1 //===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements uninitialized values analysis for source-level CFGs.
10 //
11 //===----------------------------------------------------------------------===//
12
13 #include "clang/Analysis/Analyses/UninitializedValues.h"
14 #include "clang/AST/Attr.h"
15 #include "clang/AST/Decl.h"
16 #include "clang/AST/DeclBase.h"
17 #include "clang/AST/Expr.h"
18 #include "clang/AST/OperationKinds.h"
19 #include "clang/AST/Stmt.h"
20 #include "clang/AST/StmtObjC.h"
21 #include "clang/AST/StmtVisitor.h"
22 #include "clang/AST/Type.h"
23 #include "clang/Analysis/Analyses/PostOrderCFGView.h"
24 #include "clang/Analysis/AnalysisDeclContext.h"
25 #include "clang/Analysis/CFG.h"
26 #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
27 #include "clang/Basic/LLVM.h"
28 #include "llvm/ADT/BitVector.h"
29 #include "llvm/ADT/DenseMap.h"
30 #include "llvm/ADT/None.h"
31 #include "llvm/ADT/Optional.h"
32 #include "llvm/ADT/PackedVector.h"
33 #include "llvm/ADT/SmallBitVector.h"
34 #include "llvm/ADT/SmallVector.h"
35 #include "llvm/Support/Casting.h"
36 #include <algorithm>
37 #include <cassert>
38
39 using namespace clang;
40
41 #define DEBUG_LOGGING 0
42
isTrackedVar(const VarDecl * vd,const DeclContext * dc)43 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
44 if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
45 !vd->isExceptionVariable() && !vd->isInitCapture() &&
46 !vd->isImplicit() && vd->getDeclContext() == dc) {
47 QualType ty = vd->getType();
48 return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
49 }
50 return false;
51 }
52
53 //------------------------------------------------------------------------====//
54 // DeclToIndex: a mapping from Decls we track to value indices.
55 //====------------------------------------------------------------------------//
56
57 namespace {
58
59 class DeclToIndex {
60 llvm::DenseMap<const VarDecl *, unsigned> map;
61
62 public:
63 DeclToIndex() = default;
64
65 /// Compute the actual mapping from declarations to bits.
66 void computeMap(const DeclContext &dc);
67
68 /// Return the number of declarations in the map.
size() const69 unsigned size() const { return map.size(); }
70
71 /// Returns the bit vector index for a given declaration.
72 Optional<unsigned> getValueIndex(const VarDecl *d) const;
73 };
74
75 } // namespace
76
computeMap(const DeclContext & dc)77 void DeclToIndex::computeMap(const DeclContext &dc) {
78 unsigned count = 0;
79 DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
80 E(dc.decls_end());
81 for ( ; I != E; ++I) {
82 const VarDecl *vd = *I;
83 if (isTrackedVar(vd, &dc))
84 map[vd] = count++;
85 }
86 }
87
getValueIndex(const VarDecl * d) const88 Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
89 llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
90 if (I == map.end())
91 return None;
92 return I->second;
93 }
94
95 //------------------------------------------------------------------------====//
96 // CFGBlockValues: dataflow values for CFG blocks.
97 //====------------------------------------------------------------------------//
98
99 // These values are defined in such a way that a merge can be done using
100 // a bitwise OR.
