  }
722 }
723 
724 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
725  if (Decl *Callee = ce->getCalleeDecl()) {
726  if (Callee->hasAttr<ReturnsTwiceAttr>()) {
727  // After a call to a function like setjmp or vfork, any variable which is
728  // initialized anywhere within this function may now be initialized. For
729  // now, just assume such a call initializes all variables. FIXME: Only
730  // mark variables as initialized if they have an initializer which is
731  // reachable from here.
732  vals.setAllScratchValues(Initialized);
733  }
734  else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
735  // Functions labeled like "analyzer_noreturn" are often used to denote
736  // "panic" functions that in special debug situations can still return,
737  // but for the most part should not be treated as returning. This is a
738  // useful annotation borrowed from the static analyzer that is useful for
739  // suppressing branch-specific false positives when we call one of these
740  // functions but keep pretending the path continues (when in reality the
741  // user doesn't care).
742  vals.setAllScratchValues(Unknown);
743  }
744  }
745 }
746 
747 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
748  switch (classification.get(dr)) {
749  case ClassifyRefs::Ignore:
750  break;
751  case ClassifyRefs::Use:
752  reportUse(dr, cast<VarDecl>(dr->getDecl()));
753  break;
754  case ClassifyRefs::Init:
755  vals[cast<VarDecl>(dr->getDecl())] = Initialized;
756  break;
757  case ClassifyRefs::SelfInit:
758  handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
759  break;
760  }
761 }
762 
763 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
764  if (BO->getOpcode() == BO_Assign) {
765  FindVarResult Var = findVar(BO->getLHS());
766  if (const VarDecl *VD = Var.getDecl())
767  vals[VD] = Initialized;
768  }
769 }
770 
771 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
772  for (auto *DI : DS->decls()) {
773  auto *VD = dyn_cast<VarDecl>(DI);
774  if (VD && isTrackedVar(VD)) {
775  if (getSelfInitExpr(VD)) {
776  // If the initializer consists solely of a reference to itself, we
777  // explicitly mark the variable as uninitialized. This allows code
778  // like the following:
779  //
780  // int x = x;
781  //
782  // to deliberately leave a variable uninitialized. Different analysis
783  // clients can detect this pattern and adjust their reporting
784  // appropriately, but we need to continue to analyze subsequent uses
785  // of the variable.
786  vals[VD] = Uninitialized;
787  } else if (VD->getInit()) {
788  // Treat the new variable as initialized.
789  vals[VD] = Initialized;
790  } else {
791  // No initializer: the variable is now uninitialized. This matters
792  // for cases like:
793  // while (...) {
794  // int n;
795  // use(n);
796  // n = 0;
797  // }
798  // FIXME: Mark the variable as uninitialized whenever its scope is
799  // left, since its scope could be re-entered by a jump over the
800  // declaration.
801  vals[VD] = Uninitialized;
802  }
803  }
804  }
805 }
806 
807 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
808  // If the Objective-C message expression is an implicit no-return that
809  // is not modeled in the CFG, set the tracked dataflow values to Unknown.
810  if (objCNoRet.isImplicitNoReturn(ME)) {
811  vals.setAllScratchValues(Unknown);
812  }
813 }
814 
815 //------------------------------------------------------------------------====//
816 // High-level "driver" logic for uninitialized values analysis.
817 //====------------------------------------------------------------------------//
818 
819 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
820  AnalysisDeclContext &ac, CFGBlockValues &vals,
821  const ClassifyRefs &classification,
822  llvm::BitVector &wasAnalyzed,
823  UninitVariablesHandler &handler) {
824  wasAnalyzed[block->getBlockID()] = true;
825  vals.resetScratch();
826  // Merge in values of predecessor blocks.
827  bool isFirst = true;
828  for (CFGBlock::const_pred_iterator I = block->pred_begin(),
829  E = block->pred_end(); I != E; ++I) {
830  const CFGBlock *pred = *I;
831  if (!pred)
832  continue;
833  if (wasAnalyzed[pred->getBlockID()]) {
834  vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
835  isFirst = false;
836  }
837  }
838  // Apply the transfer function.
839  TransferFunctions tf(vals, cfg, block, ac, classification, handler);
840  for (const auto &I : *block) {
841  if (Optional<CFGStmt> cs = I.getAs<CFGStmt>())
842  tf.Visit(const_cast<Stmt *>(cs->getStmt()));
843  }
844  return vals.updateValueVectorWithScratch(block);
845 }
846 
847 namespace {
848 
849 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
850 /// to detect when a CFGBlock has any *potential* use of an uninitialized
851 /// variable. It is mainly used to prune out work during the final
852 /// reporting pass.
