1 //=- AnalysisBasedWarnings.cpp - Sema warnings based on libAnalysis -*- C++ -*-=// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file defines analysis_warnings::[Policy,Executor]. 11 // Together they are used by Sema to issue warnings based on inexpensive 12 // static analysis algorithms in libAnalysis. 13 // 14 //===----------------------------------------------------------------------===// 15 16 #include "clang/Sema/AnalysisBasedWarnings.h" 17 #include "clang/AST/DeclCXX.h" 18 #include "clang/AST/DeclObjC.h" 19 #include "clang/AST/EvaluatedExprVisitor.h" 20 #include "clang/AST/ExprCXX.h" 21 #include "clang/AST/ExprObjC.h" 22 #include "clang/AST/ParentMap.h" 23 #include "clang/AST/RecursiveASTVisitor.h" 24 #include "clang/AST/StmtCXX.h" 25 #include "clang/AST/StmtObjC.h" 26 #include "clang/AST/StmtVisitor.h" 27 #include "clang/Analysis/Analyses/CFGReachabilityAnalysis.h" 28 #include "clang/Analysis/Analyses/Consumed.h" 29 #include "clang/Analysis/Analyses/ReachableCode.h" 30 #include "clang/Analysis/Analyses/ThreadSafety.h" 31 #include "clang/Analysis/Analyses/UninitializedValues.h" 32 #include "clang/Analysis/AnalysisContext.h" 33 #include "clang/Analysis/CFG.h" 34 #include "clang/Analysis/CFGStmtMap.h" 35 #include "clang/Basic/SourceLocation.h" 36 #include "clang/Basic/SourceManager.h" 37 #include "clang/Lex/Lexer.h" 38 #include "clang/Lex/Preprocessor.h" 39 #include "clang/Sema/ScopeInfo.h" 40 #include "clang/Sema/SemaInternal.h" 41 #include "llvm/ADT/ArrayRef.h" 42 #include "llvm/ADT/BitVector.h" 43 #include "llvm/ADT/FoldingSet.h" 44 #include "llvm/ADT/ImmutableMap.h" 45 #include "llvm/ADT/MapVector.h" 46 #include "llvm/ADT/PostOrderIterator.h" 47 #include "llvm/ADT/SmallString.h" 48 #include "llvm/ADT/SmallVector.h" 49 #include "llvm/ADT/StringRef.h" 50 #include "llvm/Support/Casting.h" 51 #include <algorithm> 52 #include <deque> 53 #include <iterator> 54 #include <vector> 55 56 using namespace clang; 57 58 //===----------------------------------------------------------------------===// 59 // Unreachable code analysis. 60 //===----------------------------------------------------------------------===// 61 62 namespace { 63 class UnreachableCodeHandler : public reachable_code::Callback { 64 Sema &S; 65 public: 66 UnreachableCodeHandler(Sema &s) : S(s) {} 67 68 void HandleUnreachable(reachable_code::UnreachableKind UK, 69 SourceLocation L, 70 SourceRange SilenceableCondVal, 71 SourceRange R1, 72 SourceRange R2) override { 73 unsigned diag = diag::warn_unreachable; 74 switch (UK) { 75 case reachable_code::UK_Break: 76 diag = diag::warn_unreachable_break; 77 break; 78 case reachable_code::UK_Return: 79 diag = diag::warn_unreachable_return; 80 break; 81 case reachable_code::UK_Loop_Increment: 82 diag = diag::warn_unreachable_loop_increment; 83 break; 84 case reachable_code::UK_Other: 85 break; 86 } 87 88 S.Diag(L, diag) << R1 << R2; 89 90 SourceLocation Open = SilenceableCondVal.getBegin(); 91 if (Open.isValid()) { 92 SourceLocation Close = SilenceableCondVal.getEnd(); 93 Close = S.getLocForEndOfToken(Close); 94 if (Close.isValid()) { 95 S.Diag(Open, diag::note_unreachable_silence) 96 << FixItHint::CreateInsertion(Open, "/* DISABLES CODE */ (") 97 << FixItHint::CreateInsertion(Close, ")"); 98 } 99 } 100 } 101 }; 102 } 103 104 /// CheckUnreachable - Check for unreachable code. 105 static void CheckUnreachable(Sema &S, AnalysisDeclContext &AC) { 106 // As a heuristic prune all diagnostics not in the main file. Currently 107 // the majority of warnings in headers are false positives. These 108 // are largely caused by configuration state, e.g. preprocessor 109 // defined code, etc. 110 // 111 // Note that this is also a performance optimization. Analyzing 112 // headers many times can be expensive. 113 if (!S.getSourceManager().isInMainFile(AC.getDecl()->getLocStart())) 114 return; 115 116 UnreachableCodeHandler UC(S); 117 reachable_code::FindUnreachableCode(AC, S.getPreprocessor(), UC); 118 } 119 120 /// \brief Warn on logical operator errors in CFGBuilder 121 class LogicalErrorHandler : public CFGCallback { 122 Sema &S; 123 124 public: 125 LogicalErrorHandler(Sema &S) : CFGCallback(), S(S) {} 126 127 static bool HasMacroID(const Expr *E) { 128 if (E->getExprLoc().isMacroID()) 129 return true; 130 131 // Recurse to children. 132 for (ConstStmtRange SubStmts = E->children(); SubStmts; ++SubStmts) 133 if (*SubStmts) 134 if (const Expr *SubExpr = dyn_cast<Expr>(*SubStmts)) 135 if (HasMacroID(SubExpr)) 136 return true; 137 138 return false; 139 } 140 141 void compareAlwaysTrue(const BinaryOperator *B, bool isAlwaysTrue) { 142 if (HasMacroID(B)) 143 return; 144 145 SourceRange DiagRange = B->getSourceRange(); 146 S.Diag(B->getExprLoc(), diag::warn_tautological_overlap_comparison) 147 << DiagRange << isAlwaysTrue; 148 } 149 150 void compareBitwiseEquality(const BinaryOperator *B, bool isAlwaysTrue) { 151 if (HasMacroID(B)) 152 return; 153 154 SourceRange DiagRange = B->getSourceRange(); 155 S.Diag(B->getExprLoc(), diag::warn_comparison_bitwise_always) 156 << DiagRange << isAlwaysTrue; 157 } 158 }; 159 160 161 //===----------------------------------------------------------------------===// 162 // Check for infinite self-recursion in functions 163 //===----------------------------------------------------------------------===// 164 165 // All blocks are in one of three states. States are ordered so that blocks 166 // can only move to higher states. 167 enum RecursiveState { 168 FoundNoPath, 169 FoundPath, 170 FoundPathWithNoRecursiveCall 171 }; 172 173 static void checkForFunctionCall(Sema &S, const FunctionDecl *FD, 174 CFGBlock &Block, unsigned ExitID, 175 llvm::SmallVectorImpl<RecursiveState> &States, 176 RecursiveState State) { 177 unsigned ID = Block.getBlockID(); 178 179 // A block's state can only move to a higher state. 180 if (States[ID] >= State) 181 return; 182 183 States[ID] = State; 184 185 // Found a path to the exit node without a recursive call. 186 if (ID == ExitID && State == FoundPathWithNoRecursiveCall) 187 return; 188 189 if (State == FoundPathWithNoRecursiveCall) { 190 // If the current state is FoundPathWithNoRecursiveCall, the successors 191 // will be either FoundPathWithNoRecursiveCall or FoundPath. To determine 192 // which, process all the Stmt's in this block to find any recursive calls. 193 for (const auto &B : Block) { 194 if (B.getKind() != CFGElement::Statement) 195 continue; 196 197 const CallExpr *CE = dyn_cast<CallExpr>(B.getAs<CFGStmt>()->getStmt()); 198 if (CE && CE->getCalleeDecl() && 199 CE->getCalleeDecl()->getCanonicalDecl() == FD) { 200 201 // Skip function calls which are qualified with a templated class. 202 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>( 203 CE->getCallee()->IgnoreParenImpCasts())) { 204 if (NestedNameSpecifier *NNS = DRE->getQualifier()) { 205 if (NNS->getKind() == NestedNameSpecifier::TypeSpec && 206 isa<TemplateSpecializationType>(NNS->getAsType())) { 207 continue; 208 } 209 } 210 } 211 212 if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE)) { 213 if (isa<CXXThisExpr>(MCE->getImplicitObjectArgument()) || 214 !MCE->getMethodDecl()->isVirtual()) { 215 State = FoundPath; 216 break; 217 } 218 } else { 219 State = FoundPath; 220 break; 221 } 222 } 223 } 224 } 225 226 for (CFGBlock::succ_iterator I = Block.succ_begin(), E = Block.succ_end(); 227 I != E; ++I) 228 if (*I) 229 checkForFunctionCall(S, FD, **I, ExitID, States, State); 230 } 231 232 static void checkRecursiveFunction(Sema &S, const FunctionDecl *FD, 233 const Stmt *Body, 234 AnalysisDeclContext &AC) { 235 FD = FD->getCanonicalDecl(); 236 237 // Only run on non-templated functions and non-templated members of 238 // templated classes. 239 if (FD->getTemplatedKind() != FunctionDecl::TK_NonTemplate && 240 FD->getTemplatedKind() != FunctionDecl::TK_MemberSpecialization) 241 return; 242 243 CFG *cfg = AC.getCFG(); 244 if (!cfg) return; 245 246 // If the exit block is unreachable, skip processing the function. 247 if (cfg->getExit().pred_empty()) 248 return; 249 250 // Mark all nodes as FoundNoPath, then begin processing the entry block. 251 llvm::SmallVector<RecursiveState, 16> states(cfg->getNumBlockIDs(), 252 FoundNoPath); 253 checkForFunctionCall(S, FD, cfg->getEntry(), cfg->getExit().getBlockID(), 254 states, FoundPathWithNoRecursiveCall); 255 256 // Check that the exit block is reachable. This prevents triggering the 257 // warning on functions that do not terminate. 258 if (states[cfg->getExit().getBlockID()] == FoundPath) 259 S.Diag(Body->getLocStart(), diag::warn_infinite_recursive_function); 260 } 261 262 //===----------------------------------------------------------------------===// 263 // Check for missing return value. 264 //===----------------------------------------------------------------------===// 265 266 enum ControlFlowKind { 267 UnknownFallThrough, 268 NeverFallThrough, 269 MaybeFallThrough, 270 AlwaysFallThrough, 271 NeverFallThroughOrReturn 272 }; 273 274 /// CheckFallThrough - Check that we don't fall off the end of a 275 /// Statement that should return a value. 