clang-tools  17.0.0git
UseAfterMoveCheck.cpp
Go to the documentation of this file.
1 //===--- UseAfterMoveCheck.cpp - clang-tidy -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "UseAfterMoveCheck.h"
10 
11 #include "clang/AST/Expr.h"
12 #include "clang/AST/ExprCXX.h"
13 #include "clang/AST/ExprConcepts.h"
14 #include "clang/ASTMatchers/ASTMatchers.h"
15 #include "clang/Analysis/CFG.h"
16 #include "clang/Lex/Lexer.h"
17 #include "llvm/ADT/STLExtras.h"
18 
19 #include "../utils/ExprSequence.h"
20 #include <optional>
21 
22 using namespace clang::ast_matchers;
23 using namespace clang::tidy::utils;
24 
25 namespace clang::tidy::bugprone {
26 
27 namespace {
28 
29 AST_MATCHER(Expr, hasUnevaluatedContext) {
30  if (isa<CXXNoexceptExpr>(Node) || isa<RequiresExpr>(Node))
31  return true;
32  if (const auto *UnaryExpr = dyn_cast<UnaryExprOrTypeTraitExpr>(&Node)) {
33  switch (UnaryExpr->getKind()) {
34  case UETT_SizeOf:
35  case UETT_AlignOf:
36  return true;
37  default:
38  return false;
39  }
40  }
41  if (const auto *TypeIDExpr = dyn_cast<CXXTypeidExpr>(&Node))
42  return !TypeIDExpr->isPotentiallyEvaluated();
43  return false;
44 }
45 
46 /// Contains information about a use-after-move.
47 struct UseAfterMove {
48  // The DeclRefExpr that constituted the use of the object.
49  const DeclRefExpr *DeclRef;
50 
51  // Is the order in which the move and the use are evaluated undefined?
53 };
54 
55 /// Finds uses of a variable after a move (and maintains state required by the
56 /// various internal helper functions).
57 class UseAfterMoveFinder {
58 public:
59  UseAfterMoveFinder(ASTContext *TheContext);
60 
61  // Within the given function body, finds the first use of 'MovedVariable' that
62  // occurs after 'MovingCall' (the expression that performs the move). If a
63  // use-after-move is found, writes information about it to 'TheUseAfterMove'.
64  // Returns whether a use-after-move was found.
65  bool find(Stmt *FunctionBody, const Expr *MovingCall,
66  const ValueDecl *MovedVariable, UseAfterMove *TheUseAfterMove);
67 
68 private:
69  bool findInternal(const CFGBlock *Block, const Expr *MovingCall,
70  const ValueDecl *MovedVariable,
71  UseAfterMove *TheUseAfterMove);
72  void getUsesAndReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
74  llvm::SmallPtrSetImpl<const Stmt *> *Reinits);
75  void getDeclRefs(const CFGBlock *Block, const Decl *MovedVariable,
76  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
77  void getReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
78  llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
79  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
80 
81  ASTContext *Context;
82  std::unique_ptr<ExprSequence> Sequence;
83  std::unique_ptr<StmtToBlockMap> BlockMap;
84  llvm::SmallPtrSet<const CFGBlock *, 8> Visited;
85 };
86 
87 } // namespace
88 
89 
90 // Matches nodes that are
91 // - Part of a decltype argument or class template argument (we check this by
92 // seeing if they are children of a TypeLoc), or
93 // - Part of a function template argument (we check this by seeing if they are
94 // children of a DeclRefExpr that references a function template).
95 // DeclRefExprs that fulfill these conditions should not be counted as a use or
96 // move.
97 static StatementMatcher inDecltypeOrTemplateArg() {
98  return anyOf(hasAncestor(typeLoc()),
99  hasAncestor(declRefExpr(
100  to(functionDecl(ast_matchers::isTemplateInstantiation())))),
101  hasAncestor(expr(hasUnevaluatedContext())));
102 }
103 
104 UseAfterMoveFinder::UseAfterMoveFinder(ASTContext *TheContext)
105  : Context(TheContext) {}
106 
107 bool UseAfterMoveFinder::find(Stmt *FunctionBody, const Expr *MovingCall,
108  const ValueDecl *MovedVariable,
109  UseAfterMove *TheUseAfterMove) {
110  // Generate the CFG manually instead of through an AnalysisDeclContext because
111  // it seems the latter can't be used to generate a CFG for the body of a
112  // lambda.
113  //
114  // We include implicit and temporary destructors in the CFG so that
115  // destructors marked [[noreturn]] are handled correctly in the control flow
116  // analysis. (These are used in some styles of assertion macros.)
