1218887Sdim// BugReporterVisitors.cpp - Helpers for reporting bugs -----------*- C++ -*--// 2218887Sdim// 3218887Sdim// The LLVM Compiler Infrastructure 4218887Sdim// 5218887Sdim// This file is distributed under the University of Illinois Open Source 6218887Sdim// License. See LICENSE.TXT for details. 7218887Sdim// 8218887Sdim//===----------------------------------------------------------------------===// 9218887Sdim// 10218887Sdim// This file defines a set of BugReporter "visitors" which can be used to 11218887Sdim// enhance the diagnostics reported for a bug. 12218887Sdim// 13218887Sdim//===----------------------------------------------------------------------===// 14226633Sdim#include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h" 15218887Sdim#include "clang/AST/Expr.h" 16218887Sdim#include "clang/AST/ExprObjC.h" 17218887Sdim#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" 18218887Sdim#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" 19243830Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 20218887Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" 21249423Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 22226633Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 23234353Sdim#include "llvm/ADT/SmallString.h" 24243830Sdim#include "llvm/ADT/StringExtras.h" 25249423Sdim#include "llvm/Support/raw_ostream.h" 26218887Sdim 27218887Sdimusing namespace clang; 28218887Sdimusing namespace ento; 29218887Sdim 30249423Sdimusing llvm::FoldingSetNodeID; 31249423Sdim 32218887Sdim//===----------------------------------------------------------------------===// 33218887Sdim// Utility functions. 34218887Sdim//===----------------------------------------------------------------------===// 35218887Sdim 36243830Sdimbool bugreporter::isDeclRefExprToReference(const Expr *E) { 37243830Sdim if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) { 38243830Sdim return DRE->getDecl()->getType()->isReferenceType(); 39243830Sdim } 40243830Sdim return false; 41243830Sdim} 42243830Sdim 43249423Sdimconst Expr *bugreporter::getDerefExpr(const Stmt *S) { 44251662Sdim // Pattern match for a few useful cases: 45218887Sdim // a[0], p->f, *p 46249423Sdim const Expr *E = dyn_cast<Expr>(S); 47249423Sdim if (!E) 48243830Sdim return 0; 49249423Sdim E = E->IgnoreParenCasts(); 50218887Sdim 51239462Sdim while (true) { 52249423Sdim if (const BinaryOperator *B = dyn_cast<BinaryOperator>(E)) { 53239462Sdim assert(B->isAssignmentOp()); 54249423Sdim E = B->getLHS()->IgnoreParenCasts(); 55239462Sdim continue; 56239462Sdim } 57249423Sdim else if (const UnaryOperator *U = dyn_cast<UnaryOperator>(E)) { 58239462Sdim if (U->getOpcode() == UO_Deref) 59239462Sdim return U->getSubExpr()->IgnoreParenCasts(); 60239462Sdim } 61249423Sdim else if (const MemberExpr *ME = dyn_cast<MemberExpr>(E)) { 62243830Sdim if (ME->isArrow() || isDeclRefExprToReference(ME->getBase())) { 63243830Sdim return ME->getBase()->IgnoreParenCasts(); 64251662Sdim } else { 65251662Sdim // If we have a member expr with a dot, the base must have been 66251662Sdim // dereferenced. 67251662Sdim return getDerefExpr(ME->getBase()); 68243830Sdim } 69239462Sdim } 70249423Sdim else if (const ObjCIvarRefExpr *IvarRef = dyn_cast<ObjCIvarRefExpr>(E)) { 71243830Sdim return IvarRef->getBase()->IgnoreParenCasts(); 72243830Sdim } 73249423Sdim else if (const ArraySubscriptExpr *AE = dyn_cast<ArraySubscriptExpr>(E)) { 74239462Sdim return AE->getBase(); 75239462Sdim } 76251662Sdim else if (isDeclRefExprToReference(E)) { 77251662Sdim return E; 78251662Sdim } 79239462Sdim break; 80218887Sdim } 81218887Sdim 82218887Sdim return NULL; 83218887Sdim} 84218887Sdim 85218887Sdimconst Stmt *bugreporter::GetDenomExpr(const ExplodedNode *N) { 86218887Sdim const Stmt *S = N->getLocationAs<PreStmt>()->getStmt(); 87218887Sdim if (const BinaryOperator *BE = dyn_cast<BinaryOperator>(S)) 88218887Sdim return BE->getRHS(); 89218887Sdim return NULL; 90218887Sdim} 91218887Sdim 92218887Sdimconst Stmt *bugreporter::GetRetValExpr(const ExplodedNode *N) { 93218887Sdim const Stmt *S = N->getLocationAs<PostStmt>()->getStmt(); 94218887Sdim if (const ReturnStmt *RS = dyn_cast<ReturnStmt>(S)) 95218887Sdim return RS->getRetValue(); 96218887Sdim return NULL; 97218887Sdim} 98218887Sdim 99218887Sdim//===----------------------------------------------------------------------===// 100218887Sdim// Definitions for bug reporter visitors. 101218887Sdim//===----------------------------------------------------------------------===// 102218887Sdim 103226633SdimPathDiagnosticPiece* 104226633SdimBugReporterVisitor::getEndPath(BugReporterContext &BRC, 105226633Sdim const ExplodedNode *EndPathNode, 106226633Sdim BugReport &BR) { 107226633Sdim return 0; 108226633Sdim} 109218887Sdim 110226633SdimPathDiagnosticPiece* 111226633SdimBugReporterVisitor::getDefaultEndPath(BugReporterContext &BRC, 112226633Sdim const ExplodedNode *EndPathNode, 113226633Sdim BugReport &BR) { 114234353Sdim PathDiagnosticLocation L = 115234353Sdim PathDiagnosticLocation::createEndOfPath(EndPathNode,BRC.getSourceManager()); 116226633Sdim 117226633Sdim BugReport::ranges_iterator Beg, End; 118226633Sdim llvm::tie(Beg, End) = BR.getRanges(); 119218887Sdim 120226633Sdim // Only add the statement itself as a range if we didn't specify any 121226633Sdim // special ranges for this report. 122226633Sdim PathDiagnosticPiece *P = new PathDiagnosticEventPiece(L, 123226633Sdim BR.getDescription(), 124226633Sdim Beg == End); 125226633Sdim for (; Beg != End; ++Beg) 126226633Sdim P->addRange(*Beg); 127218887Sdim 128226633Sdim return P; 129226633Sdim} 130218887Sdim 131226633Sdim 132243830Sdimnamespace { 133243830Sdim/// Emits an extra note at the return statement of an interesting stack frame. 134243830Sdim/// 135243830Sdim/// The returned value is marked as an interesting value, and if it's null, 136243830Sdim/// adds a visitor to track where it became null. 137243830Sdim/// 138243830Sdim/// This visitor is intended to be used when another visitor discovers that an 139243830Sdim/// interesting value comes from an inlined function call. 140243830Sdimclass ReturnVisitor : public BugReporterVisitorImpl<ReturnVisitor> { 141243830Sdim const StackFrameContext *StackFrame; 142243830Sdim enum { 143243830Sdim Initial, 144249423Sdim MaybeUnsuppress, 145243830Sdim Satisfied 146243830Sdim } Mode; 147243830Sdim 148249423Sdim bool EnableNullFPSuppression; 149249423Sdim 150243830Sdimpublic: 151249423Sdim ReturnVisitor(const StackFrameContext *Frame, bool Suppressed) 152249423Sdim : StackFrame(Frame), Mode(Initial), EnableNullFPSuppression(Suppressed) {} 153243830Sdim 154243830Sdim static void *getTag() { 155243830Sdim static int Tag = 0; 156243830Sdim return static_cast<void *>(&Tag); 157243830Sdim } 158243830Sdim 159243830Sdim virtual void Profile(llvm::FoldingSetNodeID &ID) const { 160243830Sdim ID.AddPointer(ReturnVisitor::getTag()); 161243830Sdim ID.AddPointer(StackFrame); 162249423Sdim ID.AddBoolean(EnableNullFPSuppression); 163243830Sdim } 164243830Sdim 165243830Sdim /// Adds a ReturnVisitor if the given statement represents a call that was 166243830Sdim /// inlined. 167243830Sdim /// 168243830Sdim /// This will search back through the ExplodedGraph, starting from the given 169243830Sdim /// node, looking for when the given statement was processed. If it turns out 170243830Sdim /// the statement is a call that was inlined, we add the visitor to the 171243830Sdim /// bug report, so it can print a note later. 172243830Sdim static void addVisitorIfNecessary(const ExplodedNode *Node, const Stmt *S, 173249423Sdim BugReport &BR, 174249423Sdim bool InEnableNullFPSuppression) { 175243830Sdim if (!CallEvent::isCallStmt(S)) 176243830Sdim return; 177243830Sdim 178243830Sdim // First, find when we processed the statement. 179243830Sdim do { 180249423Sdim if (Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>()) 181243830Sdim if (CEE->getCalleeContext()->getCallSite() == S) 182243830Sdim break; 183249423Sdim if (Optional<StmtPoint> SP = Node->getLocationAs<StmtPoint>()) 184243830Sdim if (SP->getStmt() == S) 185243830Sdim break; 186243830Sdim 187243830Sdim Node = Node->getFirstPred(); 188243830Sdim } while (Node); 189243830Sdim 190243830Sdim // Next, step over any post-statement checks. 191249423Sdim while (Node && Node->getLocation().getAs<PostStmt>()) 192243830Sdim Node = Node->getFirstPred(); 193249423Sdim if (!Node) 194249423Sdim return; 195243830Sdim 196243830Sdim // Finally, see if we inlined the call. 197249423Sdim Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>(); 198249423Sdim if (!CEE) 199249423Sdim return; 200249423Sdim 201249423Sdim const StackFrameContext *CalleeContext = CEE->getCalleeContext(); 202249423Sdim if (CalleeContext->getCallSite() != S) 203249423Sdim return; 204249423Sdim 205249423Sdim // Check the return value. 