276 /// 277 /// \returns AlwaysFallThrough iff we always fall off the end of the statement, 278 /// MaybeFallThrough iff we might or might not fall off the end, 279 /// NeverFallThroughOrReturn iff we never fall off the end of the statement or 280 /// return. We assume NeverFallThrough iff we never fall off the end of the 281 /// statement but we may return. We assume that functions not marked noreturn 282 /// will return. 283 static ControlFlowKind CheckFallThrough(AnalysisDeclContext &AC) { 284 CFG *cfg = AC.getCFG(); 285 if (!cfg) return UnknownFallThrough; 286 287 // The CFG leaves in dead things, and we don't want the dead code paths to 288 // confuse us, so we mark all live things first. 289 llvm::BitVector live(cfg->getNumBlockIDs()); 290 unsigned count = reachable_code::ScanReachableFromBlock(&cfg->getEntry(), 291 live); 292 293 bool AddEHEdges = AC.getAddEHEdges(); 294 if (!AddEHEdges && count != cfg->getNumBlockIDs()) 295 // When there are things remaining dead, and we didn't add EH edges 296 // from CallExprs to the catch clauses, we have to go back and 297 // mark them as live. 298 for (const auto *B : *cfg) { 299 if (!live[B->getBlockID()]) { 300 if (B->pred_begin() == B->pred_end()) { 301 if (B->getTerminator() && isa<CXXTryStmt>(B->getTerminator())) 302 // When not adding EH edges from calls, catch clauses 303 // can otherwise seem dead. Avoid noting them as dead. 304 count += reachable_code::ScanReachableFromBlock(B, live); 305 continue; 306 } 307 } 308 } 309 310 // Now we know what is live, we check the live precessors of the exit block 311 // and look for fall through paths, being careful to ignore normal returns, 312 // and exceptional paths. 313 bool HasLiveReturn = false; 314 bool HasFakeEdge = false; 315 bool HasPlainEdge = false; 316 bool HasAbnormalEdge = false; 317 318 // Ignore default cases that aren't likely to be reachable because all 319 // enums in a switch(X) have explicit case statements. 320 CFGBlock::FilterOptions FO; 321 FO.IgnoreDefaultsWithCoveredEnums = 1; 322 323 for (CFGBlock::filtered_pred_iterator 324 I = cfg->getExit().filtered_pred_start_end(FO); I.hasMore(); ++I) { 325 const CFGBlock& B = **I; 326 if (!live[B.getBlockID()]) 327 continue; 328 329 // Skip blocks which contain an element marked as no-return. They don't 330 // represent actually viable edges into the exit block, so mark them as 331 // abnormal. 332 if (B.hasNoReturnElement()) { 333 HasAbnormalEdge = true; 334 continue; 335 } 336 337 // Destructors can appear after the 'return' in the CFG. This is 338 // normal. We need to look pass the destructors for the return 339 // statement (if it exists). 340 CFGBlock::const_reverse_iterator ri = B.rbegin(), re = B.rend(); 341 342 for ( ; ri != re ; ++ri) 343 if (ri->getAs<CFGStmt>()) 344 break; 345 346 // No more CFGElements in the block? 347 if (ri == re) { 348 if (B.getTerminator() && isa<CXXTryStmt>(B.getTerminator())) { 349 HasAbnormalEdge = true; 350 continue; 351 } 352 // A labeled empty statement, or the entry block... 353 HasPlainEdge = true; 354 continue; 355 } 356 357 CFGStmt CS = ri->castAs<CFGStmt>(); 358 const Stmt *S = CS.getStmt(); 359 if (isa<ReturnStmt>(S)) { 360 HasLiveReturn = true; 361 continue; 362 } 363 if (isa<ObjCAtThrowStmt>(S)) { 364 HasFakeEdge = true; 365 continue; 366 } 367 if (isa<CXXThrowExpr>(S)) { 368 HasFakeEdge = true; 369 continue; 370 } 371 if (isa<MSAsmStmt>(S)) { 372 // TODO: Verify this is correct. 373 HasFakeEdge = true; 374 HasLiveReturn = true; 375 continue; 376 } 377 if (isa<CXXTryStmt>(S)) { 378 HasAbnormalEdge = true; 379 continue; 380 } 381 if (std::find(B.succ_begin(), B.succ_end(), &cfg->getExit()) 382 == B.succ_end()) { 383 HasAbnormalEdge = true; 384 continue; 385 } 386 387 HasPlainEdge = true; 388 } 389 if (!HasPlainEdge) { 390 if (HasLiveReturn) 391 return NeverFallThrough; 392 return NeverFallThroughOrReturn; 393 } 394 if (HasAbnormalEdge || HasFakeEdge || HasLiveReturn) 395 return MaybeFallThrough; 396 // This says AlwaysFallThrough for calls to functions that are not marked 397 // noreturn, that don't return. If people would like this warning to be more 398 // accurate, such functions should be marked as noreturn. 399 return AlwaysFallThrough; 400 } 401 402 namespace { 403 404 struct CheckFallThroughDiagnostics { 405 unsigned diag_MaybeFallThrough_HasNoReturn; 406 unsigned diag_MaybeFallThrough_ReturnsNonVoid; 407 unsigned diag_AlwaysFallThrough_HasNoReturn; 408 unsigned diag_AlwaysFallThrough_ReturnsNonVoid; 409 unsigned diag_NeverFallThroughOrReturn; 410 enum { Function, Block, Lambda } funMode; 411 SourceLocation FuncLoc; 412 413 static CheckFallThroughDiagnostics MakeForFunction(const Decl *Func) { 414 CheckFallThroughDiagnostics D; 415 D.FuncLoc = Func->getLocation(); 416 D.diag_MaybeFallThrough_HasNoReturn = 417 diag::warn_falloff_noreturn_function; 418 D.diag_MaybeFallThrough_ReturnsNonVoid = 419 diag::warn_maybe_falloff_nonvoid_function; 420 D.diag_AlwaysFallThrough_HasNoReturn = 421 diag::warn_falloff_noreturn_function; 422 D.diag_AlwaysFallThrough_ReturnsNonVoid = 423 diag::warn_falloff_nonvoid_function; 424 425 // Don't suggest that virtual functions be marked "noreturn", since they 426 // might be overridden by non-noreturn functions. 427 bool isVirtualMethod = false; 428 if (const CXXMethodDecl *Method = dyn_cast<CXXMethodDecl>(Func)) 429 isVirtualMethod = Method->isVirtual(); 430 431 // Don't suggest that template instantiations be marked "noreturn" 432 bool isTemplateInstantiation = false; 433 if (const FunctionDecl *Function = dyn_cast<FunctionDecl>(Func)) 434 isTemplateInstantiation = Function->isTemplateInstantiation(); 435 436 if (!isVirtualMethod && !isTemplateInstantiation) 437 D.diag_NeverFallThroughOrReturn = 438 diag::warn_suggest_noreturn_function; 439 else 440 D.diag_NeverFallThroughOrReturn = 0; 441 442 D.funMode = Function; 443 return D; 444 } 445 446 static CheckFallThroughDiagnostics MakeForBlock() { 447 CheckFallThroughDiagnostics D; 448 D.diag_MaybeFallThrough_HasNoReturn = 449 diag::err_noreturn_block_has_return_expr; 450 D.diag_MaybeFallThrough_ReturnsNonVoid = 451 diag::err_maybe_falloff_nonvoid_block; 452 D.diag_AlwaysFallThrough_HasNoReturn = 453 diag::err_noreturn_block_has_return_expr; 454 D.diag_AlwaysFallThrough_ReturnsNonVoid = 455 diag::err_falloff_nonvoid_block; 456 D.diag_NeverFallThroughOrReturn = 0; 457 D.funMode = Block; 458 return D; 459 } 460 461 static CheckFallThroughDiagnostics MakeForLambda() { 462 CheckFallThroughDiagnostics D; 463 D.diag_MaybeFallThrough_HasNoReturn = 464 diag::err_noreturn_lambda_has_return_expr; 465 D.diag_MaybeFallThrough_ReturnsNonVoid = 466 diag::warn_maybe_falloff_nonvoid_lambda; 467 D.diag_AlwaysFallThrough_HasNoReturn = 468 diag::err_noreturn_lambda_has_return_expr; 469 D.diag_AlwaysFallThrough_ReturnsNonVoid = 470 diag::warn_falloff_nonvoid_lambda; 471 D.diag_NeverFallThroughOrReturn = 0; 472 D.funMode = Lambda; 473 return D; 474 } 475 476 bool checkDiagnostics(DiagnosticsEngine &D, bool ReturnsVoid, 477 bool HasNoReturn) const { 478 if (funMode == Function) { 479 return (ReturnsVoid || 480 D.isIgnored(diag::warn_maybe_falloff_nonvoid_function, 481 FuncLoc)) && 482 (!HasNoReturn || 483 D.isIgnored(diag::warn_noreturn_function_has_return_expr, 484 FuncLoc)) && 485 (!ReturnsVoid || 486 D.isIgnored(diag::warn_suggest_noreturn_block, FuncLoc)); 487 } 488 489 // For blocks / lambdas. 490 return ReturnsVoid && !HasNoReturn; 491 } 492 }; 493 494 } 495 496 /// CheckFallThroughForFunctionDef - Check that we don't fall off the end of a 497 /// function that should return a value. Check that we don't fall off the end 498 /// of a noreturn function. We assume that functions and blocks not marked 499 /// noreturn will return. 500 static void CheckFallThroughForBody(Sema &S, const Decl *D, const Stmt *Body, 501 const BlockExpr *blkExpr, 502 const CheckFallThroughDiagnostics& CD, 503 AnalysisDeclContext &AC) { 504 505 bool ReturnsVoid = false; 506 bool HasNoReturn = false; 507 508 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 509 ReturnsVoid = FD->getReturnType()->isVoidType(); 510 HasNoReturn = FD->isNoReturn(); 511 } 512 else if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 513 ReturnsVoid = MD->getReturnType()->isVoidType(); 514 HasNoReturn = MD->hasAttr<NoReturnAttr>(); 515 } 516 else if (isa<BlockDecl>(D)) { 517 QualType BlockTy = blkExpr->getType(); 518 if (const FunctionType *FT = 519 BlockTy->getPointeeType()->getAs<FunctionType>()) { 520 if (FT->getReturnType()->isVoidType()) 521 ReturnsVoid = true; 522 if (FT->getNoReturnAttr()) 523 HasNoReturn = true; 524 } 525 } 526 527 DiagnosticsEngine &Diags = S.getDiagnostics(); 528 529 // Short circuit for compilation speed. 530 if (CD.checkDiagnostics(Diags, ReturnsVoid, HasNoReturn)) 531 return; 532 533 SourceLocation LBrace = Body->getLocStart(), RBrace = Body->getLocEnd(); 534 // Either in a function body compound statement, or a function-try-block. 