clang 8.0.0

NullabilityChecker.cpp
Go to the documentation of this file.
1 //== Nullabilityhecker.cpp - Nullability checker ----------------*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker tries to find nullability violations. There are several kinds of
11 // possible violations:
12 // * Null pointer is passed to a pointer which has a _Nonnull type.
13 // * Null pointer is returned from a function which has a _Nonnull return type.
14 // * Nullable pointer is passed to a pointer which has a _Nonnull type.
15 // * Nullable pointer is returned from a function which has a _Nonnull return
16 // type.
17 // * Nullable pointer is dereferenced.
18 //
19 // This checker propagates the nullability information of the pointers and looks
20 // for the patterns that are described above. Explicit casts are trusted and are
21 // considered a way to suppress false positives for this checker. The other way
22 // to suppress warnings would be to add asserts or guarding if statements to the
23 // code. In addition to the nullability propagation this checker also uses some
24 // heuristics to suppress potential false positives.
25 //
26 //===----------------------------------------------------------------------===//
27
28 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
29
30 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
31 #include "clang/StaticAnalyzer/Core/Checker.h"
32 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
33 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
34 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
35 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
36
37 #include "llvm/ADT/StringExtras.h"
38 #include "llvm/Support/Path.h"
39
40 using namespace clang;
41 using namespace ento;
42
43 namespace {
44
45 /// Returns the most nullable nullability. This is used for message expressions
46 /// like [receiver method], where the nullability of this expression is either
47 /// the nullability of the receiver or the nullability of the return type of the
48 /// method, depending on which is more nullable. Contradicted is considered to
49 /// be the most nullable, to avoid false positive results.
50 Nullability getMostNullable(Nullability Lhs, Nullability Rhs) {
51 return static_cast<Nullability>(
52 std::min(static_cast<char>(Lhs), static_cast<char>(Rhs)));
53 }
54
55 const char *getNullabilityString(Nullability Nullab) {
56 switch (Nullab) {
57 case Nullability::Contradicted:
58 return "contradicted";
59 case Nullability::Nullable:
60 return "nullable";
61 case Nullability::Unspecified:
62 return "unspecified";
63 case Nullability::Nonnull:
64 return "nonnull";
65 }
66 llvm_unreachable("Unexpected enumeration.");
67 return "";
68 }
69
70 // These enums are used as an index to ErrorMessages array.
71 enum class ErrorKind : int {
72 NilAssignedToNonnull,
73 NilPassedToNonnull,
74 NilReturnedToNonnull,
75 NullableAssignedToNonnull,
76 NullableReturnedToNonnull,
77 NullableDereferenced,
78 NullablePassedToNonnull
79 };
80
81 class NullabilityChecker
82 : public Checker<check::Bind, check::PreCall, check::PreStmt<ReturnStmt>,
83 check::PostCall, check::PostStmt<ExplicitCastExpr>,
84 check::PostObjCMessage, check::DeadSymbols,
85 check::Event<ImplicitNullDerefEvent>> {
86 mutable std::unique_ptr<BugType> BT;
87
88 public:
89 // If true, the checker will not diagnose nullabilility issues for calls
90 // to system headers. This option is motivated by the observation that large
91 // projects may have many nullability warnings. These projects may
92 // find warnings about nullability annotations that they have explicitly
93 // added themselves higher priority to fix than warnings on calls to system
94 // libraries.
95 DefaultBool NoDiagnoseCallsToSystemHeaders;
96
97 void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const;
98 void checkPostStmt(const ExplicitCastExpr *CE, CheckerContext &C) const;
99 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
100 void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
101 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
102 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
103 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
104 void checkEvent(ImplicitNullDerefEvent Event) const;
105
106 void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
107 const char *Sep) const override;
108
109 struct NullabilityChecksFilter {
110 DefaultBool CheckNullPassedToNonnull;
111 DefaultBool CheckNullReturnedFromNonnull;
112 DefaultBool CheckNullableDereferenced;
113 DefaultBool CheckNullablePassedToNonnull;
114 DefaultBool CheckNullableReturnedFromNonnull;
115
116 CheckName CheckNameNullPassedToNonnull;
117 CheckName CheckNameNullReturnedFromNonnull;
118 CheckName CheckNameNullableDereferenced;
119 CheckName CheckNameNullablePassedToNonnull;
120 CheckName CheckNameNullableReturnedFromNonnull;
121 };
122
123 NullabilityChecksFilter Filter;
124 // When set to false no nullability information will be tracked in
125 // NullabilityMap. It is possible to catch errors like passing a null pointer
126 // to a callee that expects nonnull argument without the information that is
127 // stroed in the NullabilityMap. This is an optimization.
128 DefaultBool NeedTracking;
129
130 private:
131 class NullabilityBugVisitor : public BugReporterVisitor {
132 public:
133 NullabilityBugVisitor(const MemRegion *M) : Region(M) {}
134
135 void Profile(llvm::FoldingSetNodeID &ID) const override {
136 static int X = 0;
137 ID.AddPointer(&X);
138 ID.AddPointer(Region);
139 }
140
141 std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
142 BugReporterContext &BRC,
143 BugReport &BR) override;
144
145 private:
146 // The tracked region.
147 const MemRegion *Region;
148 };
149
150 /// When any of the nonnull arguments of the analyzed function is null, do not
151 /// report anything and turn off the check.
152 ///
153 /// When \p SuppressPath is set to true, no more bugs will be reported on this
154 /// path by this checker.
155 void reportBugIfInvariantHolds(StringRef Msg, ErrorKind Error,
156 ExplodedNode *N, const MemRegion *Region,
157 CheckerContext &C,
158 const Stmt *ValueExpr = nullptr,
159 bool SuppressPath = false) const;
160
161 void reportBug(StringRef Msg, ErrorKind Error, ExplodedNode *N,
162 const MemRegion *Region, BugReporter &BR,
163 const Stmt *ValueExpr = nullptr) const {
164 if (!BT)
165 BT.reset(new BugType(this, "Nullability", categories::MemoryError));
166
167 auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
168 if (Region) {
169 R->markInteresting(Region);
170 R->addVisitor(llvm::make_unique<NullabilityBugVisitor>(Region));
171 }
172 if (ValueExpr) {
173 R->addRange(ValueExpr->getSourceRange());
174 if (Error == ErrorKind::NilAssignedToNonnull ||
175 Error == ErrorKind::NilPassedToNonnull ||
176 Error == ErrorKind::NilReturnedToNonnull)
177 if (const auto *Ex = dyn_cast<Expr>(ValueExpr))
178 bugreporter::trackExpressionValue(N, Ex, *R);
179 }
180 BR.emitReport(std::move(R));
181 }
182
183 /// If an SVal wraps a region that should be tracked, it will return a pointer
184 /// to the wrapped region. Otherwise it will return a nullptr.
185 const SymbolicRegion *getTrackRegion(SVal Val,
186 bool CheckSuperRegion = false) const;
187
188 /// Returns true if the call is diagnosable in the current analyzer
189 /// configuration.