206249423Sdim ProgramStateRef State = Node->getState(); 207249423Sdim SVal RetVal = State->getSVal(S, Node->getLocationContext()); 208249423Sdim 209249423Sdim // Handle cases where a reference is returned and then immediately used. 210249423Sdim if (cast<Expr>(S)->isGLValue()) 211249423Sdim if (Optional<Loc> LValue = RetVal.getAs<Loc>()) 212249423Sdim RetVal = State->getSVal(*LValue); 213249423Sdim 214249423Sdim // See if the return value is NULL. If so, suppress the report. 215249423Sdim SubEngine *Eng = State->getStateManager().getOwningEngine(); 216249423Sdim assert(Eng && "Cannot file a bug report without an owning engine"); 217249423Sdim AnalyzerOptions &Options = Eng->getAnalysisManager().options; 218249423Sdim 219249423Sdim bool EnableNullFPSuppression = false; 220249423Sdim if (InEnableNullFPSuppression && Options.shouldSuppressNullReturnPaths()) 221249423Sdim if (Optional<Loc> RetLoc = RetVal.getAs<Loc>()) 222249423Sdim EnableNullFPSuppression = State->isNull(*RetLoc).isConstrainedTrue(); 223249423Sdim 224249423Sdim BR.markInteresting(CalleeContext); 225249423Sdim BR.addVisitor(new ReturnVisitor(CalleeContext, EnableNullFPSuppression)); 226243830Sdim } 227243830Sdim 228243830Sdim /// Returns true if any counter-suppression heuristics are enabled for 229243830Sdim /// ReturnVisitor. 230243830Sdim static bool hasCounterSuppression(AnalyzerOptions &Options) { 231243830Sdim return Options.shouldAvoidSuppressingNullArgumentPaths(); 232243830Sdim } 233243830Sdim 234243830Sdim PathDiagnosticPiece *visitNodeInitial(const ExplodedNode *N, 235243830Sdim const ExplodedNode *PrevN, 236243830Sdim BugReporterContext &BRC, 237243830Sdim BugReport &BR) { 238243830Sdim // Only print a message at the interesting return statement. 239243830Sdim if (N->getLocationContext() != StackFrame) 240243830Sdim return 0; 241243830Sdim 242249423Sdim Optional<StmtPoint> SP = N->getLocationAs<StmtPoint>(); 243243830Sdim if (!SP) 244243830Sdim return 0; 245243830Sdim 246243830Sdim const ReturnStmt *Ret = dyn_cast<ReturnStmt>(SP->getStmt()); 247243830Sdim if (!Ret) 248243830Sdim return 0; 249243830Sdim 250243830Sdim // Okay, we're at the right return statement, but do we have the return 251243830Sdim // value available? 252243830Sdim ProgramStateRef State = N->getState(); 253243830Sdim SVal V = State->getSVal(Ret, StackFrame); 254243830Sdim if (V.isUnknownOrUndef()) 255243830Sdim return 0; 256243830Sdim 257243830Sdim // Don't print any more notes after this one. 258243830Sdim Mode = Satisfied; 259243830Sdim 260243830Sdim const Expr *RetE = Ret->getRetValue(); 261243830Sdim assert(RetE && "Tracking a return value for a void function"); 262249423Sdim 263249423Sdim // Handle cases where a reference is returned and then immediately used. 264249423Sdim Optional<Loc> LValue; 265249423Sdim if (RetE->isGLValue()) { 266249423Sdim if ((LValue = V.getAs<Loc>())) { 267249423Sdim SVal RValue = State->getRawSVal(*LValue, RetE->getType()); 268249423Sdim if (RValue.getAs<DefinedSVal>()) 269249423Sdim V = RValue; 270249423Sdim } 271249423Sdim } 272249423Sdim 273249423Sdim // Ignore aggregate rvalues. 274249423Sdim if (V.getAs<nonloc::LazyCompoundVal>() || 275249423Sdim V.getAs<nonloc::CompoundVal>()) 276249423Sdim return 0; 277249423Sdim 278243830Sdim RetE = RetE->IgnoreParenCasts(); 279243830Sdim 280243830Sdim // If we can't prove the return value is 0, just mark it interesting, and 281243830Sdim // make sure to track it into any further inner functions. 282249423Sdim if (!State->isNull(V).isConstrainedTrue()) { 283243830Sdim BR.markInteresting(V); 284249423Sdim ReturnVisitor::addVisitorIfNecessary(N, RetE, BR, 285249423Sdim EnableNullFPSuppression); 286243830Sdim return 0; 287243830Sdim } 288243830Sdim 289243830Sdim // If we're returning 0, we should track where that 0 came from. 290249423Sdim bugreporter::trackNullOrUndefValue(N, RetE, BR, /*IsArg*/ false, 291249423Sdim EnableNullFPSuppression); 292243830Sdim 293243830Sdim // Build an appropriate message based on the return value. 294243830Sdim SmallString<64> Msg; 295243830Sdim llvm::raw_svector_ostream Out(Msg); 296243830Sdim 297249423Sdim if (V.getAs<Loc>()) { 298249423Sdim // If we have counter-suppression enabled, make sure we keep visiting 299249423Sdim // future nodes. We want to emit a path note as well, in case 300243830Sdim // the report is resurrected as valid later on. 301243830Sdim ExprEngine &Eng = BRC.getBugReporter().getEngine(); 302243830Sdim AnalyzerOptions &Options = Eng.getAnalysisManager().options; 303249423Sdim if (EnableNullFPSuppression && hasCounterSuppression(Options)) 304249423Sdim Mode = MaybeUnsuppress; 305243830Sdim 306243830Sdim if (RetE->getType()->isObjCObjectPointerType()) 307243830Sdim Out << "Returning nil"; 308243830Sdim else 309243830Sdim Out << "Returning null pointer"; 310243830Sdim } else { 311243830Sdim Out << "Returning zero"; 312243830Sdim } 313243830Sdim 314249423Sdim if (LValue) { 315249423Sdim if (const MemRegion *MR = LValue->getAsRegion()) { 316249423Sdim if (MR->canPrintPretty()) { 317251662Sdim Out << " (reference to "; 318249423Sdim MR->printPretty(Out); 319251662Sdim Out << ")"; 320249423Sdim } 321249423Sdim } 322249423Sdim } else { 323249423Sdim // FIXME: We should have a more generalized location printing mechanism. 324249423Sdim if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(RetE)) 325249423Sdim if (const DeclaratorDecl *DD = dyn_cast<DeclaratorDecl>(DR->getDecl())) 326249423Sdim Out << " (loaded from '" << *DD << "')"; 327249423Sdim } 328243830Sdim 329243830Sdim PathDiagnosticLocation L(Ret, BRC.getSourceManager(), StackFrame); 330243830Sdim return new PathDiagnosticEventPiece(L, Out.str()); 331243830Sdim } 332243830Sdim 333249423Sdim PathDiagnosticPiece *visitNodeMaybeUnsuppress(const ExplodedNode *N, 334249423Sdim const ExplodedNode *PrevN, 335249423Sdim BugReporterContext &BRC, 336249423Sdim BugReport &BR) { 337249423Sdim#ifndef NDEBUG 338249423Sdim ExprEngine &Eng = BRC.getBugReporter().getEngine(); 339249423Sdim AnalyzerOptions &Options = Eng.getAnalysisManager().options; 340249423Sdim assert(hasCounterSuppression(Options)); 341249423Sdim#endif 342249423Sdim 343243830Sdim // Are we at the entry node for this call? 344249423Sdim Optional<CallEnter> CE = N->getLocationAs<CallEnter>(); 345243830Sdim if (!CE) 346243830Sdim return 0; 347243830Sdim 348243830Sdim if (CE->getCalleeContext() != StackFrame) 349243830Sdim return 0; 350243830Sdim 351243830Sdim Mode = Satisfied; 352243830Sdim 353249423Sdim // Don't automatically suppress a report if one of the arguments is 354249423Sdim // known to be a null pointer. Instead, start tracking /that/ null 355249423Sdim // value back to its origin. 356249423Sdim ProgramStateManager &StateMgr = BRC.getStateManager(); 357249423Sdim CallEventManager &CallMgr = StateMgr.getCallEventManager(); 358243830Sdim 359249423Sdim ProgramStateRef State = N->getState(); 360249423Sdim CallEventRef<> Call = CallMgr.getCaller(StackFrame, State); 361249423Sdim for (unsigned I = 0, E = Call->getNumArgs(); I != E; ++I) { 362249423Sdim Optional<Loc> ArgV = Call->getArgSVal(I).getAs<Loc>(); 363249423Sdim if (!ArgV) 364249423Sdim continue; 365243830Sdim 366249423Sdim const Expr *ArgE = Call->getArgExpr(I); 367249423Sdim if (!ArgE) 368249423Sdim continue; 369243830Sdim 370249423Sdim // Is it possible for this argument to be non-null? 371249423Sdim if (!State->isNull(*ArgV).isConstrainedTrue()) 372249423Sdim continue; 373243830Sdim 374249423Sdim if (bugreporter::trackNullOrUndefValue(N, ArgE, BR, /*IsArg=*/true, 375249423Sdim EnableNullFPSuppression)) 376249423Sdim BR.removeInvalidation(ReturnVisitor::getTag(), StackFrame); 377243830Sdim 378249423Sdim // If we /can't/ track the null pointer, we should err on the side of 379249423Sdim // false negatives, and continue towards marking this report invalid. 380249423Sdim // (We will still look at the other arguments, though.) 