535 switch (CheckFallThrough(AC)) { 536 case UnknownFallThrough: 537 break; 538 539 case MaybeFallThrough: 540 if (HasNoReturn) 541 S.Diag(RBrace, CD.diag_MaybeFallThrough_HasNoReturn); 542 else if (!ReturnsVoid) 543 S.Diag(RBrace, CD.diag_MaybeFallThrough_ReturnsNonVoid); 544 break; 545 case AlwaysFallThrough: 546 if (HasNoReturn) 547 S.Diag(RBrace, CD.diag_AlwaysFallThrough_HasNoReturn); 548 else if (!ReturnsVoid) 549 S.Diag(RBrace, CD.diag_AlwaysFallThrough_ReturnsNonVoid); 550 break; 551 case NeverFallThroughOrReturn: 552 if (ReturnsVoid && !HasNoReturn && CD.diag_NeverFallThroughOrReturn) { 553 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 554 S.Diag(LBrace, CD.diag_NeverFallThroughOrReturn) << 0 << FD; 555 } else if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 556 S.Diag(LBrace, CD.diag_NeverFallThroughOrReturn) << 1 << MD; 557 } else { 558 S.Diag(LBrace, CD.diag_NeverFallThroughOrReturn); 559 } 560 } 561 break; 562 case NeverFallThrough: 563 break; 564 } 565 } 566 567 //===----------------------------------------------------------------------===// 568 // -Wuninitialized 569 //===----------------------------------------------------------------------===// 570 571 namespace { 572 /// ContainsReference - A visitor class to search for references to 573 /// a particular declaration (the needle) within any evaluated component of an 574 /// expression (recursively). 575 class ContainsReference : public EvaluatedExprVisitor<ContainsReference> { 576 bool FoundReference; 577 const DeclRefExpr *Needle; 578 579 public: 580 ContainsReference(ASTContext &Context, const DeclRefExpr *Needle) 581 : EvaluatedExprVisitor<ContainsReference>(Context), 582 FoundReference(false), Needle(Needle) {} 583 584 void VisitExpr(Expr *E) { 585 // Stop evaluating if we already have a reference. 586 if (FoundReference) 587 return; 588 589 EvaluatedExprVisitor<ContainsReference>::VisitExpr(E); 590 } 591 592 void VisitDeclRefExpr(DeclRefExpr *E) { 593 if (E == Needle) 594 FoundReference = true; 595 else 596 EvaluatedExprVisitor<ContainsReference>::VisitDeclRefExpr(E); 597 } 598 599 bool doesContainReference() const { return FoundReference; } 600 }; 601 } 602 603 static bool SuggestInitializationFixit(Sema &S, const VarDecl *VD) { 604 QualType VariableTy = VD->getType().getCanonicalType(); 605 if (VariableTy->isBlockPointerType() && 606 !VD->hasAttr<BlocksAttr>()) { 607 S.Diag(VD->getLocation(), diag::note_block_var_fixit_add_initialization) 608 << VD->getDeclName() 609 << FixItHint::CreateInsertion(VD->getLocation(), "__block "); 610 return true; 611 } 612 613 // Don't issue a fixit if there is already an initializer. 614 if (VD->getInit()) 615 return false; 616 617 // Don't suggest a fixit inside macros. 618 if (VD->getLocEnd().isMacroID()) 619 return false; 620 621 SourceLocation Loc = S.getLocForEndOfToken(VD->getLocEnd()); 622 623 // Suggest possible initialization (if any). 624 std::string Init = S.getFixItZeroInitializerForType(VariableTy, Loc); 625 if (Init.empty()) 626 return false; 627 628 S.Diag(Loc, diag::note_var_fixit_add_initialization) << VD->getDeclName() 629 << FixItHint::CreateInsertion(Loc, Init); 630 return true; 631 } 632 633 /// Create a fixit to remove an if-like statement, on the assumption that its 634 /// condition is CondVal. 635 static void CreateIfFixit(Sema &S, const Stmt *If, const Stmt *Then, 636 const Stmt *Else, bool CondVal, 637 FixItHint &Fixit1, FixItHint &Fixit2) { 638 if (CondVal) { 639 // If condition is always true, remove all but the 'then'. 640 Fixit1 = FixItHint::CreateRemoval( 641 CharSourceRange::getCharRange(If->getLocStart(), 642 Then->getLocStart())); 643 if (Else) { 644 SourceLocation ElseKwLoc = Lexer::getLocForEndOfToken( 645 Then->getLocEnd(), 0, S.getSourceManager(), S.getLangOpts()); 646 Fixit2 = FixItHint::CreateRemoval( 647 SourceRange(ElseKwLoc, Else->getLocEnd())); 648 } 649 } else { 650 // If condition is always false, remove all but the 'else'. 651 if (Else) 652 Fixit1 = FixItHint::CreateRemoval( 653 CharSourceRange::getCharRange(If->getLocStart(), 654 Else->getLocStart())); 655 else 656 Fixit1 = FixItHint::CreateRemoval(If->getSourceRange()); 657 } 658 } 659 660 /// DiagUninitUse -- Helper function to produce a diagnostic for an 661 /// uninitialized use of a variable. 662 static void DiagUninitUse(Sema &S, const VarDecl *VD, const UninitUse &Use, 663 bool IsCapturedByBlock) { 664 bool Diagnosed = false; 665 666 switch (Use.getKind()) { 667 case UninitUse::Always: 668 S.Diag(Use.getUser()->getLocStart(), diag::warn_uninit_var) 669 << VD->getDeclName() << IsCapturedByBlock 670 << Use.getUser()->getSourceRange(); 671 return; 672 673 case UninitUse::AfterDecl: 674 case UninitUse::AfterCall: 675 S.Diag(VD->getLocation(), diag::warn_sometimes_uninit_var) 676 << VD->getDeclName() << IsCapturedByBlock 677 << (Use.getKind() == UninitUse::AfterDecl ? 4 : 5) 678 << const_cast<DeclContext*>(VD->getLexicalDeclContext()) 679 << VD->getSourceRange(); 680 S.Diag(Use.getUser()->getLocStart(), diag::note_uninit_var_use) 681 << IsCapturedByBlock << Use.getUser()->getSourceRange(); 682 return; 683 684 case UninitUse::Maybe: 685 case UninitUse::Sometimes: 686 // Carry on to report sometimes-uninitialized branches, if possible, 687 // or a 'may be used uninitialized' diagnostic otherwise. 688 break; 689 } 690 691 // Diagnose each branch which leads to a sometimes-uninitialized use. 692 for (UninitUse::branch_iterator I = Use.branch_begin(), E = Use.branch_end(); 693 I != E; ++I) { 694 assert(Use.getKind() == UninitUse::Sometimes); 695 696 const Expr *User = Use.getUser(); 697 const Stmt *Term = I->Terminator; 698 699 // Information used when building the diagnostic. 700 unsigned DiagKind; 701 StringRef Str; 702 SourceRange Range; 703 704 // FixIts to suppress the diagnostic by removing the dead condition. 705 // For all binary terminators, branch 0 is taken if the condition is true, 706 // and branch 1 is taken if the condition is false. 707 int RemoveDiagKind = -1; 708 const char *FixitStr = 709 S.getLangOpts().CPlusPlus ? (I->Output ? "true" : "false") 710 : (I->Output ? "1" : "0"); 711 FixItHint Fixit1, Fixit2; 712 713 switch (Term ? Term->getStmtClass() : Stmt::DeclStmtClass) { 714 default: 715 // Don't know how to report this. Just fall back to 'may be used 716 // uninitialized'. FIXME: Can this happen? 717 continue; 718 719 // "condition is true / condition is false". 720 case Stmt::IfStmtClass: { 721 const IfStmt *IS = cast<IfStmt>(Term); 722 DiagKind = 0; 723 Str = "if"; 724 Range = IS->getCond()->getSourceRange(); 725 RemoveDiagKind = 0; 726 CreateIfFixit(S, IS, IS->getThen(), IS->getElse(), 727 I->Output, Fixit1, Fixit2); 728 break; 729 } 730 case Stmt::ConditionalOperatorClass: { 731 const ConditionalOperator *CO = cast<ConditionalOperator>(Term); 732 DiagKind = 0; 733 Str = "?:"; 734 Range = CO->getCond()->getSourceRange(); 735 RemoveDiagKind = 0; 736 CreateIfFixit(S, CO, CO->getTrueExpr(), CO->getFalseExpr(), 737 I->Output, Fixit1, Fixit2); 738 break; 739 } 740 case Stmt::BinaryOperatorClass: { 741 const BinaryOperator *BO = cast<BinaryOperator>(Term); 742 if (!BO->isLogicalOp()) 743 continue; 744 DiagKind = 0; 745 Str = BO->getOpcodeStr(); 746 Range = BO->getLHS()->getSourceRange(); 747 RemoveDiagKind = 0; 748 if ((BO->getOpcode() == BO_LAnd && I->Output) || 749 (BO->getOpcode() == BO_LOr && !I->Output)) 750 // true && y -> y, false || y -> y. 751 Fixit1 = FixItHint::CreateRemoval(SourceRange(BO->getLocStart(), 752 BO->getOperatorLoc())); 753 else 754 // false && y -> false, true || y -> true. 755 Fixit1 = FixItHint::CreateReplacement(BO->getSourceRange(), FixitStr); 756 break; 757 } 758 759 // "loop is entered / loop is exited". 760 case Stmt::WhileStmtClass: 761 DiagKind = 1; 762 Str = "while"; 763 Range = cast<WhileStmt>(Term)->getCond()->getSourceRange(); 764 RemoveDiagKind = 1; 765 Fixit1 = FixItHint::CreateReplacement(Range, FixitStr); 766 break; 767 case Stmt::ForStmtClass: 768 DiagKind = 1; 769 Str = "for"; 770 Range = cast<ForStmt>(Term)->getCond()->getSourceRange(); 771 RemoveDiagKind = 1; 772 if (I->Output) 773 Fixit1 = FixItHint::CreateRemoval(Range); 774 else 775 Fixit1 = FixItHint::CreateReplacement(Range, FixitStr); 776 break; 777 case Stmt::CXXForRangeStmtClass: 778 if (I->Output == 1) { 779 // The use occurs if a range-based for loop's body never executes. 780 // That may be impossible, and there's no syntactic fix for this, 781 // so treat it as a 'may be uninitialized' case. 782 continue; 783 } 784 DiagKind = 1; 785 Str = "for"; 786 Range = cast<CXXForRangeStmt>(Term)->getRangeInit()->getSourceRange(); 787 break; 788 789 // "condition is true / loop is exited". 790 case Stmt::DoStmtClass: 791 DiagKind = 2; 792 Str = "do"; 793 Range = cast<DoStmt>(Term)->getCond()->getSourceRange(); 794 RemoveDiagKind = 1; 795 Fixit1 = FixItHint::CreateReplacement(Range, FixitStr); 796 break; 797 798 // "switch case is taken". 