clang-tools  16.0.0git
UseAfterMoveCheck.cpp
Go to the documentation of this file.
1 //===--- UseAfterMoveCheck.cpp - clang-tidy -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "UseAfterMoveCheck.h"
10 
11 #include "clang/AST/Expr.h"
12 #include "clang/AST/ExprCXX.h"
13 #include "clang/AST/ExprConcepts.h"
14 #include "clang/ASTMatchers/ASTMatchers.h"
15 #include "clang/Analysis/CFG.h"
16 #include "clang/Lex/Lexer.h"
17 #include "llvm/ADT/STLExtras.h"
18 
19 #include "../utils/ExprSequence.h"
20 
21 using namespace clang::ast_matchers;
22 using namespace clang::tidy::utils;
23 
24 
25 namespace clang {
26 namespace tidy {
27 namespace bugprone {
28 
29 namespace {
30 
31 AST_MATCHER(Expr, hasUnevaluatedContext) {
32  if (isa<CXXNoexceptExpr>(Node) || isa<RequiresExpr>(Node))
33  return true;
34  if (const auto *UnaryExpr = dyn_cast<UnaryExprOrTypeTraitExpr>(&Node)) {
35  switch (UnaryExpr->getKind()) {
36  case UETT_SizeOf:
37  case UETT_AlignOf:
38  return true;
39  default:
40  return false;
41  }
42  }
43  if (const auto *TypeIDExpr = dyn_cast<CXXTypeidExpr>(&Node))
44  return !TypeIDExpr->isPotentiallyEvaluated();
45  return false;
46 }
47 
48 /// Contains information about a use-after-move.
49 struct UseAfterMove {
50  // The DeclRefExpr that constituted the use of the object.
51  const DeclRefExpr *DeclRef;
52 
53  // Is the order in which the move and the use are evaluated undefined?
55 };
56 
57 /// Finds uses of a variable after a move (and maintains state required by the
58 /// various internal helper functions).
59 class UseAfterMoveFinder {
60 public:
61  UseAfterMoveFinder(ASTContext *TheContext);
62 
63  // Within the given function body, finds the first use of 'MovedVariable' that
64  // occurs after 'MovingCall' (the expression that performs the move). If a
65  // use-after-move is found, writes information about it to 'TheUseAfterMove'.
66  // Returns whether a use-after-move was found.
67  bool find(Stmt *FunctionBody, const Expr *MovingCall,
68  const ValueDecl *MovedVariable, UseAfterMove *TheUseAfterMove);
69 
70 private:
71  bool findInternal(const CFGBlock *Block, const Expr *MovingCall,
72  const ValueDecl *MovedVariable,
73  UseAfterMove *TheUseAfterMove);
74  void getUsesAndReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
76  llvm::SmallPtrSetImpl<const Stmt *> *Reinits);
77  void getDeclRefs(const CFGBlock *Block, const Decl *MovedVariable,
78  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
79  void getReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
80  llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
81  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
82 
83  ASTContext *Context;
84  std::unique_ptr<ExprSequence> Sequence;
85  std::unique_ptr<StmtToBlockMap> BlockMap;
86  llvm::SmallPtrSet<const CFGBlock *, 8> Visited;
87 };
88 
89 } // namespace
90 
91 
92 // Matches nodes that are
93 // - Part of a decltype argument or class template argument (we check this by
94 // seeing if they are children of a TypeLoc), or
95 // - Part of a function template argument (we check this by seeing if they are
96 // children of a DeclRefExpr that references a function template).
97 // DeclRefExprs that fulfill these conditions should not be counted as a use or
98 // move.
99 static StatementMatcher inDecltypeOrTemplateArg() {
100  return anyOf(hasAncestor(typeLoc()),
101  hasAncestor(declRefExpr(
102  to(functionDecl(ast_matchers::isTemplateInstantiation())))),
103  hasAncestor(expr(hasUnevaluatedContext())));
104 }
105 
106 UseAfterMoveFinder::UseAfterMoveFinder(ASTContext *TheContext)
107  : Context(TheContext) {}
108 
109 bool UseAfterMoveFinder::find(Stmt *FunctionBody, const Expr *MovingCall,
110  const ValueDecl *MovedVariable,
111  UseAfterMove *TheUseAfterMove) {
112  // Generate the CFG manually instead of through an AnalysisDeclContext because
113  // it seems the latter can't be used to generate a CFG for the body of a
114  // lambda.
115  //
116  // We include implicit and temporary destructors in the CFG so that
117  // destructors marked [[noreturn]] are handled correctly in the control flow
118  // analysis. (These are used in some styles of assertion macros.)
