unittests/StaticAnalyzer/SValTest.cpp

//===- unittests/StaticAnalyzer/SvalTest.cpp ------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//

#include "CheckerRegistration.h"

#include "clang/AST/ASTContext.h"
#include "clang/AST/Decl.h"
#include "clang/AST/DeclGroup.h"
#include "clang/AST/RecursiveASTVisitor.h"
#include "clang/AST/Stmt.h"
#include "clang/AST/Type.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
#include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"
#include "clang/StaticAnalyzer/Frontend/CheckerRegistry.h"
#include "clang/Tooling/Tooling.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/raw_ostream.h"
#include "gtest/gtest.h"

namespace clang {

// getType() tests include whole bunch of type comparisons,
// so when something is wrong, it's good to have gtest telling us
// what are those types.
LLVM_ATTRIBUTE_UNUSED std::ostream &operator<<(std::ostream &OS,
                                               const QualType &T) {
  return OS << T.getAsString();
}

LLVM_ATTRIBUTE_UNUSED std::ostream &operator<<(std::ostream &OS,
                                               const CanQualType &T) {
  return OS << QualType{T};
}

namespace ento {
namespace {

//===----------------------------------------------------------------------===//
//                       Testing framework implementation
//===----------------------------------------------------------------------===//

/// A simple map from variable names to symbolic values used to init them.
using SVals = llvm::StringMap<SVal>;

/// SValCollector is the barebone of all tests.
///
/// It is implemented as a checker and reacts to binds, so we find
/// symbolic values of interest, and to end analysis, where we actually
/// can test whatever we gathered.
class SValCollector : public Checker<check::Bind, check::EndAnalysis> {
public:
  void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const {
    // Skip instantly if we finished testing.
    // Also, we care only for binds happening in variable initializations.
    if (Tested || !isa<DeclStmt>(S))
      return;

    if (const auto *VR = llvm::dyn_cast_or_null<VarRegion>(Loc.getAsRegion())) {
      CollectedSVals[VR->getDescriptiveName(false)] = Val;
    }
  }

  void checkEndAnalysis(ExplodedGraph &G, BugReporter &B,
                        ExprEngine &Engine) const {
    if (!Tested) {
      test(Engine, Engine.getContext());
      Tested = true;
      CollectedSVals.clear();
    }
  }

  /// Helper function for tests to access bound symbolic values.
  SVal getByName(StringRef Name) const { return CollectedSVals[Name]; }

private:
  /// Entry point for tests.
  virtual void test(ExprEngine &Engine, const ASTContext &Context) const = 0;

  mutable bool Tested = false;
  mutable SVals CollectedSVals;
};

// SVAL_TEST is a combined way of providing a short code snippet and
// to test some programmatic predicates on symbolic values produced by the
// engine for the actual code.
//
// Each test has a NAME.  One can think of it as a name for normal gtests.
//
// Each test should provide a CODE snippet.  Code snippets might contain any
// valid C/C++, but have ONLY ONE defined function.  There are no requirements
// about function's name or parameters.  It can even be a class method.  The
// body of the function must contain a set of variable declarations.  Each
// variable declaration gets bound to a symbolic value, so for the following
// example:
//
//     int x = <expr>;
//
// `x` will be bound to whatever symbolic value the engine produced for <expr>.
// LIVENESS and REASSIGNMENTS don't affect this binding.
//
// During the test the actual values can be accessed via `getByName` function,
// and, for the `x`-bound value, one must use "x" as its name.
//
// Example:
// SVAL_TEST(SimpleSValTest, R"(
// void foo() {
//   int x = 42;
// })") {
//   SVal X = getByName("x");
//   EXPECT_TRUE(X.isConstant(42));
// }
#define SVAL_TEST(NAME, CODE)                                                  \
  class NAME##SValCollector final : public SValCollector {                     \
  public:                                                                      \
    void test(ExprEngine &Engine, const ASTContext &Context) const override;   \
  };                                                                           \
                                                                               \
  void add##NAME##SValCollector(AnalysisASTConsumer &AnalysisConsumer,         \
                                AnalyzerOptions &AnOpts) {                     \
    AnOpts.CheckersAndPackages = {{"test.##NAME##SValCollector", true}};       \
    AnalysisConsumer.AddCheckerRegistrationFn([](CheckerRegistry &Registry) {  \
      Registry.addChecker<NAME##SValCollector>("test.##NAME##SValCollector",   \
                                               "Description", "");             \
    });                                                                        \
  }                                                                            \
                                                                               \
  TEST(SValTest, NAME) { runCheckerOnCode<add##NAME##SValCollector>(CODE); }   \
  void NAME##SValCollector::test(ExprEngine &Engine,                           \
                                 const ASTContext &Context) const

