AnalysisBasedWarnings.cpp revision 2e5156274b8051217565b557bfa14c80f7990e9c
1//=- AnalysisBasedWarnings.cpp - Sema warnings based on libAnalysis -*- C++ -*-=// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines analysis_warnings::[Policy,Executor]. 11// Together they are used by Sema to issue warnings based on inexpensive 12// static analysis algorithms in libAnalysis. 13// 14//===----------------------------------------------------------------------===// 15 16#include "clang/Sema/AnalysisBasedWarnings.h" 17#include "clang/Sema/SemaInternal.h" 18#include "clang/Sema/ScopeInfo.h" 19#include "clang/Basic/SourceManager.h" 20#include "clang/Basic/SourceLocation.h" 21#include "clang/Lex/Preprocessor.h" 22#include "clang/AST/DeclObjC.h" 23#include "clang/AST/DeclCXX.h" 24#include "clang/AST/ExprObjC.h" 25#include "clang/AST/ExprCXX.h" 26#include "clang/AST/StmtObjC.h" 27#include "clang/AST/StmtCXX.h" 28#include "clang/AST/EvaluatedExprVisitor.h" 29#include "clang/AST/StmtVisitor.h" 30#include "clang/Analysis/AnalysisContext.h" 31#include "clang/Analysis/CFG.h" 32#include "clang/Analysis/Analyses/ReachableCode.h" 33#include "clang/Analysis/Analyses/CFGReachabilityAnalysis.h" 34#include "clang/Analysis/Analyses/ThreadSafety.h" 35#include "clang/Analysis/CFGStmtMap.h" 36#include "clang/Analysis/Analyses/UninitializedValues.h" 37#include "llvm/ADT/BitVector.h" 38#include "llvm/ADT/FoldingSet.h" 39#include "llvm/ADT/ImmutableMap.h" 40#include "llvm/ADT/PostOrderIterator.h" 41#include "llvm/ADT/SmallVector.h" 42#include "llvm/ADT/StringRef.h" 43#include "llvm/Support/Casting.h" 44#include <algorithm> 45#include <vector> 46 47using namespace clang; 48 49//===----------------------------------------------------------------------===// 50// Unreachable code analysis. 51//===----------------------------------------------------------------------===// 52 53namespace { 54 class UnreachableCodeHandler : public reachable_code::Callback { 55 Sema &S; 56 public: 57 UnreachableCodeHandler(Sema &s) : S(s) {} 58 59 void HandleUnreachable(SourceLocation L, SourceRange R1, SourceRange R2) { 60 S.Diag(L, diag::warn_unreachable) << R1 << R2; 61 } 62 }; 63} 64 65/// CheckUnreachable - Check for unreachable code. 66static void CheckUnreachable(Sema &S, AnalysisDeclContext &AC) { 67 UnreachableCodeHandler UC(S); 68 reachable_code::FindUnreachableCode(AC, UC); 69} 70 71//===----------------------------------------------------------------------===// 72// Check for missing return value. 73//===----------------------------------------------------------------------===// 74 75enum ControlFlowKind { 76 UnknownFallThrough, 77 NeverFallThrough, 78 MaybeFallThrough, 79 AlwaysFallThrough, 80 NeverFallThroughOrReturn 81}; 82 83/// CheckFallThrough - Check that we don't fall off the end of a 84/// Statement that should return a value. 85/// 86/// \returns AlwaysFallThrough iff we always fall off the end of the statement, 87/// MaybeFallThrough iff we might or might not fall off the end, 88/// NeverFallThroughOrReturn iff we never fall off the end of the statement or 89/// return. We assume NeverFallThrough iff we never fall off the end of the 90/// statement but we may return. We assume that functions not marked noreturn 91/// will return. 92static ControlFlowKind CheckFallThrough(AnalysisDeclContext &AC) { 93 CFG *cfg = AC.getCFG(); 94 if (cfg == 0) return UnknownFallThrough; 95 96 // The CFG leaves in dead things, and we don't want the dead code paths to 97 // confuse us, so we mark all live things first. 98 llvm::BitVector live(cfg->getNumBlockIDs()); 99 unsigned count = reachable_code::ScanReachableFromBlock(&cfg->getEntry(), 100 live); 101 102 bool AddEHEdges = AC.getAddEHEdges(); 103 if (!AddEHEdges && count != cfg->getNumBlockIDs()) 104 // When there are things remaining dead, and we didn't add EH edges 105 // from CallExprs to the catch clauses, we have to go back and 106 // mark them as live. 107 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) { 108 CFGBlock &b = **I; 109 if (!live[b.getBlockID()]) { 110 if (b.pred_begin() == b.pred_end()) { 111 if (b.getTerminator() && isa<CXXTryStmt>(b.getTerminator())) 112 // When not adding EH edges from calls, catch clauses 113 // can otherwise seem dead. Avoid noting them as dead. 114 count += reachable_code::ScanReachableFromBlock(&b, live); 115 continue; 116 } 117 } 118 } 119 120 // Now we know what is live, we check the live precessors of the exit block 121 // and look for fall through paths, being careful to ignore normal returns, 122 // and exceptional paths. 