clang  10.0.0svn
BugReporterVisitors.cpp
Go to the documentation of this file.
1 //===- BugReporterVisitors.cpp - Helpers for reporting bugs ---------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines a set of BugReporter "visitors" which can be used to
10 // enhance the diagnostics reported for a bug.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/ASTContext.h"
16 #include "clang/AST/Decl.h"
17 #include "clang/AST/DeclBase.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/Expr.h"
20 #include "clang/AST/ExprCXX.h"
21 #include "clang/AST/ExprObjC.h"
22 #include "clang/AST/Stmt.h"
23 #include "clang/AST/Type.h"
27 #include "clang/Analysis/CFG.h"
31 #include "clang/Basic/LLVM.h"
34 #include "clang/Lex/Lexer.h"
49 #include "llvm/ADT/ArrayRef.h"
50 #include "llvm/ADT/None.h"
51 #include "llvm/ADT/Optional.h"
52 #include "llvm/ADT/STLExtras.h"
53 #include "llvm/ADT/SmallPtrSet.h"
54 #include "llvm/ADT/SmallString.h"
55 #include "llvm/ADT/SmallVector.h"
56 #include "llvm/ADT/StringExtras.h"
57 #include "llvm/ADT/StringRef.h"
58 #include "llvm/Support/Casting.h"
59 #include "llvm/Support/ErrorHandling.h"
60 #include "llvm/Support/raw_ostream.h"
61 #include <cassert>
62 #include <deque>
63 #include <memory>
64 #include <string>
65 #include <utility>
66 
67 using namespace clang;
68 using namespace ento;
69 
70 //===----------------------------------------------------------------------===//
71 // Utility functions.
72 //===----------------------------------------------------------------------===//
73 
74 static const Expr *peelOffPointerArithmetic(const BinaryOperator *B) {
75  if (B->isAdditiveOp() && B->getType()->isPointerType()) {
76  if (B->getLHS()->getType()->isPointerType()) {
77  return B->getLHS();
78  } else if (B->getRHS()->getType()->isPointerType()) {
79  return B->getRHS();
80  }
81  }
82  return nullptr;
83 }
84 
85 /// Given that expression S represents a pointer that would be dereferenced,
86 /// try to find a sub-expression from which the pointer came from.
87 /// This is used for tracking down origins of a null or undefined value:
88 /// "this is null because that is null because that is null" etc.
89 /// We wipe away field and element offsets because they merely add offsets.
90 /// We also wipe away all casts except lvalue-to-rvalue casts, because the
91 /// latter represent an actual pointer dereference; however, we remove
92 /// the final lvalue-to-rvalue cast before returning from this function
93 /// because it demonstrates more clearly from where the pointer rvalue was
94 /// loaded. Examples:
95 /// x->y.z ==> x (lvalue)
96 /// foo()->y.z ==> foo() (rvalue)
97 const Expr *bugreporter::getDerefExpr(const Stmt *S) {
98  const auto *E = dyn_cast<Expr>(S);
99  if (!E)
100  return nullptr;
101 
102  while (true) {
103  if (const auto *CE = dyn_cast<CastExpr>(E)) {
104  if (CE->getCastKind() == CK_LValueToRValue) {
105  // This cast represents the load we're looking for.
106  break;
107  }
108  E = CE->getSubExpr();
109  } else if (const auto *B = dyn_cast<BinaryOperator>(E)) {
110  // Pointer arithmetic: '*(x + 2)' -> 'x') etc.
111  if (const Expr *Inner = peelOffPointerArithmetic(B)) {
112  E = Inner;
113  } else {
114  // Probably more arithmetic can be pattern-matched here,
115  // but for now give up.
116  break;
117  }
118  } else if (const auto *U = dyn_cast<UnaryOperator>(E)) {
119  if (U->getOpcode() == UO_Deref || U->getOpcode() == UO_AddrOf ||
120  (U->isIncrementDecrementOp() && U->getType()->isPointerType())) {
121  // Operators '*' and '&' don't actually mean anything.
122  // We look at casts instead.
123  E = U->getSubExpr();
124  } else {
125  // Probably more arithmetic can be pattern-matched here,
126  // but for now give up.
127  break;
128  }
129  }
130  // Pattern match for a few useful cases: a[0], p->f, *p etc.
131  else if (const auto *ME = dyn_cast<MemberExpr>(E)) {
132  E = ME->getBase();
133  } else if (const auto *IvarRef = dyn_cast<ObjCIvarRefExpr>(E)) {
134  E = IvarRef->getBase();
135  } else if (const auto *AE = dyn_cast<ArraySubscriptExpr>(E)) {
136  E = AE->getBase();
137  } else if (const auto *PE = dyn_cast<ParenExpr>(E)) {
138  E = PE->getSubExpr();
139  } else if (const auto *FE = dyn_cast<FullExpr>(E)) {
140  E = FE->getSubExpr();
141  } else {
142  // Other arbitrary stuff.
143  break;
144  }
145  }
146 
147  // Special case: remove the final lvalue-to-rvalue cast, but do not recurse
148  // deeper into the sub-expression. This way we return the lvalue from which
149  // our pointer rvalue was loaded.
150  if (const auto *CE = dyn_cast<ImplicitCastExpr>(E))
151  if (CE->getCastKind() == CK_LValueToRValue)
152  E = CE->getSubExpr();
153 
154  return E;
155 }
156 
157 /// Comparing internal representations of symbolic values (via
158 /// SVal::operator==()) is a valid way to check if the value was updated,
159 /// unless it's a LazyCompoundVal that may have a different internal
160 /// representation every time it is loaded from the state. In this function we
161 /// do an approximate comparison for lazy compound values, checking that they
162 /// are the immediate snapshots of the tracked region's bindings within the
163 /// node's respective states but not really checking that these snapshots
164 /// actually contain the same set of bindings.
165 static bool hasVisibleUpdate(const ExplodedNode *LeftNode, SVal LeftVal,
166  const ExplodedNode *RightNode, SVal RightVal) {
167  if (LeftVal == RightVal)
168  return true;
169 
170  const auto LLCV = LeftVal.getAs<nonloc::LazyCompoundVal>();
171  if (!LLCV)
172  return false;
173 
174  const auto RLCV = RightVal.getAs<nonloc::LazyCompoundVal>();
175  if (!RLCV)
176  return false;
177 
178  return LLCV->getRegion() == RLCV->getRegion() &&
179  LLCV->getStore() == LeftNode->getState()->getStore() &&
180  RLCV->getStore() == RightNode->getState()->getStore();
181 }
182 
184 getConcreteIntegerValue(const Expr *CondVarExpr, const ExplodedNode *N) {
185  ProgramStateRef State = N->getState();
186  const LocationContext *LCtx = N->getLocationContext();
187 
188  // The declaration of the value may rely on a pointer so take its l-value.
189  if (const auto *DRE = dyn_cast_or_null<DeclRefExpr>(CondVarExpr)) {
190  if (const auto *VD = dyn_cast_or_null<VarDecl>(DRE->getDecl())) {
191  SVal DeclSVal = State->getSVal(State->getLValue(VD, LCtx));
192  if (auto DeclCI = DeclSVal.getAs<nonloc::ConcreteInt>())
193  return &DeclCI->getValue();
194  }
195  }
196 
197  return {};
198 }
199 
200 /// \return name of the macro inside the location \p Loc.
201 static StringRef getMacroName(SourceLocation Loc,
202  BugReporterContext &BRC) {
204  Loc,
205  BRC.getSourceManager(),
206  BRC.getASTContext().getLangOpts());
207 }
208 
209 /// \return Whether given spelling location corresponds to an expansion
210 /// of a function-like macro.
212  const SourceManager &SM) {
213  if (!Loc.isMacroID())
214  return false;
215  while (SM.isMacroArgExpansion(Loc))
216  Loc = SM.getImmediateExpansionRange(Loc).getBegin();
217  std::pair<FileID, unsigned> TLInfo = SM.getDecomposedLoc(Loc);
218  SrcMgr::SLocEntry SE = SM.getSLocEntry(TLInfo.first);
219  const SrcMgr::ExpansionInfo &EInfo = SE.getExpansion();
220  return EInfo.isFunctionMacroExpansion();
221 }
222 
223 /// \return Whether \c RegionOfInterest was modified at \p N,
224 /// where \p ValueAfter is \c RegionOfInterest's value at the end of the
225 /// stack frame.
226 static bool wasRegionOfInterestModifiedAt(const SubRegion *RegionOfInterest,
227  const ExplodedNode *N,
228  SVal ValueAfter) {
229  ProgramStateRef State = N->getState();
230  ProgramStateManager &Mgr = N->getState()->getStateManager();
231 
232  if (!N->getLocationAs<PostStore>() && !N->getLocationAs<PostInitializer>() &&
233  !N->getLocationAs<PostStmt>())
234  return false;
235 
236  // Writing into region of interest.
237  if (auto PS = N->getLocationAs<PostStmt>())
238  if (auto *BO = PS->getStmtAs<BinaryOperator>())
239  if (BO->isAssignmentOp() && RegionOfInterest->isSubRegionOf(
240  N->getSVal(BO->getLHS()).getAsRegion()))
241  return true;
242 
243  // SVal after the state is possibly different.
244  SVal ValueAtN = N->getState()->getSVal(RegionOfInterest);
245  if (!Mgr.getSValBuilder()
246  .areEqual(State, ValueAtN, ValueAfter)
247  .isConstrainedTrue() &&
248  (!ValueAtN.isUndef() || !ValueAfter.isUndef()))
249  return true;
250 
251  return false;
252 }
253 
254 //===----------------------------------------------------------------------===//
255 // Implementation of BugReporterVisitor.
256 //===----------------------------------------------------------------------===//
257 
258 std::shared_ptr<PathDiagnosticPiece>
259 BugReporterVisitor::getEndPath(BugReporterContext &,
260  const ExplodedNode *, BugReport &) {
261  return nullptr;
262 }
263 
264 void
265 BugReporterVisitor::finalizeVisitor(BugReporterContext &,
266  const ExplodedNode *, BugReport &) {}
267 
268 std::shared_ptr<PathDiagnosticPiece> BugReporterVisitor::getDefaultEndPath(
269  BugReporterContext &BRC, const ExplodedNode *EndPathNode, BugReport &BR) {
270  PathDiagnosticLocation L =
271  PathDiagnosticLocation::createEndOfPath(EndPathNode,BRC.getSourceManager());
272 
273  const auto &Ranges = BR.getRanges();
274 
275  // Only add the statement itself as a range if we didn't specify any
276  // special ranges for this report.
277  auto P = std::make_shared<PathDiagnosticEventPiece>(
278  L, BR.getDescription(), Ranges.begin() == Ranges.end());
279  for (SourceRange Range : Ranges)
280  P->addRange(Range);
281 
282  return P;
283 }
284 
285 //===----------------------------------------------------------------------===//
286 // Implementation of NoStoreFuncVisitor.
287 //===----------------------------------------------------------------------===//
288 
289 namespace {
290 
291 /// Put a diagnostic on return statement of all inlined functions
292 /// for which the region of interest \p RegionOfInterest was passed into,
293 /// but not written inside, and it has caused an undefined read or a null
294 /// pointer dereference outside.
295 class NoStoreFuncVisitor final : public BugReporterVisitor {
296  const SubRegion *RegionOfInterest;
297  MemRegionManager &MmrMgr;
298  const SourceManager &SM;
299  const PrintingPolicy &PP;
300 
301  /// Recursion limit for dereferencing fields when looking for the
302  /// region of interest.
303  /// The limit of two indicates that we will dereference fields only once.
304  static const unsigned DEREFERENCE_LIMIT = 2;
305 
306  /// Frames writing into \c RegionOfInterest.
307  /// This visitor generates a note only if a function does not write into
308  /// a region of interest. This information is not immediately available
309  /// by looking at the node associated with the exit from the function
310  /// (usually the return statement). To avoid recomputing the same information
311  /// many times (going up the path for each node and checking whether the
312  /// region was written into) we instead lazily compute the
313  /// stack frames along the path which write into the region of interest.
314  llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingRegion;
315  llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingCalculated;
316 
317  using RegionVector = SmallVector<const MemRegion *, 5>;
318 
319 public:
320  NoStoreFuncVisitor(const SubRegion *R)
321  : RegionOfInterest(R), MmrMgr(*R->getMemRegionManager()),
322  SM(MmrMgr.getContext().getSourceManager()),
323  PP(MmrMgr.getContext().getPrintingPolicy()) {}
324 
325  void Profile(llvm::FoldingSetNodeID &ID) const override {
326  static int Tag = 0;
327  ID.AddPointer(&Tag);
328  ID.AddPointer(RegionOfInterest);
329  }
330 
331  void *getTag() const {
332  static int Tag = 0;
333  return static_cast<void *>(&Tag);
334  }
335 
336  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
337  BugReporterContext &BR,
338  BugReport &R) override;
339 
340 private:
341  /// Attempts to find the region of interest in a given record decl,
342  /// by either following the base classes or fields.
343  /// Dereferences fields up to a given recursion limit.
344  /// Note that \p Vec is passed by value, leading to quadratic copying cost,
345  /// but it's OK in practice since its length is limited to DEREFERENCE_LIMIT.
346  /// \return A chain fields leading to the region of interest or None.
348  findRegionOfInterestInRecord(const RecordDecl *RD, ProgramStateRef State,
349  const MemRegion *R, const RegionVector &Vec = {},
350  int depth = 0);
351 
352  /// Check and lazily calculate whether the region of interest is
353  /// modified in the stack frame to which \p N belongs.
354  /// The calculation is cached in FramesModifyingRegion.
355  bool isRegionOfInterestModifiedInFrame(const ExplodedNode *N) {
356  const LocationContext *Ctx = N->getLocationContext();
357  const StackFrameContext *SCtx = Ctx->getStackFrame();
358  if (!FramesModifyingCalculated.count(SCtx))
359  findModifyingFrames(N);
360  return FramesModifyingRegion.count(SCtx);
361  }
362 
363  /// Write to \c FramesModifyingRegion all stack frames along
364  /// the path in the current stack frame which modify \c RegionOfInterest.
365  void findModifyingFrames(const ExplodedNode *N);
366 
367  /// Consume the information on the no-store stack frame in order to
368  /// either emit a note or suppress the report enirely.
369  /// \return Diagnostics piece for region not modified in the current function,
370  /// if it decides to emit one.
371  std::shared_ptr<PathDiagnosticPiece>
372  maybeEmitNote(BugReport &R, const CallEvent &Call, const ExplodedNode *N,
373  const RegionVector &FieldChain, const MemRegion *MatchedRegion,
374  StringRef FirstElement, bool FirstIsReferenceType,
375  unsigned IndirectionLevel);
376 
377  /// Pretty-print region \p MatchedRegion to \p os.
378  /// \return Whether printing succeeded.
379  bool prettyPrintRegionName(StringRef FirstElement, bool FirstIsReferenceType,
380  const MemRegion *MatchedRegion,
381  const RegionVector &FieldChain,
382  int IndirectionLevel,
383  llvm::raw_svector_ostream &os);
384 
385  /// Print first item in the chain, return new separator.
386  static StringRef prettyPrintFirstElement(StringRef FirstElement,
387  bool MoreItemsExpected,
388  int IndirectionLevel,
389  llvm::raw_svector_ostream &os);
390 };
391 
392 } // end of anonymous namespace
393 
394 /// \return Whether the method declaration \p Parent
395 /// syntactically has a binary operation writing into the ivar \p Ivar.