190 bool isDiagnosableCall(const CallEvent &Call) const {
191 if (NoDiagnoseCallsToSystemHeaders && Call.isInSystemHeader())
192 return false;
193
194 return true;
195 }
196 };
197
198 class NullabilityState {
199 public:
200 NullabilityState(Nullability Nullab, const Stmt *Source = nullptr)
201 : Nullab(Nullab), Source(Source) {}
202
203 const Stmt *getNullabilitySource() const { return Source; }
204
205 Nullability getValue() const { return Nullab; }
206
207 void Profile(llvm::FoldingSetNodeID &ID) const {
208 ID.AddInteger(static_cast<char>(Nullab));
209 ID.AddPointer(Source);
210 }
211
212 void print(raw_ostream &Out) const {
213 Out << getNullabilityString(Nullab) << "\n";
214 }
215
216 private:
217 Nullability Nullab;
218 // Source is the expression which determined the nullability. For example in a
219 // message like [nullable nonnull_returning] has nullable nullability, because
220 // the receiver is nullable. Here the receiver will be the source of the
221 // nullability. This is useful information when the diagnostics are generated.
222 const Stmt *Source;
223 };
224
225 bool operator==(NullabilityState Lhs, NullabilityState Rhs) {
226 return Lhs.getValue() == Rhs.getValue() &&
227 Lhs.getNullabilitySource() == Rhs.getNullabilitySource();
228 }
229
230 } // end anonymous namespace
231
232 REGISTER_MAP_WITH_PROGRAMSTATE(NullabilityMap, const MemRegion *,
233 NullabilityState)
234
235 // We say "the nullability type invariant is violated" when a location with a
236 // non-null type contains NULL or a function with a non-null return type returns
237 // NULL. Violations of the nullability type invariant can be detected either
238 // directly (for example, when NULL is passed as an argument to a nonnull
239 // parameter) or indirectly (for example, when, inside a function, the
240 // programmer defensively checks whether a nonnull parameter contains NULL and
241 // finds that it does).
242 //
243 // As a matter of policy, the nullability checker typically warns on direct
244 // violations of the nullability invariant (although it uses various
245 // heuristics to suppress warnings in some cases) but will not warn if the
246 // invariant has already been violated along the path (either directly or
247 // indirectly). As a practical matter, this prevents the analyzer from
248 // (1) warning on defensive code paths where a nullability precondition is
249 // determined to have been violated, (2) warning additional times after an
250 // initial direct violation has been discovered, and (3) warning after a direct
251 // violation that has been implicitly or explicitly suppressed (for
252 // example, with a cast of NULL to _Nonnull). In essence, once an invariant
253 // violation is detected on a path, this checker will be essentially turned off
254 // for the rest of the analysis
255 //
256 // The analyzer takes this approach (rather than generating a sink node) to
257 // ensure coverage of defensive paths, which may be important for backwards
258 // compatibility in codebases that were developed without nullability in mind.
259 REGISTER_TRAIT_WITH_PROGRAMSTATE(InvariantViolated, bool)
260
261 enum class NullConstraint { IsNull, IsNotNull, Unknown };
262
263 static NullConstraint getNullConstraint(DefinedOrUnknownSVal Val,
264 ProgramStateRef State) {
265 ConditionTruthVal Nullness = State->isNull(Val);
266 if (Nullness.isConstrainedFalse())
267 return NullConstraint::IsNotNull;
268 if (Nullness.isConstrainedTrue())
269 return NullConstraint::IsNull;
270 return NullConstraint::Unknown;
271 }
272
273 const SymbolicRegion *
274 NullabilityChecker::getTrackRegion(SVal Val, bool CheckSuperRegion) const {
275 if (!NeedTracking)
276 return nullptr;
277
278 auto RegionSVal = Val.getAs<loc::MemRegionVal>();
279 if (!RegionSVal)
280 return nullptr;
281
282 const MemRegion *Region = RegionSVal->getRegion();
283
284 if (CheckSuperRegion) {
285 if (auto FieldReg = Region->getAs<FieldRegion>())
286 return dyn_cast<SymbolicRegion>(FieldReg->getSuperRegion());
287 if (auto ElementReg = Region->getAs<ElementRegion>())
288 return dyn_cast<SymbolicRegion>(ElementReg->getSuperRegion());
289 }
290
291 return dyn_cast<SymbolicRegion>(Region);
292 }
293
294 std::shared_ptr<PathDiagnosticPiece>
295 NullabilityChecker::NullabilityBugVisitor::VisitNode(const ExplodedNode *N,
296 BugReporterContext &BRC,
297 BugReport &BR) {
298 ProgramStateRef State = N->getState();
299 ProgramStateRef StatePrev = N->getFirstPred()->getState();
300
301 const NullabilityState *TrackedNullab = State->get<NullabilityMap>(Region);
302 const NullabilityState *TrackedNullabPrev =
303 StatePrev->get<NullabilityMap>(Region);
304 if (!TrackedNullab)
305 return nullptr;
306
307 if (TrackedNullabPrev &&
308 TrackedNullabPrev->getValue() == TrackedNullab->getValue())
309 return nullptr;
310
311 // Retrieve the associated statement.
312 const Stmt *S = TrackedNullab->getNullabilitySource();
313 if (!S || S->getBeginLoc().isInvalid()) {
314 S = PathDiagnosticLocation::getStmt(N);
315 }
316
317 if (!S)
318 return nullptr;
319
320 std::string InfoText =
321 (llvm::Twine("Nullability '") +
322 getNullabilityString(TrackedNullab->getValue()) + "' is inferred")
323 .str();
324
325 // Generate the extra diagnostic.
326 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
327 N->getLocationContext());
328 return std::make_shared<PathDiagnosticEventPiece>(Pos, InfoText, true,
329 nullptr);
330 }
331
332 /// Returns true when the value stored at the given location has been
333 /// constrained to null after being passed through an object of nonnnull type.
334 static bool checkValueAtLValForInvariantViolation(ProgramStateRef State,
335 SVal LV, QualType T) {
336 if (getNullabilityAnnotation(T) != Nullability::Nonnull)
337 return false;
338
339 auto RegionVal = LV.getAs<loc::MemRegionVal>();
340 if (!RegionVal)
341 return false;
342
343 // If the value was constrained to null *after* it was passed through that
344 // location, it could not have been a concrete pointer *when* it was passed.
345 // In that case we would have handled the situation when the value was
346 // bound to that location, by emitting (or not emitting) a report.
347 // Therefore we are only interested in symbolic regions that can be either
348 // null or non-null depending on the value of their respective symbol.
