clang  6.0.0svn
UninitializedValues.cpp
Go to the documentation of this file.
1 //==- UninitializedValues.cpp - Find Uninitialized Values -------*- C++ --*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file implements uninitialized values analysis for source-level CFGs.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/AST/ASTContext.h"
15 #include "clang/AST/Attr.h"
16 #include "clang/AST/Decl.h"
17 #include "clang/AST/DeclCXX.h"
18 #include "clang/AST/StmtVisitor.h"
22 #include "clang/Analysis/CFG.h"
24 #include "llvm/ADT/DenseMap.h"
25 #include "llvm/ADT/Optional.h"
26 #include "llvm/ADT/PackedVector.h"
27 #include "llvm/ADT/SmallBitVector.h"
28 #include "llvm/ADT/SmallVector.h"
29 #include "llvm/Support/SaveAndRestore.h"
30 #include <utility>
31 
32 using namespace clang;
33 
34 #define DEBUG_LOGGING 0
35 
36 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
37  if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
38  !vd->isExceptionVariable() && !vd->isInitCapture() &&
39  !vd->isImplicit() && vd->getDeclContext() == dc) {
40  QualType ty = vd->getType();
41  return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
42  }
43  return false;
44 }
45 
46 //------------------------------------------------------------------------====//
47 // DeclToIndex: a mapping from Decls we track to value indices.
48 //====------------------------------------------------------------------------//
49 
50 namespace {
51 class DeclToIndex {
52  llvm::DenseMap<const VarDecl *, unsigned> map;
53 public:
54  DeclToIndex() {}
55 
56  /// Compute the actual mapping from declarations to bits.
57  void computeMap(const DeclContext &dc);
58 
59  /// Return the number of declarations in the map.
60  unsigned size() const { return map.size(); }
61 
62  /// Returns the bit vector index for a given declaration.
63  Optional<unsigned> getValueIndex(const VarDecl *d) const;
64 };
65 }
66 
67 void DeclToIndex::computeMap(const DeclContext &dc) {
68  unsigned count = 0;
70  E(dc.decls_end());
71  for ( ; I != E; ++I) {
72  const VarDecl *vd = *I;
73  if (isTrackedVar(vd, &dc))
74  map[vd] = count++;
75  }
76 }
77 
78 Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
79  llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
80  if (I == map.end())
81  return None;
82  return I->second;
83 }
84 
85 //------------------------------------------------------------------------====//
86 // CFGBlockValues: dataflow values for CFG blocks.
87 //====------------------------------------------------------------------------//
88 
89 // These values are defined in such a way that a merge can be done using
90 // a bitwise OR.
91 enum Value { Unknown = 0x0, /* 00 */
92  Initialized = 0x1, /* 01 */
93  Uninitialized = 0x2, /* 10 */
94  MayUninitialized = 0x3 /* 11 */ };
95 
96 static bool isUninitialized(const Value v) {
97  return v >= Uninitialized;
98 }
99 static bool isAlwaysUninit(const Value v) {
100  return v == Uninitialized;
101 }
102 
103 namespace {
104 
105 typedef llvm::PackedVector<Value, 2, llvm::SmallBitVector> ValueVector;
106 
107 class CFGBlockValues {
108  const CFG &cfg;
110  ValueVector scratch;
111  DeclToIndex declToIndex;
112 public:
113  CFGBlockValues(const CFG &cfg);
114 
115  unsigned getNumEntries() const { return declToIndex.size(); }
116 
117  void computeSetOfDeclarations(const DeclContext &dc);
118  ValueVector &getValueVector(const CFGBlock *block) {
119  return vals[block->getBlockID()];
120  }
121 
122  void setAllScratchValues(Value V);
123  void mergeIntoScratch(ValueVector const &source, bool isFirst);
124  bool updateValueVectorWithScratch(const CFGBlock *block);
125 
126  bool hasNoDeclarations() const {
127  return declToIndex.size() == 0;
128  }
129 
130  void resetScratch();
131 
132  ValueVector::reference operator[](const VarDecl *vd);
133 
134  Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
135  const VarDecl *vd) {
136  const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
137  assert(idx.hasValue());
138  return getValueVector(block)[idx.getValue()];
139  }
140 };
141 } // end anonymous namespace
142 
143 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
144 
145 void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
146  declToIndex.computeMap(dc);
147  unsigned decls = declToIndex.size();
148  scratch.resize(decls);
149  unsigned n = cfg.getNumBlockIDs();
150  if (!n)
151  return;
152  vals.resize(n);
153  for (unsigned i = 0; i < n; ++i)
154  vals[i].resize(decls);
155 }
156 
157 #if DEBUG_LOGGING
158 static void printVector(const CFGBlock *block, ValueVector &bv,
159  unsigned num) {
160  llvm::errs() << block->getBlockID() << " :";
161  for (unsigned i = 0; i < bv.size(); ++i) {
162  llvm::errs() << ' ' << bv[i];
163  }
164  llvm::errs() << " : " << num << '\n';
165 }
166 #endif
167 
168 void CFGBlockValues::setAllScratchValues(Value V) {
169  for (unsigned I = 0, E = scratch.size(); I != E; ++I)
170  scratch[I] = V;
171 }
172 
173 void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
174  bool isFirst) {
175  if (isFirst)
176  scratch = source;
177  else
178  scratch |= source;
179 }
180 
181 bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
182  ValueVector &dst = getValueVector(block);
183  bool changed = (dst != scratch);
184  if (changed)
185  dst = scratch;
186 #if DEBUG_LOGGING
187  printVector(block, scratch, 0);
188 #endif
189  return changed;
190 }
191 
192 void CFGBlockValues::resetScratch() {
193  scratch.reset();
194 }
195 
196 ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
197  const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
198  assert(idx.hasValue());
199  return scratch[idx.getValue()];
200 }
201 
202 //------------------------------------------------------------------------====//
203 // Worklist: worklist for dataflow analysis.