397  const ObjCIvarDecl *Ivar) {
398  using namespace ast_matchers;
399  const char *IvarBind = "Ivar";
400  if (!Parent || !Parent->hasBody())
401  return false;
402  StatementMatcher WriteIntoIvarM = binaryOperator(
403  hasOperatorName("="),
404  hasLHS(ignoringParenImpCasts(
405  objcIvarRefExpr(hasDeclaration(equalsNode(Ivar))).bind(IvarBind))));
406  StatementMatcher ParentM = stmt(hasDescendant(WriteIntoIvarM));
407  auto Matches = match(ParentM, *Parent->getBody(), Parent->getASTContext());
408  for (BoundNodes &Match : Matches) {
409  auto IvarRef = Match.getNodeAs<ObjCIvarRefExpr>(IvarBind);
410  if (IvarRef->isFreeIvar())
411  return true;
412 
413  const Expr *Base = IvarRef->getBase();
414  if (const auto *ICE = dyn_cast<ImplicitCastExpr>(Base))
415  Base = ICE->getSubExpr();
416 
417  if (const auto *DRE = dyn_cast<DeclRefExpr>(Base))
418  if (const auto *ID = dyn_cast<ImplicitParamDecl>(DRE->getDecl()))
419  if (ID->getParameterKind() == ImplicitParamDecl::ObjCSelf)
420  return true;
421 
422  return false;
423  }
424  return false;
425 }
426 
427 /// Get parameters associated with runtime definition in order
428 /// to get the correct parameter name.
429 static ArrayRef<ParmVarDecl *> getCallParameters(CallEventRef<> Call) {
430  // Use runtime definition, if available.
431  RuntimeDefinition RD = Call->getRuntimeDefinition();
432  if (const auto *FD = dyn_cast_or_null<FunctionDecl>(RD.getDecl()))
433  return FD->parameters();
434  if (const auto *MD = dyn_cast_or_null<ObjCMethodDecl>(RD.getDecl()))
435  return MD->parameters();
436 
437  return Call->parameters();
438 }
439 
440 /// \return whether \p Ty points to a const type, or is a const reference.
441 static bool isPointerToConst(QualType Ty) {
442  return !Ty->getPointeeType().isNull() &&
444 }
445 
446 /// Attempts to find the region of interest in a given CXX decl,
447 /// by either following the base classes or fields.
448 /// Dereferences fields up to a given recursion limit.
449 /// Note that \p Vec is passed by value, leading to quadratic copying cost,
450 /// but it's OK in practice since its length is limited to DEREFERENCE_LIMIT.
451 /// \return A chain fields leading to the region of interest or None.
453 NoStoreFuncVisitor::findRegionOfInterestInRecord(
454  const RecordDecl *RD, ProgramStateRef State, const MemRegion *R,
455  const NoStoreFuncVisitor::RegionVector &Vec /* = {} */,
456  int depth /* = 0 */) {
457 
458  if (depth == DEREFERENCE_LIMIT) // Limit the recursion depth.
459  return None;
460 
461  if (const auto *RDX = dyn_cast<CXXRecordDecl>(RD))
462  if (!RDX->hasDefinition())
463  return None;
464 
465  // Recursively examine the base classes.
466  // Note that following base classes does not increase the recursion depth.
467  if (const auto *RDX = dyn_cast<CXXRecordDecl>(RD))
468  for (const auto II : RDX->bases())
469  if (const RecordDecl *RRD = II.getType()->getAsRecordDecl())
470  if (Optional<RegionVector> Out =
471  findRegionOfInterestInRecord(RRD, State, R, Vec, depth))
472  return Out;
473 
474  for (const FieldDecl *I : RD->fields()) {
475  QualType FT = I->getType();
476  const FieldRegion *FR = MmrMgr.getFieldRegion(I, cast<SubRegion>(R));
477  const SVal V = State->getSVal(FR);
478  const MemRegion *VR = V.getAsRegion();
479 
480  RegionVector VecF = Vec;
481  VecF.push_back(FR);
482 
483  if (RegionOfInterest == VR)
484  return VecF;
485 
486  if (const RecordDecl *RRD = FT->getAsRecordDecl())
487  if (auto Out =
488  findRegionOfInterestInRecord(RRD, State, FR, VecF, depth + 1))
489  return Out;
490 
491  QualType PT = FT->getPointeeType();
492  if (PT.isNull() || PT->isVoidType() || !VR)
493  continue;
494 
495  if (const RecordDecl *RRD = PT->getAsRecordDecl())
496  if (Optional<RegionVector> Out =
497  findRegionOfInterestInRecord(RRD, State, VR, VecF, depth + 1))
498  return Out;
499  }
500 
501  return None;
502 }
503 
504 std::shared_ptr<PathDiagnosticPiece>
505 NoStoreFuncVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BR,
506  BugReport &R) {
507 
508  const LocationContext *Ctx = N->getLocationContext();
509  const StackFrameContext *SCtx = Ctx->getStackFrame();
510  ProgramStateRef State = N->getState();
511  auto CallExitLoc = N->getLocationAs<CallExitBegin>();
512 
513  // No diagnostic if region was modified inside the frame.
514  if (!CallExitLoc || isRegionOfInterestModifiedInFrame(N))
515  return nullptr;
516 
517  CallEventRef<> Call =
518  BR.getStateManager().getCallEventManager().getCaller(SCtx, State);
519 
520  // Region of interest corresponds to an IVar, exiting a method
521  // which could have written into that IVar, but did not.
522  if (const auto *MC = dyn_cast<ObjCMethodCall>(Call)) {
523  if (const auto *IvarR = dyn_cast<ObjCIvarRegion>(RegionOfInterest)) {
524  const MemRegion *SelfRegion = MC->getReceiverSVal().getAsRegion();
525  if (RegionOfInterest->isSubRegionOf(SelfRegion) &&
526  potentiallyWritesIntoIvar(Call->getRuntimeDefinition().getDecl(),
527  IvarR->getDecl()))
528  return maybeEmitNote(R, *Call, N, {}, SelfRegion, "self",
529  /*FirstIsReferenceType=*/false, 1);
530  }
531  }
532 
533  if (const auto *CCall = dyn_cast<CXXConstructorCall>(Call)) {
534  const MemRegion *ThisR = CCall->getCXXThisVal().getAsRegion();
535  if (RegionOfInterest->isSubRegionOf(ThisR) &&
536  !CCall->getDecl()->isImplicit())
537  return maybeEmitNote(R, *Call, N, {}, ThisR, "this",
538  /*FirstIsReferenceType=*/false, 1);
539 
540  // Do not generate diagnostics for not modified parameters in
541  // constructors.
542  return nullptr;
543  }
544 
545  ArrayRef<ParmVarDecl *> parameters = getCallParameters(Call);
546  for (unsigned I = 0; I < Call->getNumArgs() && I < parameters.size(); ++I) {
547  const ParmVarDecl *PVD = parameters[I];
548  SVal V = Call->getArgSVal(I);
549  bool ParamIsReferenceType = PVD->getType()->isReferenceType();
550  std::string ParamName = PVD->getNameAsString();
551 
552  int IndirectionLevel = 1;
553  QualType T = PVD->getType();
554  while (const MemRegion *MR = V.getAsRegion()) {
555  if (RegionOfInterest->isSubRegionOf(MR) && !isPointerToConst(T))
556  return maybeEmitNote(R, *Call, N, {}, MR, ParamName,
557  ParamIsReferenceType, IndirectionLevel);
558 
559  QualType PT = T->getPointeeType();
560  if (PT.isNull() || PT->isVoidType())
561  break;
562 
563  if (const RecordDecl *RD = PT->getAsRecordDecl())
565  findRegionOfInterestInRecord(RD, State, MR))
566  return maybeEmitNote(R, *Call, N, *P, RegionOfInterest, ParamName,
567  ParamIsReferenceType, IndirectionLevel);
568 
569  V = State->getSVal(MR, PT);
570  T = PT;
571  IndirectionLevel++;
572  }
573  }
574 
575  return nullptr;
576 }
577 
578 void NoStoreFuncVisitor::findModifyingFrames(const ExplodedNode *N) {
579  assert(N->getLocationAs<CallExitBegin>());
580  ProgramStateRef LastReturnState = N->getState();
581  SVal ValueAtReturn = LastReturnState->getSVal(RegionOfInterest);
582  const LocationContext *Ctx = N->getLocationContext();
583  const StackFrameContext *OriginalSCtx = Ctx->getStackFrame();
584 
585  do {
586  ProgramStateRef State = N->getState();
587  auto CallExitLoc = N->getLocationAs<CallExitBegin>();
588  if (CallExitLoc) {
589  LastReturnState = State;
590  ValueAtReturn = LastReturnState->getSVal(RegionOfInterest);
591  }
592 
593  FramesModifyingCalculated.insert(N->getLocationContext()->getStackFrame());
594 
595  if (wasRegionOfInterestModifiedAt(RegionOfInterest, N, ValueAtReturn)) {
596  const StackFrameContext *SCtx = N->getStackFrame();
597  while (!SCtx->inTopFrame()) {
598  auto p = FramesModifyingRegion.insert(SCtx);
599  if (!p.second)
600  break; // Frame and all its parents already inserted.
601  SCtx = SCtx->getParent()->getStackFrame();
602  }
603  }
604 
605  // Stop calculation at the call to the current function.
606  if (auto CE = N->getLocationAs<CallEnter>())
607  if (CE->getCalleeContext() == OriginalSCtx)
608  break;
609 
610  N = N->getFirstPred();
611  } while (N);
612 }
613 
614 std::shared_ptr<PathDiagnosticPiece> NoStoreFuncVisitor::maybeEmitNote(
615  BugReport &R, const CallEvent &Call, const ExplodedNode *N,
616  const RegionVector &FieldChain, const MemRegion *MatchedRegion,
617  StringRef FirstElement, bool FirstIsReferenceType,
618  unsigned IndirectionLevel) {
619  // Optimistically suppress uninitialized value bugs that result
620  // from system headers having a chance to initialize the value
621  // but failing to do so. It's too unlikely a system header's fault.
622  // It's much more likely a situation in which the function has a failure
623  // mode that the user decided not to check. If we want to hunt such
624  // omitted checks, we should provide an explicit function-specific note
625  // describing the precondition under which the function isn't supposed to
626  // initialize its out-parameter, and additionally check that such
627  // precondition can actually be fulfilled on the current path.
628  if (Call.isInSystemHeader()) {
629  // We make an exception for system header functions that have no branches.
630  // Such functions unconditionally fail to initialize the variable.
631  // If they call other functions that have more paths within them,
632  // this suppression would still apply when we visit these inner functions.
633  // One common example of a standard function that doesn't ever initialize
634  // its out parameter is operator placement new; it's up to the follow-up
635  // constructor (if any) to initialize the memory.
636  if (!N->getStackFrame()->getCFG()->isLinear())
637  R.markInvalid(getTag(), nullptr);
638  return nullptr;
639  }
640 
641  PathDiagnosticLocation L =
642  PathDiagnosticLocation::create(N->getLocation(), SM);
643 
644  // For now this shouldn't trigger, but once it does (as we add more
645  // functions to the body farm), we'll need to decide if these reports
646  // are worth suppressing as well.
647  if (!L.hasValidLocation())
648  return nullptr;
649 
650  SmallString<256> sbuf;
651  llvm::raw_svector_ostream os(sbuf);
652  os << "Returning without writing to '";
653 
654  // Do not generate the note if failed to pretty-print.
655  if (!prettyPrintRegionName(FirstElement, FirstIsReferenceType, MatchedRegion,
656  FieldChain, IndirectionLevel, os))
657  return nullptr;
658 
659  os << "'";
660  return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
661 }
662 
663 bool NoStoreFuncVisitor::prettyPrintRegionName(StringRef FirstElement,
664  bool FirstIsReferenceType,
665  const MemRegion *MatchedRegion,
666  const RegionVector &FieldChain,
667  int IndirectionLevel,
668  llvm::raw_svector_ostream &os) {
669 
670  if (FirstIsReferenceType)
671  IndirectionLevel--;
672 
673  RegionVector RegionSequence;
674 
675  // Add the regions in the reverse order, then reverse the resulting array.
676  assert(RegionOfInterest->isSubRegionOf(MatchedRegion));
677  const MemRegion *R = RegionOfInterest;
678  while (R != MatchedRegion) {
679  RegionSequence.push_back(R);
680  R = cast<SubRegion>(R)->getSuperRegion();
681  }
682  std::reverse(RegionSequence.begin(), RegionSequence.end());
683  RegionSequence.append(FieldChain.begin(), FieldChain.end());
684 
685  StringRef Sep;
686  for (const MemRegion *R : RegionSequence) {
687 
688  // Just keep going up to the base region.
689  // Element regions may appear due to casts.
690  if (isa<CXXBaseObjectRegion>(R) || isa<CXXTempObjectRegion>(R))
691  continue;
692 
693  if (Sep.empty())
694  Sep = prettyPrintFirstElement(FirstElement,
695  /*MoreItemsExpected=*/true,
696  IndirectionLevel, os);
697 
698  os << Sep;
699 
700  // Can only reasonably pretty-print DeclRegions.
701  if (!isa<DeclRegion>(R))
702  return false;
703 
704  const auto *DR = cast<DeclRegion>(R);
705  Sep = DR->getValueType()->isAnyPointerType() ? "->" : ".";
706  DR->getDecl()->getDeclName().print(os, PP);
707  }
708 
709  if (Sep.empty())
710  prettyPrintFirstElement(FirstElement,
711  /*MoreItemsExpected=*/false, IndirectionLevel, os);
712  return true;
713 }
714 
715 StringRef NoStoreFuncVisitor::prettyPrintFirstElement(
716  StringRef FirstElement, bool MoreItemsExpected, int IndirectionLevel,
717  llvm::raw_svector_ostream &os) {
718  StringRef Out = ".";
719 
720  if (IndirectionLevel > 0 && MoreItemsExpected) {
721  IndirectionLevel--;
722  Out = "->";
723  }
724 
725  if (IndirectionLevel > 0 && MoreItemsExpected)
726  os << "(";
727 
728  for (int i = 0; i < IndirectionLevel; i++)
729  os << "*";
730  os << FirstElement;
731 
732  if (IndirectionLevel > 0 && MoreItemsExpected)
733  os << ")";
734 
735  return Out;
736 }
737 
738 //===----------------------------------------------------------------------===//
739 // Implementation of MacroNullReturnSuppressionVisitor.
740 //===----------------------------------------------------------------------===//
741 
742 namespace {
743 
744 /// Suppress null-pointer-dereference bugs where dereferenced null was returned
745 /// the macro.
746 class MacroNullReturnSuppressionVisitor final : public BugReporterVisitor {
747  const SubRegion *RegionOfInterest;
748  const SVal ValueAtDereference;
749 
750  // Do not invalidate the reports where the value was modified
751  // after it got assigned to from the macro.
752  bool WasModified = false;
753 
754 public:
755  MacroNullReturnSuppressionVisitor(const SubRegion *R,
756  const SVal V) : RegionOfInterest(R),
757  ValueAtDereference(V) {}
758 
759  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
760  BugReporterContext &BRC,
761  BugReport &BR) override {
762  if (WasModified)
763  return nullptr;
764 
765  auto BugPoint = BR.getErrorNode()->getLocation().getAs<StmtPoint>();
766  if (!BugPoint)
767  return nullptr;
768 
769  const SourceManager &SMgr = BRC.getSourceManager();
770  if (auto Loc = matchAssignment(N)) {
771  if (isFunctionMacroExpansion(*Loc, SMgr)) {
772  std::string MacroName = getMacroName(*Loc, BRC);
773  SourceLocation BugLoc = BugPoint->getStmt()->getBeginLoc();
774  if (!BugLoc.isMacroID() || getMacroName(BugLoc, BRC) != MacroName)
775  BR.markInvalid(getTag(), MacroName.c_str());
776  }
777  }
778 
779  if (wasRegionOfInterestModifiedAt(RegionOfInterest, N, ValueAtDereference))
780  WasModified = true;
781 
782  return nullptr;
783  }
784 
785  static void addMacroVisitorIfNecessary(
786  const ExplodedNode *N, const MemRegion *R,
787  bool EnableNullFPSuppression, BugReport &BR,
788  const SVal V) {
789  AnalyzerOptions &Options = N->getState()->getAnalysisManager().options;
790  if (EnableNullFPSuppression &&
791  Options.ShouldSuppressNullReturnPaths && V.getAs<Loc>())
792  BR.addVisitor(llvm::make_unique<MacroNullReturnSuppressionVisitor>(
793  R->getAs<SubRegion>(), V));
794  }
795 
796  void* getTag() const {
797  static int Tag = 0;
798  return static_cast<void *>(&Tag);
799  }
800 
801  void Profile(llvm::FoldingSetNodeID &ID) const override {
802  ID.AddPointer(getTag());
803  }
804 
805 private:
806  /// \return Source location of right hand side of an assignment
807  /// into \c RegionOfInterest, empty optional if none found.