349 auto StoredVal = State->getSVal(*RegionVal).getAs<loc::MemRegionVal>();
350 if (!StoredVal || !isa<SymbolicRegion>(StoredVal->getRegion()))
351 return false;
352
353 if (getNullConstraint(*StoredVal, State) == NullConstraint::IsNull)
354 return true;
355
356 return false;
357 }
358
359 static bool
360 checkParamsForPreconditionViolation(ArrayRef<ParmVarDecl *> Params,
361 ProgramStateRef State,
362 const LocationContext *LocCtxt) {
363 for (const auto *ParamDecl : Params) {
364 if (ParamDecl->isParameterPack())
365 break;
366
367 SVal LV = State->getLValue(ParamDecl, LocCtxt);
368 if (checkValueAtLValForInvariantViolation(State, LV,
369 ParamDecl->getType())) {
370 return true;
371 }
372 }
373 return false;
374 }
375
376 static bool
377 checkSelfIvarsForInvariantViolation(ProgramStateRef State,
378 const LocationContext *LocCtxt) {
379 auto *MD = dyn_cast<ObjCMethodDecl>(LocCtxt->getDecl());
380 if (!MD || !MD->isInstanceMethod())
381 return false;
382
383 const ImplicitParamDecl *SelfDecl = LocCtxt->getSelfDecl();
384 if (!SelfDecl)
385 return false;
386
387 SVal SelfVal = State->getSVal(State->getRegion(SelfDecl, LocCtxt));
388
389 const ObjCObjectPointerType *SelfType =
390 dyn_cast<ObjCObjectPointerType>(SelfDecl->getType());
391 if (!SelfType)
392 return false;
393
394 const ObjCInterfaceDecl *ID = SelfType->getInterfaceDecl();
395 if (!ID)
396 return false;
397
398 for (const auto *IvarDecl : ID->ivars()) {
399 SVal LV = State->getLValue(IvarDecl, SelfVal);
400 if (checkValueAtLValForInvariantViolation(State, LV, IvarDecl->getType())) {
401 return true;
402 }
403 }
404 return false;
405 }
406
407 static bool checkInvariantViolation(ProgramStateRef State, ExplodedNode *N,
408 CheckerContext &C) {
409 if (State->get<InvariantViolated>())
410 return true;
411
412 const LocationContext *LocCtxt = C.getLocationContext();
413 const Decl *D = LocCtxt->getDecl();
414 if (!D)
415 return false;
416
417 ArrayRef<ParmVarDecl*> Params;
418 if (const auto *BD = dyn_cast<BlockDecl>(D))
419 Params = BD->parameters();
420 else if (const auto *FD = dyn_cast<FunctionDecl>(D))
421 Params = FD->parameters();
422 else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
423 Params = MD->parameters();
424 else
425 return false;
426
427 if (checkParamsForPreconditionViolation(Params, State, LocCtxt) ||
428 checkSelfIvarsForInvariantViolation(State, LocCtxt)) {
429 if (!N->isSink())
430 C.addTransition(State->set<InvariantViolated>(true), N);
431 return true;
432 }
433 return false;
434 }
435
436 void NullabilityChecker::reportBugIfInvariantHolds(StringRef Msg,
437 ErrorKind Error, ExplodedNode *N, const MemRegion *Region,
438 CheckerContext &C, const Stmt *ValueExpr, bool SuppressPath) const {
439 ProgramStateRef OriginalState = N->getState();
440
441 if (checkInvariantViolation(OriginalState, N, C))
442 return;
443 if (SuppressPath) {
444 OriginalState = OriginalState->set<InvariantViolated>(true);
445 N = C.addTransition(OriginalState, N);
446 }
447
448 reportBug(Msg, Error, N, Region, C.getBugReporter(), ValueExpr);
449 }
450
451 /// Cleaning up the program state.
452 void NullabilityChecker::checkDeadSymbols(SymbolReaper &SR,
453 CheckerContext &C) const {
454 ProgramStateRef State = C.getState();
455 NullabilityMapTy Nullabilities = State->get<NullabilityMap>();
456 for (NullabilityMapTy::iterator I = Nullabilities.begin(),
457 E = Nullabilities.end();
458 I != E; ++I) {
459 const auto *Region = I->first->getAs<SymbolicRegion>();
460 assert(Region && "Non-symbolic region is tracked.");
461 if (SR.isDead(Region->getSymbol())) {
462 State = State->remove<NullabilityMap>(I->first);
463 }
464 }
465 // When one of the nonnull arguments are constrained to be null, nullability
466 // preconditions are violated. It is not enough to check this only when we
467 // actually report an error, because at that time interesting symbols might be
468 // reaped.
469 if (checkInvariantViolation(State, C.getPredecessor(), C))
470 return;
471 C.addTransition(State);
472 }
473
474 /// This callback triggers when a pointer is dereferenced and the analyzer does
475 /// not know anything about the value of that pointer. When that pointer is
476 /// nullable, this code emits a warning.
477 void NullabilityChecker::checkEvent(ImplicitNullDerefEvent Event) const {
478 if (Event.SinkNode->getState()->get<InvariantViolated>())
479 return;
480
481 const MemRegion *Region =
482 getTrackRegion(Event.Location, /*CheckSuperregion=*/true);
483 if (!Region)
484 return;
485
486 ProgramStateRef State = Event.SinkNode->getState();
487 const NullabilityState *TrackedNullability =
488 State->get<NullabilityMap>(Region);
489
490 if (!TrackedNullability)
491 return;
492
493 if (Filter.CheckNullableDereferenced &&
494 TrackedNullability->getValue() == Nullability::Nullable) {
495 BugReporter &BR = *Event.BR;
496 // Do not suppress errors on defensive code paths, because dereferencing
497 // a nullable pointer is always an error.
498 if (Event.IsDirectDereference)
499 reportBug("Nullable pointer is dereferenced",
500 ErrorKind::NullableDereferenced, Event.SinkNode, Region, BR);
501 else {
502 reportBug("Nullable pointer is passed to a callee that requires a "
503 "non-null", ErrorKind::NullablePassedToNonnull,
504 Event.SinkNode, Region, BR);
505 }
506 }
507 }
508
509 /// Find the outermost subexpression of E that is not an implicit cast.
510 /// This looks through the implicit casts to _Nonnull that ARC adds to
511 /// return expressions of ObjC types when the return type of the function or
512 /// method is non-null but the express is not.
513 static const Expr *lookThroughImplicitCasts(const Expr *E) {
514 assert(E);
515
516 while (auto *ICE = dyn_cast<ImplicitCastExpr>(E)) {
517 E = ICE->getSubExpr();
518 }
519
520 return E;
521 }
522
523 /// This method check when nullable pointer or null value is returned from a
524 /// function that has nonnull return type.
525 void NullabilityChecker::checkPreStmt(const ReturnStmt *S,
526 CheckerContext &C) const {
527 auto RetExpr = S->getRetValue();
528 if (!RetExpr)
529 return;
530
531 if (!RetExpr->getType()->isAnyPointerType())
532 return;
533
534 ProgramStateRef State = C.getState();
535 if (State->get<InvariantViolated>())
536 return;
537
538 auto RetSVal = C.getSVal(S).getAs<DefinedOrUnknownSVal>();
539 if (!RetSVal)
540 return;
541
542 bool InSuppressedMethodFamily = false;
543
544 QualType RequiredRetType;
545 AnalysisDeclContext *DeclCtxt =
546 C.getLocationContext()->getAnalysisDeclContext();
547 const Decl *D = DeclCtxt->getDecl();
548 if (auto *MD = dyn_cast<ObjCMethodDecl>(D)) {
549 // HACK: This is a big hammer to avoid warning when there are defensive
550 // nil checks in -init and -copy methods. We should add more sophisticated
551 // logic here to suppress on common defensive idioms but still
552 // warn when there is a likely problem.
553 ObjCMethodFamily Family = MD->getMethodFamily();
554 if (OMF_init == Family || OMF_copy == Family || OMF_mutableCopy == Family)
555 InSuppressedMethodFamily = true;
556
557 RequiredRetType = MD->getReturnType();
558 } else if (auto *FD = dyn_cast<FunctionDecl>(D)) {
559 RequiredRetType = FD->getReturnType();
560 } else {
561 return;
562 }
563
564 NullConstraint Nullness = getNullConstraint(*RetSVal, State);
565
566 Nullability RequiredNullability = getNullabilityAnnotation(RequiredRetType);
567
568 // If the returned value is null but the type of the expression
569 // generating it is nonnull then we will suppress the diagnostic.
