1 //===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements uninitialized values analysis for source-level CFGs.
10 //
11 //===----------------------------------------------------------------------===//
12
13 #include "clang/Analysis/Analyses/UninitializedValues.h"
14 #include "clang/AST/Attr.h"
15 #include "clang/AST/Decl.h"
16 #include "clang/AST/DeclBase.h"
17 #include "clang/AST/Expr.h"
18 #include "clang/AST/OperationKinds.h"
19 #include "clang/AST/Stmt.h"
20 #include "clang/AST/StmtObjC.h"
21 #include "clang/AST/StmtVisitor.h"
22 #include "clang/AST/Type.h"
23 #include "clang/Analysis/Analyses/PostOrderCFGView.h"
24 #include "clang/Analysis/AnalysisDeclContext.h"
25 #include "clang/Analysis/CFG.h"
26 #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
27 #include "clang/Analysis/FlowSensitive/DataflowWorklist.h"
28 #include "clang/Basic/LLVM.h"
29 #include "llvm/ADT/BitVector.h"
30 #include "llvm/ADT/DenseMap.h"
31 #include "llvm/ADT/None.h"
32 #include "llvm/ADT/Optional.h"
33 #include "llvm/ADT/PackedVector.h"
34 #include "llvm/ADT/SmallBitVector.h"
35 #include "llvm/ADT/SmallVector.h"
36 #include "llvm/Support/Casting.h"
37 #include <algorithm>
38 #include <cassert>
39
40 using namespace clang;
41
42 #define DEBUG_LOGGING 0
43
isTrackedVar(const VarDecl * vd,const DeclContext * dc)44 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
45 if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
46 !vd->isExceptionVariable() && !vd->isInitCapture() &&
47 !vd->isImplicit() && vd->getDeclContext() == dc) {
48 QualType ty = vd->getType();
49 return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
50 }
51 return false;
52 }
53
54 //------------------------------------------------------------------------====//
55 // DeclToIndex: a mapping from Decls we track to value indices.
56 //====------------------------------------------------------------------------//
57
58 namespace {
59
60 class DeclToIndex {
61 llvm::DenseMap<const VarDecl *, unsigned> map;
62
63 public:
64 DeclToIndex() = default;
65
66 /// Compute the actual mapping from declarations to bits.
67 void computeMap(const DeclContext &dc);
68
69 /// Return the number of declarations in the map.
size() const70 unsigned size() const { return map.size(); }
71
72 /// Returns the bit vector index for a given declaration.
73 Optional<unsigned> getValueIndex(const VarDecl *d) const;
74 };
75
76 } // namespace
77
computeMap(const DeclContext & dc)78 void DeclToIndex::computeMap(const DeclContext &dc) {
79 unsigned count = 0;
80 DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
81 E(dc.decls_end());
82 for ( ; I != E; ++I) {
83 const VarDecl *vd = *I;
84 if (isTrackedVar(vd, &dc))
85 map[vd] = count++;
86 }
87 }
88
getValueIndex(const VarDecl * d) const89 Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
90 llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
91 if (I == map.end())
92 return None;
93 return I->second;
94 }
95
96 //------------------------------------------------------------------------====//
97 // CFGBlockValues: dataflow values for CFG blocks.
98 //====------------------------------------------------------------------------//
99
100 // These values are defined in such a way that a merge can be done using
101 // a bitwise OR.