101 enum Value { Unknown = 0x0, /* 00 */
102 Initialized = 0x1, /* 01 */
103 Uninitialized = 0x2, /* 10 */
104 MayUninitialized = 0x3 /* 11 */ };
105
isUninitialized(const Value v)106 static bool isUninitialized(const Value v) {
107 return v >= Uninitialized;
108 }
109
isAlwaysUninit(const Value v)110 static bool isAlwaysUninit(const Value v) {
111 return v == Uninitialized;
112 }
113
114 namespace {
115
116 using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
117
118 class CFGBlockValues {
119 const CFG &cfg;
120 SmallVector<ValueVector, 8> vals;
121 ValueVector scratch;
122 DeclToIndex declToIndex;
123
124 public:
125 CFGBlockValues(const CFG &cfg);
126
getNumEntries() const127 unsigned getNumEntries() const { return declToIndex.size(); }
128
129 void computeSetOfDeclarations(const DeclContext &dc);
130
getValueVector(const CFGBlock * block)131 ValueVector &getValueVector(const CFGBlock *block) {
132 return vals[block->getBlockID()];
133 }
134
135 void setAllScratchValues(Value V);
136 void mergeIntoScratch(ValueVector const &source, bool isFirst);
137 bool updateValueVectorWithScratch(const CFGBlock *block);
138
hasNoDeclarations() const139 bool hasNoDeclarations() const {
140 return declToIndex.size() == 0;
141 }
142
143 void resetScratch();
144
145 ValueVector::reference operator[](const VarDecl *vd);
146
getValue(const CFGBlock * block,const CFGBlock * dstBlock,const VarDecl * vd)147 Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
148 const VarDecl *vd) {
149 const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
150 assert(idx.hasValue());
151 return getValueVector(block)[idx.getValue()];
152 }
153 };
154
155 } // namespace
156
CFGBlockValues(const CFG & c)157 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
158
computeSetOfDeclarations(const DeclContext & dc)159 void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
160 declToIndex.computeMap(dc);
161 unsigned decls = declToIndex.size();
162 scratch.resize(decls);
163 unsigned n = cfg.getNumBlockIDs();
164 if (!n)
165 return;
166 vals.resize(n);
167 for (auto &val : vals)
168 val.resize(decls);
169 }
170
171 #if DEBUG_LOGGING
printVector(const CFGBlock * block,ValueVector & bv,unsigned num)172 static void printVector(const CFGBlock *block, ValueVector &bv,
173 unsigned num) {
174 llvm::errs() << block->getBlockID() << " :";
175 for (const auto &i : bv)
176 llvm::errs() << ' ' << i;
177 llvm::errs() << " : " << num << '\n';
178 }
179 #endif
180
setAllScratchValues(Value V)181 void CFGBlockValues::setAllScratchValues(Value V) {
182 for (unsigned I = 0, E = scratch.size(); I != E; ++I)
183 scratch[I] = V;
184 }
185
mergeIntoScratch(ValueVector const & source,bool isFirst)186 void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
187 bool isFirst) {
188 if (isFirst)
189 scratch = source;
190 else
191 scratch |= source;
192 }
193
updateValueVectorWithScratch(const CFGBlock * block)194 bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
195 ValueVector &dst = getValueVector(block);
196 bool changed = (dst != scratch);
197 if (changed)
198 dst = scratch;
199 #if DEBUG_LOGGING
200 printVector(block, scratch, 0);
201 #endif
202 return changed;
203 }
204
resetScratch()205 void CFGBlockValues::resetScratch() {
206 scratch.reset();
207 }
208
operator [](const VarDecl * vd)209 ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
210 const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
211 assert(idx.hasValue());
212 return scratch[idx.getValue()];
213 }
214
215 //------------------------------------------------------------------------====//
216 // Worklist: worklist for dataflow analysis.
217 //====------------------------------------------------------------------------//
218
219 namespace {
220
221 class DataflowWorklist {
222 PostOrderCFGView::iterator PO_I, PO_E;
223 SmallVector<const CFGBlock *, 20> worklist;
224 llvm::BitVector enqueuedBlocks;
225
226 public:
DataflowWorklist(const CFG & cfg,PostOrderCFGView & view)227 DataflowWorklist(const CFG &cfg, PostOrderCFGView &view)
228 : PO_I(view.begin()), PO_E(view.end()),
229 enqueuedBlocks(cfg.getNumBlockIDs(), true) {
230 // Treat the first block as already analyzed.
231 if (PO_I != PO_E) {
232 assert(*PO_I == &cfg.getEntry());
233 enqueuedBlocks[(*PO_I)->getBlockID()] = false;
234 ++PO_I;
235 }
236 }
237
238 void enqueueSuccessors(const CFGBlock *block);
239 const CFGBlock *dequeue();
240 };
241
242 } // namespace
243
enqueueSuccessors(const CFGBlock * block)244 void DataflowWorklist::enqueueSuccessors(const CFGBlock *block) {
245 for (CFGBlock::const_succ_iterator I = block->succ_begin(),
246 E = block->succ_end(); I != E; ++I) {
247 const CFGBlock *Successor = *I;
248 if (!Successor || enqueuedBlocks[Successor->getBlockID()])
249 continue;
250 worklist.push_back(Successor);
251 enqueuedBlocks[Successor->getBlockID()] = true;
252 }
253 }
254
dequeue()255 const CFGBlock *DataflowWorklist::dequeue() {
256 const CFGBlock *B = nullptr;
257
258 // First dequeue from the worklist. This can represent
259 // updates along backedges that we want propagated as quickly as possible.