799 case Stmt::CaseStmtClass: 800 DiagKind = 3; 801 Str = "case"; 802 Range = cast<CaseStmt>(Term)->getLHS()->getSourceRange(); 803 break; 804 case Stmt::DefaultStmtClass: 805 DiagKind = 3; 806 Str = "default"; 807 Range = cast<DefaultStmt>(Term)->getDefaultLoc(); 808 break; 809 } 810 811 S.Diag(Range.getBegin(), diag::warn_sometimes_uninit_var) 812 << VD->getDeclName() << IsCapturedByBlock << DiagKind 813 << Str << I->Output << Range; 814 S.Diag(User->getLocStart(), diag::note_uninit_var_use) 815 << IsCapturedByBlock << User->getSourceRange(); 816 if (RemoveDiagKind != -1) 817 S.Diag(Fixit1.RemoveRange.getBegin(), diag::note_uninit_fixit_remove_cond) 818 << RemoveDiagKind << Str << I->Output << Fixit1 << Fixit2; 819 820 Diagnosed = true; 821 } 822 823 if (!Diagnosed) 824 S.Diag(Use.getUser()->getLocStart(), diag::warn_maybe_uninit_var) 825 << VD->getDeclName() << IsCapturedByBlock 826 << Use.getUser()->getSourceRange(); 827 } 828 829 /// DiagnoseUninitializedUse -- Helper function for diagnosing uses of an 830 /// uninitialized variable. This manages the different forms of diagnostic 831 /// emitted for particular types of uses. Returns true if the use was diagnosed 832 /// as a warning. If a particular use is one we omit warnings for, returns 833 /// false. 834 static bool DiagnoseUninitializedUse(Sema &S, const VarDecl *VD, 835 const UninitUse &Use, 836 bool alwaysReportSelfInit = false) { 837 838 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Use.getUser())) { 839 // Inspect the initializer of the variable declaration which is 840 // being referenced prior to its initialization. We emit 841 // specialized diagnostics for self-initialization, and we 842 // specifically avoid warning about self references which take the 843 // form of: 844 // 845 // int x = x; 846 // 847 // This is used to indicate to GCC that 'x' is intentionally left 848 // uninitialized. Proven code paths which access 'x' in 849 // an uninitialized state after this will still warn. 850 if (const Expr *Initializer = VD->getInit()) { 851 if (!alwaysReportSelfInit && DRE == Initializer->IgnoreParenImpCasts()) 852 return false; 853 854 ContainsReference CR(S.Context, DRE); 855 CR.Visit(const_cast<Expr*>(Initializer)); 856 if (CR.doesContainReference()) { 857 S.Diag(DRE->getLocStart(), 858 diag::warn_uninit_self_reference_in_init) 859 << VD->getDeclName() << VD->getLocation() << DRE->getSourceRange(); 860 return true; 861 } 862 } 863 864 DiagUninitUse(S, VD, Use, false); 865 } else { 866 const BlockExpr *BE = cast<BlockExpr>(Use.getUser()); 867 if (VD->getType()->isBlockPointerType() && !VD->hasAttr<BlocksAttr>()) 868 S.Diag(BE->getLocStart(), 869 diag::warn_uninit_byref_blockvar_captured_by_block) 870 << VD->getDeclName(); 871 else 872 DiagUninitUse(S, VD, Use, true); 873 } 874 875 // Report where the variable was declared when the use wasn't within 876 // the initializer of that declaration & we didn't already suggest 877 // an initialization fixit. 878 if (!SuggestInitializationFixit(S, VD)) 879 S.Diag(VD->getLocStart(), diag::note_uninit_var_def) 880 << VD->getDeclName(); 881 882 return true; 883 } 884 885 namespace { 886 class FallthroughMapper : public RecursiveASTVisitor<FallthroughMapper> { 887 public: 888 FallthroughMapper(Sema &S) 889 : FoundSwitchStatements(false), 890 S(S) { 891 } 892 893 bool foundSwitchStatements() const { return FoundSwitchStatements; } 894 895 void markFallthroughVisited(const AttributedStmt *Stmt) { 896 bool Found = FallthroughStmts.erase(Stmt); 897 assert(Found); 898 (void)Found; 899 } 900 901 typedef llvm::SmallPtrSet<const AttributedStmt*, 8> AttrStmts; 902 903 const AttrStmts &getFallthroughStmts() const { 904 return FallthroughStmts; 905 } 906 907 void fillReachableBlocks(CFG *Cfg) { 908 assert(ReachableBlocks.empty() && "ReachableBlocks already filled"); 909 std::deque<const CFGBlock *> BlockQueue; 910 911 ReachableBlocks.insert(&Cfg->getEntry()); 912 BlockQueue.push_back(&Cfg->getEntry()); 913 // Mark all case blocks reachable to avoid problems with switching on 914 // constants, covered enums, etc. 915 // These blocks can contain fall-through annotations, and we don't want to 916 // issue a warn_fallthrough_attr_unreachable for them. 917 for (const auto *B : *Cfg) { 918 const Stmt *L = B->getLabel(); 919 if (L && isa<SwitchCase>(L) && ReachableBlocks.insert(B).second) 920 BlockQueue.push_back(B); 921 } 922 923 while (!BlockQueue.empty()) { 924 const CFGBlock *P = BlockQueue.front(); 925 BlockQueue.pop_front(); 926 for (CFGBlock::const_succ_iterator I = P->succ_begin(), 927 E = P->succ_end(); 928 I != E; ++I) { 929 if (*I && ReachableBlocks.insert(*I).second) 930 BlockQueue.push_back(*I); 931 } 932 } 933 } 934 935 bool checkFallThroughIntoBlock(const CFGBlock &B, int &AnnotatedCnt) { 936 assert(!ReachableBlocks.empty() && "ReachableBlocks empty"); 937 938 int UnannotatedCnt = 0; 939 AnnotatedCnt = 0; 940 941 std::deque<const CFGBlock*> BlockQueue(B.pred_begin(), B.pred_end()); 942 while (!BlockQueue.empty()) { 943 const CFGBlock *P = BlockQueue.front(); 944 BlockQueue.pop_front(); 945 if (!P) continue; 946 947 const Stmt *Term = P->getTerminator(); 948 if (Term && isa<SwitchStmt>(Term)) 949 continue; // Switch statement, good. 950 951 const SwitchCase *SW = dyn_cast_or_null<SwitchCase>(P->getLabel()); 952 if (SW && SW->getSubStmt() == B.getLabel() && P->begin() == P->end()) 953 continue; // Previous case label has no statements, good. 954 955 const LabelStmt *L = dyn_cast_or_null<LabelStmt>(P->getLabel()); 956 if (L && L->getSubStmt() == B.getLabel() && P->begin() == P->end()) 957 continue; // Case label is preceded with a normal label, good. 958 959 if (!ReachableBlocks.count(P)) { 960 for (CFGBlock::const_reverse_iterator ElemIt = P->rbegin(), 961 ElemEnd = P->rend(); 962 ElemIt != ElemEnd; ++ElemIt) { 963 if (Optional<CFGStmt> CS = ElemIt->getAs<CFGStmt>()) { 964 if (const AttributedStmt *AS = asFallThroughAttr(CS->getStmt())) { 965 S.Diag(AS->getLocStart(), 966 diag::warn_fallthrough_attr_unreachable); 967 markFallthroughVisited(AS); 968 ++AnnotatedCnt; 969 break; 970 } 971 // Don't care about other unreachable statements. 972 } 973 } 974 // If there are no unreachable statements, this may be a special 975 // case in CFG: 976 // case X: { 977 // A a; // A has a destructor. 978 // break; 979 // } 980 // // <<<< This place is represented by a 'hanging' CFG block. 981 // case Y: 982 continue; 983 } 984 985 const Stmt *LastStmt = getLastStmt(*P); 986 if (const AttributedStmt *AS = asFallThroughAttr(LastStmt)) { 987 markFallthroughVisited(AS); 988 ++AnnotatedCnt; 989 continue; // Fallthrough annotation, good. 990 } 991 992 if (!LastStmt) { // This block contains no executable statements. 993 // Traverse its predecessors. 994 std::copy(P->pred_begin(), P->pred_end(), 995 std::back_inserter(BlockQueue)); 996 continue; 997 } 998 999 ++UnannotatedCnt; 1000 } 1001 return !!UnannotatedCnt; 1002 } 1003 1004 // RecursiveASTVisitor setup. 1005 bool shouldWalkTypesOfTypeLocs() const { return false; } 1006 1007 bool VisitAttributedStmt(AttributedStmt *S) { 1008 if (asFallThroughAttr(S)) 1009 FallthroughStmts.insert(S); 1010 return true; 1011 } 1012 1013 bool VisitSwitchStmt(SwitchStmt *S) { 1014 FoundSwitchStatements = true; 1015 return true; 1016 } 1017 1018 // We don't want to traverse local type declarations. We analyze their 1019 // methods separately. 1020 bool TraverseDecl(Decl *D) { return true; } 1021 1022 // We analyze lambda bodies separately. Skip them here. 1023 bool TraverseLambdaBody(LambdaExpr *LE) { return true; } 1024 1025 private: 1026 1027 static const AttributedStmt *asFallThroughAttr(const Stmt *S) { 1028 if (const AttributedStmt *AS = dyn_cast_or_null<AttributedStmt>(S)) { 1029 if (hasSpecificAttr<FallThroughAttr>(AS->getAttrs())) 1030 return AS; 1031 } 1032 return nullptr; 1033 } 1034 1035 static const Stmt *getLastStmt(const CFGBlock &B) { 1036 if (const Stmt *Term = B.getTerminator()) 1037 return Term; 1038 for (CFGBlock::const_reverse_iterator ElemIt = B.rbegin(), 1039 ElemEnd = B.rend(); 1040 ElemIt != ElemEnd; ++ElemIt) { 1041 if (Optional<CFGStmt> CS = ElemIt->getAs<CFGStmt>()) 1042 return CS->getStmt(); 1043 } 1044 // Workaround to detect a statement thrown out by CFGBuilder: 1045 // case X: {} case Y: 1046 // case X: ; case Y: 1047 if (const SwitchCase *SW = dyn_cast_or_null<SwitchCase>(B.getLabel())) 1048 if (!isa<SwitchCase>(SW->getSubStmt())) 1049 return SW->getSubStmt(); 1050 1051 return nullptr; 1052 } 1053 1054 bool FoundSwitchStatements; 1055 AttrStmts FallthroughStmts; 1056 Sema &S; 1057 llvm::SmallPtrSet<const CFGBlock *, 16> ReachableBlocks; 1058 }; 1059 } 1060 1061 static void DiagnoseSwitchLabelsFallthrough(Sema &S, AnalysisDeclContext &AC, 1062 bool PerFunction) { 1063 // Only perform this analysis when using C++11. There is no good workflow 1064 // for this warning when not using C++11. There is no good way to silence 1065 // the warning (no attribute is available) unless we are using C++11's support 1066 // for generalized attributes. Once could use pragmas to silence the warning, 1067 // but as a general solution that is gross and not in the spirit of this 1068 // warning. 1069 // 1070 // NOTE: This an intermediate solution. There are on-going discussions on 1071 // how to properly support this warning outside of C++11 with an annotation. 