102 enum Value { Unknown = 0x0, /* 00 */
103 Initialized = 0x1, /* 01 */
104 Uninitialized = 0x2, /* 10 */
105 MayUninitialized = 0x3 /* 11 */ };
106
isUninitialized(const Value v)107 static bool isUninitialized(const Value v) {
108 return v >= Uninitialized;
109 }
110
isAlwaysUninit(const Value v)111 static bool isAlwaysUninit(const Value v) {
112 return v == Uninitialized;
113 }
114
115 namespace {
116
117 using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
118
119 class CFGBlockValues {
120 const CFG &cfg;
121 SmallVector<ValueVector, 8> vals;
122 ValueVector scratch;
123 DeclToIndex declToIndex;
124
125 public:
126 CFGBlockValues(const CFG &cfg);
127
getNumEntries() const128 unsigned getNumEntries() const { return declToIndex.size(); }
129
130 void computeSetOfDeclarations(const DeclContext &dc);
131
getValueVector(const CFGBlock * block)132 ValueVector &getValueVector(const CFGBlock *block) {
133 return vals[block->getBlockID()];
134 }
135
136 void setAllScratchValues(Value V);
137 void mergeIntoScratch(ValueVector const &source, bool isFirst);
138 bool updateValueVectorWithScratch(const CFGBlock *block);
139
hasNoDeclarations() const140 bool hasNoDeclarations() const {
141 return declToIndex.size() == 0;
142 }
143
144 void resetScratch();
145
146 ValueVector::reference operator[](const VarDecl *vd);
147
getValue(const CFGBlock * block,const CFGBlock * dstBlock,const VarDecl * vd)148 Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
149 const VarDecl *vd) {
150 const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
151 assert(idx.hasValue());
152 return getValueVector(block)[idx.getValue()];
153 }
154 };
155
156 } // namespace
157
CFGBlockValues(const CFG & c)158 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
159
computeSetOfDeclarations(const DeclContext & dc)160 void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
161 declToIndex.computeMap(dc);
162 unsigned decls = declToIndex.size();
163 scratch.resize(decls);
164 unsigned n = cfg.getNumBlockIDs();
165 if (!n)
166 return;
167 vals.resize(n);
168 for (auto &val : vals)
169 val.resize(decls);
170 }
171
172 #if DEBUG_LOGGING
printVector(const CFGBlock * block,ValueVector & bv,unsigned num)173 static void printVector(const CFGBlock *block, ValueVector &bv,
174 unsigned num) {
175 llvm::errs() << block->getBlockID() << " :";
176 for (const auto &i : bv)
177 llvm::errs() << ' ' << i;
178 llvm::errs() << " : " << num << '\n';
179 }
180 #endif
181
setAllScratchValues(Value V)182 void CFGBlockValues::setAllScratchValues(Value V) {
183 for (unsigned I = 0, E = scratch.size(); I != E; ++I)
184 scratch[I] = V;
185 }
186
mergeIntoScratch(ValueVector const & source,bool isFirst)187 void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
188 bool isFirst) {
189 if (isFirst)
190 scratch = source;
191 else
192 scratch |= source;
193 }
194
updateValueVectorWithScratch(const CFGBlock * block)195 bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
196 ValueVector &dst = getValueVector(block);
197 bool changed = (dst != scratch);
198 if (changed)
199 dst = scratch;
200 #if DEBUG_LOGGING
201 printVector(block, scratch, 0);
202 #endif
203 return changed;
204 }
205
resetScratch()206 void CFGBlockValues::resetScratch() {
207 scratch.reset();
208 }
209
operator [](const VarDecl * vd)210 ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
211 const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
212 assert(idx.hasValue());
213 return scratch[idx.getValue()];
214 }
215
216 //------------------------------------------------------------------------====//
217 // Classification of DeclRefExprs as use or initialization.
218 //====------------------------------------------------------------------------//
219
220 namespace {
221
222 class FindVarResult {
223 const VarDecl *vd;
224 const DeclRefExpr *dr;
225
226 public:
FindVarResult(const VarDecl * vd,const DeclRefExpr * dr)227 FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
228
getDeclRefExpr() const229 const DeclRefExpr *getDeclRefExpr() const { return dr; }
getDecl() const230 const VarDecl *getDecl() const { return vd; }
231 };
232
233 } // namespace
234
stripCasts(ASTContext & C,const Expr * Ex)235 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
236 while (Ex) {
237 Ex = Ex->IgnoreParenNoopCasts(C);
238 if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
239 if (CE->getCastKind() == CK_LValueBitCast) {
240 Ex = CE->getSubExpr();
241 continue;
242 }
243 }
244 break;
245 }
246 return Ex;
247 }
248
249 /// If E is an expression comprising a reference to a single variable, find that
250 /// variable.
findVar(const Expr * E,const DeclContext * DC)251 static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
252 if (const auto *DRE =
253 dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
254 if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
255 if (isTrackedVar(VD, DC))
256 return FindVarResult(VD, DRE);
257 return FindVarResult(nullptr, nullptr);
258 }
259
260 namespace {
261
262 /// Classify each DeclRefExpr as an initialization or a use. Any
263 /// DeclRefExpr which isn't explicitly classified will be assumed to have
264 /// escaped the analysis and will be treated as an initialization.
