clang-tools  8.0.0
UseAfterMoveCheck.cpp
Go to the documentation of this file.
1 //===--- UseAfterMoveCheck.cpp - clang-tidy -------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 
10 #include "UseAfterMoveCheck.h"
11 
12 #include "clang/Analysis/CFG.h"
13 #include "clang/Lex/Lexer.h"
14 
15 #include "../utils/ExprSequence.h"
16 
17 using namespace clang::ast_matchers;
18 using namespace clang::tidy::utils;
19 
20 
21 namespace clang {
22 namespace tidy {
23 namespace bugprone {
24 
25 namespace {
26 
27 /// Contains information about a use-after-move.
28 struct UseAfterMove {
29  // The DeclRefExpr that constituted the use of the object.
30  const DeclRefExpr *DeclRef;
31 
32  // Is the order in which the move and the use are evaluated undefined?
34 };
35 
36 /// Finds uses of a variable after a move (and maintains state required by the
37 /// various internal helper functions).
38 class UseAfterMoveFinder {
39 public:
40  UseAfterMoveFinder(ASTContext *TheContext);
41 
42  // Within the given function body, finds the first use of 'MovedVariable' that
43  // occurs after 'MovingCall' (the expression that performs the move). If a
44  // use-after-move is found, writes information about it to 'TheUseAfterMove'.
45  // Returns whether a use-after-move was found.
46  bool find(Stmt *FunctionBody, const Expr *MovingCall,
47  const ValueDecl *MovedVariable, UseAfterMove *TheUseAfterMove);
48 
49 private:
50  bool findInternal(const CFGBlock *Block, const Expr *MovingCall,
51  const ValueDecl *MovedVariable,
52  UseAfterMove *TheUseAfterMove);
53  void getUsesAndReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
54  llvm::SmallVectorImpl<const DeclRefExpr *> *Uses,
55  llvm::SmallPtrSetImpl<const Stmt *> *Reinits);
56  void getDeclRefs(const CFGBlock *Block, const Decl *MovedVariable,
57  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
58  void getReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
59  llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
60  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
61 
62  ASTContext *Context;
63  std::unique_ptr<ExprSequence> Sequence;
64  std::unique_ptr<StmtToBlockMap> BlockMap;
65  llvm::SmallPtrSet<const CFGBlock *, 8> Visited;
66 };
67 
68 } // namespace
69 
70 
71 // Matches nodes that are
72 // - Part of a decltype argument or class template argument (we check this by
73 // seeing if they are children of a TypeLoc), or
74 // - Part of a function template argument (we check this by seeing if they are
75 // children of a DeclRefExpr that references a function template).
76 // DeclRefExprs that fulfill these conditions should not be counted as a use or
77 // move.
78 static StatementMatcher inDecltypeOrTemplateArg() {
79  return anyOf(hasAncestor(typeLoc()),
80  hasAncestor(declRefExpr(
81  to(functionDecl(ast_matchers::isTemplateInstantiation())))));
82 }
83 
84 UseAfterMoveFinder::UseAfterMoveFinder(ASTContext *TheContext)
85  : Context(TheContext) {}
86 
87 bool UseAfterMoveFinder::find(Stmt *FunctionBody, const Expr *MovingCall,
88  const ValueDecl *MovedVariable,
89  UseAfterMove *TheUseAfterMove) {
90  // Generate the CFG manually instead of through an AnalysisDeclContext because
91  // it seems the latter can't be used to generate a CFG for the body of a
92  // labmda.
93  //
94  // We include implicit and temporary destructors in the CFG so that
95  // destructors marked [[noreturn]] are handled correctly in the control flow
96  // analysis. (These are used in some styles of assertion macros.)
