1 //===- BugReporterVisitors.cpp - Helpers for reporting bugs ---------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines a set of BugReporter "visitors" which can be used to 10 // enhance the diagnostics reported for a bug. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h" 15 #include "clang/AST/ASTContext.h" 16 #include "clang/AST/Decl.h" 17 #include "clang/AST/DeclBase.h" 18 #include "clang/AST/DeclCXX.h" 19 #include "clang/AST/Expr.h" 20 #include "clang/AST/ExprCXX.h" 21 #include "clang/AST/ExprObjC.h" 22 #include "clang/AST/Stmt.h" 23 #include "clang/AST/Type.h" 24 #include "clang/ASTMatchers/ASTMatchFinder.h" 25 #include "clang/Analysis/Analyses/Dominators.h" 26 #include "clang/Analysis/AnalysisDeclContext.h" 27 #include "clang/Analysis/CFG.h" 28 #include "clang/Analysis/CFGStmtMap.h" 29 #include "clang/Analysis/PathDiagnostic.h" 30 #include "clang/Analysis/ProgramPoint.h" 31 #include "clang/Basic/IdentifierTable.h" 32 #include "clang/Basic/LLVM.h" 33 #include "clang/Basic/SourceLocation.h" 34 #include "clang/Basic/SourceManager.h" 35 #include "clang/Lex/Lexer.h" 36 #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h" 37 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" 38 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 39 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 40 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" 41 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 42 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" 43 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 44 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" 45 #include "clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h" 46 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" 47 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" 48 #include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h" 49 #include "llvm/ADT/ArrayRef.h" 50 #include "llvm/ADT/None.h" 51 #include "llvm/ADT/Optional.h" 52 #include "llvm/ADT/STLExtras.h" 53 #include "llvm/ADT/SmallPtrSet.h" 54 #include "llvm/ADT/SmallString.h" 55 #include "llvm/ADT/SmallVector.h" 56 #include "llvm/ADT/StringExtras.h" 57 #include "llvm/ADT/StringRef.h" 58 #include "llvm/Support/Casting.h" 59 #include "llvm/Support/ErrorHandling.h" 60 #include "llvm/Support/raw_ostream.h" 61 #include <cassert> 62 #include <deque> 63 #include <memory> 64 #include <string> 65 #include <utility> 66 67 using namespace clang; 68 using namespace ento; 69 70 //===----------------------------------------------------------------------===// 71 // Utility functions. 72 //===----------------------------------------------------------------------===// 73 74 static const Expr *peelOffPointerArithmetic(const BinaryOperator *B) { 75 if (B->isAdditiveOp() && B->getType()->isPointerType()) { 76 if (B->getLHS()->getType()->isPointerType()) { 77 return B->getLHS(); 78 } else if (B->getRHS()->getType()->isPointerType()) { 79 return B->getRHS(); 80 } 81 } 82 return nullptr; 83 } 84 85 /// Given that expression S represents a pointer that would be dereferenced, 86 /// try to find a sub-expression from which the pointer came from. 87 /// This is used for tracking down origins of a null or undefined value: 88 /// "this is null because that is null because that is null" etc. 89 /// We wipe away field and element offsets because they merely add offsets. 90 /// We also wipe away all casts except lvalue-to-rvalue casts, because the 91 /// latter represent an actual pointer dereference; however, we remove 92 /// the final lvalue-to-rvalue cast before returning from this function 93 /// because it demonstrates more clearly from where the pointer rvalue was 94 /// loaded. Examples: 95 /// x->y.z ==> x (lvalue) 96 /// foo()->y.z ==> foo() (rvalue) 97 const Expr *bugreporter::getDerefExpr(const Stmt *S) { 98 const auto *E = dyn_cast<Expr>(S); 99 if (!E) 100 return nullptr; 101 102 while (true) { 103 if (const auto *CE = dyn_cast<CastExpr>(E)) { 104 if (CE->getCastKind() == CK_LValueToRValue) { 105 // This cast represents the load we're looking for. 106 break; 107 } 108 E = CE->getSubExpr(); 109 } else if (const auto *B = dyn_cast<BinaryOperator>(E)) { 110 // Pointer arithmetic: '*(x + 2)' -> 'x') etc. 111 if (const Expr *Inner = peelOffPointerArithmetic(B)) { 112 E = Inner; 113 } else { 114 // Probably more arithmetic can be pattern-matched here, 115 // but for now give up. 116 break; 117 } 118 } else if (const auto *U = dyn_cast<UnaryOperator>(E)) { 119 if (U->getOpcode() == UO_Deref || U->getOpcode() == UO_AddrOf || 120 (U->isIncrementDecrementOp() && U->getType()->isPointerType())) { 121 // Operators '*' and '&' don't actually mean anything. 122 // We look at casts instead. 123 E = U->getSubExpr(); 124 } else { 125 // Probably more arithmetic can be pattern-matched here, 126 // but for now give up. 127 break; 128 } 129 } 130 // Pattern match for a few useful cases: a[0], p->f, *p etc. 131 else if (const auto *ME = dyn_cast<MemberExpr>(E)) { 132 E = ME->getBase(); 133 } else if (const auto *IvarRef = dyn_cast<ObjCIvarRefExpr>(E)) { 134 E = IvarRef->getBase(); 135 } else if (const auto *AE = dyn_cast<ArraySubscriptExpr>(E)) { 136 E = AE->getBase(); 137 } else if (const auto *PE = dyn_cast<ParenExpr>(E)) { 138 E = PE->getSubExpr(); 139 } else if (const auto *FE = dyn_cast<FullExpr>(E)) { 140 E = FE->getSubExpr(); 141 } else { 142 // Other arbitrary stuff. 143 break; 144 } 145 } 146 147 // Special case: remove the final lvalue-to-rvalue cast, but do not recurse 148 // deeper into the sub-expression. This way we return the lvalue from which 149 // our pointer rvalue was loaded. 150 if (const auto *CE = dyn_cast<ImplicitCastExpr>(E)) 151 if (CE->getCastKind() == CK_LValueToRValue) 152 E = CE->getSubExpr(); 153 154 return E; 155 } 156 157 /// Comparing internal representations of symbolic values (via 158 /// SVal::operator==()) is a valid way to check if the value was updated, 159 /// unless it's a LazyCompoundVal that may have a different internal 160 /// representation every time it is loaded from the state. In this function we 161 /// do an approximate comparison for lazy compound values, checking that they 162 /// are the immediate snapshots of the tracked region's bindings within the 163 /// node's respective states but not really checking that these snapshots 164 /// actually contain the same set of bindings. 165 static bool hasVisibleUpdate(const ExplodedNode *LeftNode, SVal LeftVal, 166 const ExplodedNode *RightNode, SVal RightVal) { 167 if (LeftVal == RightVal) 168 return true; 169 170 const auto LLCV = LeftVal.getAs<nonloc::LazyCompoundVal>(); 171 if (!LLCV) 172 return false; 173 174 const auto RLCV = RightVal.getAs<nonloc::LazyCompoundVal>(); 175 if (!RLCV) 176 return false; 177 178 return LLCV->getRegion() == RLCV->getRegion() && 179 LLCV->getStore() == LeftNode->getState()->getStore() && 180 RLCV->getStore() == RightNode->getState()->getStore(); 181 } 182 183 static Optional<SVal> getSValForVar(const Expr *CondVarExpr, 184 const ExplodedNode *N) { 185 ProgramStateRef State = N->getState(); 186 const LocationContext *LCtx = N->getLocationContext(); 187 188 assert(CondVarExpr); 189 CondVarExpr = CondVarExpr->IgnoreImpCasts(); 190 191 // The declaration of the value may rely on a pointer so take its l-value. 192 // FIXME: As seen in VisitCommonDeclRefExpr, sometimes DeclRefExpr may 193 // evaluate to a FieldRegion when it refers to a declaration of a lambda 194 // capture variable. We most likely need to duplicate that logic here. 195 if (const auto *DRE = dyn_cast<DeclRefExpr>(CondVarExpr)) 196 if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) 197 return State->getSVal(State->getLValue(VD, LCtx)); 198 199 if (const auto *ME = dyn_cast<MemberExpr>(CondVarExpr)) 200 if (const auto *FD = dyn_cast<FieldDecl>(ME->getMemberDecl())) 201 if (auto FieldL = State->getSVal(ME, LCtx).getAs<Loc>()) 202 return State->getRawSVal(*FieldL, FD->getType()); 203 204 return None; 205 } 206 207 static Optional<const llvm::APSInt *> 208 getConcreteIntegerValue(const Expr *CondVarExpr, const ExplodedNode *N) { 209 210 if (Optional<SVal> V = getSValForVar(CondVarExpr, N)) 211 if (auto CI = V->getAs<nonloc::ConcreteInt>()) 212 return &CI->getValue(); 213 return None; 214 } 215 216 static bool isVarAnInterestingCondition(const Expr *CondVarExpr, 217 const ExplodedNode *N, 218 const PathSensitiveBugReport *B) { 219 // Even if this condition is marked as interesting, it isn't *that* 220 // interesting if it didn't happen in a nested stackframe, the user could just 221 // follow the arrows. 222 if (!B->getErrorNode()->getStackFrame()->isParentOf(N->getStackFrame())) 223 return false; 224 225 if (Optional<SVal> V = getSValForVar(CondVarExpr, N)) 226 if (Optional<bugreporter::TrackingKind> K = B->getInterestingnessKind(*V)) 227 return *K == bugreporter::TrackingKind::Condition; 228 229 return false; 230 } 231 232 static bool isInterestingExpr(const Expr *E, const ExplodedNode *N, 233 const PathSensitiveBugReport *B) { 234 if (Optional<SVal> V = getSValForVar(E, N)) 235 return B->getInterestingnessKind(*V).hasValue(); 236 return false; 237 } 238 239 /// \return name of the macro inside the location \p Loc. 240 static StringRef getMacroName(SourceLocation Loc, 241 BugReporterContext &BRC) { 242 return Lexer::getImmediateMacroName( 243 Loc, 244 BRC.getSourceManager(), 245 BRC.getASTContext().getLangOpts()); 246 } 247 248 /// \return Whether given spelling location corresponds to an expansion 249 /// of a function-like macro. 250 static bool isFunctionMacroExpansion(SourceLocation Loc, 251 const SourceManager &SM) { 252 if (!Loc.isMacroID()) 253 return false; 254 while (SM.isMacroArgExpansion(Loc)) 255 Loc = SM.getImmediateExpansionRange(Loc).getBegin(); 256 std::pair<FileID, unsigned> TLInfo = SM.getDecomposedLoc(Loc); 257 SrcMgr::SLocEntry SE = SM.getSLocEntry(TLInfo.first); 258 const SrcMgr::ExpansionInfo &EInfo = SE.getExpansion(); 259 return EInfo.isFunctionMacroExpansion(); 260 } 261 262 /// \return Whether \c RegionOfInterest was modified at \p N, 263 /// where \p ValueAfter is \c RegionOfInterest's value at the end of the 264 /// stack frame. 265 static bool wasRegionOfInterestModifiedAt(const SubRegion *RegionOfInterest, 266 const ExplodedNode *N, 267 SVal ValueAfter) { 268 ProgramStateRef State = N->getState(); 269 ProgramStateManager &Mgr = N->getState()->getStateManager(); 270 271 if (!N->getLocationAs<PostStore>() && !N->getLocationAs<PostInitializer>() && 272 !N->getLocationAs<PostStmt>()) 273 return false; 274 275 // Writing into region of interest. 276 if (auto PS = N->getLocationAs<PostStmt>()) 277 if (auto *BO = PS->getStmtAs<BinaryOperator>()) 278 if (BO->isAssignmentOp() && RegionOfInterest->isSubRegionOf( 279 N->getSVal(BO->getLHS()).getAsRegion())) 280 return true; 281 282 // SVal after the state is possibly different. 283 SVal ValueAtN = N->getState()->getSVal(RegionOfInterest); 284 if (!Mgr.getSValBuilder() 285 .areEqual(State, ValueAtN, ValueAfter) 286 .isConstrainedTrue() && 287 (!ValueAtN.isUndef() || !ValueAfter.isUndef())) 288 return true; 289 290 return false; 291 } 292 293 //===----------------------------------------------------------------------===// 294 // Implementation of BugReporterVisitor. 295 //===----------------------------------------------------------------------===// 296 297 PathDiagnosticPieceRef BugReporterVisitor::getEndPath(BugReporterContext &, 298 const ExplodedNode *, 299 PathSensitiveBugReport &) { 300 return nullptr; 301 } 302 303 void BugReporterVisitor::finalizeVisitor(BugReporterContext &, 304 const ExplodedNode *, 305 PathSensitiveBugReport &) {} 306 307 PathDiagnosticPieceRef 308 BugReporterVisitor::getDefaultEndPath(const BugReporterContext &BRC, 309 const ExplodedNode *EndPathNode, 310 const PathSensitiveBugReport &BR) { 311 PathDiagnosticLocation L = BR.getLocation(); 312 const auto &Ranges = BR.getRanges(); 313 314 // Only add the statement itself as a range if we didn't specify any 315 // special ranges for this report. 316 auto P = std::make_shared<PathDiagnosticEventPiece>( 317 L, BR.getDescription(), Ranges.begin() == Ranges.end()); 318 for (SourceRange Range : Ranges) 319 P->addRange(Range); 320 321 return P; 322 } 323 324 //===----------------------------------------------------------------------===// 325 // Implementation of NoStoreFuncVisitor. 326 //===----------------------------------------------------------------------===// 327 328 namespace { 329 330 /// Put a diagnostic on return statement of all inlined functions 331 /// for which the region of interest \p RegionOfInterest was passed into, 332 /// but not written inside, and it has caused an undefined read or a null 333 /// pointer dereference outside. 334 class NoStoreFuncVisitor final : public BugReporterVisitor { 335 const SubRegion *RegionOfInterest; 336 MemRegionManager &MmrMgr; 337 const SourceManager &SM; 338 const PrintingPolicy &PP; 339 bugreporter::TrackingKind TKind; 340 341 /// Recursion limit for dereferencing fields when looking for the 342 /// region of interest. 343 /// The limit of two indicates that we will dereference fields only once. 344 static const unsigned DEREFERENCE_LIMIT = 2; 345 346 /// Frames writing into \c RegionOfInterest. 