260 if (!worklist.empty())
261 B = worklist.pop_back_val();
262
263 // Next dequeue from the initial reverse post order. This is the
264 // theoretical ideal in the presence of no back edges.
265 else if (PO_I != PO_E) {
266 B = *PO_I;
267 ++PO_I;
268 }
269 else
270 return nullptr;
271
272 assert(enqueuedBlocks[B->getBlockID()] == true);
273 enqueuedBlocks[B->getBlockID()] = false;
274 return B;
275 }
276
277 //------------------------------------------------------------------------====//
278 // Classification of DeclRefExprs as use or initialization.
279 //====------------------------------------------------------------------------//
280
281 namespace {
282
283 class FindVarResult {
284 const VarDecl *vd;
285 const DeclRefExpr *dr;
286
287 public:
FindVarResult(const VarDecl * vd,const DeclRefExpr * dr)288 FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
289
getDeclRefExpr() const290 const DeclRefExpr *getDeclRefExpr() const { return dr; }
getDecl() const291 const VarDecl *getDecl() const { return vd; }
292 };
293
294 } // namespace
295
stripCasts(ASTContext & C,const Expr * Ex)296 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
297 while (Ex) {
298 Ex = Ex->IgnoreParenNoopCasts(C);
299 if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
300 if (CE->getCastKind() == CK_LValueBitCast) {
301 Ex = CE->getSubExpr();
302 continue;
303 }
304 }
305 break;
306 }
307 return Ex;
308 }
309
310 /// If E is an expression comprising a reference to a single variable, find that
311 /// variable.
findVar(const Expr * E,const DeclContext * DC)312 static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
313 if (const auto *DRE =
314 dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
315 if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
316 if (isTrackedVar(VD, DC))
317 return FindVarResult(VD, DRE);
318 return FindVarResult(nullptr, nullptr);
319 }
320
321 namespace {
322
323 /// Classify each DeclRefExpr as an initialization or a use. Any
324 /// DeclRefExpr which isn't explicitly classified will be assumed to have
325 /// escaped the analysis and will be treated as an initialization.
326 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
327 public:
328 enum Class {
329 Init,
330 Use,
331 SelfInit,
332 Ignore
333 };
334
335 private:
336 const DeclContext *DC;
337 llvm::DenseMap<const DeclRefExpr *, Class> Classification;
338
isTrackedVar(const VarDecl * VD) const339 bool isTrackedVar(const VarDecl *VD) const {
340 return ::isTrackedVar(VD, DC);
341 }
342
343 void classify(const Expr *E, Class C);
344
345 public:
ClassifyRefs(AnalysisDeclContext & AC)346 ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
347
348 void VisitDeclStmt(DeclStmt *DS);
349 void VisitUnaryOperator(UnaryOperator *UO);
350 void VisitBinaryOperator(BinaryOperator *BO);
351 void VisitCallExpr(CallExpr *CE);
352 void VisitCastExpr(CastExpr *CE);
353 void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
354
operator ()(Stmt * S)355 void operator()(Stmt *S) { Visit(S); }
356
get(const DeclRefExpr * DRE) const357 Class get(const DeclRefExpr *DRE) const {
358 llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
359 = Classification.find(DRE);
360 if (I != Classification.end())
361 return I->second;
362
363 const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
364 if (!VD || !isTrackedVar(VD))
365 return Ignore;
366
367 return Init;
368 }
369 };
370
371 } // namespace
372
getSelfInitExpr(VarDecl * VD)373 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
374 if (VD->getType()->isRecordType())
375 return nullptr;
376 if (Expr *Init = VD->getInit()) {
377 const auto *DRE =
378 dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
379 if (DRE && DRE->getDecl() == VD)
380 return DRE;
381 }
382 return nullptr;
383 }
384
classify(const Expr * E,Class C)385 void ClassifyRefs::classify(const Expr *E, Class C) {
386 // The result of a ?: could also be an lvalue.