381243830Sdim } 382243830Sdim 383243830Sdim return 0; 384243830Sdim } 385243830Sdim 386243830Sdim PathDiagnosticPiece *VisitNode(const ExplodedNode *N, 387243830Sdim const ExplodedNode *PrevN, 388243830Sdim BugReporterContext &BRC, 389243830Sdim BugReport &BR) { 390243830Sdim switch (Mode) { 391243830Sdim case Initial: 392243830Sdim return visitNodeInitial(N, PrevN, BRC, BR); 393249423Sdim case MaybeUnsuppress: 394249423Sdim return visitNodeMaybeUnsuppress(N, PrevN, BRC, BR); 395243830Sdim case Satisfied: 396243830Sdim return 0; 397243830Sdim } 398243830Sdim 399243830Sdim llvm_unreachable("Invalid visit mode!"); 400243830Sdim } 401249423Sdim 402249423Sdim PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, 403249423Sdim const ExplodedNode *N, 404249423Sdim BugReport &BR) { 405249423Sdim if (EnableNullFPSuppression) 406249423Sdim BR.markInvalid(ReturnVisitor::getTag(), StackFrame); 407249423Sdim return 0; 408249423Sdim } 409243830Sdim}; 410243830Sdim} // end anonymous namespace 411243830Sdim 412243830Sdim 413226633Sdimvoid FindLastStoreBRVisitor ::Profile(llvm::FoldingSetNodeID &ID) const { 414226633Sdim static int tag = 0; 415226633Sdim ID.AddPointer(&tag); 416226633Sdim ID.AddPointer(R); 417226633Sdim ID.Add(V); 418249423Sdim ID.AddBoolean(EnableNullFPSuppression); 419226633Sdim} 420226633Sdim 421251662Sdim/// Returns true if \p N represents the DeclStmt declaring and initializing 422251662Sdim/// \p VR. 423251662Sdimstatic bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR) { 424251662Sdim Optional<PostStmt> P = N->getLocationAs<PostStmt>(); 425251662Sdim if (!P) 426251662Sdim return false; 427251662Sdim 428251662Sdim const DeclStmt *DS = P->getStmtAs<DeclStmt>(); 429251662Sdim if (!DS) 430251662Sdim return false; 431251662Sdim 432251662Sdim if (DS->getSingleDecl() != VR->getDecl()) 433251662Sdim return false; 434251662Sdim 435251662Sdim const MemSpaceRegion *VarSpace = VR->getMemorySpace(); 436251662Sdim const StackSpaceRegion *FrameSpace = dyn_cast<StackSpaceRegion>(VarSpace); 437251662Sdim if (!FrameSpace) { 438251662Sdim // If we ever directly evaluate global DeclStmts, this assertion will be 439251662Sdim // invalid, but this still seems preferable to silently accepting an 440251662Sdim // initialization that may be for a path-sensitive variable. 441251662Sdim assert(VR->getDecl()->isStaticLocal() && "non-static stackless VarRegion"); 442251662Sdim return true; 443251662Sdim } 444251662Sdim 445251662Sdim assert(VR->getDecl()->hasLocalStorage()); 446251662Sdim const LocationContext *LCtx = N->getLocationContext(); 447251662Sdim return FrameSpace->getStackFrame() == LCtx->getCurrentStackFrame(); 448251662Sdim} 449251662Sdim 450243830SdimPathDiagnosticPiece *FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ, 451243830Sdim const ExplodedNode *Pred, 452243830Sdim BugReporterContext &BRC, 453243830Sdim BugReport &BR) { 454226633Sdim 455249423Sdim if (Satisfied) 456226633Sdim return NULL; 457226633Sdim 458243830Sdim const ExplodedNode *StoreSite = 0; 459243830Sdim const Expr *InitE = 0; 460243830Sdim bool IsParam = false; 461243830Sdim 462243830Sdim // First see if we reached the declaration of the region. 463243830Sdim if (const VarRegion *VR = dyn_cast<VarRegion>(R)) { 464251662Sdim if (isInitializationOfVar(Pred, VR)) { 465251662Sdim StoreSite = Pred; 466251662Sdim InitE = VR->getDecl()->getInit(); 467243830Sdim } 468243830Sdim } 469243830Sdim 470249423Sdim // If this is a post initializer expression, initializing the region, we 471249423Sdim // should track the initializer expression. 472249423Sdim if (Optional<PostInitializer> PIP = Pred->getLocationAs<PostInitializer>()) { 473249423Sdim const MemRegion *FieldReg = (const MemRegion *)PIP->getLocationValue(); 474249423Sdim if (FieldReg && FieldReg == R) { 475249423Sdim StoreSite = Pred; 476249423Sdim InitE = PIP->getInitializer()->getInit(); 477249423Sdim } 478249423Sdim } 479249423Sdim 480249423Sdim // Otherwise, see if this is the store site: 481249423Sdim // (1) Succ has this binding and Pred does not, i.e. this is 482249423Sdim // where the binding first occurred. 483249423Sdim // (2) Succ has this binding and is a PostStore node for this region, i.e. 484249423Sdim // the same binding was re-assigned here. 485226633Sdim if (!StoreSite) { 486243830Sdim if (Succ->getState()->getSVal(R) != V) 487239462Sdim return NULL; 488226633Sdim 489249423Sdim if (Pred->getState()->getSVal(R) == V) { 490249423Sdim Optional<PostStore> PS = Succ->getLocationAs<PostStore>(); 491249423Sdim if (!PS || PS->getLocationValue() != R) 492249423Sdim return NULL; 493249423Sdim } 494249423Sdim 495243830Sdim StoreSite = Succ; 496239462Sdim 497243830Sdim // If this is an assignment expression, we can track the value 498243830Sdim // being assigned. 499249423Sdim if (Optional<PostStmt> P = Succ->getLocationAs<PostStmt>()) 500243830Sdim if (const BinaryOperator *BO = P->getStmtAs<BinaryOperator>()) 501243830Sdim if (BO->isAssignmentOp()) 502243830Sdim InitE = BO->getRHS(); 503218887Sdim 504243830Sdim // If this is a call entry, the variable should be a parameter. 505243830Sdim // FIXME: Handle CXXThisRegion as well. (This is not a priority because 506243830Sdim // 'this' should never be NULL, but this visitor isn't just for NULL and 507243830Sdim // UndefinedVal.) 508249423Sdim if (Optional<CallEnter> CE = Succ->getLocationAs<CallEnter>()) { 509249423Sdim if (const VarRegion *VR = dyn_cast<VarRegion>(R)) { 510249423Sdim const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl()); 511249423Sdim 512249423Sdim ProgramStateManager &StateMgr = BRC.getStateManager(); 513249423Sdim CallEventManager &CallMgr = StateMgr.getCallEventManager(); 514239462Sdim 515249423Sdim CallEventRef<> Call = CallMgr.getCaller(CE->getCalleeContext(), 516249423Sdim Succ->getState()); 517249423Sdim InitE = Call->getArgExpr(Param->getFunctionScopeIndex()); 518249423Sdim IsParam = true; 519249423Sdim } 520218887Sdim } 521249423Sdim 522249423Sdim // If this is a CXXTempObjectRegion, the Expr responsible for its creation 523249423Sdim // is wrapped inside of it. 524249423Sdim if (const CXXTempObjectRegion *TmpR = dyn_cast<CXXTempObjectRegion>(R)) 525249423Sdim InitE = TmpR->getExpr(); 526243830Sdim } 527218887Sdim 528243830Sdim if (!StoreSite) 529243830Sdim return NULL; 530249423Sdim Satisfied = true; 531243830Sdim 532243830Sdim // If we have an expression that provided the value, try to track where it 533243830Sdim // came from. 534243830Sdim if (InitE) { 535263508Sdim if (V.isUndef() || 536263508Sdim V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) { 537243830Sdim if (!IsParam) 538243830Sdim InitE = InitE->IgnoreParenCasts(); 539249423Sdim bugreporter::trackNullOrUndefValue(StoreSite, InitE, BR, IsParam, 540249423Sdim EnableNullFPSuppression); 541243830Sdim } else { 542243830Sdim ReturnVisitor::addVisitorIfNecessary(StoreSite, InitE->IgnoreParenCasts(), 543249423Sdim BR, EnableNullFPSuppression); 544226633Sdim } 545226633Sdim } 546218887Sdim 547243830Sdim // Okay, we've found the binding. Emit an appropriate message. 548234353Sdim SmallString<256> sbuf; 549226633Sdim llvm::raw_svector_ostream os(sbuf); 550218887Sdim 551249423Sdim if (Optional<PostStmt> PS = StoreSite->getLocationAs<PostStmt>()) { 552249423Sdim const Stmt *S = PS->getStmt(); 553249423Sdim const char *action = 0; 554249423Sdim const DeclStmt *DS = dyn_cast<DeclStmt>(S); 555249423Sdim const VarRegion *VR = dyn_cast<VarRegion>(R); 556218887Sdim 557249423Sdim if (DS) { 558251662Sdim action = R->canPrintPretty() ? "initialized to " : 559251662Sdim "Initializing to "; 560249423Sdim } else if (isa<BlockExpr>(S)) { 561251662Sdim action = R->canPrintPretty() ? "captured by block as " : 562251662Sdim "Captured by block as "; 563249423Sdim if (VR) { 564249423Sdim // See if we can get the BlockVarRegion. 565249423Sdim ProgramStateRef State = StoreSite->getState(); 566249423Sdim SVal V = State->getSVal(S, PS->getLocationContext()); 567249423Sdim if (const BlockDataRegion *BDR = 568249423Sdim dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) { 569249423Sdim if (const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) { 570249423Sdim if (Optional<KnownSVal> KV = 571249423Sdim State->getSVal(OriginalR).getAs<KnownSVal>()) 572249423Sdim BR.addVisitor(new FindLastStoreBRVisitor(*KV, OriginalR, 573249423Sdim EnableNullFPSuppression)); 574249423Sdim } 575249423Sdim } 576218887Sdim } 577249423Sdim } 578218887Sdim 579249423Sdim if (action) { 580251662Sdim if (R->canPrintPretty()) { 581251662Sdim R->printPretty(os); 582251662Sdim os << " "; 583251662Sdim } 584249423Sdim 585249423Sdim if (V.getAs<loc::ConcreteInt>()) { 586218887Sdim bool b = false; 587218887Sdim if (R->isBoundable()) { 588226633Sdim if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) { 589218887Sdim if (TR->getValueType()->isObjCObjectPointerType()) { 590249423Sdim os << action << "nil"; 591218887Sdim b = true; 592218887Sdim } 593218887Sdim } 594218887Sdim } 595218887Sdim 596218887Sdim if (!b) 597249423Sdim os << action << "a null pointer value"; 598249423Sdim } else if (Optional<nonloc::ConcreteInt> CVal = 599249423Sdim V.getAs<nonloc::ConcreteInt>()) { 600249423Sdim os << action << CVal->getValue(); 601218887Sdim } 602249423Sdim else if (DS) { 603249423Sdim if (V.isUndef()) { 604249423Sdim if (isa<VarRegion>(R)) { 605249423Sdim const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl()); 606251662Sdim if (VD->getInit()) { 607251662Sdim os << (R->canPrintPretty() ? "initialized" : "Initializing") 608251662Sdim << " to a garbage value"; 609251662Sdim } else { 610251662Sdim os << (R->canPrintPretty() ? "declared" : "Declaring") 611251662Sdim << " without an initial value"; 612251662Sdim } 613249423Sdim } 614226633Sdim } 615249423Sdim else { 616251662Sdim os << (R->canPrintPretty() ? "initialized" : "Initialized") 617251662Sdim << " here"; 618249423Sdim } 619218887Sdim } 620218887Sdim } 621249423Sdim } else if (StoreSite->getLocation().getAs<CallEnter>()) { 622249423Sdim if (const VarRegion *VR = dyn_cast<VarRegion>(R)) { 623249423Sdim const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl()); 624243830Sdim 625249423Sdim os << "Passing "; 626243830Sdim 627249423Sdim if (V.getAs<loc::ConcreteInt>()) { 628249423Sdim if (Param->getType()->isObjCObjectPointerType()) 629249423Sdim os << "nil object reference"; 630249423Sdim else 631249423Sdim os << "null pointer value"; 632249423Sdim } else if (V.isUndef()) { 633249423Sdim os << "uninitialized value"; 634249423Sdim } else if (Optional<nonloc::ConcreteInt> CI = 635249423Sdim V.getAs<nonloc::ConcreteInt>()) { 636249423Sdim os << "the value " << CI->getValue(); 637249423Sdim } else { 638249423Sdim os << "value"; 639249423Sdim } 640243830Sdim 641249423Sdim // Printed parameter indexes are 1-based, not 0-based. 