347 /// This visitor generates a note only if a function does not write into 348 /// a region of interest. This information is not immediately available 349 /// by looking at the node associated with the exit from the function 350 /// (usually the return statement). To avoid recomputing the same information 351 /// many times (going up the path for each node and checking whether the 352 /// region was written into) we instead lazily compute the 353 /// stack frames along the path which write into the region of interest. 354 llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingRegion; 355 llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingCalculated; 356 357 using RegionVector = SmallVector<const MemRegion *, 5>; 358 359 public: 360 NoStoreFuncVisitor(const SubRegion *R, bugreporter::TrackingKind TKind) 361 : RegionOfInterest(R), MmrMgr(*R->getMemRegionManager()), 362 SM(MmrMgr.getContext().getSourceManager()), 363 PP(MmrMgr.getContext().getPrintingPolicy()), TKind(TKind) {} 364 365 void Profile(llvm::FoldingSetNodeID &ID) const override { 366 static int Tag = 0; 367 ID.AddPointer(&Tag); 368 ID.AddPointer(RegionOfInterest); 369 } 370 371 void *getTag() const { 372 static int Tag = 0; 373 return static_cast<void *>(&Tag); 374 } 375 376 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, 377 BugReporterContext &BR, 378 PathSensitiveBugReport &R) override; 379 380 private: 381 /// Attempts to find the region of interest in a given record decl, 382 /// by either following the base classes or fields. 383 /// Dereferences fields up to a given recursion limit. 384 /// Note that \p Vec is passed by value, leading to quadratic copying cost, 385 /// but it's OK in practice since its length is limited to DEREFERENCE_LIMIT. 386 /// \return A chain fields leading to the region of interest or None. 387 const Optional<RegionVector> 388 findRegionOfInterestInRecord(const RecordDecl *RD, ProgramStateRef State, 389 const MemRegion *R, const RegionVector &Vec = {}, 390 int depth = 0); 391 392 /// Check and lazily calculate whether the region of interest is 393 /// modified in the stack frame to which \p N belongs. 394 /// The calculation is cached in FramesModifyingRegion. 395 bool isRegionOfInterestModifiedInFrame(const ExplodedNode *N) { 396 const LocationContext *Ctx = N->getLocationContext(); 397 const StackFrameContext *SCtx = Ctx->getStackFrame(); 398 if (!FramesModifyingCalculated.count(SCtx)) 399 findModifyingFrames(N); 400 return FramesModifyingRegion.count(SCtx); 401 } 402 403 /// Write to \c FramesModifyingRegion all stack frames along 404 /// the path in the current stack frame which modify \c RegionOfInterest. 405 void findModifyingFrames(const ExplodedNode *N); 406 407 /// Consume the information on the no-store stack frame in order to 408 /// either emit a note or suppress the report enirely. 409 /// \return Diagnostics piece for region not modified in the current function, 410 /// if it decides to emit one. 411 PathDiagnosticPieceRef 412 maybeEmitNote(PathSensitiveBugReport &R, const CallEvent &Call, 413 const ExplodedNode *N, const RegionVector &FieldChain, 414 const MemRegion *MatchedRegion, StringRef FirstElement, 415 bool FirstIsReferenceType, unsigned IndirectionLevel); 416 417 /// Pretty-print region \p MatchedRegion to \p os. 418 /// \return Whether printing succeeded. 419 bool prettyPrintRegionName(StringRef FirstElement, bool FirstIsReferenceType, 420 const MemRegion *MatchedRegion, 421 const RegionVector &FieldChain, 422 int IndirectionLevel, 423 llvm::raw_svector_ostream &os); 424 425 /// Print first item in the chain, return new separator. 426 static StringRef prettyPrintFirstElement(StringRef FirstElement, 427 bool MoreItemsExpected, 428 int IndirectionLevel, 429 llvm::raw_svector_ostream &os); 430 }; 431 432 } // end of anonymous namespace 433 434 /// \return Whether the method declaration \p Parent 435 /// syntactically has a binary operation writing into the ivar \p Ivar. 436 static bool potentiallyWritesIntoIvar(const Decl *Parent, 437 const ObjCIvarDecl *Ivar) { 438 using namespace ast_matchers; 439 const char *IvarBind = "Ivar"; 440 if (!Parent || !Parent->hasBody()) 441 return false; 442 StatementMatcher WriteIntoIvarM = binaryOperator( 443 hasOperatorName("="), 444 hasLHS(ignoringParenImpCasts( 445 objcIvarRefExpr(hasDeclaration(equalsNode(Ivar))).bind(IvarBind)))); 446 StatementMatcher ParentM = stmt(hasDescendant(WriteIntoIvarM)); 447 auto Matches = match(ParentM, *Parent->getBody(), Parent->getASTContext()); 448 for (BoundNodes &Match : Matches) { 449 auto IvarRef = Match.getNodeAs<ObjCIvarRefExpr>(IvarBind); 450 if (IvarRef->isFreeIvar()) 451 return true; 452 453 const Expr *Base = IvarRef->getBase(); 454 if (const auto *ICE = dyn_cast<ImplicitCastExpr>(Base)) 455 Base = ICE->getSubExpr(); 456 457 if (const auto *DRE = dyn_cast<DeclRefExpr>(Base)) 458 if (const auto *ID = dyn_cast<ImplicitParamDecl>(DRE->getDecl())) 459 if (ID->getParameterKind() == ImplicitParamDecl::ObjCSelf) 460 return true; 461 462 return false; 463 } 464 return false; 465 } 466 467 /// Get parameters associated with runtime definition in order 468 /// to get the correct parameter name. 469 static ArrayRef<ParmVarDecl *> getCallParameters(CallEventRef<> Call) { 470 // Use runtime definition, if available. 471 RuntimeDefinition RD = Call->getRuntimeDefinition(); 472 if (const auto *FD = dyn_cast_or_null<FunctionDecl>(RD.getDecl())) 473 return FD->parameters(); 474 if (const auto *MD = dyn_cast_or_null<ObjCMethodDecl>(RD.getDecl())) 475 return MD->parameters(); 476 477 return Call->parameters(); 478 } 479 480 /// \return whether \p Ty points to a const type, or is a const reference. 481 static bool isPointerToConst(QualType Ty) { 482 return !Ty->getPointeeType().isNull() && 483 Ty->getPointeeType().getCanonicalType().isConstQualified(); 484 } 485 486 /// Attempts to find the region of interest in a given CXX decl, 487 /// by either following the base classes or fields. 488 /// Dereferences fields up to a given recursion limit. 489 /// Note that \p Vec is passed by value, leading to quadratic copying cost, 490 /// but it's OK in practice since its length is limited to DEREFERENCE_LIMIT. 491 /// \return A chain fields leading to the region of interest or None. 492 const Optional<NoStoreFuncVisitor::RegionVector> 493 NoStoreFuncVisitor::findRegionOfInterestInRecord( 494 const RecordDecl *RD, ProgramStateRef State, const MemRegion *R, 495 const NoStoreFuncVisitor::RegionVector &Vec /* = {} */, 496 int depth /* = 0 */) { 497 498 if (depth == DEREFERENCE_LIMIT) // Limit the recursion depth. 499 return None; 500 501 if (const auto *RDX = dyn_cast<CXXRecordDecl>(RD)) 502 if (!RDX->hasDefinition()) 503 return None; 504 505 // Recursively examine the base classes. 506 // Note that following base classes does not increase the recursion depth. 507 if (const auto *RDX = dyn_cast<CXXRecordDecl>(RD)) 508 for (const auto &II : RDX->bases()) 509 if (const RecordDecl *RRD = II.getType()->getAsRecordDecl()) 510 if (Optional<RegionVector> Out = 511 findRegionOfInterestInRecord(RRD, State, R, Vec, depth)) 512 return Out; 513 514 for (const FieldDecl *I : RD->fields()) { 515 QualType FT = I->getType(); 516 const FieldRegion *FR = MmrMgr.getFieldRegion(I, cast<SubRegion>(R)); 517 const SVal V = State->getSVal(FR); 518 const MemRegion *VR = V.getAsRegion(); 519 520 RegionVector VecF = Vec; 521 VecF.push_back(FR); 522 523 if (RegionOfInterest == VR) 524 return VecF; 525 526 if (const RecordDecl *RRD = FT->getAsRecordDecl()) 527 if (auto Out = 528 findRegionOfInterestInRecord(RRD, State, FR, VecF, depth + 1)) 529 return Out; 530 531 QualType PT = FT->getPointeeType(); 532 if (PT.isNull() || PT->isVoidType() || !VR) 533 continue; 534 535 if (const RecordDecl *RRD = PT->getAsRecordDecl()) 536 if (Optional<RegionVector> Out = 537 findRegionOfInterestInRecord(RRD, State, VR, VecF, depth + 1)) 538 return Out; 539 } 540 541 return None; 542 } 543 544 PathDiagnosticPieceRef 545 NoStoreFuncVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BR, 546 PathSensitiveBugReport &R) { 547 548 const LocationContext *Ctx = N->getLocationContext(); 549 const StackFrameContext *SCtx = Ctx->getStackFrame(); 550 ProgramStateRef State = N->getState(); 551 auto CallExitLoc = N->getLocationAs<CallExitBegin>(); 552 553 // No diagnostic if region was modified inside the frame. 554 if (!CallExitLoc || isRegionOfInterestModifiedInFrame(N)) 555 return nullptr; 556 557 CallEventRef<> Call = 558 BR.getStateManager().getCallEventManager().getCaller(SCtx, State); 559 560 // Region of interest corresponds to an IVar, exiting a method 561 // which could have written into that IVar, but did not. 562 if (const auto *MC = dyn_cast<ObjCMethodCall>(Call)) { 563 if (const auto *IvarR = dyn_cast<ObjCIvarRegion>(RegionOfInterest)) { 564 const MemRegion *SelfRegion = MC->getReceiverSVal().getAsRegion(); 565 if (RegionOfInterest->isSubRegionOf(SelfRegion) && 566 potentiallyWritesIntoIvar(Call->getRuntimeDefinition().getDecl(), 567 IvarR->getDecl())) 568 return maybeEmitNote(R, *Call, N, {}, SelfRegion, "self", 569 /*FirstIsReferenceType=*/false, 1); 570 } 571 } 572 573 if (const auto *CCall = dyn_cast<CXXConstructorCall>(Call)) { 574 const MemRegion *ThisR = CCall->getCXXThisVal().getAsRegion(); 575 if (RegionOfInterest->isSubRegionOf(ThisR) && 576 !CCall->getDecl()->isImplicit()) 577 return maybeEmitNote(R, *Call, N, {}, ThisR, "this", 578 /*FirstIsReferenceType=*/false, 1); 579 580 // Do not generate diagnostics for not modified parameters in 581 // constructors. 582 return nullptr; 583 } 584 585 ArrayRef<ParmVarDecl *> parameters = getCallParameters(Call); 586 for (unsigned I = 0; I < Call->getNumArgs() && I < parameters.size(); ++I) { 587 const ParmVarDecl *PVD = parameters[I]; 588 SVal V = Call->getArgSVal(I); 589 bool ParamIsReferenceType = PVD->getType()->isReferenceType(); 590 std::string ParamName = PVD->getNameAsString(); 591 592 int IndirectionLevel = 1; 593 QualType T = PVD->getType(); 594 while (const MemRegion *MR = V.getAsRegion()) { 595 if (RegionOfInterest->isSubRegionOf(MR) && !isPointerToConst(T)) 596 return maybeEmitNote(R, *Call, N, {}, MR, ParamName, 597 ParamIsReferenceType, IndirectionLevel); 598 599 QualType PT = T->getPointeeType(); 600 if (PT.isNull() || PT->isVoidType()) 601 break; 602 603 if (const RecordDecl *RD = PT->getAsRecordDecl()) 604 if (Optional<RegionVector> P = 605 findRegionOfInterestInRecord(RD, State, MR)) 606 return maybeEmitNote(R, *Call, N, *P, RegionOfInterest, ParamName, 607 ParamIsReferenceType, IndirectionLevel); 608 609 V = State->getSVal(MR, PT); 610 T = PT; 611 IndirectionLevel++; 612 } 613 } 614 615 return nullptr; 616 } 617 618 void NoStoreFuncVisitor::findModifyingFrames(const ExplodedNode *N) { 619 assert(N->getLocationAs<CallExitBegin>()); 620 ProgramStateRef LastReturnState = N->getState(); 621 SVal ValueAtReturn = LastReturnState->getSVal(RegionOfInterest); 622 const LocationContext *Ctx = N->getLocationContext(); 623 const StackFrameContext *OriginalSCtx = Ctx->getStackFrame(); 624 625 do { 626 ProgramStateRef State = N->getState(); 627 auto CallExitLoc = N->getLocationAs<CallExitBegin>(); 628 if (CallExitLoc) { 629 LastReturnState = State; 630 ValueAtReturn = LastReturnState->getSVal(RegionOfInterest); 631 } 632 633 FramesModifyingCalculated.insert(N->getLocationContext()->getStackFrame()); 634 635 if (wasRegionOfInterestModifiedAt(RegionOfInterest, N, ValueAtReturn)) { 636 const StackFrameContext *SCtx = N->getStackFrame(); 637 while (!SCtx->inTopFrame()) { 638 auto p = FramesModifyingRegion.insert(SCtx); 639 if (!p.second) 640 break; // Frame and all its parents already inserted. 641 SCtx = SCtx->getParent()->getStackFrame(); 642 } 643 } 644 645 // Stop calculation at the call to the current function. 646 if (auto CE = N->getLocationAs<CallEnter>()) 647 if (CE->getCalleeContext() == OriginalSCtx) 648 break; 649 650 N = N->getFirstPred(); 651 } while (N); 652 } 653 654 static llvm::StringLiteral WillBeUsedForACondition = 655 ", which participates in a condition later"; 656 657 PathDiagnosticPieceRef NoStoreFuncVisitor::maybeEmitNote( 658 PathSensitiveBugReport &R, const CallEvent &Call, const ExplodedNode *N, 659 const RegionVector &FieldChain, const MemRegion *MatchedRegion, 660 StringRef FirstElement, bool FirstIsReferenceType, 661 unsigned IndirectionLevel) { 662 // Optimistically suppress uninitialized value bugs that result 663 // from system headers having a chance to initialize the value 664 // but failing to do so. It's too unlikely a system header's fault. 665 // It's much more likely a situation in which the function has a failure 666 // mode that the user decided not to check. If we want to hunt such 667 // omitted checks, we should provide an explicit function-specific note 668 // describing the precondition under which the function isn't supposed to 669 // initialize its out-parameter, and additionally check that such 670 // precondition can actually be fulfilled on the current path. 671 if (Call.isInSystemHeader()) { 672 // We make an exception for system header functions that have no branches. 673 // Such functions unconditionally fail to initialize the variable. 674 // If they call other functions that have more paths within them, 675 // this suppression would still apply when we visit these inner functions. 