117  CFG::BuildOptions Options;
118  Options.AddImplicitDtors = true;
119  Options.AddTemporaryDtors = true;
120  std::unique_ptr<CFG> TheCFG =
121  CFG::buildCFG(nullptr, FunctionBody, Context, Options);
122  if (!TheCFG)
123  return false;
124 
125  Sequence =
126  std::make_unique<ExprSequence>(TheCFG.get(), FunctionBody, Context);
127  BlockMap = std::make_unique<StmtToBlockMap>(TheCFG.get(), Context);
128  Visited.clear();
129 
130  const CFGBlock *Block = BlockMap->blockContainingStmt(MovingCall);
131  if (!Block) {
132  // This can happen if MovingCall is in a constructor initializer, which is
133  // not included in the CFG because the CFG is built only from the function
134  // body.
135  Block = &TheCFG->getEntry();
136  }
137 
138  return findInternal(Block, MovingCall, MovedVariable, TheUseAfterMove);
139 }
140 
141 bool UseAfterMoveFinder::findInternal(const CFGBlock *Block,
142  const Expr *MovingCall,
143  const ValueDecl *MovedVariable,
144  UseAfterMove *TheUseAfterMove) {
145  if (Visited.count(Block))
146  return false;
147 
148  // Mark the block as visited (except if this is the block containing the
149  // std::move() and it's being visited the first time).
150  if (!MovingCall)
151  Visited.insert(Block);
152 
153  // Get all uses and reinits in the block.
154  llvm::SmallVector<const DeclRefExpr *, 1> Uses;
155  llvm::SmallPtrSet<const Stmt *, 1> Reinits;
156  getUsesAndReinits(Block, MovedVariable, &Uses, &Reinits);
157 
158  // Ignore all reinitializations where the move potentially comes after the
159  // reinit.
160  // If `Reinit` is identical to `MovingCall`, we're looking at a move-to-self
161  // (e.g. `a = std::move(a)`). Count these as reinitializations.
162  llvm::SmallVector<const Stmt *, 1> ReinitsToDelete;
163  for (const Stmt *Reinit : Reinits) {
164  if (MovingCall && Reinit != MovingCall &&
165  Sequence->potentiallyAfter(MovingCall, Reinit))
166  ReinitsToDelete.push_back(Reinit);
167  }
168  for (const Stmt *Reinit : ReinitsToDelete) {
169  Reinits.erase(Reinit);
170  }
171 
172  // Find all uses that potentially come after the move.
173  for (const DeclRefExpr *Use : Uses) {
174  if (!MovingCall || Sequence->potentiallyAfter(Use, MovingCall)) {
175  // Does the use have a saving reinit? A reinit is saving if it definitely
176  // comes before the use, i.e. if there's no potential that the reinit is
177  // after the use.
178  bool HaveSavingReinit = false;
179  for (const Stmt *Reinit : Reinits) {
180  if (!Sequence->potentiallyAfter(Reinit, Use))
181  HaveSavingReinit = true;
182  }
183 
184  if (!HaveSavingReinit) {
185  TheUseAfterMove->DeclRef = Use;
186 
187  // Is this a use-after-move that depends on order of evaluation?
188  // This is the case if the move potentially comes after the use (and we
189  // already know that use potentially comes after the move, which taken
190  // together tells us that the ordering is unclear).
191  TheUseAfterMove->EvaluationOrderUndefined =
192  MovingCall != nullptr &&
193  Sequence->potentiallyAfter(MovingCall, Use);
194 
195  return true;
196  }
197  }
198  }
199 
200  // If the object wasn't reinitialized, call ourselves recursively on all
201  // successors.
202  if (Reinits.empty()) {
203  for (const auto &Succ : Block->succs()) {
204  if (Succ && findInternal(Succ, nullptr, MovedVariable, TheUseAfterMove))
205  return true;
206  }
207  }
208 
209  return false;
210 }
211 
212 void UseAfterMoveFinder::getUsesAndReinits(
213  const CFGBlock *Block, const ValueDecl *MovedVariable,
215  llvm::SmallPtrSetImpl<const Stmt *> *Reinits) {
216  llvm::SmallPtrSet<const DeclRefExpr *, 1> DeclRefs;
217  llvm::SmallPtrSet<const DeclRefExpr *, 1> ReinitDeclRefs;
218 
219  getDeclRefs(Block, MovedVariable, &DeclRefs);
220  getReinits(Block, MovedVariable, Reinits, &ReinitDeclRefs);
221 
222  // All references to the variable that aren't reinitializations are uses.