570 // This enables explicit suppression when returning a nil literal in a
571 // function with a _Nonnull return type:
572 // return (NSString * _Nonnull)0;
573 Nullability RetExprTypeLevelNullability =
574 getNullabilityAnnotation(lookThroughImplicitCasts(RetExpr)->getType());
575
576 bool NullReturnedFromNonNull = (RequiredNullability == Nullability::Nonnull &&
577 Nullness == NullConstraint::IsNull);
578 if (Filter.CheckNullReturnedFromNonnull &&
579 NullReturnedFromNonNull &&
580 RetExprTypeLevelNullability != Nullability::Nonnull &&
581 !InSuppressedMethodFamily &&
582 C.getLocationContext()->inTopFrame()) {
583 static CheckerProgramPointTag Tag(this, "NullReturnedFromNonnull");
584 ExplodedNode *N = C.generateErrorNode(State, &Tag);
585 if (!N)
586 return;
587
588 SmallString<256> SBuf;
589 llvm::raw_svector_ostream OS(SBuf);
590 OS << (RetExpr->getType()->isObjCObjectPointerType() ? "nil" : "Null");
591 OS << " returned from a " << C.getDeclDescription(D) <<
592 " that is expected to return a non-null value";
593 reportBugIfInvariantHolds(OS.str(),
594 ErrorKind::NilReturnedToNonnull, N, nullptr, C,
595 RetExpr);
596 return;
597 }
598
599 // If null was returned from a non-null function, mark the nullability
600 // invariant as violated even if the diagnostic was suppressed.
601 if (NullReturnedFromNonNull) {
602 State = State->set<InvariantViolated>(true);
603 C.addTransition(State);
604 return;
605 }
606
607 const MemRegion *Region = getTrackRegion(*RetSVal);
608 if (!Region)
609 return;
610
611 const NullabilityState *TrackedNullability =
612 State->get<NullabilityMap>(Region);
613 if (TrackedNullability) {
614 Nullability TrackedNullabValue = TrackedNullability->getValue();
615 if (Filter.CheckNullableReturnedFromNonnull &&
616 Nullness != NullConstraint::IsNotNull &&
617 TrackedNullabValue == Nullability::Nullable &&
618 RequiredNullability == Nullability::Nonnull) {
619 static CheckerProgramPointTag Tag(this, "NullableReturnedFromNonnull");
620 ExplodedNode *N = C.addTransition(State, C.getPredecessor(), &Tag);
621
622 SmallString<256> SBuf;
623 llvm::raw_svector_ostream OS(SBuf);
624 OS << "Nullable pointer is returned from a " << C.getDeclDescription(D) <<
625 " that is expected to return a non-null value";
626
627 reportBugIfInvariantHolds(OS.str(),
628 ErrorKind::NullableReturnedToNonnull, N,
629 Region, C);
630 }
631 return;
632 }
633 if (RequiredNullability == Nullability::Nullable) {
634 State = State->set<NullabilityMap>(Region,
635 NullabilityState(RequiredNullability,
636 S));
637 C.addTransition(State);
638 }
639 }
640
641 /// This callback warns when a nullable pointer or a null value is passed to a
642 /// function that expects its argument to be nonnull.
643 void NullabilityChecker::checkPreCall(const CallEvent &Call,
644 CheckerContext &C) const {
645 if (!Call.getDecl())
646 return;
647
648 ProgramStateRef State = C.getState();
649 if (State->get<InvariantViolated>())
650 return;
651
652 ProgramStateRef OrigState = State;
653
654 unsigned Idx = 0;
655 for (const ParmVarDecl *Param : Call.parameters()) {
656 if (Param->isParameterPack())
657 break;
658
659 if (Idx >= Call.getNumArgs())
660 break;
661
662 const Expr *ArgExpr = Call.getArgExpr(Idx);
663 auto ArgSVal = Call.getArgSVal(Idx++).getAs<DefinedOrUnknownSVal>();
664 if (!ArgSVal)
665 continue;
666
667 if (!Param->getType()->isAnyPointerType() &&
668 !Param->getType()->isReferenceType())
669 continue;
670
671 NullConstraint Nullness = getNullConstraint(*ArgSVal, State);
672
673 Nullability RequiredNullability =
674 getNullabilityAnnotation(Param->getType());
675 Nullability ArgExprTypeLevelNullability =
676 getNullabilityAnnotation(ArgExpr->getType());
677
678 unsigned ParamIdx = Param->getFunctionScopeIndex() + 1;
679
680 if (Filter.CheckNullPassedToNonnull && Nullness == NullConstraint::IsNull &&
681 ArgExprTypeLevelNullability != Nullability::Nonnull &&
682 RequiredNullability == Nullability::Nonnull &&
683 isDiagnosableCall(Call)) {
684 ExplodedNode *N = C.generateErrorNode(State);
685 if (!N)
686 return;
687
688 SmallString<256> SBuf;
689 llvm::raw_svector_ostream OS(SBuf);
690 OS << (Param->getType()->isObjCObjectPointerType() ? "nil" : "Null");
691 OS << " passed to a callee that requires a non-null " << ParamIdx
692 << llvm::getOrdinalSuffix(ParamIdx) << " parameter";
693 reportBugIfInvariantHolds(OS.str(), ErrorKind::NilPassedToNonnull, N,
694 nullptr, C,
695 ArgExpr, /*SuppressPath=*/false);
696 return;
697 }
698
699 const MemRegion *Region = getTrackRegion(*ArgSVal);
700 if (!Region)
701 continue;
702
703 const NullabilityState *TrackedNullability =
704 State->get<NullabilityMap>(Region);
705
706 if (TrackedNullability) {
707 if (Nullness == NullConstraint::IsNotNull ||
708 TrackedNullability->getValue() != Nullability::Nullable)
709 continue;
710
711 if (Filter.CheckNullablePassedToNonnull &&
712 RequiredNullability == Nullability::Nonnull &&
713 isDiagnosableCall(Call)) {
714 ExplodedNode *N = C.addTransition(State);
715 SmallString<256> SBuf;
716 llvm::raw_svector_ostream OS(SBuf);
717 OS << "Nullable pointer is passed to a callee that requires a non-null "
718 << ParamIdx << llvm::getOrdinalSuffix(ParamIdx) << " parameter";
719 reportBugIfInvariantHolds(OS.str(),
720 ErrorKind::NullablePassedToNonnull, N,
721 Region, C, ArgExpr, /*SuppressPath=*/true);
722 return;
723 }
724 if (Filter.CheckNullableDereferenced &&
725 Param->getType()->isReferenceType()) {
726 ExplodedNode *N = C.addTransition(State);
727 reportBugIfInvariantHolds("Nullable pointer is dereferenced",
728 ErrorKind::NullableDereferenced, N, Region,
729 C, ArgExpr, /*SuppressPath=*/true);
730 return;
731 }
732 continue;
733 }
734 // No tracked nullability yet.