676 // One common example of a standard function that doesn't ever initialize 677 // its out parameter is operator placement new; it's up to the follow-up 678 // constructor (if any) to initialize the memory. 679 if (!N->getStackFrame()->getCFG()->isLinear()) 680 R.markInvalid(getTag(), nullptr); 681 return nullptr; 682 } 683 684 PathDiagnosticLocation L = 685 PathDiagnosticLocation::create(N->getLocation(), SM); 686 687 // For now this shouldn't trigger, but once it does (as we add more 688 // functions to the body farm), we'll need to decide if these reports 689 // are worth suppressing as well. 690 if (!L.hasValidLocation()) 691 return nullptr; 692 693 SmallString<256> sbuf; 694 llvm::raw_svector_ostream os(sbuf); 695 os << "Returning without writing to '"; 696 697 // Do not generate the note if failed to pretty-print. 698 if (!prettyPrintRegionName(FirstElement, FirstIsReferenceType, MatchedRegion, 699 FieldChain, IndirectionLevel, os)) 700 return nullptr; 701 702 os << "'"; 703 if (TKind == bugreporter::TrackingKind::Condition) 704 os << WillBeUsedForACondition; 705 return std::make_shared<PathDiagnosticEventPiece>(L, os.str()); 706 } 707 708 bool NoStoreFuncVisitor::prettyPrintRegionName(StringRef FirstElement, 709 bool FirstIsReferenceType, 710 const MemRegion *MatchedRegion, 711 const RegionVector &FieldChain, 712 int IndirectionLevel, 713 llvm::raw_svector_ostream &os) { 714 715 if (FirstIsReferenceType) 716 IndirectionLevel--; 717 718 RegionVector RegionSequence; 719 720 // Add the regions in the reverse order, then reverse the resulting array. 721 assert(RegionOfInterest->isSubRegionOf(MatchedRegion)); 722 const MemRegion *R = RegionOfInterest; 723 while (R != MatchedRegion) { 724 RegionSequence.push_back(R); 725 R = cast<SubRegion>(R)->getSuperRegion(); 726 } 727 std::reverse(RegionSequence.begin(), RegionSequence.end()); 728 RegionSequence.append(FieldChain.begin(), FieldChain.end()); 729 730 StringRef Sep; 731 for (const MemRegion *R : RegionSequence) { 732 733 // Just keep going up to the base region. 734 // Element regions may appear due to casts. 735 if (isa<CXXBaseObjectRegion>(R) || isa<CXXTempObjectRegion>(R)) 736 continue; 737 738 if (Sep.empty()) 739 Sep = prettyPrintFirstElement(FirstElement, 740 /*MoreItemsExpected=*/true, 741 IndirectionLevel, os); 742 743 os << Sep; 744 745 // Can only reasonably pretty-print DeclRegions. 746 if (!isa<DeclRegion>(R)) 747 return false; 748 749 const auto *DR = cast<DeclRegion>(R); 750 Sep = DR->getValueType()->isAnyPointerType() ? "->" : "."; 751 DR->getDecl()->getDeclName().print(os, PP); 752 } 753 754 if (Sep.empty()) 755 prettyPrintFirstElement(FirstElement, 756 /*MoreItemsExpected=*/false, IndirectionLevel, os); 757 return true; 758 } 759 760 StringRef NoStoreFuncVisitor::prettyPrintFirstElement( 761 StringRef FirstElement, bool MoreItemsExpected, int IndirectionLevel, 762 llvm::raw_svector_ostream &os) { 763 StringRef Out = "."; 764 765 if (IndirectionLevel > 0 && MoreItemsExpected) { 766 IndirectionLevel--; 767 Out = "->"; 768 } 769 770 if (IndirectionLevel > 0 && MoreItemsExpected) 771 os << "("; 772 773 for (int i = 0; i < IndirectionLevel; i++) 774 os << "*"; 775 os << FirstElement; 776 777 if (IndirectionLevel > 0 && MoreItemsExpected) 778 os << ")"; 779 780 return Out; 781 } 782 783 //===----------------------------------------------------------------------===// 784 // Implementation of MacroNullReturnSuppressionVisitor. 785 //===----------------------------------------------------------------------===// 786 787 namespace { 788 789 /// Suppress null-pointer-dereference bugs where dereferenced null was returned 790 /// the macro. 791 class MacroNullReturnSuppressionVisitor final : public BugReporterVisitor { 792 const SubRegion *RegionOfInterest; 793 const SVal ValueAtDereference; 794 795 // Do not invalidate the reports where the value was modified 796 // after it got assigned to from the macro. 797 bool WasModified = false; 798 799 public: 800 MacroNullReturnSuppressionVisitor(const SubRegion *R, const SVal V) 801 : RegionOfInterest(R), ValueAtDereference(V) {} 802 803 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, 804 BugReporterContext &BRC, 805 PathSensitiveBugReport &BR) override { 806 if (WasModified) 807 return nullptr; 808 809 auto BugPoint = BR.getErrorNode()->getLocation().getAs<StmtPoint>(); 810 if (!BugPoint) 811 return nullptr; 812 813 const SourceManager &SMgr = BRC.getSourceManager(); 814 if (auto Loc = matchAssignment(N)) { 815 if (isFunctionMacroExpansion(*Loc, SMgr)) { 816 std::string MacroName = getMacroName(*Loc, BRC); 817 SourceLocation BugLoc = BugPoint->getStmt()->getBeginLoc(); 818 if (!BugLoc.isMacroID() || getMacroName(BugLoc, BRC) != MacroName) 819 BR.markInvalid(getTag(), MacroName.c_str()); 820 } 821 } 822 823 if (wasRegionOfInterestModifiedAt(RegionOfInterest, N, ValueAtDereference)) 824 WasModified = true; 825 826 return nullptr; 827 } 828 829 static void addMacroVisitorIfNecessary( 830 const ExplodedNode *N, const MemRegion *R, 831 bool EnableNullFPSuppression, PathSensitiveBugReport &BR, 832 const SVal V) { 833 AnalyzerOptions &Options = N->getState()->getAnalysisManager().options; 834 if (EnableNullFPSuppression && 835 Options.ShouldSuppressNullReturnPaths && V.getAs<Loc>()) 836 BR.addVisitor(std::make_unique<MacroNullReturnSuppressionVisitor>( 837 R->getAs<SubRegion>(), V)); 838 } 839 840 void* getTag() const { 841 static int Tag = 0; 842 return static_cast<void *>(&Tag); 843 } 844 845 void Profile(llvm::FoldingSetNodeID &ID) const override { 846 ID.AddPointer(getTag()); 847 } 848 849 private: 850 /// \return Source location of right hand side of an assignment 851 /// into \c RegionOfInterest, empty optional if none found. 852 Optional<SourceLocation> matchAssignment(const ExplodedNode *N) { 853 const Stmt *S = N->getStmtForDiagnostics(); 854 ProgramStateRef State = N->getState(); 855 auto *LCtx = N->getLocationContext(); 856 if (!S) 857 return None; 858 859 if (const auto *DS = dyn_cast<DeclStmt>(S)) { 860 if (const auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl())) 861 if (const Expr *RHS = VD->getInit()) 862 if (RegionOfInterest->isSubRegionOf( 863 State->getLValue(VD, LCtx).getAsRegion())) 864 return RHS->getBeginLoc(); 865 } else if (const auto *BO = dyn_cast<BinaryOperator>(S)) { 866 const MemRegion *R = N->getSVal(BO->getLHS()).getAsRegion(); 867 const Expr *RHS = BO->getRHS(); 868 if (BO->isAssignmentOp() && RegionOfInterest->isSubRegionOf(R)) { 869 return RHS->getBeginLoc(); 870 } 871 } 872 return None; 873 } 874 }; 875 876 } // end of anonymous namespace 877 878 namespace { 879 880 /// Emits an extra note at the return statement of an interesting stack frame. 881 /// 882 /// The returned value is marked as an interesting value, and if it's null, 883 /// adds a visitor to track where it became null. 884 /// 885 /// This visitor is intended to be used when another visitor discovers that an 886 /// interesting value comes from an inlined function call. 887 class ReturnVisitor : public BugReporterVisitor { 888 const StackFrameContext *CalleeSFC; 889 enum { 890 Initial, 891 MaybeUnsuppress, 892 Satisfied 893 } Mode = Initial; 894 895 bool EnableNullFPSuppression; 896 bool ShouldInvalidate = true; 897 AnalyzerOptions& Options; 898 bugreporter::TrackingKind TKind; 899 900 public: 901 ReturnVisitor(const StackFrameContext *Frame, bool Suppressed, 902 AnalyzerOptions &Options, bugreporter::TrackingKind TKind) 903 : CalleeSFC(Frame), EnableNullFPSuppression(Suppressed), 904 Options(Options), TKind(TKind) {} 905 906 static void *getTag() { 907 static int Tag = 0; 908 return static_cast<void *>(&Tag); 909 } 910 911 void Profile(llvm::FoldingSetNodeID &ID) const override { 912 ID.AddPointer(ReturnVisitor::getTag()); 913 ID.AddPointer(CalleeSFC); 914 ID.AddBoolean(EnableNullFPSuppression); 915 } 916 917 /// Adds a ReturnVisitor if the given statement represents a call that was 918 /// inlined. 919 /// 920 /// This will search back through the ExplodedGraph, starting from the given 921 /// node, looking for when the given statement was processed. If it turns out 922 /// the statement is a call that was inlined, we add the visitor to the 923 /// bug report, so it can print a note later. 924 static void addVisitorIfNecessary(const ExplodedNode *Node, const Stmt *S, 925 PathSensitiveBugReport &BR, 926 bool InEnableNullFPSuppression, 927 bugreporter::TrackingKind TKind) { 928 if (!CallEvent::isCallStmt(S)) 929 return; 930 931 // First, find when we processed the statement. 932 // If we work with a 'CXXNewExpr' that is going to be purged away before 933 // its call take place. We would catch that purge in the last condition 934 // as a 'StmtPoint' so we have to bypass it. 935 const bool BypassCXXNewExprEval = isa<CXXNewExpr>(S); 936 937 // This is moving forward when we enter into another context. 938 const StackFrameContext *CurrentSFC = Node->getStackFrame(); 939 940 do { 941 // If that is satisfied we found our statement as an inlined call. 942 if (Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>()) 943 if (CEE->getCalleeContext()->getCallSite() == S) 944 break; 945 946 // Try to move forward to the end of the call-chain. 947 Node = Node->getFirstPred(); 948 if (!Node) 949 break; 950 951 const StackFrameContext *PredSFC = Node->getStackFrame(); 952 953 // If that is satisfied we found our statement. 954 // FIXME: This code currently bypasses the call site for the 955 // conservatively evaluated allocator. 956 if (!BypassCXXNewExprEval) 957 if (Optional<StmtPoint> SP = Node->getLocationAs<StmtPoint>()) 958 // See if we do not enter into another context. 959 if (SP->getStmt() == S && CurrentSFC == PredSFC) 960 break; 961 962 CurrentSFC = PredSFC; 963 } while (Node->getStackFrame() == CurrentSFC); 964 965 // Next, step over any post-statement checks. 966 while (Node && Node->getLocation().getAs<PostStmt>()) 967 Node = Node->getFirstPred(); 968 if (!Node) 969 return; 970 971 // Finally, see if we inlined the call. 972 Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>(); 973 if (!CEE) 974 return; 975 976 const StackFrameContext *CalleeContext = CEE->getCalleeContext(); 977 if (CalleeContext->getCallSite() != S) 978 return; 979 980 // Check the return value. 981 ProgramStateRef State = Node->getState(); 982 SVal RetVal = Node->getSVal(S); 983 984 // Handle cases where a reference is returned and then immediately used. 985 if (cast<Expr>(S)->isGLValue()) 986 if (Optional<Loc> LValue = RetVal.getAs<Loc>()) 987 RetVal = State->getSVal(*LValue); 988 989 // See if the return value is NULL. If so, suppress the report. 990 AnalyzerOptions &Options = State->getAnalysisManager().options; 991 992 bool EnableNullFPSuppression = false; 993 if (InEnableNullFPSuppression && 994 Options.ShouldSuppressNullReturnPaths) 995 if (Optional<Loc> RetLoc = RetVal.getAs<Loc>()) 996 EnableNullFPSuppression = State->isNull(*RetLoc).isConstrainedTrue(); 997 998 BR.addVisitor(std::make_unique<ReturnVisitor>(CalleeContext, 999 EnableNullFPSuppression, 1000 Options, TKind)); 1001 } 1002 1003 PathDiagnosticPieceRef visitNodeInitial(const ExplodedNode *N, 1004 BugReporterContext &BRC, 1005 PathSensitiveBugReport &BR) { 1006 // Only print a message at the interesting return statement. 1007 if (N->getLocationContext() != CalleeSFC) 1008 return nullptr; 1009 1010 Optional<StmtPoint> SP = N->getLocationAs<StmtPoint>(); 1011 if (!SP) 1012 return nullptr; 1013 1014 const auto *Ret = dyn_cast<ReturnStmt>(SP->getStmt()); 1015 if (!Ret) 1016 return nullptr; 1017 1018 // Okay, we're at the right return statement, but do we have the return 1019 // value available? 1020 ProgramStateRef State = N->getState(); 1021 SVal V = State->getSVal(Ret, CalleeSFC); 1022 if (V.isUnknownOrUndef()) 1023 return nullptr; 1024 1025 // Don't print any more notes after this one. 1026 Mode = Satisfied; 1027 1028 const Expr *RetE = Ret->getRetValue(); 1029 assert(RetE && "Tracking a return value for a void function"); 1030 1031 // Handle cases where a reference is returned and then immediately used. 1032 Optional<Loc> LValue; 1033 if (RetE->isGLValue()) { 1034 if ((LValue = V.getAs<Loc>())) { 1035 SVal RValue = State->getRawSVal(*LValue, RetE->getType()); 1036 if (RValue.getAs<DefinedSVal>()) 1037 V = RValue; 1038 } 1039 } 1040 1041 // Ignore aggregate rvalues. 1042 if (V.getAs<nonloc::LazyCompoundVal>() || 1043 V.getAs<nonloc::CompoundVal>()) 1044 return nullptr; 1045 1046 RetE = RetE->IgnoreParenCasts(); 1047 1048 // Let's track the return value. 1049 bugreporter::trackExpressionValue( 1050 N, RetE, BR, TKind, EnableNullFPSuppression); 1051 1052 // Build an appropriate message based on the return value. 