387 E = E->IgnoreParens();
388 if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
389 classify(CO->getTrueExpr(), C);
390 classify(CO->getFalseExpr(), C);
391 return;
392 }
393
394 if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
395 classify(BCO->getFalseExpr(), C);
396 return;
397 }
398
399 if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
400 classify(OVE->getSourceExpr(), C);
401 return;
402 }
403
404 if (const auto *ME = dyn_cast<MemberExpr>(E)) {
405 if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
406 if (!VD->isStaticDataMember())
407 classify(ME->getBase(), C);
408 }
409 return;
410 }
411
412 if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
413 switch (BO->getOpcode()) {
414 case BO_PtrMemD:
415 case BO_PtrMemI:
416 classify(BO->getLHS(), C);
417 return;
418 case BO_Comma:
419 classify(BO->getRHS(), C);
420 return;
421 default:
422 return;
423 }
424 }
425
426 FindVarResult Var = findVar(E, DC);
427 if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
428 Classification[DRE] = std::max(Classification[DRE], C);
429 }
430
VisitDeclStmt(DeclStmt * DS)431 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
432 for (auto *DI : DS->decls()) {
433 auto *VD = dyn_cast<VarDecl>(DI);
434 if (VD && isTrackedVar(VD))
435 if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
436 Classification[DRE] = SelfInit;
437 }
438 }
439
VisitBinaryOperator(BinaryOperator * BO)440 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
441 // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
442 // is not a compound-assignment, we will treat it as initializing the variable
443 // when TransferFunctions visits it. A compound-assignment does not affect
444 // whether a variable is uninitialized, and there's no point counting it as a
445 // use.
446 if (BO->isCompoundAssignmentOp())
447 classify(BO->getLHS(), Use);
448 else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
449 classify(BO->getLHS(), Ignore);
450 }
451
VisitUnaryOperator(UnaryOperator * UO)452 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
453 // Increment and decrement are uses despite there being no lvalue-to-rvalue
454 // conversion.
455 if (UO->isIncrementDecrementOp())
456 classify(UO->getSubExpr(), Use);
457 }
458
VisitOMPExecutableDirective(OMPExecutableDirective * ED)459 void ClassifyRefs::VisitOMPExecutableDirective(OMPExecutableDirective *ED) {
460 for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses()))
461 classify(cast<Expr>(S), Use);
462 }
463
isPointerToConst(const QualType & QT)464 static bool isPointerToConst(const QualType &QT) {
465 return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
466 }
467
VisitCallExpr(CallExpr * CE)468 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
469 // Classify arguments to std::move as used.
470 if (CE->isCallToStdMove()) {
471 // RecordTypes are handled in SemaDeclCXX.cpp.
472 if (!CE->getArg(0)->getType()->isRecordType())
473 classify(CE->getArg(0), Use);
474 return;
475 }
476
477 // If a value is passed by const pointer or by const reference to a function,
478 // we should not assume that it is initialized by the call, and we
479 // conservatively do not assume that it is used.
480 for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
481 I != E; ++I) {
482 if ((*I)->isGLValue()) {
483 if ((*I)->getType().isConstQualified())
484 classify((*I), Ignore);
485 } else if (isPointerToConst((*I)->getType())) {
486 const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
487 const auto *UO = dyn_cast<UnaryOperator>(Ex);
488 if (UO && UO->getOpcode() == UO_AddrOf)
489 Ex = UO->getSubExpr();
490 classify(Ex, Ignore);
491 }
492 }
493 }
494
VisitCastExpr(CastExpr * CE)495 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
496 if (CE->getCastKind() == CK_LValueToRValue)
497 classify(CE->getSubExpr(), Use);
498 else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
499 if (CSE->getType()->isVoidType()) {
500 // Squelch any detected load of an uninitialized value if
501 // we cast it to void.
502 // e.g. (void) x;
503 classify(CSE->getSubExpr(), Ignore);
504 }
505 }
506 }
507
508 //------------------------------------------------------------------------====//
509 // Transfer function for uninitialized values analysis.