265 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
266 public:
267 enum Class {
268 Init,
269 Use,
270 SelfInit,
271 ConstRefUse,
272 Ignore
273 };
274
275 private:
276 const DeclContext *DC;
277 llvm::DenseMap<const DeclRefExpr *, Class> Classification;
278
isTrackedVar(const VarDecl * VD) const279 bool isTrackedVar(const VarDecl *VD) const {
280 return ::isTrackedVar(VD, DC);
281 }
282
283 void classify(const Expr *E, Class C);
284
285 public:
ClassifyRefs(AnalysisDeclContext & AC)286 ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
287
288 void VisitDeclStmt(DeclStmt *DS);
289 void VisitUnaryOperator(UnaryOperator *UO);
290 void VisitBinaryOperator(BinaryOperator *BO);
291 void VisitCallExpr(CallExpr *CE);
292 void VisitCastExpr(CastExpr *CE);
293 void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
294
operator ()(Stmt * S)295 void operator()(Stmt *S) { Visit(S); }
296
get(const DeclRefExpr * DRE) const297 Class get(const DeclRefExpr *DRE) const {
298 llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
299 = Classification.find(DRE);
300 if (I != Classification.end())
301 return I->second;
302
303 const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
304 if (!VD || !isTrackedVar(VD))
305 return Ignore;
306
307 return Init;
308 }
309 };
310
311 } // namespace
312
getSelfInitExpr(VarDecl * VD)313 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
314 if (VD->getType()->isRecordType())
315 return nullptr;
316 if (Expr *Init = VD->getInit()) {
317 const auto *DRE =
318 dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
319 if (DRE && DRE->getDecl() == VD)
320 return DRE;
321 }
322 return nullptr;
323 }
324
classify(const Expr * E,Class C)325 void ClassifyRefs::classify(const Expr *E, Class C) {
326 // The result of a ?: could also be an lvalue.
327 E = E->IgnoreParens();
328 if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
329 classify(CO->getTrueExpr(), C);
330 classify(CO->getFalseExpr(), C);
331 return;
332 }
333
334 if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
335 classify(BCO->getFalseExpr(), C);
336 return;
337 }
338
339 if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
340 classify(OVE->getSourceExpr(), C);
341 return;
342 }
343
344 if (const auto *ME = dyn_cast<MemberExpr>(E)) {
345 if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
346 if (!VD->isStaticDataMember())
347 classify(ME->getBase(), C);
348 }
349 return;
350 }
351
352 if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
353 switch (BO->getOpcode()) {
354 case BO_PtrMemD:
355 case BO_PtrMemI:
356 classify(BO->getLHS(), C);
357 return;
358 case BO_Comma:
359 classify(BO->getRHS(), C);
360 return;
361 default:
362 return;
363 }
364 }
365
366 FindVarResult Var = findVar(E, DC);
367 if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
368 Classification[DRE] = std::max(Classification[DRE], C);
369 }
370
VisitDeclStmt(DeclStmt * DS)371 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
372 for (auto *DI : DS->decls()) {
373 auto *VD = dyn_cast<VarDecl>(DI);
374 if (VD && isTrackedVar(VD))
375 if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
376 Classification[DRE] = SelfInit;
377 }
378 }
379
VisitBinaryOperator(BinaryOperator * BO)380 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
381 // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
382 // is not a compound-assignment, we will treat it as initializing the variable
383 // when TransferFunctions visits it. A compound-assignment does not affect
384 // whether a variable is uninitialized, and there's no point counting it as a
385 // use.
386 if (BO->isCompoundAssignmentOp())
387 classify(BO->getLHS(), Use);
388 else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
389 classify(BO->getLHS(), Ignore);
390 }
391
VisitUnaryOperator(UnaryOperator * UO)392 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
393 // Increment and decrement are uses despite there being no lvalue-to-rvalue
394 // conversion.
395 if (UO->isIncrementDecrementOp())
396 classify(UO->getSubExpr(), Use);
397 }
398
VisitOMPExecutableDirective(OMPExecutableDirective * ED)399 void ClassifyRefs::VisitOMPExecutableDirective(OMPExecutableDirective *ED) {
400 for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses()))
401 classify(cast<Expr>(S), Use);
402 }
403
isPointerToConst(const QualType & QT)404 static bool isPointerToConst(const QualType &QT) {
405 return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
406 }
407
hasTrivialBody(CallExpr * CE)408 static bool hasTrivialBody(CallExpr *CE) {
409 if (FunctionDecl *FD = CE->getDirectCallee()) {
410 if (FunctionTemplateDecl *FTD = FD->getPrimaryTemplate())
411 return FTD->getTemplatedDecl()->hasTrivialBody();
412 return FD->hasTrivialBody();
413 }
414 return false;
415 }
416
VisitCallExpr(CallExpr * CE)417 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
418 // Classify arguments to std::move as used.