642249423Sdim unsigned Idx = Param->getFunctionScopeIndex() + 1; 643251662Sdim os << " via " << Idx << llvm::getOrdinalSuffix(Idx) << " parameter"; 644251662Sdim if (R->canPrintPretty()) { 645251662Sdim os << " "; 646251662Sdim R->printPretty(os); 647251662Sdim } 648249423Sdim } 649226633Sdim } 650218887Sdim 651226633Sdim if (os.str().empty()) { 652249423Sdim if (V.getAs<loc::ConcreteInt>()) { 653226633Sdim bool b = false; 654226633Sdim if (R->isBoundable()) { 655226633Sdim if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) { 656226633Sdim if (TR->getValueType()->isObjCObjectPointerType()) { 657251662Sdim os << "nil object reference stored"; 658226633Sdim b = true; 659226633Sdim } 660226633Sdim } 661226633Sdim } 662251662Sdim if (!b) { 663251662Sdim if (R->canPrintPretty()) 664251662Sdim os << "Null pointer value stored"; 665251662Sdim else 666251662Sdim os << "Storing null pointer value"; 667251662Sdim } 668218887Sdim 669251662Sdim } else if (V.isUndef()) { 670251662Sdim if (R->canPrintPretty()) 671251662Sdim os << "Uninitialized value stored"; 672251662Sdim else 673251662Sdim os << "Storing uninitialized value"; 674251662Sdim 675249423Sdim } else if (Optional<nonloc::ConcreteInt> CV = 676249423Sdim V.getAs<nonloc::ConcreteInt>()) { 677251662Sdim if (R->canPrintPretty()) 678251662Sdim os << "The value " << CV->getValue() << " is assigned"; 679251662Sdim else 680251662Sdim os << "Assigning " << CV->getValue(); 681251662Sdim 682251662Sdim } else { 683251662Sdim if (R->canPrintPretty()) 684251662Sdim os << "Value assigned"; 685251662Sdim else 686251662Sdim os << "Assigning value"; 687218887Sdim } 688251662Sdim 689251662Sdim if (R->canPrintPretty()) { 690251662Sdim os << " to "; 691251662Sdim R->printPretty(os); 692251662Sdim } 693218887Sdim } 694218887Sdim 695226633Sdim // Construct a new PathDiagnosticPiece. 696243830Sdim ProgramPoint P = StoreSite->getLocation(); 697243830Sdim PathDiagnosticLocation L; 698249423Sdim if (P.getAs<CallEnter>() && InitE) 699243830Sdim L = PathDiagnosticLocation(InitE, BRC.getSourceManager(), 700243830Sdim P.getLocationContext()); 701263508Sdim 702263508Sdim if (!L.isValid() || !L.asLocation().isValid()) 703243830Sdim L = PathDiagnosticLocation::create(P, BRC.getSourceManager()); 704263508Sdim 705263508Sdim if (!L.isValid() || !L.asLocation().isValid()) 706226633Sdim return NULL; 707263508Sdim 708226633Sdim return new PathDiagnosticEventPiece(L, os.str()); 709226633Sdim} 710218887Sdim 711226633Sdimvoid TrackConstraintBRVisitor::Profile(llvm::FoldingSetNodeID &ID) const { 712226633Sdim static int tag = 0; 713226633Sdim ID.AddPointer(&tag); 714226633Sdim ID.AddBoolean(Assumption); 715226633Sdim ID.Add(Constraint); 716218887Sdim} 717218887Sdim 718243830Sdim/// Return the tag associated with this visitor. This tag will be used 719243830Sdim/// to make all PathDiagnosticPieces created by this visitor. 720243830Sdimconst char *TrackConstraintBRVisitor::getTag() { 721243830Sdim return "TrackConstraintBRVisitor"; 722243830Sdim} 723243830Sdim 724249423Sdimbool TrackConstraintBRVisitor::isUnderconstrained(const ExplodedNode *N) const { 725249423Sdim if (IsZeroCheck) 726249423Sdim return N->getState()->isNull(Constraint).isUnderconstrained(); 727249423Sdim return N->getState()->assume(Constraint, !Assumption); 728249423Sdim} 729249423Sdim 730226633SdimPathDiagnosticPiece * 731226633SdimTrackConstraintBRVisitor::VisitNode(const ExplodedNode *N, 732226633Sdim const ExplodedNode *PrevN, 733226633Sdim BugReporterContext &BRC, 734226633Sdim BugReport &BR) { 735249423Sdim if (IsSatisfied) 736226633Sdim return NULL; 737218887Sdim 738251662Sdim // Start tracking after we see the first state in which the value is 739251662Sdim // constrained. 740251662Sdim if (!IsTrackingTurnedOn) 741251662Sdim if (!isUnderconstrained(N)) 742251662Sdim IsTrackingTurnedOn = true; 743251662Sdim if (!IsTrackingTurnedOn) 744251662Sdim return 0; 745251662Sdim 746226633Sdim // Check if in the previous state it was feasible for this constraint 747226633Sdim // to *not* be true. 748249423Sdim if (isUnderconstrained(PrevN)) { 749218887Sdim 750249423Sdim IsSatisfied = true; 751226633Sdim 752226633Sdim // As a sanity check, make sure that the negation of the constraint 753226633Sdim // was infeasible in the current state. If it is feasible, we somehow 754226633Sdim // missed the transition point. 755251662Sdim assert(!isUnderconstrained(N)); 756218887Sdim 757226633Sdim // We found the transition point for the constraint. We now need to 758226633Sdim // pretty-print the constraint. (work-in-progress) 759249423Sdim SmallString<64> sbuf; 760249423Sdim llvm::raw_svector_ostream os(sbuf); 761218887Sdim 762249423Sdim if (Constraint.getAs<Loc>()) { 763226633Sdim os << "Assuming pointer value is "; 764226633Sdim os << (Assumption ? "non-null" : "null"); 765226633Sdim } 766218887Sdim 767226633Sdim if (os.str().empty()) 768226633Sdim return NULL; 769218887Sdim 770226633Sdim // Construct a new PathDiagnosticPiece. 771226633Sdim ProgramPoint P = N->getLocation(); 772226633Sdim PathDiagnosticLocation L = 773226633Sdim PathDiagnosticLocation::create(P, BRC.getSourceManager()); 774226633Sdim if (!L.isValid()) 775226633Sdim return NULL; 776243830Sdim 777243830Sdim PathDiagnosticEventPiece *X = new PathDiagnosticEventPiece(L, os.str()); 778243830Sdim X->setTag(getTag()); 779243830Sdim return X; 780226633Sdim } 781218887Sdim 782226633Sdim return NULL; 783226633Sdim} 784218887Sdim 785249423SdimSuppressInlineDefensiveChecksVisitor:: 786249423SdimSuppressInlineDefensiveChecksVisitor(DefinedSVal Value, const ExplodedNode *N) 787249423Sdim : V(Value), IsSatisfied(false), IsTrackingTurnedOn(false) { 788249423Sdim 789249423Sdim // Check if the visitor is disabled. 790249423Sdim SubEngine *Eng = N->getState()->getStateManager().getOwningEngine(); 791249423Sdim assert(Eng && "Cannot file a bug report without an owning engine"); 792249423Sdim AnalyzerOptions &Options = Eng->getAnalysisManager().options; 793249423Sdim if (!Options.shouldSuppressInlinedDefensiveChecks()) 794249423Sdim IsSatisfied = true; 795249423Sdim 796249423Sdim assert(N->getState()->isNull(V).isConstrainedTrue() && 797249423Sdim "The visitor only tracks the cases where V is constrained to 0"); 798249423Sdim} 799249423Sdim 800249423Sdimvoid SuppressInlineDefensiveChecksVisitor::Profile(FoldingSetNodeID &ID) const { 801249423Sdim static int id = 0; 802249423Sdim ID.AddPointer(&id); 803249423Sdim ID.Add(V); 804249423Sdim} 805249423Sdim 806249423Sdimconst char *SuppressInlineDefensiveChecksVisitor::getTag() { 807249423Sdim return "IDCVisitor"; 808249423Sdim} 809249423Sdim 810249423SdimPathDiagnosticPiece * 811249423SdimSuppressInlineDefensiveChecksVisitor::VisitNode(const ExplodedNode *Succ, 812249423Sdim const ExplodedNode *Pred, 813249423Sdim BugReporterContext &BRC, 814249423Sdim BugReport &BR) { 815249423Sdim if (IsSatisfied) 816249423Sdim return 0; 817249423Sdim 818249423Sdim // Start tracking after we see the first state in which the value is null. 819249423Sdim if (!IsTrackingTurnedOn) 820249423Sdim if (Succ->getState()->isNull(V).isConstrainedTrue()) 821249423Sdim IsTrackingTurnedOn = true; 822249423Sdim if (!IsTrackingTurnedOn) 823249423Sdim return 0; 824249423Sdim 825249423Sdim // Check if in the previous state it was feasible for this value 826249423Sdim // to *not* be null. 827249423Sdim if (!Pred->getState()->isNull(V).isConstrainedTrue()) { 828249423Sdim IsSatisfied = true; 829249423Sdim 830249423Sdim assert(Succ->getState()->isNull(V).isConstrainedTrue()); 831249423Sdim 832249423Sdim // Check if this is inlined defensive checks. 