1f4a2713aSLionel Sambuc //=== NoReturnFunctionChecker.cpp -------------------------------*- C++ -*-===//
2f4a2713aSLionel Sambuc //
3f4a2713aSLionel Sambuc // The LLVM Compiler Infrastructure
4f4a2713aSLionel Sambuc //
5f4a2713aSLionel Sambuc // This file is distributed under the University of Illinois Open Source
6f4a2713aSLionel Sambuc // License. See LICENSE.TXT for details.
7f4a2713aSLionel Sambuc //
8f4a2713aSLionel Sambuc //===----------------------------------------------------------------------===//
9f4a2713aSLionel Sambuc //
10f4a2713aSLionel Sambuc // This defines NoReturnFunctionChecker, which evaluates functions that do not
11f4a2713aSLionel Sambuc // return to the caller.
12f4a2713aSLionel Sambuc //
13f4a2713aSLionel Sambuc //===----------------------------------------------------------------------===//
14f4a2713aSLionel Sambuc
15f4a2713aSLionel Sambuc #include "ClangSACheckers.h"
16*0a6a1f1dSLionel Sambuc #include "SelectorExtras.h"
17f4a2713aSLionel Sambuc #include "clang/AST/Attr.h"
18f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/Checker.h"
19f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/CheckerManager.h"
20f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
21f4a2713aSLionel Sambuc #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
22f4a2713aSLionel Sambuc #include "llvm/ADT/StringSwitch.h"
23f4a2713aSLionel Sambuc #include <cstdarg>
24f4a2713aSLionel Sambuc
25f4a2713aSLionel Sambuc using namespace clang;
26f4a2713aSLionel Sambuc using namespace ento;
27f4a2713aSLionel Sambuc
28f4a2713aSLionel Sambuc namespace {
29f4a2713aSLionel Sambuc
30f4a2713aSLionel Sambuc class NoReturnFunctionChecker : public Checker< check::PostCall,
31f4a2713aSLionel Sambuc check::PostObjCMessage > {
32*0a6a1f1dSLionel Sambuc mutable Selector HandleFailureInFunctionSel;
33*0a6a1f1dSLionel Sambuc mutable Selector HandleFailureInMethodSel;
34f4a2713aSLionel Sambuc public:
35f4a2713aSLionel Sambuc void checkPostCall(const CallEvent &CE, CheckerContext &C) const;
36f4a2713aSLionel Sambuc void checkPostObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
37f4a2713aSLionel Sambuc };
38f4a2713aSLionel Sambuc
39f4a2713aSLionel Sambuc }
40f4a2713aSLionel Sambuc
checkPostCall(const CallEvent & CE,CheckerContext & C) const41f4a2713aSLionel Sambuc void NoReturnFunctionChecker::checkPostCall(const CallEvent &CE,
42f4a2713aSLionel Sambuc CheckerContext &C) const {
43f4a2713aSLionel Sambuc bool BuildSinks = false;
44f4a2713aSLionel Sambuc
45f4a2713aSLionel Sambuc if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(CE.getDecl()))
46*0a6a1f1dSLionel Sambuc BuildSinks = FD->hasAttr<AnalyzerNoReturnAttr>() || FD->isNoReturn();
47f4a2713aSLionel Sambuc
48f4a2713aSLionel Sambuc const Expr *Callee = CE.getOriginExpr();
49f4a2713aSLionel Sambuc if (!BuildSinks && Callee)
50f4a2713aSLionel Sambuc BuildSinks = getFunctionExtInfo(Callee->getType()).getNoReturn();
51f4a2713aSLionel Sambuc
52f4a2713aSLionel Sambuc if (!BuildSinks && CE.isGlobalCFunction()) {
53f4a2713aSLionel Sambuc if (const IdentifierInfo *II = CE.getCalleeIdentifier()) {
54f4a2713aSLionel Sambuc // HACK: Some functions are not marked noreturn, and don't return.
55f4a2713aSLionel Sambuc // Here are a few hardwired ones. If this takes too long, we can
56f4a2713aSLionel Sambuc // potentially cache these results.
57f4a2713aSLionel Sambuc BuildSinks
58f4a2713aSLionel Sambuc = llvm::StringSwitch<bool>(StringRef(II->getName()))
59f4a2713aSLionel Sambuc .Case("exit", true)
60f4a2713aSLionel Sambuc .Case("panic", true)
61f4a2713aSLionel Sambuc .Case("error", true)
62f4a2713aSLionel Sambuc .Case("Assert", true)
63f4a2713aSLionel Sambuc // FIXME: This is just a wrapper around throwing an exception.
64f4a2713aSLionel Sambuc // Eventually inter-procedural analysis should handle this easily.
65f4a2713aSLionel Sambuc .Case("ziperr", true)
66f4a2713aSLionel Sambuc .Case("assfail", true)
67f4a2713aSLionel Sambuc .Case("db_error", true)
68f4a2713aSLionel Sambuc .Case("__assert", true)
69f4a2713aSLionel Sambuc // For the purpose of static analysis, we do not care that
70f4a2713aSLionel Sambuc // this MSVC function will return if the user decides to continue.