204 //====------------------------------------------------------------------------//
205 
206 namespace {
207 class DataflowWorklist {
208  PostOrderCFGView::iterator PO_I, PO_E;
210  llvm::BitVector enqueuedBlocks;
211 public:
212  DataflowWorklist(const CFG &cfg, PostOrderCFGView &view)
213  : PO_I(view.begin()), PO_E(view.end()),
214  enqueuedBlocks(cfg.getNumBlockIDs(), true) {
215  // Treat the first block as already analyzed.
216  if (PO_I != PO_E) {
217  assert(*PO_I == &cfg.getEntry());
218  enqueuedBlocks[(*PO_I)->getBlockID()] = false;
219  ++PO_I;
220  }
221  }
222 
223  void enqueueSuccessors(const CFGBlock *block);
224  const CFGBlock *dequeue();
225 };
226 }
227 
228 void DataflowWorklist::enqueueSuccessors(const clang::CFGBlock *block) {
229  for (CFGBlock::const_succ_iterator I = block->succ_begin(),
230  E = block->succ_end(); I != E; ++I) {
231  const CFGBlock *Successor = *I;
232  if (!Successor || enqueuedBlocks[Successor->getBlockID()])
233  continue;
234  worklist.push_back(Successor);
235  enqueuedBlocks[Successor->getBlockID()] = true;
236  }
237 }
238 
239 const CFGBlock *DataflowWorklist::dequeue() {
240  const CFGBlock *B = nullptr;
241 
242  // First dequeue from the worklist. This can represent
243  // updates along backedges that we want propagated as quickly as possible.
244  if (!worklist.empty())
245  B = worklist.pop_back_val();
246 
247  // Next dequeue from the initial reverse post order. This is the
248  // theoretical ideal in the presence of no back edges.
249  else if (PO_I != PO_E) {
250  B = *PO_I;
251  ++PO_I;
252  }
253  else {
254  return nullptr;
255  }
256 
257  assert(enqueuedBlocks[B->getBlockID()] == true);
258  enqueuedBlocks[B->getBlockID()] = false;
259  return B;
260 }
261 
262 //------------------------------------------------------------------------====//
263 // Classification of DeclRefExprs as use or initialization.
264 //====------------------------------------------------------------------------//
265 
266 namespace {
267 class FindVarResult {
268  const VarDecl *vd;
269  const DeclRefExpr *dr;
270 public:
271  FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
272 
273  const DeclRefExpr *getDeclRefExpr() const { return dr; }
274  const VarDecl *getDecl() const { return vd; }
275 };
276 
277 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
278  while (Ex) {
279  Ex = Ex->IgnoreParenNoopCasts(C);
280  if (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) {
281  if (CE->getCastKind() == CK_LValueBitCast) {
282  Ex = CE->getSubExpr();
283  continue;
284  }
285  }
286  break;
287  }
288  return Ex;
289 }
290 
291 /// If E is an expression comprising a reference to a single variable, find that
292 /// variable.
293 static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
294  if (const DeclRefExpr *DRE =
295  dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
296  if (const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl()))
297  if (isTrackedVar(VD, DC))
298  return FindVarResult(VD, DRE);
299  return FindVarResult(nullptr, nullptr);
300 }
301 
302 /// \brief Classify each DeclRefExpr as an initialization or a use. Any
303 /// DeclRefExpr which isn't explicitly classified will be assumed to have
304 /// escaped the analysis and will be treated as an initialization.