419 if (CE->isCallToStdMove()) {
420 // RecordTypes are handled in SemaDeclCXX.cpp.
421 if (!CE->getArg(0)->getType()->isRecordType())
422 classify(CE->getArg(0), Use);
423 return;
424 }
425 bool isTrivialBody = hasTrivialBody(CE);
426 // If a value is passed by const pointer to a function,
427 // we should not assume that it is initialized by the call, and we
428 // conservatively do not assume that it is used.
429 // If a value is passed by const reference to a function,
430 // it should already be initialized.
431 for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
432 I != E; ++I) {
433 if ((*I)->isGLValue()) {
434 if ((*I)->getType().isConstQualified())
435 classify((*I), isTrivialBody ? Ignore : ConstRefUse);
436 } else if (isPointerToConst((*I)->getType())) {
437 const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
438 const auto *UO = dyn_cast<UnaryOperator>(Ex);
439 if (UO && UO->getOpcode() == UO_AddrOf)
440 Ex = UO->getSubExpr();
441 classify(Ex, Ignore);
442 }
443 }
444 }
445
VisitCastExpr(CastExpr * CE)446 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
447 if (CE->getCastKind() == CK_LValueToRValue)
448 classify(CE->getSubExpr(), Use);
449 else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
450 if (CSE->getType()->isVoidType()) {
451 // Squelch any detected load of an uninitialized value if
452 // we cast it to void.
453 // e.g. (void) x;
454 classify(CSE->getSubExpr(), Ignore);
455 }
456 }
457 }
458
459 //------------------------------------------------------------------------====//
460 // Transfer function for uninitialized values analysis.
461 //====------------------------------------------------------------------------//
462
463 namespace {
464
465 class TransferFunctions : public StmtVisitor<TransferFunctions> {
466 CFGBlockValues &vals;
467 const CFG &cfg;
468 const CFGBlock *block;
469 AnalysisDeclContext ∾
470 const ClassifyRefs &classification;
471 ObjCNoReturn objCNoRet;
472 UninitVariablesHandler &handler;
473
474 public:
TransferFunctions(CFGBlockValues & vals,const CFG & cfg,const CFGBlock * block,AnalysisDeclContext & ac,const ClassifyRefs & classification,UninitVariablesHandler & handler)475 TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
476 const CFGBlock *block, AnalysisDeclContext &ac,
477 const ClassifyRefs &classification,
478 UninitVariablesHandler &handler)
479 : vals(vals), cfg(cfg), block(block), ac(ac),
480 classification(classification), objCNoRet(ac.getASTContext()),
481 handler(handler) {}
482
483 void reportUse(const Expr *ex, const VarDecl *vd);
484 void reportConstRefUse(const Expr *ex, const VarDecl *vd);
485
486 void VisitBinaryOperator(BinaryOperator *bo);
487 void VisitBlockExpr(BlockExpr *be);
488 void VisitCallExpr(CallExpr *ce);
489 void VisitDeclRefExpr(DeclRefExpr *dr);
490 void VisitDeclStmt(DeclStmt *ds);
491 void VisitGCCAsmStmt(GCCAsmStmt *as);
492 void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
493 void VisitObjCMessageExpr(ObjCMessageExpr *ME);
494 void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
495
isTrackedVar(const VarDecl * vd)496 bool isTrackedVar(const VarDecl *vd) {
497 return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
498 }
499
findVar(const Expr * ex)500 FindVarResult findVar(const Expr *ex) {
501 return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
502 }
503
getUninitUse(const Expr * ex,const VarDecl * vd,Value v)504 UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
505 UninitUse Use(ex, isAlwaysUninit(v));
506
507 assert(isUninitialized(v));
508 if (Use.getKind() == UninitUse::Always)
509 return Use;
510
511 // If an edge which leads unconditionally to this use did not initialize
512 // the variable, we can say something stronger than 'may be uninitialized':
513 // we can say 'either it's used uninitialized or you have dead code'.
514 //
515 // We track the number of successors of a node which have been visited, and
516 // visit a node once we have visited all of its successors. Only edges where
517 // the variable might still be uninitialized are followed. Since a variable
518 // can't transfer from being initialized to being uninitialized, this will
519 // trace out the subgraph which inevitably leads to the use and does not
520 // initialize the variable. We do not want to skip past loops, since their
521 // non-termination might be correlated with the initialization condition.