//===----------------------------------------------------------------------===//
//                                 Actual tests
//===----------------------------------------------------------------------===//

SVAL_TEST(GetConstType, R"(
void foo() {
  int x = 42;
  int *y = nullptr;
})") {
  SVal X = getByName("x");
  ASSERT_FALSE(X.getType(Context).isNull());
  EXPECT_EQ(Context.IntTy, X.getType(Context));

  SVal Y = getByName("y");
  ASSERT_FALSE(Y.getType(Context).isNull());
  EXPECT_EQ(Context.getUIntPtrType(), Y.getType(Context));
}

SVAL_TEST(GetLocAsIntType, R"(
void foo(int *x) {
  long int a = (long int)x;
  unsigned b = (long unsigned)&a;
  int c = (long int)nullptr;
})") {
  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  // TODO: Turn it into signed long
  EXPECT_EQ(Context.getUIntPtrType(), A.getType(Context));

  SVal B = getByName("b");
  ASSERT_FALSE(B.getType(Context).isNull());
  EXPECT_EQ(Context.UnsignedIntTy, B.getType(Context));

  SVal C = getByName("c");
  ASSERT_FALSE(C.getType(Context).isNull());
  EXPECT_EQ(Context.IntTy, C.getType(Context));
}

SVAL_TEST(GetSymExprType, R"(
void foo(int a, int b) {
  int x = a;
  int y = a + b;
  long z = a;
})") {
  QualType Int = Context.IntTy;

  SVal X = getByName("x");
  ASSERT_FALSE(X.getType(Context).isNull());
  EXPECT_EQ(Int, X.getType(Context));

  SVal Y = getByName("y");
  ASSERT_FALSE(Y.getType(Context).isNull());
  EXPECT_EQ(Int, Y.getType(Context));

  // TODO: Change to Long when we support symbolic casts
  SVal Z = getByName("z");
  ASSERT_FALSE(Z.getType(Context).isNull());
  EXPECT_EQ(Int, Z.getType(Context));
}

SVAL_TEST(GetPointerType, R"(
int *bar();
int &foobar();
struct Z {
  int a;
  int *b;
};
void foo(int x, int *y, Z z) {
  int &a = x;
  int &b = *y;
  int &c = *bar();
  int &d = foobar();
  int &e = z.a;
  int &f = *z.b;
})") {
  QualType Int = Context.IntTy;

  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  const auto *APtrTy = dyn_cast<PointerType>(A.getType(Context));
  ASSERT_NE(APtrTy, nullptr);
  EXPECT_EQ(Int, APtrTy->getPointeeType());

  SVal B = getByName("b");
  ASSERT_FALSE(B.getType(Context).isNull());
  const auto *BPtrTy = dyn_cast<PointerType>(B.getType(Context));
  ASSERT_NE(BPtrTy, nullptr);
  EXPECT_EQ(Int, BPtrTy->getPointeeType());

  SVal C = getByName("c");
  ASSERT_FALSE(C.getType(Context).isNull());
  const auto *CPtrTy = dyn_cast<PointerType>(C.getType(Context));
  ASSERT_NE(CPtrTy, nullptr);
  EXPECT_EQ(Int, CPtrTy->getPointeeType());

  SVal D = getByName("d");
  ASSERT_FALSE(D.getType(Context).isNull());
  const auto *DRefTy = dyn_cast<LValueReferenceType>(D.getType(Context));
  ASSERT_NE(DRefTy, nullptr);
  EXPECT_EQ(Int, DRefTy->getPointeeType());

  SVal E = getByName("e");
  ASSERT_FALSE(E.getType(Context).isNull());
  const auto *EPtrTy = dyn_cast<PointerType>(E.getType(Context));
  ASSERT_NE(EPtrTy, nullptr);
  EXPECT_EQ(Int, EPtrTy->getPointeeType());