97  CFG::BuildOptions Options;
98  Options.AddImplicitDtors = true;
99  Options.AddTemporaryDtors = true;
100  std::unique_ptr<CFG> TheCFG =
101  CFG::buildCFG(nullptr, FunctionBody, Context, Options);
102  if (!TheCFG)
103  return false;
104 
105  Sequence =
106  llvm::make_unique<ExprSequence>(TheCFG.get(), FunctionBody, Context);
107  BlockMap = llvm::make_unique<StmtToBlockMap>(TheCFG.get(), Context);
108  Visited.clear();
109 
110  const CFGBlock *Block = BlockMap->blockContainingStmt(MovingCall);
111  if (!Block)
112  return false;
113 
114  return findInternal(Block, MovingCall, MovedVariable, TheUseAfterMove);
115 }
116 
117 bool UseAfterMoveFinder::findInternal(const CFGBlock *Block,
118  const Expr *MovingCall,
119  const ValueDecl *MovedVariable,
120  UseAfterMove *TheUseAfterMove) {
121  if (Visited.count(Block))
122  return false;
123 
124  // Mark the block as visited (except if this is the block containing the
125  // std::move() and it's being visited the first time).
126  if (!MovingCall)
127  Visited.insert(Block);
128 
129  // Get all uses and reinits in the block.
130  llvm::SmallVector<const DeclRefExpr *, 1> Uses;
131  llvm::SmallPtrSet<const Stmt *, 1> Reinits;
132  getUsesAndReinits(Block, MovedVariable, &Uses, &Reinits);
133 
134  // Ignore all reinitializations where the move potentially comes after the
135  // reinit.
136  llvm::SmallVector<const Stmt *, 1> ReinitsToDelete;
137  for (const Stmt *Reinit : Reinits) {
138  if (MovingCall && Sequence->potentiallyAfter(MovingCall, Reinit))
139  ReinitsToDelete.push_back(Reinit);
140  }
141  for (const Stmt *Reinit : ReinitsToDelete) {
142  Reinits.erase(Reinit);
143  }
144 
145  // Find all uses that potentially come after the move.
146  for (const DeclRefExpr *Use : Uses) {
147  if (!MovingCall || Sequence->potentiallyAfter(Use, MovingCall)) {
148  // Does the use have a saving reinit? A reinit is saving if it definitely
149  // comes before the use, i.e. if there's no potential that the reinit is
150  // after the use.
151  bool HaveSavingReinit = false;
152  for (const Stmt *Reinit : Reinits) {
153  if (!Sequence->potentiallyAfter(Reinit, Use))
154  HaveSavingReinit = true;
155  }
156 
157  if (!HaveSavingReinit) {
158  TheUseAfterMove->DeclRef = Use;
159 
160  // Is this a use-after-move that depends on order of evaluation?
161  // This is the case if the move potentially comes after the use (and we
162  // already know that use potentially comes after the move, which taken
163  // together tells us that the ordering is unclear).
164  TheUseAfterMove->EvaluationOrderUndefined =
165  MovingCall != nullptr &&
166  Sequence->potentiallyAfter(MovingCall, Use);
167 
168  return true;
169  }
170  }
171  }
172 
173  // If the object wasn't reinitialized, call ourselves recursively on all
174  // successors.
175  if (Reinits.empty()) {
176  for (const auto &Succ : Block->succs()) {
177  if (Succ && findInternal(Succ, nullptr, MovedVariable, TheUseAfterMove))
178  return true;
179  }
180  }
181 
182  return false;
183 }
184 
185 void UseAfterMoveFinder::getUsesAndReinits(
186  const CFGBlock *Block, const ValueDecl *MovedVariable,
187  llvm::SmallVectorImpl<const DeclRefExpr *> *Uses,
188  llvm::SmallPtrSetImpl<const Stmt *> *Reinits) {
189  llvm::SmallPtrSet<const DeclRefExpr *, 1> DeclRefs;
190  llvm::SmallPtrSet<const DeclRefExpr *, 1> ReinitDeclRefs;
191 
192  getDeclRefs(Block, MovedVariable, &DeclRefs);
193  getReinits(Block, MovedVariable, Reinits, &ReinitDeclRefs);
194 
195  // All references to the variable that aren't reinitializations are uses.