305 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
306 public:
307  enum Class {
308  Init,
309  Use,
310  SelfInit,
311  Ignore
312  };
313 
314 private:
315  const DeclContext *DC;
316  llvm::DenseMap<const DeclRefExpr*, Class> Classification;
317 
318  bool isTrackedVar(const VarDecl *VD) const {
319  return ::isTrackedVar(VD, DC);
320  }
321 
322  void classify(const Expr *E, Class C);
323 
324 public:
325  ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
326 
327  void VisitDeclStmt(DeclStmt *DS);
328  void VisitUnaryOperator(UnaryOperator *UO);
329  void VisitBinaryOperator(BinaryOperator *BO);
330  void VisitCallExpr(CallExpr *CE);
331  void VisitCastExpr(CastExpr *CE);
332 
333  void operator()(Stmt *S) { Visit(S); }
334 
335  Class get(const DeclRefExpr *DRE) const {
336  llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
337  = Classification.find(DRE);
338  if (I != Classification.end())
339  return I->second;
340 
341  const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl());
342  if (!VD || !isTrackedVar(VD))
343  return Ignore;
344 
345  return Init;
346  }
347 };
348 }
349 
350 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
351  if (VD->getType()->isRecordType())
352  return nullptr;
353  if (Expr *Init = VD->getInit()) {
354  const DeclRefExpr *DRE
355  = dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
356  if (DRE && DRE->getDecl() == VD)
357  return DRE;
358  }
359  return nullptr;
360 }
361 
362 void ClassifyRefs::classify(const Expr *E, Class C) {
363  // The result of a ?: could also be an lvalue.
364  E = E->IgnoreParens();
365  if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
366  classify(CO->getTrueExpr(), C);
367  classify(CO->getFalseExpr(), C);
368  return;
369  }
370 
371  if (const BinaryConditionalOperator *BCO =
372  dyn_cast<BinaryConditionalOperator>(E)) {
373  classify(BCO->getFalseExpr(), C);
374  return;
375  }
376 
377  if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) {
378  classify(OVE->getSourceExpr(), C);
379  return;
380  }
381 
382  if (const MemberExpr *ME = dyn_cast<MemberExpr>(E)) {
383  if (VarDecl *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
384  if (!VD->isStaticDataMember())
385  classify(ME->getBase(), C);
386  }
387  return;
388  }
389 
390  if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
391  switch (BO->getOpcode()) {
392  case BO_PtrMemD:
393  case BO_PtrMemI:
394  classify(BO->getLHS(), C);
395  return;
396  case BO_Comma:
397  classify(BO->getRHS(), C);
398  return;
399  default:
400  return;
401  }
402  }
403 
404  FindVarResult Var = findVar(E, DC);
405  if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
406  Classification[DRE] = std::max(Classification[DRE], C);
407 }
408 
409 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
410  for (auto *DI : DS->decls()) {
411  VarDecl *VD = dyn_cast<VarDecl>(DI);
412  if (VD && isTrackedVar(VD))
413  if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
414  Classification[DRE] = SelfInit;
415  }
416 }
417 
418 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
419  // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
420  // is not a compound-assignment, we will treat it as initializing the variable
421  // when TransferFunctions visits it. A compound-assignment does not affect
422  // whether a variable is uninitialized, and there's no point counting it as a
423  // use.
424  if (BO->isCompoundAssignmentOp())
425  classify(BO->getLHS(), Use);
426  else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
427  classify(BO->getLHS(), Ignore);
428 }
429 
430 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
431  // Increment and decrement are uses despite there being no lvalue-to-rvalue
432  // conversion.
433  if (UO->isIncrementDecrementOp())
434  classify(UO->getSubExpr(), Use);
435 }
436 
437 static bool isPointerToConst(const QualType &QT) {
438  return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
439 }
440 
441 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
442  // Classify arguments to std::move as used.
443  if (CE->isCallToStdMove()) {
444  // RecordTypes are handled in SemaDeclCXX.cpp.
445  if (!CE->getArg(0)->getType()->isRecordType())
446  classify(CE->getArg(0), Use);
447  return;
448  }
449 
450  // If a value is passed by const pointer or by const reference to a function,
451  // we should not assume that it is initialized by the call, and we
452  // conservatively do not assume that it is used.