123 bool HasLiveReturn = false; 124 bool HasFakeEdge = false; 125 bool HasPlainEdge = false; 126 bool HasAbnormalEdge = false; 127 128 // Ignore default cases that aren't likely to be reachable because all 129 // enums in a switch(X) have explicit case statements. 130 CFGBlock::FilterOptions FO; 131 FO.IgnoreDefaultsWithCoveredEnums = 1; 132 133 for (CFGBlock::filtered_pred_iterator 134 I = cfg->getExit().filtered_pred_start_end(FO); I.hasMore(); ++I) { 135 const CFGBlock& B = **I; 136 if (!live[B.getBlockID()]) 137 continue; 138 139 // Skip blocks which contain an element marked as no-return. They don't 140 // represent actually viable edges into the exit block, so mark them as 141 // abnormal. 142 if (B.hasNoReturnElement()) { 143 HasAbnormalEdge = true; 144 continue; 145 } 146 147 // Destructors can appear after the 'return' in the CFG. This is 148 // normal. We need to look pass the destructors for the return 149 // statement (if it exists). 150 CFGBlock::const_reverse_iterator ri = B.rbegin(), re = B.rend(); 151 152 for ( ; ri != re ; ++ri) 153 if (isa<CFGStmt>(*ri)) 154 break; 155 156 // No more CFGElements in the block? 157 if (ri == re) { 158 if (B.getTerminator() && isa<CXXTryStmt>(B.getTerminator())) { 159 HasAbnormalEdge = true; 160 continue; 161 } 162 // A labeled empty statement, or the entry block... 163 HasPlainEdge = true; 164 continue; 165 } 166 167 CFGStmt CS = cast<CFGStmt>(*ri); 168 const Stmt *S = CS.getStmt(); 169 if (isa<ReturnStmt>(S)) { 170 HasLiveReturn = true; 171 continue; 172 } 173 if (isa<ObjCAtThrowStmt>(S)) { 174 HasFakeEdge = true; 175 continue; 176 } 177 if (isa<CXXThrowExpr>(S)) { 178 HasFakeEdge = true; 179 continue; 180 } 181 if (const AsmStmt *AS = dyn_cast<AsmStmt>(S)) { 182 if (AS->isMSAsm()) { 183 HasFakeEdge = true; 184 HasLiveReturn = true; 185 continue; 186 } 187 } 188 if (isa<CXXTryStmt>(S)) { 189 HasAbnormalEdge = true; 190 continue; 191 } 192 if (std::find(B.succ_begin(), B.succ_end(), &cfg->getExit()) 193 == B.succ_end()) { 194 HasAbnormalEdge = true; 195 continue; 196 } 197 198 HasPlainEdge = true; 199 } 200 if (!HasPlainEdge) { 201 if (HasLiveReturn) 202 return NeverFallThrough; 203 return NeverFallThroughOrReturn; 204 } 205 if (HasAbnormalEdge || HasFakeEdge || HasLiveReturn) 206 return MaybeFallThrough; 207 // This says AlwaysFallThrough for calls to functions that are not marked 208 // noreturn, that don't return. If people would like this warning to be more 209 // accurate, such functions should be marked as noreturn. 210 return AlwaysFallThrough; 211} 212 213namespace { 214 215struct CheckFallThroughDiagnostics { 216 unsigned diag_MaybeFallThrough_HasNoReturn; 217 unsigned diag_MaybeFallThrough_ReturnsNonVoid; 218 unsigned diag_AlwaysFallThrough_HasNoReturn; 219 unsigned diag_AlwaysFallThrough_ReturnsNonVoid; 220 unsigned diag_NeverFallThroughOrReturn; 221 bool funMode; 222 SourceLocation FuncLoc; 223 224 static CheckFallThroughDiagnostics MakeForFunction(const Decl *Func) { 225 CheckFallThroughDiagnostics D; 226 D.FuncLoc = Func->getLocation(); 227 D.diag_MaybeFallThrough_HasNoReturn = 228 diag::warn_falloff_noreturn_function; 229 D.diag_MaybeFallThrough_ReturnsNonVoid = 230 diag::warn_maybe_falloff_nonvoid_function; 231 D.diag_AlwaysFallThrough_HasNoReturn = 232 diag::warn_falloff_noreturn_function; 233 D.diag_AlwaysFallThrough_ReturnsNonVoid = 234 diag::warn_falloff_nonvoid_function; 235 236 // Don't suggest that virtual functions be marked "noreturn", since they 237 // might be overridden by non-noreturn functions. 238 bool isVirtualMethod = false; 239 if (const CXXMethodDecl *Method = dyn_cast<CXXMethodDecl>(Func)) 240 isVirtualMethod = Method->isVirtual(); 241 242 // Don't suggest that template instantiations be marked "noreturn" 243 bool isTemplateInstantiation = false; 244 if (const FunctionDecl *Function = dyn_cast<FunctionDecl>(Func)) 245 isTemplateInstantiation = Function->isTemplateInstantiation(); 246 247 if (!isVirtualMethod && !isTemplateInstantiation) 248 D.diag_NeverFallThroughOrReturn = 249 diag::warn_suggest_noreturn_function; 250 else 251 D.diag_NeverFallThroughOrReturn = 0; 252 253 D.funMode = true; 254 return D; 255 } 256 257 static CheckFallThroughDiagnostics