From 2055effed54d614b51e3501a174c9b1fe92e4de4 Mon Sep 17 00:00:00 2001 From: Zhongxing Xu Date: Tue, 24 Nov 2009 07:06:39 +0000 Subject: Refactor NilReceiverStructRet and NilReceiverLargerThanVoidPtrRet into CallAndMessageChecker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89745 91177308-0d34-0410-b5e6-96231b3b80d8 --- lib/Analysis/CallAndMessageChecker.cpp | 118 ++++++++++++++++++++++++++++++++- 1 file changed, 115 insertions(+), 3 deletions(-) (limited to 'lib/Analysis/CallAndMessageChecker.cpp') diff --git a/lib/Analysis/CallAndMessageChecker.cpp b/lib/Analysis/CallAndMessageChecker.cpp index 8386d03e23..ebc3a4fd56 100644 --- a/lib/Analysis/CallAndMessageChecker.cpp +++ b/lib/Analysis/CallAndMessageChecker.cpp @@ -14,6 +14,7 @@ #include "clang/Analysis/PathSensitive/CheckerVisitor.h" #include "clang/Analysis/PathSensitive/BugReporter.h" +#include "clang/AST/ParentMap.h" #include "GRExprEngineInternalChecks.h" using namespace clang; @@ -26,10 +27,13 @@ class VISIBILITY_HIDDEN CallAndMessageChecker BugType *BT_call_arg; BugType *BT_msg_undef; BugType *BT_msg_arg; + BugType *BT_struct_ret; + BugType *BT_void_ptr; public: CallAndMessageChecker() : BT_call_null(0), BT_call_undef(0), BT_call_arg(0), - BT_msg_undef(0), BT_msg_arg(0) {} + BT_msg_undef(0), BT_msg_arg(0), BT_struct_ret(0), BT_void_ptr(0) {} + static void *getTag() { static int x = 0; return &x; @@ -119,8 +123,8 @@ void CallAndMessageChecker::PreVisitObjCMessageExpr(CheckerContext &C, } // Check for any arguments that are uninitialized/undefined. - for (ObjCMessageExpr::const_arg_iterator I = ME->arg_begin(), E = ME->arg_end(); - I != E; ++I) { + for (ObjCMessageExpr::const_arg_iterator I = ME->arg_begin(), + E = ME->arg_end(); I != E; ++I) { if (state->getSVal(*I).isUndef()) { if (ExplodedNode *N = C.GenerateSink()) { if (!BT_msg_arg) @@ -137,4 +141,112 @@ void CallAndMessageChecker::PreVisitObjCMessageExpr(CheckerContext &C, } } } + + // Check if the receiver was nil and then return value a struct. + if (const Expr *Receiver = ME->getReceiver()) { + SVal L_untested = state->getSVal(Receiver); + // Assume that the receiver is not NULL. + DefinedOrUnknownSVal L = cast(L_untested); + const GRState *StNotNull = state->Assume(L, true); + + // Assume that the receiver is NULL. + const GRState *StNull = state->Assume(L, false); + + if (StNull) { + QualType RetTy = ME->getType(); + if (RetTy->isRecordType()) { + if (C.getPredecessor()->getParentMap().isConsumedExpr(ME)) { + // The [0 ...] expressions will return garbage. Flag either an + // explicit or implicit error. Because of the structure of this + // function we currently do not bifurfacte the state graph at + // this point. + // FIXME: We should bifurcate and fill the returned struct with + // garbage. + if (ExplodedNode* N = C.GenerateSink(StNull)) { + if (!StNotNull) { + if (!BT_struct_ret) { + std::string sbuf; + llvm::raw_string_ostream os(sbuf); + os << "The receiver in the message expression is 'nil' and " + "results in the returned value (of type '" + << ME->getType().getAsString() + << "') to be garbage or otherwise undefined"; + BT_struct_ret = new BuiltinBug(os.str().c_str()); + } + + EnhancedBugReport *R = new EnhancedBugReport(*BT_struct_ret, + BT_struct_ret->getName(), N); + R->addRange(Receiver->getSourceRange()); + R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, + Receiver); + C.EmitReport(R); + return; + } + else + // Do not report implicit bug. + return; + } + } + } else { + ASTContext &Ctx = C.getASTContext(); + if (RetTy != Ctx.VoidTy) { + if (C.getPredecessor()->getParentMap().isConsumedExpr(ME)) { + // sizeof(void *) + const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy); + // sizeof(return type) + const uint64_t returnTypeSize = Ctx.getTypeSize(ME->getType()); + + if (voidPtrSize < returnTypeSize) { + if (ExplodedNode* N = C.GenerateSink(StNull)) { + if (!StNotNull) { + if (!BT_struct_ret) { + std::string sbuf; + llvm::raw_string_ostream os(sbuf); + os << "The receiver in the message expression is 'nil' and " + "results in the returned value (of type '" + << ME->getType().getAsString() + << "' and of size " + << returnTypeSize / 8 + << " bytes) to be garbage or otherwise undefined"; + BT_void_ptr = new BuiltinBug(os.str().c_str()); + } + + EnhancedBugReport *R = new EnhancedBugReport(*BT_void_ptr, + BT_void_ptr->getName(), N); + R->addRange(Receiver->getSourceRange()); + R->addVisitorCreator( + bugreporter::registerTrackNullOrUndefValue, Receiver); + C.EmitReport(R); + return; + } else + // Do not report implicit bug. + return; + } + } + else if (!StNotNull) { + // Handle the safe cases where the return value is 0 if the + // receiver is nil. + // + // FIXME: For now take the conservative approach that we only + // return null values if we *know* that the receiver is nil. + // This is because we can have surprises like: + // + // ... = [[NSScreens screens] objectAtIndex:0]; + // + // What can happen is that [... screens] could return nil, but + // it most likely isn't nil. We should assume the semantics + // of this case unless we have *a lot* more knowledge. + // + SVal V = C.getValueManager().makeZeroVal(ME->getType()); + C.GenerateNode(StNull->BindExpr(ME, V)); + return; + } + } + } + } + } + // Do not propagate null state. + if (StNotNull) + C.GenerateNode(StNotNull); + } } -- cgit v1.2.3-18-g5258