453  for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
454  I != E; ++I) {
455  if ((*I)->isGLValue()) {
456  if ((*I)->getType().isConstQualified())
457  classify((*I), Ignore);
458  } else if (isPointerToConst((*I)->getType())) {
459  const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
460  const UnaryOperator *UO = dyn_cast<UnaryOperator>(Ex);
461  if (UO && UO->getOpcode() == UO_AddrOf)
462  Ex = UO->getSubExpr();
463  classify(Ex, Ignore);
464  }
465  }
466 }
467 
468 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
469  if (CE->getCastKind() == CK_LValueToRValue)
470  classify(CE->getSubExpr(), Use);
471  else if (CStyleCastExpr *CSE = dyn_cast<CStyleCastExpr>(CE)) {
472  if (CSE->getType()->isVoidType()) {
473  // Squelch any detected load of an uninitialized value if
474  // we cast it to void.
475  // e.g. (void) x;
476  classify(CSE->getSubExpr(), Ignore);
477  }
478  }
479 }
480 
481 //------------------------------------------------------------------------====//
482 // Transfer function for uninitialized values analysis.
483 //====------------------------------------------------------------------------//
484 
485 namespace {
486 class TransferFunctions : public StmtVisitor<TransferFunctions> {
487  CFGBlockValues &vals;
488  const CFG &cfg;
489  const CFGBlock *block;
491  const ClassifyRefs &classification;
492  ObjCNoReturn objCNoRet;
493  UninitVariablesHandler &handler;
494 
495 public:
496  TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
497  const CFGBlock *block, AnalysisDeclContext &ac,
498  const ClassifyRefs &classification,
499  UninitVariablesHandler &handler)
500  : vals(vals), cfg(cfg), block(block), ac(ac),
501  classification(classification), objCNoRet(ac.getASTContext()),
502  handler(handler) {}
503 
504  void reportUse(const Expr *ex, const VarDecl *vd);
505 
506  void VisitBinaryOperator(BinaryOperator *bo);
507  void VisitBlockExpr(BlockExpr *be);
508  void VisitCallExpr(CallExpr *ce);
509  void VisitDeclRefExpr(DeclRefExpr *dr);
510  void VisitDeclStmt(DeclStmt *ds);
511  void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
512  void VisitObjCMessageExpr(ObjCMessageExpr *ME);
513 
514  bool isTrackedVar(const VarDecl *vd) {
515  return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
516  }
517 
518  FindVarResult findVar(const Expr *ex) {
519  return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
520  }
521 
522  UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
523  UninitUse Use(ex, isAlwaysUninit(v));
524 
525  assert(isUninitialized(v));
526  if (Use.getKind() == UninitUse::Always)
527  return Use;
528 
529  // If an edge which leads unconditionally to this use did not initialize
530  // the variable, we can say something stronger than 'may be uninitialized':
531  // we can say 'either it's used uninitialized or you have dead code'.
532  //
533  // We track the number of successors of a node which have been visited, and
534  // visit a node once we have visited all of its successors. Only edges where
535  // the variable might still be uninitialized are followed. Since a variable
536  // can't transfer from being initialized to being uninitialized, this will
537  // trace out the subgraph which inevitably leads to the use and does not
538  // initialize the variable. We do not want to skip past loops, since their
539  // non-termination might be correlated with the initialization condition.
540  //
541  // For example:
542  //
543  // void f(bool a, bool b) {
544  // block1: int n;
545  // if (a) {
546  // block2: if (b)
547  // block3: n = 1;
548  // block4: } else if (b) {
549  // block5: while (!a) {
550  // block6: do_work(&a);
551  // n = 2;
552  // }
553  // }
554  // block7: if (a)
555  // block8: g();
556  // block9: return n;
557  // }
558  //
559  // Starting from the maybe-uninitialized use in block 9:
560  // * Block 7 is not visited because we have only visited one of its two
561  // successors.
562  // * Block 8 is visited because we've visited its only successor.
563  // From block 8:
564  // * Block 7 is visited because we've now visited both of its successors.
565  // From block 7:
566  // * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
567  // of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
568  // * Block 3 is not visited because it initializes 'n'.
569  // Now the algorithm terminates, having visited blocks 7 and 8, and having
570  // found the frontier is blocks 2, 4, and 5.
571  //
572  // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
573  // and 4), so we report that any time either of those edges is taken (in
574  // each case when 'b == false'), 'n' is used uninitialized.
576  SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
577  Queue.push_back(block);
578  // Specify that we've already visited all successors of the starting block.
579  // This has the dual purpose of ensuring we never add it to the queue, and
580  // of marking it as not being a candidate element of the frontier.
581  SuccsVisited[block->getBlockID()] = block->succ_size();
582  while (!Queue.empty()) {
583  const CFGBlock *B = Queue.pop_back_val();
584 
585  // If the use is always reached from the entry block, make a note of that.