1072 if (!AC.getASTContext().getLangOpts().CPlusPlus11) 1073 return; 1074 1075 FallthroughMapper FM(S); 1076 FM.TraverseStmt(AC.getBody()); 1077 1078 if (!FM.foundSwitchStatements()) 1079 return; 1080 1081 if (PerFunction && FM.getFallthroughStmts().empty()) 1082 return; 1083 1084 CFG *Cfg = AC.getCFG(); 1085 1086 if (!Cfg) 1087 return; 1088 1089 FM.fillReachableBlocks(Cfg); 1090 1091 for (CFG::reverse_iterator I = Cfg->rbegin(), E = Cfg->rend(); I != E; ++I) { 1092 const CFGBlock *B = *I; 1093 const Stmt *Label = B->getLabel(); 1094 1095 if (!Label || !isa<SwitchCase>(Label)) 1096 continue; 1097 1098 int AnnotatedCnt; 1099 1100 if (!FM.checkFallThroughIntoBlock(*B, AnnotatedCnt)) 1101 continue; 1102 1103 S.Diag(Label->getLocStart(), 1104 PerFunction ? diag::warn_unannotated_fallthrough_per_function 1105 : diag::warn_unannotated_fallthrough); 1106 1107 if (!AnnotatedCnt) { 1108 SourceLocation L = Label->getLocStart(); 1109 if (L.isMacroID()) 1110 continue; 1111 if (S.getLangOpts().CPlusPlus11) { 1112 const Stmt *Term = B->getTerminator(); 1113 // Skip empty cases. 1114 while (B->empty() && !Term && B->succ_size() == 1) { 1115 B = *B->succ_begin(); 1116 Term = B->getTerminator(); 1117 } 1118 if (!(B->empty() && Term && isa<BreakStmt>(Term))) { 1119 Preprocessor &PP = S.getPreprocessor(); 1120 TokenValue Tokens[] = { 1121 tok::l_square, tok::l_square, PP.getIdentifierInfo("clang"), 1122 tok::coloncolon, PP.getIdentifierInfo("fallthrough"), 1123 tok::r_square, tok::r_square 1124 }; 1125 StringRef AnnotationSpelling = "[[clang::fallthrough]]"; 1126 StringRef MacroName = PP.getLastMacroWithSpelling(L, Tokens); 1127 if (!MacroName.empty()) 1128 AnnotationSpelling = MacroName; 1129 SmallString<64> TextToInsert(AnnotationSpelling); 1130 TextToInsert += "; "; 1131 S.Diag(L, diag::note_insert_fallthrough_fixit) << 1132 AnnotationSpelling << 1133 FixItHint::CreateInsertion(L, TextToInsert); 1134 } 1135 } 1136 S.Diag(L, diag::note_insert_break_fixit) << 1137 FixItHint::CreateInsertion(L, "break; "); 1138 } 1139 } 1140 1141 for (const auto *F : FM.getFallthroughStmts()) 1142 S.Diag(F->getLocStart(), diag::warn_fallthrough_attr_invalid_placement); 1143 } 1144 1145 static bool isInLoop(const ASTContext &Ctx, const ParentMap &PM, 1146 const Stmt *S) { 1147 assert(S); 1148 1149 do { 1150 switch (S->getStmtClass()) { 1151 case Stmt::ForStmtClass: 1152 case Stmt::WhileStmtClass: 1153 case Stmt::CXXForRangeStmtClass: 1154 case Stmt::ObjCForCollectionStmtClass: 1155 return true; 1156 case Stmt::DoStmtClass: { 1157 const Expr *Cond = cast<DoStmt>(S)->getCond(); 1158 llvm::APSInt Val; 1159 if (!Cond->EvaluateAsInt(Val, Ctx)) 1160 return true; 1161 return Val.getBoolValue(); 1162 } 1163 default: 1164 break; 1165 } 1166 } while ((S = PM.getParent(S))); 1167 1168 return false; 1169 } 1170 1171 1172 static void diagnoseRepeatedUseOfWeak(Sema &S, 1173 const sema::FunctionScopeInfo *CurFn, 1174 const Decl *D, 1175 const ParentMap &PM) { 1176 typedef sema::FunctionScopeInfo::WeakObjectProfileTy WeakObjectProfileTy; 1177 typedef sema::FunctionScopeInfo::WeakObjectUseMap WeakObjectUseMap; 1178 typedef sema::FunctionScopeInfo::WeakUseVector WeakUseVector; 1179 typedef std::pair<const Stmt *, WeakObjectUseMap::const_iterator> 1180 StmtUsesPair; 1181 1182 ASTContext &Ctx = S.getASTContext(); 1183 1184 const WeakObjectUseMap &WeakMap = CurFn->getWeakObjectUses(); 1185 1186 // Extract all weak objects that are referenced more than once. 1187 SmallVector<StmtUsesPair, 8> UsesByStmt; 1188 for (WeakObjectUseMap::const_iterator I = WeakMap.begin(), E = WeakMap.end(); 1189 I != E; ++I) { 1190 const WeakUseVector &Uses = I->second; 1191 1192 // Find the first read of the weak object. 1193 WeakUseVector::const_iterator UI = Uses.begin(), UE = Uses.end(); 1194 for ( ; UI != UE; ++UI) { 1195 if (UI->isUnsafe()) 1196 break; 1197 } 1198 1199 // If there were only writes to this object, don't warn. 1200 if (UI == UE) 1201 continue; 1202 1203 // If there was only one read, followed by any number of writes, and the 1204 // read is not within a loop, don't warn. Additionally, don't warn in a 1205 // loop if the base object is a local variable -- local variables are often 1206 // changed in loops. 1207 if (UI == Uses.begin()) { 1208 WeakUseVector::const_iterator UI2 = UI; 1209 for (++UI2; UI2 != UE; ++UI2) 1210 if (UI2->isUnsafe()) 1211 break; 1212 1213 if (UI2 == UE) { 1214 if (!isInLoop(Ctx, PM, UI->getUseExpr())) 1215 continue; 1216 1217 const WeakObjectProfileTy &Profile = I->first; 1218 if (!Profile.isExactProfile()) 1219 continue; 1220 1221 const NamedDecl *Base = Profile.getBase(); 1222 if (!Base) 1223 Base = Profile.getProperty(); 1224 assert(Base && "A profile always has a base or property."); 1225 1226 if (const VarDecl *BaseVar = dyn_cast<VarDecl>(Base)) 1227 if (BaseVar->hasLocalStorage() && !isa<ParmVarDecl>(Base)) 1228 continue; 1229 } 1230 } 1231 1232 UsesByStmt.push_back(StmtUsesPair(UI->getUseExpr(), I)); 1233 } 1234 1235 if (UsesByStmt.empty()) 1236 return; 1237 1238 // Sort by first use so that we emit the warnings in a deterministic order. 1239 SourceManager &SM = S.getSourceManager(); 1240 std::sort(UsesByStmt.begin(), UsesByStmt.end(), 1241 [&SM](const StmtUsesPair &LHS, const StmtUsesPair &RHS) { 1242 return SM.isBeforeInTranslationUnit(LHS.first->getLocStart(), 1243 RHS.first->getLocStart()); 1244 }); 1245 1246 // Classify the current code body for better warning text. 1247 // This enum should stay in sync with the cases in 1248 // warn_arc_repeated_use_of_weak and warn_arc_possible_repeated_use_of_weak. 1249 // FIXME: Should we use a common classification enum and the same set of 1250 // possibilities all throughout Sema? 1251 enum { 1252 Function, 1253 Method, 1254 Block, 1255 Lambda 1256 } FunctionKind; 1257 1258 if (isa<sema::BlockScopeInfo>(CurFn)) 1259 FunctionKind = Block; 1260 else if (isa<sema::LambdaScopeInfo>(CurFn)) 1261 FunctionKind = Lambda; 1262 else if (isa<ObjCMethodDecl>(D)) 1263 FunctionKind = Method; 1264 else 1265 FunctionKind = Function; 1266 1267 // Iterate through the sorted problems and emit warnings for each. 1268 for (const auto &P : UsesByStmt) { 1269 const Stmt *FirstRead = P.first; 1270 const WeakObjectProfileTy &Key = P.second->first; 1271 const WeakUseVector &Uses = P.second->second; 1272 1273 // For complicated expressions like 'a.b.c' and 'x.b.c', WeakObjectProfileTy 1274 // may not contain enough information to determine that these are different 1275 // properties. We can only be 100% sure of a repeated use in certain cases, 1276 // and we adjust the diagnostic kind accordingly so that the less certain 1277 // case can be turned off if it is too noisy. 1278 unsigned DiagKind; 1279 if (Key.isExactProfile()) 1280 DiagKind = diag::warn_arc_repeated_use_of_weak; 1281 else 1282 DiagKind = diag::warn_arc_possible_repeated_use_of_weak; 1283 1284 // Classify the weak object being accessed for better warning text. 1285 // This enum should stay in sync with the cases in 1286 // warn_arc_repeated_use_of_weak and warn_arc_possible_repeated_use_of_weak. 1287 enum { 1288 Variable, 1289 Property, 1290 ImplicitProperty, 1291 Ivar 1292 } ObjectKind; 1293 1294 const NamedDecl *D = Key.getProperty(); 1295 if (isa<VarDecl>(D)) 1296 ObjectKind = Variable; 1297 else if (isa<ObjCPropertyDecl>(D)) 1298 ObjectKind = Property; 1299 else if (isa<ObjCMethodDecl>(D)) 1300 ObjectKind = ImplicitProperty; 1301 else if (isa<ObjCIvarDecl>(D)) 1302 ObjectKind = Ivar; 1303 else 1304 llvm_unreachable("Unexpected weak object kind!"); 1305 1306 // Show the first time the object was read. 1307 S.Diag(FirstRead->getLocStart(), DiagKind) 1308 << int(ObjectKind) << D << int(FunctionKind) 1309 << FirstRead->getSourceRange(); 1310 1311 // Print all the other accesses as notes. 1312 for (const auto &Use : Uses) { 1313 if (Use.getUseExpr() == FirstRead) 1314 continue; 1315 S.Diag(Use.getUseExpr()->getLocStart(), 1316 diag::note_arc_weak_also_accessed_here) 1317 << Use.getUseExpr()->getSourceRange(); 1318 } 1319 } 1320 } 1321 1322 namespace { 1323 class UninitValsDiagReporter : public UninitVariablesHandler { 1324 Sema &S; 1325 typedef SmallVector<UninitUse, 2> UsesVec; 1326 typedef llvm::PointerIntPair<UsesVec *, 1, bool> MappedType; 1327 // Prefer using MapVector to DenseMap, so that iteration order will be 1328 // the same as insertion order. This is needed to obtain a deterministic 1329 // order of diagnostics when calling flushDiagnostics(). 