MakeForBlock() { 258 CheckFallThroughDiagnostics D; 259 D.diag_MaybeFallThrough_HasNoReturn = 260 diag::err_noreturn_block_has_return_expr; 261 D.diag_MaybeFallThrough_ReturnsNonVoid = 262 diag::err_maybe_falloff_nonvoid_block; 263 D.diag_AlwaysFallThrough_HasNoReturn = 264 diag::err_noreturn_block_has_return_expr; 265 D.diag_AlwaysFallThrough_ReturnsNonVoid = 266 diag::err_falloff_nonvoid_block; 267 D.diag_NeverFallThroughOrReturn = 268 diag::warn_suggest_noreturn_block; 269 D.funMode = false; 270 return D; 271 } 272 273 bool checkDiagnostics(DiagnosticsEngine &D, bool ReturnsVoid, 274 bool HasNoReturn) const { 275 if (funMode) { 276 return (ReturnsVoid || 277 D.getDiagnosticLevel(diag::warn_maybe_falloff_nonvoid_function, 278 FuncLoc) == DiagnosticsEngine::Ignored) 279 && (!HasNoReturn || 280 D.getDiagnosticLevel(diag::warn_noreturn_function_has_return_expr, 281 FuncLoc) == DiagnosticsEngine::Ignored) 282 && (!ReturnsVoid || 283 D.getDiagnosticLevel(diag::warn_suggest_noreturn_block, FuncLoc) 284 == DiagnosticsEngine::Ignored); 285 } 286 287 // For blocks. 288 return ReturnsVoid && !HasNoReturn 289 && (!ReturnsVoid || 290 D.getDiagnosticLevel(diag::warn_suggest_noreturn_block, FuncLoc) 291 == DiagnosticsEngine::Ignored); 292 } 293}; 294 295} 296 297/// CheckFallThroughForFunctionDef - Check that we don't fall off the end of a 298/// function that should return a value. Check that we don't fall off the end 299/// of a noreturn function. We assume that functions and blocks not marked 300/// noreturn will return. 301static void CheckFallThroughForBody(Sema &S, const Decl *D, const Stmt *Body, 302 const BlockExpr *blkExpr, 303 const CheckFallThroughDiagnostics& CD, 304 AnalysisDeclContext &AC) { 305 306 bool ReturnsVoid = false; 307 bool HasNoReturn = false; 308 309 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 310 ReturnsVoid = FD->getResultType()->isVoidType(); 311 HasNoReturn = FD->hasAttr<NoReturnAttr>() || 312 FD->getType()->getAs<FunctionType>()->getNoReturnAttr(); 313 } 314 else if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 315 ReturnsVoid = MD->getResultType()->isVoidType(); 316 HasNoReturn = MD->hasAttr<NoReturnAttr>(); 317 } 318 else if (isa<BlockDecl>(D)) { 319 QualType BlockTy = blkExpr->getType(); 320 if (const FunctionType *FT = 321 BlockTy->getPointeeType()->getAs<FunctionType>()) { 322 if (FT->getResultType()->isVoidType()) 323 ReturnsVoid = true; 324 if (FT->getNoReturnAttr()) 325 HasNoReturn = true; 326 } 327 } 328 329 DiagnosticsEngine &Diags = S.getDiagnostics(); 330 331 // Short circuit for compilation speed. 332 if (CD.checkDiagnostics(Diags, ReturnsVoid, HasNoReturn)) 333 return; 334 335 // FIXME: Function try block 336 if (const CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) { 337 switch (CheckFallThrough(AC)) { 338 case UnknownFallThrough: 339 break; 340 341 case MaybeFallThrough: 342 if (HasNoReturn) 343 S.Diag(Compound->getRBracLoc(), 344 CD.diag_MaybeFallThrough_HasNoReturn); 345 else if (!ReturnsVoid) 346 S.Diag(Compound->getRBracLoc(), 347 CD.diag_MaybeFallThrough_ReturnsNonVoid); 348 break; 349 case AlwaysFallThrough: 350 if (HasNoReturn) 351 S.Diag(Compound->getRBracLoc(), 352 CD.diag_AlwaysFallThrough_HasNoReturn); 353 else if (!ReturnsVoid) 354 S.Diag(Compound->getRBracLoc(), 355 CD.diag_AlwaysFallThrough_ReturnsNonVoid); 356 break; 357 case NeverFallThroughOrReturn: 358 if (ReturnsVoid && !HasNoReturn && CD.diag_NeverFallThroughOrReturn) { 359 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 360 S.Diag(Compound->getLBracLoc(), CD.diag_NeverFallThroughOrReturn) 361 << 0 << FD; 362 } else if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 363 S.Diag(Compound->getLBracLoc(), CD.diag_NeverFallThroughOrReturn) 364 << 1 << MD; 365 } else { 366 S.Diag(Compound->getLBracLoc(), CD.diag_NeverFallThroughOrReturn); 367 } 368 } 369 break; 370 case NeverFallThrough: 371 break; 372 } 373 } 374} 375 376//===----------------------------------------------------------------------===// 377// -Wuninitialized 378//===----------------------------------------------------------------------===// 379 380namespace { 381/// ContainsReference - A visitor class to search for references to 382/// a particular declaration (the needle) within any evaluated component of an 383/// expression (recursively). 