586  if (B == &cfg.getEntry())
587  Use.setUninitAfterCall();
588 
589  for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
590  I != E; ++I) {
591  const CFGBlock *Pred = *I;
592  if (!Pred)
593  continue;
594 
595  Value AtPredExit = vals.getValue(Pred, B, vd);
596  if (AtPredExit == Initialized)
597  // This block initializes the variable.
598  continue;
599  if (AtPredExit == MayUninitialized &&
600  vals.getValue(B, nullptr, vd) == Uninitialized) {
601  // This block declares the variable (uninitialized), and is reachable
602  // from a block that initializes the variable. We can't guarantee to
603  // give an earlier location for the diagnostic (and it appears that
604  // this code is intended to be reachable) so give a diagnostic here
605  // and go no further down this path.
606  Use.setUninitAfterDecl();
607  continue;
608  }
609 
610  unsigned &SV = SuccsVisited[Pred->getBlockID()];
611  if (!SV) {
612  // When visiting the first successor of a block, mark all NULL
613  // successors as having been visited.
614  for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
615  SE = Pred->succ_end();
616  SI != SE; ++SI)
617  if (!*SI)
618  ++SV;
619  }
620 
621  if (++SV == Pred->succ_size())
622  // All paths from this block lead to the use and don't initialize the
623  // variable.
624  Queue.push_back(Pred);
625  }
626  }
627 
628  // Scan the frontier, looking for blocks where the variable was
629  // uninitialized.
630  for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) {
631  const CFGBlock *Block = *BI;
632  unsigned BlockID = Block->getBlockID();
633  const Stmt *Term = Block->getTerminator();
634  if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
635  Term) {
636  // This block inevitably leads to the use. If we have an edge from here
637  // to a post-dominator block, and the variable is uninitialized on that
638  // edge, we have found a bug.
639  for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
640  E = Block->succ_end(); I != E; ++I) {
641  const CFGBlock *Succ = *I;
642  if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
643  vals.getValue(Block, Succ, vd) == Uninitialized) {
644  // Switch cases are a special case: report the label to the caller
645  // as the 'terminator', not the switch statement itself. Suppress
646  // situations where no label matched: we can't be sure that's
647  // possible.
648  if (isa<SwitchStmt>(Term)) {
649  const Stmt *Label = Succ->getLabel();
650  if (!Label || !isa<SwitchCase>(Label))
651  // Might not be possible.
652  continue;
653  UninitUse::Branch Branch;
654  Branch.Terminator = Label;
655  Branch.Output = 0; // Ignored.
656  Use.addUninitBranch(Branch);
657  } else {
658  UninitUse::Branch Branch;
659  Branch.Terminator = Term;
660  Branch.Output = I - Block->succ_begin();
661  Use.addUninitBranch(Branch);
662  }
663  }
664  }
665  }
666  }
667 
668  return Use;
669  }
670 };
671 }
672 
673 void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
674  Value v = vals[vd];
675  if (isUninitialized(v))
676  handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
677 }
678 
679 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
680  // This represents an initialization of the 'element' value.
681  if (DeclStmt *DS = dyn_cast<DeclStmt>(FS->getElement())) {
682  const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl());
683  if (isTrackedVar(VD))
684  vals[VD] = Initialized;
685  }
686 }
687 
688 void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
689  const BlockDecl *bd = be->getBlockDecl();
690  for (const auto &I : bd->captures()) {
691  const VarDecl *vd = I.getVariable();
692  if (!isTrackedVar(vd))
693  continue;
694  if (I.isByRef()) {
695  vals[vd] = Initialized;
696  continue;
697  }
698  reportUse(be, vd);
699  }
700 }
701 
702 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
703  if (Decl *Callee = ce->getCalleeDecl()) {
704  if (Callee->hasAttr<ReturnsTwiceAttr>()) {
705  // After a call to a function like setjmp or vfork, any variable which is
706  // initialized anywhere within this function may now be initialized. For
707  // now, just assume such a call initializes all variables. FIXME: Only
708  // mark variables as initialized if they have an initializer which is
709  // reachable from here.
710  vals.setAllScratchValues(Initialized);
711  }
712  else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
713  // Functions labeled like "analyzer_noreturn" are often used to denote
714  // "panic" functions that in special debug situations can still return,
715  // but for the most part should not be treated as returning. This is a
716  // useful annotation borrowed from the static analyzer that is useful for
717  // suppressing branch-specific false positives when we call one of these
718  // functions but keep pretending the path continues (when in reality the
719  // user doesn't care).