119  CFG::BuildOptions Options;
120  Options.AddImplicitDtors = true;
121  Options.AddTemporaryDtors = true;
122  std::unique_ptr<CFG> TheCFG =
123  CFG::buildCFG(nullptr, FunctionBody, Context, Options);
124  if (!TheCFG)
125  return false;
126 
127  Sequence =
128  std::make_unique<ExprSequence>(TheCFG.get(), FunctionBody, Context);
129  BlockMap = std::make_unique<StmtToBlockMap>(TheCFG.get(), Context);
130  Visited.clear();
131 
132  const CFGBlock *Block = BlockMap->blockContainingStmt(MovingCall);
133  if (!Block) {
134  // This can happen if MovingCall is in a constructor initializer, which is
135  // not included in the CFG because the CFG is built only from the function
136  // body.
137  Block = &TheCFG->getEntry();
138  }
139 
140  return findInternal(Block, MovingCall, MovedVariable, TheUseAfterMove);
141 }
142 
143 bool UseAfterMoveFinder::findInternal(const CFGBlock *Block,
144  const Expr *MovingCall,
145  const ValueDecl *MovedVariable,
146  UseAfterMove *TheUseAfterMove) {
147  if (Visited.count(Block))
148  return false;
149 
150  // Mark the block as visited (except if this is the block containing the
151  // std::move() and it's being visited the first time).
152  if (!MovingCall)
153  Visited.insert(Block);
154 
155  // Get all uses and reinits in the block.
156  llvm::SmallVector<const DeclRefExpr *, 1> Uses;
157  llvm::SmallPtrSet<const Stmt *, 1> Reinits;
158  getUsesAndReinits(Block, MovedVariable, &Uses, &Reinits);
159 
160  // Ignore all reinitializations where the move potentially comes after the
161  // reinit.
162  // If `Reinit` is identical to `MovingCall`, we're looking at a move-to-self
163  // (e.g. `a = std::move(a)`). Count these as reinitializations.
164  llvm::SmallVector<const Stmt *, 1> ReinitsToDelete;
165  for (const Stmt *Reinit : Reinits) {
166  if (MovingCall && Reinit != MovingCall &&
167  Sequence->potentiallyAfter(MovingCall, Reinit))
168  ReinitsToDelete.push_back(Reinit);
169  }
170  for (const Stmt *Reinit : ReinitsToDelete) {
171  Reinits.erase(Reinit);
172  }
173 
174  // Find all uses that potentially come after the move.
175  for (const DeclRefExpr *Use : Uses) {
176  if (!MovingCall || Sequence->potentiallyAfter(Use, MovingCall)) {
177  // Does the use have a saving reinit? A reinit is saving if it definitely
178  // comes before the use, i.e. if there's no potential that the reinit is
179  // after the use.
180  bool HaveSavingReinit = false;
181  for (const Stmt *Reinit : Reinits) {
182  if (!Sequence->potentiallyAfter(Reinit, Use))
183  HaveSavingReinit = true;
184  }
185 
186  if (!HaveSavingReinit) {
187  TheUseAfterMove->DeclRef = Use;
188 
189  // Is this a use-after-move that depends on order of evaluation?
190  // This is the case if the move potentially comes after the use (and we
191  // already know that use potentially comes after the move, which taken
192  // together tells us that the ordering is unclear).
193  TheUseAfterMove->EvaluationOrderUndefined =
194  MovingCall != nullptr &&
195  Sequence->potentiallyAfter(MovingCall, Use);
196 
197  return true;
198  }
199  }
200  }
201 
202  // If the object wasn't reinitialized, call ourselves recursively on all
203  // successors.
204  if (Reinits.empty()) {
205  for (const auto &Succ : Block->succs()) {
206  if (Succ && findInternal(Succ, nullptr, MovedVariable, TheUseAfterMove))
207  return true;
208  }
209  }
210 
211  return false;
212 }
213 
214 void UseAfterMoveFinder::getUsesAndReinits(
215  const CFGBlock *Block, const ValueDecl *MovedVariable,
217  llvm::SmallPtrSetImpl<const Stmt *> *Reinits) {
218  llvm::SmallPtrSet<const DeclRefExpr *, 1> DeclRefs;
219  llvm::SmallPtrSet<const DeclRefExpr *, 1> ReinitDeclRefs;
220 
221  getDeclRefs(Block, MovedVariable, &DeclRefs);
222  getReinits(Block, MovedVariable, Reinits, &ReinitDeclRefs);
223 
224  // All references to the variable that aren't reinitializations are uses.