384class ContainsReference : public EvaluatedExprVisitor<ContainsReference> { 385 bool FoundReference; 386 const DeclRefExpr *Needle; 387 388public: 389 ContainsReference(ASTContext &Context, const DeclRefExpr *Needle) 390 : EvaluatedExprVisitor<ContainsReference>(Context), 391 FoundReference(false), Needle(Needle) {} 392 393 void VisitExpr(Expr *E) { 394 // Stop evaluating if we already have a reference. 395 if (FoundReference) 396 return; 397 398 EvaluatedExprVisitor<ContainsReference>::VisitExpr(E); 399 } 400 401 void VisitDeclRefExpr(DeclRefExpr *E) { 402 if (E == Needle) 403 FoundReference = true; 404 else 405 EvaluatedExprVisitor<ContainsReference>::VisitDeclRefExpr(E); 406 } 407 408 bool doesContainReference() const { return FoundReference; } 409}; 410} 411 412static bool SuggestInitializationFixit(Sema &S, const VarDecl *VD) { 413 // Don't issue a fixit if there is already an initializer. 414 if (VD->getInit()) 415 return false; 416 417 // Suggest possible initialization (if any). 418 QualType VariableTy = VD->getType().getCanonicalType(); 419 const char *Init = S.getFixItZeroInitializerForType(VariableTy); 420 if (!Init) 421 return false; 422 423 SourceLocation Loc = S.PP.getLocForEndOfToken(VD->getLocEnd()); 424 S.Diag(Loc, diag::note_var_fixit_add_initialization) << VD->getDeclName() 425 << FixItHint::CreateInsertion(Loc, Init); 426 return true; 427} 428 429/// DiagnoseUninitializedUse -- Helper function for diagnosing uses of an 430/// uninitialized variable. This manages the different forms of diagnostic 431/// emitted for particular types of uses. Returns true if the use was diagnosed 432/// as a warning. If a pariticular use is one we omit warnings for, returns 433/// false. 434static bool DiagnoseUninitializedUse(Sema &S, const VarDecl *VD, 435 const Expr *E, bool isAlwaysUninit, 436 bool alwaysReportSelfInit = false) { 437 bool isSelfInit = false; 438 439 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) { 440 if (isAlwaysUninit) { 441 // Inspect the initializer of the variable declaration which is 442 // being referenced prior to its initialization. We emit 443 // specialized diagnostics for self-initialization, and we 444 // specifically avoid warning about self references which take the 445 // form of: 446 // 447 // int x = x; 448 // 449 // This is used to indicate to GCC that 'x' is intentionally left 450 // uninitialized. Proven code paths which access 'x' in 451 // an uninitialized state after this will still warn. 452 // 453 // TODO: Should we suppress maybe-uninitialized warnings for 454 // variables initialized in this way? 455 if (const Expr *Initializer = VD->getInit()) { 456 if (!alwaysReportSelfInit && DRE == Initializer->IgnoreParenImpCasts()) 457 return false; 458 459 ContainsReference CR(S.Context, DRE); 460 CR.Visit(const_cast<Expr*>(Initializer)); 461 isSelfInit = CR.doesContainReference(); 462 } 463 if (isSelfInit) { 464 S.Diag(DRE->getLocStart(), 465 diag::warn_uninit_self_reference_in_init) 466 << VD->getDeclName() << VD->getLocation() << DRE->getSourceRange(); 467 } else { 468 S.Diag(DRE->getLocStart(), diag::warn_uninit_var) 469 << VD->getDeclName() << DRE->getSourceRange(); 470 } 471 } else { 472 S.Diag(DRE->getLocStart(), diag::warn_maybe_uninit_var) 473 << VD->getDeclName() << DRE->getSourceRange(); 474 } 475 } else { 476 const BlockExpr *BE = cast<BlockExpr>(E); 477 S.Diag(BE->getLocStart(), 478 isAlwaysUninit ? diag::warn_uninit_var_captured_by_block 479 : diag::warn_maybe_uninit_var_captured_by_block) 480 << VD->getDeclName(); 481 } 482 483 // Report where the variable was declared when the use wasn't within 484 // the initializer of that declaration & we didn't already suggest 485 // an initialization fixit. 486 if (!isSelfInit && !SuggestInitializationFixit(S, VD)) 487 S.Diag(VD->getLocStart(), diag::note_uninit_var_def) 488 << VD->getDeclName(); 489 490 return true; 491} 492 493typedef std::pair<const Expr*, bool> UninitUse; 494 495namespace { 496struct SLocSort { 497 bool operator()(const UninitUse &a, const UninitUse &b) { 498 SourceLocation aLoc = a.first->getLocStart(); 499 SourceLocation bLoc = b.first->getLocStart(); 500 return aLoc.getRawEncoding() < bLoc.getRawEncoding(); 501 } 502}; 503 504class UninitValsDiagReporter : public UninitVariablesHandler { 505 Sema &S; 506 typedef SmallVector<UninitUse, 2> UsesVec; 507 typedef llvm::DenseMap<const VarDecl *, std::pair<UsesVec*, bool> > UsesMap; 508 UsesMap *uses; 509 510public: 511 UninitValsDiagReporter(Sema &S) : S(S), uses(0) {} 512 ~UninitValsDiagReporter() { 513 flushDiagnostics(); 514 } 515 516 std::pair<UsesVec*, bool> &getUses(const VarDecl *vd) { 517 if (!uses) 518 uses = new UsesMap(); 519 520 UsesMap::mapped_type &V = (*uses)[vd]; 521 UsesVec *&vec = V.first; 522 if (!vec) 523 vec = new UsesVec(); 524 525 return V; 526 } 527 528 void handleUseOfUninitVariable(const Expr *ex, const VarDecl *vd, 529 bool isAlwaysUninit) { 530 getUses(vd).first->push_back(std::make_pair(ex, isAlwaysUninit)); 531 } 532 533 void handleSelfInit(const VarDecl *vd) { 534 getUses(vd).second = true; 535 } 536 537 void flushDiagnostics() { 538 if (!uses) 539 return; 540 541 for (UsesMap::iterator i = uses->begin(), e = uses->end(); i != e; ++i) { 542 const VarDecl *vd = i->first; 543 const UsesMap::mapped_type &V = i->second; 544 545 UsesVec *vec = V.first; 546 bool hasSelfInit = V.second; 547 548 // Specially handle the case where we have uses of an uninitialized 549 // variable, but the root cause is an idiomatic self-init. We want 550 // to report the diagnostic at the self-init since that is the root cause. 551 if (!vec->empty() && hasSelfInit && hasAlwaysUninitializedUse(vec)) 552 DiagnoseUninitializedUse(S, vd, vd->getInit()->IgnoreParenCasts(), 553 /* isAlwaysUninit */ true, 554 /* alwaysReportSelfInit */ true); 555 else { 556 // Sort the uses by their SourceLocations. While not strictly 557 // guaranteed to produce them in line/column order, this will provide 558 // a stable ordering. 559 std::sort(vec->begin(), vec->end(), SLocSort()); 560 561 for (UsesVec::iterator vi = vec->begin(), ve = vec->end(); vi != ve; 562 ++vi) { 563 if (DiagnoseUninitializedUse(S, vd, vi->first, 564 /*isAlwaysUninit=*/vi->second)) 565 // Skip further diagnostics for this variable. We try to warn only 566 // on the first point at which a variable is used uninitialized. 567 break; 568 } 569 } 570 571 // Release the uses vector. 572 delete vec; 573 } 574 delete uses; 575 } 576 577private: 578 static bool hasAlwaysUninitializedUse(const UsesVec* vec) { 579 for (UsesVec::const_iterator i = vec->begin(), e = vec->end(); i != e; ++i) { 580 if (i->second) { 581 return true; 582 } 583 } 584 return false; 585} 586}; 587} 588 589 590//===----------------------------------------------------------------------===// 591// -Wthread-safety 592//===----------------------------------------------------------------------===// 593namespace clang { 594namespace thread_safety { 595typedef llvm::SmallVector<PartialDiagnosticAt, 1> OptionalNotes; 596typedef std::pair<PartialDiagnosticAt, OptionalNotes> DelayedDiag; 597typedef llvm::SmallVector<DelayedDiag, 4> DiagList; 598 599struct SortDiagBySourceLocation { 600 Sema &S; 601 SortDiagBySourceLocation(Sema &S) : S(S) {} 602 603 bool operator()(const DelayedDiag &left, const DelayedDiag &right) { 604 // Although this call will be slow, this is only called when outputting 605 // multiple warnings. 606 return S.getSourceManager().isBeforeInTranslationUnit(left.first.first, 607 right.first.first); 608 } 609}; 610 611namespace { 612class ThreadSafetyReporter : public clang::thread_safety::ThreadSafetyHandler { 613 Sema &S; 614 DiagList Warnings; 615 SourceLocation FunLocation, FunEndLocation; 616 617 // Helper functions 618 void warnLockMismatch(unsigned DiagID, Name LockName, SourceLocation Loc) { 619 // Gracefully handle rare cases when the analysis can't get a more 620 // precise source location. 621 if (!Loc.isValid()) 622 Loc = FunLocation; 623 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) << LockName); 624 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 625 } 626 627 public: 628 ThreadSafetyReporter(Sema &S, SourceLocation FL, SourceLocation FEL) 629 : S(S), FunLocation(FL), FunEndLocation(FEL) {} 630 631 /// \brief Emit all buffered diagnostics in order of sourcelocation. 