196  Uses->clear();
197  for (const DeclRefExpr *DeclRef : DeclRefs) {
198  if (!ReinitDeclRefs.count(DeclRef))
199  Uses->push_back(DeclRef);
200  }
201 
202  // Sort the uses by their occurrence in the source code.
203  std::sort(Uses->begin(), Uses->end(),
204  [](const DeclRefExpr *D1, const DeclRefExpr *D2) {
205  return D1->getExprLoc() < D2->getExprLoc();
206  });
207 }
208 
209 bool isStandardSmartPointer(const ValueDecl *VD) {
210  const Type *TheType = VD->getType().getNonReferenceType().getTypePtrOrNull();
211  if (!TheType)
212  return false;
213 
214  const CXXRecordDecl *RecordDecl = TheType->getAsCXXRecordDecl();
215  if (!RecordDecl)
216  return false;
217 
218  const IdentifierInfo *ID = RecordDecl->getIdentifier();
219  if (!ID)
220  return false;
221 
222  StringRef Name = ID->getName();
223  if (Name != "unique_ptr" && Name != "shared_ptr" && Name != "weak_ptr")
224  return false;
225 
226  return RecordDecl->getDeclContext()->isStdNamespace();
227 }
228 
229 void UseAfterMoveFinder::getDeclRefs(
230  const CFGBlock *Block, const Decl *MovedVariable,
231  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
232  DeclRefs->clear();
233  for (const auto &Elem : *Block) {
234  Optional<CFGStmt> S = Elem.getAs<CFGStmt>();
235  if (!S)
236  continue;
237 
238  auto addDeclRefs = [this, Block,
239  DeclRefs](const ArrayRef<BoundNodes> Matches) {
240  for (const auto &Match : Matches) {
241  const auto *DeclRef = Match.getNodeAs<DeclRefExpr>("declref");
242  const auto *Operator = Match.getNodeAs<CXXOperatorCallExpr>("operator");
243  if (DeclRef && BlockMap->blockContainingStmt(DeclRef) == Block) {
244  // Ignore uses of a standard smart pointer that don't dereference the
245  // pointer.
246  if (Operator || !isStandardSmartPointer(DeclRef->getDecl())) {
247  DeclRefs->insert(DeclRef);
248  }
249  }
250  }
251  };
252 
253  auto DeclRefMatcher = declRefExpr(hasDeclaration(equalsNode(MovedVariable)),
254  unless(inDecltypeOrTemplateArg()))
255  .bind("declref");
256 
257  addDeclRefs(match(findAll(DeclRefMatcher), *S->getStmt(), *Context));
258  addDeclRefs(match(
259  findAll(cxxOperatorCallExpr(anyOf(hasOverloadedOperatorName("*"),
260  hasOverloadedOperatorName("->"),
261  hasOverloadedOperatorName("[]")),
262  hasArgument(0, DeclRefMatcher))
263  .bind("operator")),
264  *S->getStmt(), *Context));
265  }
266 }
267 
268 void UseAfterMoveFinder::getReinits(
269  const CFGBlock *Block, const ValueDecl *MovedVariable,
270  llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
271  llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
272  auto DeclRefMatcher =
273  declRefExpr(hasDeclaration(equalsNode(MovedVariable))).bind("declref");
274 
275  auto StandardContainerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
276  recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
277  "::std::basic_string", "::std::vector", "::std::deque",
278  "::std::forward_list", "::std::list", "::std::set", "::std::map",
279  "::std::multiset", "::std::multimap", "::std::unordered_set",
280  "::std::unordered_map", "::std::unordered_multiset",
281  "::std::unordered_multimap"))))));
282 
283  auto StandardSmartPointerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
284  recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
285  "::std::unique_ptr", "::std::shared_ptr", "::std::weak_ptr"))))));
286 
287  // Matches different types of reinitialization.
288  auto ReinitMatcher =
289  stmt(anyOf(
290  // Assignment. In addition to the overloaded assignment operator,
291  // test for built-in assignment as well, since template functions
292  // may be instantiated to use std::move() on built-in types.