735 if (ArgExprTypeLevelNullability != Nullability::Nullable)
736 continue;
737 State = State->set<NullabilityMap>(
738 Region, NullabilityState(ArgExprTypeLevelNullability, ArgExpr));
739 }
740 if (State != OrigState)
741 C.addTransition(State);
742 }
743
744 /// Suppress the nullability warnings for some functions.
745 void NullabilityChecker::checkPostCall(const CallEvent &Call,
746 CheckerContext &C) const {
747 auto Decl = Call.getDecl();
748 if (!Decl)
749 return;
750 // ObjC Messages handles in a different callback.
751 if (Call.getKind() == CE_ObjCMessage)
752 return;
753 const FunctionType *FuncType = Decl->getFunctionType();
754 if (!FuncType)
755 return;
756 QualType ReturnType = FuncType->getReturnType();
757 if (!ReturnType->isAnyPointerType())
758 return;
759 ProgramStateRef State = C.getState();
760 if (State->get<InvariantViolated>())
761 return;
762
763 const MemRegion *Region = getTrackRegion(Call.getReturnValue());
764 if (!Region)
765 return;
766
767 // CG headers are misannotated. Do not warn for symbols that are the results
768 // of CG calls.
769 const SourceManager &SM = C.getSourceManager();
770 StringRef FilePath = SM.getFilename(SM.getSpellingLoc(Decl->getBeginLoc()));
771 if (llvm::sys::path::filename(FilePath).startswith("CG")) {
772 State = State->set<NullabilityMap>(Region, Nullability::Contradicted);
773 C.addTransition(State);
774 return;
775 }
776
777 const NullabilityState *TrackedNullability =
778 State->get<NullabilityMap>(Region);
779
780 if (!TrackedNullability &&
781 getNullabilityAnnotation(ReturnType) == Nullability::Nullable) {
782 State = State->set<NullabilityMap>(Region, Nullability::Nullable);
783 C.addTransition(State);
784 }
785 }
786
787 static Nullability getReceiverNullability(const ObjCMethodCall &M,
788 ProgramStateRef State) {
789 if (M.isReceiverSelfOrSuper()) {
790 // For super and super class receivers we assume that the receiver is
791 // nonnull.
792 return Nullability::Nonnull;
793 }
794 // Otherwise look up nullability in the state.
795 SVal Receiver = M.getReceiverSVal();
796 if (auto DefOrUnknown = Receiver.getAs<DefinedOrUnknownSVal>()) {
797 // If the receiver is constrained to be nonnull, assume that it is nonnull
798 // regardless of its type.
799 NullConstraint Nullness = getNullConstraint(*DefOrUnknown, State);
800 if (Nullness == NullConstraint::IsNotNull)
801 return Nullability::Nonnull;
802 }
803 auto ValueRegionSVal = Receiver.getAs<loc::MemRegionVal>();
804 if (ValueRegionSVal) {
805 const MemRegion *SelfRegion = ValueRegionSVal->getRegion();
806 assert(SelfRegion);
807
808 const NullabilityState *TrackedSelfNullability =
809 State->get<NullabilityMap>(SelfRegion);
810 if (TrackedSelfNullability)
811 return TrackedSelfNullability->getValue();
812 }
813 return Nullability::Unspecified;
814 }
815
816 /// Calculate the nullability of the result of a message expr based on the
817 /// nullability of the receiver, the nullability of the return value, and the
818 /// constraints.
819 void NullabilityChecker::checkPostObjCMessage(const ObjCMethodCall &M,
820 CheckerContext &C) const {
821 auto Decl = M.getDecl();
822 if (!Decl)
823 return;
824 QualType RetType = Decl->getReturnType();
825 if (!RetType->isAnyPointerType())
826 return;
827
828 ProgramStateRef State = C.getState();
829 if (State->get<InvariantViolated>())
830 return;
831
832 const MemRegion *ReturnRegion = getTrackRegion(M.getReturnValue());
833 if (!ReturnRegion)
834 return;
835
836 auto Interface = Decl->getClassInterface();
837 auto Name = Interface ? Interface->getName() : "";
838 // In order to reduce the noise in the diagnostics generated by this checker,
839 // some framework and programming style based heuristics are used. These
840 // heuristics are for Cocoa APIs which have NS prefix.
841 if (Name.startswith("NS")) {
842 // Developers rely on dynamic invariants such as an item should be available
843 // in a collection, or a collection is not empty often. Those invariants can
844 // not be inferred by any static analysis tool. To not to bother the users
845 // with too many false positives, every item retrieval function should be
846 // ignored for collections. The instance methods of dictionaries in Cocoa
847 // are either item retrieval related or not interesting nullability wise.
848 // Using this fact, to keep the code easier to read just ignore the return
849 // value of every instance method of dictionaries.
850 if (M.isInstanceMessage() && Name.contains("Dictionary")) {
851 State =
852 State->set<NullabilityMap>(ReturnRegion, Nullability::Contradicted);
853 C.addTransition(State);
854 return;
855 }
856 // For similar reasons ignore some methods of Cocoa arrays.
857 StringRef FirstSelectorSlot = M.getSelector().getNameForSlot(0);
858 if (Name.contains("Array") &&
859 (FirstSelectorSlot == "firstObject" ||
860 FirstSelectorSlot == "lastObject")) {
861 State =
862 State->set<NullabilityMap>(ReturnRegion, Nullability::Contradicted);
863 C.addTransition(State);
864 return;
865 }
866
867 // Encoding related methods of string should not fail when lossless
868 // encodings are used. Using lossless encodings is so frequent that ignoring
869 // this class of methods reduced the emitted diagnostics by about 30% on
870 // some projects (and all of that was false positives).
871 if (Name.contains("String")) {
872 for (auto Param : M.parameters()) {
873 if (Param->getName() == "encoding") {
874 State = State->set<NullabilityMap>(ReturnRegion,
875 Nullability::Contradicted);
876 C.addTransition(State);
877 return;
878 }
879 }
880 }
881 }
882
883 const ObjCMessageExpr *Message = M.getOriginExpr();
884 Nullability SelfNullability = getReceiverNullability(M, State);
885
886 const NullabilityState *NullabilityOfReturn =
887 State->get<NullabilityMap>(ReturnRegion);
888
889 if (NullabilityOfReturn) {
890 // When we have a nullability tracked for the return value, the nullability
891 // of the expression will be the most nullable of the receiver and the
892 // return value.
893 Nullability RetValTracked = NullabilityOfReturn->getValue();
894 Nullability ComputedNullab =
895 getMostNullable(RetValTracked, SelfNullability);
896 if (ComputedNullab != RetValTracked &&
897 ComputedNullab != Nullability::Unspecified) {
898 const Stmt *NullabilitySource =
899 ComputedNullab == RetValTracked
900 ? NullabilityOfReturn->getNullabilitySource()
901 : Message->getInstanceReceiver();
902 State = State->set<NullabilityMap>(
903 ReturnRegion, NullabilityState(ComputedNullab, NullabilitySource));
904 C.addTransition(State);
905 }
906 return;
907 }
908
909 // No tracked information. Use static type information for return value.
910 Nullability RetNullability = getNullabilityAnnotation(RetType);
911
912 // Properties might be computed. For this reason the static analyzer creates a
913 // new symbol each time an unknown property is read. To avoid false pozitives
914 // do not treat unknown properties as nullable, even when they explicitly
915 // marked nullable.