632 /// We need to output diagnostics produced while iterating through 633 /// the lockset in deterministic order, so this function orders diagnostics 634 /// and outputs them. 635 void emitDiagnostics() { 636 SortDiagBySourceLocation SortDiagBySL(S); 637 sort(Warnings.begin(), Warnings.end(), SortDiagBySL); 638 for (DiagList::iterator I = Warnings.begin(), E = Warnings.end(); 639 I != E; ++I) { 640 S.Diag(I->first.first, I->first.second); 641 const OptionalNotes &Notes = I->second; 642 for (unsigned NoteI = 0, NoteN = Notes.size(); NoteI != NoteN; ++NoteI) 643 S.Diag(Notes[NoteI].first, Notes[NoteI].second); 644 } 645 } 646 647 void handleInvalidLockExp(SourceLocation Loc) { 648 PartialDiagnosticAt Warning(Loc, 649 S.PDiag(diag::warn_cannot_resolve_lock) << Loc); 650 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 651 } 652 void handleUnmatchedUnlock(Name LockName, SourceLocation Loc) { 653 warnLockMismatch(diag::warn_unlock_but_no_lock, LockName, Loc); 654 } 655 656 void handleDoubleLock(Name LockName, SourceLocation Loc) { 657 warnLockMismatch(diag::warn_double_lock, LockName, Loc); 658 } 659 660 void handleMutexHeldEndOfScope(Name LockName, SourceLocation LocLocked, 661 SourceLocation LocEndOfScope, 662 LockErrorKind LEK){ 663 unsigned DiagID = 0; 664 switch (LEK) { 665 case LEK_LockedSomePredecessors: 666 DiagID = diag::warn_lock_some_predecessors; 667 break; 668 case LEK_LockedSomeLoopIterations: 669 DiagID = diag::warn_expecting_lock_held_on_loop; 670 break; 671 case LEK_LockedAtEndOfFunction: 672 DiagID = diag::warn_no_unlock; 673 break; 674 } 675 if (LocEndOfScope.isInvalid()) 676 LocEndOfScope = FunEndLocation; 677 678 PartialDiagnosticAt Warning(LocEndOfScope, S.PDiag(DiagID) << LockName); 679 PartialDiagnosticAt Note(LocLocked, S.PDiag(diag::note_locked_here)); 680 Warnings.push_back(DelayedDiag(Warning, OptionalNotes(1, Note))); 681 } 682 683 684 void handleExclusiveAndShared(Name LockName, SourceLocation Loc1, 685 SourceLocation Loc2) { 686 PartialDiagnosticAt Warning( 687 Loc1, S.PDiag(diag::warn_lock_exclusive_and_shared) << LockName); 688 PartialDiagnosticAt Note( 689 Loc2, S.PDiag(diag::note_lock_exclusive_and_shared) << LockName); 690 Warnings.push_back(DelayedDiag(Warning, OptionalNotes(1, Note))); 691 } 692 693 void handleNoMutexHeld(const NamedDecl *D, ProtectedOperationKind POK, 694 AccessKind AK, SourceLocation Loc) { 695 assert((POK == POK_VarAccess || POK == POK_VarDereference) 696 && "Only works for variables"); 697 unsigned DiagID = POK == POK_VarAccess? 698 diag::warn_variable_requires_any_lock: 699 diag::warn_var_deref_requires_any_lock; 700 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) 701 << D->getName() << getLockKindFromAccessKind(AK)); 702 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 703 } 704 705 void handleMutexNotHeld(const NamedDecl *D, ProtectedOperationKind POK, 706 Name LockName, LockKind LK, SourceLocation Loc) { 707 unsigned DiagID = 0; 708 switch (POK) { 709 case POK_VarAccess: 710 DiagID = diag::warn_variable_requires_lock; 711 break; 712 case POK_VarDereference: 713 DiagID = diag::warn_var_deref_requires_lock; 714 break; 715 case POK_FunctionCall: 716 DiagID = diag::warn_fun_requires_lock; 717 break; 718 } 719 PartialDiagnosticAt Warning(Loc, S.PDiag(DiagID) 720 << D->getName() << LockName << LK); 721 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 722 } 723 724 void handleFunExcludesLock(Name FunName, Name LockName, SourceLocation Loc) { 725 PartialDiagnosticAt Warning(Loc, 726 S.PDiag(diag::warn_fun_excludes_mutex) << FunName << LockName); 727 Warnings.push_back(DelayedDiag(Warning, OptionalNotes())); 728 } 729}; 730} 731} 732} 733 734//===----------------------------------------------------------------------===// 735// AnalysisBasedWarnings - Worker object used by Sema to execute analysis-based 736// warnings on a function, method, or block. 737//===----------------------------------------------------------------------===// 738 739clang::sema::AnalysisBasedWarnings::Policy::Policy() { 740 enableCheckFallThrough = 1; 741 enableCheckUnreachable = 0; 742 enableThreadSafetyAnalysis = 0; 743} 744 745clang::sema::AnalysisBasedWarnings::AnalysisBasedWarnings(Sema &s) 746 : S(s), 747 NumFunctionsAnalyzed(0), 748 NumFunctionsWithBadCFGs(0), 749 NumCFGBlocks(0), 750 MaxCFGBlocksPerFunction(0), 751 NumUninitAnalysisFunctions(0), 752 NumUninitAnalysisVariables(0), 753 MaxUninitAnalysisVariablesPerFunction(0), 754 NumUninitAnalysisBlockVisits(0), 755 MaxUninitAnalysisBlockVisitsPerFunction(0) { 756 DiagnosticsEngine &D = S.getDiagnostics(); 757 DefaultPolicy.enableCheckUnreachable = (unsigned) 758 (D.getDiagnosticLevel(diag::warn_unreachable, SourceLocation()) != 759 DiagnosticsEngine::Ignored); 760 DefaultPolicy.enableThreadSafetyAnalysis = (unsigned) 761 (D.getDiagnosticLevel(diag::warn_double_lock, SourceLocation()) != 