853 struct PruneBlocksHandler : public UninitVariablesHandler {
854  /// Records if a CFGBlock had a potential use of an uninitialized variable.
855  llvm::BitVector hadUse;
856 
857  /// Records if any CFGBlock had a potential use of an uninitialized variable.
858  bool hadAnyUse = false;
859 
860  /// The current block to scribble use information.
861  unsigned currentBlock = 0;
862 
863  PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
864 
865  ~PruneBlocksHandler() override = default;
866 
867  void handleUseOfUninitVariable(const VarDecl *vd,
868  const UninitUse &use) override {
869  hadUse[currentBlock] = true;
870  hadAnyUse = true;
871  }
872 
873  /// Called when the uninitialized variable analysis detects the
874  /// idiom 'int x = x'. All other uses of 'x' within the initializer
875  /// are handled by handleUseOfUninitVariable.
876  void handleSelfInit(const VarDecl *vd) override {
877  hadUse[currentBlock] = true;
878  hadAnyUse = true;
879  }
880 };
881 
882 } // namespace
883 
885  const DeclContext &dc,
886  const CFG &cfg,
888  UninitVariablesHandler &handler,
890  CFGBlockValues vals(cfg);
891  vals.computeSetOfDeclarations(dc);
892  if (vals.hasNoDeclarations())
893  return;
894 
895  stats.NumVariablesAnalyzed = vals.getNumEntries();
896 
897  // Precompute which expressions are uses and which are initializations.
898  ClassifyRefs classification(ac);
899  cfg.VisitBlockStmts(classification);
900 
901  // Mark all variables uninitialized at the entry.
902  const CFGBlock &entry = cfg.getEntry();
903  ValueVector &vec = vals.getValueVector(&entry);
904  const unsigned n = vals.getNumEntries();
905  for (unsigned j = 0; j < n; ++j) {
906  vec[j] = Uninitialized;
907  }
908 
909  // Proceed with the workist.
910  DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>());
911  llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
912  worklist.enqueueSuccessors(&cfg.getEntry());
913  llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
914  wasAnalyzed[cfg.getEntry().getBlockID()] = true;
915  PruneBlocksHandler PBH(cfg.getNumBlockIDs());
916 
917  while (const CFGBlock *block = worklist.dequeue()) {
918  PBH.currentBlock = block->getBlockID();
919 
920  // Did the block change?
921  bool changed = runOnBlock(block, cfg, ac, vals,
922  classification, wasAnalyzed, PBH);
923  ++stats.NumBlockVisits;
924  if (changed || !previouslyVisited[block->getBlockID()])
925  worklist.enqueueSuccessors(block);
926  previouslyVisited[block->getBlockID()] = true;
927  }
928 
929  if (!PBH.hadAnyUse)
930  return;
931 
932  // Run through the blocks one more time, and report uninitialized variables.
933  for (const auto *block : cfg)
934  if (PBH.hadUse[block->getBlockID()]) {
935  runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
936  ++stats.NumBlockVisits;
937  }
938 }
939 
const BlockDecl * getBlockDecl() const
Definition: Expr.h:5468
bool isCallToStdMove() const
Definition: Expr.h:2688
pred_iterator pred_end()
Definition: CFG.h:733
A (possibly-)qualified type.
Definition: Type.h:639
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2591
AdjacentBlocks::const_iterator const_pred_iterator
Definition: CFG.h:719
succ_iterator succ_begin()
Definition: CFG.h:750
Stmt - This represents one statement.
Definition: Stmt.h:65
CFGBlock & getEntry()
Definition: CFG.h:1092
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:505
C Language Family Type Representation.
bool isRecordType() const
Definition: Type.h:6416
unsigned getBlockID() const
Definition: CFG.h:855
static bool isPointerToConst(const QualType &QT)
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
Opcode getOpcode() const
Definition: Expr.h:3353
static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc)
static const Expr * stripCasts(ASTContext &C, const Expr *Ex)
unsigned succ_size() const
Definition: CFG.h:768
Represents a variable declaration or definition.
Definition: Decl.h:812
ASTContext & getASTContext() const
Defines the Objective-C statement AST node classes.
Kind getKind() const
Get the kind of uninitialized use.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
AnalysisDeclContext contains the context data for the function or method under analysis.
static bool isIncrementDecrementOp(Opcode Op)
Definition: Expr.h:2007
Expr * getSubExpr()
Definition: Expr.h:3093
static bool isAlwaysUninit(const Value v)
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:726
static bool runOnBlock(const CFGBlock *block, const CFG &cfg, AnalysisDeclContext &ac, CFGBlockValues &vals, const ClassifyRefs &classification, llvm::BitVector &wasAnalyzed, UninitVariablesHandler &handler)
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
T * getAnalysis()
Return the specified analysis object, lazily running the analysis if necessary.