1053 SmallString<64> Msg; 1054 llvm::raw_svector_ostream Out(Msg); 1055 1056 bool WouldEventBeMeaningless = false; 1057 1058 if (State->isNull(V).isConstrainedTrue()) { 1059 if (V.getAs<Loc>()) { 1060 1061 // If we have counter-suppression enabled, make sure we keep visiting 1062 // future nodes. We want to emit a path note as well, in case 1063 // the report is resurrected as valid later on. 1064 if (EnableNullFPSuppression && 1065 Options.ShouldAvoidSuppressingNullArgumentPaths) 1066 Mode = MaybeUnsuppress; 1067 1068 if (RetE->getType()->isObjCObjectPointerType()) { 1069 Out << "Returning nil"; 1070 } else { 1071 Out << "Returning null pointer"; 1072 } 1073 } else { 1074 Out << "Returning zero"; 1075 } 1076 1077 } else { 1078 if (auto CI = V.getAs<nonloc::ConcreteInt>()) { 1079 Out << "Returning the value " << CI->getValue(); 1080 } else { 1081 // There is nothing interesting about returning a value, when it is 1082 // plain value without any constraints, and the function is guaranteed 1083 // to return that every time. We could use CFG::isLinear() here, but 1084 // constexpr branches are obvious to the compiler, not necesserily to 1085 // the programmer. 1086 if (N->getCFG().size() == 3) 1087 WouldEventBeMeaningless = true; 1088 1089 if (V.getAs<Loc>()) 1090 Out << "Returning pointer"; 1091 else 1092 Out << "Returning value"; 1093 } 1094 } 1095 1096 if (LValue) { 1097 if (const MemRegion *MR = LValue->getAsRegion()) { 1098 if (MR->canPrintPretty()) { 1099 Out << " (reference to "; 1100 MR->printPretty(Out); 1101 Out << ")"; 1102 } 1103 } 1104 } else { 1105 // FIXME: We should have a more generalized location printing mechanism. 1106 if (const auto *DR = dyn_cast<DeclRefExpr>(RetE)) 1107 if (const auto *DD = dyn_cast<DeclaratorDecl>(DR->getDecl())) 1108 Out << " (loaded from '" << *DD << "')"; 1109 } 1110 1111 PathDiagnosticLocation L(Ret, BRC.getSourceManager(), CalleeSFC); 1112 if (!L.isValid() || !L.asLocation().isValid()) 1113 return nullptr; 1114 1115 if (TKind == bugreporter::TrackingKind::Condition) 1116 Out << WillBeUsedForACondition; 1117 1118 auto EventPiece = std::make_shared<PathDiagnosticEventPiece>(L, Out.str()); 1119 1120 // If we determined that the note is meaningless, make it prunable, and 1121 // don't mark the stackframe interesting. 1122 if (WouldEventBeMeaningless) 1123 EventPiece->setPrunable(true); 1124 else 1125 BR.markInteresting(CalleeSFC); 1126 1127 return EventPiece; 1128 } 1129 1130 PathDiagnosticPieceRef visitNodeMaybeUnsuppress(const ExplodedNode *N, 1131 BugReporterContext &BRC, 1132 PathSensitiveBugReport &BR) { 1133 assert(Options.ShouldAvoidSuppressingNullArgumentPaths); 1134 1135 // Are we at the entry node for this call? 1136 Optional<CallEnter> CE = N->getLocationAs<CallEnter>(); 1137 if (!CE) 1138 return nullptr; 1139 1140 if (CE->getCalleeContext() != CalleeSFC) 1141 return nullptr; 1142 1143 Mode = Satisfied; 1144 1145 // Don't automatically suppress a report if one of the arguments is 1146 // known to be a null pointer. Instead, start tracking /that/ null 1147 // value back to its origin. 1148 ProgramStateManager &StateMgr = BRC.getStateManager(); 1149 CallEventManager &CallMgr = StateMgr.getCallEventManager(); 1150 1151 ProgramStateRef State = N->getState(); 1152 CallEventRef<> Call = CallMgr.getCaller(CalleeSFC, State); 1153 for (unsigned I = 0, E = Call->getNumArgs(); I != E; ++I) { 1154 Optional<Loc> ArgV = Call->getArgSVal(I).getAs<Loc>(); 1155 if (!ArgV) 1156 continue; 1157 1158 const Expr *ArgE = Call->getArgExpr(I); 1159 if (!ArgE) 1160 continue; 1161 1162 // Is it possible for this argument to be non-null? 1163 if (!State->isNull(*ArgV).isConstrainedTrue()) 1164 continue; 1165 1166 if (trackExpressionValue(N, ArgE, BR, TKind, EnableNullFPSuppression)) 1167 ShouldInvalidate = false; 1168 1169 // If we /can't/ track the null pointer, we should err on the side of 1170 // false negatives, and continue towards marking this report invalid. 1171 // (We will still look at the other arguments, though.) 1172 } 1173 1174 return nullptr; 1175 } 1176 1177 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, 1178 BugReporterContext &BRC, 1179 PathSensitiveBugReport &BR) override { 1180 switch (Mode) { 1181 case Initial: 1182 return visitNodeInitial(N, BRC, BR); 1183 case MaybeUnsuppress: 1184 return visitNodeMaybeUnsuppress(N, BRC, BR); 1185 case Satisfied: 1186 return nullptr; 1187 } 1188 1189 llvm_unreachable("Invalid visit mode!"); 1190 } 1191 1192 void finalizeVisitor(BugReporterContext &, const ExplodedNode *, 1193 PathSensitiveBugReport &BR) override { 1194 if (EnableNullFPSuppression && ShouldInvalidate) 1195 BR.markInvalid(ReturnVisitor::getTag(), CalleeSFC); 1196 } 1197 }; 1198 1199 } // end of anonymous namespace 1200 1201 //===----------------------------------------------------------------------===// 1202 // Implementation of FindLastStoreBRVisitor. 1203 //===----------------------------------------------------------------------===// 1204 1205 void FindLastStoreBRVisitor::Profile(llvm::FoldingSetNodeID &ID) const { 1206 static int tag = 0; 1207 ID.AddPointer(&tag); 1208 ID.AddPointer(R); 1209 ID.Add(V); 1210 ID.AddInteger(static_cast<int>(TKind)); 1211 ID.AddBoolean(EnableNullFPSuppression); 1212 } 1213 1214 /// Returns true if \p N represents the DeclStmt declaring and initializing 1215 /// \p VR. 1216 static bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR) { 1217 Optional<PostStmt> P = N->getLocationAs<PostStmt>(); 1218 if (!P) 1219 return false; 1220 1221 const DeclStmt *DS = P->getStmtAs<DeclStmt>(); 1222 if (!DS) 1223 return false; 1224 1225 if (DS->getSingleDecl() != VR->getDecl()) 1226 return false; 1227 1228 const MemSpaceRegion *VarSpace = VR->getMemorySpace(); 1229 const auto *FrameSpace = dyn_cast<StackSpaceRegion>(VarSpace); 1230 if (!FrameSpace) { 1231 // If we ever directly evaluate global DeclStmts, this assertion will be 1232 // invalid, but this still seems preferable to silently accepting an 1233 // initialization that may be for a path-sensitive variable. 1234 assert(VR->getDecl()->isStaticLocal() && "non-static stackless VarRegion"); 1235 return true; 1236 } 1237 1238 assert(VR->getDecl()->hasLocalStorage()); 1239 const LocationContext *LCtx = N->getLocationContext(); 1240 return FrameSpace->getStackFrame() == LCtx->getStackFrame(); 1241 } 1242 1243 /// Show diagnostics for initializing or declaring a region \p R with a bad value. 1244 static void showBRDiagnostics(const char *action, llvm::raw_svector_ostream &os, 1245 const MemRegion *R, SVal V, const DeclStmt *DS) { 1246 if (R->canPrintPretty()) { 1247 R->printPretty(os); 1248 os << " "; 1249 } 1250 1251 if (V.getAs<loc::ConcreteInt>()) { 1252 bool b = false; 1253 if (R->isBoundable()) { 1254 if (const auto *TR = dyn_cast<TypedValueRegion>(R)) { 1255 if (TR->getValueType()->isObjCObjectPointerType()) { 1256 os << action << "nil"; 1257 b = true; 1258 } 1259 } 1260 } 1261 if (!b) 1262 os << action << "a null pointer value"; 1263 1264 } else if (auto CVal = V.getAs<nonloc::ConcreteInt>()) { 1265 os << action << CVal->getValue(); 1266 } else if (DS) { 1267 if (V.isUndef()) { 1268 if (isa<VarRegion>(R)) { 1269 const auto *VD = cast<VarDecl>(DS->getSingleDecl()); 1270 if (VD->getInit()) { 1271 os << (R->canPrintPretty() ? "initialized" : "Initializing") 1272 << " to a garbage value"; 1273 } else { 1274 os << (R->canPrintPretty() ? "declared" : "Declaring") 1275 << " without an initial value"; 1276 } 1277 } 1278 } else { 1279 os << (R->canPrintPretty() ? "initialized" : "Initialized") 1280 << " here"; 1281 } 1282 } 1283 } 1284 1285 /// Display diagnostics for passing bad region as a parameter. 1286 static void showBRParamDiagnostics(llvm::raw_svector_ostream& os, 1287 const VarRegion *VR, 1288 SVal V) { 1289 const auto *Param = cast<ParmVarDecl>(VR->getDecl()); 1290 1291 os << "Passing "; 1292 1293 if (V.getAs<loc::ConcreteInt>()) { 1294 if (Param->getType()->isObjCObjectPointerType()) 1295 os << "nil object reference"; 1296 else 1297 os << "null pointer value"; 1298 } else if (V.isUndef()) { 1299 os << "uninitialized value"; 1300 } else if (auto CI = V.getAs<nonloc::ConcreteInt>()) { 1301 os << "the value " << CI->getValue(); 1302 } else { 1303 os << "value"; 1304 } 1305 1306 // Printed parameter indexes are 1-based, not 0-based. 1307 unsigned Idx = Param->getFunctionScopeIndex() + 1; 1308 os << " via " << Idx << llvm::getOrdinalSuffix(Idx) << " parameter"; 1309 if (VR->canPrintPretty()) { 1310 os << " "; 1311 VR->printPretty(os); 1312 } 1313 } 1314 1315 /// Show default diagnostics for storing bad region. 1316 static void showBRDefaultDiagnostics(llvm::raw_svector_ostream &os, 1317 const MemRegion *R, SVal V) { 1318 if (V.getAs<loc::ConcreteInt>()) { 1319 bool b = false; 1320 if (R->isBoundable()) { 1321 if (const auto *TR = dyn_cast<TypedValueRegion>(R)) { 1322 if (TR->getValueType()->isObjCObjectPointerType()) { 1323 os << "nil object reference stored"; 1324 b = true; 1325 } 1326 } 1327 } 1328 if (!b) { 1329 if (R->canPrintPretty()) 1330 os << "Null pointer value stored"; 1331 else 1332 os << "Storing null pointer value"; 1333 } 1334 1335 } else if (V.isUndef()) { 1336 if (R->canPrintPretty()) 1337 os << "Uninitialized value stored"; 1338 else 1339 os << "Storing uninitialized value"; 1340 1341 } else if (auto CV = V.getAs<nonloc::ConcreteInt>()) { 1342 if (R->canPrintPretty()) 1343 os << "The value " << CV->getValue() << " is assigned"; 1344 else 1345 os << "Assigning " << CV->getValue(); 1346 1347 } else { 1348 if (R->canPrintPretty()) 1349 os << "Value assigned"; 1350 else 1351 os << "Assigning value"; 1352 } 1353 1354 if (R->canPrintPretty()) { 1355 os << " to "; 1356 R->printPretty(os); 1357 } 1358 } 1359 1360 PathDiagnosticPieceRef 1361 FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ, 1362 BugReporterContext &BRC, 1363 PathSensitiveBugReport &BR) { 1364 if (Satisfied) 1365 return nullptr; 1366 1367 const ExplodedNode *StoreSite = nullptr; 1368 const ExplodedNode *Pred = Succ->getFirstPred(); 1369 const Expr *InitE = nullptr; 1370 bool IsParam = false; 1371 1372 // First see if we reached the declaration of the region. 1373 if (const auto *VR = dyn_cast<VarRegion>(R)) { 1374 if (isInitializationOfVar(Pred, VR)) { 1375 StoreSite = Pred; 1376 InitE = VR->getDecl()->getInit(); 1377 } 1378 } 1379 1380 // If this is a post initializer expression, initializing the region, we 1381 // should track the initializer expression. 1382 if (Optional<PostInitializer> PIP = Pred->getLocationAs<PostInitializer>()) { 1383 const MemRegion *FieldReg = (const MemRegion *)PIP->getLocationValue(); 1384 if (FieldReg == R) { 1385 StoreSite = Pred; 1386 InitE = PIP->getInitializer()->getInit(); 1387 } 1388 } 1389 1390 // Otherwise, see if this is the store site: 1391 // (1) Succ has this binding and Pred does not, i.e. this is 1392 // where the binding first occurred. 1393 // (2) Succ has this binding and is a PostStore node for this region, i.e. 1394 // the same binding was re-assigned here. 1395 if (!StoreSite) { 1396 if (Succ->getState()->getSVal(R) != V) 1397 return nullptr; 1398 1399 if (hasVisibleUpdate(Pred, Pred->getState()->getSVal(R), Succ, V)) { 1400 Optional<PostStore> PS = Succ->getLocationAs<PostStore>(); 1401 if (!PS || PS->getLocationValue() != R) 1402 return nullptr; 1403 } 1404 1405 StoreSite = Succ; 1406 1407 // If this is an assignment expression, we can track the value 1408 // being assigned. 1409 if (Optional<PostStmt> P = Succ->getLocationAs<PostStmt>()) 1410 if (const BinaryOperator *BO = P->getStmtAs<BinaryOperator>()) 1411 if (BO->isAssignmentOp()) 1412 InitE = BO->getRHS(); 1413 1414 // If this is a call entry, the variable should be a parameter. 1415 // FIXME: Handle CXXThisRegion as well. (This is not a priority because 1416 // 'this' should never be NULL, but this visitor isn't just for NULL and 1417 // UndefinedVal.) 1418 if (Optional<CallEnter> CE = Succ->getLocationAs<CallEnter>()) { 1419 if (const auto *VR = dyn_cast<VarRegion>(R)) { 1420 1421 if (const auto *Param = dyn_cast<ParmVarDecl>(VR->getDecl())) { 1422 ProgramStateManager &StateMgr = BRC.getStateManager(); 1423 CallEventManager &CallMgr = StateMgr.getCallEventManager(); 1424 1425 CallEventRef<> Call = CallMgr.getCaller(CE->getCalleeContext(), 1426 Succ->getState()); 1427 InitE = Call->getArgExpr(Param->getFunctionScopeIndex()); 1428 } else { 1429 // Handle Objective-C 'self'. 1430 assert(isa<ImplicitParamDecl>(VR->getDecl())); 1431 InitE = cast<ObjCMessageExpr>(CE->getCalleeContext()->getCallSite()) 1432 ->getInstanceReceiver()->IgnoreParenCasts(); 1433 } 1434 IsParam = true; 1435 } 1436 } 1437 1438 // If this is a CXXTempObjectRegion, the Expr responsible for its creation 1439 // is wrapped inside of it. 1440 if (const auto *TmpR = dyn_cast<CXXTempObjectRegion>(R)) 1441 InitE = TmpR->getExpr(); 1442 } 1443 1444 if (!StoreSite) 1445 return nullptr; 1446 1447 Satisfied = true; 1448 1449 // If we have an expression that provided the value, try to track where it 1450 // came from. 1451 if (InitE) { 1452 if (!IsParam) 1453 InitE = InitE->IgnoreParenCasts(); 1454 1455 bugreporter::trackExpressionValue( 1456 StoreSite, InitE, BR, TKind, EnableNullFPSuppression); 1457 } 1458 1459 if (TKind == TrackingKind::Condition && 1460 !OriginSFC->isParentOf(StoreSite->getStackFrame())) 1461 return nullptr; 1462 1463 // Okay, we've found the binding. Emit an appropriate message. 1464 SmallString<256> sbuf; 1465 llvm::raw_svector_ostream os(sbuf); 1466 1467 if (Optional<PostStmt> PS = StoreSite->getLocationAs<PostStmt>()) { 1468 const Stmt *S = PS->getStmt(); 1469 const char *action = nullptr; 1470 const auto *DS = dyn_cast<DeclStmt>(S); 1471 const auto *VR = dyn_cast<VarRegion>(R); 1472 1473 if (DS) { 1474 action = R->canPrintPretty() ? "initialized to " : 1475 "Initializing to "; 1476 } else if (isa<BlockExpr>(S)) { 1477 action = R->canPrintPretty() ? "captured by block as " : 1478 "Captured by block as "; 1479 if (VR) { 1480 // See if we can get the BlockVarRegion. 