808  Optional<SourceLocation> matchAssignment(const ExplodedNode *N) {
810  ProgramStateRef State = N->getState();
811  auto *LCtx = N->getLocationContext();
812  if (!S)
813  return None;
814 
815  if (const auto *DS = dyn_cast<DeclStmt>(S)) {
816  if (const auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl()))
817  if (const Expr *RHS = VD->getInit())
818  if (RegionOfInterest->isSubRegionOf(
819  State->getLValue(VD, LCtx).getAsRegion()))
820  return RHS->getBeginLoc();
821  } else if (const auto *BO = dyn_cast<BinaryOperator>(S)) {
822  const MemRegion *R = N->getSVal(BO->getLHS()).getAsRegion();
823  const Expr *RHS = BO->getRHS();
824  if (BO->isAssignmentOp() && RegionOfInterest->isSubRegionOf(R)) {
825  return RHS->getBeginLoc();
826  }
827  }
828  return None;
829  }
830 };
831 
832 } // end of anonymous namespace
833 
834 namespace {
835 
836 /// Emits an extra note at the return statement of an interesting stack frame.
837 ///
838 /// The returned value is marked as an interesting value, and if it's null,
839 /// adds a visitor to track where it became null.
840 ///
841 /// This visitor is intended to be used when another visitor discovers that an
842 /// interesting value comes from an inlined function call.
843 class ReturnVisitor : public BugReporterVisitor {
844  const StackFrameContext *StackFrame;
845  enum {
846  Initial,
847  MaybeUnsuppress,
848  Satisfied
849  } Mode = Initial;
850 
851  bool EnableNullFPSuppression;
852  bool ShouldInvalidate = true;
853  AnalyzerOptions& Options;
854 
855 public:
856  ReturnVisitor(const StackFrameContext *Frame,
857  bool Suppressed,
858  AnalyzerOptions &Options)
859  : StackFrame(Frame), EnableNullFPSuppression(Suppressed),
860  Options(Options) {}
861 
862  static void *getTag() {
863  static int Tag = 0;
864  return static_cast<void *>(&Tag);
865  }
866 
867  void Profile(llvm::FoldingSetNodeID &ID) const override {
868  ID.AddPointer(ReturnVisitor::getTag());
869  ID.AddPointer(StackFrame);
870  ID.AddBoolean(EnableNullFPSuppression);
871  }
872 
873  /// Adds a ReturnVisitor if the given statement represents a call that was
874  /// inlined.
875  ///
876  /// This will search back through the ExplodedGraph, starting from the given
877  /// node, looking for when the given statement was processed. If it turns out
878  /// the statement is a call that was inlined, we add the visitor to the
879  /// bug report, so it can print a note later.
880  static void addVisitorIfNecessary(const ExplodedNode *Node, const Stmt *S,
881  BugReport &BR,
882  bool InEnableNullFPSuppression) {
883  if (!CallEvent::isCallStmt(S))
884  return;
885 
886  // First, find when we processed the statement.
887  // If we work with a 'CXXNewExpr' that is going to be purged away before
888  // its call take place. We would catch that purge in the last condition
889  // as a 'StmtPoint' so we have to bypass it.
890  const bool BypassCXXNewExprEval = isa<CXXNewExpr>(S);
891 
892  // This is moving forward when we enter into another context.
893  const StackFrameContext *CurrentSFC = Node->getStackFrame();
894 
895  do {
896  // If that is satisfied we found our statement as an inlined call.
897  if (Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>())
898  if (CEE->getCalleeContext()->getCallSite() == S)
899  break;
900 
901  // Try to move forward to the end of the call-chain.
902  Node = Node->getFirstPred();
903  if (!Node)
904  break;
905 
906  const StackFrameContext *PredSFC = Node->getStackFrame();
907 
908  // If that is satisfied we found our statement.
909  // FIXME: This code currently bypasses the call site for the
910  // conservatively evaluated allocator.
911  if (!BypassCXXNewExprEval)
912  if (Optional<StmtPoint> SP = Node->getLocationAs<StmtPoint>())
913  // See if we do not enter into another context.
914  if (SP->getStmt() == S && CurrentSFC == PredSFC)
915  break;
916 
917  CurrentSFC = PredSFC;
918  } while (Node->getStackFrame() == CurrentSFC);
919 
920  // Next, step over any post-statement checks.
921  while (Node && Node->getLocation().getAs<PostStmt>())
922  Node = Node->getFirstPred();
923  if (!Node)
924  return;
925 
926  // Finally, see if we inlined the call.
927  Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>();
928  if (!CEE)
929  return;
930 
931  const StackFrameContext *CalleeContext = CEE->getCalleeContext();
932  if (CalleeContext->getCallSite() != S)
933  return;
934 
935  // Check the return value.
936  ProgramStateRef State = Node->getState();
937  SVal RetVal = Node->getSVal(S);
938 
939  // Handle cases where a reference is returned and then immediately used.
940  if (cast<Expr>(S)->isGLValue())
941  if (Optional<Loc> LValue = RetVal.getAs<Loc>())
942  RetVal = State->getSVal(*LValue);
943 
944  // See if the return value is NULL. If so, suppress the report.
945  AnalyzerOptions &Options = State->getAnalysisManager().options;
946 
947  bool EnableNullFPSuppression = false;
948  if (InEnableNullFPSuppression &&
949  Options.ShouldSuppressNullReturnPaths)
950  if (Optional<Loc> RetLoc = RetVal.getAs<Loc>())
951  EnableNullFPSuppression = State->isNull(*RetLoc).isConstrainedTrue();
952 
953  BR.markInteresting(CalleeContext);
954  BR.addVisitor(llvm::make_unique<ReturnVisitor>(CalleeContext,
955  EnableNullFPSuppression,
956  Options));
957  }
958 
959  std::shared_ptr<PathDiagnosticPiece>
960  visitNodeInitial(const ExplodedNode *N,
961  BugReporterContext &BRC, BugReport &BR) {
962  // Only print a message at the interesting return statement.
963  if (N->getLocationContext() != StackFrame)
964  return nullptr;
965 
966  Optional<StmtPoint> SP = N->getLocationAs<StmtPoint>();
967  if (!SP)
968  return nullptr;
969 
970  const auto *Ret = dyn_cast<ReturnStmt>(SP->getStmt());
971  if (!Ret)
972  return nullptr;
973 
974  // Okay, we're at the right return statement, but do we have the return
975  // value available?
976  ProgramStateRef State = N->getState();
977  SVal V = State->getSVal(Ret, StackFrame);
978  if (V.isUnknownOrUndef())
979  return nullptr;
980 
981  // Don't print any more notes after this one.
982  Mode = Satisfied;
983 
984  const Expr *RetE = Ret->getRetValue();
985  assert(RetE && "Tracking a return value for a void function");
986 
987  // Handle cases where a reference is returned and then immediately used.
988  Optional<Loc> LValue;
989  if (RetE->isGLValue()) {
990  if ((LValue = V.getAs<Loc>())) {
991  SVal RValue = State->getRawSVal(*LValue, RetE->getType());
992  if (RValue.getAs<DefinedSVal>())
993  V = RValue;
994  }
995  }
996 
997  // Ignore aggregate rvalues.
998  if (V.getAs<nonloc::LazyCompoundVal>() ||
999  V.getAs<nonloc::CompoundVal>())
1000  return nullptr;
1001 
1002  RetE = RetE->IgnoreParenCasts();
1003 
1004  // If we're returning 0, we should track where that 0 came from.
1005  bugreporter::trackExpressionValue(N, RetE, BR, EnableNullFPSuppression);
1006 
1007  // Build an appropriate message based on the return value.
1008  SmallString<64> Msg;
1009  llvm::raw_svector_ostream Out(Msg);
1010 
1011  if (State->isNull(V).isConstrainedTrue()) {
1012  if (V.getAs<Loc>()) {
1013 
1014  // If we have counter-suppression enabled, make sure we keep visiting
1015  // future nodes. We want to emit a path note as well, in case
1016  // the report is resurrected as valid later on.
1017  if (EnableNullFPSuppression &&
1018  Options.ShouldAvoidSuppressingNullArgumentPaths)
1019  Mode = MaybeUnsuppress;
1020 
1021  if (RetE->getType()->isObjCObjectPointerType()) {
1022  Out << "Returning nil";
1023  } else {
1024  Out << "Returning null pointer";
1025  }
1026  } else {
1027  Out << "Returning zero";
1028  }
1029 
1030  } else {
1031  if (auto CI = V.getAs<nonloc::ConcreteInt>()) {
1032  Out << "Returning the value " << CI->getValue();
1033  } else if (V.getAs<Loc>()) {
1034  Out << "Returning pointer";
1035  } else {
1036  Out << "Returning value";
1037  }
1038  }
1039 
1040  if (LValue) {
1041  if (const MemRegion *MR = LValue->getAsRegion()) {
1042  if (MR->canPrintPretty()) {
1043  Out << " (reference to ";
1044  MR->printPretty(Out);
1045  Out << ")";
1046  }
1047  }
1048  } else {
1049  // FIXME: We should have a more generalized location printing mechanism.
1050  if (const auto *DR = dyn_cast<DeclRefExpr>(RetE))
1051  if (const auto *DD = dyn_cast<DeclaratorDecl>(DR->getDecl()))
1052  Out << " (loaded from '" << *DD << "')";
1053  }
1054 
1055  PathDiagnosticLocation L(Ret, BRC.getSourceManager(), StackFrame);
1056  if (!L.isValid() || !L.asLocation().isValid())
1057  return nullptr;
1058 
1059  return std::make_shared<PathDiagnosticEventPiece>(L, Out.str());
1060  }
1061 
1062  std::shared_ptr<PathDiagnosticPiece>
1063  visitNodeMaybeUnsuppress(const ExplodedNode *N,
1064  BugReporterContext &BRC, BugReport &BR) {
1065 #ifndef NDEBUG
1066  assert(Options.ShouldAvoidSuppressingNullArgumentPaths);
1067 #endif
1068 
1069  // Are we at the entry node for this call?
1070  Optional<CallEnter> CE = N->getLocationAs<CallEnter>();
1071  if (!CE)
1072  return nullptr;
1073 
1074  if (CE->getCalleeContext() != StackFrame)
1075  return nullptr;
1076 
1077  Mode = Satisfied;
1078 
1079  // Don't automatically suppress a report if one of the arguments is
1080  // known to be a null pointer. Instead, start tracking /that/ null
1081  // value back to its origin.
1082  ProgramStateManager &StateMgr = BRC.getStateManager();
1083  CallEventManager &CallMgr = StateMgr.getCallEventManager();
1084 
1085  ProgramStateRef State = N->getState();
1086  CallEventRef<> Call = CallMgr.getCaller(StackFrame, State);
1087  for (unsigned I = 0, E = Call->getNumArgs(); I != E; ++I) {
1088  Optional<Loc> ArgV = Call->getArgSVal(I).getAs<Loc>();
1089  if (!ArgV)
1090  continue;
1091 
1092  const Expr *ArgE = Call->getArgExpr(I);
1093  if (!ArgE)
1094  continue;
1095 
1096  // Is it possible for this argument to be non-null?
1097  if (!State->isNull(*ArgV).isConstrainedTrue())
1098  continue;
1099 
1100  if (bugreporter::trackExpressionValue(N, ArgE, BR, EnableNullFPSuppression))
1101  ShouldInvalidate = false;
1102 
1103  // If we /can't/ track the null pointer, we should err on the side of
1104  // false negatives, and continue towards marking this report invalid.
1105  // (We will still look at the other arguments, though.)
1106  }
1107 
1108  return nullptr;
1109  }
1110 
1111  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
1112  BugReporterContext &BRC,
1113  BugReport &BR) override {
1114  switch (Mode) {
1115  case Initial:
1116  return visitNodeInitial(N, BRC, BR);
1117  case MaybeUnsuppress:
1118  return visitNodeMaybeUnsuppress(N, BRC, BR);
1119  case Satisfied:
1120  return nullptr;
1121  }
1122 
1123  llvm_unreachable("Invalid visit mode!");
1124  }
1125 
1126  void finalizeVisitor(BugReporterContext &, const ExplodedNode *,
1127  BugReport &BR) override {
1128  if (EnableNullFPSuppression && ShouldInvalidate)
1129  BR.markInvalid(ReturnVisitor::getTag(), StackFrame);
1130  }
1131 };
1132 
1133 } // end of anonymous namespace
1134 
1135 //===----------------------------------------------------------------------===//
1136 // Implementation of FindLastStoreBRVisitor.
1137 //===----------------------------------------------------------------------===//
1138 
1139 void FindLastStoreBRVisitor::Profile(llvm::FoldingSetNodeID &ID) const {
1140  static int tag = 0;
1141  ID.AddPointer(&tag);
1142  ID.AddPointer(R);
1143  ID.Add(V);
1144  ID.AddBoolean(EnableNullFPSuppression);
1145 }
1146 
1147 /// Returns true if \p N represents the DeclStmt declaring and initializing
1148 /// \p VR.
1149 static bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR) {
1150  Optional<PostStmt> P = N->getLocationAs<PostStmt>();
1151  if (!P)
1152  return false;
1153 
1154  const DeclStmt *DS = P->getStmtAs<DeclStmt>();
1155  if (!DS)
1156  return false;
1157 
1158  if (DS->getSingleDecl() != VR->getDecl())
1159  return false;
1160 
1161  const MemSpaceRegion *VarSpace = VR->getMemorySpace();
1162  const auto *FrameSpace = dyn_cast<StackSpaceRegion>(VarSpace);
1163  if (!FrameSpace) {
1164  // If we ever directly evaluate global DeclStmts, this assertion will be
1165  // invalid, but this still seems preferable to silently accepting an
1166  // initialization that may be for a path-sensitive variable.
1167  assert(VR->getDecl()->isStaticLocal() && "non-static stackless VarRegion");
1168  return true;
1169  }
1170 
1171  assert(VR->getDecl()->hasLocalStorage());
1172  const LocationContext *LCtx = N->getLocationContext();
1173  return FrameSpace->getStackFrame() == LCtx->getStackFrame();
1174 }
1175 
1176 /// Show diagnostics for initializing or declaring a region \p R with a bad value.