762 DiagnosticsEngine::Ignored); 763 764} 765 766static void flushDiagnostics(Sema &S, sema::FunctionScopeInfo *fscope) { 767 for (SmallVectorImpl<sema::PossiblyUnreachableDiag>::iterator 768 i = fscope->PossiblyUnreachableDiags.begin(), 769 e = fscope->PossiblyUnreachableDiags.end(); 770 i != e; ++i) { 771 const sema::PossiblyUnreachableDiag &D = *i; 772 S.Diag(D.Loc, D.PD); 773 } 774} 775 776void clang::sema:: 777AnalysisBasedWarnings::IssueWarnings(sema::AnalysisBasedWarnings::Policy P, 778 sema::FunctionScopeInfo *fscope, 779 const Decl *D, const BlockExpr *blkExpr) { 780 781 // We avoid doing analysis-based warnings when there are errors for 782 // two reasons: 783 // (1) The CFGs often can't be constructed (if the body is invalid), so 784 // don't bother trying. 785 // (2) The code already has problems; running the analysis just takes more 786 // time. 787 DiagnosticsEngine &Diags = S.getDiagnostics(); 788 789 // Do not do any analysis for declarations in system headers if we are 790 // going to just ignore them. 791 if (Diags.getSuppressSystemWarnings() && 792 S.SourceMgr.isInSystemHeader(D->getLocation())) 793 return; 794 795 // For code in dependent contexts, we'll do this at instantiation time. 796 if (cast<DeclContext>(D)->isDependentContext()) 797 return; 798 799 if (Diags.hasErrorOccurred() || Diags.hasFatalErrorOccurred()) { 800 // Flush out any possibly unreachable diagnostics. 801 flushDiagnostics(S, fscope); 802 return; 803 } 804 805 const Stmt *Body = D->getBody(); 806 assert(Body); 807 808 AnalysisDeclContext AC(/* AnalysisDeclContextManager */ 0, D, 0); 809 810 // Don't generate EH edges for CallExprs as we'd like to avoid the n^2 811 // explosion for destrutors that can result and the compile time hit. 812 AC.getCFGBuildOptions().PruneTriviallyFalseEdges = true; 813 AC.getCFGBuildOptions().AddEHEdges = false; 814 AC.getCFGBuildOptions().AddInitializers = true; 815 AC.getCFGBuildOptions().AddImplicitDtors = true; 816 817 // Force that certain expressions appear as CFGElements in the CFG. This 818 // is used to speed up various analyses. 819 // FIXME: This isn't the right factoring. This is here for initial 820 // prototyping, but we need a way for analyses to say what expressions they 821 // expect to always be CFGElements and then fill in the BuildOptions 822 // appropriately. This is essentially a layering violation. 823 if (P.enableCheckUnreachable || P.enableThreadSafetyAnalysis) { 824 // Unreachable code analysis and thread safety require a linearized CFG. 825 AC.getCFGBuildOptions().setAllAlwaysAdd(); 826 } 827 else { 828 AC.getCFGBuildOptions() 829 .setAlwaysAdd(Stmt::BinaryOperatorClass) 830 .setAlwaysAdd(Stmt::BlockExprClass) 831 .setAlwaysAdd(Stmt::CStyleCastExprClass) 832 .setAlwaysAdd(Stmt::DeclRefExprClass) 833 .setAlwaysAdd(Stmt::ImplicitCastExprClass) 834 .setAlwaysAdd(Stmt::UnaryOperatorClass); 835 } 836 837 // Construct the analysis context with the specified CFG build options. 838 839 // Emit delayed diagnostics. 840 if (!fscope->PossiblyUnreachableDiags.empty()) { 841 bool analyzed = false; 842 843 // Register the expressions with the CFGBuilder. 844 for (SmallVectorImpl<sema::PossiblyUnreachableDiag>::iterator 845 i = fscope->PossiblyUnreachableDiags.begin(), 846 e = fscope->PossiblyUnreachableDiags.end(); 847 i != e; ++i) { 848 if (const Stmt *stmt = i->stmt) 849 AC.registerForcedBlockExpression(stmt); 850 } 851 852 if (AC.getCFG()) { 853 analyzed = true; 854 for (SmallVectorImpl<sema::PossiblyUnreachableDiag>::iterator 855 i = fscope->PossiblyUnreachableDiags.begin(), 856 e = fscope->PossiblyUnreachableDiags.end(); 857 i != e; ++i) 858 { 859 const sema::PossiblyUnreachableDiag &D = *i; 860 bool processed = false; 861 if (const Stmt *stmt = i->stmt) { 862 const CFGBlock *block = AC.getBlockForRegisteredExpression(stmt); 863 CFGReverseBlockReachabilityAnalysis *cra = 864 AC.getCFGReachablityAnalysis(); 865 // FIXME: We should be able to assert that block is non-null, but 866 // the CFG analysis can skip potentially-evaluated expressions in 867 // edge cases; see test/Sema/vla-2.c. 868 if (block && cra) { 869 // Can this block be reached from the entrance? 870 if (cra->isReachable(&AC.getCFG()->getEntry(), block)) 871 S.Diag(D.Loc, D.PD); 872 processed = true; 873 } 874 } 875 if (!processed) { 876 // Emit the warning anyway if we cannot map to a basic block. 