522 //
523 // For example:
524 //
525 // void f(bool a, bool b) {
526 // block1: int n;
527 // if (a) {
528 // block2: if (b)
529 // block3: n = 1;
530 // block4: } else if (b) {
531 // block5: while (!a) {
532 // block6: do_work(&a);
533 // n = 2;
534 // }
535 // }
536 // block7: if (a)
537 // block8: g();
538 // block9: return n;
539 // }
540 //
541 // Starting from the maybe-uninitialized use in block 9:
542 // * Block 7 is not visited because we have only visited one of its two
543 // successors.
544 // * Block 8 is visited because we've visited its only successor.
545 // From block 8:
546 // * Block 7 is visited because we've now visited both of its successors.
547 // From block 7:
548 // * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
549 // of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
550 // * Block 3 is not visited because it initializes 'n'.
551 // Now the algorithm terminates, having visited blocks 7 and 8, and having
552 // found the frontier is blocks 2, 4, and 5.
553 //
554 // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
555 // and 4), so we report that any time either of those edges is taken (in
556 // each case when 'b == false'), 'n' is used uninitialized.
557 SmallVector<const CFGBlock*, 32> Queue;
558 SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
559 Queue.push_back(block);
560 // Specify that we've already visited all successors of the starting block.
561 // This has the dual purpose of ensuring we never add it to the queue, and
562 // of marking it as not being a candidate element of the frontier.
563 SuccsVisited[block->getBlockID()] = block->succ_size();
564 while (!Queue.empty()) {
565 const CFGBlock *B = Queue.pop_back_val();
566
567 // If the use is always reached from the entry block, make a note of that.
568 if (B == &cfg.getEntry())
569 Use.setUninitAfterCall();
570
571 for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
572 I != E; ++I) {
573 const CFGBlock *Pred = *I;
574 if (!Pred)
575 continue;
576
577 Value AtPredExit = vals.getValue(Pred, B, vd);
578 if (AtPredExit == Initialized)
579 // This block initializes the variable.
580 continue;
581 if (AtPredExit == MayUninitialized &&
582 vals.getValue(B, nullptr, vd) == Uninitialized) {
583 // This block declares the variable (uninitialized), and is reachable
584 // from a block that initializes the variable. We can't guarantee to
585 // give an earlier location for the diagnostic (and it appears that
586 // this code is intended to be reachable) so give a diagnostic here
587 // and go no further down this path.
588 Use.setUninitAfterDecl();
589 continue;
590 }
591
592 if (AtPredExit == MayUninitialized) {
593 // If the predecessor's terminator is an "asm goto" that initializes
594 // the variable, then don't count it as "initialized" on the indirect
595 // paths.
596 CFGTerminator term = Pred->getTerminator();
597 if (const auto *as = dyn_cast_or_null<GCCAsmStmt>(term.getStmt())) {
598 const CFGBlock *fallthrough = *Pred->succ_begin();
599 if (as->isAsmGoto() &&
600 llvm::any_of(as->outputs(), [&](const Expr *output) {
601 return vd == findVar(output).getDecl() &&
602 llvm::any_of(as->labels(),
603 [&](const AddrLabelExpr *label) {
604 return label->getLabel()->getStmt() == B->Label &&
605 B != fallthrough;
606 });
607 })) {
608 Use.setUninitAfterDecl();
609 continue;
610 }
611 }
612 }
613
614 unsigned &SV = SuccsVisited[Pred->getBlockID()];
615 if (!SV) {
616 // When visiting the first successor of a block, mark all NULL
617 // successors as having been visited.
618 for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
619 SE = Pred->succ_end();
620 SI != SE; ++SI)
621 if (!*SI)
622 ++SV;
623 }
624
625 if (++SV == Pred->succ_size())
626 // All paths from this block lead to the use and don't initialize the
627 // variable.
628 Queue.push_back(Pred);
629 }
630 }
631
632 // Scan the frontier, looking for blocks where the variable was
633 // uninitialized.
634 for (const auto *Block : cfg) {
635 unsigned BlockID = Block->getBlockID();
636 const Stmt *Term = Block->getTerminatorStmt();
637 if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
638 Term) {
639 // This block inevitably leads to the use. If we have an edge from here
640 // to a post-dominator block, and the variable is uninitialized on that
641 // edge, we have found a bug.