1177 static void showBRDiagnostics(const char *action, llvm::raw_svector_ostream &os,
1178  const MemRegion *R, SVal V, const DeclStmt *DS) {
1179  if (R->canPrintPretty()) {
1180  R->printPretty(os);
1181  os << " ";
1182  }
1183 
1184  if (V.getAs<loc::ConcreteInt>()) {
1185  bool b = false;
1186  if (R->isBoundable()) {
1187  if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
1188  if (TR->getValueType()->isObjCObjectPointerType()) {
1189  os << action << "nil";
1190  b = true;
1191  }
1192  }
1193  }
1194  if (!b)
1195  os << action << "a null pointer value";
1196 
1197  } else if (auto CVal = V.getAs<nonloc::ConcreteInt>()) {
1198  os << action << CVal->getValue();
1199  } else if (DS) {
1200  if (V.isUndef()) {
1201  if (isa<VarRegion>(R)) {
1202  const auto *VD = cast<VarDecl>(DS->getSingleDecl());
1203  if (VD->getInit()) {
1204  os << (R->canPrintPretty() ? "initialized" : "Initializing")
1205  << " to a garbage value";
1206  } else {
1207  os << (R->canPrintPretty() ? "declared" : "Declaring")
1208  << " without an initial value";
1209  }
1210  }
1211  } else {
1212  os << (R->canPrintPretty() ? "initialized" : "Initialized")
1213  << " here";
1214  }
1215  }
1216 }
1217 
1218 /// Display diagnostics for passing bad region as a parameter.
1219 static void showBRParamDiagnostics(llvm::raw_svector_ostream& os,
1220  const VarRegion *VR,
1221  SVal V) {
1222  const auto *Param = cast<ParmVarDecl>(VR->getDecl());
1223 
1224  os << "Passing ";
1225 
1226  if (V.getAs<loc::ConcreteInt>()) {
1227  if (Param->getType()->isObjCObjectPointerType())
1228  os << "nil object reference";
1229  else
1230  os << "null pointer value";
1231  } else if (V.isUndef()) {
1232  os << "uninitialized value";
1233  } else if (auto CI = V.getAs<nonloc::ConcreteInt>()) {
1234  os << "the value " << CI->getValue();
1235  } else {
1236  os << "value";
1237  }
1238 
1239  // Printed parameter indexes are 1-based, not 0-based.
1240  unsigned Idx = Param->getFunctionScopeIndex() + 1;
1241  os << " via " << Idx << llvm::getOrdinalSuffix(Idx) << " parameter";
1242  if (VR->canPrintPretty()) {
1243  os << " ";
1244  VR->printPretty(os);
1245  }
1246 }
1247 
1248 /// Show default diagnostics for storing bad region.
1249 static void showBRDefaultDiagnostics(llvm::raw_svector_ostream& os,
1250  const MemRegion *R,
1251  SVal V) {
1252  if (V.getAs<loc::ConcreteInt>()) {
1253  bool b = false;
1254  if (R->isBoundable()) {
1255  if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
1256  if (TR->getValueType()->isObjCObjectPointerType()) {
1257  os << "nil object reference stored";
1258  b = true;
1259  }
1260  }
1261  }
1262  if (!b) {
1263  if (R->canPrintPretty())
1264  os << "Null pointer value stored";
1265  else
1266  os << "Storing null pointer value";
1267  }
1268 
1269  } else if (V.isUndef()) {
1270  if (R->canPrintPretty())
1271  os << "Uninitialized value stored";
1272  else
1273  os << "Storing uninitialized value";
1274 
1275  } else if (auto CV = V.getAs<nonloc::ConcreteInt>()) {
1276  if (R->canPrintPretty())
1277  os << "The value " << CV->getValue() << " is assigned";
1278  else
1279  os << "Assigning " << CV->getValue();
1280 
1281  } else {
1282  if (R->canPrintPretty())
1283  os << "Value assigned";
1284  else
1285  os << "Assigning value";
1286  }
1287 
1288  if (R->canPrintPretty()) {
1289  os << " to ";
1290  R->printPretty(os);
1291  }
1292 }
1293 
1294 std::shared_ptr<PathDiagnosticPiece>
1295 FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
1296  BugReporterContext &BRC, BugReport &BR) {
1297  if (Satisfied)
1298  return nullptr;
1299 
1300  const ExplodedNode *StoreSite = nullptr;
1301  const ExplodedNode *Pred = Succ->getFirstPred();
1302  const Expr *InitE = nullptr;
1303  bool IsParam = false;
1304 
1305  // First see if we reached the declaration of the region.
1306  if (const auto *VR = dyn_cast<VarRegion>(R)) {
1307  if (isInitializationOfVar(Pred, VR)) {
1308  StoreSite = Pred;
1309  InitE = VR->getDecl()->getInit();
1310  }
1311  }
1312 
1313  // If this is a post initializer expression, initializing the region, we
1314  // should track the initializer expression.
1315  if (Optional<PostInitializer> PIP = Pred->getLocationAs<PostInitializer>()) {
1316  const MemRegion *FieldReg = (const MemRegion *)PIP->getLocationValue();
1317  if (FieldReg && FieldReg == R) {
1318  StoreSite = Pred;
1319  InitE = PIP->getInitializer()->getInit();
1320  }
1321  }
1322 
1323  // Otherwise, see if this is the store site:
1324  // (1) Succ has this binding and Pred does not, i.e. this is
1325  // where the binding first occurred.
1326  // (2) Succ has this binding and is a PostStore node for this region, i.e.
1327  // the same binding was re-assigned here.
1328  if (!StoreSite) {
1329  if (Succ->getState()->getSVal(R) != V)
1330  return nullptr;
1331 
1332  if (hasVisibleUpdate(Pred, Pred->getState()->getSVal(R), Succ, V)) {
1333  Optional<PostStore> PS = Succ->getLocationAs<PostStore>();
1334  if (!PS || PS->getLocationValue() != R)
1335  return nullptr;
1336  }
1337 
1338  StoreSite = Succ;
1339 
1340  // If this is an assignment expression, we can track the value
1341  // being assigned.
1342  if (Optional<PostStmt> P = Succ->getLocationAs<PostStmt>())
1343  if (const BinaryOperator *BO = P->getStmtAs<BinaryOperator>())
1344  if (BO->isAssignmentOp())
1345  InitE = BO->getRHS();
1346 
1347  // If this is a call entry, the variable should be a parameter.
1348  // FIXME: Handle CXXThisRegion as well. (This is not a priority because
1349  // 'this' should never be NULL, but this visitor isn't just for NULL and
1350  // UndefinedVal.)
1351  if (Optional<CallEnter> CE = Succ->getLocationAs<CallEnter>()) {
1352  if (const auto *VR = dyn_cast<VarRegion>(R)) {
1353 
1354  const auto *Param = cast<ParmVarDecl>(VR->getDecl());
1355 
1356  ProgramStateManager &StateMgr = BRC.getStateManager();
1357  CallEventManager &CallMgr = StateMgr.getCallEventManager();
1358 
1359  CallEventRef<> Call = CallMgr.getCaller(CE->getCalleeContext(),
1360  Succ->getState());
1361  InitE = Call->getArgExpr(Param->getFunctionScopeIndex());
1362  IsParam = true;
1363  }
1364  }
1365 
1366  // If this is a CXXTempObjectRegion, the Expr responsible for its creation
1367  // is wrapped inside of it.
1368  if (const auto *TmpR = dyn_cast<CXXTempObjectRegion>(R))
1369  InitE = TmpR->getExpr();
1370  }
1371 
1372  if (!StoreSite)
1373  return nullptr;
1374  Satisfied = true;
1375 
1376  // If we have an expression that provided the value, try to track where it
1377  // came from.
1378  if (InitE) {
1379  if (V.isUndef() ||
1380  V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) {
1381  if (!IsParam)
1382  InitE = InitE->IgnoreParenCasts();
1383  bugreporter::trackExpressionValue(StoreSite, InitE, BR,
1384  EnableNullFPSuppression);
1385  }
1386  ReturnVisitor::addVisitorIfNecessary(StoreSite, InitE->IgnoreParenCasts(),
1387  BR, EnableNullFPSuppression);
1388  }
1389 
1390  // Okay, we've found the binding. Emit an appropriate message.
1391  SmallString<256> sbuf;
1392  llvm::raw_svector_ostream os(sbuf);
1393 
1394  if (Optional<PostStmt> PS = StoreSite->getLocationAs<PostStmt>()) {
1395  const Stmt *S = PS->getStmt();
1396  const char *action = nullptr;
1397  const auto *DS = dyn_cast<DeclStmt>(S);
1398  const auto *VR = dyn_cast<VarRegion>(R);
1399 
1400  if (DS) {
1401  action = R->canPrintPretty() ? "initialized to " :
1402  "Initializing to ";
1403  } else if (isa<BlockExpr>(S)) {
1404  action = R->canPrintPretty() ? "captured by block as " :
1405  "Captured by block as ";
1406  if (VR) {
1407  // See if we can get the BlockVarRegion.
1408  ProgramStateRef State = StoreSite->getState();
1409  SVal V = StoreSite->getSVal(S);
1410  if (const auto *BDR =
1411  dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
1412  if (const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) {
1413  if (auto KV = State->getSVal(OriginalR).getAs<KnownSVal>())
1414  BR.addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1415  *KV, OriginalR, EnableNullFPSuppression));
1416  }
1417  }
1418  }
1419  }
1420  if (action)
1421  showBRDiagnostics(action, os, R, V, DS);
1422 
1423  } else if (StoreSite->getLocation().getAs<CallEnter>()) {
1424  if (const auto *VR = dyn_cast<VarRegion>(R))
1425  showBRParamDiagnostics(os, VR, V);
1426  }
1427 
1428  if (os.str().empty())
1429  showBRDefaultDiagnostics(os, R, V);
1430 
1431  // Construct a new PathDiagnosticPiece.
1432  ProgramPoint P = StoreSite->getLocation();
1433  PathDiagnosticLocation L;
1434  if (P.getAs<CallEnter>() && InitE)
1435  L = PathDiagnosticLocation(InitE, BRC.getSourceManager(),
1436  P.getLocationContext());
1437 
1438  if (!L.isValid() || !L.asLocation().isValid())
1439  L = PathDiagnosticLocation::create(P, BRC.getSourceManager());
1440 
1441  if (!L.isValid() || !L.asLocation().isValid())
1442  return nullptr;
1443 
1444  return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
1445 }
1446 
1447 //===----------------------------------------------------------------------===//
1448 // Implementation of TrackConstraintBRVisitor.
1449 //===----------------------------------------------------------------------===//
1450 
1451 void TrackConstraintBRVisitor::Profile(llvm::FoldingSetNodeID &ID) const {
1452  static int tag = 0;
1453  ID.AddPointer(&tag);
1454  ID.AddBoolean(Assumption);
1455  ID.Add(Constraint);
1456 }
1457 
1458 /// Return the tag associated with this visitor. This tag will be used
1459 /// to make all PathDiagnosticPieces created by this visitor.
1460 const char *TrackConstraintBRVisitor::getTag() {
1461  return "TrackConstraintBRVisitor";
1462 }
1463 
1464 bool TrackConstraintBRVisitor::isUnderconstrained(const ExplodedNode *N) const {
1465  if (IsZeroCheck)
1466  return N->getState()->isNull(Constraint).isUnderconstrained();
1467  return (bool)N->getState()->assume(Constraint, !Assumption);
1468 }
1469 
1470 std::shared_ptr<PathDiagnosticPiece>
1471 TrackConstraintBRVisitor::VisitNode(const ExplodedNode *N,
1472  BugReporterContext &BRC, BugReport &) {
1473  const ExplodedNode *PrevN = N->getFirstPred();
1474  if (IsSatisfied)
1475  return nullptr;
1476 
1477  // Start tracking after we see the first state in which the value is
1478  // constrained.
1479  if (!IsTrackingTurnedOn)
1480  if (!isUnderconstrained(N))
1481  IsTrackingTurnedOn = true;
1482  if (!IsTrackingTurnedOn)
1483  return nullptr;
1484 
1485  // Check if in the previous state it was feasible for this constraint
1486  // to *not* be true.
1487  if (isUnderconstrained(PrevN)) {
1488  IsSatisfied = true;
1489 
1490  // As a sanity check, make sure that the negation of the constraint
1491  // was infeasible in the current state. If it is feasible, we somehow
1492  // missed the transition point.
1493  assert(!isUnderconstrained(N));
1494 
1495  // We found the transition point for the constraint. We now need to
1496  // pretty-print the constraint. (work-in-progress)
1497  SmallString<64> sbuf;
1498  llvm::raw_svector_ostream os(sbuf);
1499 
1500  if (Constraint.getAs<Loc>()) {
1501  os << "Assuming pointer value is ";
1502  os << (Assumption ? "non-null" : "null");
1503  }
1504 
1505  if (os.str().empty())
1506  return nullptr;
1507 
1508  // Construct a new PathDiagnosticPiece.
1509  ProgramPoint P = N->getLocation();
1510  PathDiagnosticLocation L =
1511  PathDiagnosticLocation::create(P, BRC.getSourceManager());
1512  if (!L.isValid())
1513  return nullptr;
1514 
1515  auto X = std::make_shared<PathDiagnosticEventPiece>(L, os.str());
1516  X->setTag(getTag());
1517  return std::move(X);
1518  }
1519 
1520  return nullptr;
1521 }
1522 
1523 //===----------------------------------------------------------------------===//
1524 // Implementation of SuppressInlineDefensiveChecksVisitor.
1525 //===----------------------------------------------------------------------===//
1526 
1527 SuppressInlineDefensiveChecksVisitor::
1528 SuppressInlineDefensiveChecksVisitor(DefinedSVal Value, const ExplodedNode *N)
1529  : V(Value) {
1530  // Check if the visitor is disabled.
1531  AnalyzerOptions &Options = N->getState()->getAnalysisManager().options;
1532  if (!Options.ShouldSuppressInlinedDefensiveChecks)
1533  IsSatisfied = true;
1534 
1535  assert(N->getState()->isNull(V).isConstrainedTrue() &&
1536  "The visitor only tracks the cases where V is constrained to 0");
1537 }
1538 
1539 void SuppressInlineDefensiveChecksVisitor::Profile(
1540  llvm::FoldingSetNodeID &ID) const {
1541  static int id = 0;
1542  ID.AddPointer(&id);
1543  ID.Add(V);
1544 }
1545 
1546 const char *SuppressInlineDefensiveChecksVisitor::getTag() {
1547  return "IDCVisitor";
1548 }
1549 
1550 std::shared_ptr<PathDiagnosticPiece>
1551 SuppressInlineDefensiveChecksVisitor::VisitNode(const ExplodedNode *Succ,
1552  BugReporterContext &BRC,
1553  BugReport &BR) {
1554  const ExplodedNode *Pred = Succ->getFirstPred();
1555  if (IsSatisfied)
1556  return nullptr;
1557 
1558  // Start tracking after we see the first state in which the value is null.
1559  if (!IsTrackingTurnedOn)
1560  if (Succ->getState()->isNull(V).isConstrainedTrue())
1561  IsTrackingTurnedOn = true;
1562  if (!IsTrackingTurnedOn)
1563  return nullptr;
1564 
1565  // Check if in the previous state it was feasible for this value
1566  // to *not* be null.
1567  if (!Pred->getState()->isNull(V).isConstrainedTrue()) {
1568  IsSatisfied = true;
1569 
1570  assert(Succ->getState()->isNull(V).isConstrainedTrue());
1571 
1572  // Check if this is inlined defensive checks.
1573  const LocationContext *CurLC =Succ->getLocationContext();
1574  const LocationContext *ReportLC = BR.getErrorNode()->getLocationContext();
1575  if (CurLC != ReportLC && !CurLC->isParentOf(ReportLC)) {
1576  BR.markInvalid("Suppress IDC", CurLC);
1577  return nullptr;
1578  }
1579 
1580  // Treat defensive checks in function-like macros as if they were an inlined
1581  // defensive check. If the bug location is not in a macro and the
1582  // terminator for the current location is in a macro then suppress the
1583  // warning.