223  Uses->clear();
224  for (const DeclRefExpr *DeclRef : DeclRefs) {
225  if (!ReinitDeclRefs.count(DeclRef))
226  Uses->push_back(DeclRef);
227  }
228 
229  // Sort the uses by their occurrence in the source code.
230  llvm::sort(*Uses, [](const DeclRefExpr *D1, const DeclRefExpr *D2) {
231  return D1->getExprLoc() < D2->getExprLoc();
232  });
233 }
234 
235 bool isStandardSmartPointer(const ValueDecl *VD) {
236  const Type *TheType = VD->getType().getNonReferenceType().getTypePtrOrNull();
237  if (!TheType)
238  return false;
239 
240  const CXXRecordDecl *RecordDecl = TheType->getAsCXXRecordDecl();
241  if (!RecordDecl)
242  return false;
243 
244  const IdentifierInfo *ID = RecordDecl->getIdentifier();
245  if (!ID)
246  return false;
247 
248  StringRef Name = ID->getName();
249  if (Name != "unique_ptr" && Name != "shared_ptr" && Name != "weak_ptr")
250  return false;
251 
252  return RecordDecl->getDeclContext()->isStdNamespace();
253 }
254 
255 void UseAfterMoveFinder::getDeclRefs(
256  const CFGBlock *Block, const Decl *MovedVariable,
257  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
258  DeclRefs->clear();
259  for (const auto &Elem : *Block) {
260  std::optional<CFGStmt> S = Elem.getAs<CFGStmt>();
261  if (!S)
262  continue;
263 
264  auto AddDeclRefs = [this, Block,
265  DeclRefs](const ArrayRef<BoundNodes> Matches) {
266  for (const auto &Match : Matches) {
267  const auto *DeclRef = Match.getNodeAs<DeclRefExpr>("declref");
268  const auto *Operator = Match.getNodeAs<CXXOperatorCallExpr>("operator");
269  if (DeclRef && BlockMap->blockContainingStmt(DeclRef) == Block) {
270  // Ignore uses of a standard smart pointer that don't dereference the
271  // pointer.
272  if (Operator || !isStandardSmartPointer(DeclRef->getDecl())) {
273  DeclRefs->insert(DeclRef);
274  }
275  }
276  }
277  };
278 
279  auto DeclRefMatcher = declRefExpr(hasDeclaration(equalsNode(MovedVariable)),
280  unless(inDecltypeOrTemplateArg()))
281  .bind("declref");
282 
283  AddDeclRefs(match(traverse(TK_AsIs, findAll(DeclRefMatcher)), *S->getStmt(),
284  *Context));
285  AddDeclRefs(match(findAll(cxxOperatorCallExpr(
286  hasAnyOverloadedOperatorName("*", "->", "[]"),
287  hasArgument(0, DeclRefMatcher))
288  .bind("operator")),
289  *S->getStmt(), *Context));
290  }
291 }
292 
293 void UseAfterMoveFinder::getReinits(
294  const CFGBlock *Block, const ValueDecl *MovedVariable,
295  llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
296  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
297  auto DeclRefMatcher =
298  declRefExpr(hasDeclaration(equalsNode(MovedVariable))).bind("declref");
299 
300  auto StandardContainerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
301  recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
302  "::std::basic_string", "::std::vector", "::std::deque",
303  "::std::forward_list", "::std::list", "::std::set", "::std::map",
304  "::std::multiset", "::std::multimap", "::std::unordered_set",
305  "::std::unordered_map", "::std::unordered_multiset",
306  "::std::unordered_multimap"))))));
307 
308  auto StandardSmartPointerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
309  recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
310  "::std::unique_ptr", "::std::shared_ptr", "::std::weak_ptr"))))));
311 
312  // Matches different types of reinitialization.
313  auto ReinitMatcher =
314  stmt(anyOf(
315  // Assignment. In addition to the overloaded assignment operator,
316  // test for built-in assignment as well, since template functions
317  // may be instantiated to use std::move() on built-in types.
318  binaryOperation(hasOperatorName("="), hasLHS(DeclRefMatcher)),
319  // Declaration. We treat this as a type of reinitialization too,
320  // so we don't need to treat it separately.
321  declStmt(hasDescendant(equalsNode(MovedVariable))),
322  // clear() and assign() on standard containers.
323  cxxMemberCallExpr(
324  on(expr(DeclRefMatcher, StandardContainerTypeMatcher)),
325  // To keep the matcher simple, we check for assign() calls
326  // on all standard containers, even though only vector,
327  // deque, forward_list and list have assign(). If assign()
328  // is called on any of the other containers, this will be
329  // flagged by a compile error anyway.