1481 ProgramStateRef State = StoreSite->getState(); 1482 SVal V = StoreSite->getSVal(S); 1483 if (const auto *BDR = 1484 dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) { 1485 if (const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) { 1486 if (auto KV = State->getSVal(OriginalR).getAs<KnownSVal>()) 1487 BR.addVisitor(std::make_unique<FindLastStoreBRVisitor>( 1488 *KV, OriginalR, EnableNullFPSuppression, TKind, OriginSFC)); 1489 } 1490 } 1491 } 1492 } 1493 if (action) 1494 showBRDiagnostics(action, os, R, V, DS); 1495 1496 } else if (StoreSite->getLocation().getAs<CallEnter>()) { 1497 if (const auto *VR = dyn_cast<VarRegion>(R)) 1498 showBRParamDiagnostics(os, VR, V); 1499 } 1500 1501 if (os.str().empty()) 1502 showBRDefaultDiagnostics(os, R, V); 1503 1504 if (TKind == bugreporter::TrackingKind::Condition) 1505 os << WillBeUsedForACondition; 1506 1507 // Construct a new PathDiagnosticPiece. 1508 ProgramPoint P = StoreSite->getLocation(); 1509 PathDiagnosticLocation L; 1510 if (P.getAs<CallEnter>() && InitE) 1511 L = PathDiagnosticLocation(InitE, BRC.getSourceManager(), 1512 P.getLocationContext()); 1513 1514 if (!L.isValid() || !L.asLocation().isValid()) 1515 L = PathDiagnosticLocation::create(P, BRC.getSourceManager()); 1516 1517 if (!L.isValid() || !L.asLocation().isValid()) 1518 return nullptr; 1519 1520 return std::make_shared<PathDiagnosticEventPiece>(L, os.str()); 1521 } 1522 1523 //===----------------------------------------------------------------------===// 1524 // Implementation of TrackConstraintBRVisitor. 1525 //===----------------------------------------------------------------------===// 1526 1527 void TrackConstraintBRVisitor::Profile(llvm::FoldingSetNodeID &ID) const { 1528 static int tag = 0; 1529 ID.AddPointer(&tag); 1530 ID.AddBoolean(Assumption); 1531 ID.Add(Constraint); 1532 } 1533 1534 /// Return the tag associated with this visitor. This tag will be used 1535 /// to make all PathDiagnosticPieces created by this visitor. 1536 const char *TrackConstraintBRVisitor::getTag() { 1537 return "TrackConstraintBRVisitor"; 1538 } 1539 1540 bool TrackConstraintBRVisitor::isUnderconstrained(const ExplodedNode *N) const { 1541 if (IsZeroCheck) 1542 return N->getState()->isNull(Constraint).isUnderconstrained(); 1543 return (bool)N->getState()->assume(Constraint, !Assumption); 1544 } 1545 1546 PathDiagnosticPieceRef TrackConstraintBRVisitor::VisitNode( 1547 const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) { 1548 const ExplodedNode *PrevN = N->getFirstPred(); 1549 if (IsSatisfied) 1550 return nullptr; 1551 1552 // Start tracking after we see the first state in which the value is 1553 // constrained. 1554 if (!IsTrackingTurnedOn) 1555 if (!isUnderconstrained(N)) 1556 IsTrackingTurnedOn = true; 1557 if (!IsTrackingTurnedOn) 1558 return nullptr; 1559 1560 // Check if in the previous state it was feasible for this constraint 1561 // to *not* be true. 1562 if (isUnderconstrained(PrevN)) { 1563 IsSatisfied = true; 1564 1565 // As a sanity check, make sure that the negation of the constraint 1566 // was infeasible in the current state. If it is feasible, we somehow 1567 // missed the transition point. 1568 assert(!isUnderconstrained(N)); 1569 1570 // We found the transition point for the constraint. We now need to 1571 // pretty-print the constraint. (work-in-progress) 1572 SmallString<64> sbuf; 1573 llvm::raw_svector_ostream os(sbuf); 1574 1575 if (Constraint.getAs<Loc>()) { 1576 os << "Assuming pointer value is "; 1577 os << (Assumption ? "non-null" : "null"); 1578 } 1579 1580 if (os.str().empty()) 1581 return nullptr; 1582 1583 // Construct a new PathDiagnosticPiece. 1584 ProgramPoint P = N->getLocation(); 1585 PathDiagnosticLocation L = 1586 PathDiagnosticLocation::create(P, BRC.getSourceManager()); 1587 if (!L.isValid()) 1588 return nullptr; 1589 1590 auto X = std::make_shared<PathDiagnosticEventPiece>(L, os.str()); 1591 X->setTag(getTag()); 1592 return std::move(X); 1593 } 1594 1595 return nullptr; 1596 } 1597 1598 //===----------------------------------------------------------------------===// 1599 // Implementation of SuppressInlineDefensiveChecksVisitor. 1600 //===----------------------------------------------------------------------===// 1601 1602 SuppressInlineDefensiveChecksVisitor:: 1603 SuppressInlineDefensiveChecksVisitor(DefinedSVal Value, const ExplodedNode *N) 1604 : V(Value) { 1605 // Check if the visitor is disabled. 1606 AnalyzerOptions &Options = N->getState()->getAnalysisManager().options; 1607 if (!Options.ShouldSuppressInlinedDefensiveChecks) 1608 IsSatisfied = true; 1609 } 1610 1611 void SuppressInlineDefensiveChecksVisitor::Profile( 1612 llvm::FoldingSetNodeID &ID) const { 1613 static int id = 0; 1614 ID.AddPointer(&id); 1615 ID.Add(V); 1616 } 1617 1618 const char *SuppressInlineDefensiveChecksVisitor::getTag() { 1619 return "IDCVisitor"; 1620 } 1621 1622 PathDiagnosticPieceRef 1623 SuppressInlineDefensiveChecksVisitor::VisitNode(const ExplodedNode *Succ, 1624 BugReporterContext &BRC, 1625 PathSensitiveBugReport &BR) { 1626 const ExplodedNode *Pred = Succ->getFirstPred(); 1627 if (IsSatisfied) 1628 return nullptr; 1629 1630 // Start tracking after we see the first state in which the value is null. 1631 if (!IsTrackingTurnedOn) 1632 if (Succ->getState()->isNull(V).isConstrainedTrue()) 1633 IsTrackingTurnedOn = true; 1634 if (!IsTrackingTurnedOn) 1635 return nullptr; 1636 1637 // Check if in the previous state it was feasible for this value 1638 // to *not* be null. 1639 if (!Pred->getState()->isNull(V).isConstrainedTrue() && 1640 Succ->getState()->isNull(V).isConstrainedTrue()) { 1641 IsSatisfied = true; 1642 1643 // Check if this is inlined defensive checks. 1644 const LocationContext *CurLC = Succ->getLocationContext(); 1645 const LocationContext *ReportLC = BR.getErrorNode()->getLocationContext(); 1646 if (CurLC != ReportLC && !CurLC->isParentOf(ReportLC)) { 1647 BR.markInvalid("Suppress IDC", CurLC); 1648 return nullptr; 1649 } 1650 1651 // Treat defensive checks in function-like macros as if they were an inlined 1652 // defensive check. If the bug location is not in a macro and the 1653 // terminator for the current location is in a macro then suppress the 1654 // warning. 1655 auto BugPoint = BR.getErrorNode()->getLocation().getAs<StmtPoint>(); 1656 1657 if (!BugPoint) 1658 return nullptr; 1659 1660 ProgramPoint CurPoint = Succ->getLocation(); 1661 const Stmt *CurTerminatorStmt = nullptr; 1662 if (auto BE = CurPoint.getAs<BlockEdge>()) { 1663 CurTerminatorStmt = BE->getSrc()->getTerminator().getStmt(); 1664 } else if (auto SP = CurPoint.getAs<StmtPoint>()) { 1665 const Stmt *CurStmt = SP->getStmt(); 1666 if (!CurStmt->getBeginLoc().isMacroID()) 1667 return nullptr; 1668 1669 CFGStmtMap *Map = CurLC->getAnalysisDeclContext()->getCFGStmtMap(); 1670 CurTerminatorStmt = Map->getBlock(CurStmt)->getTerminatorStmt(); 1671 } else { 1672 return nullptr; 1673 } 1674 1675 if (!CurTerminatorStmt) 1676 return nullptr; 1677 1678 SourceLocation TerminatorLoc = CurTerminatorStmt->getBeginLoc(); 1679 if (TerminatorLoc.isMacroID()) { 1680 SourceLocation BugLoc = BugPoint->getStmt()->getBeginLoc(); 1681 1682 // Suppress reports unless we are in that same macro. 1683 if (!BugLoc.isMacroID() || 1684 getMacroName(BugLoc, BRC) != getMacroName(TerminatorLoc, BRC)) { 1685 BR.markInvalid("Suppress Macro IDC", CurLC); 1686 } 1687 return nullptr; 1688 } 1689 } 1690 return nullptr; 1691 } 1692 1693 //===----------------------------------------------------------------------===// 1694 // TrackControlDependencyCondBRVisitor. 1695 //===----------------------------------------------------------------------===// 1696 1697 namespace { 1698 /// Tracks the expressions that are a control dependency of the node that was 1699 /// supplied to the constructor. 1700 /// For example: 1701 /// 1702 /// cond = 1; 1703 /// if (cond) 1704 /// 10 / 0; 1705 /// 1706 /// An error is emitted at line 3. This visitor realizes that the branch 1707 /// on line 2 is a control dependency of line 3, and tracks it's condition via 1708 /// trackExpressionValue(). 1709 class TrackControlDependencyCondBRVisitor final : public BugReporterVisitor { 1710 const ExplodedNode *Origin; 1711 ControlDependencyCalculator ControlDeps; 1712 llvm::SmallSet<const CFGBlock *, 32> VisitedBlocks; 1713 1714 public: 1715 TrackControlDependencyCondBRVisitor(const ExplodedNode *O) 1716 : Origin(O), ControlDeps(&O->getCFG()) {} 1717 1718 void Profile(llvm::FoldingSetNodeID &ID) const override { 1719 static int x = 0; 1720 ID.AddPointer(&x); 1721 } 1722 1723 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, 1724 BugReporterContext &BRC, 1725 PathSensitiveBugReport &BR) override; 1726 }; 1727 } // end of anonymous namespace 1728 1729 static std::shared_ptr<PathDiagnosticEventPiece> 1730 constructDebugPieceForTrackedCondition(const Expr *Cond, 1731 const ExplodedNode *N, 1732 BugReporterContext &BRC) { 1733 1734 if (BRC.getAnalyzerOptions().AnalysisDiagOpt == PD_NONE || 1735 !BRC.getAnalyzerOptions().ShouldTrackConditionsDebug) 1736 return nullptr; 1737 1738 std::string ConditionText = Lexer::getSourceText( 1739 CharSourceRange::getTokenRange(Cond->getSourceRange()), 1740 BRC.getSourceManager(), 1741 BRC.getASTContext().getLangOpts()); 1742 1743 return std::make_shared<PathDiagnosticEventPiece>( 1744 PathDiagnosticLocation::createBegin( 1745 Cond, BRC.getSourceManager(), N->getLocationContext()), 1746 (Twine() + "Tracking condition '" + ConditionText + "'").str()); 1747 } 1748 1749 static bool isAssertlikeBlock(const CFGBlock *B, ASTContext &Context) { 1750 if (B->succ_size() != 2) 1751 return false; 1752 1753 const CFGBlock *Then = B->succ_begin()->getReachableBlock(); 1754 const CFGBlock *Else = (B->succ_begin() + 1)->getReachableBlock(); 1755 1756 if (!Then || !Else) 1757 return false; 1758 1759 if (Then->isInevitablySinking() != Else->isInevitablySinking()) 1760 return true; 1761 1762 // For the following condition the following CFG would be built: 1763 // 1764 // -------------> 1765 // / \ 1766 // [B1] -> [B2] -> [B3] -> [sink] 1767 // assert(A && B || C); \ \ 1768 // -----------> [go on with the execution] 1769 // 1770 // It so happens that CFGBlock::getTerminatorCondition returns 'A' for block 1771 // B1, 'A && B' for B2, and 'A && B || C' for B3. Let's check whether we 1772 // reached the end of the condition! 1773 if (const Stmt *ElseCond = Else->getTerminatorCondition()) 1774 if (const auto *BinOp = dyn_cast<BinaryOperator>(ElseCond)) 1775 if (BinOp->isLogicalOp()) 1776 return isAssertlikeBlock(Else, Context); 1777 1778 return false; 1779 } 1780 1781 PathDiagnosticPieceRef 1782 TrackControlDependencyCondBRVisitor::VisitNode(const ExplodedNode *N, 1783 BugReporterContext &BRC, 1784 PathSensitiveBugReport &BR) { 1785 // We can only reason about control dependencies within the same stack frame. 1786 if (Origin->getStackFrame() != N->getStackFrame()) 1787 return nullptr; 1788 1789 CFGBlock *NB = const_cast<CFGBlock *>(N->getCFGBlock()); 1790 1791 // Skip if we already inspected this block. 1792 if (!VisitedBlocks.insert(NB).second) 1793 return nullptr; 1794 1795 CFGBlock *OriginB = const_cast<CFGBlock *>(Origin->getCFGBlock()); 1796 1797 // TODO: Cache CFGBlocks for each ExplodedNode. 1798 if (!OriginB || !NB) 1799 return nullptr; 1800 1801 if (isAssertlikeBlock(NB, BRC.getASTContext())) 1802 return nullptr; 1803 1804 if (ControlDeps.isControlDependent(OriginB, NB)) { 1805 // We don't really want to explain for range loops. Evidence suggests that 1806 // the only thing that leads to is the addition of calls to operator!=. 1807 if (llvm::isa_and_nonnull<CXXForRangeStmt>(NB->getTerminatorStmt())) 1808 return nullptr; 1809 1810 if (const Expr *Condition = NB->getLastCondition()) { 1811 // Keeping track of the already tracked conditions on a visitor level 1812 // isn't sufficient, because a new visitor is created for each tracked 1813 // expression, hence the BugReport level set. 1814 if (BR.addTrackedCondition(N)) { 1815 bugreporter::trackExpressionValue( 1816 N, Condition, BR, bugreporter::TrackingKind::Condition, 1817 /*EnableNullFPSuppression=*/false); 1818 return constructDebugPieceForTrackedCondition(Condition, N, BRC); 1819 } 1820 } 1821 } 1822 1823 return nullptr; 1824 } 1825 1826 //===----------------------------------------------------------------------===// 1827 // Implementation of trackExpressionValue. 1828 //===----------------------------------------------------------------------===// 1829 1830 static const MemRegion *getLocationRegionIfReference(const Expr *E, 1831 const ExplodedNode *N) { 1832 if (const auto *DR = dyn_cast<DeclRefExpr>(E)) { 1833 if (const auto *VD = dyn_cast<VarDecl>(DR->getDecl())) { 1834 if (!VD->getType()->isReferenceType()) 1835 return nullptr; 1836 ProgramStateManager &StateMgr = N->getState()->getStateManager(); 1837 MemRegionManager &MRMgr = StateMgr.getRegionManager(); 1838 return MRMgr.getVarRegion(VD, N->getLocationContext()); 1839 } 1840 } 1841 1842 // FIXME: This does not handle other kinds of null references, 1843 // for example, references from FieldRegions: 1844 // struct Wrapper { int &ref; }; 1845 // Wrapper w = { *(int *)0 }; 1846 // w.ref = 1; 1847 1848 return nullptr; 1849 } 1850 1851 /// \return A subexpression of {@code Ex} which represents the 1852 /// expression-of-interest. 