833249423Sdim const LocationContext *CurLC =Succ->getLocationContext(); 834249423Sdim const LocationContext *ReportLC = BR.getErrorNode()->getLocationContext(); 835249423Sdim if (CurLC != ReportLC && !CurLC->isParentOf(ReportLC)) 836249423Sdim BR.markInvalid("Suppress IDC", CurLC); 837249423Sdim } 838249423Sdim return 0; 839249423Sdim} 840249423Sdim 841249423Sdimstatic const MemRegion *getLocationRegionIfReference(const Expr *E, 842249423Sdim const ExplodedNode *N) { 843249423Sdim if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(E)) { 844249423Sdim if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { 845249423Sdim if (!VD->getType()->isReferenceType()) 846249423Sdim return 0; 847249423Sdim ProgramStateManager &StateMgr = N->getState()->getStateManager(); 848249423Sdim MemRegionManager &MRMgr = StateMgr.getRegionManager(); 849249423Sdim return MRMgr.getVarRegion(VD, N->getLocationContext()); 850249423Sdim } 851249423Sdim } 852249423Sdim 853249423Sdim // FIXME: This does not handle other kinds of null references, 854249423Sdim // for example, references from FieldRegions: 855249423Sdim // struct Wrapper { int &ref; }; 856249423Sdim // Wrapper w = { *(int *)0 }; 857249423Sdim // w.ref = 1; 858249423Sdim 859249423Sdim return 0; 860249423Sdim} 861249423Sdim 862249423Sdimstatic const Expr *peelOffOuterExpr(const Expr *Ex, 863249423Sdim const ExplodedNode *N) { 864249423Sdim Ex = Ex->IgnoreParenCasts(); 865249423Sdim if (const ExprWithCleanups *EWC = dyn_cast<ExprWithCleanups>(Ex)) 866249423Sdim return peelOffOuterExpr(EWC->getSubExpr(), N); 867249423Sdim if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(Ex)) 868249423Sdim return peelOffOuterExpr(OVE->getSourceExpr(), N); 869249423Sdim 870249423Sdim // Peel off the ternary operator. 871249423Sdim if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(Ex)) { 872249423Sdim // Find a node where the branching occured and find out which branch 873249423Sdim // we took (true/false) by looking at the ExplodedGraph. 874249423Sdim const ExplodedNode *NI = N; 875249423Sdim do { 876249423Sdim ProgramPoint ProgPoint = NI->getLocation(); 877249423Sdim if (Optional<BlockEdge> BE = ProgPoint.getAs<BlockEdge>()) { 878249423Sdim const CFGBlock *srcBlk = BE->getSrc(); 879249423Sdim if (const Stmt *term = srcBlk->getTerminator()) { 880249423Sdim if (term == CO) { 881249423Sdim bool TookTrueBranch = (*(srcBlk->succ_begin()) == BE->getDst()); 882249423Sdim if (TookTrueBranch) 883249423Sdim return peelOffOuterExpr(CO->getTrueExpr(), N); 884249423Sdim else 885249423Sdim return peelOffOuterExpr(CO->getFalseExpr(), N); 886249423Sdim } 887249423Sdim } 888249423Sdim } 889249423Sdim NI = NI->getFirstPred(); 890249423Sdim } while (NI); 891249423Sdim } 892249423Sdim return Ex; 893249423Sdim} 894249423Sdim 895249423Sdimbool bugreporter::trackNullOrUndefValue(const ExplodedNode *N, 896249423Sdim const Stmt *S, 897249423Sdim BugReport &report, bool IsArg, 898249423Sdim bool EnableNullFPSuppression) { 899226633Sdim if (!S || !N) 900243830Sdim return false; 901218887Sdim 902249423Sdim if (const Expr *Ex = dyn_cast<Expr>(S)) { 903249423Sdim Ex = Ex->IgnoreParenCasts(); 904249423Sdim const Expr *PeeledEx = peelOffOuterExpr(Ex, N); 905249423Sdim if (Ex != PeeledEx) 906249423Sdim S = PeeledEx; 907249423Sdim } 908218887Sdim 909249423Sdim const Expr *Inner = 0; 910249423Sdim if (const Expr *Ex = dyn_cast<Expr>(S)) { 911249423Sdim Ex = Ex->IgnoreParenCasts(); 912249423Sdim if (ExplodedGraph::isInterestingLValueExpr(Ex) || CallEvent::isCallStmt(Ex)) 913249423Sdim Inner = Ex; 914249423Sdim } 915249423Sdim 916251662Sdim if (IsArg && !Inner) { 917249423Sdim assert(N->getLocation().getAs<CallEnter>() && "Tracking arg but not at call"); 918243830Sdim } else { 919243830Sdim // Walk through nodes until we get one that matches the statement exactly. 920249423Sdim // Alternately, if we hit a known lvalue for the statement, we know we've 921249423Sdim // gone too far (though we can likely track the lvalue better anyway). 922243830Sdim do { 923243830Sdim const ProgramPoint &pp = N->getLocation(); 924249423Sdim if (Optional<StmtPoint> ps = pp.getAs<StmtPoint>()) { 925249423Sdim if (ps->getStmt() == S || ps->getStmt() == Inner) 926243830Sdim break; 927249423Sdim } else if (Optional<CallExitEnd> CEE = pp.getAs<CallExitEnd>()) { 928249423Sdim if (CEE->getCalleeContext()->getCallSite() == S || 929249423Sdim CEE->getCalleeContext()->getCallSite() == Inner) 930243830Sdim break; 931243830Sdim } 932243830Sdim N = N->getFirstPred(); 933243830Sdim } while (N); 934243830Sdim 935243830Sdim if (!N) 936243830Sdim return false; 937218887Sdim } 938226633Sdim 939234353Sdim ProgramStateRef state = N->getState(); 940218887Sdim 941249423Sdim // The message send could be nil due to the receiver being nil. 942249423Sdim // At this point in the path, the receiver should be live since we are at the 943249423Sdim // message send expr. If it is nil, start tracking it. 944249423Sdim if (const Expr *Receiver = NilReceiverBRVisitor::getNilReceiver(S, N)) 945251662Sdim trackNullOrUndefValue(N, Receiver, report, false, EnableNullFPSuppression); 946249423Sdim 947249423Sdim 948249423Sdim // See if the expression we're interested refers to a variable. 949243830Sdim // If so, we can track both its contents and constraints on its value. 950249423Sdim if (Inner && ExplodedGraph::isInterestingLValueExpr(Inner)) { 951249423Sdim const MemRegion *R = 0; 952218887Sdim 953249423Sdim // Find the ExplodedNode where the lvalue (the value of 'Ex') 954249423Sdim // was computed. We need this for getting the location value. 955249423Sdim const ExplodedNode *LVNode = N; 956249423Sdim while (LVNode) { 957249423Sdim if (Optional<PostStmt> P = LVNode->getLocation().getAs<PostStmt>()) { 958249423Sdim if (P->getStmt() == Inner) 959249423Sdim break; 960249423Sdim } 961249423Sdim LVNode = LVNode->getFirstPred(); 962249423Sdim } 963249423Sdim assert(LVNode && "Unable to find the lvalue node."); 964249423Sdim ProgramStateRef LVState = LVNode->getState(); 965249423Sdim SVal LVal = LVState->getSVal(Inner, LVNode->getLocationContext()); 966249423Sdim 967249423Sdim if (LVState->isNull(LVal).isConstrainedTrue()) { 968249423Sdim // In case of C++ references, we want to differentiate between a null 969249423Sdim // reference and reference to null pointer. 970249423Sdim // If the LVal is null, check if we are dealing with null reference. 971249423Sdim // For those, we want to track the location of the reference. 972249423Sdim if (const MemRegion *RR = getLocationRegionIfReference(Inner, N)) 973249423Sdim R = RR; 974249423Sdim } else { 975249423Sdim R = LVState->getSVal(Inner, LVNode->getLocationContext()).getAsRegion(); 976239462Sdim 977249423Sdim // If this is a C++ reference to a null pointer, we are tracking the 978249423Sdim // pointer. In additon, we should find the store at which the reference 979249423Sdim // got initialized. 980249423Sdim if (const MemRegion *RR = getLocationRegionIfReference(Inner, N)) { 981249423Sdim if (Optional<KnownSVal> KV = LVal.getAs<KnownSVal>()) 982249423Sdim report.addVisitor(new FindLastStoreBRVisitor(*KV, RR, 983249423Sdim EnableNullFPSuppression)); 984249423Sdim } 985249423Sdim } 986249423Sdim 987249423Sdim if (R) { 988249423Sdim // Mark both the variable region and its contents as interesting. 989251662Sdim SVal V = LVState->getRawSVal(loc::MemRegionVal(R)); 990249423Sdim 991249423Sdim report.markInteresting(R); 992249423Sdim report.markInteresting(V); 993249423Sdim report.addVisitor(new UndefOrNullArgVisitor(R)); 994243830Sdim 995249423Sdim // If the contents are symbolic, find out when they became null. 996251662Sdim if (V.getAsLocSymbol(/*IncludeBaseRegions*/ true)) { 997249423Sdim BugReporterVisitor *ConstraintTracker = 998249423Sdim new TrackConstraintBRVisitor(V.castAs<DefinedSVal>(), false); 999249423Sdim report.addVisitor(ConstraintTracker); 1000263508Sdim } 1001249423Sdim 1002263508Sdim // Add visitor, which will suppress inline defensive checks. 1003263508Sdim if (Optional<DefinedSVal> DV = V.getAs<DefinedSVal>()) { 1004263508Sdim if (!DV->isZeroConstant() && 1005263508Sdim LVState->isNull(*DV).isConstrainedTrue() && 1006263508Sdim EnableNullFPSuppression) { 1007249423Sdim BugReporterVisitor *IDCSuppressor = 1008263508Sdim new SuppressInlineDefensiveChecksVisitor(*DV, 1009251662Sdim LVNode); 1010249423Sdim report.addVisitor(IDCSuppressor); 1011239462Sdim } 1012249423Sdim } 1013239462Sdim 1014249423Sdim if (Optional<KnownSVal> KV = V.getAs<KnownSVal>()) 1015249423Sdim report.addVisitor(new FindLastStoreBRVisitor(*KV, R, 1016249423Sdim EnableNullFPSuppression)); 1017249423Sdim return true; 1018218887Sdim } 1019218887Sdim } 1020218887Sdim 1021249423Sdim // If the expression is not an "lvalue expression", we can still 1022249423Sdim // track the constraints on its contents. 1023234353Sdim SVal V = state->getSValAsScalarOrLoc(S, N->getLocationContext()); 1024218887Sdim 1025249423Sdim // If the value came from an inlined function call, we should at least make 1026249423Sdim // sure that function isn't pruned in our output. 