clang  8.0.0
UninitializedObject.h
Go to the documentation of this file.
1 //===----- UninitializedObject.h ---------------------------------*- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines helper classes for UninitializedObjectChecker and
11 // documentation about the logic of it.
12 //
13 // The checker reports uninitialized fields in objects created after a
14 // constructor call.
15 //
16 // This checker has several options:
17 // - "Pedantic" (boolean). If its not set or is set to false, the checker
18 // won't emit warnings for objects that don't have at least one initialized
19 // field. This may be set with
20 //
21 // `-analyzer-config alpha.cplusplus.UninitializedObject:Pedantic=true`.
22 //
23 // - "NotesAsWarnings" (boolean). If set to true, the checker will emit a
24 // warning for each uninitialized field, as opposed to emitting one warning
25 // per constructor call, and listing the uninitialized fields that belongs
26 // to it in notes. Defaults to false.
27 //
28 // `-analyzer-config \
29 // alpha.cplusplus.UninitializedObject:NotesAsWarnings=true`.
30 //
31 // - "CheckPointeeInitialization" (boolean). If set to false, the checker will
32 // not analyze the pointee of pointer/reference fields, and will only check
33 // whether the object itself is initialized. Defaults to false.
34 //
35 // `-analyzer-config \
36 // alpha.cplusplus.UninitializedObject:CheckPointeeInitialization=true`.
37 //
38 // - "IgnoreRecordsWithField" (string). If supplied, the checker will not
39 // analyze structures that have a field with a name or type name that
40 // matches the given pattern. Defaults to "".
41 //
42 // `-analyzer-config \
43 // alpha.cplusplus.UninitializedObject:IgnoreRecordsWithField="[Tt]ag|[Kk]ind"`.
44 //
45 // TODO: With some clever heuristics, some pointers should be dereferenced
46 // by default. For example, if the pointee is constructed within the
47 // constructor call, it's reasonable to say that no external object
48 // references it, and we wouldn't generate multiple report on the same
49 // pointee.
50 //
51 // Most of the following methods as well as the checker itself is defined in
52 // UninitializedObjectChecker.cpp.
53 //
54 // Some methods are implemented in UninitializedPointee.cpp, to reduce the
55 // complexity of the main checker file.
56 //
57 //===----------------------------------------------------------------------===//
58 
59 #ifndef LLVM_CLANG_STATICANALYZER_UNINITIALIZEDOBJECT_H
60 #define LLVM_CLANG_STATICANALYZER_UNINITIALIZEDOBJECT_H
61 
63 
64 namespace clang {
65 namespace ento {
66 
68  bool IsPedantic = false;
72 };
73 
74 /// A lightweight polymorphic wrapper around FieldRegion *. We'll use this
75 /// interface to store addinitional information about fields. As described
76 /// later, a list of these objects (i.e. "fieldchain") will be constructed and
77 /// used for printing note messages should an uninitialized value be found.
78 class FieldNode {
79 protected:
80  const FieldRegion *FR;
81 
82  /// FieldNodes are never meant to be created on the heap, see
83  /// FindUninitializedFields::addFieldToUninits().
84  /* non-virtual */ ~FieldNode() = default;
85 
86 public:
87  FieldNode(const FieldRegion *FR) : FR(FR) {}
88 
89  // We'll delete all of these special member functions to force the users of
90  // this interface to only store references to FieldNode objects in containers.
91  FieldNode() = delete;
92  FieldNode(const FieldNode &) = delete;
93  FieldNode(FieldNode &&) = delete;
94  FieldNode &operator=(const FieldNode &) = delete;
95  FieldNode &operator=(const FieldNode &&) = delete;
96 
97  void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddPointer(this); }
98 
99  /// Helper method for uniqueing.
100  bool isSameRegion(const FieldRegion *OtherFR) const {
101  // Special FieldNode descendants may wrap nullpointers (for example if they
102  // describe a special relationship between two elements of the fieldchain)
103  // -- we wouldn't like to unique these objects.