1584  auto BugPoint = BR.getErrorNode()->getLocation().getAs<StmtPoint>();
1585 
1586  if (!BugPoint)
1587  return nullptr;
1588 
1589  ProgramPoint CurPoint = Succ->getLocation();
1590  const Stmt *CurTerminatorStmt = nullptr;
1591  if (auto BE = CurPoint.getAs<BlockEdge>()) {
1592  CurTerminatorStmt = BE->getSrc()->getTerminator().getStmt();
1593  } else if (auto SP = CurPoint.getAs<StmtPoint>()) {
1594  const Stmt *CurStmt = SP->getStmt();
1595  if (!CurStmt->getBeginLoc().isMacroID())
1596  return nullptr;
1597 
1598  CFGStmtMap *Map = CurLC->getAnalysisDeclContext()->getCFGStmtMap();
1599  CurTerminatorStmt = Map->getBlock(CurStmt)->getTerminatorStmt();
1600  } else {
1601  return nullptr;
1602  }
1603 
1604  if (!CurTerminatorStmt)
1605  return nullptr;
1606 
1607  SourceLocation TerminatorLoc = CurTerminatorStmt->getBeginLoc();
1608  if (TerminatorLoc.isMacroID()) {
1609  SourceLocation BugLoc = BugPoint->getStmt()->getBeginLoc();
1610 
1611  // Suppress reports unless we are in that same macro.
1612  if (!BugLoc.isMacroID() ||
1613  getMacroName(BugLoc, BRC) != getMacroName(TerminatorLoc, BRC)) {
1614  BR.markInvalid("Suppress Macro IDC", CurLC);
1615  }
1616  return nullptr;
1617  }
1618  }
1619  return nullptr;
1620 }
1621 
1622 //===----------------------------------------------------------------------===//
1623 // TrackControlDependencyCondBRVisitor.
1624 //===----------------------------------------------------------------------===//
1625 
1626 namespace {
1627 /// Tracks the expressions that are a control dependency of the node that was
1628 /// supplied to the constructor.
1629 /// For example:
1630 ///
1631 /// cond = 1;
1632 /// if (cond)
1633 /// 10 / 0;
1634 ///
1635 /// An error is emitted at line 3. This visitor realizes that the branch
1636 /// on line 2 is a control dependency of line 3, and tracks it's condition via
1637 /// trackExpressionValue().
1638 class TrackControlDependencyCondBRVisitor final : public BugReporterVisitor {
1639  const ExplodedNode *Origin;
1640  ControlDependencyCalculator ControlDeps;
1641  llvm::SmallSet<const CFGBlock *, 32> VisitedBlocks;
1642 
1643 public:
1644  TrackControlDependencyCondBRVisitor(const ExplodedNode *O)
1645  : Origin(O), ControlDeps(&O->getCFG()) {}
1646 
1647  void Profile(llvm::FoldingSetNodeID &ID) const override {
1648  static int x = 0;
1649  ID.AddPointer(&x);
1650  }
1651 
1652  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
1653  BugReporterContext &BRC,
1654  BugReport &BR) override;
1655 };
1656 } // end of anonymous namespace
1657 
1658 static CFGBlock *GetRelevantBlock(const ExplodedNode *Node) {
1659  if (auto SP = Node->getLocationAs<StmtPoint>()) {
1660  const Stmt *S = SP->getStmt();
1661  assert(S);
1662 
1663  return const_cast<CFGBlock *>(Node->getLocationContext()
1664  ->getAnalysisDeclContext()->getCFGStmtMap()->getBlock(S));
1665  }
1666 
1667  return nullptr;
1668 }
1669 
1670 static std::shared_ptr<PathDiagnosticEventPiece>
1672  const ExplodedNode *N,
1673  BugReporterContext &BRC) {
1674 
1675  if (BRC.getAnalyzerOptions().AnalysisDiagOpt == PD_NONE ||
1676  !BRC.getAnalyzerOptions().ShouldTrackConditionsDebug)
1677  return nullptr;
1678 
1679  std::string ConditionText = Lexer::getSourceText(
1681  BRC.getSourceManager(),
1682  BRC.getASTContext().getLangOpts());
1683 
1684  return std::make_shared<PathDiagnosticEventPiece>(
1686  Cond, BRC.getSourceManager(), N->getLocationContext()),
1687  (Twine() + "Tracking condition '" + ConditionText + "'").str());
1688 }
1689 
1690 std::shared_ptr<PathDiagnosticPiece>
1691 TrackControlDependencyCondBRVisitor::VisitNode(const ExplodedNode *N,
1692  BugReporterContext &BRC,
1693  BugReport &BR) {
1694  // We can only reason about control dependencies within the same stack frame.
1695  if (Origin->getStackFrame() != N->getStackFrame())
1696  return nullptr;
1697 
1698  CFGBlock *NB = GetRelevantBlock(N);
1699 
1700  // Skip if we already inspected this block.
1701  if (!VisitedBlocks.insert(NB).second)
1702  return nullptr;
1703 
1704  CFGBlock *OriginB = GetRelevantBlock(Origin);
1705 
1706  // TODO: Cache CFGBlocks for each ExplodedNode.
1707  if (!OriginB || !NB)
1708  return nullptr;
1709 
1710  if (ControlDeps.isControlDependent(OriginB, NB)) {
1711  if (const Expr *Condition = NB->getLastCondition()) {
1712  // Keeping track of the already tracked conditions on a visitor level
1713  // isn't sufficient, because a new visitor is created for each tracked
1714  // expression, hence the BugReport level set.
1715  if (BR.addTrackedCondition(N)) {
1716  bugreporter::trackExpressionValue(
1717  N, Condition, BR, /*EnableNullFPSuppression=*/false);
1718  return constructDebugPieceForTrackedCondition(Condition, N, BRC);
1719  }
1720  }
1721  }
1722 
1723  return nullptr;
1724 }
1725 
1726 //===----------------------------------------------------------------------===//
1727 // Implementation of trackExpressionValue.
1728 //===----------------------------------------------------------------------===//
1729 
1730 static const MemRegion *getLocationRegionIfReference(const Expr *E,
1731  const ExplodedNode *N) {
1732  if (const auto *DR = dyn_cast<DeclRefExpr>(E)) {
1733  if (const auto *VD = dyn_cast<VarDecl>(DR->getDecl())) {
1734  if (!VD->getType()->isReferenceType())
1735  return nullptr;
1736  ProgramStateManager &StateMgr = N->getState()->getStateManager();
1737  MemRegionManager &MRMgr = StateMgr.getRegionManager();
1738  return MRMgr.getVarRegion(VD, N->getLocationContext());
1739  }
1740  }
1741 
1742  // FIXME: This does not handle other kinds of null references,
1743  // for example, references from FieldRegions:
1744  // struct Wrapper { int &ref; };
1745  // Wrapper w = { *(int *)0 };
1746  // w.ref = 1;
1747 
1748  return nullptr;
1749 }
1750 
1751 /// \return A subexpression of {@code Ex} which represents the
1752 /// expression-of-interest.
1753 static const Expr *peelOffOuterExpr(const Expr *Ex,
1754  const ExplodedNode *N) {
1755  Ex = Ex->IgnoreParenCasts();
1756  if (const auto *FE = dyn_cast<FullExpr>(Ex))
1757  return peelOffOuterExpr(FE->getSubExpr(), N);
1758  if (const auto *OVE = dyn_cast<OpaqueValueExpr>(Ex))
1759  return peelOffOuterExpr(OVE->getSourceExpr(), N);
1760  if (const auto *POE = dyn_cast<PseudoObjectExpr>(Ex)) {
1761  const auto *PropRef = dyn_cast<ObjCPropertyRefExpr>(POE->getSyntacticForm());
1762  if (PropRef && PropRef->isMessagingGetter()) {
1763  const Expr *GetterMessageSend =
1764  POE->getSemanticExpr(POE->getNumSemanticExprs() - 1);
1765  assert(isa<ObjCMessageExpr>(GetterMessageSend->IgnoreParenCasts()));
1766  return peelOffOuterExpr(GetterMessageSend, N);
1767  }
1768  }
1769 
1770  // Peel off the ternary operator.
1771  if (const auto *CO = dyn_cast<ConditionalOperator>(Ex)) {
1772  // Find a node where the branching occurred and find out which branch
1773  // we took (true/false) by looking at the ExplodedGraph.
1774  const ExplodedNode *NI = N;
1775  do {
1776  ProgramPoint ProgPoint = NI->getLocation();
1777  if (Optional<BlockEdge> BE = ProgPoint.getAs<BlockEdge>()) {
1778  const CFGBlock *srcBlk = BE->getSrc();
1779  if (const Stmt *term = srcBlk->getTerminatorStmt()) {
1780  if (term == CO) {
1781  bool TookTrueBranch = (*(srcBlk->succ_begin()) == BE->getDst());
1782  if (TookTrueBranch)
1783  return peelOffOuterExpr(CO->getTrueExpr(), N);
1784  else
1785  return peelOffOuterExpr(CO->getFalseExpr(), N);
1786  }
1787  }
1788  }
1789  NI = NI->getFirstPred();
1790  } while (NI);
1791  }
1792 
1793  if (auto *BO = dyn_cast<BinaryOperator>(Ex))
1794  if (const Expr *SubEx = peelOffPointerArithmetic(BO))
1795  return peelOffOuterExpr(SubEx, N);
1796 
1797  if (auto *UO = dyn_cast<UnaryOperator>(Ex)) {
1798  if (UO->getOpcode() == UO_LNot)
1799  return peelOffOuterExpr(UO->getSubExpr(), N);
1800 
1801  // FIXME: There's a hack in our Store implementation that always computes
1802  // field offsets around null pointers as if they are always equal to 0.
1803  // The idea here is to report accesses to fields as null dereferences
1804  // even though the pointer value that's being dereferenced is actually
1805  // the offset of the field rather than exactly 0.
1806  // See the FIXME in StoreManager's getLValueFieldOrIvar() method.
1807  // This code interacts heavily with this hack; otherwise the value
1808  // would not be null at all for most fields, so we'd be unable to track it.
1809  if (UO->getOpcode() == UO_AddrOf && UO->getSubExpr()->isLValue())
1810  if (const Expr *DerefEx = bugreporter::getDerefExpr(UO->getSubExpr()))
1811  return peelOffOuterExpr(DerefEx, N);
1812  }
1813 
1814  return Ex;
1815 }
1816 
1817 /// Find the ExplodedNode where the lvalue (the value of 'Ex')
1818 /// was computed.
1819 static const ExplodedNode* findNodeForExpression(const ExplodedNode *N,
1820  const Expr *Inner) {
1821  while (N) {
1822  if (PathDiagnosticLocation::getStmt(N) == Inner)
1823  return N;
1824  N = N->getFirstPred();
1825  }
1826  return N;
1827 }
1828 
1829 bool bugreporter::trackExpressionValue(const ExplodedNode *InputNode,
1830  const Expr *E, BugReport &report,
1831  bool EnableNullFPSuppression) {
1832  if (!E || !InputNode)
1833  return false;
1834 
1835  const Expr *Inner = peelOffOuterExpr(E, InputNode);
1836  const ExplodedNode *LVNode = findNodeForExpression(InputNode, Inner);
1837  if (!LVNode)
1838  return false;
1839 
1840  ProgramStateRef LVState = LVNode->getState();
1841 
1842  // We only track expressions if we believe that they are important. Chances
1843  // are good that control dependencies to the tracking point are also improtant
1844  // because of this, let's explain why we believe control reached this point.
1845  // TODO: Shouldn't we track control dependencies of every bug location, rather
1846  // than only tracked expressions?
1847  if (LVState->getAnalysisManager().getAnalyzerOptions().ShouldTrackConditions)
1848  report.addVisitor(llvm::make_unique<TrackControlDependencyCondBRVisitor>(
1849  InputNode));
1850 
1851  // The message send could be nil due to the receiver being nil.
1852  // At this point in the path, the receiver should be live since we are at the
1853  // message send expr. If it is nil, start tracking it.
1854  if (const Expr *Receiver = NilReceiverBRVisitor::getNilReceiver(Inner, LVNode))
1855  trackExpressionValue(LVNode, Receiver, report, EnableNullFPSuppression);
1856 
1857  // Track the index if this is an array subscript.
1858  if (const auto *Arr = dyn_cast<ArraySubscriptExpr>(Inner))
1859  trackExpressionValue(
1860  LVNode, Arr->getIdx(), report, /*EnableNullFPSuppression*/ false);
1861 
1862  // See if the expression we're interested refers to a variable.
1863  // If so, we can track both its contents and constraints on its value.
1865  SVal LVal = LVNode->getSVal(Inner);
1866 
1867  const MemRegion *RR = getLocationRegionIfReference(Inner, LVNode);
1868  bool LVIsNull = LVState->isNull(LVal).isConstrainedTrue();
1869 
1870  // If this is a C++ reference to a null pointer, we are tracking the
1871  // pointer. In addition, we should find the store at which the reference
1872  // got initialized.
1873  if (RR && !LVIsNull)
1874  if (auto KV = LVal.getAs<KnownSVal>())
1875  report.addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1876  *KV, RR, EnableNullFPSuppression));
1877 
1878  // In case of C++ references, we want to differentiate between a null
1879  // reference and reference to null pointer.
1880  // If the LVal is null, check if we are dealing with null reference.
1881  // For those, we want to track the location of the reference.
1882  const MemRegion *R = (RR && LVIsNull) ? RR :
1883  LVNode->getSVal(Inner).getAsRegion();
1884 
1885  if (R) {
1886 
1887  // Mark both the variable region and its contents as interesting.
1888  SVal V = LVState->getRawSVal(loc::MemRegionVal(R));
1889  report.addVisitor(
1890  llvm::make_unique<NoStoreFuncVisitor>(cast<SubRegion>(R)));
1891 
1892  MacroNullReturnSuppressionVisitor::addMacroVisitorIfNecessary(
1893  LVNode, R, EnableNullFPSuppression, report, V);
1894 
1895  report.markInteresting(V);
1896  report.addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(R));
1897 
1898  // If the contents are symbolic, find out when they became null.
1899  if (V.getAsLocSymbol(/*IncludeBaseRegions*/ true))
1900  report.addVisitor(llvm::make_unique<TrackConstraintBRVisitor>(
1901  V.castAs<DefinedSVal>(), false));
1902 
1903  // Add visitor, which will suppress inline defensive checks.
1904  if (auto DV = V.getAs<DefinedSVal>())
1905  if (!DV->isZeroConstant() && LVState->isNull(*DV).isConstrainedTrue() &&
1906  EnableNullFPSuppression)
1907  report.addVisitor(
1908  llvm::make_unique<SuppressInlineDefensiveChecksVisitor>(*DV,
1909  LVNode));
1910 
1911  if (auto KV = V.getAs<KnownSVal>())
1912  report.addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1913  *KV, R, EnableNullFPSuppression));
1914  return true;
1915  }
1916  }
1917 
1918  // If the expression is not an "lvalue expression", we can still
1919  // track the constraints on its contents.
1920  SVal V = LVState->getSValAsScalarOrLoc(Inner, LVNode->getLocationContext());
1921 
1922  ReturnVisitor::addVisitorIfNecessary(
1923  LVNode, Inner, report, EnableNullFPSuppression);
1924 
1925  // Is it a symbolic value?
1926  if (auto L = V.getAs<loc::MemRegionVal>()) {
1927  report.addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(L->getRegion()));
1928 
1929  // FIXME: this is a hack for fixing a later crash when attempting to
1930  // dereference a void* pointer.
1931  // We should not try to dereference pointers at all when we don't care
1932  // what is written inside the pointer.
1933  bool CanDereference = true;
1934  if (const auto *SR = dyn_cast<SymbolicRegion>(L->getRegion()))
1935  if (SR->getSymbol()->getType()->getPointeeType()->isVoidType())
1936  CanDereference = false;
1937 
1938  // At this point we are dealing with the region's LValue.
1939  // However, if the rvalue is a symbolic region, we should track it as well.
1940  // Try to use the correct type when looking up the value.