1853 static const Expr *peelOffOuterExpr(const Expr *Ex, 1854 const ExplodedNode *N) { 1855 Ex = Ex->IgnoreParenCasts(); 1856 if (const auto *FE = dyn_cast<FullExpr>(Ex)) 1857 return peelOffOuterExpr(FE->getSubExpr(), N); 1858 if (const auto *OVE = dyn_cast<OpaqueValueExpr>(Ex)) 1859 return peelOffOuterExpr(OVE->getSourceExpr(), N); 1860 if (const auto *POE = dyn_cast<PseudoObjectExpr>(Ex)) { 1861 const auto *PropRef = dyn_cast<ObjCPropertyRefExpr>(POE->getSyntacticForm()); 1862 if (PropRef && PropRef->isMessagingGetter()) { 1863 const Expr *GetterMessageSend = 1864 POE->getSemanticExpr(POE->getNumSemanticExprs() - 1); 1865 assert(isa<ObjCMessageExpr>(GetterMessageSend->IgnoreParenCasts())); 1866 return peelOffOuterExpr(GetterMessageSend, N); 1867 } 1868 } 1869 1870 // Peel off the ternary operator. 1871 if (const auto *CO = dyn_cast<ConditionalOperator>(Ex)) { 1872 // Find a node where the branching occurred and find out which branch 1873 // we took (true/false) by looking at the ExplodedGraph. 1874 const ExplodedNode *NI = N; 1875 do { 1876 ProgramPoint ProgPoint = NI->getLocation(); 1877 if (Optional<BlockEdge> BE = ProgPoint.getAs<BlockEdge>()) { 1878 const CFGBlock *srcBlk = BE->getSrc(); 1879 if (const Stmt *term = srcBlk->getTerminatorStmt()) { 1880 if (term == CO) { 1881 bool TookTrueBranch = (*(srcBlk->succ_begin()) == BE->getDst()); 1882 if (TookTrueBranch) 1883 return peelOffOuterExpr(CO->getTrueExpr(), N); 1884 else 1885 return peelOffOuterExpr(CO->getFalseExpr(), N); 1886 } 1887 } 1888 } 1889 NI = NI->getFirstPred(); 1890 } while (NI); 1891 } 1892 1893 if (auto *BO = dyn_cast<BinaryOperator>(Ex)) 1894 if (const Expr *SubEx = peelOffPointerArithmetic(BO)) 1895 return peelOffOuterExpr(SubEx, N); 1896 1897 if (auto *UO = dyn_cast<UnaryOperator>(Ex)) { 1898 if (UO->getOpcode() == UO_LNot) 1899 return peelOffOuterExpr(UO->getSubExpr(), N); 1900 1901 // FIXME: There's a hack in our Store implementation that always computes 1902 // field offsets around null pointers as if they are always equal to 0. 1903 // The idea here is to report accesses to fields as null dereferences 1904 // even though the pointer value that's being dereferenced is actually 1905 // the offset of the field rather than exactly 0. 1906 // See the FIXME in StoreManager's getLValueFieldOrIvar() method. 1907 // This code interacts heavily with this hack; otherwise the value 1908 // would not be null at all for most fields, so we'd be unable to track it. 1909 if (UO->getOpcode() == UO_AddrOf && UO->getSubExpr()->isLValue()) 1910 if (const Expr *DerefEx = bugreporter::getDerefExpr(UO->getSubExpr())) 1911 return peelOffOuterExpr(DerefEx, N); 1912 } 1913 1914 return Ex; 1915 } 1916 1917 /// Find the ExplodedNode where the lvalue (the value of 'Ex') 1918 /// was computed. 1919 static const ExplodedNode* findNodeForExpression(const ExplodedNode *N, 1920 const Expr *Inner) { 1921 while (N) { 1922 if (N->getStmtForDiagnostics() == Inner) 1923 return N; 1924 N = N->getFirstPred(); 1925 } 1926 return N; 1927 } 1928 1929 bool bugreporter::trackExpressionValue(const ExplodedNode *InputNode, 1930 const Expr *E, 1931 PathSensitiveBugReport &report, 1932 bugreporter::TrackingKind TKind, 1933 bool EnableNullFPSuppression) { 1934 1935 if (!E || !InputNode) 1936 return false; 1937 1938 const Expr *Inner = peelOffOuterExpr(E, InputNode); 1939 const ExplodedNode *LVNode = findNodeForExpression(InputNode, Inner); 1940 if (!LVNode) 1941 return false; 1942 1943 ProgramStateRef LVState = LVNode->getState(); 1944 const StackFrameContext *SFC = LVNode->getStackFrame(); 1945 1946 // We only track expressions if we believe that they are important. Chances 1947 // are good that control dependencies to the tracking point are also improtant 1948 // because of this, let's explain why we believe control reached this point. 1949 // TODO: Shouldn't we track control dependencies of every bug location, rather 1950 // than only tracked expressions? 1951 if (LVState->getAnalysisManager().getAnalyzerOptions().ShouldTrackConditions) 1952 report.addVisitor(std::make_unique<TrackControlDependencyCondBRVisitor>( 1953 InputNode)); 1954 1955 // The message send could be nil due to the receiver being nil. 1956 // At this point in the path, the receiver should be live since we are at the 1957 // message send expr. If it is nil, start tracking it. 1958 if (const Expr *Receiver = NilReceiverBRVisitor::getNilReceiver(Inner, LVNode)) 1959 trackExpressionValue( 1960 LVNode, Receiver, report, TKind, EnableNullFPSuppression); 1961 1962 // Track the index if this is an array subscript. 1963 if (const auto *Arr = dyn_cast<ArraySubscriptExpr>(Inner)) 1964 trackExpressionValue( 1965 LVNode, Arr->getIdx(), report, TKind, /*EnableNullFPSuppression*/false); 1966 1967 // See if the expression we're interested refers to a variable. 1968 // If so, we can track both its contents and constraints on its value. 1969 if (ExplodedGraph::isInterestingLValueExpr(Inner)) { 1970 SVal LVal = LVNode->getSVal(Inner); 1971 1972 const MemRegion *RR = getLocationRegionIfReference(Inner, LVNode); 1973 bool LVIsNull = LVState->isNull(LVal).isConstrainedTrue(); 1974 1975 // If this is a C++ reference to a null pointer, we are tracking the 1976 // pointer. In addition, we should find the store at which the reference 1977 // got initialized. 1978 if (RR && !LVIsNull) 1979 if (auto KV = LVal.getAs<KnownSVal>()) 1980 report.addVisitor(std::make_unique<FindLastStoreBRVisitor>( 1981 *KV, RR, EnableNullFPSuppression, TKind, SFC)); 1982 1983 // In case of C++ references, we want to differentiate between a null 1984 // reference and reference to null pointer. 1985 // If the LVal is null, check if we are dealing with null reference. 1986 // For those, we want to track the location of the reference. 1987 const MemRegion *R = (RR && LVIsNull) ? RR : 1988 LVNode->getSVal(Inner).getAsRegion(); 1989 1990 if (R) { 1991 1992 // Mark both the variable region and its contents as interesting. 1993 SVal V = LVState->getRawSVal(loc::MemRegionVal(R)); 1994 report.addVisitor( 1995 std::make_unique<NoStoreFuncVisitor>(cast<SubRegion>(R), TKind)); 1996 1997 MacroNullReturnSuppressionVisitor::addMacroVisitorIfNecessary( 1998 LVNode, R, EnableNullFPSuppression, report, V); 1999 2000 report.markInteresting(V, TKind); 2001 report.addVisitor(std::make_unique<UndefOrNullArgVisitor>(R)); 2002 2003 // If the contents are symbolic and null, find out when they became null. 2004 if (V.getAsLocSymbol(/*IncludeBaseRegions=*/true)) 2005 if (LVState->isNull(V).isConstrainedTrue()) 2006 report.addVisitor(std::make_unique<TrackConstraintBRVisitor>( 2007 V.castAs<DefinedSVal>(), false)); 2008 2009 // Add visitor, which will suppress inline defensive checks. 2010 if (auto DV = V.getAs<DefinedSVal>()) 2011 if (!DV->isZeroConstant() && EnableNullFPSuppression) { 2012 // Note that LVNode may be too late (i.e., too far from the InputNode) 2013 // because the lvalue may have been computed before the inlined call 2014 // was evaluated. InputNode may as well be too early here, because 2015 // the symbol is already dead; this, however, is fine because we can 2016 // still find the node in which it collapsed to null previously. 2017 report.addVisitor( 2018 std::make_unique<SuppressInlineDefensiveChecksVisitor>( 2019 *DV, InputNode)); 2020 } 2021 2022 if (auto KV = V.getAs<KnownSVal>()) 2023 report.addVisitor(std::make_unique<FindLastStoreBRVisitor>( 2024 *KV, R, EnableNullFPSuppression, TKind, SFC)); 2025 return true; 2026 } 2027 } 2028 2029 // If the expression is not an "lvalue expression", we can still 2030 // track the constraints on its contents. 2031 SVal V = LVState->getSValAsScalarOrLoc(Inner, LVNode->getLocationContext()); 2032 2033 ReturnVisitor::addVisitorIfNecessary( 2034 LVNode, Inner, report, EnableNullFPSuppression, TKind); 2035 2036 // Is it a symbolic value? 2037 if (auto L = V.getAs<loc::MemRegionVal>()) { 2038 // FIXME: this is a hack for fixing a later crash when attempting to 2039 // dereference a void* pointer. 2040 // We should not try to dereference pointers at all when we don't care 2041 // what is written inside the pointer. 2042 bool CanDereference = true; 2043 if (const auto *SR = L->getRegionAs<SymbolicRegion>()) { 2044 if (SR->getSymbol()->getType()->getPointeeType()->isVoidType()) 2045 CanDereference = false; 2046 } else if (L->getRegionAs<AllocaRegion>()) 2047 CanDereference = false; 2048 2049 // At this point we are dealing with the region's LValue. 2050 // However, if the rvalue is a symbolic region, we should track it as well. 2051 // Try to use the correct type when looking up the value. 2052 SVal RVal; 2053 if (ExplodedGraph::isInterestingLValueExpr(Inner)) 2054 RVal = LVState->getRawSVal(L.getValue(), Inner->getType()); 2055 else if (CanDereference) 2056 RVal = LVState->getSVal(L->getRegion()); 2057 2058 if (CanDereference) { 2059 report.addVisitor( 2060 std::make_unique<UndefOrNullArgVisitor>(L->getRegion())); 2061 2062 if (auto KV = RVal.getAs<KnownSVal>()) 2063 report.addVisitor(std::make_unique<FindLastStoreBRVisitor>( 2064 *KV, L->getRegion(), EnableNullFPSuppression, TKind, SFC)); 2065 } 2066 2067 const MemRegion *RegionRVal = RVal.getAsRegion(); 2068 if (RegionRVal && isa<SymbolicRegion>(RegionRVal)) { 2069 report.markInteresting(RegionRVal, TKind); 2070 report.addVisitor(std::make_unique<TrackConstraintBRVisitor>( 2071 loc::MemRegionVal(RegionRVal), /*assumption=*/false)); 2072 } 2073 } 2074 return true; 2075 } 2076 2077 //===----------------------------------------------------------------------===// 2078 // Implementation of NulReceiverBRVisitor. 2079 //===----------------------------------------------------------------------===// 2080 2081 const Expr *NilReceiverBRVisitor::getNilReceiver(const Stmt *S, 2082 const ExplodedNode *N) { 2083 const auto *ME = dyn_cast<ObjCMessageExpr>(S); 2084 if (!ME) 2085 return nullptr; 2086 if (const Expr *Receiver = ME->getInstanceReceiver()) { 2087 ProgramStateRef state = N->getState(); 2088 SVal V = N->getSVal(Receiver); 2089 if (state->isNull(V).isConstrainedTrue()) 2090 return Receiver; 2091 } 2092 return nullptr; 2093 } 2094 2095 PathDiagnosticPieceRef 2096 NilReceiverBRVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC, 2097 PathSensitiveBugReport &BR) { 2098 Optional<PreStmt> P = N->getLocationAs<PreStmt>(); 2099 if (!P) 2100 return nullptr; 2101 2102 const Stmt *S = P->getStmt(); 2103 const Expr *Receiver = getNilReceiver(S, N); 2104 if (!Receiver) 2105 return nullptr; 2106 2107 llvm::SmallString<256> Buf; 2108 llvm::raw_svector_ostream OS(Buf); 2109 2110 if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) { 2111 OS << "'"; 2112 ME->getSelector().print(OS); 2113 OS << "' not called"; 2114 } 2115 else { 2116 OS << "No method is called"; 2117 } 2118 OS << " because the receiver is nil"; 2119 2120 // The receiver was nil, and hence the method was skipped. 2121 // Register a BugReporterVisitor to issue a message telling us how 2122 // the receiver was null. 2123 bugreporter::trackExpressionValue( 2124 N, Receiver, BR, bugreporter::TrackingKind::Thorough, 2125 /*EnableNullFPSuppression*/ false); 2126 // Issue a message saying that the method was skipped. 2127 PathDiagnosticLocation L(Receiver, BRC.getSourceManager(), 2128 N->getLocationContext()); 2129 return std::make_shared<PathDiagnosticEventPiece>(L, OS.str()); 2130 } 2131 2132 //===----------------------------------------------------------------------===// 2133 // Visitor that tries to report interesting diagnostics from conditions. 2134 //===----------------------------------------------------------------------===// 2135 2136 /// Return the tag associated with this visitor. This tag will be used 2137 /// to make all PathDiagnosticPieces created by this visitor. 2138 const char *ConditionBRVisitor::getTag() { return "ConditionBRVisitor"; } 2139 2140 PathDiagnosticPieceRef 2141 ConditionBRVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC, 2142 PathSensitiveBugReport &BR) { 2143 auto piece = VisitNodeImpl(N, BRC, BR); 2144 if (piece) { 2145 piece->setTag(getTag()); 2146 if (auto *ev = dyn_cast<PathDiagnosticEventPiece>(piece.get())) 2147 ev->setPrunable(true, /* override */ false); 2148 } 2149 return piece; 2150 } 2151 2152 PathDiagnosticPieceRef 2153 ConditionBRVisitor::VisitNodeImpl(const ExplodedNode *N, 2154 BugReporterContext &BRC, 2155 PathSensitiveBugReport &BR) { 2156 ProgramPoint ProgPoint = N->getLocation(); 2157 const std::pair<const ProgramPointTag *, const ProgramPointTag *> &Tags = 2158 ExprEngine::geteagerlyAssumeBinOpBifurcationTags(); 2159 2160 // If an assumption was made on a branch, it should be caught 2161 // here by looking at the state transition. 2162 if (Optional<BlockEdge> BE = ProgPoint.getAs<BlockEdge>()) { 2163 const CFGBlock *SrcBlock = BE->getSrc(); 2164 if (const Stmt *Term = SrcBlock->getTerminatorStmt()) { 2165 // If the tag of the previous node is 'Eagerly Assume...' the current 2166 // 'BlockEdge' has the same constraint information. We do not want to 2167 // report the value as it is just an assumption on the predecessor node 2168 // which will be caught in the next VisitNode() iteration as a 'PostStmt'. 