clang  14.0.0git
ObjCAtSyncChecker.cpp
Go to the documentation of this file.
1 //== ObjCAtSyncChecker.cpp - nil mutex checker for @synchronized -*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This defines ObjCAtSyncChecker, a builtin check that checks for null pointers
10 // used as mutexes for @synchronized.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/StmtObjC.h"
21 
22 using namespace clang;
23 using namespace ento;
24 
25 namespace {
26 class ObjCAtSyncChecker
27  : public Checker< check::PreStmt<ObjCAtSynchronizedStmt> > {
28  mutable std::unique_ptr<BuiltinBug> BT_null;
29  mutable std::unique_ptr<BuiltinBug> BT_undef;
30 
31 public:
32  void checkPreStmt(const ObjCAtSynchronizedStmt *S, CheckerContext &C) const;
33 };
34 } // end anonymous namespace
35 
36 void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S,
37  CheckerContext &C) const {
38 
39  const Expr *Ex = S->getSynchExpr();
40  ProgramStateRef state = C.getState();
41  SVal V = C.getSVal(Ex);
42 
43  // Uninitialized value used for the mutex?
44  if (V.getAs<UndefinedVal>()) {
45  if (ExplodedNode *N = C.generateErrorNode()) {
46  if (!BT_undef)
47  BT_undef.reset(new BuiltinBug(this, "Uninitialized value used as mutex "
48  "for @synchronized"));
49  auto report = std::make_unique<PathSensitiveBugReport>(
50  *BT_undef, BT_undef->getDescription(), N);
51  bugreporter::trackExpressionValue(N, Ex, *report);
52  C.emitReport(std::move(report));
53  }
54  return;
55  }
56 
57  if (V.isUnknown())
58  return;
59 
60  // Check for null mutexes.
61  ProgramStateRef notNullState, nullState;
62  std::tie(notNullState, nullState) = state->assume(V.castAs<DefinedSVal>());
63 
64  if (nullState) {
65  if (!notNullState) {
66  // Generate an error node. This isn't a sink since
67  // a null mutex just means no synchronization occurs.
68  if (ExplodedNode *N = C.generateNonFatalErrorNode(nullState)) {
69  if (!BT_null)
70  BT_null.reset(new BuiltinBug(
71  this, "Nil value used as mutex for @synchronized() "
72  "(no synchronization will occur)"));
73  auto report = std::make_unique<PathSensitiveBugReport>(
74  *BT_null, BT_null->getDescription(), N);
75  bugreporter::trackExpressionValue(N, Ex, *report);
76 
77  C.emitReport(std::move(report));
78  return;
79  }
80  }
81  // Don't add a transition for 'nullState'. If the value is
82  // under-constrained to be null or non-null, assume it is non-null
83  // afterwards.
84  }
85 
86  if (notNullState)
87  C.addTransition(notNullState);
88 }
89 
90 void ento::registerObjCAtSyncChecker(CheckerManager &mgr) {
91  mgr.registerChecker<ObjCAtSyncChecker>();
92 }
93 
94 bool ento::shouldRegisterObjCAtSyncChecker(const CheckerManager &mgr) {
95  const LangOptions &LO = mgr.getLangOpts();
96  return LO.ObjC;
97 }
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
AttributeLangSupport::C
@ C
Definition: SemaDeclAttr.cpp:54
V
#define V(N, I)
Definition: ASTContext.h:3121
BuiltinCheckerRegistration.h
CheckerManager.h
clang::ObjCAtSynchronizedStmt
Represents Objective-C's @synchronized statement.
Definition: StmtObjC.h:277
StmtObjC.h
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::bugreporter::trackExpressionValue
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.
BugType.h
CheckerContext.h
clang::LangOptions
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:58
Checker.h
ExprEngine.h
clang
Definition: CalledOnceCheck.h:17
clang::Expr
This represents one expression.
Definition: Expr.h:109