;
39classUninitializedObjectChecker
40:
public Checker<check::EndFunction, check::DeadSymbols> {
41 const BugTypeBT_uninitField{
this,
"Uninitialized fields"};
53classRegularField final :
public FieldNode{
57 void printNoteMsg(llvm::raw_ostream &Out)
const override{
58Out <<
"uninitialized field ";
61 void printPrefix(llvm::raw_ostream &Out)
const override{}
63 void printNode(llvm::raw_ostream &Out)
const override{
67 void printSeparator(llvm::raw_ostream &Out)
const override{ Out <<
'.'; }
79assert(!
T.isNull());
83 void printNoteMsg(llvm::raw_ostream &Out)
const override{
84llvm_unreachable(
"This node can never be the final node in the " 88 void printPrefix(llvm::raw_ostream &Out)
const override{}
90 void printNode(llvm::raw_ostream &Out)
const override{
91Out << BaseClassT->getAsCXXRecordDecl()->getName() <<
"::";
96 bool isBase()
const override{
return true; }
133voidUninitializedObjectChecker::checkEndFunction(
136 const auto*CtorDecl = dyn_cast_or_null<CXXConstructorDecl>(
137Context.getLocationContext()->getDecl());
141 if(!CtorDecl->isUserProvided())
144 if(CtorDecl->getParent()->isUnion())
157std::pair<ProgramStateRef, const UninitFieldMap &> UninitInfo =
163 if(UninitFields.empty()) {
164Context.addTransition(UpdatedState);
175 const Stmt*CallSite = Context.getStackFrame()->getCallSite();
182 if(Opts.ShouldConvertNotesToWarnings) {
183 for(
const auto&Pair : UninitFields) {
185 auto Report= std::make_unique<PathSensitiveBugReport>(
186BT_uninitField, Pair.second,
Node, LocUsedForUniqueing,
187 Node->getLocationContext()->getDecl());
188Context.emitReport(std::move(
Report));
194llvm::raw_svector_ostream WarningOS(WarningBuf);
195WarningOS << UninitFields.size() <<
" uninitialized field" 196<< (UninitFields.size() == 1 ?
"":
"s")
197<<
" at the end of the constructor call";
199 auto Report= std::make_unique<PathSensitiveBugReport>(
200BT_uninitField, WarningOS.str(),
Node, LocUsedForUniqueing,
201 Node->getLocationContext()->getDecl());
203 for(
const auto&Pair : UninitFields) {
204 Report->addNote(Pair.second,
208Context.emitReport(std::move(
Report));
211voidUninitializedObjectChecker::checkDeadSymbols(
SymbolReaper&SR,
214 for(
const MemRegion*R : State->get<AnalyzedRegions>()) {
216State = State->remove<AnalyzedRegions>(R);
227: State(State), ObjectR(R), Opts(Opts) {
234UninitFields.clear();
237boolFindUninitializedFields::addFieldToUninits(
FieldChainInfoChain,
242 "One must also pass the pointee region as a parameter for " 243 "dereferenceable fields!");
245 if(State->getStateManager().getContext().getSourceManager().isInSystemHeader(
252 if(State->contains<AnalyzedRegions>(FR))
256 if(State->contains<AnalyzedRegions>(PointeeR)) {
259State = State->add<AnalyzedRegions>(PointeeR);
262State = State->add<AnalyzedRegions>(FR);
264UninitFieldMap::mapped_type NoteMsgBuf;
265llvm::raw_svector_ostream
OS(NoteMsgBuf);
268 returnUninitFields.insert({FR, std::move(NoteMsgBuf)}).second;
275 "This method only checks non-union record objects!");
280IsAnyFieldInitialized =
true;
286IsAnyFieldInitialized =
true;
290 boolContainsUninitField =
false;
295 const autoFieldVal =
297 const auto*FR = FieldVal.getRegionAs<
FieldRegion>();
307 if(isNonUnionUninit(FR, LocalChain.
add(RegularField(FR))))
308ContainsUninitField =
true;
313 if(isUnionUninit(FR)) {
314 if(addFieldToUninits(LocalChain.
add(RegularField(FR))))
315ContainsUninitField =
true;
317IsAnyFieldInitialized =
true;
322IsAnyFieldInitialized =
true;
326 SVal V= State->getSVal(FieldVal);
329 if(isDereferencableUninit(FR, LocalChain))
330ContainsUninitField =
true;
335 if(isPrimitiveUninit(
V)) {
336 if(addFieldToUninits(LocalChain.
add(RegularField(FR))))
337ContainsUninitField =
true;
342llvm_unreachable(
"All cases are handled!");
347 const auto*CXXRD = dyn_cast<CXXRecordDecl>(RD);
349 returnContainsUninitField;
352 const auto*BaseRegion = State->getLValue(BaseSpec, R)
354.getRegionAs<TypedValueRegion>();
359 if(isNonUnionUninit(BaseRegion, LocalChain.