330  callee(cxxMethodDecl(hasAnyName("clear", "assign")))),
331  // reset() on standard smart pointers.
332  cxxMemberCallExpr(
333  on(expr(DeclRefMatcher, StandardSmartPointerTypeMatcher)),
334  callee(cxxMethodDecl(hasName("reset")))),
335  // Methods that have the [[clang::reinitializes]] attribute.
336  cxxMemberCallExpr(
337  on(DeclRefMatcher),
338  callee(cxxMethodDecl(hasAttr(clang::attr::Reinitializes)))),
339  // Passing variable to a function as a non-const pointer.
340  callExpr(forEachArgumentWithParam(
341  unaryOperator(hasOperatorName("&"),
342  hasUnaryOperand(DeclRefMatcher)),
343  unless(parmVarDecl(hasType(pointsTo(isConstQualified())))))),
344  // Passing variable to a function as a non-const lvalue reference
345  // (unless that function is std::move()).
346  callExpr(forEachArgumentWithParam(
347  traverse(TK_AsIs, DeclRefMatcher),
348  unless(parmVarDecl(hasType(
349  references(qualType(isConstQualified())))))),
350  unless(callee(functionDecl(hasName("::std::move")))))))
351  .bind("reinit");
352 
353  Stmts->clear();
354  DeclRefs->clear();
355  for (const auto &Elem : *Block) {
356  std::optional<CFGStmt> S = Elem.getAs<CFGStmt>();
357  if (!S)
358  continue;
359 
360  SmallVector<BoundNodes, 1> Matches =
361  match(findAll(ReinitMatcher), *S->getStmt(), *Context);
362 
363  for (const auto &Match : Matches) {
364  const auto *TheStmt = Match.getNodeAs<Stmt>("reinit");
365  const auto *TheDeclRef = Match.getNodeAs<DeclRefExpr>("declref");
366  if (TheStmt && BlockMap->blockContainingStmt(TheStmt) == Block) {
367  Stmts->insert(TheStmt);
368 
369  // We count DeclStmts as reinitializations, but they don't have a
370  // DeclRefExpr associated with them -- so we need to check 'TheDeclRef'
371  // before adding it to the set.
372  if (TheDeclRef)
373  DeclRefs->insert(TheDeclRef);
374  }
375  }
376  }
377 }
378 
379 static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg,
380  const UseAfterMove &Use, ClangTidyCheck *Check,
381  ASTContext *Context) {
382  SourceLocation UseLoc = Use.DeclRef->getExprLoc();
383  SourceLocation MoveLoc = MovingCall->getExprLoc();
384 
385  Check->diag(UseLoc, "'%0' used after it was moved")
386  << MoveArg->getDecl()->getName();
387  Check->diag(MoveLoc, "move occurred here", DiagnosticIDs::Note);
388  if (Use.EvaluationOrderUndefined) {
389  Check->diag(UseLoc,
390  "the use and move are unsequenced, i.e. there is no guarantee "
391  "about the order in which they are evaluated",
392  DiagnosticIDs::Note);
393  } else if (UseLoc < MoveLoc || Use.DeclRef == MoveArg) {
394  Check->diag(UseLoc,
395  "the use happens in a later loop iteration than the move",
396  DiagnosticIDs::Note);
397  }
398 }
399 
400 void UseAfterMoveCheck::registerMatchers(MatchFinder *Finder) {
401  auto CallMoveMatcher =
402  callExpr(callee(functionDecl(hasName("::std::move"))), argumentCountIs(1),
403  hasArgument(0, declRefExpr().bind("arg")),
404  anyOf(hasAncestor(compoundStmt(
405  hasParent(lambdaExpr().bind("containing-lambda")))),
406  hasAncestor(functionDecl().bind("containing-func"))),
407  unless(inDecltypeOrTemplateArg()),
408  // try_emplace is a common maybe-moving function that returns a
409  // bool to tell callers whether it moved. Ignore std::move inside
410  // try_emplace to avoid false positives as we don't track uses of
411  // the bool.
412  unless(hasParent(cxxMemberCallExpr(
413  callee(cxxMethodDecl(hasName("try_emplace")))))))
414  .bind("call-move");
415 
416  Finder->addMatcher(
417  traverse(
418  TK_AsIs,
419  // To find the Stmt that we assume performs the actual move, we look
420  // for the direct ancestor of the std::move() that isn't one of the
421  // node types ignored by ignoringParenImpCasts().