1027249423Sdim if (const Expr *E = dyn_cast<Expr>(S)) 1028249423Sdim S = E->IgnoreParenCasts(); 1029249423Sdim 1030249423Sdim ReturnVisitor::addVisitorIfNecessary(N, S, report, EnableNullFPSuppression); 1031249423Sdim 1032218887Sdim // Uncomment this to find cases where we aren't properly getting the 1033218887Sdim // base value that was dereferenced. 1034218887Sdim // assert(!V.isUnknownOrUndef()); 1035218887Sdim // Is it a symbolic value? 1036249423Sdim if (Optional<loc::MemRegionVal> L = V.getAs<loc::MemRegionVal>()) { 1037243830Sdim // At this point we are dealing with the region's LValue. 1038243830Sdim // However, if the rvalue is a symbolic region, we should track it as well. 1039251662Sdim // Try to use the correct type when looking up the value. 1040251662Sdim SVal RVal; 1041251662Sdim if (const Expr *E = dyn_cast<Expr>(S)) 1042251662Sdim RVal = state->getRawSVal(L.getValue(), E->getType()); 1043251662Sdim else 1044251662Sdim RVal = state->getSVal(L->getRegion()); 1045251662Sdim 1046243830Sdim const MemRegion *RegionRVal = RVal.getAsRegion(); 1047243830Sdim report.addVisitor(new UndefOrNullArgVisitor(L->getRegion())); 1048218887Sdim 1049243830Sdim if (RegionRVal && isa<SymbolicRegion>(RegionRVal)) { 1050243830Sdim report.markInteresting(RegionRVal); 1051243830Sdim report.addVisitor(new TrackConstraintBRVisitor( 1052243830Sdim loc::MemRegionVal(RegionRVal), false)); 1053218887Sdim } 1054218887Sdim } 1055243830Sdim 1056243830Sdim return true; 1057218887Sdim} 1058218887Sdim 1059249423Sdimconst Expr *NilReceiverBRVisitor::getNilReceiver(const Stmt *S, 1060249423Sdim const ExplodedNode *N) { 1061249423Sdim const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S); 1062249423Sdim if (!ME) 1063226633Sdim return 0; 1064249423Sdim if (const Expr *Receiver = ME->getInstanceReceiver()) { 1065249423Sdim ProgramStateRef state = N->getState(); 1066249423Sdim SVal V = state->getSVal(Receiver, N->getLocationContext()); 1067249423Sdim if (state->isNull(V).isConstrainedTrue()) 1068249423Sdim return Receiver; 1069249423Sdim } 1070249423Sdim return 0; 1071218887Sdim} 1072218887Sdim 1073226633SdimPathDiagnosticPiece *NilReceiverBRVisitor::VisitNode(const ExplodedNode *N, 1074226633Sdim const ExplodedNode *PrevN, 1075226633Sdim BugReporterContext &BRC, 1076226633Sdim BugReport &BR) { 1077249423Sdim Optional<PreStmt> P = N->getLocationAs<PreStmt>(); 1078226633Sdim if (!P) 1079226633Sdim return 0; 1080249423Sdim 1081251662Sdim const Stmt *S = P->getStmt(); 1082251662Sdim const Expr *Receiver = getNilReceiver(S, N); 1083226633Sdim if (!Receiver) 1084226633Sdim return 0; 1085218887Sdim 1086251662Sdim llvm::SmallString<256> Buf; 1087251662Sdim llvm::raw_svector_ostream OS(Buf); 1088251662Sdim 1089251662Sdim if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { 1090251662Sdim OS << "'" << ME->getSelector().getAsString() << "' not called"; 1091251662Sdim } 1092251662Sdim else { 1093251662Sdim OS << "No method is called"; 1094251662Sdim } 1095251662Sdim OS << " because the receiver is nil"; 1096251662Sdim 1097226633Sdim // The receiver was nil, and hence the method was skipped. 1098226633Sdim // Register a BugReporterVisitor to issue a message telling us how 1099226633Sdim // the receiver was null. 1100249423Sdim bugreporter::trackNullOrUndefValue(N, Receiver, BR, /*IsArg*/ false, 1101249423Sdim /*EnableNullFPSuppression*/ false); 1102226633Sdim // Issue a message saying that the method was skipped. 1103226633Sdim PathDiagnosticLocation L(Receiver, BRC.getSourceManager(), 1104226633Sdim N->getLocationContext()); 1105251662Sdim return new PathDiagnosticEventPiece(L, OS.str()); 1106218887Sdim} 1107218887Sdim 1108226633Sdim// Registers every VarDecl inside a Stmt with a last store visitor. 1109226633Sdimvoid FindLastStoreBRVisitor::registerStatementVarDecls(BugReport &BR, 1110249423Sdim const Stmt *S, 1111249423Sdim bool EnableNullFPSuppression) { 1112226633Sdim const ExplodedNode *N = BR.getErrorNode(); 1113218887Sdim std::deque<const Stmt *> WorkList; 1114218887Sdim WorkList.push_back(S); 1115218887Sdim 1116218887Sdim while (!WorkList.empty()) { 1117218887Sdim const Stmt *Head = WorkList.front(); 1118218887Sdim WorkList.pop_front(); 1119218887Sdim 1120234353Sdim ProgramStateRef state = N->getState(); 1121226633Sdim ProgramStateManager &StateMgr = state->getStateManager(); 1122218887Sdim 1123218887Sdim if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Head)) { 1124218887Sdim if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { 1125218887Sdim const VarRegion *R = 1126218887Sdim StateMgr.getRegionManager().getVarRegion(VD, N->getLocationContext()); 1127218887Sdim 1128218887Sdim // What did we load? 1129234353Sdim SVal V = state->getSVal(S, N->getLocationContext()); 1130218887Sdim 1131249423Sdim if (V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) { 1132226633Sdim // Register a new visitor with the BugReport. 1133249423Sdim BR.addVisitor(new FindLastStoreBRVisitor(V.castAs<KnownSVal>(), R, 1134249423Sdim EnableNullFPSuppression)); 1135218887Sdim } 1136218887Sdim } 1137218887Sdim } 1138218887Sdim 1139218887Sdim for (Stmt::const_child_iterator I = Head->child_begin(); 1140218887Sdim I != Head->child_end(); ++I) 1141218887Sdim WorkList.push_back(*I); 1142218887Sdim } 1143218887Sdim} 1144226633Sdim 1145226633Sdim//===----------------------------------------------------------------------===// 1146226633Sdim// Visitor that tries to report interesting diagnostics from conditions. 1147226633Sdim//===----------------------------------------------------------------------===// 1148243830Sdim 1149243830Sdim/// Return the tag associated with this visitor. This tag will be used 1150243830Sdim/// to make all PathDiagnosticPieces created by this visitor. 1151243830Sdimconst char *ConditionBRVisitor::getTag() { 1152243830Sdim return "ConditionBRVisitor"; 1153243830Sdim} 1154243830Sdim 1155226633SdimPathDiagnosticPiece *ConditionBRVisitor::VisitNode(const ExplodedNode *N, 1156226633Sdim const ExplodedNode *Prev, 1157226633Sdim BugReporterContext &BRC, 1158226633Sdim BugReport &BR) { 1159234353Sdim PathDiagnosticPiece *piece = VisitNodeImpl(N, Prev, BRC, BR); 1160243830Sdim if (piece) { 1161243830Sdim piece->setTag(getTag()); 1162243830Sdim if (PathDiagnosticEventPiece *ev=dyn_cast<PathDiagnosticEventPiece>(piece)) 1163243830Sdim ev->setPrunable(true, /* override */ false); 1164243830Sdim } 1165234353Sdim return piece; 1166234353Sdim} 1167234353Sdim 1168234353SdimPathDiagnosticPiece *ConditionBRVisitor::VisitNodeImpl(const ExplodedNode *N, 1169234353Sdim const ExplodedNode *Prev, 1170234353Sdim BugReporterContext &BRC, 1171234353Sdim BugReport &BR) { 1172226633Sdim 1173243830Sdim ProgramPoint progPoint = N->getLocation(); 1174234353Sdim ProgramStateRef CurrentState = N->getState(); 1175234353Sdim ProgramStateRef PrevState = Prev->getState(); 1176226633Sdim 1177226633Sdim // Compare the GDMs of the state, because that is where constraints 1178226633Sdim // are managed. Note that ensure that we only look at nodes that 1179226633Sdim // were generated by the analyzer engine proper, not checkers. 1180226633Sdim if (CurrentState->getGDM().getRoot() == 1181226633Sdim PrevState->getGDM().getRoot()) 1182226633Sdim return 0; 1183226633Sdim 1184226633Sdim // If an assumption was made on a branch, it should be caught 1185226633Sdim // here by looking at the state transition. 1186249423Sdim if (Optional<BlockEdge> BE = progPoint.getAs<BlockEdge>()) { 1187226633Sdim const CFGBlock *srcBlk = BE->getSrc(); 1188226633Sdim if (const Stmt *term = srcBlk->getTerminator()) 1189234353Sdim return VisitTerminator(term, N, srcBlk, BE->getDst(), BR, BRC); 1190226633Sdim return 0; 1191226633Sdim } 1192226633Sdim 1193249423Sdim if (Optional<PostStmt> PS = progPoint.getAs<PostStmt>()) { 1194226633Sdim // FIXME: Assuming that BugReporter is a GRBugReporter is a layering 1195226633Sdim // violation. 1196226633Sdim const std::pair<const ProgramPointTag *, const ProgramPointTag *> &tags = 1197226633Sdim cast<GRBugReporter>(BRC.getBugReporter()). 