720  vals.setAllScratchValues(Unknown);
721  }
722  }
723 }
724 
725 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
726  switch (classification.get(dr)) {
727  case ClassifyRefs::Ignore:
728  break;
729  case ClassifyRefs::Use:
730  reportUse(dr, cast<VarDecl>(dr->getDecl()));
731  break;
732  case ClassifyRefs::Init:
733  vals[cast<VarDecl>(dr->getDecl())] = Initialized;
734  break;
735  case ClassifyRefs::SelfInit:
736  handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
737  break;
738  }
739 }
740 
741 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
742  if (BO->getOpcode() == BO_Assign) {
743  FindVarResult Var = findVar(BO->getLHS());
744  if (const VarDecl *VD = Var.getDecl())
745  vals[VD] = Initialized;
746  }
747 }
748 
749 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
750  for (auto *DI : DS->decls()) {
751  VarDecl *VD = dyn_cast<VarDecl>(DI);
752  if (VD && isTrackedVar(VD)) {
753  if (getSelfInitExpr(VD)) {
754  // If the initializer consists solely of a reference to itself, we
755  // explicitly mark the variable as uninitialized. This allows code
756  // like the following:
757  //
758  // int x = x;
759  //
760  // to deliberately leave a variable uninitialized. Different analysis
761  // clients can detect this pattern and adjust their reporting
762  // appropriately, but we need to continue to analyze subsequent uses
763  // of the variable.
764  vals[VD] = Uninitialized;
765  } else if (VD->getInit()) {
766  // Treat the new variable as initialized.
767  vals[VD] = Initialized;
768  } else {
769  // No initializer: the variable is now uninitialized. This matters
770  // for cases like:
771  // while (...) {
772  // int n;
773  // use(n);
774  // n = 0;
775  // }
776  // FIXME: Mark the variable as uninitialized whenever its scope is
777  // left, since its scope could be re-entered by a jump over the
778  // declaration.
779  vals[VD] = Uninitialized;
780  }
781  }
782  }
783 }
784 
785 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
786  // If the Objective-C message expression is an implicit no-return that
787  // is not modeled in the CFG, set the tracked dataflow values to Unknown.
788  if (objCNoRet.isImplicitNoReturn(ME)) {
789  vals.setAllScratchValues(Unknown);
790  }
791 }
792 
793 //------------------------------------------------------------------------====//
794 // High-level "driver" logic for uninitialized values analysis.
795 //====------------------------------------------------------------------------//
796 
797 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
798  AnalysisDeclContext &ac, CFGBlockValues &vals,
799  const ClassifyRefs &classification,
800  llvm::BitVector &wasAnalyzed,
801  UninitVariablesHandler &handler) {
802  wasAnalyzed[block->getBlockID()] = true;
803  vals.resetScratch();
804  // Merge in values of predecessor blocks.
805  bool isFirst = true;
806  for (CFGBlock::const_pred_iterator I = block->pred_begin(),
807  E = block->pred_end(); I != E; ++I) {
808  const CFGBlock *pred = *I;
809  if (!pred)
810  continue;
811  if (wasAnalyzed[pred->getBlockID()]) {
812  vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
813  isFirst = false;
814  }
815  }
816  // Apply the transfer function.
817  TransferFunctions tf(vals, cfg, block, ac, classification, handler);
818  for (CFGBlock::const_iterator I = block->begin(), E = block->end();
819  I != E; ++I) {
820  if (Optional<CFGStmt> cs = I->getAs<CFGStmt>())
821  tf.Visit(const_cast<Stmt*>(cs->getStmt()));
822  }
823  return vals.updateValueVectorWithScratch(block);
824 }
825 
826 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
827 /// to detect when a CFGBlock has any *potential* use of an uninitialized
828 /// variable. It is mainly used to prune out work during the final
829 /// reporting pass.
830 namespace {
831 struct PruneBlocksHandler : public UninitVariablesHandler {
832  PruneBlocksHandler(unsigned numBlocks)
833  : hadUse(numBlocks, false), hadAnyUse(false),
834  currentBlock(0) {}
835 
836  ~PruneBlocksHandler() override {}
837 
838  /// Records if a CFGBlock had a potential use of an uninitialized variable.
839  llvm::BitVector hadUse;
840 
841  /// Records if any CFGBlock had a potential use of an uninitialized variable.
842  bool hadAnyUse;
843 
844  /// The current block to scribble use information.
845  unsigned currentBlock;
846 
847  void handleUseOfUninitVariable(const VarDecl *vd,
848  const UninitUse &use) override {
849  hadUse[currentBlock] = true;
850  hadAnyUse = true;
851  }
852 
853  /// Called when the uninitialized variable analysis detects the
854  /// idiom 'int x = x'. All other uses of 'x' within the initializer
855  /// are handled by handleUseOfUninitVariable.