1941  SVal RVal;
1943  RVal = LVState->getRawSVal(L.getValue(), Inner->getType());
1944  } else if (CanDereference) {
1945  RVal = LVState->getSVal(L->getRegion());
1946  }
1947 
1948  if (CanDereference)
1949  if (auto KV = RVal.getAs<KnownSVal>())
1950  report.addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1951  *KV, L->getRegion(), EnableNullFPSuppression));
1952 
1953  const MemRegion *RegionRVal = RVal.getAsRegion();
1954  if (RegionRVal && isa<SymbolicRegion>(RegionRVal)) {
1955  report.markInteresting(RegionRVal);
1956  report.addVisitor(llvm::make_unique<TrackConstraintBRVisitor>(
1957  loc::MemRegionVal(RegionRVal), /*assumption=*/false));
1958  }
1959  }
1960  return true;
1961 }
1962 
1963 //===----------------------------------------------------------------------===//
1964 // Implementation of NulReceiverBRVisitor.
1965 //===----------------------------------------------------------------------===//
1966 
1967 const Expr *NilReceiverBRVisitor::getNilReceiver(const Stmt *S,
1968  const ExplodedNode *N) {
1969  const auto *ME = dyn_cast<ObjCMessageExpr>(S);
1970  if (!ME)
1971  return nullptr;
1972  if (const Expr *Receiver = ME->getInstanceReceiver()) {
1973  ProgramStateRef state = N->getState();
1974  SVal V = N->getSVal(Receiver);
1975  if (state->isNull(V).isConstrainedTrue())
1976  return Receiver;
1977  }
1978  return nullptr;
1979 }
1980 
1981 std::shared_ptr<PathDiagnosticPiece>
1982 NilReceiverBRVisitor::VisitNode(const ExplodedNode *N,
1983  BugReporterContext &BRC, BugReport &BR) {
1984  Optional<PreStmt> P = N->getLocationAs<PreStmt>();
1985  if (!P)
1986  return nullptr;
1987 
1988  const Stmt *S = P->getStmt();
1989  const Expr *Receiver = getNilReceiver(S, N);
1990  if (!Receiver)
1991  return nullptr;
1992 
1994  llvm::raw_svector_ostream OS(Buf);
1995 
1996  if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1997  OS << "'";
1998  ME->getSelector().print(OS);
1999  OS << "' not called";
2000  }
2001  else {
2002  OS << "No method is called";
2003  }
2004  OS << " because the receiver is nil";
2005 
2006  // The receiver was nil, and hence the method was skipped.
2007  // Register a BugReporterVisitor to issue a message telling us how
2008  // the receiver was null.
2009  bugreporter::trackExpressionValue(N, Receiver, BR,
2010  /*EnableNullFPSuppression*/ false);
2011  // Issue a message saying that the method was skipped.
2012  PathDiagnosticLocation L(Receiver, BRC.getSourceManager(),
2013  N->getLocationContext());
2014  return std::make_shared<PathDiagnosticEventPiece>(L, OS.str());
2015 }
2016 
2017 //===----------------------------------------------------------------------===//
2018 // Implementation of FindLastStoreBRVisitor.
2019 //===----------------------------------------------------------------------===//
2020 
2021 // Registers every VarDecl inside a Stmt with a last store visitor.
2022 void FindLastStoreBRVisitor::registerStatementVarDecls(BugReport &BR,
2023  const Stmt *S,
2024  bool EnableNullFPSuppression) {
2025  const ExplodedNode *N = BR.getErrorNode();
2026  std::deque<const Stmt *> WorkList;
2027  WorkList.push_back(S);
2028 
2029  while (!WorkList.empty()) {
2030  const Stmt *Head = WorkList.front();
2031  WorkList.pop_front();
2032 
2033  ProgramStateManager &StateMgr = N->getState()->getStateManager();
2034 
2035  if (const auto *DR = dyn_cast<DeclRefExpr>(Head)) {
2036  if (const auto *VD = dyn_cast<VarDecl>(DR->getDecl())) {
2037  const VarRegion *R =
2038  StateMgr.getRegionManager().getVarRegion(VD, N->getLocationContext());
2039 
2040  // What did we load?
2041  SVal V = N->getSVal(S);
2042 
2043  if (V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) {
2044  // Register a new visitor with the BugReport.
2045  BR.addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
2046  V.castAs<KnownSVal>(), R, EnableNullFPSuppression));
2047  }
2048  }
2049  }
2050 
2051  for (const Stmt *SubStmt : Head->children())
2052  WorkList.push_back(SubStmt);
2053  }
2054 }
2055 
2056 //===----------------------------------------------------------------------===//
2057 // Visitor that tries to report interesting diagnostics from conditions.
2058 //===----------------------------------------------------------------------===//
2059 
2060 /// Return the tag associated with this visitor. This tag will be used
2061 /// to make all PathDiagnosticPieces created by this visitor.
2062 const char *ConditionBRVisitor::getTag() {
2063  return "ConditionBRVisitor";
2064 }
2065 
2066 std::shared_ptr<PathDiagnosticPiece>
2067 ConditionBRVisitor::VisitNode(const ExplodedNode *N,
2068  BugReporterContext &BRC, BugReport &BR) {
2069  auto piece = VisitNodeImpl(N, BRC, BR);
2070  if (piece) {
2071  piece->setTag(getTag());
2072  if (auto *ev = dyn_cast<PathDiagnosticEventPiece>(piece.get()))
2073  ev->setPrunable(true, /* override */ false);
2074  }
2075  return piece;
2076 }
2077 
2078 std::shared_ptr<PathDiagnosticPiece>
2079 ConditionBRVisitor::VisitNodeImpl(const ExplodedNode *N,
2080  BugReporterContext &BRC, BugReport &BR) {
2081  ProgramPoint ProgPoint = N->getLocation();
2082  const std::pair<const ProgramPointTag *, const ProgramPointTag *> &Tags =
2084 
2085  // If an assumption was made on a branch, it should be caught
2086  // here by looking at the state transition.
2087  if (Optional<BlockEdge> BE = ProgPoint.getAs<BlockEdge>()) {
2088  const CFGBlock *SrcBlock = BE->getSrc();
2089  if (const Stmt *Term = SrcBlock->getTerminatorStmt()) {
2090  // If the tag of the previous node is 'Eagerly Assume...' the current
2091  // 'BlockEdge' has the same constraint information. We do not want to
2092  // report the value as it is just an assumption on the predecessor node
2093  // which will be caught in the next VisitNode() iteration as a 'PostStmt'.
2094  const ProgramPointTag *PreviousNodeTag =
2095  N->getFirstPred()->getLocation().getTag();
2096  if (PreviousNodeTag == Tags.first || PreviousNodeTag == Tags.second)
2097  return nullptr;
2098 
2099  return VisitTerminator(Term, N, SrcBlock, BE->getDst(), BR, BRC);
2100  }
2101  return nullptr;
2102  }
2103 
2104  if (Optional<PostStmt> PS = ProgPoint.getAs<PostStmt>()) {
2105  const ProgramPointTag *CurrentNodeTag = PS->getTag();
2106  if (CurrentNodeTag != Tags.first && CurrentNodeTag != Tags.second)
2107  return nullptr;
2108 
2109  bool TookTrue = CurrentNodeTag == Tags.first;
2110  return VisitTrueTest(cast<Expr>(PS->getStmt()), BRC, BR, N, TookTrue);
2111  }
2112 
2113  return nullptr;
2114 }
2115 
2116 std::shared_ptr<PathDiagnosticPiece> ConditionBRVisitor::VisitTerminator(
2117  const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk,
2118  const CFGBlock *dstBlk, BugReport &R, BugReporterContext &BRC) {
2119  const Expr *Cond = nullptr;
2120 
2121  // In the code below, Term is a CFG terminator and Cond is a branch condition
2122  // expression upon which the decision is made on this terminator.
2123  //
2124  // For example, in "if (x == 0)", the "if (x == 0)" statement is a terminator,
2125  // and "x == 0" is the respective condition.
2126  //
2127  // Another example: in "if (x && y)", we've got two terminators and two
2128  // conditions due to short-circuit nature of operator "&&":
2129  // 1. The "if (x && y)" statement is a terminator,
2130  // and "y" is the respective condition.
2131  // 2. Also "x && ..." is another terminator,
2132  // and "x" is its condition.
2133 
2134  switch (Term->getStmtClass()) {
2135  // FIXME: Stmt::SwitchStmtClass is worth handling, however it is a bit
2136  // more tricky because there are more than two branches to account for.
2137  default:
2138  return nullptr;
2139  case Stmt::IfStmtClass:
2140  Cond = cast<IfStmt>(Term)->getCond();
2141  break;
2142  case Stmt::ConditionalOperatorClass:
2143  Cond = cast<ConditionalOperator>(Term)->getCond();
2144  break;
2145  case Stmt::BinaryOperatorClass:
2146  // When we encounter a logical operator (&& or ||) as a CFG terminator,
2147  // then the condition is actually its LHS; otherwise, we'd encounter
2148  // the parent, such as if-statement, as a terminator.
2149  const auto *BO = cast<BinaryOperator>(Term);
2150  assert(BO->isLogicalOp() &&
2151  "CFG terminator is not a short-circuit operator!");
2152  Cond = BO->getLHS();
2153  break;
2154  }
2155 
2156  Cond = Cond->IgnoreParens();
2157 
2158  // However, when we encounter a logical operator as a branch condition,
2159  // then the condition is actually its RHS, because LHS would be
2160  // the condition for the logical operator terminator.
2161  while (const auto *InnerBO = dyn_cast<BinaryOperator>(Cond)) {
2162  if (!InnerBO->isLogicalOp())
2163  break;
2164  Cond = InnerBO->getRHS()->IgnoreParens();
2165  }
2166 
2167  assert(Cond);
2168  assert(srcBlk->succ_size() == 2);
2169  const bool TookTrue = *(srcBlk->succ_begin()) == dstBlk;
2170  return VisitTrueTest(Cond, BRC, R, N, TookTrue);
2171 }
2172 
2173 std::shared_ptr<PathDiagnosticPiece>
2174 ConditionBRVisitor::VisitTrueTest(const Expr *Cond, BugReporterContext &BRC,
2175  BugReport &R, const ExplodedNode *N,
2176  bool TookTrue) {
2177  ProgramStateRef CurrentState = N->getState();
2178  ProgramStateRef PrevState = N->getFirstPred()->getState();
2179  const LocationContext *LCtx = N->getLocationContext();
2180 
2181  // If the constraint information is changed between the current and the
2182  // previous program state we assuming the newly seen constraint information.
2183  // If we cannot evaluate the condition (and the constraints are the same)
2184  // the analyzer has no information about the value and just assuming it.
2185  bool IsAssuming =
2186  !BRC.getStateManager().haveEqualConstraints(CurrentState, PrevState) ||
2187  CurrentState->getSVal(Cond, LCtx).isUnknownOrUndef();
2188 
2189  // These will be modified in code below, but we need to preserve the original
2190  // values in case we want to throw the generic message.
2191  const Expr *CondTmp = Cond;
2192  bool TookTrueTmp = TookTrue;
2193 
2194  while (true) {
2195  CondTmp = CondTmp->IgnoreParenCasts();
2196  switch (CondTmp->getStmtClass()) {
2197  default:
2198  break;
2199  case Stmt::BinaryOperatorClass:
2200  if (auto P = VisitTrueTest(Cond, cast<BinaryOperator>(CondTmp),
2201  BRC, R, N, TookTrueTmp, IsAssuming))
2202  return P;
2203  break;
2204  case Stmt::DeclRefExprClass:
2205  if (auto P = VisitTrueTest(Cond, cast<DeclRefExpr>(CondTmp),
2206  BRC, R, N, TookTrueTmp, IsAssuming))
2207  return P;
2208  break;
2209  case Stmt::MemberExprClass:
2210  if (auto P = VisitTrueTest(Cond, cast<MemberExpr>(CondTmp),
2211  BRC, R, N, TookTrueTmp, IsAssuming))
2212  return P;
2213  break;
2214  case Stmt::UnaryOperatorClass: {
2215  const auto *UO = cast<UnaryOperator>(CondTmp);
2216  if (UO->getOpcode() == UO_LNot) {
2217  TookTrueTmp = !TookTrueTmp;
2218  CondTmp = UO->getSubExpr();
2219  continue;
2220  }
2221  break;
2222  }
2223  }
2224  break;
2225  }
2226 
2227  // Condition too complex to explain? Just say something so that the user
2228  // knew we've made some path decision at this point.
2229  // If it is too complex and we know the evaluation of the condition do not
2230  // repeat the note from 'BugReporter.cpp'
2231  if (!IsAssuming)
2232  return nullptr;
2233 
2234  PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
2235  if (!Loc.isValid() || !Loc.asLocation().isValid())
2236  return nullptr;
2237 
2238  return std::make_shared<PathDiagnosticEventPiece>(
2239  Loc, TookTrue ? GenericTrueMessage : GenericFalseMessage);
2240 }
2241 
2242 bool ConditionBRVisitor::patternMatch(const Expr *Ex,
2243  const Expr *ParentEx,
2244  raw_ostream &Out,
2245  BugReporterContext &BRC,
2246  BugReport &report,
2247  const ExplodedNode *N,
2248  Optional<bool> &prunable,
2249  bool IsSameFieldName) {
2250  const Expr *OriginalExpr = Ex;
2251  Ex = Ex->IgnoreParenCasts();
2252 
2253  if (isa<GNUNullExpr>(Ex) || isa<ObjCBoolLiteralExpr>(Ex) ||
2254  isa<CXXBoolLiteralExpr>(Ex) || isa<IntegerLiteral>(Ex) ||
2255  isa<FloatingLiteral>(Ex)) {
2256  // Use heuristics to determine if the expression is a macro
2257  // expanding to a literal and if so, use the macro's name.
2258  SourceLocation BeginLoc = OriginalExpr->getBeginLoc();
2259  SourceLocation EndLoc = OriginalExpr->getEndLoc();
2260  if (BeginLoc.isMacroID() && EndLoc.isMacroID()) {
2261  SourceManager &SM = BRC.getSourceManager();
2262  const LangOptions &LO = BRC.getASTContext().getLangOpts();
2263  if (Lexer::isAtStartOfMacroExpansion(BeginLoc, SM, LO) &&
2264  Lexer::isAtEndOfMacroExpansion(EndLoc, SM, LO)) {
2265  CharSourceRange R = Lexer::getAsCharRange({BeginLoc, EndLoc}, SM, LO);
2266  Out << Lexer::getSourceText(R, SM, LO);
2267  return false;
2268  }
2269  }
2270  }
2271 
2272  if (const auto *DR = dyn_cast<DeclRefExpr>(Ex)) {
2273  const bool quotes = isa<VarDecl>(DR->getDecl());
2274  if (quotes) {
2275  Out << '\'';
2276  const LocationContext *LCtx = N->getLocationContext();
2277  const ProgramState *state = N->getState().get();
2278  if (const MemRegion *R = state->getLValue(cast<VarDecl>(DR->getDecl()),
2279  LCtx).getAsRegion()) {
2280  if (report.isInteresting(R))
2281  prunable = false;
2282  else {
2283  const ProgramState *state = N->getState().get();
2284  SVal V = state->getSVal(R);
2285  if (report.isInteresting(V))
2286  prunable = false;
2287  }
2288  }
2289  }
2290  Out << DR->getDecl()->getDeclName().getAsString();
2291  if (quotes)
2292  Out << '\'';
2293  return quotes;
2294  }
2295 
2296  if (const auto *IL = dyn_cast<IntegerLiteral>(Ex)) {
2297  QualType OriginalTy = OriginalExpr->getType();
2298  if (OriginalTy->isPointerType()) {
2299  if (IL->getValue() == 0) {
2300  Out << "null";
2301  return false;
2302  }
2303  }
2304  else if (OriginalTy->isObjCObjectPointerType()) {
2305  if (IL->getValue() == 0) {
2306  Out << "nil";
2307  return false;
2308  }
2309  }
2310 
2311  Out << IL->getValue();
2312  return false;
2313  }
2314 
2315  if (const auto *ME = dyn_cast<MemberExpr>(Ex)) {
2316  if (!IsSameFieldName)
2317  Out << "field '" << ME->getMemberDecl()->getName() << '\'';
2318  else
2319  Out << '\''
2322  BRC.getSourceManager(), BRC.getASTContext().getLangOpts(), 0)
2323  << '\'';
2324  }
2325 
2326  return false;
2327 }
2328 
2329 std::shared_ptr<PathDiagnosticPiece> ConditionBRVisitor::VisitTrueTest(
2330  const Expr *Cond, const BinaryOperator *BExpr, BugReporterContext &BRC,
2331  BugReport &R, const ExplodedNode *N, bool TookTrue, bool IsAssuming) {
2332  bool shouldInvert = false;
2333  Optional<bool> shouldPrune;
2334 
2335  // Check if the field name of the MemberExprs is ambiguous. Example:
2336  // " 'a.d' is equal to 'h.d' " in 'test/Analysis/null-deref-path-notes.cpp'.