71f4a2713aSLionel Sambuc .Case("_wassert", true)
72f4a2713aSLionel Sambuc .Case("__assert_rtn", true)
73f4a2713aSLionel Sambuc .Case("__assert_fail", true)
74f4a2713aSLionel Sambuc .Case("dtrace_assfail", true)
75f4a2713aSLionel Sambuc .Case("yy_fatal_error", true)
76f4a2713aSLionel Sambuc .Case("_XCAssertionFailureHandler", true)
77f4a2713aSLionel Sambuc .Case("_DTAssertionFailureHandler", true)
78f4a2713aSLionel Sambuc .Case("_TSAssertionFailureHandler", true)
79f4a2713aSLionel Sambuc .Default(false);
80f4a2713aSLionel Sambuc }
81f4a2713aSLionel Sambuc }
82f4a2713aSLionel Sambuc
83f4a2713aSLionel Sambuc if (BuildSinks)
84f4a2713aSLionel Sambuc C.generateSink();
85f4a2713aSLionel Sambuc }
86f4a2713aSLionel Sambuc
checkPostObjCMessage(const ObjCMethodCall & Msg,CheckerContext & C) const87f4a2713aSLionel Sambuc void NoReturnFunctionChecker::checkPostObjCMessage(const ObjCMethodCall &Msg,
88f4a2713aSLionel Sambuc CheckerContext &C) const {
89f4a2713aSLionel Sambuc // Check if the method is annotated with analyzer_noreturn.
90f4a2713aSLionel Sambuc if (const ObjCMethodDecl *MD = Msg.getDecl()) {
91f4a2713aSLionel Sambuc MD = MD->getCanonicalDecl();
92f4a2713aSLionel Sambuc if (MD->hasAttr<AnalyzerNoReturnAttr>()) {
93f4a2713aSLionel Sambuc C.generateSink();
94f4a2713aSLionel Sambuc return;
95f4a2713aSLionel Sambuc }
96f4a2713aSLionel Sambuc }
97f4a2713aSLionel Sambuc
98f4a2713aSLionel Sambuc // HACK: This entire check is to handle two messages in the Cocoa frameworks:
99f4a2713aSLionel Sambuc // -[NSAssertionHandler
100f4a2713aSLionel Sambuc // handleFailureInMethod:object:file:lineNumber:description:]
101f4a2713aSLionel Sambuc // -[NSAssertionHandler
102f4a2713aSLionel Sambuc // handleFailureInFunction:file:lineNumber:description:]
103f4a2713aSLionel Sambuc // Eventually these should be annotated with __attribute__((noreturn)).
104f4a2713aSLionel Sambuc // Because ObjC messages use dynamic dispatch, it is not generally safe to
105f4a2713aSLionel Sambuc // assume certain methods can't return. In cases where it is definitely valid,
106f4a2713aSLionel Sambuc // see if you can mark the methods noreturn or analyzer_noreturn instead of
107f4a2713aSLionel Sambuc // adding more explicit checks to this method.
108f4a2713aSLionel Sambuc
109f4a2713aSLionel Sambuc if (!Msg.isInstanceMessage())
110f4a2713aSLionel Sambuc return;
111f4a2713aSLionel Sambuc
112f4a2713aSLionel Sambuc const ObjCInterfaceDecl *Receiver = Msg.getReceiverInterface();
113f4a2713aSLionel Sambuc if (!Receiver)
114f4a2713aSLionel Sambuc return;
115f4a2713aSLionel Sambuc if (!Receiver->getIdentifier()->isStr("NSAssertionHandler"))
116f4a2713aSLionel Sambuc return;
117f4a2713aSLionel Sambuc
118f4a2713aSLionel Sambuc Selector Sel = Msg.getSelector();
119f4a2713aSLionel Sambuc switch (Sel.getNumArgs()) {
120f4a2713aSLionel Sambuc default:
121f4a2713aSLionel Sambuc return;
122f4a2713aSLionel Sambuc case 4:
123*0a6a1f1dSLionel Sambuc lazyInitKeywordSelector(HandleFailureInFunctionSel, C.getASTContext(),
124*0a6a1f1dSLionel Sambuc "handleFailureInFunction", "file", "lineNumber",
125*0a6a1f1dSLionel Sambuc "description", nullptr);
126*0a6a1f1dSLionel Sambuc if (Sel != HandleFailureInFunctionSel)
127f4a2713aSLionel Sambuc return;
128f4a2713aSLionel Sambuc break;
129f4a2713aSLionel Sambuc case 5:
130*0a6a1f1dSLionel Sambuc lazyInitKeywordSelector(HandleFailureInMethodSel, C.getASTContext(),
131*0a6a1f1dSLionel Sambuc "handleFailureInMethod", "object", "file",
132*0a6a1f1dSLionel Sambuc "lineNumber", "description", nullptr);
133*0a6a1f1dSLionel Sambuc if (Sel != HandleFailureInMethodSel)
134f4a2713aSLionel Sambuc return;
135f4a2713aSLionel Sambuc break;
136f4a2713aSLionel Sambuc }
137f4a2713aSLionel Sambuc
138f4a2713aSLionel Sambuc // If we got here, it's one of the messages we care about.
139f4a2713aSLionel Sambuc C.generateSink();
140f4a2713aSLionel Sambuc }
141f4a2713aSLionel Sambuc
registerNoReturnFunctionChecker(CheckerManager & mgr)142f4a2713aSLionel Sambuc void ento::registerNoReturnFunctionChecker(CheckerManager &mgr) {
143f4a2713aSLionel Sambuc mgr.registerChecker<NoReturnFunctionChecker>();
144f4a2713aSLionel Sambuc }
145