510 //====------------------------------------------------------------------------//
511
512 namespace {
513
514 class TransferFunctions : public StmtVisitor<TransferFunctions> {
515 CFGBlockValues &vals;
516 const CFG &cfg;
517 const CFGBlock *block;
518 AnalysisDeclContext ∾
519 const ClassifyRefs &classification;
520 ObjCNoReturn objCNoRet;
521 UninitVariablesHandler &handler;
522
523 public:
TransferFunctions(CFGBlockValues & vals,const CFG & cfg,const CFGBlock * block,AnalysisDeclContext & ac,const ClassifyRefs & classification,UninitVariablesHandler & handler)524 TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
525 const CFGBlock *block, AnalysisDeclContext &ac,
526 const ClassifyRefs &classification,
527 UninitVariablesHandler &handler)
528 : vals(vals), cfg(cfg), block(block), ac(ac),
529 classification(classification), objCNoRet(ac.getASTContext()),
530 handler(handler) {}
531
532 void reportUse(const Expr *ex, const VarDecl *vd);
533
534 void VisitBinaryOperator(BinaryOperator *bo);
535 void VisitBlockExpr(BlockExpr *be);
536 void VisitCallExpr(CallExpr *ce);
537 void VisitDeclRefExpr(DeclRefExpr *dr);
538 void VisitDeclStmt(DeclStmt *ds);
539 void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
540 void VisitObjCMessageExpr(ObjCMessageExpr *ME);
541 void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
542
isTrackedVar(const VarDecl * vd)543 bool isTrackedVar(const VarDecl *vd) {
544 return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
545 }
546
findVar(const Expr * ex)547 FindVarResult findVar(const Expr *ex) {
548 return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
549 }
550
getUninitUse(const Expr * ex,const VarDecl * vd,Value v)551 UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
552 UninitUse Use(ex, isAlwaysUninit(v));
553
554 assert(isUninitialized(v));
555 if (Use.getKind() == UninitUse::Always)
556 return Use;
557
558 // If an edge which leads unconditionally to this use did not initialize
559 // the variable, we can say something stronger than 'may be uninitialized':
560 // we can say 'either it's used uninitialized or you have dead code'.
561 //
562 // We track the number of successors of a node which have been visited, and
563 // visit a node once we have visited all of its successors. Only edges where
564 // the variable might still be uninitialized are followed. Since a variable
565 // can't transfer from being initialized to being uninitialized, this will
566 // trace out the subgraph which inevitably leads to the use and does not
567 // initialize the variable. We do not want to skip past loops, since their
568 // non-termination might be correlated with the initialization condition.
569 //
570 // For example:
571 //
572 // void f(bool a, bool b) {
573 // block1: int n;
574 // if (a) {
575 // block2: if (b)
576 // block3: n = 1;
577 // block4: } else if (b) {
578 // block5: while (!a) {
579 // block6: do_work(&a);
580 // n = 2;
581 // }
582 // }
583 // block7: if (a)
584 // block8: g();
585 // block9: return n;
586 // }
587 //
588 // Starting from the maybe-uninitialized use in block 9:
589 // * Block 7 is not visited because we have only visited one of its two
590 // successors.
591 // * Block 8 is visited because we've visited its only successor.
592 // From block 8:
593 // * Block 7 is visited because we've now visited both of its successors.
594 // From block 7:
595 // * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
596 // of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
597 // * Block 3 is not visited because it initializes 'n'.
598 // Now the algorithm terminates, having visited blocks 7 and 8, and having
599 // found the frontier is blocks 2, 4, and 5.
600 //
601 // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
602 // and 4), so we report that any time either of those edges is taken (in
603 // each case when 'b == false'), 'n' is used uninitialized.
604 SmallVector<const CFGBlock*, 32> Queue;
605 SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
606 Queue.push_back(block);
607 // Specify that we've already visited all successors of the starting block.
608 // This has the dual purpose of ensuring we never add it to the queue, and
609 // of marking it as not being a candidate element of the frontier.
610 SuccsVisited[block->getBlockID()] = block->succ_size();
611 while (!Queue.empty()) {
612 const CFGBlock *B = Queue.pop_back_val();
613
614 // If the use is always reached from the entry block, make a note of that.
615 if (B == &cfg.getEntry())
616 Use.setUninitAfterCall();
617
618 for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
619 I != E; ++I) {
620 const CFGBlock *Pred = *I;
621 if (!Pred)
622 continue;
623
624 Value AtPredExit = vals.getValue(Pred, B, vd);
625 if (AtPredExit == Initialized)
626 // This block initializes the variable.