225  Uses->clear();
226  for (const DeclRefExpr *DeclRef : DeclRefs) {
227  if (!ReinitDeclRefs.count(DeclRef))
228  Uses->push_back(DeclRef);
229  }
230 
231  // Sort the uses by their occurrence in the source code.
232  llvm::sort(*Uses, [](const DeclRefExpr *D1, const DeclRefExpr *D2) {
233  return D1->getExprLoc() < D2->getExprLoc();
234  });
235 }
236 
237 bool isStandardSmartPointer(const ValueDecl *VD) {
238  const Type *TheType = VD->getType().getNonReferenceType().getTypePtrOrNull();
239  if (!TheType)
240  return false;
241 
242  const CXXRecordDecl *RecordDecl = TheType->getAsCXXRecordDecl();
243  if (!RecordDecl)
244  return false;
245 
246  const IdentifierInfo *ID = RecordDecl->getIdentifier();
247  if (!ID)
248  return false;
249 
250  StringRef Name = ID->getName();
251  if (Name != "unique_ptr" && Name != "shared_ptr" && Name != "weak_ptr")
252  return false;
253 
254  return RecordDecl->getDeclContext()->isStdNamespace();
255 }
256 
257 void UseAfterMoveFinder::getDeclRefs(
258  const CFGBlock *Block, const Decl *MovedVariable,
259  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
260  DeclRefs->clear();
261  for (const auto &Elem : *Block) {
262  Optional<CFGStmt> S = Elem.getAs<CFGStmt>();
263  if (!S)
264  continue;
265 
266  auto AddDeclRefs = [this, Block,
267  DeclRefs](const ArrayRef<BoundNodes> Matches) {
268  for (const auto &Match : Matches) {
269  const auto *DeclRef = Match.getNodeAs<DeclRefExpr>("declref");
270  const auto *Operator = Match.getNodeAs<CXXOperatorCallExpr>("operator");
271  if (DeclRef && BlockMap->blockContainingStmt(DeclRef) == Block) {
272  // Ignore uses of a standard smart pointer that don't dereference the
273  // pointer.
274  if (Operator || !isStandardSmartPointer(DeclRef->getDecl())) {
275  DeclRefs->insert(DeclRef);
276  }
277  }
278  }
279  };
280 
281  auto DeclRefMatcher = declRefExpr(hasDeclaration(equalsNode(MovedVariable)),
282  unless(inDecltypeOrTemplateArg()))
283  .bind("declref");
284 
285  AddDeclRefs(match(traverse(TK_AsIs, findAll(DeclRefMatcher)), *S->getStmt(),
286  *Context));
287  AddDeclRefs(match(findAll(cxxOperatorCallExpr(
288  hasAnyOverloadedOperatorName("*", "->", "[]"),
289  hasArgument(0, DeclRefMatcher))
290  .bind("operator")),
291  *S->getStmt(), *Context));
292  }
293 }
294 
295 void UseAfterMoveFinder::getReinits(
296  const CFGBlock *Block, const ValueDecl *MovedVariable,
297  llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
298  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
299  auto DeclRefMatcher =
300  declRefExpr(hasDeclaration(equalsNode(MovedVariable))).bind("declref");
301 
302  auto StandardContainerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
303  recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
304  "::std::basic_string", "::std::vector", "::std::deque",
305  "::std::forward_list", "::std::list", "::std::set", "::std::map",
306  "::std::multiset", "::std::multimap", "::std::unordered_set",
307  "::std::unordered_map", "::std::unordered_multiset",
308  "::std::unordered_multimap"))))));
309 
310  auto StandardSmartPointerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
311  recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
312  "::std::unique_ptr", "::std::shared_ptr", "::std::weak_ptr"))))));
313 
314  // Matches different types of reinitialization.
315  auto ReinitMatcher =
316  stmt(anyOf(
317  // Assignment. In addition to the overloaded assignment operator,
318  // test for built-in assignment as well, since template functions
319  // may be instantiated to use std::move() on built-in types.
320  binaryOperation(hasOperatorName("="), hasLHS(DeclRefMatcher)),
321  // Declaration. We treat this as a type of reinitialization too,
322  // so we don't need to treat it separately.
323  declStmt(hasDescendant(equalsNode(MovedVariable))),
324  // clear() and assign() on standard containers.
325  cxxMemberCallExpr(
326  on(expr(DeclRefMatcher, StandardContainerTypeMatcher)),
327  // To keep the matcher simple, we check for assign() calls
328  // on all standard containers, even though only vector,
329  // deque, forward_list and list have assign(). If assign()
330  // is called on any of the other containers, this will be
331  // flagged by a compile error anyway.