422  stmt(
423  forEach(expr(ignoringParenImpCasts(CallMoveMatcher))),
424  // Don't allow an InitListExpr to be the moving call. An
425  // InitListExpr has both a syntactic and a semantic form, and the
426  // parent-child relationships are different between the two. This
427  // could cause an InitListExpr to be analyzed as the moving call
428  // in addition to the Expr that we actually want, resulting in two
429  // diagnostics with different code locations for the same move.
430  unless(initListExpr()),
431  unless(expr(ignoringParenImpCasts(equalsBoundNode("call-move")))))
432  .bind("moving-call")),
433  this);
434 }
435 
436 void UseAfterMoveCheck::check(const MatchFinder::MatchResult &Result) {
437  const auto *ContainingLambda =
438  Result.Nodes.getNodeAs<LambdaExpr>("containing-lambda");
439  const auto *ContainingFunc =
440  Result.Nodes.getNodeAs<FunctionDecl>("containing-func");
441  const auto *CallMove = Result.Nodes.getNodeAs<CallExpr>("call-move");
442  const auto *MovingCall = Result.Nodes.getNodeAs<Expr>("moving-call");
443  const auto *Arg = Result.Nodes.getNodeAs<DeclRefExpr>("arg");
444 
445  if (!MovingCall || !MovingCall->getExprLoc().isValid())
446  MovingCall = CallMove;
447 
448  Stmt *FunctionBody = nullptr;
449  if (ContainingLambda)
450  FunctionBody = ContainingLambda->getBody();
451  else if (ContainingFunc)
452  FunctionBody = ContainingFunc->getBody();
453  else
454  return;
455 
456  // Ignore the std::move if the variable that was passed to it isn't a local
457  // variable.
458  if (!Arg->getDecl()->getDeclContext()->isFunctionOrMethod())
459  return;
460 
461  UseAfterMoveFinder Finder(Result.Context);
462  UseAfterMove Use;
463  if (Finder.find(FunctionBody, MovingCall, Arg->getDecl(), &Use))
464  emitDiagnostic(MovingCall, Arg, Use, this, Result.Context);
465 }
466 
467 } // namespace clang::tidy::bugprone
clang::tidy::bugprone::inDecltypeOrTemplateArg
static StatementMatcher inDecltypeOrTemplateArg()
Definition: UseAfterMoveCheck.cpp:97
clang::tidy::bugprone::emitDiagnostic
static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg, const UseAfterMove &Use, ClangTidyCheck *Check, ASTContext *Context)
Definition: UseAfterMoveCheck.cpp:379
Type
NodeType Type
Definition: HTMLGenerator.cpp:75
clang::tidy::ClangTidyCheck
Base class for all clang-tidy checks.
Definition: ClangTidyCheck.h:53
clang::ast_matchers
Definition: AbseilMatcher.h:13
clang::clangd::match
std::vector< std::string > match(const SymbolIndex &I, const FuzzyFindRequest &Req, bool *Incomplete)
Definition: TestIndex.cpp:133
clang::ast_matchers::AST_MATCHER
AST_MATCHER(Decl, declHasNoReturnAttr)
matches a Decl if it has a "no return" attribute of any kind
Definition: InfiniteLoopCheck.cpp:24
Decl
const FunctionDecl * Decl
Definition: AvoidBindCheck.cpp:98
clang::tidy::ClangTidyCheck::diag
DiagnosticBuilder diag(SourceLocation Loc, StringRef Description, DiagnosticIDs::Level Level=DiagnosticIDs::Warning)
Add a diagnostic with the check's name.
Definition: ClangTidyCheck.cpp:25
Name
Token Name
Definition: MacroToEnumCheck.cpp:87
clang::tidy::utils
Definition: Aliasing.cpp:14
DeclRef
const DeclRefExpr * DeclRef
Definition: UseAfterMoveCheck.cpp:49
UseAfterMoveCheck.h
ID
static char ID
Definition: Logger.cpp:74
EvaluationOrderUndefined
bool EvaluationOrderUndefined
Definition: UseAfterMoveCheck.cpp:52
clang::clangd::check
bool check(llvm::StringRef File, const ThreadsafeFS &TFS, const ClangdLSPServer::Options &Opts)
Definition: Check.cpp:418
clang::tidy::bugprone::isStandardSmartPointer
bool isStandardSmartPointer(const ValueDecl *VD)
Definition: UseAfterMoveCheck.cpp:235
llvm::SmallVectorImpl
Definition: NoLintDirectiveHandler.h:21
clang::tidy::bugprone
Definition: ArgumentCommentCheck.cpp:19