627 continue;
628 if (AtPredExit == MayUninitialized &&
629 vals.getValue(B, nullptr, vd) == Uninitialized) {
630 // This block declares the variable (uninitialized), and is reachable
631 // from a block that initializes the variable. We can't guarantee to
632 // give an earlier location for the diagnostic (and it appears that
633 // this code is intended to be reachable) so give a diagnostic here
634 // and go no further down this path.
635 Use.setUninitAfterDecl();
636 continue;
637 }
638
639 unsigned &SV = SuccsVisited[Pred->getBlockID()];
640 if (!SV) {
641 // When visiting the first successor of a block, mark all NULL
642 // successors as having been visited.
643 for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
644 SE = Pred->succ_end();
645 SI != SE; ++SI)
646 if (!*SI)
647 ++SV;
648 }
649
650 if (++SV == Pred->succ_size())
651 // All paths from this block lead to the use and don't initialize the
652 // variable.
653 Queue.push_back(Pred);
654 }
655 }
656
657 // Scan the frontier, looking for blocks where the variable was
658 // uninitialized.
659 for (const auto *Block : cfg) {
660 unsigned BlockID = Block->getBlockID();
661 const Stmt *Term = Block->getTerminatorStmt();
662 if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
663 Term) {
664 // This block inevitably leads to the use. If we have an edge from here
665 // to a post-dominator block, and the variable is uninitialized on that
666 // edge, we have found a bug.
667 for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
668 E = Block->succ_end(); I != E; ++I) {
669 const CFGBlock *Succ = *I;
670 if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
671 vals.getValue(Block, Succ, vd) == Uninitialized) {
672 // Switch cases are a special case: report the label to the caller
673 // as the 'terminator', not the switch statement itself. Suppress
674 // situations where no label matched: we can't be sure that's
675 // possible.
676 if (isa<SwitchStmt>(Term)) {
677 const Stmt *Label = Succ->getLabel();
678 if (!Label || !isa<SwitchCase>(Label))
679 // Might not be possible.
680 continue;
681 UninitUse::Branch Branch;
682 Branch.Terminator = Label;
683 Branch.Output = 0; // Ignored.
684 Use.addUninitBranch(Branch);
685 } else {
686 UninitUse::Branch Branch;
687 Branch.Terminator = Term;
688 Branch.Output = I - Block->succ_begin();
689 Use.addUninitBranch(Branch);
690 }
691 }
692 }
693 }
694 }
695
696 return Use;
697 }
698 };
699
700 } // namespace
701
reportUse(const Expr * ex,const VarDecl * vd)702 void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
703 Value v = vals[vd];
704 if (isUninitialized(v))
705 handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
706 }
707
VisitObjCForCollectionStmt(ObjCForCollectionStmt * FS)708 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
709 // This represents an initialization of the 'element' value.
710 if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
711 const auto *VD = cast<VarDecl>(DS->getSingleDecl());
712 if (isTrackedVar(VD))
713 vals[VD] = Initialized;
714 }
715 }
716
VisitOMPExecutableDirective(OMPExecutableDirective * ED)717 void TransferFunctions::VisitOMPExecutableDirective(
718 OMPExecutableDirective *ED) {
719 for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses())) {
720 assert(S && "Expected non-null used-in-clause child.");
721 Visit(S);
722 }
723 if (!ED->isStandaloneDirective())
724 Visit(ED->getStructuredBlock());
725 }
726
VisitBlockExpr(BlockExpr * be)727 void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
728 const BlockDecl *bd = be->getBlockDecl();
729 for (const auto &I : bd->captures()) {
730 const VarDecl *vd = I.getVariable();
731 if (!isTrackedVar(vd))
732 continue;
733 if (I.isByRef()) {
734 vals[vd] = Initialized;
735 continue;
736 }
737 reportUse(be, vd);
738 }
739 }
740
VisitCallExpr(CallExpr * ce)741 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
742 if (Decl *Callee = ce->getCalleeDecl()) {
743 if (Callee->hasAttr<ReturnsTwiceAttr>()) {
744 // After a call to a function like setjmp or vfork, any variable which is
745 // initialized anywhere within this function may now be initialized. For
746 // now, just assume such a call initializes all variables. FIXME: Only
747 // mark variables as initialized if they have an initializer which is
748 // reachable from here.