642 for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
643 E = Block->succ_end(); I != E; ++I) {
644 const CFGBlock *Succ = *I;
645 if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
646 vals.getValue(Block, Succ, vd) == Uninitialized) {
647 // Switch cases are a special case: report the label to the caller
648 // as the 'terminator', not the switch statement itself. Suppress
649 // situations where no label matched: we can't be sure that's
650 // possible.
651 if (isa<SwitchStmt>(Term)) {
652 const Stmt *Label = Succ->getLabel();
653 if (!Label || !isa<SwitchCase>(Label))
654 // Might not be possible.
655 continue;
656 UninitUse::Branch Branch;
657 Branch.Terminator = Label;
658 Branch.Output = 0; // Ignored.
659 Use.addUninitBranch(Branch);
660 } else {
661 UninitUse::Branch Branch;
662 Branch.Terminator = Term;
663 Branch.Output = I - Block->succ_begin();
664 Use.addUninitBranch(Branch);
665 }
666 }
667 }
668 }
669 }
670
671 return Use;
672 }
673 };
674
675 } // namespace
676
reportUse(const Expr * ex,const VarDecl * vd)677 void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
678 Value v = vals[vd];
679 if (isUninitialized(v))
680 handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
681 }
682
reportConstRefUse(const Expr * ex,const VarDecl * vd)683 void TransferFunctions::reportConstRefUse(const Expr *ex, const VarDecl *vd) {
684 Value v = vals[vd];
685 if (isAlwaysUninit(v))
686 handler.handleConstRefUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
687 }
688
VisitObjCForCollectionStmt(ObjCForCollectionStmt * FS)689 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
690 // This represents an initialization of the 'element' value.
691 if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
692 const auto *VD = cast<VarDecl>(DS->getSingleDecl());
693 if (isTrackedVar(VD))
694 vals[VD] = Initialized;
695 }
696 }
697
VisitOMPExecutableDirective(OMPExecutableDirective * ED)698 void TransferFunctions::VisitOMPExecutableDirective(
699 OMPExecutableDirective *ED) {
700 for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses())) {
701 assert(S && "Expected non-null used-in-clause child.");
702 Visit(S);
703 }
704 if (!ED->isStandaloneDirective())
705 Visit(ED->getStructuredBlock());
706 }
707
VisitBlockExpr(BlockExpr * be)708 void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
709 const BlockDecl *bd = be->getBlockDecl();
710 for (const auto &I : bd->captures()) {
711 const VarDecl *vd = I.getVariable();
712 if (!isTrackedVar(vd))
713 continue;
714 if (I.isByRef()) {
715 vals[vd] = Initialized;
716 continue;
717 }
718 reportUse(be, vd);
719 }
720 }
721
VisitCallExpr(CallExpr * ce)722 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
723 if (Decl *Callee = ce->getCalleeDecl()) {
724 if (Callee->hasAttr<ReturnsTwiceAttr>()) {
725 // After a call to a function like setjmp or vfork, any variable which is
726 // initialized anywhere within this function may now be initialized. For
727 // now, just assume such a call initializes all variables. FIXME: Only
728 // mark variables as initialized if they have an initializer which is
729 // reachable from here.
730 vals.setAllScratchValues(Initialized);
731 }
732 else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
733 // Functions labeled like "analyzer_noreturn" are often used to denote
734 // "panic" functions that in special debug situations can still return,
735 // but for the most part should not be treated as returning. This is a
736 // useful annotation borrowed from the static analyzer that is useful for
737 // suppressing branch-specific false positives when we call one of these
738 // functions but keep pretending the path continues (when in reality the
739 // user doesn't care).