104  if (FR == nullptr)
105  return false;
106 
107  return FR == OtherFR;
108  }
109 
110  const FieldRegion *getRegion() const { return FR; }
111  const FieldDecl *getDecl() const {
112  assert(FR);
113  return FR->getDecl();
114  }
115 
116  // When a fieldchain is printed, it will have the following format (without
117  // newline, indices are in order of insertion, from 1 to n):
118  //
119  // <note_message_n>'<prefix_n><prefix_n-1>...<prefix_1>
120  // this-><node_1><separator_1><node_2><separator_2>...<node_n>'
121 
122  /// If this is the last element of the fieldchain, this method will print the
123  /// note message associated with it.
124  /// The note message should state something like "uninitialized field" or
125  /// "uninitialized pointee" etc.
126  virtual void printNoteMsg(llvm::raw_ostream &Out) const = 0;
127 
128  /// Print any prefixes before the fieldchain. Could contain casts, etc.
129  virtual void printPrefix(llvm::raw_ostream &Out) const = 0;
130 
131  /// Print the node. Should contain the name of the field stored in FR.
132  virtual void printNode(llvm::raw_ostream &Out) const = 0;
133 
134  /// Print the separator. For example, fields may be separated with '.' or
135  /// "->".
136  virtual void printSeparator(llvm::raw_ostream &Out) const = 0;
137 
138  virtual bool isBase() const { return false; }
139 };
140 
141 /// Returns with Field's name. This is a helper function to get the correct name
142 /// even if Field is a captured lambda variable.
143 std::string getVariableName(const FieldDecl *Field);
144 
145 /// Represents a field chain. A field chain is a list of fields where the first
146 /// element of the chain is the object under checking (not stored), and every
147 /// other element is a field, and the element that precedes it is the object
148 /// that contains it.
149 ///
150 /// Note that this class is immutable (essentially a wrapper around an
151 /// ImmutableList), new FieldChainInfo objects may be created by member
152 /// functions such as add() and replaceHead().
154 public:
155  using FieldChain = llvm::ImmutableList<const FieldNode &>;
156 
157 private:
158  FieldChain::Factory &ChainFactory;
159  FieldChain Chain;
160 
161  FieldChainInfo(FieldChain::Factory &F, FieldChain NewChain)
162  : FieldChainInfo(F) {
163  Chain = NewChain;
164  }
165 
166 public:
167  FieldChainInfo() = delete;
168  FieldChainInfo(FieldChain::Factory &F) : ChainFactory(F) {}
169  FieldChainInfo(const FieldChainInfo &Other) = default;
170 
171  /// Constructs a new FieldChainInfo object with \p FN appended.
172  template <class FieldNodeT> FieldChainInfo add(const FieldNodeT &FN);
173 
174  /// Constructs a new FieldChainInfo object with \p FN as the new head of the
175  /// list.
176  template <class FieldNodeT> FieldChainInfo replaceHead(const FieldNodeT &FN);
177 
178  bool contains(const FieldRegion *FR) const;
179  bool isEmpty() const { return Chain.isEmpty(); }
180 
181  const FieldNode &getHead() const { return Chain.getHead(); }
182  const FieldRegion *getUninitRegion() const { return getHead().getRegion(); }
183 
184  void printNoteMsg(llvm::raw_ostream &Out) const;
185 };
186 
187 using UninitFieldMap = std::map<const FieldRegion *, llvm::SmallString<50>>;
188 
189 /// Searches for and stores uninitialized fields in a non-union object.