856  void handleSelfInit(const VarDecl *vd) override {
857  hadUse[currentBlock] = true;
858  hadAnyUse = true;
859  }
860 };
861 }
862 
864  const DeclContext &dc,
865  const CFG &cfg,
867  UninitVariablesHandler &handler,
869  CFGBlockValues vals(cfg);
870  vals.computeSetOfDeclarations(dc);
871  if (vals.hasNoDeclarations())
872  return;
873 
874  stats.NumVariablesAnalyzed = vals.getNumEntries();
875 
876  // Precompute which expressions are uses and which are initializations.
877  ClassifyRefs classification(ac);
878  cfg.VisitBlockStmts(classification);
879 
880  // Mark all variables uninitialized at the entry.
881  const CFGBlock &entry = cfg.getEntry();
882  ValueVector &vec = vals.getValueVector(&entry);
883  const unsigned n = vals.getNumEntries();
884  for (unsigned j = 0; j < n ; ++j) {
885  vec[j] = Uninitialized;
886  }
887 
888  // Proceed with the workist.
889  DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>());
890  llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
891  worklist.enqueueSuccessors(&cfg.getEntry());
892  llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
893  wasAnalyzed[cfg.getEntry().getBlockID()] = true;
894  PruneBlocksHandler PBH(cfg.getNumBlockIDs());
895 
896  while (const CFGBlock *block = worklist.dequeue()) {
897  PBH.currentBlock = block->getBlockID();
898 
899  // Did the block change?
900  bool changed = runOnBlock(block, cfg, ac, vals,
901  classification, wasAnalyzed, PBH);
902  ++stats.NumBlockVisits;
903  if (changed || !previouslyVisited[block->getBlockID()])
904  worklist.enqueueSuccessors(block);
905  previouslyVisited[block->getBlockID()] = true;
906  }
907 
908  if (!PBH.hadAnyUse)
909  return;
910 
911  // Run through the blocks one more time, and report uninitialized variables.
912  for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) {
913  const CFGBlock *block = *BI;
914  if (PBH.hadUse[block->getBlockID()]) {
915  runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
916  ++stats.NumBlockVisits;
917  }
918  }
919 }
920 
Defines the clang::ASTContext interface.
const BlockDecl * getBlockDecl() const
Definition: Expr.h:4866
bool isCallToStdMove() const
Definition: Expr.h:2351
pred_iterator pred_end()
Definition: CFG.h:584
A (possibly-)qualified type.
Definition: Type.h:653
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2278
succ_iterator succ_begin()
Definition: CFG.h:600
Stmt - This represents one statement.
Definition: Stmt.h:66
CFGBlock & getEntry()
Definition: CFG.h:900
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:456
bool isRecordType() const
Definition: Type.h:6025
unsigned getBlockID() const
Definition: CFG.h:704
static bool isPointerToConst(const QualType &QT)
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
Opcode getOpcode() const
Definition: Expr.h:3027
iterator begin()
Definition: CFG.h:553
static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc)
unsigned succ_size() const
Definition: CFG.h:617
VarDecl - An instance of this class is created to represent a variable declaration or definition...
Definition: Decl.h:807
ASTContext & getASTContext() const
Kind getKind() const
Get the kind of uninitialized use.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:149
AnalysisDeclContext contains the context data for the function or method under analysis.
static bool isIncrementDecrementOp(Opcode Op)
Definition: Expr.h:1778
Expr * getSubExpr()
Definition: Expr.h:2762
iterator end()
Definition: CFG.h:886
static bool isAlwaysUninit(const Value v)
static bool runOnBlock(const CFGBlock *block, const CFG &cfg, AnalysisDeclContext &ac, CFGBlockValues &vals, const ClassifyRefs &classification, llvm::BitVector &wasAnalyzed, UninitVariablesHandler &handler)
T * getAnalysis()
Return the specified analysis object, lazily running the analysis if necessary.
ElementList::const_iterator const_iterator
Definition: CFG.h:546
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2986
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:2710
bool isScalarType() const
Definition: Type.h:6214
Iterator for iterating over Stmt * arrays that contain only Expr *.
Definition: Stmt.h:332
arg_iterator arg_end()
Definition: Expr.h:2309
ConditionalOperator - The ?: ternary operator.
Definition: Expr.h:3270
Expr * IgnoreParenNoopCasts(ASTContext &Ctx) LLVM_READONLY
IgnoreParenNoopCasts - Ignore parentheses and casts that do not change the value (including ptr->int ...