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3318
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3041
bool isScalarType() const
Definition: Type.h:6684
arg_iterator arg_end()
Definition: Expr.h:2636
Represents a single basic block in a source-level CFG.
Definition: CFG.h:551
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3863
This represents one expression.
Definition: Expr.h:108
std::string Label
Represents a source-level, intra-procedural CFG that represents the control-flow of a Stmt...
Definition: CFG.h:1002
#define V(N, I)
Definition: ASTContext.h:2905
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5454
bool isImplicit() const
isImplicit - Indicates whether the declaration was implicitly generated by the implementation.
Definition: DeclBase.h:551
bool isExceptionVariable() const
Determine whether this variable is the exception variable in a C++ catch statememt or an Objective-C ...
Definition: Decl.h:1306
DeclContext * getDeclContext()
Definition: DeclBase.h:431
static FindVarResult findVar(const Expr *E, const DeclContext *DC)
If E is an expression comprising a reference to a single variable, find that variable.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
void runUninitializedVariablesAnalysis(const DeclContext &dc, const CFG &cfg, AnalysisDeclContext &ac, UninitVariablesHandler &handler, UninitVariablesAnalysisStats &stats)
QualType getType() const
Definition: Expr.h:130
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:950
UnaryOperator - This represents the unary-expression&#39;s (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
Definition: Expr.h:1934
ValueDecl * getDecl()
Definition: Expr.h:1147
A use of a variable, which might be uninitialized.
do v
Definition: arm_acle.h:64
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6178
Stmt * getLabel()
Definition: CFG.h:850
decl_iterator decls_begin() const
Definition: DeclBase.cpp:1374
Expr * getSubExpr() const
Definition: Expr.h:1964
CastKind getCastKind() const
Definition: Expr.h:3087
ASTContext & getASTContext() const LLVM_READONLY
Definition: DeclBase.cpp:376
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1170
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition: StmtVisitor.h:182
bool hasGlobalStorage() const
Returns true for all variables that do not have local storage.
Definition: Decl.h:1077
const Decl * getDecl() const
bool isAnyPointerType() const
Definition: Type.h:6347
std::vector< const CFGBlock * >::reverse_iterator iterator
unsigned getNumBlockIDs() const
Returns the total number of BlockIDs allocated (which start at 0).
Definition: CFG.h:1168
bool isVectorType() const
Definition: Type.h:6428
succ_iterator succ_end()
Definition: CFG.h:751
Expr * getLHS() const
Definition: Expr.h:3358
static const DeclRefExpr * getSelfInitExpr(VarDecl *VD)
pred_iterator pred_begin()
Definition: CFG.h:732
Dataflow Directional Tag Classes.
void VisitBlockStmts(CALLBACK &O) const
Definition: CFG.h:1154
DeclContext - This is used only as base class of specific decl types that can act as declaration cont...
Definition: DeclBase.h:1264
ArrayRef< Capture > captures() const
Definition: Decl.h:3990
const Expr * getInit() const
Definition: Decl.h:1219
const Decl * getSingleDecl() const
Definition: Stmt.h:1185
bool isInitCapture() const
Whether this variable is the implicit variable for a lambda init-capture.
Definition: Decl.h:1390
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
Definition: DeclBase.h:2032
Iterator for iterating over Stmt * arrays that contain only T *.
Definition: Stmt.h:1014
The use is always uninitialized.
Represents Objective-C&#39;s collection statement.
Definition: StmtObjC.h:23
arg_iterator arg_begin()
Definition: Expr.h:2633
decl_range decls()
Definition: Stmt.h:1218
static bool isCompoundAssignmentOp(Opcode Opc)
Definition: Expr.h:3449
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2434
ASTContext & getParentASTContext() const
Definition: DeclBase.h:1792
__DEVICE__ int max(int __a, int __b)
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1074
bool isLocalVarDecl() const
Returns true for local variable declarations other than parameters.
Definition: Decl.h:1104
QualType getType() const
Definition: Decl.h:647
void addUninitBranch(Branch B)
Expr * IgnoreParenNoopCasts(const ASTContext &Ctx) LLVM_READONLY
Skip past any parenthese and casts which do not change the value (including ptr->int casts of the sam...
Definition: Expr.cpp:2836
Decl * getCalleeDecl()
Definition: Expr.h:2564
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
Definition: Expr.cpp:2805
decl_iterator decls_end() const
Definition: DeclBase.h:2014
static bool isUninitialized(const Value v)