1330 typedef llvm::MapVector<const VarDecl *, MappedType> UsesMap; 1331 UsesMap *uses; 1332 1333 public: 1334 UninitValsDiagReporter(Sema &S) : S(S), uses(nullptr) {} 1335 ~UninitValsDiagReporter() { 1336 flushDiagnostics(); 1337 } 1338 1339 MappedType &getUses(const VarDecl *vd) { 1340 if (!uses) 1341 uses = new UsesMap(); 1342 1343 MappedType &V = (*uses)[vd]; 1344 if (!V.getPointer()) 1345 V.setPointer(new UsesVec()); 1346 1347 return V; 1348 } 1349 1350 void handleUseOfUninitVariable(const VarDecl *vd, 1351 const UninitUse &use) override { 1352 getUses(vd).getPointer()->push_back(use); 1353 } 1354 1355 void handleSelfInit(const VarDecl *vd) override { 1356 getUses(vd).setInt(true); 1357 } 1358 1359 void flushDiagnostics() { 1360 if (!uses) 1361 return; 1362 1363 for (const auto &P : *uses) { 1364 const VarDecl *vd = P.first; 1365 const MappedType &V = P.second; 1366 1367 UsesVec *vec = V.getPointer(); 1368 bool hasSelfInit = V.getInt(); 1369 1370 // Specially handle the case where we have uses of an uninitialized 1371 // variable, but the root cause is an idiomatic self-init. We want 1372 // to report the diagnostic at the self-init since that is the root cause. 1373 if (!vec->empty() && hasSelfInit && hasAlwaysUninitializedUse(vec)) 1374 DiagnoseUninitializedUse(S, vd, 1375 UninitUse(vd->getInit()->IgnoreParenCasts(), 1376 /* isAlwaysUninit */ true), 1377 /* alwaysReportSelfInit */ true); 1378 else { 1379 // Sort the uses by their SourceLocations. While not strictly 1380 // guaranteed to produce them in line/column order, this will provide 1381 // a stable ordering. 1382 std::sort(vec->begin(), vec->end(), 1383 [](const UninitUse &a, const UninitUse &b) { 1384 // Prefer a more confident report over a less confident one. 1385 if (a.getKind() != b.getKind()) 1386 return a.getKind() > b.getKind(); 1387 return a.getUser()->getLocStart() < b.getUser()->getLocStart(); 1388 }); 1389 1390 for (const auto &U : *vec) { 1391 // If we have self-init, downgrade all uses to 'may be uninitialized'. 1392 UninitUse Use = hasSelfInit ? UninitUse(U.getUser(), false) : U; 1393 1394 if (DiagnoseUninitializedUse(S, vd, Use)) 1395 // Skip further diagnostics for this variable. We try to warn only 1396 // on the first point at which a variable is used uninitialized. 1397 break; 1398 } 1399 } 1400 1401 // Release the uses vector. 1402 delete vec; 1403 } 1404 delete uses; 1405 } 1406 1407 private: 1408 static bool hasAlwaysUninitializedUse(const UsesVec* vec) { 1409 return std::any_of(vec->begin(), vec->end(), [](const UninitUse &U) { 1410 return U.getKind() == UninitUse::Always || 1411 U.getKind() == UninitUse::AfterCall || 1412 U.getKind() == UninitUse::AfterDecl; 1413 }); 1414 } 1415 }; 1416 } 1417 1418 namespace clang { 1419 namespace { 1420 typedef SmallVector<PartialDiagnosticAt, 1> OptionalNotes; 1421 typedef std::pair<PartialDiagnosticAt, OptionalNotes> DelayedDiag; 1422 typedef std::list<DelayedDiag> DiagList; 1423 1424 struct SortDiagBySourceLocation { 1425 SourceManager &SM; 1426 SortDiagBySourceLocation(SourceManager &SM) : SM(SM) {} 1427 1428 bool operator()(const DelayedDiag &left, const DelayedDiag &right) { 1429 // Although this call will be slow, this is only called when outputting 1430 // multiple warnings. 1431 return SM.isBeforeInTranslationUnit(left.first.first, right.first.first); 1432 } 1433 }; 1434 }} 1435 1436 //===----------------------------------------------------------------------===// 1437 // -Wthread-safety 1438 //===----------------------------------------------------------------------===// 1439 namespace clang { 1440 namespace threadSafety { 1441 1442 class ThreadSafetyReporter : public clang::threadSafety::ThreadSafetyHandler { 1443 Sema &S; 1444 DiagList Warnings; 1445 SourceLocation FunLocation, FunEndLocation; 1446 1447 const FunctionDecl *CurrentFunction; 1448 bool Verbose; 1449 1450 OptionalNotes getNotes() const { 1451 if (Verbose && CurrentFunction) { 1452 PartialDiagnosticAt FNote(CurrentFunction->getBody()->getLocStart(), 1453 S.PDiag(diag::note_thread_warning_in_fun) 1454 << CurrentFunction->getNameAsString()); 1455 return OptionalNotes(1, FNote); 1456 } 1457 return OptionalNotes(); 1458 } 1459 1460 OptionalNotes getNotes(const PartialDiagnosticAt &Note) const { 1461 OptionalNotes ONS(1, Note); 1462 if (Verbose && CurrentFunction) { 1463 PartialDiagnosticAt FNote(CurrentFunction->getBody()->getLocStart(), 1464 S.PDiag(diag::note_thread_warning_in_fun) 1465 << CurrentFunction->getNameAsString()); 1466 ONS.push_back(FNote); 1467 } 1468 return ONS; 1469 } 1470 1471 OptionalNotes getNotes(const PartialDiagnosticAt &Note1, 1472 const PartialDiagnosticAt &Note2) const { 1473 OptionalNotes ONS; 1474 ONS.push_back(Note1); 1475 ONS.push_back(Note2); 1476 if (Verbose && CurrentFunction) { 1477 PartialDiagnosticAt FNote(CurrentFunction->getBody()->getLocStart(), 1478 S.PDiag(diag::note_thread_warning_in_fun) 1479 << CurrentFunction->getNameAsString()); 1480 ONS.push_back(FNote); 1481 } 1482 return ONS; 1483 } 1484 1485 // Helper functions 1486 void warnLockMismatch(unsigned DiagID, StringRef Kind, Name LockName, 1487 SourceLocation Loc) { 1488 // Gracefully handle rare cases when the analysis can't get a more 1489 // precise source location. 1490 if (!Loc.isValid()) 1491 Loc = FunLocation; 1492 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) << Kind << LockName); 1493 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1494 } 1495 1496 public: 1497 ThreadSafetyReporter(Sema &S, SourceLocation FL, SourceLocation FEL) 1498 : S(S), FunLocation(FL), FunEndLocation(FEL), 1499 CurrentFunction(nullptr), Verbose(false) {} 1500 1501 void setVerbose(bool b) { Verbose = b; } 1502 1503 /// \brief Emit all buffered diagnostics in order of sourcelocation. 1504 /// We need to output diagnostics produced while iterating through 1505 /// the lockset in deterministic order, so this function orders diagnostics 1506 /// and outputs them. 1507 void emitDiagnostics() { 1508 Warnings.sort(SortDiagBySourceLocation(S.getSourceManager())); 1509 for (const auto &Diag : Warnings) { 1510 S.Diag(Diag.first.first, Diag.first.second); 1511 for (const auto &Note : Diag.second) 1512 S.Diag(Note.first, Note.second); 1513 } 1514 } 1515 1516 void handleInvalidLockExp(StringRef Kind, SourceLocation Loc) override { 1517 PartialDiagnosticAt Warning(Loc, S.PDiag(diag::warn_cannot_resolve_lock) 1518 << Loc); 1519 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1520 } 1521 1522 void handleUnmatchedUnlock(StringRef Kind, Name LockName, 1523 SourceLocation Loc) override { 1524 warnLockMismatch(diag::warn_unlock_but_no_lock, Kind, LockName, Loc); 1525 } 1526 1527 void handleIncorrectUnlockKind(StringRef Kind, Name LockName, 1528 LockKind Expected, LockKind Received, 1529 SourceLocation Loc) override { 1530 if (Loc.isInvalid()) 1531 Loc = FunLocation; 1532 PartialDiagnosticAt Warning(Loc, S.PDiag(diag::warn_unlock_kind_mismatch) 1533 << Kind << LockName << Received 1534 << Expected); 1535 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1536 } 1537 1538 void handleDoubleLock(StringRef Kind, Name LockName, SourceLocation Loc) override { 1539 warnLockMismatch(diag::warn_double_lock, Kind, LockName, Loc); 1540 } 1541 1542 void handleMutexHeldEndOfScope(StringRef Kind, Name LockName, 1543 SourceLocation LocLocked, 1544 SourceLocation LocEndOfScope, 1545 LockErrorKind LEK) override { 1546 unsigned DiagID = 0; 1547 switch (LEK) { 1548 case LEK_LockedSomePredecessors: 1549 DiagID = diag::warn_lock_some_predecessors; 1550 break; 1551 case LEK_LockedSomeLoopIterations: 1552 DiagID = diag::warn_expecting_lock_held_on_loop; 1553 break; 1554 case LEK_LockedAtEndOfFunction: 1555 DiagID = diag::warn_no_unlock; 1556 break; 1557 case LEK_NotLockedAtEndOfFunction: 1558 DiagID = diag::warn_expecting_locked; 1559 break; 1560 } 1561 if (LocEndOfScope.isInvalid()) 1562 LocEndOfScope = FunEndLocation; 1563 1564 PartialDiagnosticAt Warning(LocEndOfScope, S.PDiag(DiagID) << Kind 1565 << LockName); 1566 if (LocLocked.isValid()) { 1567 PartialDiagnosticAt Note(LocLocked, S.PDiag(diag::note_locked_here) 1568 << Kind); 1569 Warnings.push_back(DelayedDiag(Warning, getNotes(Note))); 1570 return; 1571 } 1572 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1573 } 1574 1575 void handleExclusiveAndShared(StringRef Kind, Name LockName, 1576 SourceLocation Loc1, 1577 SourceLocation Loc2) override { 1578 PartialDiagnosticAt Warning(Loc1, 1579 S.PDiag(diag::warn_lock_exclusive_and_shared) 1580 << Kind << LockName); 1581 PartialDiagnosticAt Note(Loc2, S.PDiag(diag::note_lock_exclusive_and_shared) 1582 << Kind << LockName); 1583 Warnings.push_back(DelayedDiag(Warning, getNotes(Note))); 1584 } 1585 1586 void handleNoMutexHeld(StringRef Kind, const NamedDecl *D, 1587 ProtectedOperationKind POK, AccessKind AK, 1588 SourceLocation Loc) override { 1589 assert((POK == POK_VarAccess || POK == POK_VarDereference) && 1590 "Only works for variables"); 1591 unsigned DiagID = POK == POK_VarAccess? 