740 vals.setAllScratchValues(Unknown);
741 }
742 }
743 }
744
VisitDeclRefExpr(DeclRefExpr * dr)745 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
746 switch (classification.get(dr)) {
747 case ClassifyRefs::Ignore:
748 break;
749 case ClassifyRefs::Use:
750 reportUse(dr, cast<VarDecl>(dr->getDecl()));
751 break;
752 case ClassifyRefs::Init:
753 vals[cast<VarDecl>(dr->getDecl())] = Initialized;
754 break;
755 case ClassifyRefs::SelfInit:
756 handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
757 break;
758 case ClassifyRefs::ConstRefUse:
759 reportConstRefUse(dr, cast<VarDecl>(dr->getDecl()));
760 break;
761 }
762 }
763
VisitBinaryOperator(BinaryOperator * BO)764 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
765 if (BO->getOpcode() == BO_Assign) {
766 FindVarResult Var = findVar(BO->getLHS());
767 if (const VarDecl *VD = Var.getDecl())
768 vals[VD] = Initialized;
769 }
770 }
771
VisitDeclStmt(DeclStmt * DS)772 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
773 for (auto *DI : DS->decls()) {
774 auto *VD = dyn_cast<VarDecl>(DI);
775 if (VD && isTrackedVar(VD)) {
776 if (getSelfInitExpr(VD)) {
777 // If the initializer consists solely of a reference to itself, we
778 // explicitly mark the variable as uninitialized. This allows code
779 // like the following:
780 //
781 // int x = x;
782 //
783 // to deliberately leave a variable uninitialized. Different analysis
784 // clients can detect this pattern and adjust their reporting
785 // appropriately, but we need to continue to analyze subsequent uses
786 // of the variable.
787 vals[VD] = Uninitialized;
788 } else if (VD->getInit()) {
789 // Treat the new variable as initialized.
790 vals[VD] = Initialized;
791 } else {
792 // No initializer: the variable is now uninitialized. This matters
793 // for cases like:
794 // while (...) {
795 // int n;
796 // use(n);
797 // n = 0;
798 // }
799 // FIXME: Mark the variable as uninitialized whenever its scope is
800 // left, since its scope could be re-entered by a jump over the
801 // declaration.
802 vals[VD] = Uninitialized;
803 }
804 }
805 }
806 }
807
VisitGCCAsmStmt(GCCAsmStmt * as)808 void TransferFunctions::VisitGCCAsmStmt(GCCAsmStmt *as) {
809 // An "asm goto" statement is a terminator that may initialize some variables.
810 if (!as->isAsmGoto())
811 return;
812
813 ASTContext &C = ac.getASTContext();
814 for (const Expr *O : as->outputs()) {
815 const Expr *Ex = stripCasts(C, O);
816
817 // Strip away any unary operators. Invalid l-values are reported by other
818 // semantic analysis passes.
819 while (const auto *UO = dyn_cast<UnaryOperator>(Ex))
820 Ex = stripCasts(C, UO->getSubExpr());
821
822 // Mark the variable as potentially uninitialized for those cases where
823 // it's used on an indirect path, where it's not guaranteed to be
824 // defined.
825 if (const VarDecl *VD = findVar(Ex).getDecl())
826 vals[VD] = MayUninitialized;
827 }
828 }
829
VisitObjCMessageExpr(ObjCMessageExpr * ME)830 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
831 // If the Objective-C message expression is an implicit no-return that
832 // is not modeled in the CFG, set the tracked dataflow values to Unknown.
833 if (objCNoRet.isImplicitNoReturn(ME)) {
834 vals.setAllScratchValues(Unknown);
835 }
836 }
837
838 //------------------------------------------------------------------------====//
839 // High-level "driver" logic for uninitialized values analysis.
840 //====------------------------------------------------------------------------//
841
runOnBlock(const CFGBlock * block,const CFG & cfg,AnalysisDeclContext & ac,CFGBlockValues & vals,const ClassifyRefs & classification,llvm::BitVector & wasAnalyzed,UninitVariablesHandler & handler)842 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
843 AnalysisDeclContext &ac, CFGBlockValues &vals,
844 const ClassifyRefs &classification,
845 llvm::BitVector &wasAnalyzed,
846 UninitVariablesHandler &handler) {
847 wasAnalyzed[block->getBlockID()] = true;
848 vals.resetScratch();
849 // Merge in values of predecessor blocks.
850 bool isFirst = true;
851 for (CFGBlock::const_pred_iterator I = block->pred_begin(),
852 E = block->pred_end(); I != E; ++I) {
853 const CFGBlock *pred = *I;
854 if (!pred)
855 continue;
856 if (wasAnalyzed[pred->getBlockID()]) {
857 vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
858 isFirst = false;
859 }
860 }
861 // Apply the transfer function.