916 if (M.getMessageKind() == OCM_PropertyAccess && !C.wasInlined)
917 RetNullability = Nullability::Nonnull;
918
919 Nullability ComputedNullab = getMostNullable(RetNullability, SelfNullability);
920 if (ComputedNullab == Nullability::Nullable) {
921 const Stmt *NullabilitySource = ComputedNullab == RetNullability
922 ? Message
923 : Message->getInstanceReceiver();
924 State = State->set<NullabilityMap>(
925 ReturnRegion, NullabilityState(ComputedNullab, NullabilitySource));
926 C.addTransition(State);
927 }
928 }
929
930 /// Explicit casts are trusted. If there is a disagreement in the nullability
931 /// annotations in the destination and the source or '0' is casted to nonnull
932 /// track the value as having contraditory nullability. This will allow users to
933 /// suppress warnings.
934 void NullabilityChecker::checkPostStmt(const ExplicitCastExpr *CE,
935 CheckerContext &C) const {
936 QualType OriginType = CE->getSubExpr()->getType();
937 QualType DestType = CE->getType();
938 if (!OriginType->isAnyPointerType())
939 return;
940 if (!DestType->isAnyPointerType())
941 return;
942
943 ProgramStateRef State = C.getState();
944 if (State->get<InvariantViolated>())
945 return;
946
947 Nullability DestNullability = getNullabilityAnnotation(DestType);
948
949 // No explicit nullability in the destination type, so this cast does not
950 // change the nullability.
951 if (DestNullability == Nullability::Unspecified)
952 return;
953
954 auto RegionSVal = C.getSVal(CE).getAs<DefinedOrUnknownSVal>();
955 const MemRegion *Region = getTrackRegion(*RegionSVal);
956 if (!Region)
957 return;
958
959 // When 0 is converted to nonnull mark it as contradicted.
960 if (DestNullability == Nullability::Nonnull) {
961 NullConstraint Nullness = getNullConstraint(*RegionSVal, State);
962 if (Nullness == NullConstraint::IsNull) {
963 State = State->set<NullabilityMap>(Region, Nullability::Contradicted);
964 C.addTransition(State);
965 return;
966 }
967 }
968
969 const NullabilityState *TrackedNullability =
970 State->get<NullabilityMap>(Region);
971
972 if (!TrackedNullability) {
973 if (DestNullability != Nullability::Nullable)
974 return;
975 State = State->set<NullabilityMap>(Region,
976 NullabilityState(DestNullability, CE));
977 C.addTransition(State);
978 return;
979 }
980
981 if (TrackedNullability->getValue() != DestNullability &&
982 TrackedNullability->getValue() != Nullability::Contradicted) {
983 State = State->set<NullabilityMap>(Region, Nullability::Contradicted);
984 C.addTransition(State);
985 }
986 }
987
988 /// For a given statement performing a bind, attempt to syntactically
989 /// match the expression resulting in the bound value.
990 static const Expr * matchValueExprForBind(const Stmt *S) {
991 // For `x = e` the value expression is the right-hand side.
992 if (auto *BinOp = dyn_cast<BinaryOperator>(S)) {
993 if (BinOp->getOpcode() == BO_Assign)
994 return BinOp->getRHS();
995 }
996
997 // For `int x = e` the value expression is the initializer.
998 if (auto *DS = dyn_cast<DeclStmt>(S)) {
999 if (DS->isSingleDecl()) {
1000 auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
1001 if (!VD)
1002 return nullptr;
1003
1004 if (const Expr *Init = VD->getInit())
1005 return Init;
1006 }
1007 }
1008
1009 return nullptr;
1010 }
1011
1012 /// Returns true if \param S is a DeclStmt for a local variable that
1013 /// ObjC automated reference counting initialized with zero.
1014 static bool isARCNilInitializedLocal(CheckerContext &C, const Stmt *S) {
1015 // We suppress diagnostics for ARC zero-initialized _Nonnull locals. This
1016 // prevents false positives when a _Nonnull local variable cannot be
1017 // initialized with an initialization expression:
1018 // NSString * _Nonnull s; // no-warning
1019 // @autoreleasepool {
1020 // s = ...
1021 // }
1022 //
1023 // FIXME: We should treat implicitly zero-initialized _Nonnull locals as
1024 // uninitialized in Sema's UninitializedValues analysis to warn when a use of
1025 // the zero-initialized definition will unexpectedly yield nil.
1026
1027 // Locals are only zero-initialized when automated reference counting
1028 // is turned on.
1029 if (!C.getASTContext().getLangOpts().ObjCAutoRefCount)
1030 return false;
1031
1032 auto *DS = dyn_cast<DeclStmt>(S);
1033 if (!DS || !DS->isSingleDecl())
1034 return false;
1035
1036 auto *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
1037 if (!VD)
1038 return false;
1039
1040 // Sema only zero-initializes locals with ObjCLifetimes.
1041 if(!VD->getType().getQualifiers().hasObjCLifetime())
1042 return false;
1043
1044 const Expr *Init = VD->getInit();
1045 assert(Init && "ObjC local under ARC without initializer");
1046
1047 // Return false if the local is explicitly initialized (e.g., with '= nil').
1048 if (!isa<ImplicitValueInitExpr>(Init))
1049 return false;
1050
1051 return true;
1052 }
1053
1054 /// Propagate the nullability information through binds and warn when nullable
1055 /// pointer or null symbol is assigned to a pointer with a nonnull type.
1056 void NullabilityChecker::checkBind(SVal L, SVal V, const Stmt *S,
1057 CheckerContext &C) const {
1058 const TypedValueRegion *TVR =
1059 dyn_cast_or_null<TypedValueRegion>(L.getAsRegion());
1060 if (!TVR)
1061 return;
1062
1063 QualType LocType = TVR->getValueType();
1064 if (!LocType->isAnyPointerType())
1065 return;
1066
1067 ProgramStateRef State = C.getState();
1068 if (State->get<InvariantViolated>())
1069 return;
1070
1071 auto ValDefOrUnknown = V.getAs<DefinedOrUnknownSVal>();
1072 if (!ValDefOrUnknown)
1073 return;
1074
1075 NullConstraint RhsNullness = getNullConstraint(*ValDefOrUnknown, State);
1076
1077 Nullability ValNullability = Nullability::Unspecified;
1078 if (SymbolRef Sym = ValDefOrUnknown->getAsSymbol())
1079 ValNullability = getNullabilityAnnotation(Sym->getType());
1080
1081 Nullability LocNullability = getNullabilityAnnotation(LocType);
1082
1083 // If the type of the RHS expression is nonnull, don't warn. This
1084 // enables explicit suppression with a cast to nonnull.