293  binaryOperator(hasOperatorName("="), hasLHS(DeclRefMatcher)),
294  cxxOperatorCallExpr(hasOverloadedOperatorName("="),
295  hasArgument(0, DeclRefMatcher)),
296  // Declaration. We treat this as a type of reinitialization too,
297  // so we don't need to treat it separately.
298  declStmt(hasDescendant(equalsNode(MovedVariable))),
299  // clear() and assign() on standard containers.
300  cxxMemberCallExpr(
301  on(expr(DeclRefMatcher, StandardContainerTypeMatcher)),
302  // To keep the matcher simple, we check for assign() calls
303  // on all standard containers, even though only vector,
304  // deque, forward_list and list have assign(). If assign()
305  // is called on any of the other containers, this will be
306  // flagged by a compile error anyway.
307  callee(cxxMethodDecl(hasAnyName("clear", "assign")))),
308  // reset() on standard smart pointers.
309  cxxMemberCallExpr(
310  on(expr(DeclRefMatcher, StandardSmartPointerTypeMatcher)),
311  callee(cxxMethodDecl(hasName("reset")))),
312  // Methods that have the [[clang::reinitializes]] attribute.
313  cxxMemberCallExpr(
314  on(DeclRefMatcher),
315  callee(cxxMethodDecl(hasAttr(clang::attr::Reinitializes)))),
316  // Passing variable to a function as a non-const pointer.
317  callExpr(forEachArgumentWithParam(
318  unaryOperator(hasOperatorName("&"),
319  hasUnaryOperand(DeclRefMatcher)),
320  unless(parmVarDecl(hasType(pointsTo(isConstQualified())))))),
321  // Passing variable to a function as a non-const lvalue reference
322  // (unless that function is std::move()).
323  callExpr(forEachArgumentWithParam(
324  DeclRefMatcher,
325  unless(parmVarDecl(hasType(
326  references(qualType(isConstQualified())))))),
327  unless(callee(functionDecl(hasName("::std::move")))))))
328  .bind("reinit");
329 
330  Stmts->clear();
331  DeclRefs->clear();
332  for (const auto &Elem : *Block) {
333  Optional<CFGStmt> S = Elem.getAs<CFGStmt>();
334  if (!S)
335  continue;
336 
337  SmallVector<BoundNodes, 1> Matches =
338  match(findAll(ReinitMatcher), *S->getStmt(), *Context);
339 
340  for (const auto &Match : Matches) {
341  const auto *TheStmt = Match.getNodeAs<Stmt>("reinit");
342  const auto *TheDeclRef = Match.getNodeAs<DeclRefExpr>("declref");
343  if (TheStmt && BlockMap->blockContainingStmt(TheStmt) == Block) {
344  Stmts->insert(TheStmt);
345 
346  // We count DeclStmts as reinitializations, but they don't have a
347  // DeclRefExpr associated with them -- so we need to check 'TheDeclRef'
348  // before adding it to the set.