332  callee(cxxMethodDecl(hasAnyName("clear", "assign")))),
333  // reset() on standard smart pointers.
334  cxxMemberCallExpr(
335  on(expr(DeclRefMatcher, StandardSmartPointerTypeMatcher)),
336  callee(cxxMethodDecl(hasName("reset")))),
337  // Methods that have the [[clang::reinitializes]] attribute.
338  cxxMemberCallExpr(
339  on(DeclRefMatcher),
340  callee(cxxMethodDecl(hasAttr(clang::attr::Reinitializes)))),
341  // Passing variable to a function as a non-const pointer.
342  callExpr(forEachArgumentWithParam(
343  unaryOperator(hasOperatorName("&"),
344  hasUnaryOperand(DeclRefMatcher)),
345  unless(parmVarDecl(hasType(pointsTo(isConstQualified())))))),
346  // Passing variable to a function as a non-const lvalue reference
347  // (unless that function is std::move()).
348  callExpr(forEachArgumentWithParam(
349  traverse(TK_AsIs, DeclRefMatcher),
350  unless(parmVarDecl(hasType(
351  references(qualType(isConstQualified())))))),
352  unless(callee(functionDecl(hasName("::std::move")))))))
353  .bind("reinit");
354 
355  Stmts->clear();
356  DeclRefs->clear();
357  for (const auto &Elem : *Block) {
358  Optional<CFGStmt> S = Elem.getAs<CFGStmt>();
359  if (!S)
360  continue;
361 
362  SmallVector<BoundNodes, 1> Matches =
363  match(findAll(ReinitMatcher), *S->getStmt(), *Context);
364 
365  for (const auto &Match : Matches) {
366  const auto *TheStmt = Match.getNodeAs<Stmt>("reinit");
367  const auto *TheDeclRef = Match.getNodeAs<DeclRefExpr>("declref");
368  if (TheStmt && BlockMap->blockContainingStmt(TheStmt) == Block) {
369  Stmts->insert(TheStmt);
370 
371  // We count DeclStmts as reinitializations, but they don't have a
372  // DeclRefExpr associated with them -- so we need to check 'TheDeclRef'
373  // before adding it to the set.
374  if (TheDeclRef)
375  DeclRefs->insert(TheDeclRef);
376  }
377  }
378  }
379 }
380 
381 static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg,
382  const UseAfterMove &Use, ClangTidyCheck *Check,
383  ASTContext *Context) {
384  SourceLocation UseLoc = Use.DeclRef->getExprLoc();
385  SourceLocation MoveLoc = MovingCall->getExprLoc();
386 
387  Check->diag(UseLoc, "'%0' used after it was moved")
388  << MoveArg->getDecl()->getName();
389  Check->diag(MoveLoc, "move occurred here", DiagnosticIDs::Note);
390  if (Use.EvaluationOrderUndefined) {
391  Check->diag(UseLoc,
392  "the use and move are unsequenced, i.e. there is no guarantee "
393  "about the order in which they are evaluated",
394  DiagnosticIDs::Note);
395  } else if (UseLoc < MoveLoc || Use.DeclRef == MoveArg) {
396  Check->diag(UseLoc,
397  "the use happens in a later loop iteration than the move",
398  DiagnosticIDs::Note);
399  }
400 }
401 
402 void UseAfterMoveCheck::registerMatchers(MatchFinder *Finder) {
403  auto CallMoveMatcher =
404  callExpr(callee(functionDecl(hasName("::std::move"))), argumentCountIs(1),
405  hasArgument(0, declRefExpr().bind("arg")),
406  anyOf(hasAncestor(compoundStmt(
407  hasParent(lambdaExpr().bind("containing-lambda")))),
408  hasAncestor(functionDecl().bind("containing-func"))),
409  unless(inDecltypeOrTemplateArg()),
410  // try_emplace is a common maybe-moving function that returns a
411  // bool to tell callers whether it moved. Ignore std::move inside
412  // try_emplace to avoid false positives as we don't track uses of
413  // the bool.
414  unless(hasParent(cxxMemberCallExpr(
415  callee(cxxMethodDecl(hasName("try_emplace")))))))
416  .bind("call-move");
417 
418  Finder->addMatcher(
419  traverse(
420  TK_AsIs,
421  // To find the Stmt that we assume performs the actual move, we look
422  // for the direct ancestor of the std::move() that isn't one of the
423  // node types ignored by ignoringParenImpCasts().