2337  bool IsSameFieldName = false;
2338  if (const auto *LhsME =
2339  dyn_cast<MemberExpr>(BExpr->getLHS()->IgnoreParenCasts()))
2340  if (const auto *RhsME =
2341  dyn_cast<MemberExpr>(BExpr->getRHS()->IgnoreParenCasts()))
2342  IsSameFieldName = LhsME->getMemberDecl()->getName() ==
2343  RhsME->getMemberDecl()->getName();
2344 
2345  SmallString<128> LhsString, RhsString;
2346  {
2347  llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString);
2348  const bool isVarLHS = patternMatch(BExpr->getLHS(), BExpr, OutLHS, BRC, R,
2349  N, shouldPrune, IsSameFieldName);
2350  const bool isVarRHS = patternMatch(BExpr->getRHS(), BExpr, OutRHS, BRC, R,
2351  N, shouldPrune, IsSameFieldName);
2352 
2353  shouldInvert = !isVarLHS && isVarRHS;
2354  }
2355 
2356  BinaryOperator::Opcode Op = BExpr->getOpcode();
2357 
2359  // For assignment operators, all that we care about is that the LHS
2360  // evaluates to "true" or "false".
2361  return VisitConditionVariable(LhsString, BExpr->getLHS(), BRC, R, N,
2362  TookTrue);
2363  }
2364 
2365  // For non-assignment operations, we require that we can understand
2366  // both the LHS and RHS.
2367  if (LhsString.empty() || RhsString.empty() ||
2368  !BinaryOperator::isComparisonOp(Op) || Op == BO_Cmp)
2369  return nullptr;
2370 
2371  // Should we invert the strings if the LHS is not a variable name?
2372  SmallString<256> buf;
2373  llvm::raw_svector_ostream Out(buf);
2374  Out << (IsAssuming ? "Assuming " : "")
2375  << (shouldInvert ? RhsString : LhsString) << " is ";
2376 
2377  // Do we need to invert the opcode?
2378  if (shouldInvert)
2379  switch (Op) {
2380  default: break;
2381  case BO_LT: Op = BO_GT; break;
2382  case BO_GT: Op = BO_LT; break;
2383  case BO_LE: Op = BO_GE; break;
2384  case BO_GE: Op = BO_LE; break;
2385  }
2386 
2387  if (!TookTrue)
2388  switch (Op) {
2389  case BO_EQ: Op = BO_NE; break;
2390  case BO_NE: Op = BO_EQ; break;
2391  case BO_LT: Op = BO_GE; break;
2392  case BO_GT: Op = BO_LE; break;
2393  case BO_LE: Op = BO_GT; break;
2394  case BO_GE: Op = BO_LT; break;
2395  default:
2396  return nullptr;
2397  }
2398 
2399  switch (Op) {
2400  case BO_EQ:
2401  Out << "equal to ";
2402  break;
2403  case BO_NE:
2404  Out << "not equal to ";
2405  break;
2406  default:
2407  Out << BinaryOperator::getOpcodeStr(Op) << ' ';
2408  break;
2409  }
2410 
2411  Out << (shouldInvert ? LhsString : RhsString);
2412  const LocationContext *LCtx = N->getLocationContext();
2413  PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
2414 
2415  // Convert 'field ...' to 'Field ...' if it is a MemberExpr.
2416  std::string Message = Out.str();
2417  Message[0] = toupper(Message[0]);
2418 
2419  // If we know the value create a pop-up note.
2420  if (!IsAssuming)
2421  return std::make_shared<PathDiagnosticPopUpPiece>(Loc, Message);
2422 
2423  auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Message);
2424  if (shouldPrune.hasValue())
2425  event->setPrunable(shouldPrune.getValue());
2426  return event;
2427 }
2428 
2429 std::shared_ptr<PathDiagnosticPiece> ConditionBRVisitor::VisitConditionVariable(
2430  StringRef LhsString, const Expr *CondVarExpr, BugReporterContext &BRC,
2431  BugReport &report, const ExplodedNode *N, bool TookTrue) {
2432  // FIXME: If there's already a constraint tracker for this variable,
2433  // we shouldn't emit anything here (c.f. the double note in
2434  // test/Analysis/inlining/path-notes.c)
2435  SmallString<256> buf;
2436  llvm::raw_svector_ostream Out(buf);
2437  Out << "Assuming " << LhsString << " is ";
2438 
2439  if (!printValue(CondVarExpr, Out, N, TookTrue, /*IsAssuming=*/true))
2440  return nullptr;
2441 
2442  const LocationContext *LCtx = N->getLocationContext();
2443  PathDiagnosticLocation Loc(CondVarExpr, BRC.getSourceManager(), LCtx);
2444  auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str());
2445 
2446  if (const auto *DR = dyn_cast<DeclRefExpr>(CondVarExpr)) {
2447  if (const auto *VD = dyn_cast<VarDecl>(DR->getDecl())) {
2448  const ProgramState *state = N->getState().get();
2449  if (const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) {
2450  if (report.isInteresting(R))
2451  event->setPrunable(false);
2452  }
2453  }
2454  }
2455 
2456  return event;
2457 }
2458 
2459 std::shared_ptr<PathDiagnosticPiece> ConditionBRVisitor::VisitTrueTest(
2460  const Expr *Cond, const DeclRefExpr *DRE, BugReporterContext &BRC,
2461  BugReport &report, const ExplodedNode *N, bool TookTrue, bool IsAssuming) {
2462  const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
2463  if (!VD)
2464  return nullptr;
2465 
2466  SmallString<256> Buf;
2467  llvm::raw_svector_ostream Out(Buf);
2468 
2469  Out << (IsAssuming ? "Assuming '" : "'") << VD->getDeclName() << "' is ";
2470 
2471  if (!printValue(DRE, Out, N, TookTrue, IsAssuming))
2472  return nullptr;
2473 
2474  const LocationContext *LCtx = N->getLocationContext();
2475  PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
2476 
2477  // If we know the value create a pop-up note.
2478  if (!IsAssuming)
2479  return std::make_shared<PathDiagnosticPopUpPiece>(Loc, Out.str());
2480 
2481  auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str());
2482  const ProgramState *state = N->getState().get();
2483  if (const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) {
2484  if (report.isInteresting(R))
2485  event->setPrunable(false);
2486  else {
2487  SVal V = state->getSVal(R);
2488  if (report.isInteresting(V))
2489  event->setPrunable(false);
2490  }
2491  }
2492  return std::move(event);
2493 }
2494 
2495 std::shared_ptr<PathDiagnosticPiece> ConditionBRVisitor::VisitTrueTest(
2496  const Expr *Cond, const MemberExpr *ME, BugReporterContext &BRC,
2497  BugReport &report, const ExplodedNode *N, bool TookTrue, bool IsAssuming) {
2498  SmallString<256> Buf;
2499  llvm::raw_svector_ostream Out(Buf);
2500 
2501  Out << (IsAssuming ? "Assuming field '" : "Field '")
2502  << ME->getMemberDecl()->getName() << "' is ";
2503 
2504  if (!printValue(ME, Out, N, TookTrue, IsAssuming))
2505  return nullptr;
2506 
2507  const LocationContext *LCtx = N->getLocationContext();
2508  PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
2509  if (!Loc.isValid() || !Loc.asLocation().isValid())
2510  return nullptr;
2511 
2512  // If we know the value create a pop-up note.
2513  if (!IsAssuming)
2514  return std::make_shared<PathDiagnosticPopUpPiece>(Loc, Out.str());
2515 
2516  return std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str());
2517 }
2518 
2519 bool ConditionBRVisitor::printValue(const Expr *CondVarExpr, raw_ostream &Out,
2520  const ExplodedNode *N, bool TookTrue,
2521  bool IsAssuming) {
2522  QualType Ty = CondVarExpr->getType();
2523 
2524  if (Ty->isPointerType()) {
2525  Out << (TookTrue ? "non-null" : "null");
2526  return true;
2527  }
2528 
2529  if (Ty->isObjCObjectPointerType()) {
2530  Out << (TookTrue ? "non-nil" : "nil");
2531  return true;
2532  }
2533 
2534  if (!Ty->isIntegralOrEnumerationType())
2535  return false;
2536 
2538  if (!IsAssuming)
2539  IntValue = getConcreteIntegerValue(CondVarExpr, N);
2540 
2541  if (IsAssuming || !IntValue.hasValue()) {
2542  if (Ty->isBooleanType())
2543  Out << (TookTrue ? "true" : "false");
2544  else
2545  Out << (TookTrue ? "not equal to 0" : "0");
2546  } else {
2547  if (Ty->isBooleanType())
2548  Out << (IntValue.getValue()->getBoolValue() ? "true" : "false");
2549  else
2550  Out << *IntValue.getValue();
2551  }
2552 
2553  return true;
2554 }
2555 
2556 const char *const ConditionBRVisitor::GenericTrueMessage =
2557  "Assuming the condition is true";
2558 const char *const ConditionBRVisitor::GenericFalseMessage =
2559  "Assuming the condition is false";
2560 
2561 bool ConditionBRVisitor::isPieceMessageGeneric(
2562  const PathDiagnosticPiece *Piece) {
2563  return Piece->getString() == GenericTrueMessage ||
2564  Piece->getString() == GenericFalseMessage;
2565 }
2566 
2567 //===----------------------------------------------------------------------===//
2568 // Implementation of LikelyFalsePositiveSuppressionBRVisitor.
2569 //===----------------------------------------------------------------------===//
2570 
2571 void LikelyFalsePositiveSuppressionBRVisitor::finalizeVisitor(
2572  BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR) {
2573  // Here we suppress false positives coming from system headers. This list is
2574  // based on known issues.
2575  AnalyzerOptions &Options = BRC.getAnalyzerOptions();
2576  const Decl *D = N->getLocationContext()->getDecl();
2577 
2579  // Skip reports within the 'std' namespace. Although these can sometimes be
2580  // the user's fault, we currently don't report them very well, and
2581  // Note that this will not help for any other data structure libraries, like
2582  // TR1, Boost, or llvm/ADT.
2583  if (Options.ShouldSuppressFromCXXStandardLibrary) {
2584  BR.markInvalid(getTag(), nullptr);
2585  return;
2586  } else {
2587  // If the complete 'std' suppression is not enabled, suppress reports
2588  // from the 'std' namespace that are known to produce false positives.
2589 
2590  // The analyzer issues a false use-after-free when std::list::pop_front
2591  // or std::list::pop_back are called multiple times because we cannot
2592  // reason about the internal invariants of the data structure.
2593  if (const auto *MD = dyn_cast<CXXMethodDecl>(D)) {
2594  const CXXRecordDecl *CD = MD->getParent();
2595  if (CD->getName() == "list") {
2596  BR.markInvalid(getTag(), nullptr);
2597  return;
2598  }
2599  }
2600 
2601  // The analyzer issues a false positive when the constructor of
2602  // std::__independent_bits_engine from algorithms is used.
2603  if (const auto *MD = dyn_cast<CXXConstructorDecl>(D)) {
2604  const CXXRecordDecl *CD = MD->getParent();
2605  if (CD->getName() == "__independent_bits_engine") {
2606  BR.markInvalid(getTag(), nullptr);
2607  return;
2608  }
2609  }
2610 
2611  for (const LocationContext *LCtx = N->getLocationContext(); LCtx;
2612  LCtx = LCtx->getParent()) {
2613  const auto *MD = dyn_cast<CXXMethodDecl>(LCtx->getDecl());
2614  if (!MD)
2615  continue;
2616 
2617  const CXXRecordDecl *CD = MD->getParent();
2618  // The analyzer issues a false positive on
2619  // std::basic_string<uint8_t> v; v.push_back(1);
2620  // and
2621  // std::u16string s; s += u'a';
2622  // because we cannot reason about the internal invariants of the
2623  // data structure.
2624  if (CD->getName() == "basic_string") {
2625  BR.markInvalid(getTag(), nullptr);
2626  return;
2627  }
2628 
2629  // The analyzer issues a false positive on
2630  // std::shared_ptr<int> p(new int(1)); p = nullptr;
2631  // because it does not reason properly about temporary destructors.
2632  if (CD->getName() == "shared_ptr") {
2633  BR.markInvalid(getTag(), nullptr);
2634  return;
2635  }
2636  }
2637  }
2638  }
2639 
2640  // Skip reports within the sys/queue.h macros as we do not have the ability to
2641  // reason about data structure shapes.
2642  SourceManager &SM = BRC.getSourceManager();
2643  FullSourceLoc Loc = BR.getLocation(SM).asLocation();
2644  while (Loc.isMacroID()) {
2645  Loc = Loc.getSpellingLoc();
2646  if (SM.getFilename(Loc).endswith("sys/queue.h")) {
2647  BR.markInvalid(getTag(), nullptr);
2648  return;
2649  }
2650  }
2651 }
2652 
2653 //===----------------------------------------------------------------------===//
2654 // Implementation of UndefOrNullArgVisitor.
2655 //===----------------------------------------------------------------------===//
2656 
2657 std::shared_ptr<PathDiagnosticPiece>
2658 UndefOrNullArgVisitor::VisitNode(const ExplodedNode *N,
2659  BugReporterContext &BRC, BugReport &BR) {
2660  ProgramStateRef State = N->getState();
2661  ProgramPoint ProgLoc = N->getLocation();
2662 
2663  // We are only interested in visiting CallEnter nodes.
2664  Optional<CallEnter> CEnter = ProgLoc.getAs<CallEnter>();
2665  if (!CEnter)
2666  return nullptr;
2667 
2668  // Check if one of the arguments is the region the visitor is tracking.
2669  CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager();
2670  CallEventRef<> Call = CEMgr.getCaller(CEnter->getCalleeContext(), State);
2671  unsigned Idx = 0;
2672  ArrayRef<ParmVarDecl *> parms = Call->parameters();
2673 
2674  for (const auto ParamDecl : parms) {
2675  const MemRegion *ArgReg = Call->getArgSVal(Idx).getAsRegion();
2676  ++Idx;
2677 
2678  // Are we tracking the argument or its subregion?
2679  if ( !ArgReg || !R->isSubRegionOf(ArgReg->StripCasts()))
2680  continue;
2681 
2682  // Check the function parameter type.
2683  assert(ParamDecl && "Formal parameter has no decl?");
2684  QualType T = ParamDecl->getType();
2685 
2686  if (!(T->isAnyPointerType() || T->isReferenceType())) {
2687  // Function can only change the value passed in by address.
2688  continue;
2689  }
2690 
2691  // If it is a const pointer value, the function does not intend to
2692  // change the value.
2693  if (T->getPointeeType().isConstQualified())
2694  continue;
2695 
2696  // Mark the call site (LocationContext) as interesting if the value of the
2697  // argument is undefined or '0'/'NULL'.