1085 Nullability ValueExprTypeLevelNullability = Nullability::Unspecified;
1086 const Expr *ValueExpr = matchValueExprForBind(S);
1087 if (ValueExpr) {
1088 ValueExprTypeLevelNullability =
1089 getNullabilityAnnotation(lookThroughImplicitCasts(ValueExpr)->getType());
1090 }
1091
1092 bool NullAssignedToNonNull = (LocNullability == Nullability::Nonnull &&
1093 RhsNullness == NullConstraint::IsNull);
1094 if (Filter.CheckNullPassedToNonnull &&
1095 NullAssignedToNonNull &&
1096 ValNullability != Nullability::Nonnull &&
1097 ValueExprTypeLevelNullability != Nullability::Nonnull &&
1098 !isARCNilInitializedLocal(C, S)) {
1099 static CheckerProgramPointTag Tag(this, "NullPassedToNonnull");
1100 ExplodedNode *N = C.generateErrorNode(State, &Tag);
1101 if (!N)
1102 return;
1103
1104
1105 const Stmt *ValueStmt = S;
1106 if (ValueExpr)
1107 ValueStmt = ValueExpr;
1108
1109 SmallString<256> SBuf;
1110 llvm::raw_svector_ostream OS(SBuf);
1111 OS << (LocType->isObjCObjectPointerType() ? "nil" : "Null");
1112 OS << " assigned to a pointer which is expected to have non-null value";
1113 reportBugIfInvariantHolds(OS.str(),
1114 ErrorKind::NilAssignedToNonnull, N, nullptr, C,
1115 ValueStmt);
1116 return;
1117 }
1118
1119 // If null was returned from a non-null function, mark the nullability
1120 // invariant as violated even if the diagnostic was suppressed.
1121 if (NullAssignedToNonNull) {
1122 State = State->set<InvariantViolated>(true);
1123 C.addTransition(State);
1124 return;
1125 }
1126
1127 // Intentionally missing case: '0' is bound to a reference. It is handled by
1128 // the DereferenceChecker.
1129
1130 const MemRegion *ValueRegion = getTrackRegion(*ValDefOrUnknown);
1131 if (!ValueRegion)
1132 return;
1133
1134 const NullabilityState *TrackedNullability =
1135 State->get<NullabilityMap>(ValueRegion);
1136
1137 if (TrackedNullability) {
1138 if (RhsNullness == NullConstraint::IsNotNull ||
1139 TrackedNullability->getValue() != Nullability::Nullable)
1140 return;
1141 if (Filter.CheckNullablePassedToNonnull &&
1142 LocNullability == Nullability::Nonnull) {
1143 static CheckerProgramPointTag Tag(this, "NullablePassedToNonnull");
1144 ExplodedNode *N = C.addTransition(State, C.getPredecessor(), &Tag);
1145 reportBugIfInvariantHolds("Nullable pointer is assigned to a pointer "
1146 "which is expected to have non-null value",
1147 ErrorKind::NullableAssignedToNonnull, N,
1148 ValueRegion, C);
1149 }
1150 return;
1151 }
1152
1153 const auto *BinOp = dyn_cast<BinaryOperator>(S);
1154
1155 if (ValNullability == Nullability::Nullable) {
1156 // Trust the static information of the value more than the static
1157 // information on the location.
1158 const Stmt *NullabilitySource = BinOp ? BinOp->getRHS() : S;
1159 State = State->set<NullabilityMap>(
1160 ValueRegion, NullabilityState(ValNullability, NullabilitySource));
1161 C.addTransition(State);
1162 return;
1163 }
1164
1165 if (LocNullability == Nullability::Nullable) {
1166 const Stmt *NullabilitySource = BinOp ? BinOp->getLHS() : S;
1167 State = State->set<NullabilityMap>(
1168 ValueRegion, NullabilityState(LocNullability, NullabilitySource));
1169 C.addTransition(State);
1170 }
1171 }
1172
1173 void NullabilityChecker::printState(raw_ostream &Out, ProgramStateRef State,
1174 const char *NL, const char *Sep) const {
1175
1176 NullabilityMapTy B = State->get<NullabilityMap>();
1177
1178 if (State->get<InvariantViolated>())
1179 Out << Sep << NL
1180 << "Nullability invariant was violated, warnings suppressed." << NL;
1181
1182 if (B.isEmpty())
1183 return;
1184
1185 if (!State->get<InvariantViolated>())
1186 Out << Sep << NL;
1187
1188 for (NullabilityMapTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
1189 Out << I->first << " : ";
1190 I->second.print(Out);
1191 Out << NL;
1192 }
1193 }
1194
1195 #define REGISTER_CHECKER(name, trackingRequired) \
1196 void ento::register##name##Checker(CheckerManager &mgr) { \
1197 NullabilityChecker *checker = mgr.registerChecker<NullabilityChecker>(); \
1198 checker->Filter.Check##name = true; \
1199 checker->Filter.CheckName##name = mgr.getCurrentCheckName(); \
1200 checker->NeedTracking = checker->NeedTracking || trackingRequired; \
1201 checker->NoDiagnoseCallsToSystemHeaders = \
1202 checker->NoDiagnoseCallsToSystemHeaders || \
1203 mgr.getAnalyzerOptions().getCheckerBooleanOption( \
1204 "NoDiagnoseCallsToSystemHeaders", false, checker, true); \
1205 }
1206
1207 // The checks are likely to be turned on by default and it is possible to do
1208 // them without tracking any nullability related information. As an optimization
1209 // no nullability information will be tracked when only these two checks are
1210 // enables.
1211 REGISTER_CHECKER(NullPassedToNonnull, false)
1212 REGISTER_CHECKER(NullReturnedFromNonnull, false)
1213
1214 REGISTER_CHECKER(NullableDereferenced, true)
1215 REGISTER_CHECKER(NullablePassedToNonnull, true)
1216 REGISTER_CHECKER(NullableReturnedFromNonnull, true)
clang::ento::Nullability
Nullability
Definition: CheckerHelpers.h:53
clang::Builtin::ID
ID
Definition: Builtins.h:49
ento
clang::ObjCMethodCall::getReceiverSVal
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:960
checkParamsForPreconditionViolation
static bool checkParamsForPreconditionViolation(ArrayRef< ParmVarDecl *> Params, ProgramStateRef State, const LocationContext *LocCtxt)
Definition: NullabilityChecker.cpp:360
clang::ento::Nullability::Unspecified
clang::ento::Nullability::Nonnull
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:638
clang::ento::categories::MemoryError
const char *const MemoryError
Definition: CommonBugCategories.cpp:19
clang::operator==
bool operator==(CanQual< T > x, CanQual< U > y)
Definition: CanonicalType.h:203
clang::ento::SymbolRef
const SymExpr * SymbolRef
Definition: PathDiagnostic.h:59
clang::prec::Unknown
Definition: OperatorPrecedence.h:28
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:66
ErrorKind
ErrorKind
Definition: NullabilityChecker.cpp:71
clang::FunctionType
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3355
clang::ento::CE_ObjCMessage
Definition: CallEvent.h:71
checkValueAtLValForInvariantViolation
static bool checkValueAtLValForInvariantViolation(ProgramStateRef State, SVal LV, QualType T)
Returns true when the value stored at the given location has been constrained to null after being pas...
Definition: NullabilityChecker.cpp:334
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:87
clang::Decl::getBeginLoc
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: DeclBase.h:410
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:38
clang::ObjCInterfaceDecl::ivars
ivar_range ivars() const
Definition: DeclObjC.h:1458
clang::LocationContext
Definition: AnalysisDeclContext.h:218
getReceiverNullability
static Nullability getReceiverNullability(const ObjCMethodCall &M, ProgramStateRef State)
Definition: NullabilityChecker.cpp:787
BugType.h
clang::VarDecl
Represents a variable declaration or definition.