424  stmt(
425  forEach(expr(ignoringParenImpCasts(CallMoveMatcher))),
426  // Don't allow an InitListExpr to be the moving call. An
427  // InitListExpr has both a syntactic and a semantic form, and the
428  // parent-child relationships are different between the two. This
429  // could cause an InitListExpr to be analyzed as the moving call
430  // in addition to the Expr that we actually want, resulting in two
431  // diagnostics with different code locations for the same move.
432  unless(initListExpr()),
433  unless(expr(ignoringParenImpCasts(equalsBoundNode("call-move")))))
434  .bind("moving-call")),
435  this);
436 }
437 
438 void UseAfterMoveCheck::check(const MatchFinder::MatchResult &Result) {
439  const auto *ContainingLambda =
440  Result.Nodes.getNodeAs<LambdaExpr>("containing-lambda");
441  const auto *ContainingFunc =
442  Result.Nodes.getNodeAs<FunctionDecl>("containing-func");
443  const auto *CallMove = Result.Nodes.getNodeAs<CallExpr>("call-move");
444  const auto *MovingCall = Result.Nodes.getNodeAs<Expr>("moving-call");
445  const auto *Arg = Result.Nodes.getNodeAs<DeclRefExpr>("arg");
446 
447  if (!MovingCall || !MovingCall->getExprLoc().isValid())
448  MovingCall = CallMove;
449 
450  Stmt *FunctionBody = nullptr;
451  if (ContainingLambda)
452  FunctionBody = ContainingLambda->getBody();
453  else if (ContainingFunc)
454  FunctionBody = ContainingFunc->getBody();
455  else
456  return;
457 
458  // Ignore the std::move if the variable that was passed to it isn't a local
459  // variable.
460  if (!Arg->getDecl()->getDeclContext()->isFunctionOrMethod())
461  return;
462 
463  UseAfterMoveFinder Finder(Result.Context);
464  UseAfterMove Use;
465  if (Finder.find(FunctionBody, MovingCall, Arg->getDecl(), &Use))
466  emitDiagnostic(MovingCall, Arg, Use, this, Result.Context);
467 }
468 
469 } // namespace bugprone
470 } // namespace tidy
471 } // namespace clang
clang::tidy::bugprone::inDecltypeOrTemplateArg
static StatementMatcher inDecltypeOrTemplateArg()
Definition: UseAfterMoveCheck.cpp:99
clang::tidy::bugprone::emitDiagnostic
static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg, const UseAfterMove &Use, ClangTidyCheck *Check, ASTContext *Context)
Definition: UseAfterMoveCheck.cpp:381
Type
NodeType Type
Definition: HTMLGenerator.cpp:73
clang::clangd::check
bool check(llvm::StringRef File, llvm::Optional< Range > LineRange, const ThreadsafeFS &TFS, const ClangdLSPServer::Options &Opts, bool EnableCodeCompletion)
Definition: Check.cpp:275
clang::tidy::ClangTidyCheck
Base class for all clang-tidy checks.
Definition: ClangTidyCheck.h:53
clang::ast_matchers
Definition: AbseilMatcher.h:14
clang::clangd::match
std::vector< std::string > match(const SymbolIndex &I, const FuzzyFindRequest &Req, bool *Incomplete)
Definition: TestIndex.cpp:129
clang::ast_matchers::AST_MATCHER
AST_MATCHER(Decl, declHasNoReturnAttr)
matches a Decl if it has a "no return" attribute of any kind
Definition: InfiniteLoopCheck.cpp:24
Decl
const FunctionDecl * Decl
Definition: AvoidBindCheck.cpp:100
clang::tidy::ClangTidyCheck::diag
DiagnosticBuilder diag(SourceLocation Loc, StringRef Description, DiagnosticIDs::Level Level=DiagnosticIDs::Warning)
Add a diagnostic with the check's name.
Definition: ClangTidyCheck.cpp:25
Name
Token Name
Definition: MacroToEnumCheck.cpp:89
clang::tidy::utils
Definition: Aliasing.cpp:16
DeclRef
const DeclRefExpr * DeclRef
Definition: UseAfterMoveCheck.cpp:51
UseAfterMoveCheck.h
ID
static char ID
Definition: Logger.cpp:74
EvaluationOrderUndefined
bool EvaluationOrderUndefined
Definition: UseAfterMoveCheck.cpp:54
clang
===– Representation.cpp - ClangDoc Representation --------—*- C++ -*-===//
Definition: ApplyReplacements.h:27
clang::tidy::bugprone::isStandardSmartPointer
bool isStandardSmartPointer(const ValueDecl *VD)
Definition: UseAfterMoveCheck.cpp:237
llvm::SmallVectorImpl
Definition: NoLintDirectiveHandler.h:23