2698  SVal BoundVal = State->getSVal(R);
2699  if (BoundVal.isUndef() || BoundVal.isZeroConstant()) {
2700  BR.markInteresting(CEnter->getCalleeContext());
2701  return nullptr;
2702  }
2703  }
2704  return nullptr;
2705 }
2706 
2707 //===----------------------------------------------------------------------===//
2708 // Implementation of FalsePositiveRefutationBRVisitor.
2709 //===----------------------------------------------------------------------===//
2710 
2711 FalsePositiveRefutationBRVisitor::FalsePositiveRefutationBRVisitor()
2712  : Constraints(ConstraintRangeTy::Factory().getEmptyMap()) {}
2713 
2714 void FalsePositiveRefutationBRVisitor::finalizeVisitor(
2715  BugReporterContext &BRC, const ExplodedNode *EndPathNode, BugReport &BR) {
2716  // Collect new constraints
2717  VisitNode(EndPathNode, BRC, BR);
2718 
2719  // Create a refutation manager
2720  llvm::SMTSolverRef RefutationSolver = llvm::CreateZ3Solver();
2721  ASTContext &Ctx = BRC.getASTContext();
2722 
2723  // Add constraints to the solver
2724  for (const auto &I : Constraints) {
2725  const SymbolRef Sym = I.first;
2726  auto RangeIt = I.second.begin();
2727 
2728  llvm::SMTExprRef Constraints = SMTConv::getRangeExpr(
2729  RefutationSolver, Ctx, Sym, RangeIt->From(), RangeIt->To(),
2730  /*InRange=*/true);
2731  while ((++RangeIt) != I.second.end()) {
2732  Constraints = RefutationSolver->mkOr(
2733  Constraints, SMTConv::getRangeExpr(RefutationSolver, Ctx, Sym,
2734  RangeIt->From(), RangeIt->To(),
2735  /*InRange=*/true));
2736  }
2737 
2738  RefutationSolver->addConstraint(Constraints);
2739  }
2740 
2741  // And check for satisfiability
2742  Optional<bool> isSat = RefutationSolver->check();
2743  if (!isSat.hasValue())
2744  return;
2745 
2746  if (!isSat.getValue())
2747  BR.markInvalid("Infeasible constraints", EndPathNode->getLocationContext());
2748 }
2749 
2750 std::shared_ptr<PathDiagnosticPiece>
2751 FalsePositiveRefutationBRVisitor::VisitNode(const ExplodedNode *N,
2752  BugReporterContext &,
2753  BugReport &) {
2754  // Collect new constraints
2755  const ConstraintRangeTy &NewCs = N->getState()->get<ConstraintRange>();
2756  ConstraintRangeTy::Factory &CF =
2757  N->getState()->get_context<ConstraintRange>();
2758 
2759  // Add constraints if we don't have them yet
2760  for (auto const &C : NewCs) {
2761  const SymbolRef &Sym = C.first;
2762  if (!Constraints.contains(Sym)) {
2763  Constraints = CF.add(Constraints, Sym, C.second);
2764  }
2765  }
2766 
2767  return nullptr;
2768 }
2769 
2770 void FalsePositiveRefutationBRVisitor::Profile(
2771  llvm::FoldingSetNodeID &ID) const {
2772  static int Tag = 0;
2773  ID.AddPointer(&Tag);
2774 }
2775 
2776 //===----------------------------------------------------------------------===//
2777 // Implementation of TagVisitor.
2778 //===----------------------------------------------------------------------===//
2779 
2780 int NoteTag::Kind = 0;
2781 
2782 void TagVisitor::Profile(llvm::FoldingSetNodeID &ID) const {
2783  static int Tag = 0;
2784  ID.AddPointer(&Tag);
2785 }
2786 
2787 std::shared_ptr<PathDiagnosticPiece>
2788 TagVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
2789  BugReport &R) {
2790  ProgramPoint PP = N->getLocation();
2791  const NoteTag *T = dyn_cast_or_null<NoteTag>(PP.getTag());
2792  if (!T)
2793  return nullptr;
2794 
2795  if (Optional<std::string> Msg = T->generateMessage(BRC, R)) {
2796  PathDiagnosticLocation Loc =
2797  PathDiagnosticLocation::create(PP, BRC.getSourceManager());
2798  auto Piece = std::make_shared<PathDiagnosticEventPiece>(Loc, *Msg);
2799  Piece->setPrunable(T->isPrunable());
2800  return Piece;
2801  }
2802 
2803  return nullptr;
2804 }
ObjCPropertyRefExpr - A dot-syntax expression to access an ObjC property.
Definition: ExprObjC.h:614
Indicates that the tracked object is a CF object.
Defines the clang::ASTContext interface.
static ArrayRef< ParmVarDecl * > getCallParameters(CallEventRef<> Call)
Get parameters associated with runtime definition in order to get the correct parameter name...
This is a discriminated union of FileInfo and ExpansionInfo.
A (possibly-)qualified type.
Definition: Type.h:643
static bool isPointerToConst(QualType Ty)
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
Definition: Expr.h:2890
static StringRef getMacroName(SourceLocation Loc, BugReporterContext &BRC)
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
succ_iterator succ_begin()
Definition: CFG.h:769
virtual Stmt * getBody() const
getBody - If this Decl represents a declaration for a body of code, such as a function or method defi...
Definition: DeclBase.h:986
const SymExpr * SymbolRef
Stmt - This represents one statement.
Definition: Stmt.h:66
internal::Matcher< Stmt > StatementMatcher
Definition: ASTMatchers.h:147
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:505
internal::PolymorphicMatcherWithParam1< internal::HasDeclarationMatcher, internal::Matcher< Decl >, void(internal::HasDeclarationSupportedTypes)> hasDeclaration(const internal::Matcher< Decl > &InnerMatcher)
Matches a node if the declaration associated with that node matches the given matcher.
Definition: ASTMatchers.h:2884
C Language Family Type Representation.
Defines the SourceManager interface.
static CharSourceRange getTokenRange(SourceRange R)
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:630
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1133
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Opcode getOpcode() const
Definition: Expr.h:3440
StringRef P
const internal::ArgumentAdaptingMatcherFunc< internal::HasDescendantMatcher > hasDescendant
Matches AST nodes that have descendant AST nodes that match the provided matcher. ...
Each ExpansionInfo encodes the expansion location - where the token was ultimately expanded...
llvm::ImmutableMap< SymbolRef, RangeSet > ConstraintRangeTy
unsigned succ_size() const
Definition: CFG.h:787
__m128i_u * p
Definition: emmintrin.h:2134
static bool isAtStartOfMacroExpansion(SourceLocation loc, const SourceManager &SM, const LangOptions &LangOpts, SourceLocation *MacroBegin=nullptr)
Returns true if the given MacroID location points at the first token of the macro expansion...
Definition: Lexer.cpp:791
Represents a variable declaration or definition.
Definition: Decl.h:812
const internal::VariadicDynCastAllOfMatcher< Stmt, BinaryOperator > binaryOperator
Matches binary operator expressions.
const internal::VariadicDynCastAllOfMatcher< Stmt, ObjCIvarRefExpr > objcIvarRefExpr
Matches a reference to an ObjCIvar.
Describes how types, statements, expressions, and declarations should be printed. ...
Definition: PrettyPrinter.h:37
Represents a parameter to a function.
Definition: Decl.h:1564
Defines the clang::Expr interface and subclasses for C++ expressions.
long i
Definition: xmmintrin.h:1456
bool isParentOf(const LocationContext *LC) const
Represents a struct/union/class.
Definition: Decl.h:3626
SourceLocation getBegin() const
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
LineState State
field_range fields() const
Definition: Decl.h:3841
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Stmt.cpp:263
Represents a member of a struct/union/class.
Definition: Decl.h:2607
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:431
bool isReferenceType() const
Definition: Type.h:6396
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:49
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isAssignmentOp() const
Definition: Expr.h:3534
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:6747
Represents a point when we start the call exit sequence (for inlined call).
Definition: ProgramPoint.h:668
StringRef getOpcodeStr() const
Definition: Expr.h:3461
bool isGLValue() const
Definition: Expr.h:261
BinaryOperatorKind
static bool isInStdNamespace(const Decl *D)
Returns true if the root namespace of the given declaration is the &#39;std&#39; C++ namespace.
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
child_range children()
Definition: Stmt.cpp:212
const LocationContext * getParent() const
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3405
static bool wasRegionOfInterestModifiedAt(const SubRegion *RegionOfInterest, const ExplodedNode *N, SVal ValueAfter)
Expr * IgnoreParenCasts() LLVM_READONLY
Skip past any parentheses and casts which might surround this expression until reaching a fixed point...
Definition: Expr.cpp:2947
b
Definition: emmintrin.h:321
static const Expr * peelOffPointerArithmetic(const BinaryOperator *B)
static CFGBlock * GetRelevantBlock(const ExplodedNode *Node)
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
static const MemRegion * getLocationRegionIfReference(const Expr *E, const ExplodedNode *N)
static Optional< const llvm::APSInt * > getConcreteIntegerValue(const Expr *CondVarExpr, const ExplodedNode *N)
SmallVector< BoundNodes, 1 > match(MatcherT Matcher, const NodeT &Node, ASTContext &Context)
Returns the results of matching Matcher on Node.
static bool hasVisibleUpdate(const ExplodedNode *LeftNode, SVal LeftVal, const ExplodedNode *RightNode, SVal RightVal)
Comparing internal representations of symbolic values (via SVal::operator==()) is a valid way to chec...
NodeId Parent
Definition: ASTDiff.cpp:191
RecordDecl * getAsRecordDecl() const
Retrieves the RecordDecl this type refers to.
Definition: Type.cpp:1640
const Stmt * getCallSite() const
Represents a single basic block in a source-level CFG.
Definition: CFG.h:570
static bool potentiallyWritesIntoIvar(const Decl *Parent, const ObjCIvarDecl *Ivar)
Represents a point when we finish the call exit sequence (for inlined call).
Definition: ProgramPoint.h:688
static StringRef getSourceText(CharSourceRange Range, const SourceManager &SM, const LangOptions &LangOpts, bool *Invalid=nullptr)
Returns a string for the source that the range encompasses.
Definition: Lexer.cpp:930
static bool isAtEndOfMacroExpansion(SourceLocation loc, const SourceManager &SM, const LangOptions &LangOpts, SourceLocation *MacroEnd=nullptr)
Returns true if the given MacroID location points at the last token of the macro expansion.
Definition: Lexer.cpp:813
This represents one expression.
Definition: Expr.h:108
Represents a character-granular source range.
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:26
const Expr * getLastCondition() const
Definition: CFG.cpp:5655
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1376
#define V(N, I)
Definition: ASTContext.h:2907
bool inTopFrame() const override
Return true if the current LocationContext has no caller context.
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
QualType getType() const
Definition: Expr.h:137
CharSourceRange getImmediateExpansionRange(SourceLocation Loc) const
Return the start/end of the expansion information for an expansion location.
DeclContext * getParent()
getParent - Returns the containing DeclContext.
Definition: DeclBase.h:1779
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2610
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:950
ValueDecl * getDecl()
Definition: Expr.h:1217
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:708
const SourceManager & SM
Definition: Format.cpp:1572
const ExpansionInfo & getExpansion() const
SourceLocation getEndLoc() const LLVM_READONLY
Definition: Stmt.cpp:276
virtual bool hasBody() const
Returns true if this Decl represents a declaration for a body of code, such as a function or method d...
Definition: DeclBase.h:992
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6201
bool isComparisonOp() const
Definition: Expr.h:3496
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
Maps string IDs to AST nodes matched by parts of a matcher.
Definition: ASTMatchers.h:103
StringRef getFilename(SourceLocation SpellingLoc) const
Return the filename of the file containing a SourceLocation.
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
QualType getCanonicalType() const
Definition: Type.h:6181
Encodes a location in the source.
static std::shared_ptr< PathDiagnosticEventPiece > constructDebugPieceForTrackedCondition(const Expr *Cond, const ExplodedNode *N, BugReporterContext &BRC)
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:452
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:39
std::string getNameAsString() const
Get a human-readable name for the declaration, even if it is one of the special kinds of names (C++ c...
Definition: Decl.h:291
ASTContext & getASTContext() const LLVM_READONLY
Definition: DeclBase.cpp:376
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1203
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2114
bool isAnyPointerType() const
Definition: Type.h:6388
bool isObjCObjectPointerType() const
Definition: Type.h:6488
static void showBRDiagnostics(const char *action, llvm::raw_svector_ostream &os, const MemRegion *R, SVal V, const DeclStmt *DS)
Show diagnostics for initializing or declaring a region R with a bad value.
static StringRef getImmediateMacroName(SourceLocation Loc, const SourceManager &SM, const LangOptions &LangOpts)
Retrieve the name of the immediate macro expansion.
Definition: Lexer.cpp:966
static bool isFunctionMacroExpansion(SourceLocation Loc, const SourceManager &SM)
Expr * getLHS() const
Definition: Expr.h:3445
ast_type_traits::DynTypedNode Node
Dataflow Directional Tag Classes.
static void showBRDefaultDiagnostics(llvm::raw_svector_ostream &os, const MemRegion *R, SVal V)
Show default diagnostics for storing bad region.
Parameter for Objective-C &#39;self&#39; argument.
Definition: Decl.h:1509
StmtClass getStmtClass() const
Definition: Stmt.h:1087
bool isBooleanType() const
Definition: Type.h:6760
const Decl * getSingleDecl() const
Definition: Stmt.h:1218
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:177
Stmt * getTerminatorStmt()
Definition: CFG.h:860
static void showBRParamDiagnostics(llvm::raw_svector_ostream &os, const VarRegion *VR, SVal V)
Display diagnostics for passing bad region as a parameter.
bool isMacroID() const
static CharSourceRange getAsCharRange(SourceRange Range, const SourceManager &SM, const LangOptions &LangOpts)
Given a token range, produce a corresponding CharSourceRange that is not a token range.
Definition: Lexer.h:379
bool isMacroArgExpansion(SourceLocation Loc, SourceLocation *StartLoc=nullptr) const
Tests whether the given source location represents a macro argument&#39;s expansion into the function-lik...
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
const LocationContext * getLocationContext() const
Definition: ProgramPoint.h:179
static bool isAdditiveOp(Opcode Opc)
Definition: Expr.h:3481
const StackFrameContext * getStackFrame() const
Stores options for the analyzer from the command line.
const SrcMgr::SLocEntry & getSLocEntry(FileID FID, bool *Invalid=nullptr) const
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:546
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:14425
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:2807
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
bool isVoidType() const
Definition: Type.h:6643
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1944
static PathDiagnosticLocation createEndOfPath(const ExplodedNode *N, const SourceManager &SM)
Create a location corresponding to the next valid ExplodedNode as end of path location.
static bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR)
Returns true if N represents the DeclStmt declaring and initializing VR.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:251
FullSourceLoc getSpellingLoc() const
A SourceLocation and its associated SourceManager.
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:275
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1141
Expr * getRHS() const
Definition: Expr.h:3447
bool isFunctionMacroExpansion() const
bool isPointerType() const
Definition: Type.h:6384
QualType getType() const
Definition: Decl.h:647
A trivial tuple used to represent a source range.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
static bool isInterestingLValueExpr(const Expr *Ex)
Returns true if nodes for the given expression kind are always kept around.
This class handles loading and caching of source files into memory.
std::pair< FileID, unsigned > getDecomposedLoc(SourceLocation Loc) const
Decompose the specified location into a raw FileID + Offset pair.
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
Definition: Expr.cpp:2938
static llvm::SMTExprRef getRangeExpr(llvm::SMTSolverRef &Solver, ASTContext &Ctx, SymbolRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange)
Definition: SMTConv.h:504