replaceHead(
360BaseClass(BaseSpec.getType()))))
361ContainsUninitField =
true;
363 if(isNonUnionUninit(BaseRegion,
364LocalChain.
add(BaseClass(BaseSpec.getType()))))
365ContainsUninitField =
true;
369 returnContainsUninitField;
374 "This method only checks union objects!");
379boolFindUninitializedFields::isPrimitiveUninit(
SVal V) {
383IsAnyFieldInitialized =
true;
393 if(
Node.isSameRegion(FR))
403static void printTail(llvm::raw_ostream &Out,
429 Node.printPrefix(Out);
444L.getHead().printNode(Out);
445L.getHead().printSeparator(Out);
457Context.getSValBuilder().getCXXThis(CtorDecl, Context.getStackFrame());
459 SValObjectV = Context.getState()->getSVal(ThisLoc);
479 const auto*OtherCtor = dyn_cast<CXXConstructorDecl>(LC->
getDecl());
498llvm::Regex R(Pattern);
501 if(R.match(FD->getType().getAsString()))
503 if(R.match(FD->getName()))
511 if(isa<CXXConstructorDecl>(M))
531assert(
Parent&&
"The record's definition must be avaible if an uninitialized" 532 " field of it was found!");
534 ASTContext&AC = State->getStateManager().getContext();
539 hasAnyName(
"exit",
"panic",
"error",
"Assert",
"assert",
"ziperr",
540 "assfail",
"db_error",
"__assert",
"__assert2",
"_wassert",
541 "__assert_rtn",
"__assert_fail",
"dtrace_assfail",
542 "yy_fatal_error",
"_XCAssertionFailureHandler",
543 "_DTAssertionFailureHandler",
"_TSAssertionFailureHandler"))));
558 if(Accesses.empty())
560 const auto*FirstAccess = Accesses[0].getNodeAs<
MemberExpr>(
"access");
566 const auto*FirstGuard = Guards[0].getNodeAs<
Stmt>(
"guard");
569 if(FirstAccess->getBeginLoc() < FirstGuard->getBeginLoc())
580 const auto*CXXParent = dyn_cast<CXXRecordDecl>(Field->getParent());
582 if(CXXParent && CXXParent->isLambda()) {
583assert(CXXParent->captures_begin());
584 autoIt = CXXParent->captures_begin() + Field->getFieldIndex();
586 if(It->capturesVariable())
587 returnllvm::Twine(
"/*captured variable*/"+
588It->getCapturedVar()->getName())
591 if(It->capturesThis())
592 return "/*'this' capture*/";
594llvm_unreachable(
"No other capture type is expected!");
597 returnstd::string(Field->getName());
600voidento::registerUninitializedObjectChecker(
CheckerManager&Mgr) {
606ChOpts.
IsPedantic= AnOpts.getCheckerBooleanOption(Chk,
"Pedantic");
608Chk,
"NotesAsWarnings");
610Chk,
"CheckPointeeInitialization");
612std::string(AnOpts.getCheckerStringOption(Chk,
"IgnoreRecordsWithField"));
614AnOpts.getCheckerBooleanOption(Chk,
"IgnoreGuardedFields");
616std::string ErrorMsg;
619 "a valid regex, building failed with error message " 620 "\""+ ErrorMsg +
"\"");
623boolento::shouldRegisterUninitializedObjectChecker(
const CheckerManager&mgr) {
#define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem)
Declares an immutable set of type NameTy, suitable for placement into the ProgramState.
static const Stmt * getMethodBody(const CXXMethodDecl *M)
static const TypedValueRegion * getConstructedRegion(const CXXConstructorDecl *CtorDecl, CheckerContext &Context)
Returns the region that was constructed by CtorDecl, or nullptr if that isn't possible.
static bool hasUnguardedAccess(const FieldDecl *FD, ProgramStateRef State)
Checks syntactically whether it is possible to access FD from the record that contains it without a p...
static bool willObjectBeAnalyzedLater(const CXXConstructorDecl *Ctor, CheckerContext &Context)
Checks whether the object constructed by Ctor will be analyzed later (e.g.
static bool shouldIgnoreRecord(const RecordDecl *RD, StringRef Pattern)
Checks whether RD contains a field with a name or type name that matches Pattern.
static void printTail(llvm::raw_ostream &Out, const FieldChainInfo::FieldChain L)
Prints every element except the last to Out.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
SourceManager & getSourceManager()
Stores options for the analyzer from the command line.
Represents a base class of a C++ class.
Represents a C++ constructor within a class.
Represents a static or instance method of a struct/union/class.
SourceLocation getLocation() const
AccessSpecifier getAccess() const
Represents a member of a struct/union/class.
const RecordDecl * getParent() const
Returns the parent of this field declaration, which is the struct in which this field is defined.
Stmt * getBody(const FunctionDecl *&Definition) const
Retrieve the body (definition) of the function.
FunctionDecl * getDefinition()
Get the definition for this declaration.
bool isDefined(const FunctionDecl *&Definition, bool CheckForPendingFriendDefinition=false) const
Returns true if the function has a definition that does not need to be instantiated.