2169 const ProgramPointTag *PreviousNodeTag = 2170 N->getFirstPred()->getLocation().getTag(); 2171 if (PreviousNodeTag == Tags.first || PreviousNodeTag == Tags.second) 2172 return nullptr; 2173 2174 return VisitTerminator(Term, N, SrcBlock, BE->getDst(), BR, BRC); 2175 } 2176 return nullptr; 2177 } 2178 2179 if (Optional<PostStmt> PS = ProgPoint.getAs<PostStmt>()) { 2180 const ProgramPointTag *CurrentNodeTag = PS->getTag(); 2181 if (CurrentNodeTag != Tags.first && CurrentNodeTag != Tags.second) 2182 return nullptr; 2183 2184 bool TookTrue = CurrentNodeTag == Tags.first; 2185 return VisitTrueTest(cast<Expr>(PS->getStmt()), BRC, BR, N, TookTrue); 2186 } 2187 2188 return nullptr; 2189 } 2190 2191 PathDiagnosticPieceRef ConditionBRVisitor::VisitTerminator( 2192 const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk, 2193 const CFGBlock *dstBlk, PathSensitiveBugReport &R, 2194 BugReporterContext &BRC) { 2195 const Expr *Cond = nullptr; 2196 2197 // In the code below, Term is a CFG terminator and Cond is a branch condition 2198 // expression upon which the decision is made on this terminator. 2199 // 2200 // For example, in "if (x == 0)", the "if (x == 0)" statement is a terminator, 2201 // and "x == 0" is the respective condition. 2202 // 2203 // Another example: in "if (x && y)", we've got two terminators and two 2204 // conditions due to short-circuit nature of operator "&&": 2205 // 1. The "if (x && y)" statement is a terminator, 2206 // and "y" is the respective condition. 2207 // 2. Also "x && ..." is another terminator, 2208 // and "x" is its condition. 2209 2210 switch (Term->getStmtClass()) { 2211 // FIXME: Stmt::SwitchStmtClass is worth handling, however it is a bit 2212 // more tricky because there are more than two branches to account for. 2213 default: 2214 return nullptr; 2215 case Stmt::IfStmtClass: 2216 Cond = cast<IfStmt>(Term)->getCond(); 2217 break; 2218 case Stmt::ConditionalOperatorClass: 2219 Cond = cast<ConditionalOperator>(Term)->getCond(); 2220 break; 2221 case Stmt::BinaryOperatorClass: 2222 // When we encounter a logical operator (&& or ||) as a CFG terminator, 2223 // then the condition is actually its LHS; otherwise, we'd encounter 2224 // the parent, such as if-statement, as a terminator. 2225 const auto *BO = cast<BinaryOperator>(Term); 2226 assert(BO->isLogicalOp() && 2227 "CFG terminator is not a short-circuit operator!"); 2228 Cond = BO->getLHS(); 2229 break; 2230 } 2231 2232 Cond = Cond->IgnoreParens(); 2233 2234 // However, when we encounter a logical operator as a branch condition, 2235 // then the condition is actually its RHS, because LHS would be 2236 // the condition for the logical operator terminator. 2237 while (const auto *InnerBO = dyn_cast<BinaryOperator>(Cond)) { 2238 if (!InnerBO->isLogicalOp()) 2239 break; 2240 Cond = InnerBO->getRHS()->IgnoreParens(); 2241 } 2242 2243 assert(Cond); 2244 assert(srcBlk->succ_size() == 2); 2245 const bool TookTrue = *(srcBlk->succ_begin()) == dstBlk; 2246 return VisitTrueTest(Cond, BRC, R, N, TookTrue); 2247 } 2248 2249 PathDiagnosticPieceRef 2250 ConditionBRVisitor::VisitTrueTest(const Expr *Cond, BugReporterContext &BRC, 2251 PathSensitiveBugReport &R, 2252 const ExplodedNode *N, bool TookTrue) { 2253 ProgramStateRef CurrentState = N->getState(); 2254 ProgramStateRef PrevState = N->getFirstPred()->getState(); 2255 const LocationContext *LCtx = N->getLocationContext(); 2256 2257 // If the constraint information is changed between the current and the 2258 // previous program state we assuming the newly seen constraint information. 2259 // If we cannot evaluate the condition (and the constraints are the same) 2260 // the analyzer has no information about the value and just assuming it. 2261 bool IsAssuming = 2262 !BRC.getStateManager().haveEqualConstraints(CurrentState, PrevState) || 2263 CurrentState->getSVal(Cond, LCtx).isUnknownOrUndef(); 2264 2265 // These will be modified in code below, but we need to preserve the original 2266 // values in case we want to throw the generic message. 2267 const Expr *CondTmp = Cond; 2268 bool TookTrueTmp = TookTrue; 2269 2270 while (true) { 2271 CondTmp = CondTmp->IgnoreParenCasts(); 2272 switch (CondTmp->getStmtClass()) { 2273 default: 2274 break; 2275 case Stmt::BinaryOperatorClass: 2276 if (auto P = VisitTrueTest(Cond, cast<BinaryOperator>(CondTmp), 2277 BRC, R, N, TookTrueTmp, IsAssuming)) 2278 return P; 2279 break; 2280 case Stmt::DeclRefExprClass: 2281 if (auto P = VisitTrueTest(Cond, cast<DeclRefExpr>(CondTmp), 2282 BRC, R, N, TookTrueTmp, IsAssuming)) 2283 return P; 2284 break; 2285 case Stmt::MemberExprClass: 2286 if (auto P = VisitTrueTest(Cond, cast<MemberExpr>(CondTmp), 2287 BRC, R, N, TookTrueTmp, IsAssuming)) 2288 return P; 2289 break; 2290 case Stmt::UnaryOperatorClass: { 2291 const auto *UO = cast<UnaryOperator>(CondTmp); 2292 if (UO->getOpcode() == UO_LNot) { 2293 TookTrueTmp = !TookTrueTmp; 2294 CondTmp = UO->getSubExpr(); 2295 continue; 2296 } 2297 break; 2298 } 2299 } 2300 break; 2301 } 2302 2303 // Condition too complex to explain? Just say something so that the user 2304 // knew we've made some path decision at this point. 2305 // If it is too complex and we know the evaluation of the condition do not 2306 // repeat the note from 'BugReporter.cpp' 2307 if (!IsAssuming) 2308 return nullptr; 2309 2310 PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx); 2311 if (!Loc.isValid() || !Loc.asLocation().isValid()) 2312 return nullptr; 2313 2314 return std::make_shared<PathDiagnosticEventPiece>( 2315 Loc, TookTrue ? GenericTrueMessage : GenericFalseMessage); 2316 } 2317 2318 bool ConditionBRVisitor::patternMatch(const Expr *Ex, 2319 const Expr *ParentEx, 2320 raw_ostream &Out, 2321 BugReporterContext &BRC, 2322 PathSensitiveBugReport &report, 2323 const ExplodedNode *N, 2324 Optional<bool> &prunable, 2325 bool IsSameFieldName) { 2326 const Expr *OriginalExpr = Ex; 2327 Ex = Ex->IgnoreParenCasts(); 2328 2329 if (isa<GNUNullExpr>(Ex) || isa<ObjCBoolLiteralExpr>(Ex) || 2330 isa<CXXBoolLiteralExpr>(Ex) || isa<IntegerLiteral>(Ex) || 2331 isa<FloatingLiteral>(Ex)) { 2332 // Use heuristics to determine if the expression is a macro 2333 // expanding to a literal and if so, use the macro's name. 2334 SourceLocation BeginLoc = OriginalExpr->getBeginLoc(); 2335 SourceLocation EndLoc = OriginalExpr->getEndLoc(); 2336 if (BeginLoc.isMacroID() && EndLoc.isMacroID()) { 2337 const SourceManager &SM = BRC.getSourceManager(); 2338 const LangOptions &LO = BRC.getASTContext().getLangOpts(); 2339 if (Lexer::isAtStartOfMacroExpansion(BeginLoc, SM, LO) && 2340 Lexer::isAtEndOfMacroExpansion(EndLoc, SM, LO)) { 2341 CharSourceRange R = Lexer::getAsCharRange({BeginLoc, EndLoc}, SM, LO); 2342 Out << Lexer::getSourceText(R, SM, LO); 2343 return false; 2344 } 2345 } 2346 } 2347 2348 if (const auto *DR = dyn_cast<DeclRefExpr>(Ex)) { 2349 const bool quotes = isa<VarDecl>(DR->getDecl()); 2350 if (quotes) { 2351 Out << '\''; 2352 const LocationContext *LCtx = N->getLocationContext(); 2353 const ProgramState *state = N->getState().get(); 2354 if (const MemRegion *R = state->getLValue(cast<VarDecl>(DR->getDecl()), 2355 LCtx).getAsRegion()) { 2356 if (report.isInteresting(R)) 2357 prunable = false; 2358 else { 2359 const ProgramState *state = N->getState().get(); 2360 SVal V = state->getSVal(R); 2361 if (report.isInteresting(V)) 2362 prunable = false; 2363 } 2364 } 2365 } 2366 Out << DR->getDecl()->getDeclName().getAsString(); 2367 if (quotes) 2368 Out << '\''; 2369 return quotes; 2370 } 2371 2372 if (const auto *IL = dyn_cast<IntegerLiteral>(Ex)) { 2373 QualType OriginalTy = OriginalExpr->getType(); 2374 if (OriginalTy->isPointerType()) { 2375 if (IL->getValue() == 0) { 2376 Out << "null"; 2377 return false; 2378 } 2379 } 2380 else if (OriginalTy->isObjCObjectPointerType()) { 2381 if (IL->getValue() == 0) { 2382 Out << "nil"; 2383 return false; 2384 } 2385 } 2386 2387 Out << IL->getValue(); 2388 return false; 2389 } 2390 2391 if (const auto *ME = dyn_cast<MemberExpr>(Ex)) { 2392 if (!IsSameFieldName) 2393 Out << "field '" << ME->getMemberDecl()->getName() << '\''; 2394 else 2395 Out << '\'' 2396 << Lexer::getSourceText( 2397 CharSourceRange::getTokenRange(Ex->getSourceRange()), 2398 BRC.getSourceManager(), BRC.getASTContext().getLangOpts(), 0) 2399 << '\''; 2400 } 2401 2402 return false; 2403 } 2404 2405 PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest( 2406 const Expr *Cond, const BinaryOperator *BExpr, BugReporterContext &BRC, 2407 PathSensitiveBugReport &R, const ExplodedNode *N, bool TookTrue, 2408 bool IsAssuming) { 2409 bool shouldInvert = false; 2410 Optional<bool> shouldPrune; 2411 2412 // Check if the field name of the MemberExprs is ambiguous. Example: 2413 // " 'a.d' is equal to 'h.d' " in 'test/Analysis/null-deref-path-notes.cpp'. 2414 bool IsSameFieldName = false; 2415 const auto *LhsME = dyn_cast<MemberExpr>(BExpr->getLHS()->IgnoreParenCasts()); 2416 const auto *RhsME = dyn_cast<MemberExpr>(BExpr->getRHS()->IgnoreParenCasts()); 2417 2418 if (LhsME && RhsME) 2419 IsSameFieldName = 2420 LhsME->getMemberDecl()->getName() == RhsME->getMemberDecl()->getName(); 2421 2422 SmallString<128> LhsString, RhsString; 2423 { 2424 llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString); 2425 const bool isVarLHS = patternMatch(BExpr->getLHS(), BExpr, OutLHS, BRC, R, 2426 N, shouldPrune, IsSameFieldName); 2427 const bool isVarRHS = patternMatch(BExpr->getRHS(), BExpr, OutRHS, BRC, R, 2428 N, shouldPrune, IsSameFieldName); 2429 2430 shouldInvert = !isVarLHS && isVarRHS; 2431 } 2432 2433 BinaryOperator::Opcode Op = BExpr->getOpcode(); 2434 2435 if (BinaryOperator::isAssignmentOp(Op)) { 2436 // For assignment operators, all that we care about is that the LHS 2437 // evaluates to "true" or "false". 2438 return VisitConditionVariable(LhsString, BExpr->getLHS(), BRC, R, N, 2439 TookTrue); 2440 } 2441 2442 // For non-assignment operations, we require that we can understand 2443 // both the LHS and RHS. 2444 if (LhsString.empty() || RhsString.empty() || 2445 !BinaryOperator::isComparisonOp(Op) || Op == BO_Cmp) 2446 return nullptr; 2447 2448 // Should we invert the strings if the LHS is not a variable name? 2449 SmallString<256> buf; 2450 llvm::raw_svector_ostream Out(buf); 2451 Out << (IsAssuming ? "Assuming " : "") 2452 << (shouldInvert ? RhsString : LhsString) << " is "; 2453 2454 // Do we need to invert the opcode? 2455 if (shouldInvert) 2456 switch (Op) { 2457 default: break; 2458 case BO_LT: Op = BO_GT; break; 2459 case BO_GT: Op = BO_LT; break; 2460 case BO_LE: Op = BO_GE; break; 2461 case BO_GE: Op = BO_LE; break; 2462 } 2463 2464 if (!TookTrue) 2465 switch (Op) { 2466 case BO_EQ: Op = BO_NE; break; 2467 case BO_NE: Op = BO_EQ; break; 2468 case BO_LT: Op = BO_GE; break; 2469 case BO_GT: Op = BO_LE; break; 2470 case BO_LE: Op = BO_GT; break; 2471 case BO_GE: Op = BO_LT; break; 2472 default: 2473 return nullptr; 2474 } 2475 2476 switch (Op) { 2477 case BO_EQ: 2478 Out << "equal to "; 2479 break; 2480 case BO_NE: 2481 Out << "not equal to "; 2482 break; 2483 default: 2484 Out << BinaryOperator::getOpcodeStr(Op) << ' '; 2485 break; 2486 } 2487 2488 Out << (shouldInvert ? LhsString : RhsString); 2489 const LocationContext *LCtx = N->getLocationContext(); 2490 const SourceManager &SM = BRC.getSourceManager(); 2491 2492 if (isVarAnInterestingCondition(BExpr->getLHS(), N, &R) || 2493 isVarAnInterestingCondition(BExpr->getRHS(), N, &R)) 2494 Out << WillBeUsedForACondition; 2495 2496 // Convert 'field ...' to 'Field ...' if it is a MemberExpr. 2497 std::string Message = Out.str(); 2498 Message[0] = toupper(Message[0]); 2499 2500 // If we know the value create a pop-up note to the value part of 'BExpr'. 2501 if (!IsAssuming) { 2502 PathDiagnosticLocation Loc; 2503 if (!shouldInvert) { 2504 if (LhsME && LhsME->getMemberLoc().isValid()) 2505 Loc = PathDiagnosticLocation(LhsME->getMemberLoc(), SM); 2506 else 2507 Loc = PathDiagnosticLocation(BExpr->getLHS(), SM, LCtx); 2508 } else { 2509 if (RhsME && RhsME->getMemberLoc().isValid()) 2510 Loc = PathDiagnosticLocation(RhsME->getMemberLoc(), SM); 2511 else 2512 Loc = PathDiagnosticLocation(BExpr->getRHS(), SM, LCtx); 2513 } 2514 2515 return std::make_shared<PathDiagnosticPopUpPiece>(Loc, Message); 2516 } 2517 2518 PathDiagnosticLocation Loc(Cond, SM, LCtx); 2519 auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Message); 2520 if (shouldPrune.hasValue()) 2521 event->setPrunable(shouldPrune.getValue()); 2522 return event; 2523 } 2524 2525 PathDiagnosticPieceRef ConditionBRVisitor::VisitConditionVariable( 2526 StringRef LhsString, const Expr *CondVarExpr, BugReporterContext &BRC, 2527 PathSensitiveBugReport &report, const ExplodedNode *N, bool TookTrue) { 2528 // FIXME: If there's already a constraint tracker for this variable, 2529 // we shouldn't emit anything here (c.f. the double note in 2530 // test/Analysis/inlining/path-notes.c) 2531 SmallString<256> buf; 2532 llvm::raw_svector_ostream Out(buf); 2533 Out << "Assuming " << LhsString << " is "; 2534 2535 if (!printValue(CondVarExpr, Out, N, TookTrue, /*IsAssuming=*/true)) 2536 return nullptr; 2537 2538 const LocationContext *LCtx = N->getLocationContext(); 2539 PathDiagnosticLocation Loc(CondVarExpr, BRC.getSourceManager(), LCtx); 2540 2541 if (isVarAnInterestingCondition(CondVarExpr, N, &report)) 2542 Out << WillBeUsedForACondition; 2543 2544 auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str()); 2545 2546 if (isInterestingExpr(CondVarExpr, N, &report)) 2547 event->setPrunable(false); 2548 2549 return event; 2550 } 2551 2552 PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest( 2553 const Expr *Cond, const DeclRefExpr *DRE, BugReporterContext &BRC, 2554 PathSensitiveBugReport &report, const ExplodedNode *N, bool TookTrue, 2555 bool IsAssuming) { 2556 const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()); 2557 if (!VD) 2558 return nullptr; 2559 2560 SmallString<256> Buf; 2561 llvm::raw_svector_ostream Out(Buf); 2562 2563 Out << (IsAssuming ? "Assuming '" : "'") << VD->getDeclName() << "' is "; 2564 2565 if (!printValue(DRE, Out, N, TookTrue, IsAssuming)) 2566 return nullptr; 2567 2568 const LocationContext *LCtx = N->getLocationContext(); 2569 2570 if (isVarAnInterestingCondition(DRE, N, &report)) 2571 Out << WillBeUsedForACondition; 2572 2573 // If we know the value create a pop-up note to the 'DRE'. 