1592 diag::warn_variable_requires_any_lock: 1593 diag::warn_var_deref_requires_any_lock; 1594 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) 1595 << D->getNameAsString() << getLockKindFromAccessKind(AK)); 1596 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1597 } 1598 1599 void handleMutexNotHeld(StringRef Kind, const NamedDecl *D, 1600 ProtectedOperationKind POK, Name LockName, 1601 LockKind LK, SourceLocation Loc, 1602 Name *PossibleMatch) override { 1603 unsigned DiagID = 0; 1604 if (PossibleMatch) { 1605 switch (POK) { 1606 case POK_VarAccess: 1607 DiagID = diag::warn_variable_requires_lock_precise; 1608 break; 1609 case POK_VarDereference: 1610 DiagID = diag::warn_var_deref_requires_lock_precise; 1611 break; 1612 case POK_FunctionCall: 1613 DiagID = diag::warn_fun_requires_lock_precise; 1614 break; 1615 case POK_PassByRef: 1616 DiagID = diag::warn_guarded_pass_by_reference; 1617 break; 1618 case POK_PtPassByRef: 1619 DiagID = diag::warn_pt_guarded_pass_by_reference; 1620 break; 1621 } 1622 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) << Kind 1623 << D->getNameAsString() 1624 << LockName << LK); 1625 PartialDiagnosticAt Note(Loc, S.PDiag(diag::note_found_mutex_near_match) 1626 << *PossibleMatch); 1627 if (Verbose && POK == POK_VarAccess) { 1628 PartialDiagnosticAt VNote(D->getLocation(), 1629 S.PDiag(diag::note_guarded_by_declared_here) 1630 << D->getNameAsString()); 1631 Warnings.push_back(DelayedDiag(Warning, getNotes(Note, VNote))); 1632 } else 1633 Warnings.push_back(DelayedDiag(Warning, getNotes(Note))); 1634 } else { 1635 switch (POK) { 1636 case POK_VarAccess: 1637 DiagID = diag::warn_variable_requires_lock; 1638 break; 1639 case POK_VarDereference: 1640 DiagID = diag::warn_var_deref_requires_lock; 1641 break; 1642 case POK_FunctionCall: 1643 DiagID = diag::warn_fun_requires_lock; 1644 break; 1645 case POK_PassByRef: 1646 DiagID = diag::warn_guarded_pass_by_reference; 1647 break; 1648 case POK_PtPassByRef: 1649 DiagID = diag::warn_pt_guarded_pass_by_reference; 1650 break; 1651 } 1652 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) << Kind 1653 << D->getNameAsString() 1654 << LockName << LK); 1655 if (Verbose && POK == POK_VarAccess) { 1656 PartialDiagnosticAt Note(D->getLocation(), 1657 S.PDiag(diag::note_guarded_by_declared_here) 1658 << D->getNameAsString()); 1659 Warnings.push_back(DelayedDiag(Warning, getNotes(Note))); 1660 } else 1661 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1662 } 1663 } 1664 1665 1666 virtual void handleNegativeNotHeld(StringRef Kind, Name LockName, Name Neg, 1667 SourceLocation Loc) override { 1668 PartialDiagnosticAt Warning(Loc, 1669 S.PDiag(diag::warn_acquire_requires_negative_cap) 1670 << Kind << LockName << Neg); 1671 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1672 } 1673 1674 1675 void handleFunExcludesLock(StringRef Kind, Name FunName, Name LockName, 1676 SourceLocation Loc) override { 1677 PartialDiagnosticAt Warning(Loc, S.PDiag(diag::warn_fun_excludes_mutex) 1678 << Kind << FunName << LockName); 1679 Warnings.push_back(DelayedDiag(Warning, getNotes())); 1680 } 1681 1682 void enterFunction(const FunctionDecl* FD) override { 1683 CurrentFunction = FD; 1684 } 1685 1686 void leaveFunction(const FunctionDecl* FD) override { 1687 CurrentFunction = 0; 1688 } 1689 }; 1690 1691 } 1692 } 1693 1694 //===----------------------------------------------------------------------===// 1695 // -Wconsumed 1696 //===----------------------------------------------------------------------===// 1697 1698 namespace clang { 1699 namespace consumed { 1700 namespace { 1701 class ConsumedWarningsHandler : public ConsumedWarningsHandlerBase { 1702 1703 Sema &S; 1704 DiagList Warnings; 1705 1706 public: 1707 1708 ConsumedWarningsHandler(Sema &S) : S(S) {} 1709 1710 void emitDiagnostics() override { 1711 Warnings.sort(SortDiagBySourceLocation(S.getSourceManager())); 1712 for (const auto &Diag : Warnings) { 1713 S.Diag(Diag.first.first, Diag.first.second); 1714 for (const auto &Note : Diag.second) 1715 S.Diag(Note.first, Note.second); 1716 } 1717 } 1718 1719 void warnLoopStateMismatch(SourceLocation Loc, 1720 StringRef VariableName) override { 1721 PartialDiagnosticAt Warning(Loc, S.PDiag(diag::warn_loop_state_mismatch) << 1722 VariableName); 1723 1724 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1725 } 1726 1727 void warnParamReturnTypestateMismatch(SourceLocation Loc, 1728 StringRef VariableName, 1729 StringRef ExpectedState, 1730 StringRef ObservedState) override { 1731 1732 PartialDiagnosticAt Warning(Loc, S.PDiag( 1733 diag::warn_param_return_typestate_mismatch) << VariableName << 1734 ExpectedState << ObservedState); 1735 1736 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1737 } 1738 1739 void warnParamTypestateMismatch(SourceLocation Loc, StringRef ExpectedState, 1740 StringRef ObservedState) override { 1741 1742 PartialDiagnosticAt Warning(Loc, S.PDiag( 1743 diag::warn_param_typestate_mismatch) << ExpectedState << ObservedState); 1744 1745 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1746 } 1747 1748 void warnReturnTypestateForUnconsumableType(SourceLocation Loc, 1749 StringRef TypeName) override { 1750 PartialDiagnosticAt Warning(Loc, S.PDiag( 1751 diag::warn_return_typestate_for_unconsumable_type) << TypeName); 1752 1753 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1754 } 1755 1756 void warnReturnTypestateMismatch(SourceLocation Loc, StringRef ExpectedState, 1757 StringRef ObservedState) override { 1758 1759 PartialDiagnosticAt Warning(Loc, S.PDiag( 1760 diag::warn_return_typestate_mismatch) << ExpectedState << ObservedState); 1761 1762 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1763 } 1764 1765 void warnUseOfTempInInvalidState(StringRef MethodName, StringRef State, 1766 SourceLocation Loc) override { 1767 1768 PartialDiagnosticAt Warning(Loc, S.PDiag( 1769 diag::warn_use_of_temp_in_invalid_state) << MethodName << State); 1770 1771 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1772 } 1773 1774 void warnUseInInvalidState(StringRef MethodName, StringRef VariableName, 1775 StringRef State, SourceLocation Loc) override { 1776 1777 PartialDiagnosticAt Warning(Loc, S.PDiag(diag::warn_use_in_invalid_state) << 1778 MethodName << VariableName << State); 1779 1780 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 1781 } 1782 }; 1783 }}} 1784 1785 //===----------------------------------------------------------------------===// 1786 // AnalysisBasedWarnings - Worker object used by Sema to execute analysis-based 1787 // warnings on a function, method, or block. 1788 //===----------------------------------------------------------------------===// 1789 1790 clang::sema::AnalysisBasedWarnings::Policy::Policy() { 1791 enableCheckFallThrough = 1; 1792 enableCheckUnreachable = 0; 1793 enableThreadSafetyAnalysis = 0; 1794 enableConsumedAnalysis = 0; 1795 } 1796 1797 static unsigned isEnabled(DiagnosticsEngine &D, unsigned diag) { 1798 return (unsigned)!D.isIgnored(diag, SourceLocation()); 1799 } 1800 1801 clang::sema::AnalysisBasedWarnings::AnalysisBasedWarnings(Sema &s) 1802 : S(s), 1803 NumFunctionsAnalyzed(0), 1804 NumFunctionsWithBadCFGs(0), 1805 NumCFGBlocks(0), 1806 MaxCFGBlocksPerFunction(0), 1807 NumUninitAnalysisFunctions(0), 1808 NumUninitAnalysisVariables(0), 1809 MaxUninitAnalysisVariablesPerFunction(0), 1810 NumUninitAnalysisBlockVisits(0), 1811 MaxUninitAnalysisBlockVisitsPerFunction(0) { 1812 1813 using namespace diag; 1814 DiagnosticsEngine &D = S.getDiagnostics(); 1815 1816 DefaultPolicy.enableCheckUnreachable = 1817 isEnabled(D, warn_unreachable) || 1818 isEnabled(D, warn_unreachable_break) || 1819 isEnabled(D, warn_unreachable_return) || 1820 isEnabled(D, warn_unreachable_loop_increment); 1821 1822 DefaultPolicy.enableThreadSafetyAnalysis = 1823 isEnabled(D, warn_double_lock); 1824 1825 DefaultPolicy.enableConsumedAnalysis = 1826 isEnabled(D, warn_use_in_invalid_state); 1827 } 1828 1829 static void flushDiagnostics(Sema &S, const sema::FunctionScopeInfo *fscope) { 1830 for (const auto &D : fscope->PossiblyUnreachableDiags) 1831 S.Diag(D.Loc, D.PD); 1832 } 1833 1834 void clang::sema:: 1835 AnalysisBasedWarnings::IssueWarnings(sema::AnalysisBasedWarnings::Policy P, 1836 sema::FunctionScopeInfo *fscope, 1837 const Decl *D, const BlockExpr *blkExpr) { 1838 1839 // We avoid doing analysis-based warnings when there are errors for 1840 // two reasons: 1841 // (1) The CFGs often can't be constructed (if the body is invalid), so 1842 // don't bother trying. 1843 // (2) The code already has problems; running the analysis just takes more 1844 // time. 1845 DiagnosticsEngine &Diags = S.getDiagnostics(); 1846 1847 // Do not do any analysis for declarations in system headers if we are 1848 // going to just ignore them. 1849 if (Diags.getSuppressSystemWarnings() && 1850 S.SourceMgr.isInSystemHeader(D->getLocation())) 1851 return; 1852 1853 // For code in dependent contexts, we'll do this at instantiation time. 1854 if (cast<DeclContext>(D)->isDependentContext()) 1855 return; 1856 1857 if (Diags.hasUncompilableErrorOccurred() || Diags.hasFatalErrorOccurred()) { 1858 // Flush out any possibly unreachable diagnostics. 1859 flushDiagnostics(S, fscope); 1860 return; 1861 } 1862 1863 const Stmt *Body = D->getBody(); 1864 assert(Body); 1865 1866 // Construct the analysis context with the specified CFG build options. 