862 TransferFunctions tf(vals, cfg, block, ac, classification, handler);
863 for (const auto &I : *block) {
864 if (Optional<CFGStmt> cs = I.getAs<CFGStmt>())
865 tf.Visit(const_cast<Stmt *>(cs->getStmt()));
866 }
867 CFGTerminator terminator = block->getTerminator();
868 if (auto *as = dyn_cast_or_null<GCCAsmStmt>(terminator.getStmt()))
869 if (as->isAsmGoto())
870 tf.Visit(as);
871 return vals.updateValueVectorWithScratch(block);
872 }
873
874 namespace {
875
876 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
877 /// to detect when a CFGBlock has any *potential* use of an uninitialized
878 /// variable. It is mainly used to prune out work during the final
879 /// reporting pass.
880 struct PruneBlocksHandler : public UninitVariablesHandler {
881 /// Records if a CFGBlock had a potential use of an uninitialized variable.
882 llvm::BitVector hadUse;
883
884 /// Records if any CFGBlock had a potential use of an uninitialized variable.
885 bool hadAnyUse = false;
886
887 /// The current block to scribble use information.
888 unsigned currentBlock = 0;
889
PruneBlocksHandler__anon3fc8c4040811::PruneBlocksHandler890 PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
891
892 ~PruneBlocksHandler() override = default;
893
handleUseOfUninitVariable__anon3fc8c4040811::PruneBlocksHandler894 void handleUseOfUninitVariable(const VarDecl *vd,
895 const UninitUse &use) override {
896 hadUse[currentBlock] = true;
897 hadAnyUse = true;
898 }
899
handleConstRefUseOfUninitVariable__anon3fc8c4040811::PruneBlocksHandler900 void handleConstRefUseOfUninitVariable(const VarDecl *vd,
901 const UninitUse &use) override {
902 hadUse[currentBlock] = true;
903 hadAnyUse = true;
904 }
905
906 /// Called when the uninitialized variable analysis detects the
907 /// idiom 'int x = x'. All other uses of 'x' within the initializer
908 /// are handled by handleUseOfUninitVariable.
handleSelfInit__anon3fc8c4040811::PruneBlocksHandler909 void handleSelfInit(const VarDecl *vd) override {
910 hadUse[currentBlock] = true;
911 hadAnyUse = true;
912 }
913 };
914
915 } // namespace
916
runUninitializedVariablesAnalysis(const DeclContext & dc,const CFG & cfg,AnalysisDeclContext & ac,UninitVariablesHandler & handler,UninitVariablesAnalysisStats & stats)917 void clang::runUninitializedVariablesAnalysis(
918 const DeclContext &dc,
919 const CFG &cfg,
920 AnalysisDeclContext &ac,
921 UninitVariablesHandler &handler,
922 UninitVariablesAnalysisStats &stats) {
923 CFGBlockValues vals(cfg);
924 vals.computeSetOfDeclarations(dc);
925 if (vals.hasNoDeclarations())
926 return;
927
928 stats.NumVariablesAnalyzed = vals.getNumEntries();
929
930 // Precompute which expressions are uses and which are initializations.
931 ClassifyRefs classification(ac);
932 cfg.VisitBlockStmts(classification);
933
934 // Mark all variables uninitialized at the entry.
935 const CFGBlock &entry = cfg.getEntry();
936 ValueVector &vec = vals.getValueVector(&entry);
937 const unsigned n = vals.getNumEntries();
938 for (unsigned j = 0; j < n; ++j) {
939 vec[j] = Uninitialized;
940 }
941
942 // Proceed with the workist.
943 ForwardDataflowWorklist worklist(cfg, ac);
944 llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
945 worklist.enqueueSuccessors(&cfg.getEntry());
946 llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
947 wasAnalyzed[cfg.getEntry().getBlockID()] = true;
948 PruneBlocksHandler PBH(cfg.getNumBlockIDs());
949
950 while (const CFGBlock *block = worklist.dequeue()) {
951 PBH.currentBlock = block->getBlockID();
952
953 // Did the block change?
954 bool changed = runOnBlock(block, cfg, ac, vals,
955 classification, wasAnalyzed, PBH);
956 ++stats.NumBlockVisits;
957 if (changed || !previouslyVisited[block->getBlockID()])
958 worklist.enqueueSuccessors(block);
959 previouslyVisited[block->getBlockID()] = true;
960 }
961
962 if (!PBH.hadAnyUse)
963 return;
964
965 // Run through the blocks one more time, and report uninitialized variables.
966 for (const auto *block : cfg)
967 if (PBH.hadUse[block->getBlockID()]) {
968 runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
969 ++stats.NumBlockVisits;
970 }
971 }
972
973 UninitVariablesHandler::~UninitVariablesHandler() = default;
974