Definition: Decl.h:813
clang::ObjCMethodDecl
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
clang::ento::Nullability::Contradicted
clang::ParmVarDecl
Represents a parameter to a function.
Definition: Decl.h:1550
BugReporterVisitor
getNullConstraint
static NullConstraint getNullConstraint(DefinedOrUnknownSVal Val, ProgramStateRef State)
Definition: NullabilityChecker.cpp:263
State
LineState State
Definition: UnwrappedLineFormatter.cpp:877
clang::ObjCMethodFamily
ObjCMethodFamily
A family of Objective-C methods.
Definition: IdentifierTable.h:611
clang::Stmt::getBeginLoc
SourceLocation getBeginLoc() const LLVM_READONLY
Definition: Stmt.cpp:288
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function or method under analysis.
Definition: AnalysisDeclContext.h:70
Checker.h
CheckerManager.h
clang::CastExpr::getSubExpr
Expr * getSubExpr()
Definition: Expr.h:3050
clang::ObjCMethodCall
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:970
clang::LocationContext::getSelfDecl
const ImplicitParamDecl * getSelfDecl() const
Definition: AnalysisDeclContext.h:266
clang::BinaryOperator
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3287
clang::SourceManager::getSpellingLoc
SourceLocation getSpellingLoc(SourceLocation Loc) const
Given a SourceLocation object, return the spelling location referenced by the ID. ...
Definition: SourceManager.h:1165
clang::ObjCInterfaceDecl
Represents an ObjC class declaration.
Definition: DeclObjC.h:1172
llvm::ArrayRef
Definition: LLVM.h:32
llvm::SmallString
Definition: LLVM.h:35
clang::ObjCMethodCall::isReceiverSelfOrSuper
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to &#39;self&#39; or &#39;super&#39;.
Definition: CallEvent.cpp:976
clang::ObjCMethodCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:920
clang::Decl::getFunctionType
const FunctionType * getFunctionType(bool BlocksToo=true) const
Looks through the Decl&#39;s underlying type to extract a FunctionType when possible. ...
Definition: DeclBase.cpp:961
clang::OCM_PropertyAccess
Definition: CallEvent.h:962
clang::ParamIdx
A single parameter index whose accessors require each use to make explicit the parameter index encodi...
Definition: Attr.h:214
clang::Expr
This represents one expression.
Definition: Expr.h:106
clang::OMF_copy
Definition: IdentifierTable.h:620
clang::Selector::getNameForSlot
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
Definition: IdentifierTable.cpp:436
clang::OMF_mutableCopy
Definition: IdentifierTable.h:622
getValue
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Definition: ArrayBoundCheckerV2.cpp:276
clang::Expr::getType
QualType getType() const
Definition: Expr.h:128
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2443
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:904
REGISTER_CHECKER
#define REGISTER_CHECKER(name, trackingRequired)
Definition: NullabilityChecker.cpp:1195
BuiltinCheckerRegistration.h
SM
const SourceManager & SM
Definition: Format.cpp:1490
REGISTER_MAP_WITH_PROGRAMSTATE
REGISTER_MAP_WITH_PROGRAMSTATE(NullabilityMap, const MemRegion *, NullabilityState) enum class NullConstraint
Definition: NullabilityChecker.cpp:232
clang::ento::PathDiagnosticLocation::getStmt
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
Definition: PathDiagnostic.cpp:767
clang::SourceManager::getFilename
StringRef getFilename(SourceLocation SpellingLoc) const
Return the filename of the file containing a SourceLocation.
Definition: SourceManager.h:1059
clang::tooling::Filter
llvm::cl::opt< std::string > Filter
false
#define false
Definition: stdbool.h:33
REGISTER_TRAIT_WITH_PROGRAMSTATE
#define REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, Type)
Declares a program state trait for type Type called Name, and introduce a type named NameTy...
Definition: ProgramStateTrait.h:34
clang::FunctionType::getReturnType
QualType getReturnType() const
Definition: Type.h:3613
clang::ReturnStmt::getRetValue
Expr * getRetValue()
Definition: Stmt.h:2476
isARCNilInitializedLocal
static bool isARCNilInitializedLocal(CheckerContext &C, const Stmt *S)
Returns true if.
Definition: NullabilityChecker.cpp:1014
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1143
clang::ento::Nullability::Nullable
lookThroughImplicitCasts
static const Expr * lookThroughImplicitCasts(const Expr *E)
Find the outermost subexpression of E that is not an implicit cast.
Definition: NullabilityChecker.cpp:513
clang::AnalysisDeclContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:105
clang::Type::isObjCObjectPointerType
bool isObjCObjectPointerType() const
Definition: Type.h:6393
clang::Type::isAnyPointerType
bool isAnyPointerType() const
Definition: Type.h:6300
checkInvariantViolation
static bool checkInvariantViolation(ProgramStateRef State, ExplodedNode *N, CheckerContext &C)
Definition: NullabilityChecker.cpp:407
matchValueExprForBind
static const Expr * matchValueExprForBind(const Stmt *S)
For a given statement performing a bind, attempt to syntactically match the expression resulting in t...
Definition: NullabilityChecker.cpp:990
clang::ObjCMethodCall::getDecl
const ObjCMethodDecl * getDecl() const override
Definition: CallEvent.h:998
clang::ImplicitParamDecl
Definition: Decl.h:1486
clang::ObjCMessageExpr::getInstanceReceiver
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1207
clang::ObjCMethodCall::getOriginExpr
virtual const ObjCMessageExpr * getOriginExpr() const
Definition: CallEvent.h:994
clang::ObjCMethodCall::getSelector
Selector getSelector() const
Definition: CallEvent.h:1018
clang
Dataflow Directional Tag Classes.
Definition: CFGReachabilityAnalysis.h:22
clang::ento::getNullabilityAnnotation
Nullability getNullabilityAnnotation(QualType Type)
Get nullability annotation for a given type.
Definition: CheckerHelpers.cpp:102
clang::ExplicitCastExpr
ExplicitCastExpr - An explicit cast written in the source code.
Definition: Expr.h:3190
clang::ObjCMethodCall::getMessageKind
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1020
clang::LocationContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:253
clang::ObjCObjectPointerType
Represents a pointer to an Objective C object.
Definition: Type.h:5794
clang::ObjCMethodCall::isInstanceMessage
bool isInstanceMessage() const
Definition: CallEvent.h:1010
CheckerHelpers.h
clang::ento::ObjKind::OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
clang::ObjCObjectPointerType::getInterfaceDecl
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5850
X
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13954
clang::SourceLocation::isInvalid
bool isInvalid() const
Definition: SourceLocation.h:109
clang::OMF_init
Definition: IdentifierTable.h:621
checkSelfIvarsForInvariantViolation
static bool checkSelfIvarsForInvariantViolation(ProgramStateRef State, const LocationContext *LocCtxt)
Definition: NullabilityChecker.cpp:377
min
__DEVICE__ int min(int __a, int __b)
Definition: __clang_cuda_device_functions.h:1618
clang::ValueDecl::getType
QualType getType() const
Definition: Decl.h:648
true
#define true
Definition: stdbool.h:32
CallEvent.h
CallEvent
clang::SourceManager
This class handles loading and caching of source files into memory.
Definition: SourceManager.h:582
CheckerContext.h