2574 if (!IsAssuming) { 2575 PathDiagnosticLocation Loc(DRE, BRC.getSourceManager(), LCtx); 2576 return std::make_shared<PathDiagnosticPopUpPiece>(Loc, Out.str()); 2577 } 2578 2579 PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx); 2580 auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str()); 2581 2582 if (isInterestingExpr(DRE, N, &report)) 2583 event->setPrunable(false); 2584 2585 return std::move(event); 2586 } 2587 2588 PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest( 2589 const Expr *Cond, const MemberExpr *ME, BugReporterContext &BRC, 2590 PathSensitiveBugReport &report, const ExplodedNode *N, bool TookTrue, 2591 bool IsAssuming) { 2592 SmallString<256> Buf; 2593 llvm::raw_svector_ostream Out(Buf); 2594 2595 Out << (IsAssuming ? "Assuming field '" : "Field '") 2596 << ME->getMemberDecl()->getName() << "' is "; 2597 2598 if (!printValue(ME, Out, N, TookTrue, IsAssuming)) 2599 return nullptr; 2600 2601 const LocationContext *LCtx = N->getLocationContext(); 2602 PathDiagnosticLocation Loc; 2603 2604 // If we know the value create a pop-up note to the member of the MemberExpr. 2605 if (!IsAssuming && ME->getMemberLoc().isValid()) 2606 Loc = PathDiagnosticLocation(ME->getMemberLoc(), BRC.getSourceManager()); 2607 else 2608 Loc = PathDiagnosticLocation(Cond, BRC.getSourceManager(), LCtx); 2609 2610 if (!Loc.isValid() || !Loc.asLocation().isValid()) 2611 return nullptr; 2612 2613 if (isVarAnInterestingCondition(ME, N, &report)) 2614 Out << WillBeUsedForACondition; 2615 2616 // If we know the value create a pop-up note. 2617 if (!IsAssuming) 2618 return std::make_shared<PathDiagnosticPopUpPiece>(Loc, Out.str()); 2619 2620 auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Out.str()); 2621 if (isInterestingExpr(ME, N, &report)) 2622 event->setPrunable(false); 2623 return event; 2624 } 2625 2626 bool ConditionBRVisitor::printValue(const Expr *CondVarExpr, raw_ostream &Out, 2627 const ExplodedNode *N, bool TookTrue, 2628 bool IsAssuming) { 2629 QualType Ty = CondVarExpr->getType(); 2630 2631 if (Ty->isPointerType()) { 2632 Out << (TookTrue ? "non-null" : "null"); 2633 return true; 2634 } 2635 2636 if (Ty->isObjCObjectPointerType()) { 2637 Out << (TookTrue ? "non-nil" : "nil"); 2638 return true; 2639 } 2640 2641 if (!Ty->isIntegralOrEnumerationType()) 2642 return false; 2643 2644 Optional<const llvm::APSInt *> IntValue; 2645 if (!IsAssuming) 2646 IntValue = getConcreteIntegerValue(CondVarExpr, N); 2647 2648 if (IsAssuming || !IntValue.hasValue()) { 2649 if (Ty->isBooleanType()) 2650 Out << (TookTrue ? "true" : "false"); 2651 else 2652 Out << (TookTrue ? "not equal to 0" : "0"); 2653 } else { 2654 if (Ty->isBooleanType()) 2655 Out << (IntValue.getValue()->getBoolValue() ? "true" : "false"); 2656 else 2657 Out << *IntValue.getValue(); 2658 } 2659 2660 return true; 2661 } 2662 2663 constexpr llvm::StringLiteral ConditionBRVisitor::GenericTrueMessage; 2664 constexpr llvm::StringLiteral ConditionBRVisitor::GenericFalseMessage; 2665 2666 bool ConditionBRVisitor::isPieceMessageGeneric( 2667 const PathDiagnosticPiece *Piece) { 2668 return Piece->getString() == GenericTrueMessage || 2669 Piece->getString() == GenericFalseMessage; 2670 } 2671 2672 //===----------------------------------------------------------------------===// 2673 // Implementation of LikelyFalsePositiveSuppressionBRVisitor. 2674 //===----------------------------------------------------------------------===// 2675 2676 void LikelyFalsePositiveSuppressionBRVisitor::finalizeVisitor( 2677 BugReporterContext &BRC, const ExplodedNode *N, 2678 PathSensitiveBugReport &BR) { 2679 // Here we suppress false positives coming from system headers. This list is 2680 // based on known issues. 2681 const AnalyzerOptions &Options = BRC.getAnalyzerOptions(); 2682 const Decl *D = N->getLocationContext()->getDecl(); 2683 2684 if (AnalysisDeclContext::isInStdNamespace(D)) { 2685 // Skip reports within the 'std' namespace. Although these can sometimes be 2686 // the user's fault, we currently don't report them very well, and 2687 // Note that this will not help for any other data structure libraries, like 2688 // TR1, Boost, or llvm/ADT. 2689 if (Options.ShouldSuppressFromCXXStandardLibrary) { 2690 BR.markInvalid(getTag(), nullptr); 2691 return; 2692 } else { 2693 // If the complete 'std' suppression is not enabled, suppress reports 2694 // from the 'std' namespace that are known to produce false positives. 2695 2696 // The analyzer issues a false use-after-free when std::list::pop_front 2697 // or std::list::pop_back are called multiple times because we cannot 2698 // reason about the internal invariants of the data structure. 2699 if (const auto *MD = dyn_cast<CXXMethodDecl>(D)) { 2700 const CXXRecordDecl *CD = MD->getParent(); 2701 if (CD->getName() == "list") { 2702 BR.markInvalid(getTag(), nullptr); 2703 return; 2704 } 2705 } 2706 2707 // The analyzer issues a false positive when the constructor of 2708 // std::__independent_bits_engine from algorithms is used. 2709 if (const auto *MD = dyn_cast<CXXConstructorDecl>(D)) { 2710 const CXXRecordDecl *CD = MD->getParent(); 2711 if (CD->getName() == "__independent_bits_engine") { 2712 BR.markInvalid(getTag(), nullptr); 2713 return; 2714 } 2715 } 2716 2717 for (const LocationContext *LCtx = N->getLocationContext(); LCtx; 2718 LCtx = LCtx->getParent()) { 2719 const auto *MD = dyn_cast<CXXMethodDecl>(LCtx->getDecl()); 2720 if (!MD) 2721 continue; 2722 2723 const CXXRecordDecl *CD = MD->getParent(); 2724 // The analyzer issues a false positive on 2725 // std::basic_string<uint8_t> v; v.push_back(1); 2726 // and 2727 // std::u16string s; s += u'a'; 2728 // because we cannot reason about the internal invariants of the 2729 // data structure. 2730 if (CD->getName() == "basic_string") { 2731 BR.markInvalid(getTag(), nullptr); 2732 return; 2733 } 2734 2735 // The analyzer issues a false positive on 2736 // std::shared_ptr<int> p(new int(1)); p = nullptr; 2737 // because it does not reason properly about temporary destructors. 2738 if (CD->getName() == "shared_ptr") { 2739 BR.markInvalid(getTag(), nullptr); 2740 return; 2741 } 2742 } 2743 } 2744 } 2745 2746 // Skip reports within the sys/queue.h macros as we do not have the ability to 2747 // reason about data structure shapes. 2748 const SourceManager &SM = BRC.getSourceManager(); 2749 FullSourceLoc Loc = BR.getLocation().asLocation(); 2750 while (Loc.isMacroID()) { 2751 Loc = Loc.getSpellingLoc(); 2752 if (SM.getFilename(Loc).endswith("sys/queue.h")) { 2753 BR.markInvalid(getTag(), nullptr); 2754 return; 2755 } 2756 } 2757 } 2758 2759 //===----------------------------------------------------------------------===// 2760 // Implementation of UndefOrNullArgVisitor. 2761 //===----------------------------------------------------------------------===// 2762 2763 PathDiagnosticPieceRef 2764 UndefOrNullArgVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC, 2765 PathSensitiveBugReport &BR) { 2766 ProgramStateRef State = N->getState(); 2767 ProgramPoint ProgLoc = N->getLocation(); 2768 2769 // We are only interested in visiting CallEnter nodes. 2770 Optional<CallEnter> CEnter = ProgLoc.getAs<CallEnter>(); 2771 if (!CEnter) 2772 return nullptr; 2773 2774 // Check if one of the arguments is the region the visitor is tracking. 2775 CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager(); 2776 CallEventRef<> Call = CEMgr.getCaller(CEnter->getCalleeContext(), State); 2777 unsigned Idx = 0; 2778 ArrayRef<ParmVarDecl *> parms = Call->parameters(); 2779 2780 for (const auto ParamDecl : parms) { 2781 const MemRegion *ArgReg = Call->getArgSVal(Idx).getAsRegion(); 2782 ++Idx; 2783 2784 // Are we tracking the argument or its subregion? 2785 if ( !ArgReg || !R->isSubRegionOf(ArgReg->StripCasts())) 2786 continue; 2787 2788 // Check the function parameter type. 2789 assert(ParamDecl && "Formal parameter has no decl?"); 2790 QualType T = ParamDecl->getType(); 2791 2792 if (!(T->isAnyPointerType() || T->isReferenceType())) { 2793 // Function can only change the value passed in by address. 2794 continue; 2795 } 2796 2797 // If it is a const pointer value, the function does not intend to 2798 // change the value. 2799 if (T->getPointeeType().isConstQualified()) 2800 continue; 2801 2802 // Mark the call site (LocationContext) as interesting if the value of the 2803 // argument is undefined or '0'/'NULL'. 2804 SVal BoundVal = State->getSVal(R); 2805 if (BoundVal.isUndef() || BoundVal.isZeroConstant()) { 2806 BR.markInteresting(CEnter->getCalleeContext()); 2807 return nullptr; 2808 } 2809 } 2810 return nullptr; 2811 } 2812 2813 //===----------------------------------------------------------------------===// 2814 // Implementation of FalsePositiveRefutationBRVisitor. 2815 //===----------------------------------------------------------------------===// 2816 2817 FalsePositiveRefutationBRVisitor::FalsePositiveRefutationBRVisitor() 2818 : Constraints(ConstraintRangeTy::Factory().getEmptyMap()) {} 2819 2820 void FalsePositiveRefutationBRVisitor::finalizeVisitor( 2821 BugReporterContext &BRC, const ExplodedNode *EndPathNode, 2822 PathSensitiveBugReport &BR) { 2823 // Collect new constraints 2824 VisitNode(EndPathNode, BRC, BR); 2825 2826 // Create a refutation manager 2827 llvm::SMTSolverRef RefutationSolver = llvm::CreateZ3Solver(); 2828 ASTContext &Ctx = BRC.getASTContext(); 2829 2830 // Add constraints to the solver 2831 for (const auto &I : Constraints) { 2832 const SymbolRef Sym = I.first; 2833 auto RangeIt = I.second.begin(); 2834 2835 llvm::SMTExprRef Constraints = SMTConv::getRangeExpr( 2836 RefutationSolver, Ctx, Sym, RangeIt->From(), RangeIt->To(), 2837 /*InRange=*/true); 2838 while ((++RangeIt) != I.second.end()) { 2839 Constraints = RefutationSolver->mkOr( 2840 Constraints, SMTConv::getRangeExpr(RefutationSolver, Ctx, Sym, 2841 RangeIt->From(), RangeIt->To(), 2842 /*InRange=*/true)); 2843 } 2844 2845 RefutationSolver->addConstraint(Constraints); 2846 } 2847 2848 // And check for satisfiability 2849 Optional<bool> isSat = RefutationSolver->check(); 2850 if (!isSat.hasValue()) 2851 return; 2852 2853 if (!isSat.getValue()) 2854 BR.markInvalid("Infeasible constraints", EndPathNode->getLocationContext()); 2855 } 2856 2857 PathDiagnosticPieceRef FalsePositiveRefutationBRVisitor::VisitNode( 2858 const ExplodedNode *N, BugReporterContext &, PathSensitiveBugReport &) { 2859 // Collect new constraints 2860 const ConstraintRangeTy &NewCs = N->getState()->get<ConstraintRange>(); 2861 ConstraintRangeTy::Factory &CF = 2862 N->getState()->get_context<ConstraintRange>(); 2863 2864 // Add constraints if we don't have them yet 2865 for (auto const &C : NewCs) { 2866 const SymbolRef &Sym = C.first; 2867 if (!Constraints.contains(Sym)) { 2868 Constraints = CF.add(Constraints, Sym, C.second); 2869 } 2870 } 2871 2872 return nullptr; 2873 } 2874 2875 void FalsePositiveRefutationBRVisitor::Profile( 2876 llvm::FoldingSetNodeID &ID) const { 2877 static int Tag = 0; 2878 ID.AddPointer(&Tag); 2879 } 2880 2881 //===----------------------------------------------------------------------===// 2882 // Implementation of TagVisitor. 2883 //===----------------------------------------------------------------------===// 2884 2885 int NoteTag::Kind = 0; 2886 2887 void TagVisitor::Profile(llvm::FoldingSetNodeID &ID) const { 2888 static int Tag = 0; 2889 ID.AddPointer(&Tag); 2890 } 2891 2892 PathDiagnosticPieceRef TagVisitor::VisitNode(const ExplodedNode *N, 2893 BugReporterContext &BRC, 2894 PathSensitiveBugReport &R) { 2895 ProgramPoint PP = N->getLocation(); 2896 const NoteTag *T = dyn_cast_or_null<NoteTag>(PP.getTag()); 2897 if (!T) 2898 return nullptr; 2899 2900 if (Optional<std::string> Msg = T->generateMessage(BRC, R)) { 2901 PathDiagnosticLocation Loc = 2902 PathDiagnosticLocation::create(PP, BRC.getSourceManager()); 2903 auto Piece = std::make_shared<PathDiagnosticEventPiece>(Loc, *Msg); 2904 Piece->setPrunable(T->isPrunable()); 2905 return Piece; 2906 } 2907 2908 return nullptr; 2909 } 2910