1198243830Sdim getEngine().geteagerlyAssumeBinOpBifurcationTags(); 1199226633Sdim 1200226633Sdim const ProgramPointTag *tag = PS->getTag(); 1201226633Sdim if (tag == tags.first) 1202226633Sdim return VisitTrueTest(cast<Expr>(PS->getStmt()), true, 1203234353Sdim BRC, BR, N); 1204226633Sdim if (tag == tags.second) 1205226633Sdim return VisitTrueTest(cast<Expr>(PS->getStmt()), false, 1206234353Sdim BRC, BR, N); 1207226633Sdim 1208226633Sdim return 0; 1209226633Sdim } 1210226633Sdim 1211226633Sdim return 0; 1212226633Sdim} 1213226633Sdim 1214226633SdimPathDiagnosticPiece * 1215226633SdimConditionBRVisitor::VisitTerminator(const Stmt *Term, 1216226633Sdim const ExplodedNode *N, 1217226633Sdim const CFGBlock *srcBlk, 1218226633Sdim const CFGBlock *dstBlk, 1219234353Sdim BugReport &R, 1220226633Sdim BugReporterContext &BRC) { 1221226633Sdim const Expr *Cond = 0; 1222226633Sdim 1223226633Sdim switch (Term->getStmtClass()) { 1224226633Sdim default: 1225226633Sdim return 0; 1226226633Sdim case Stmt::IfStmtClass: 1227226633Sdim Cond = cast<IfStmt>(Term)->getCond(); 1228226633Sdim break; 1229226633Sdim case Stmt::ConditionalOperatorClass: 1230226633Sdim Cond = cast<ConditionalOperator>(Term)->getCond(); 1231226633Sdim break; 1232226633Sdim } 1233226633Sdim 1234226633Sdim assert(Cond); 1235226633Sdim assert(srcBlk->succ_size() == 2); 1236226633Sdim const bool tookTrue = *(srcBlk->succ_begin()) == dstBlk; 1237243830Sdim return VisitTrueTest(Cond, tookTrue, BRC, R, N); 1238226633Sdim} 1239226633Sdim 1240226633SdimPathDiagnosticPiece * 1241226633SdimConditionBRVisitor::VisitTrueTest(const Expr *Cond, 1242226633Sdim bool tookTrue, 1243226633Sdim BugReporterContext &BRC, 1244234353Sdim BugReport &R, 1245234353Sdim const ExplodedNode *N) { 1246226633Sdim 1247226633Sdim const Expr *Ex = Cond; 1248226633Sdim 1249226633Sdim while (true) { 1250243830Sdim Ex = Ex->IgnoreParenCasts(); 1251226633Sdim switch (Ex->getStmtClass()) { 1252226633Sdim default: 1253226633Sdim return 0; 1254226633Sdim case Stmt::BinaryOperatorClass: 1255234353Sdim return VisitTrueTest(Cond, cast<BinaryOperator>(Ex), tookTrue, BRC, 1256234353Sdim R, N); 1257226633Sdim case Stmt::DeclRefExprClass: 1258234353Sdim return VisitTrueTest(Cond, cast<DeclRefExpr>(Ex), tookTrue, BRC, 1259234353Sdim R, N); 1260226633Sdim case Stmt::UnaryOperatorClass: { 1261226633Sdim const UnaryOperator *UO = cast<UnaryOperator>(Ex); 1262226633Sdim if (UO->getOpcode() == UO_LNot) { 1263226633Sdim tookTrue = !tookTrue; 1264243830Sdim Ex = UO->getSubExpr(); 1265226633Sdim continue; 1266226633Sdim } 1267226633Sdim return 0; 1268226633Sdim } 1269226633Sdim } 1270226633Sdim } 1271226633Sdim} 1272226633Sdim 1273249423Sdimbool ConditionBRVisitor::patternMatch(const Expr *Ex, raw_ostream &Out, 1274234353Sdim BugReporterContext &BRC, 1275234353Sdim BugReport &report, 1276234353Sdim const ExplodedNode *N, 1277249423Sdim Optional<bool> &prunable) { 1278226633Sdim const Expr *OriginalExpr = Ex; 1279226633Sdim Ex = Ex->IgnoreParenCasts(); 1280226633Sdim 1281226633Sdim if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Ex)) { 1282226633Sdim const bool quotes = isa<VarDecl>(DR->getDecl()); 1283234353Sdim if (quotes) { 1284226633Sdim Out << '\''; 1285234353Sdim const LocationContext *LCtx = N->getLocationContext(); 1286234353Sdim const ProgramState *state = N->getState().getPtr(); 1287234353Sdim if (const MemRegion *R = state->getLValue(cast<VarDecl>(DR->getDecl()), 1288234353Sdim LCtx).getAsRegion()) { 1289234353Sdim if (report.isInteresting(R)) 1290234353Sdim prunable = false; 1291234353Sdim else { 1292234353Sdim const ProgramState *state = N->getState().getPtr(); 1293234353Sdim SVal V = state->getSVal(R); 1294234353Sdim if (report.isInteresting(V)) 1295234353Sdim prunable = false; 1296234353Sdim } 1297234353Sdim } 1298234353Sdim } 1299226633Sdim Out << DR->getDecl()->getDeclName().getAsString(); 1300226633Sdim if (quotes) 1301226633Sdim Out << '\''; 1302226633Sdim return quotes; 1303226633Sdim } 1304226633Sdim 1305226633Sdim if (const IntegerLiteral *IL = dyn_cast<IntegerLiteral>(Ex)) { 1306226633Sdim QualType OriginalTy = OriginalExpr->getType(); 1307226633Sdim if (OriginalTy->isPointerType()) { 1308226633Sdim if (IL->getValue() == 0) { 1309226633Sdim Out << "null"; 1310226633Sdim return false; 1311226633Sdim } 1312226633Sdim } 1313226633Sdim else if (OriginalTy->isObjCObjectPointerType()) { 1314226633Sdim if (IL->getValue() == 0) { 1315226633Sdim Out << "nil"; 1316226633Sdim return false; 1317226633Sdim } 1318226633Sdim } 1319226633Sdim 1320226633Sdim Out << IL->getValue(); 1321226633Sdim return false; 1322226633Sdim } 1323226633Sdim 1324226633Sdim return false; 1325226633Sdim} 1326226633Sdim 1327226633SdimPathDiagnosticPiece * 1328226633SdimConditionBRVisitor::VisitTrueTest(const Expr *Cond, 1329226633Sdim const BinaryOperator *BExpr, 1330226633Sdim const bool tookTrue, 1331226633Sdim BugReporterContext &BRC, 1332234353Sdim BugReport &R, 1333234353Sdim const ExplodedNode *N) { 1334226633Sdim 1335226633Sdim bool shouldInvert = false; 1336249423Sdim Optional<bool> shouldPrune; 1337226633Sdim 1338234353Sdim SmallString<128> LhsString, RhsString; 1339226633Sdim { 1340234353Sdim llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString); 1341234353Sdim const bool isVarLHS = patternMatch(BExpr->getLHS(), OutLHS, BRC, R, N, 1342234353Sdim shouldPrune); 1343234353Sdim const bool isVarRHS = patternMatch(BExpr->getRHS(), OutRHS, BRC, R, N, 1344234353Sdim shouldPrune); 1345226633Sdim 1346226633Sdim shouldInvert = !isVarLHS && isVarRHS; 1347226633Sdim } 1348226633Sdim 1349234353Sdim BinaryOperator::Opcode Op = BExpr->getOpcode(); 1350234353Sdim 1351234353Sdim if (BinaryOperator::isAssignmentOp(Op)) { 1352234353Sdim // For assignment operators, all that we care about is that the LHS 1353234353Sdim // evaluates to "true" or "false". 1354234353Sdim return VisitConditionVariable(LhsString, BExpr->getLHS(), tookTrue, 1355234353Sdim BRC, R, N); 1356234353Sdim } 1357234353Sdim 1358234353Sdim // For non-assignment operations, we require that we can understand 1359234353Sdim // both the LHS and RHS. 1360263508Sdim if (LhsString.empty() || RhsString.empty() || 1361263508Sdim !BinaryOperator::isComparisonOp(Op)) 1362226633Sdim return 0; 1363234353Sdim 1364226633Sdim // Should we invert the strings if the LHS is not a variable name? 1365234353Sdim SmallString<256> buf; 1366226633Sdim llvm::raw_svector_ostream Out(buf); 1367226633Sdim Out << "Assuming " << (shouldInvert ? RhsString : LhsString) << " is "; 1368226633Sdim 1369226633Sdim // Do we need to invert the opcode? 1370226633Sdim if (shouldInvert) 1371226633Sdim switch (Op) { 1372226633Sdim default: break; 1373226633Sdim case BO_LT: Op = BO_GT; break; 1374226633Sdim case BO_GT: Op = BO_LT; break; 1375226633Sdim case BO_LE: Op = BO_GE; break; 1376226633Sdim case BO_GE: Op = BO_LE; break; 1377226633Sdim } 1378226633Sdim 1379226633Sdim if (!tookTrue) 1380226633Sdim switch (Op) { 1381226633Sdim case BO_EQ: Op = BO_NE; break; 1382226633Sdim case BO_NE: Op = BO_EQ; break; 1383226633Sdim case BO_LT: Op = BO_GE; break; 1384226633Sdim case BO_GT: Op = BO_LE; break; 1385226633Sdim case BO_LE: Op = BO_GT; break; 1386226633Sdim case BO_GE: Op = BO_LT; break; 1387226633Sdim default: 1388226633Sdim return 0; 1389226633Sdim } 1390226633Sdim 1391234353Sdim switch (Op) { 1392226633Sdim case BO_EQ: 1393226633Sdim Out << "equal to "; 1394226633Sdim break; 1395226633Sdim case BO_NE: 1396226633Sdim Out << "not equal to "; 1397226633Sdim break; 1398226633Sdim default: 1399226633Sdim Out << BinaryOperator::getOpcodeStr(Op) << ' '; 1400226633Sdim break; 1401226633Sdim } 1402226633Sdim 1403226633Sdim Out << (shouldInvert ? LhsString : RhsString); 1404234353Sdim const LocationContext *LCtx = N->getLocationContext(); 1405234353Sdim PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx); 1406234353Sdim PathDiagnosticEventPiece *event = 1407234353Sdim new PathDiagnosticEventPiece(Loc, Out.str()); 1408234353Sdim if (shouldPrune.hasValue()) 1409234353Sdim event->setPrunable(shouldPrune.getValue()); 1410234353Sdim return event; 1411234353Sdim} 1412226633Sdim 1413234353SdimPathDiagnosticPiece * 1414234353SdimConditionBRVisitor::VisitConditionVariable(StringRef LhsString, 1415234353Sdim const Expr *CondVarExpr, 1416234353Sdim const bool tookTrue, 1417234353Sdim BugReporterContext &BRC, 1418234353Sdim BugReport &report, 1419234353Sdim const ExplodedNode *N) { 1420239462Sdim // FIXME: If there's already a constraint tracker for this variable, 1421239462Sdim // we shouldn't emit anything here (c.f. the double note in 1422239462Sdim // test/Analysis/inlining/path-notes.c) 1423234353Sdim SmallString<256> buf; 1424234353Sdim llvm::raw_svector_ostream Out(buf); 1425234353Sdim Out << "Assuming " << LhsString << " is "; 1426234353Sdim 1427234353Sdim QualType Ty = CondVarExpr->getType(); 1428234353Sdim 1429234353Sdim if (Ty->isPointerType()) 1430234353Sdim Out << (tookTrue ? "not null" : "null"); 1431234353Sdim else if (Ty->isObjCObjectPointerType()) 1432234353Sdim Out << (tookTrue ? "not nil" : "nil"); 1433234353Sdim else if (Ty->isBooleanType()) 1434234353Sdim Out << (tookTrue ? "true" : "false"); 1435251662Sdim else if (Ty->isIntegralOrEnumerationType()) 1436234353Sdim Out << (tookTrue ? "non-zero" : "zero"); 1437234353Sdim else 1438234353Sdim return 0; 1439234353Sdim 1440234353Sdim const LocationContext *LCtx = N->getLocationContext(); 1441234353Sdim PathDiagnosticLocation Loc(CondVarExpr, BRC.getSourceManager(), LCtx); 1442234353Sdim PathDiagnosticEventPiece *event = 1443234353Sdim new PathDiagnosticEventPiece(Loc, Out.str()); 1444234353Sdim 1445234353Sdim