749 vals.setAllScratchValues(Initialized);
750 }
751 else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
752 // Functions labeled like "analyzer_noreturn" are often used to denote
753 // "panic" functions that in special debug situations can still return,
754 // but for the most part should not be treated as returning. This is a
755 // useful annotation borrowed from the static analyzer that is useful for
756 // suppressing branch-specific false positives when we call one of these
757 // functions but keep pretending the path continues (when in reality the
758 // user doesn't care).
759 vals.setAllScratchValues(Unknown);
760 }
761 }
762 }
763
VisitDeclRefExpr(DeclRefExpr * dr)764 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
765 switch (classification.get(dr)) {
766 case ClassifyRefs::Ignore:
767 break;
768 case ClassifyRefs::Use:
769 reportUse(dr, cast<VarDecl>(dr->getDecl()));
770 break;
771 case ClassifyRefs::Init:
772 vals[cast<VarDecl>(dr->getDecl())] = Initialized;
773 break;
774 case ClassifyRefs::SelfInit:
775 handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
776 break;
777 }
778 }
779
VisitBinaryOperator(BinaryOperator * BO)780 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
781 if (BO->getOpcode() == BO_Assign) {
782 FindVarResult Var = findVar(BO->getLHS());
783 if (const VarDecl *VD = Var.getDecl())
784 vals[VD] = Initialized;
785 }
786 }
787
VisitDeclStmt(DeclStmt * DS)788 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
789 for (auto *DI : DS->decls()) {
790 auto *VD = dyn_cast<VarDecl>(DI);
791 if (VD && isTrackedVar(VD)) {
792 if (getSelfInitExpr(VD)) {
793 // If the initializer consists solely of a reference to itself, we
794 // explicitly mark the variable as uninitialized. This allows code
795 // like the following:
796 //
797 // int x = x;
798 //
799 // to deliberately leave a variable uninitialized. Different analysis
800 // clients can detect this pattern and adjust their reporting
801 // appropriately, but we need to continue to analyze subsequent uses
802 // of the variable.
803 vals[VD] = Uninitialized;
804 } else if (VD->getInit()) {
805 // Treat the new variable as initialized.
806 vals[VD] = Initialized;
807 } else {
808 // No initializer: the variable is now uninitialized. This matters
809 // for cases like:
810 // while (...) {
811 // int n;
812 // use(n);
813 // n = 0;
814 // }
815 // FIXME: Mark the variable as uninitialized whenever its scope is
816 // left, since its scope could be re-entered by a jump over the
817 // declaration.
818 vals[VD] = Uninitialized;
819 }
820 }
821 }
822 }
823
VisitObjCMessageExpr(ObjCMessageExpr * ME)824 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
825 // If the Objective-C message expression is an implicit no-return that
826 // is not modeled in the CFG, set the tracked dataflow values to Unknown.
827 if (objCNoRet.isImplicitNoReturn(ME)) {
828 vals.setAllScratchValues(Unknown);
829 }
830 }
831
832 //------------------------------------------------------------------------====//
833 // High-level "driver" logic for uninitialized values analysis.
834 //====------------------------------------------------------------------------//
835
runOnBlock(const CFGBlock * block,const CFG & cfg,AnalysisDeclContext & ac,CFGBlockValues & vals,const ClassifyRefs & classification,llvm::BitVector & wasAnalyzed,UninitVariablesHandler & handler)836 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
837 AnalysisDeclContext &ac, CFGBlockValues &vals,
838 const ClassifyRefs &classification,
839 llvm::BitVector &wasAnalyzed,
840 UninitVariablesHandler &handler) {
841 wasAnalyzed[block->getBlockID()] = true;
842 vals.resetScratch();
843 // Merge in values of predecessor blocks.
844 bool isFirst = true;
845 for (CFGBlock::const_pred_iterator I = block->pred_begin(),
846 E = block->pred_end(); I != E; ++I) {
847 const CFGBlock *pred = *I;
848 if (!pred)
849 continue;
850 if (wasAnalyzed[pred->getBlockID()]) {
851 vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
852 isFirst = false;
853 }
854 }
855 // Apply the transfer function.