  SVal F = getByName("f");
  ASSERT_FALSE(F.getType(Context).isNull());
  const auto *FPtrTy = dyn_cast<PointerType>(F.getType(Context));
  ASSERT_NE(FPtrTy, nullptr);
  EXPECT_EQ(Int, FPtrTy->getPointeeType());
}

SVAL_TEST(GetCompoundType, R"(
struct TestStruct {
  int a, b;
};
union TestUnion {
  int a;
  float b;
  TestStruct c;
};
void foo(int x) {
  int a[] = {1, x, 2};
  TestStruct b = {x, 42};
  TestUnion c = {42};
  TestUnion d = {.c=b};
}
)") {
  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  const auto *AArrayType = dyn_cast<ArrayType>(A.getType(Context));
  ASSERT_NE(AArrayType, nullptr);
  EXPECT_EQ(Context.IntTy, AArrayType->getElementType());

  SVal B = getByName("b");
  ASSERT_FALSE(B.getType(Context).isNull());
  const auto *BRecordType = dyn_cast<RecordType>(B.getType(Context));
  ASSERT_NE(BRecordType, nullptr);
  EXPECT_EQ("TestStruct", BRecordType->getDecl()->getName());

  SVal C = getByName("c");
  ASSERT_FALSE(C.getType(Context).isNull());
  const auto *CRecordType = dyn_cast<RecordType>(C.getType(Context));
  ASSERT_NE(CRecordType, nullptr);
  EXPECT_EQ("TestUnion", CRecordType->getDecl()->getName());

  auto D = getByName("d").getAs<nonloc::CompoundVal>();
  ASSERT_TRUE(D.hasValue());
  auto Begin = D->begin();
  ASSERT_NE(D->end(), Begin);
  ++Begin;
  ASSERT_EQ(D->end(), Begin);
  auto LD = D->begin()->getAs<nonloc::LazyCompoundVal>();
  ASSERT_TRUE(LD.hasValue());
  auto LDT = LD->getType(Context);
  ASSERT_FALSE(LDT.isNull());
  const auto *DRecordType = dyn_cast<RecordType>(LDT);
  ASSERT_NE(DRecordType, nullptr);
  EXPECT_EQ("TestStruct", DRecordType->getDecl()->getName());
}

SVAL_TEST(GetStringType, R"(
void foo() {
  const char *a = "Hello, world!";
}
)") {
  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  const auto *APtrTy = dyn_cast<PointerType>(A.getType(Context));
  ASSERT_NE(APtrTy, nullptr);
  EXPECT_EQ(Context.CharTy, APtrTy->getPointeeType());
}

SVAL_TEST(GetThisType, R"(
class TestClass {
  void foo();
};
void TestClass::foo() {
  const auto *a = this;
}
)") {
  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  const auto *APtrTy = dyn_cast<PointerType>(A.getType(Context));
  ASSERT_NE(APtrTy, nullptr);
  const auto *ARecordType = dyn_cast<RecordType>(APtrTy->getPointeeType());
  ASSERT_NE(ARecordType, nullptr);
  EXPECT_EQ("TestClass", ARecordType->getDecl()->getName());
}

SVAL_TEST(GetFunctionPtrType, R"(
void bar();
void foo() {
  auto *a = &bar;
}
)") {
  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  const auto *APtrTy = dyn_cast<PointerType>(A.getType(Context));
  ASSERT_NE(APtrTy, nullptr);
  ASSERT_TRUE(isa<FunctionProtoType>(APtrTy->getPointeeType()));
}

SVAL_TEST(GetLabelType, R"(
void foo() {
  entry:
  void *a = &&entry;
  char *b = (char *)&&entry;
}
)") {
  SVal A = getByName("a");
  ASSERT_FALSE(A.getType(Context).isNull());
  EXPECT_EQ(Context.VoidPtrTy, A.getType(Context));

  SVal B = getByName("a");
  ASSERT_FALSE(B.getType(Context).isNull());
  // TODO: Change to CharTy when we support symbolic casts
  EXPECT_EQ(Context.VoidPtrTy, B.getType(Context));
}

} // namespace
} // namespace ento
} // namespace clang