877 S.Diag(D.Loc, D.PD); 878 } 879 } 880 } 881 882 if (!analyzed) 883 flushDiagnostics(S, fscope); 884 } 885 886 887 // Warning: check missing 'return' 888 if (P.enableCheckFallThrough) { 889 const CheckFallThroughDiagnostics &CD = 890 (isa<BlockDecl>(D) ? CheckFallThroughDiagnostics::MakeForBlock() 891 : CheckFallThroughDiagnostics::MakeForFunction(D)); 892 CheckFallThroughForBody(S, D, Body, blkExpr, CD, AC); 893 } 894 895 // Warning: check for unreachable code 896 if (P.enableCheckUnreachable) { 897 // Only check for unreachable code on non-template instantiations. 898 // Different template instantiations can effectively change the control-flow 899 // and it is very difficult to prove that a snippet of code in a template 900 // is unreachable for all instantiations. 901 bool isTemplateInstantiation = false; 902 if (const FunctionDecl *Function = dyn_cast<FunctionDecl>(D)) 903 isTemplateInstantiation = Function->isTemplateInstantiation(); 904 if (!isTemplateInstantiation) 905 CheckUnreachable(S, AC); 906 } 907 908 // Check for thread safety violations 909 if (P.enableThreadSafetyAnalysis) { 910 SourceLocation FL = AC.getDecl()->getLocation(); 911 SourceLocation FEL = AC.getDecl()->getLocEnd(); 912 thread_safety::ThreadSafetyReporter Reporter(S, FL, FEL); 913 thread_safety::runThreadSafetyAnalysis(AC, Reporter); 914 Reporter.emitDiagnostics(); 915 } 916 917 if (Diags.getDiagnosticLevel(diag::warn_uninit_var, D->getLocStart()) 918 != DiagnosticsEngine::Ignored || 919 Diags.getDiagnosticLevel(diag::warn_maybe_uninit_var, D->getLocStart()) 920 != DiagnosticsEngine::Ignored) { 921 if (CFG *cfg = AC.getCFG()) { 922 UninitValsDiagReporter reporter(S); 923 UninitVariablesAnalysisStats stats; 924 std::memset(&stats, 0, sizeof(UninitVariablesAnalysisStats)); 925 runUninitializedVariablesAnalysis(*cast<DeclContext>(D), *cfg, AC, 926 reporter, stats); 927 928 if (S.CollectStats && stats.NumVariablesAnalyzed > 0) { 929 ++NumUninitAnalysisFunctions; 930 NumUninitAnalysisVariables += stats.NumVariablesAnalyzed; 931 NumUninitAnalysisBlockVisits += stats.NumBlockVisits; 932 MaxUninitAnalysisVariablesPerFunction = 933 std::max(MaxUninitAnalysisVariablesPerFunction, 934 stats.NumVariablesAnalyzed); 935 MaxUninitAnalysisBlockVisitsPerFunction = 936 std::max(MaxUninitAnalysisBlockVisitsPerFunction, 937 stats.NumBlockVisits); 938 } 939 } 940 } 941 942 // Collect statistics about the CFG if it was built. 943 if (S.CollectStats && AC.isCFGBuilt()) { 944 ++NumFunctionsAnalyzed; 945 if (CFG *cfg = AC.getCFG()) { 946 // If we successfully built a CFG for this context, record some more 947 // detail information about it. 948 NumCFGBlocks += cfg->getNumBlockIDs(); 949 MaxCFGBlocksPerFunction = std::max(MaxCFGBlocksPerFunction, 950 cfg->getNumBlockIDs()); 951 } else { 952 ++NumFunctionsWithBadCFGs; 953 } 954 } 955} 956 957void clang::sema::AnalysisBasedWarnings::PrintStats() const { 958 llvm::errs() << "\n*** Analysis Based Warnings Stats:\n"; 959 960 unsigned NumCFGsBuilt = NumFunctionsAnalyzed - NumFunctionsWithBadCFGs; 961 unsigned AvgCFGBlocksPerFunction = 962 !NumCFGsBuilt ? 0 : NumCFGBlocks/NumCFGsBuilt; 963 llvm::errs() << NumFunctionsAnalyzed << " functions analyzed (" 964 << NumFunctionsWithBadCFGs << " w/o CFGs).\n" 965 << " " << NumCFGBlocks << " CFG blocks built.\n" 966 << " " << AvgCFGBlocksPerFunction 967 << " average CFG blocks per function.\n" 968 << " " << MaxCFGBlocksPerFunction 969 << " max CFG blocks per function.\n"; 970 971 unsigned AvgUninitVariablesPerFunction = !NumUninitAnalysisFunctions ? 0 972 : NumUninitAnalysisVariables/NumUninitAnalysisFunctions; 973 unsigned AvgUninitBlockVisitsPerFunction = !NumUninitAnalysisFunctions ? 0 974 : NumUninitAnalysisBlockVisits/NumUninitAnalysisFunctions; 975 llvm::errs() << NumUninitAnalysisFunctions 976 << " functions analyzed for uninitialiazed variables\n" 977 << " " << NumUninitAnalysisVariables << " variables analyzed.\n" 978 << " " << AvgUninitVariablesPerFunction 979 << " average variables per function.\n" 980 << " " << MaxUninitAnalysisVariablesPerFunction 981 << " max variables per function.\n" 982 << " " << NumUninitAnalysisBlockVisits << " block visits.\n" 983 << " " << AvgUninitBlockVisitsPerFunction 984 << " average block visits per function.\n" 985 << " " << MaxUninitAnalysisBlockVisitsPerFunction 986 << " max block visits per function.\n"; 987} 988