192  const TypedValueRegion *const ObjectR;
193 
194  const UninitObjCheckerOptions Opts;
195  bool IsAnyFieldInitialized = false;
196 
197  FieldChainInfo::FieldChain::Factory ChainFactory;
198 
199  /// A map for assigning uninitialized regions to note messages. For example,
200  ///
201  /// struct A {
202  /// int x;
203  /// };
204  ///
205  /// A a;
206  ///
207  /// After analyzing `a`, the map will contain a pair for `a.x`'s region and
208  /// the note message "uninitialized field 'this->x'.
209  UninitFieldMap UninitFields;
210 
211 public:
212  /// Constructs the FindUninitializedField object, searches for and stores
213  /// uninitialized fields in R.
215  const TypedValueRegion *const R,
216  const UninitObjCheckerOptions &Opts);
217 
218  /// Returns with the modified state and a map of (uninitialized region,
219  /// note message) pairs.
220  std::pair<ProgramStateRef, const UninitFieldMap &> getResults() {
221  return {State, UninitFields};
222  }
223 
224  /// Returns whether the analyzed region contains at least one initialized
225  /// field. Note that this includes subfields as well, not just direct ones,
226  /// and will return false if an uninitialized pointee is found with
227  /// CheckPointeeInitialization enabled.
228  bool isAnyFieldInitialized() { return IsAnyFieldInitialized; }
229 
230 private:
231  // For the purposes of this checker, we'll regard the analyzed region as a
232  // directed tree, where
233  // * the root is the object under checking
234  // * every node is an object that is
235  // - a union
236  // - a non-union record
237  // - dereferenceable (see isDereferencableType())
238  // - an array
239  // - of a primitive type (see isPrimitiveType())
240  // * the parent of each node is the object that contains it
241  // * every leaf is an array, a primitive object, a nullptr or an undefined
242  // pointer.
243  //
244  // Example:
245  //
246  // struct A {
247  // struct B {
248  // int x, y = 0;
249  // };
250  // B b;
251  // int *iptr = new int;
252  // B* bptr;
253  //
254  // A() {}
255  // };
256  //
257  // The directed tree:
258  //
259  // ->x
260  // /
261  // ->b--->y
262  // /
263  // A-->iptr->(int value)
264  // \
265  // ->bptr
266  //
267  // From this we'll construct a vector of fieldchains, where each fieldchain
268  // represents an uninitialized field. An uninitialized field may be a
269  // primitive object, a pointer, a pointee or a union without a single
270  // initialized field.
271  // In the above example, for the default constructor call we'll end up with
272  // these fieldchains:
273  //
274  // this->b.x
275  // this->iptr (pointee uninit)
276  // this->bptr (pointer uninit)
277  //
278  // We'll traverse each node of the above graph with the appropriate one of
279  // these methods:
280 
281  /// Checks the region of a union object, and returns true if no field is
282  /// initialized within the region.
283  bool isUnionUninit(const TypedValueRegion *R);
284 
285  /// Checks a region of a non-union object, and returns true if an
286  /// uninitialized field is found within the region.
287  bool isNonUnionUninit(const TypedValueRegion *R, FieldChainInfo LocalChain);
288 
289  /// Checks a region of a pointer or reference object, and returns true if the
290  /// ptr/ref object itself or any field within the pointee's region is
291  /// uninitialized.
292  bool isDereferencableUninit(const FieldRegion *FR, FieldChainInfo LocalChain);
293 
294  /// Returns true if the value of a primitive object is uninitialized.
295  bool isPrimitiveUninit(const SVal &V);
296 
297  // Note that we don't have a method for arrays -- the elements of an array are
298  // often left uninitialized intentionally even when it is of a C++ record
299  // type, so we'll assume that an array is always initialized.
300  // TODO: Add a support for nonloc::LocAsInteger.
301 
302  /// Processes LocalChain and attempts to insert it into UninitFields. Returns
303  /// true on success. Also adds the head of the list and \p PointeeR (if
304  /// supplied) to the GDM as already analyzed objects.