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
const LocationContext * getParent() const
It might return null.
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
A (possibly-)qualified type.
Represents a struct/union/class.
field_range fields() const
RecordDecl * getDefinition() const
Returns the RecordDecl that actually defines this struct/union/class.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Stmt - This represents one statement.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
bool isStructureOrClassType() const
bool isRecordType() const
RecordDecl * getAsRecordDecl() const
Retrieves the RecordDecl this type refers to.
const AnalyzerOptions & getAnalyzerOptions() const
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
void reportInvalidCheckerOptionValue(const CheckerBase *C, StringRef OptionName, StringRef ExpectedValueDesc) const
Emits an error through a DiagnosticsEngine about an invalid user supplied checker option value.
Represents a field chain.
bool contains(const FieldRegion *FR) const
llvm::ImmutableList< const FieldNode & > FieldChain
const FieldNode & getHead() const
const FieldRegion * getUninitRegion() const
FieldChainInfo replaceHead(const FieldNodeT &FN)
Constructs a new FieldChainInfo object with FN as the new head of the list.
FieldChainInfo add(const FieldNodeT &FN)
Constructs a new FieldChainInfo object with FN appended.
void printNoteMsg(llvm::raw_ostream &Out) const
A lightweight polymorphic wrapper around FieldRegion *.
virtual bool isBase() const
virtual void printSeparator(llvm::raw_ostream &Out) const =0
Print the separator.
virtual void printPrefix(llvm::raw_ostream &Out) const =0
Print any prefixes before the fieldchain. Could contain casts, etc.
virtual void printNoteMsg(llvm::raw_ostream &Out) const =0
If this is the last element of the fieldchain, this method will print the note message associated wit...
const FieldDecl * getDecl() const
virtual void printNode(llvm::raw_ostream &Out) const =0
Print the node. Should contain the name of the field stored in FR.
LLVM_ATTRIBUTE_RETURNS_NONNULL const FieldDecl * getDecl() const override
Searches for and stores uninitialized fields in a non-union object.
FindUninitializedFields(ProgramStateRef State, const TypedValueRegion *const R, const UninitObjCheckerOptions &Opts)
Constructs the FindUninitializedField object, searches for and stores uninitialized fields in R.
bool isAnyFieldInitialized()
Returns whether the analyzed region contains at least one initialized field.
MemRegion - The root abstract class for all memory regions.
const RegionTy * getAs() const
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
const MemRegion * getAsRegion() const
bool isSubRegionOf(const MemRegion *R) const override
Check if the region is a subregion of the given region.
A class responsible for cleaning up unused symbols.
bool isLiveRegion(const MemRegion *region)
TypedValueRegion - An abstract class representing regions having a typed value.
virtual QualType getValueType() const =0
const internal::ArgumentAdaptingMatcherFunc< internal::HasDescendantMatcher > hasDescendant
Matches AST nodes that have descendant AST nodes that match the provided matcher.
const internal::VariadicDynCastAllOfMatcher< Stmt, CallExpr > callExpr
Matches call expressions.
SmallVector< BoundNodes, 1 > match(MatcherT Matcher, const NodeT &Node, ASTContext &Context)
Returns the results of matching Matcher on Node.
const internal::VariadicFunction< internal::Matcher< NamedDecl >, StringRef, internal::hasAnyNameFunc > hasAnyName
Matches NamedDecl nodes that have any of the specified names.
const internal::VariadicDynCastAllOfMatcher< Decl, FunctionDecl > functionDecl
Matches function declarations.
const internal::VariadicDynCastAllOfMatcher< Stmt, SwitchStmt > switchStmt
Matches switch statements.
const internal::VariadicDynCastAllOfMatcher< Stmt, MemberExpr > memberExpr
Matches member expressions.
internal::PolymorphicMatcher< internal::HasDeclarationMatcher, void(internal::HasDeclarationSupportedTypes), internal::Matcher< Decl > > hasDeclaration(const internal::Matcher< Decl > &InnerMatcher)
Matches a node if the declaration associated with that node matches the given matcher.
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
const internal::VariadicDynCastAllOfMatcher< Stmt, ConditionalOperator > conditionalOperator
Matches conditional operator expressions.
const internal::VariadicOperatorMatcherFunc< 2, std::numeric_limits< unsigned >::max()> anyOf
Matches if any of the given matchers matches.
const internal::VariadicDynCastAllOfMatcher< Stmt, IfStmt > ifStmt
Matches if statements.
std::string getVariableName(const FieldDecl *Field)
Returns with Field's name.
bool isPrimitiveType(const QualType &T)
Returns true if T is a primitive type.
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
bool isDereferencableType(const QualType &T)
std::map< const FieldRegion *, llvm::SmallString< 50 > > UninitFieldMap
The JSON file list parser is used to communicate input to InstallAPI.
const FunctionProtoType * T
bool ShouldConvertNotesToWarnings
std::string IgnoredRecordsWithFieldPattern
bool CheckPointeeInitialization
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4