349  if (TheDeclRef)
350  DeclRefs->insert(TheDeclRef);
351  }
352  }
353  }
354 }
355 
356 static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg,
357  const UseAfterMove &Use, ClangTidyCheck *Check,
358  ASTContext *Context) {
359  SourceLocation UseLoc = Use.DeclRef->getExprLoc();
360  SourceLocation MoveLoc = MovingCall->getExprLoc();
361 
362  Check->diag(UseLoc, "'%0' used after it was moved")
363  << MoveArg->getDecl()->getName();
364  Check->diag(MoveLoc, "move occurred here", DiagnosticIDs::Note);
365  if (Use.EvaluationOrderUndefined) {
366  Check->diag(UseLoc,
367  "the use and move are unsequenced, i.e. there is no guarantee "
368  "about the order in which they are evaluated",
369  DiagnosticIDs::Note);
370  } else if (UseLoc < MoveLoc || Use.DeclRef == MoveArg) {
371  Check->diag(UseLoc,
372  "the use happens in a later loop iteration than the move",
373  DiagnosticIDs::Note);
374  }
375 }
376 
377 void UseAfterMoveCheck::registerMatchers(MatchFinder *Finder) {
378  if (!getLangOpts().CPlusPlus11)
379  return;
380 
381  auto CallMoveMatcher =
382  callExpr(callee(functionDecl(hasName("::std::move"))), argumentCountIs(1),
383  hasArgument(0, declRefExpr().bind("arg")),
384  anyOf(hasAncestor(lambdaExpr().bind("containing-lambda")),
385  hasAncestor(functionDecl().bind("containing-func"))),
386  unless(inDecltypeOrTemplateArg()))
387  .bind("call-move");
388 
389  Finder->addMatcher(
390  // To find the Stmt that we assume performs the actual move, we look for
391  // the direct ancestor of the std::move() that isn't one of the node
392  // types ignored by ignoringParenImpCasts().
393  stmt(forEach(expr(ignoringParenImpCasts(CallMoveMatcher))),
394  // Don't allow an InitListExpr to be the moving call. An InitListExpr
395  // has both a syntactic and a semantic form, and the parent-child
396  // relationships are different between the two. This could cause an
397  // InitListExpr to be analyzed as the moving call in addition to the
398  // Expr that we actually want, resulting in two diagnostics with
399  // different code locations for the same move.
400  unless(initListExpr()),
401  unless(expr(ignoringParenImpCasts(equalsBoundNode("call-move")))))
402  .bind("moving-call"),
403  this);
404 }
405 
406 void UseAfterMoveCheck::check(const MatchFinder::MatchResult &Result) {
407  const auto *ContainingLambda =
408  Result.Nodes.getNodeAs<LambdaExpr>("containing-lambda");
409  const auto *ContainingFunc =
410  Result.Nodes.getNodeAs<FunctionDecl>("containing-func");
411  const auto *CallMove = Result.Nodes.getNodeAs<CallExpr>("call-move");
412  const auto *MovingCall = Result.Nodes.getNodeAs<Expr>("moving-call");
413  const auto *Arg = Result.Nodes.getNodeAs<DeclRefExpr>("arg");
414 
415  if (!MovingCall || !MovingCall->getExprLoc().isValid())
416  MovingCall = CallMove;
417 
418  Stmt *FunctionBody = nullptr;
419  if (ContainingLambda)
420  FunctionBody = ContainingLambda->getBody();
421  else if (ContainingFunc)
422  FunctionBody = ContainingFunc->getBody();
423  else
424  return;
425 
426  // Ignore the std::move if the variable that was passed to it isn't a local
427  // variable.
428  if (!Arg->getDecl()->getDeclContext()->isFunctionOrMethod())
429  return;
430 
431  UseAfterMoveFinder finder(Result.Context);
432  UseAfterMove Use;
433  if (finder.find(FunctionBody, MovingCall, Arg->getDecl(), &Use))
434  emitDiagnostic(MovingCall, Arg, Use, this, Result.Context);
435 }
436 
437 } // namespace bugprone
438 } // namespace tidy
439 } // namespace clang
Base class for all clang-tidy checks.
Definition: ClangTidy.h:127
static constexpr llvm::StringLiteral Name
llvm::Optional< llvm::Expected< tooling::AtomicChanges > > Result
===– Representation.cpp - ClangDoc Representation --------—*- C++ -*-===//
bool isStandardSmartPointer(const ValueDecl *VD)
static StatementMatcher inDecltypeOrTemplateArg()
bool EvaluationOrderUndefined
const DeclRefExpr * DeclRef
DiagnosticBuilder diag(SourceLocation Loc, StringRef Description, DiagnosticIDs::Level Level=DiagnosticIDs::Warning)
Add a diagnostic with the check&#39;s name.
Definition: ClangTidy.cpp:438
static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg, const UseAfterMove &Use, ClangTidyCheck *Check, ASTContext *Context)