Definition: Expr.cpp:2583
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:401
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
Definition: Decl.h:3689
Expr - This represents one expression.
Definition: Expr.h:106
std::string Label
CFG - Represents a source-level, intra-procedural CFG that represents the control-flow of a Stmt...
Definition: CFG.h:808
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:4852
bool isImplicit() const
isImplicit - Indicates whether the declaration was implicitly generated by the implementation.
Definition: DeclBase.h:551
bool isExceptionVariable() const
Determine whether this variable is the exception variable in a C++ catch statememt or an Objective-C ...
Definition: Decl.h:1300
DeclContext * getDeclContext()
Definition: DeclBase.h:425
static SVal getValue(SVal val, SValBuilder &svalBuilder)
void runUninitializedVariablesAnalysis(const DeclContext &dc, const CFG &cfg, AnalysisDeclContext &ac, UninitVariablesHandler &handler, UninitVariablesAnalysisStats &stats)
QualType getType() const
Definition: Expr.h:128
AdjacentBlocks::const_iterator const_pred_iterator
Definition: CFG.h:570
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:860
UnaryOperator - This represents the unary-expression&#39;s (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
Definition: Expr.h:1717
ValueDecl * getDecl()
Definition: Expr.h:1041
A use of a variable, which might be uninitialized.
CStyleCastExpr - An explicit cast in C (C99 6.5.4) or a C-style cast in C++ (C++ [expr.cast]), which uses the syntax (Type)expr.
Definition: Expr.h:2923
do v
Definition: arm_acle.h:78
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:5787
CFGTerminator getTerminator()
Definition: CFG.h:688
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
Definition: Expr.h:868
Stmt * getLabel()
Definition: CFG.h:699
decl_iterator decls_begin() const
Definition: DeclBase.cpp:1320
Expr * getSubExpr() const
Definition: Expr.h:1744
CastKind getCastKind() const
Definition: Expr.h:2758
ASTContext & getASTContext() const LLVM_READONLY
Definition: DeclBase.cpp:365
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:487
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition: StmtVisitor.h:183
bool hasGlobalStorage() const
Returns true for all variables that do not have local storage.
Definition: Decl.h:1068
const Decl * getDecl() const
bool isAnyPointerType() const
Definition: Type.h:5956
unsigned getNumBlockIDs() const
getNumBlockIDs - Returns the total number of BlockIDs allocated (which start at 0).
Definition: CFG.h:975
iterator begin()
Definition: CFG.h:885
bool isVectorType() const
Definition: Type.h:6037
succ_iterator succ_end()
Definition: CFG.h:601
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:577
Expr * getLHS() const
Definition: Expr.h:3030
static const DeclRefExpr * getSelfInitExpr(VarDecl *VD)
pred_iterator pred_begin()
Definition: CFG.h:583
Dataflow Directional Tag Classes.
CFGBlockListTy::const_iterator const_iterator
Definition: CFG.h:878
void VisitBlockStmts(CALLBACK &O) const
Definition: CFG.h:960
DeclContext - This is used only as base class of specific decl types that can act as declaration cont...
Definition: DeclBase.h:1252
ArrayRef< Capture > captures() const
Definition: Decl.h:3815
const Expr * getInit() const
Definition: Decl.h:1213
const Decl * getSingleDecl() const
Definition: Stmt.h:504
bool isInitCapture() const
Whether this variable is the implicit variable for a lambda init-capture.
Definition: Decl.h:1376
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
Definition: DeclBase.h:1596
Decl * getCalleeDecl()
Definition: Expr.cpp:1220
std::vector< const CFGBlock * >::reverse_iterator iterator
The use is always uninitialized.
Represents Objective-C&#39;s collection statement.
Definition: StmtObjC.h:24
arg_iterator arg_begin()
Definition: Expr.h:2308
decl_range decls()
Definition: Stmt.h:534
char __ovld __cnfn max(char x, char y)
Returns y if x < y, otherwise it returns x.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:2387
static bool isCompoundAssignmentOp(Opcode Opc)
Definition: Expr.h:3114
BinaryConditionalOperator - The GNU extension to the conditional operator which allows the middle ope...
Definition: Expr.h:3343
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2209
ASTContext & getParentASTContext() const
Definition: DeclBase.h:1360
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:956
bool isLocalVarDecl() const
isLocalVarDecl - Returns true for local variable declarations other than parameters.
Definition: Decl.h:1096
QualType getType() const
Definition: Decl.h:639
void addUninitBranch(Branch B)
iterator end()
Definition: CFG.h:554
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
Definition: Expr.cpp:2432
decl_iterator decls_end() const
Definition: DeclBase.h:1578
static bool isUninitialized(const Value v)