1867 AnalysisDeclContext AC(/* AnalysisDeclContextManager */ nullptr, D); 1868 1869 // Don't generate EH edges for CallExprs as we'd like to avoid the n^2 1870 // explosion for destructors that can result and the compile time hit. 1871 AC.getCFGBuildOptions().PruneTriviallyFalseEdges = true; 1872 AC.getCFGBuildOptions().AddEHEdges = false; 1873 AC.getCFGBuildOptions().AddInitializers = true; 1874 AC.getCFGBuildOptions().AddImplicitDtors = true; 1875 AC.getCFGBuildOptions().AddTemporaryDtors = true; 1876 AC.getCFGBuildOptions().AddCXXNewAllocator = false; 1877 1878 // Force that certain expressions appear as CFGElements in the CFG. This 1879 // is used to speed up various analyses. 1880 // FIXME: This isn't the right factoring. This is here for initial 1881 // prototyping, but we need a way for analyses to say what expressions they 1882 // expect to always be CFGElements and then fill in the BuildOptions 1883 // appropriately. This is essentially a layering violation. 1884 if (P.enableCheckUnreachable || P.enableThreadSafetyAnalysis || 1885 P.enableConsumedAnalysis) { 1886 // Unreachable code analysis and thread safety require a linearized CFG. 1887 AC.getCFGBuildOptions().setAllAlwaysAdd(); 1888 } 1889 else { 1890 AC.getCFGBuildOptions() 1891 .setAlwaysAdd(Stmt::BinaryOperatorClass) 1892 .setAlwaysAdd(Stmt::CompoundAssignOperatorClass) 1893 .setAlwaysAdd(Stmt::BlockExprClass) 1894 .setAlwaysAdd(Stmt::CStyleCastExprClass) 1895 .setAlwaysAdd(Stmt::DeclRefExprClass) 1896 .setAlwaysAdd(Stmt::ImplicitCastExprClass) 1897 .setAlwaysAdd(Stmt::UnaryOperatorClass) 1898 .setAlwaysAdd(Stmt::AttributedStmtClass); 1899 } 1900 1901 // Install the logical handler for -Wtautological-overlap-compare 1902 std::unique_ptr<LogicalErrorHandler> LEH; 1903 if (!Diags.isIgnored(diag::warn_tautological_overlap_comparison, 1904 D->getLocStart())) { 1905 LEH.reset(new LogicalErrorHandler(S)); 1906 AC.getCFGBuildOptions().Observer = LEH.get(); 1907 } 1908 1909 // Emit delayed diagnostics. 1910 if (!fscope->PossiblyUnreachableDiags.empty()) { 1911 bool analyzed = false; 1912 1913 // Register the expressions with the CFGBuilder. 1914 for (const auto &D : fscope->PossiblyUnreachableDiags) { 1915 if (D.stmt) 1916 AC.registerForcedBlockExpression(D.stmt); 1917 } 1918 1919 if (AC.getCFG()) { 1920 analyzed = true; 1921 for (const auto &D : fscope->PossiblyUnreachableDiags) { 1922 bool processed = false; 1923 if (D.stmt) { 1924 const CFGBlock *block = AC.getBlockForRegisteredExpression(D.stmt); 1925 CFGReverseBlockReachabilityAnalysis *cra = 1926 AC.getCFGReachablityAnalysis(); 1927 // FIXME: We should be able to assert that block is non-null, but 1928 // the CFG analysis can skip potentially-evaluated expressions in 1929 // edge cases; see test/Sema/vla-2.c. 1930 if (block && cra) { 1931 // Can this block be reached from the entrance? 1932 if (cra->isReachable(&AC.getCFG()->getEntry(), block)) 1933 S.Diag(D.Loc, D.PD); 1934 processed = true; 1935 } 1936 } 1937 if (!processed) { 1938 // Emit the warning anyway if we cannot map to a basic block. 1939 S.Diag(D.Loc, D.PD); 1940 } 1941 } 1942 } 1943 1944 if (!analyzed) 1945 flushDiagnostics(S, fscope); 1946 } 1947 1948 1949 // Warning: check missing 'return' 1950 if (P.enableCheckFallThrough) { 1951 const CheckFallThroughDiagnostics &CD = 1952 (isa<BlockDecl>(D) ? CheckFallThroughDiagnostics::MakeForBlock() 1953 : (isa<CXXMethodDecl>(D) && 1954 cast<CXXMethodDecl>(D)->getOverloadedOperator() == OO_Call && 1955 cast<CXXMethodDecl>(D)->getParent()->isLambda()) 1956 ? CheckFallThroughDiagnostics::MakeForLambda() 1957 : CheckFallThroughDiagnostics::MakeForFunction(D)); 1958 CheckFallThroughForBody(S, D, Body, blkExpr, CD, AC); 1959 } 1960 1961 // Warning: check for unreachable code 1962 if (P.enableCheckUnreachable) { 1963 // Only check for unreachable code on non-template instantiations. 1964 // Different template instantiations can effectively change the control-flow 1965 // and it is very difficult to prove that a snippet of code in a template 1966 // is unreachable for all instantiations. 1967 bool isTemplateInstantiation = false; 1968 if (const FunctionDecl *Function = dyn_cast<FunctionDecl>(D)) 1969 isTemplateInstantiation = Function->isTemplateInstantiation(); 1970 if (!isTemplateInstantiation) 1971 CheckUnreachable(S, AC); 1972 } 1973 1974 // Check for thread safety violations 1975 if (P.enableThreadSafetyAnalysis) { 1976 SourceLocation FL = AC.getDecl()->getLocation(); 1977 SourceLocation FEL = AC.getDecl()->getLocEnd(); 1978 threadSafety::ThreadSafetyReporter Reporter(S, FL, FEL); 1979 if (!Diags.isIgnored(diag::warn_thread_safety_beta, D->getLocStart())) 1980 Reporter.setIssueBetaWarnings(true); 1981 if (!Diags.isIgnored(diag::warn_thread_safety_verbose, D->getLocStart())) 1982 Reporter.setVerbose(true); 1983 1984 threadSafety::runThreadSafetyAnalysis(AC, Reporter); 1985 Reporter.emitDiagnostics(); 1986 } 1987 1988 // Check for violations of consumed properties. 1989 if (P.enableConsumedAnalysis) { 1990 consumed::ConsumedWarningsHandler WarningHandler(S); 1991 consumed::ConsumedAnalyzer Analyzer(WarningHandler); 1992 Analyzer.run(AC); 1993 } 1994 1995 if (!Diags.isIgnored(diag::warn_uninit_var, D->getLocStart()) || 1996 !Diags.isIgnored(diag::warn_sometimes_uninit_var, D->getLocStart()) || 1997 !Diags.isIgnored(diag::warn_maybe_uninit_var, D->getLocStart())) { 1998 if (CFG *cfg = AC.getCFG()) { 1999 UninitValsDiagReporter reporter(S); 2000 UninitVariablesAnalysisStats stats; 2001 std::memset(&stats, 0, sizeof(UninitVariablesAnalysisStats)); 2002 runUninitializedVariablesAnalysis(*cast<DeclContext>(D), *cfg, AC, 2003 reporter, stats); 2004 2005 if (S.CollectStats && stats.NumVariablesAnalyzed > 0) { 2006 ++NumUninitAnalysisFunctions; 2007 NumUninitAnalysisVariables += stats.NumVariablesAnalyzed; 2008 NumUninitAnalysisBlockVisits += stats.NumBlockVisits; 2009 MaxUninitAnalysisVariablesPerFunction = 2010 std::max(MaxUninitAnalysisVariablesPerFunction, 2011 stats.NumVariablesAnalyzed); 2012 MaxUninitAnalysisBlockVisitsPerFunction = 2013 std::max(MaxUninitAnalysisBlockVisitsPerFunction, 2014 stats.NumBlockVisits); 2015 } 2016 } 2017 } 2018 2019 bool FallThroughDiagFull = 2020 !Diags.isIgnored(diag::warn_unannotated_fallthrough, D->getLocStart()); 2021 bool FallThroughDiagPerFunction = !Diags.isIgnored( 2022 diag::warn_unannotated_fallthrough_per_function, D->getLocStart()); 2023 if (FallThroughDiagFull || FallThroughDiagPerFunction) { 2024 DiagnoseSwitchLabelsFallthrough(S, AC, !FallThroughDiagFull); 2025 } 2026 2027 if (S.getLangOpts().ObjCARCWeak && 2028 !Diags.isIgnored(diag::warn_arc_repeated_use_of_weak, D->getLocStart())) 2029 diagnoseRepeatedUseOfWeak(S, fscope, D, AC.getParentMap()); 2030 2031 2032 // Check for infinite self-recursion in functions 2033 if (!Diags.isIgnored(diag::warn_infinite_recursive_function, 2034 D->getLocStart())) { 2035 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 2036 checkRecursiveFunction(S, FD, Body, AC); 2037 } 2038 } 2039 2040 // If none of the previous checks caused a CFG build, trigger one here 2041 // for -Wtautological-overlap-compare 2042 if (!Diags.isIgnored(diag::warn_tautological_overlap_comparison, 2043 D->getLocStart())) { 2044 AC.getCFG(); 2045 } 2046 2047 // Collect statistics about the CFG if it was built. 2048 if (S.CollectStats && AC.isCFGBuilt()) { 2049 ++NumFunctionsAnalyzed; 2050 if (CFG *cfg = AC.getCFG()) { 2051 // If we successfully built a CFG for this context, record some more 2052 // detail information about it. 2053 NumCFGBlocks += cfg->getNumBlockIDs(); 2054 MaxCFGBlocksPerFunction = std::max(MaxCFGBlocksPerFunction, 2055 cfg->getNumBlockIDs()); 2056 } else { 2057 ++NumFunctionsWithBadCFGs; 2058 } 2059 } 2060 } 2061 2062 void clang::sema::AnalysisBasedWarnings::PrintStats() const { 2063 llvm::errs() << "\n*** Analysis Based Warnings Stats:\n"; 2064 2065 unsigned NumCFGsBuilt = NumFunctionsAnalyzed - NumFunctionsWithBadCFGs; 2066 unsigned AvgCFGBlocksPerFunction = 2067 !NumCFGsBuilt ? 0 : NumCFGBlocks/NumCFGsBuilt; 2068 llvm::errs() << NumFunctionsAnalyzed << " functions analyzed (" 2069 << NumFunctionsWithBadCFGs << " w/o CFGs).\n" 2070 << " " << NumCFGBlocks << " CFG blocks built.\n" 2071 << " " << AvgCFGBlocksPerFunction 2072 << " average CFG blocks per function.\n" 2073 << " " << MaxCFGBlocksPerFunction 2074 << " max CFG blocks per function.\n"; 2075 2076 unsigned AvgUninitVariablesPerFunction = !NumUninitAnalysisFunctions ? 0 2077 : NumUninitAnalysisVariables/NumUninitAnalysisFunctions; 2078 unsigned AvgUninitBlockVisitsPerFunction = !NumUninitAnalysisFunctions ? 0 2079 : NumUninitAnalysisBlockVisits/NumUninitAnalysisFunctions; 2080 llvm::errs() << NumUninitAnalysisFunctions 2081 << " functions analyzed for uninitialiazed variables\n" 2082 << " " << NumUninitAnalysisVariables << " variables analyzed.\n" 2083 << " " << AvgUninitVariablesPerFunction 2084 << " average variables per function.\n" 2085 << " " << MaxUninitAnalysisVariablesPerFunction 2086 << " max variables per function.\n" 2087 << " " << NumUninitAnalysisBlockVisits << " block visits.\n" 2088 << " " << AvgUninitBlockVisitsPerFunction 2089 << " average block visits per function.\n" 2090 << " " << MaxUninitAnalysisBlockVisitsPerFunction 2091 << " max block visits per function.\n"; 2092 } 2093