856 TransferFunctions tf(vals, cfg, block, ac, classification, handler);
857 for (const auto &I : *block) {
858 if (Optional<CFGStmt> cs = I.getAs<CFGStmt>())
859 tf.Visit(const_cast<Stmt *>(cs->getStmt()));
860 }
861 return vals.updateValueVectorWithScratch(block);
862 }
863
864 namespace {
865
866 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
867 /// to detect when a CFGBlock has any *potential* use of an uninitialized
868 /// variable. It is mainly used to prune out work during the final
869 /// reporting pass.
870 struct PruneBlocksHandler : public UninitVariablesHandler {
871 /// Records if a CFGBlock had a potential use of an uninitialized variable.
872 llvm::BitVector hadUse;
873
874 /// Records if any CFGBlock had a potential use of an uninitialized variable.
875 bool hadAnyUse = false;
876
877 /// The current block to scribble use information.
878 unsigned currentBlock = 0;
879
PruneBlocksHandler__anonaca55abf0711::PruneBlocksHandler880 PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
881
882 ~PruneBlocksHandler() override = default;
883
handleUseOfUninitVariable__anonaca55abf0711::PruneBlocksHandler884 void handleUseOfUninitVariable(const VarDecl *vd,
885 const UninitUse &use) override {
886 hadUse[currentBlock] = true;
887 hadAnyUse = true;
888 }
889
890 /// Called when the uninitialized variable analysis detects the
891 /// idiom 'int x = x'. All other uses of 'x' within the initializer
892 /// are handled by handleUseOfUninitVariable.
handleSelfInit__anonaca55abf0711::PruneBlocksHandler893 void handleSelfInit(const VarDecl *vd) override {
894 hadUse[currentBlock] = true;
895 hadAnyUse = true;
896 }
897 };
898
899 } // namespace
900
runUninitializedVariablesAnalysis(const DeclContext & dc,const CFG & cfg,AnalysisDeclContext & ac,UninitVariablesHandler & handler,UninitVariablesAnalysisStats & stats)901 void clang::runUninitializedVariablesAnalysis(
902 const DeclContext &dc,
903 const CFG &cfg,
904 AnalysisDeclContext &ac,
905 UninitVariablesHandler &handler,
906 UninitVariablesAnalysisStats &stats) {
907 CFGBlockValues vals(cfg);
908 vals.computeSetOfDeclarations(dc);
909 if (vals.hasNoDeclarations())
910 return;
911
912 stats.NumVariablesAnalyzed = vals.getNumEntries();
913
914 // Precompute which expressions are uses and which are initializations.
915 ClassifyRefs classification(ac);
916 cfg.VisitBlockStmts(classification);
917
918 // Mark all variables uninitialized at the entry.
919 const CFGBlock &entry = cfg.getEntry();
920 ValueVector &vec = vals.getValueVector(&entry);
921 const unsigned n = vals.getNumEntries();
922 for (unsigned j = 0; j < n; ++j) {
923 vec[j] = Uninitialized;
924 }
925
926 // Proceed with the workist.
927 DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>());
928 llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
929 worklist.enqueueSuccessors(&cfg.getEntry());
930 llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
931 wasAnalyzed[cfg.getEntry().getBlockID()] = true;
932 PruneBlocksHandler PBH(cfg.getNumBlockIDs());
933
934 while (const CFGBlock *block = worklist.dequeue()) {
935 PBH.currentBlock = block->getBlockID();
936
937 // Did the block change?
938 bool changed = runOnBlock(block, cfg, ac, vals,
939 classification, wasAnalyzed, PBH);
940 ++stats.NumBlockVisits;
941 if (changed || !previouslyVisited[block->getBlockID()])
942 worklist.enqueueSuccessors(block);
943 previouslyVisited[block->getBlockID()] = true;
944 }
945
946 if (!PBH.hadAnyUse)
947 return;
948
949 // Run through the blocks one more time, and report uninitialized variables.
950 for (const auto *block : cfg)
951 if (PBH.hadUse[block->getBlockID()]) {
952 runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
953 ++stats.NumBlockVisits;
954 }
955 }
956
957 UninitVariablesHandler::~UninitVariablesHandler() = default;
958