305  ///
306  /// Since this class analyzes regions with recursion, we'll only store
307  /// references to temporary FieldNode objects created on the stack. This means
308  /// that after analyzing a leaf of the directed tree described above, the
309  /// elements LocalChain references will be destructed, so we can't store it
310  /// directly.
311  bool addFieldToUninits(FieldChainInfo LocalChain,
312  const MemRegion *PointeeR = nullptr);
313 };
314 
315 /// Returns true if T is a primitive type. An object of a primitive type only
316 /// needs to be analyzed as much as checking whether their value is undefined.
317 inline bool isPrimitiveType(const QualType &T) {
318  return T->isBuiltinType() || T->isEnumeralType() ||
320  T->isFunctionType();
321 }
322 
323 inline bool isDereferencableType(const QualType &T) {
324  return T->isAnyPointerType() || T->isReferenceType();
325 }
326 
327 // Template method definitions.
328 
329 template <class FieldNodeT>
330 inline FieldChainInfo FieldChainInfo::add(const FieldNodeT &FN) {
331  assert(!contains(FN.getRegion()) &&
332  "Can't add a field that is already a part of the "
333  "fieldchain! Is this a cyclic reference?");
334 
335  FieldChainInfo NewChain = *this;
336  NewChain.Chain = ChainFactory.add(FN, Chain);
337  return NewChain;
338 }
339 
340 template <class FieldNodeT>
341 inline FieldChainInfo FieldChainInfo::replaceHead(const FieldNodeT &FN) {
342  FieldChainInfo NewChain(ChainFactory, Chain.getTail());
343  return NewChain.add(FN);
344 }
345 
346 } // end of namespace ento
347 } // end of namespace clang
348 
349 #endif // LLVM_CLANG_STATICANALYZER_UNINITIALIZEDOBJECT_H
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:530
A (possibly-)qualified type.
Definition: Type.h:638
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
bool isBlockPointerType() const
Definition: Type.h:6304
bool isSameRegion(const FieldRegion *OtherFR) const
Helper method for uniqueing.
bool isMemberPointerType() const
Definition: Type.h:6327
const FieldRegion * getUninitRegion() const
FieldChainInfo(FieldChain::Factory &F)
bool isPrimitiveType(const QualType &T)
Returns true if T is a primitive type.
bool isAnyFieldInitialized()
Returns whether the analyzed region contains at least one initialized field.
bool isEnumeralType() const
Definition: Type.h:6373
LineState State
FieldChainInfo add(const FieldNodeT &FN)
Constructs a new FieldChainInfo object with FN appended.
const FieldDecl * getDecl() const
Definition: MemRegion.h:1020
const FieldNode & getHead() const
Represents a member of a struct/union/class.
Definition: Decl.h:2579
bool isReferenceType() const
Definition: Type.h:6308
FieldNode(const FieldRegion *FR)
bool isDereferencableType(const QualType &T)
std::string getVariableName(const FieldDecl *Field)
Returns with Field&#39;s name.
Searches for and stores uninitialized fields in a non-union object.
void Profile(llvm::FoldingSetNodeID &ID) const
bool isBuiltinType() const
Helper methods to distinguish type categories.
Definition: Type.h:6365
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
const FieldRegion * FR
bool isAnyPointerType() const
Definition: Type.h:6300
virtual bool isBase() const
Represents a field chain.
Dataflow Directional Tag Classes.
const FieldDecl * getDecl() const
llvm::ImmutableList< const FieldNode & > FieldChain
std::map< const FieldRegion *, llvm::SmallString< 50 > > UninitFieldMap
bool isFunctionType() const
Definition: Type.h:6292
FieldChainInfo replaceHead(const FieldNodeT &FN)
Constructs a new FieldChainInfo object with FN as the new head of the list.
A lightweight polymorphic wrapper around FieldRegion *.
std::pair< ProgramStateRef, const UninitFieldMap & > getResults()
Returns with the modified state and a map of (uninitialized region, note message) pairs...
const FieldRegion * getRegion() const