if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(CondVarExpr)) { 1446234353Sdim if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { 1447234353Sdim const ProgramState *state = N->getState().getPtr(); 1448234353Sdim if (const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) { 1449234353Sdim if (report.isInteresting(R)) 1450234353Sdim event->setPrunable(false); 1451234353Sdim } 1452234353Sdim } 1453234353Sdim } 1454234353Sdim 1455234353Sdim return event; 1456226633Sdim} 1457226633Sdim 1458226633SdimPathDiagnosticPiece * 1459226633SdimConditionBRVisitor::VisitTrueTest(const Expr *Cond, 1460226633Sdim const DeclRefExpr *DR, 1461226633Sdim const bool tookTrue, 1462226633Sdim BugReporterContext &BRC, 1463234353Sdim BugReport &report, 1464234353Sdim const ExplodedNode *N) { 1465226633Sdim 1466226633Sdim const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl()); 1467226633Sdim if (!VD) 1468226633Sdim return 0; 1469226633Sdim 1470234353Sdim SmallString<256> Buf; 1471226633Sdim llvm::raw_svector_ostream Out(Buf); 1472226633Sdim 1473263508Sdim Out << "Assuming '" << VD->getDeclName() << "' is "; 1474226633Sdim 1475226633Sdim QualType VDTy = VD->getType(); 1476226633Sdim 1477226633Sdim if (VDTy->isPointerType()) 1478226633Sdim Out << (tookTrue ? "non-null" : "null"); 1479226633Sdim else if (VDTy->isObjCObjectPointerType()) 1480226633Sdim Out << (tookTrue ? "non-nil" : "nil"); 1481226633Sdim else if (VDTy->isScalarType()) 1482226633Sdim Out << (tookTrue ? "not equal to 0" : "0"); 1483226633Sdim else 1484226633Sdim return 0; 1485226633Sdim 1486234353Sdim const LocationContext *LCtx = N->getLocationContext(); 1487234353Sdim PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx); 1488234353Sdim PathDiagnosticEventPiece *event = 1489234353Sdim new PathDiagnosticEventPiece(Loc, Out.str()); 1490234353Sdim 1491234353Sdim const ProgramState *state = N->getState().getPtr(); 1492234353Sdim if (const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) { 1493234353Sdim if (report.isInteresting(R)) 1494234353Sdim event->setPrunable(false); 1495234353Sdim else { 1496234353Sdim SVal V = state->getSVal(R); 1497234353Sdim if (report.isInteresting(V)) 1498234353Sdim event->setPrunable(false); 1499234353Sdim } 1500234353Sdim } 1501234353Sdim return event; 1502226633Sdim} 1503234353Sdim 1504249423Sdim 1505249423Sdim// FIXME: Copied from ExprEngineCallAndReturn.cpp. 1506249423Sdimstatic bool isInStdNamespace(const Decl *D) { 1507249423Sdim const DeclContext *DC = D->getDeclContext()->getEnclosingNamespaceContext(); 1508249423Sdim const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(DC); 1509249423Sdim if (!ND) 1510249423Sdim return false; 1511249423Sdim 1512249423Sdim while (const NamespaceDecl *Parent = dyn_cast<NamespaceDecl>(ND->getParent())) 1513249423Sdim ND = Parent; 1514249423Sdim 1515249423Sdim return ND->getName() == "std"; 1516249423Sdim} 1517249423Sdim 1518249423Sdim 1519243830SdimPathDiagnosticPiece * 1520249423SdimLikelyFalsePositiveSuppressionBRVisitor::getEndPath(BugReporterContext &BRC, 1521249423Sdim const ExplodedNode *N, 1522249423Sdim BugReport &BR) { 1523249423Sdim // Here we suppress false positives coming from system headers. This list is 1524249423Sdim // based on known issues. 1525249423Sdim ExprEngine &Eng = BRC.getBugReporter().getEngine(); 1526249423Sdim AnalyzerOptions &Options = Eng.getAnalysisManager().options; 1527263508Sdim const Decl *D = N->getLocationContext()->getDecl(); 1528263508Sdim 1529263508Sdim if (isInStdNamespace(D)) { 1530263508Sdim // Skip reports within the 'std' namespace. Although these can sometimes be 1531263508Sdim // the user's fault, we currently don't report them very well, and 1532263508Sdim // Note that this will not help for any other data structure libraries, like 1533263508Sdim // TR1, Boost, or llvm/ADT. 1534263508Sdim if (Options.shouldSuppressFromCXXStandardLibrary()) { 1535249423Sdim BR.markInvalid(getTag(), 0); 1536249423Sdim return 0; 1537263508Sdim 1538263508Sdim } else { 1539263508Sdim // If the the complete 'std' suppression is not enabled, suppress reports 1540263508Sdim // from the 'std' namespace that are known to produce false positives. 1541263508Sdim 1542263508Sdim // The analyzer issues a false use-after-free when std::list::pop_front 1543263508Sdim // or std::list::pop_back are called multiple times because we cannot 1544263508Sdim // reason about the internal invariants of the datastructure. 1545263508Sdim if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(D)) { 1546263508Sdim const CXXRecordDecl *CD = MD->getParent(); 1547263508Sdim if (CD->getName() == "list") { 1548263508Sdim BR.markInvalid(getTag(), 0); 1549263508Sdim return 0; 1550263508Sdim } 1551263508Sdim } 1552263508Sdim 1553263508Sdim // The analyzer issues a false positive on 1554263508Sdim // std::basic_string<uint8_t> v; v.push_back(1); 1555263508Sdim // and 1556263508Sdim // std::u16string s; s += u'a'; 1557263508Sdim // because we cannot reason about the internal invariants of the 1558263508Sdim // datastructure. 1559263508Sdim const LocationContext *LCtx = N->getLocationContext(); 1560263508Sdim do { 1561263508Sdim const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(LCtx->getDecl()); 1562263508Sdim if (!MD) 1563263508Sdim break; 1564263508Sdim 1565263508Sdim const CXXRecordDecl *CD = MD->getParent(); 1566263508Sdim if (CD->getName() == "basic_string") { 1567263508Sdim BR.markInvalid(getTag(), 0); 1568263508Sdim return 0; 1569263508Sdim } else if (CD->getName().find("allocator") == StringRef::npos) { 1570263508Sdim // Only keep searching if the current method is in a class with the 1571263508Sdim // word "allocator" in its name, e.g. std::allocator or 1572263508Sdim // allocator_traits. 1573263508Sdim break; 1574263508Sdim } 1575263508Sdim 1576263508Sdim LCtx = LCtx->getParent(); 1577263508Sdim } while (LCtx); 1578249423Sdim } 1579249423Sdim } 1580249423Sdim 1581249423Sdim // Skip reports within the sys/queue.h macros as we do not have the ability to 1582249423Sdim // reason about data structure shapes. 1583249423Sdim SourceManager &SM = BRC.getSourceManager(); 1584249423Sdim FullSourceLoc Loc = BR.getLocation(SM).asLocation(); 1585249423Sdim while (Loc.isMacroID()) { 1586263508Sdim Loc = Loc.getSpellingLoc(); 1587263508Sdim if (SM.getFilename(Loc).endswith("sys/queue.h")) { 1588249423Sdim BR.markInvalid(getTag(), 0); 1589249423Sdim return 0; 1590249423Sdim } 1591249423Sdim } 1592249423Sdim 1593249423Sdim return 0; 1594249423Sdim} 1595249423Sdim 1596249423SdimPathDiagnosticPiece * 1597243830SdimUndefOrNullArgVisitor::VisitNode(const ExplodedNode *N, 1598243830Sdim const ExplodedNode *PrevN, 1599243830Sdim BugReporterContext &BRC, 1600243830Sdim BugReport &BR) { 1601243830Sdim 1602243830Sdim ProgramStateRef State = N->getState(); 1603243830Sdim ProgramPoint ProgLoc = N->getLocation(); 1604243830Sdim 1605243830Sdim // We are only interested in visiting CallEnter nodes. 1606249423Sdim Optional<CallEnter> CEnter = ProgLoc.getAs<CallEnter>(); 1607243830Sdim if (!CEnter) 1608243830Sdim return 0; 1609243830Sdim 1610243830Sdim // Check if one of the arguments is the region the visitor is tracking. 1611243830Sdim CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager(); 1612243830Sdim CallEventRef<> Call = CEMgr.getCaller(CEnter->getCalleeContext(), State); 1613243830Sdim unsigned Idx = 0; 1614243830Sdim for (CallEvent::param_iterator I = Call->param_begin(), 1615243830Sdim E = Call->param_end(); I != E; ++I, ++Idx) { 1616243830Sdim const MemRegion *ArgReg = Call->getArgSVal(Idx).getAsRegion(); 1617243830Sdim 1618243830Sdim // Are we tracking the argument or its subregion? 1619243830Sdim if ( !ArgReg || (ArgReg != R && !R->isSubRegionOf(ArgReg->StripCasts()))) 1620243830Sdim continue; 1621243830Sdim 1622243830Sdim // Check the function parameter type. 1623243830Sdim const ParmVarDecl *ParamDecl = *I; 1624243830Sdim assert(ParamDecl && "Formal parameter has no decl?"); 1625243830Sdim QualType T = ParamDecl->getType(); 1626243830Sdim 1627243830Sdim if (!(T->isAnyPointerType() || T->isReferenceType())) { 1628243830Sdim // Function can only change the value passed in by address. 1629243830Sdim continue; 1630243830Sdim } 1631243830Sdim 1632243830Sdim // If it is a const pointer value, the function does not intend to 1633243830Sdim // change the value. 1634243830Sdim if (T->getPointeeType().isConstQualified()) 1635243830Sdim continue; 1636243830Sdim 1637243830Sdim // Mark the call site (LocationContext) as interesting if the value of the 1638243830Sdim // argument is undefined or '0'/'NULL'. 1639243830Sdim SVal BoundVal = State->getSVal(R); 1640243830Sdim if (BoundVal.isUndef() || BoundVal.isZeroConstant()) { 1641243830Sdim BR.markInteresting(CEnter->getCalleeContext()); 1642243830Sdim return 0; 1643243830Sdim } 1644243830Sdim } 1645243830Sdim return 0; 1646243830Sdim} 1647