SemaChecking.cpp revision 5cf86ba6b5a724bf91cb52feade1158f1fbeb605
1//===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file implements extra semantic analysis beyond what is enforced
11//  by the C type system.
12//
13//===----------------------------------------------------------------------===//
14
15#include "Sema.h"
16#include "clang/Analysis/Analyses/PrintfFormatString.h"
17#include "clang/AST/ASTContext.h"
18#include "clang/AST/CharUnits.h"
19#include "clang/AST/DeclObjC.h"
20#include "clang/AST/ExprCXX.h"
21#include "clang/AST/ExprObjC.h"
22#include "clang/AST/DeclObjC.h"
23#include "clang/AST/StmtCXX.h"
24#include "clang/AST/StmtObjC.h"
25#include "clang/Lex/LiteralSupport.h"
26#include "clang/Lex/Preprocessor.h"
27#include "llvm/ADT/BitVector.h"
28#include "llvm/ADT/STLExtras.h"
29#include "clang/Basic/TargetBuiltins.h"
30#include <limits>
31using namespace clang;
32
33/// getLocationOfStringLiteralByte - Return a source location that points to the
34/// specified byte of the specified string literal.
35///
36/// Strings are amazingly complex.  They can be formed from multiple tokens and
37/// can have escape sequences in them in addition to the usual trigraph and
38/// escaped newline business.  This routine handles this complexity.
39///
40SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
41                                                    unsigned ByteNo) const {
42  assert(!SL->isWide() && "This doesn't work for wide strings yet");
43
44  // Loop over all of the tokens in this string until we find the one that
45  // contains the byte we're looking for.
46  unsigned TokNo = 0;
47  while (1) {
48    assert(TokNo < SL->getNumConcatenated() && "Invalid byte number!");
49    SourceLocation StrTokLoc = SL->getStrTokenLoc(TokNo);
50
51    // Get the spelling of the string so that we can get the data that makes up
52    // the string literal, not the identifier for the macro it is potentially
53    // expanded through.
54    SourceLocation StrTokSpellingLoc = SourceMgr.getSpellingLoc(StrTokLoc);
55
56    // Re-lex the token to get its length and original spelling.
57    std::pair<FileID, unsigned> LocInfo =
58      SourceMgr.getDecomposedLoc(StrTokSpellingLoc);
59    bool Invalid = false;
60    llvm::StringRef Buffer = SourceMgr.getBufferData(LocInfo.first, &Invalid);
61    if (Invalid)
62      return StrTokSpellingLoc;
63
64    const char *StrData = Buffer.data()+LocInfo.second;
65
66    // Create a langops struct and enable trigraphs.  This is sufficient for
67    // relexing tokens.
68    LangOptions LangOpts;
69    LangOpts.Trigraphs = true;
70
71    // Create a lexer starting at the beginning of this token.
72    Lexer TheLexer(StrTokSpellingLoc, LangOpts, Buffer.begin(), StrData,
73                   Buffer.end());
74    Token TheTok;
75    TheLexer.LexFromRawLexer(TheTok);
76
77    // Use the StringLiteralParser to compute the length of the string in bytes.
78    StringLiteralParser SLP(&TheTok, 1, PP);
79    unsigned TokNumBytes = SLP.GetStringLength();
80
81    // If the byte is in this token, return the location of the byte.
82    if (ByteNo < TokNumBytes ||
83        (ByteNo == TokNumBytes && TokNo == SL->getNumConcatenated())) {
84      unsigned Offset =
85        StringLiteralParser::getOffsetOfStringByte(TheTok, ByteNo, PP);
86
87      // Now that we know the offset of the token in the spelling, use the
88      // preprocessor to get the offset in the original source.
89      return PP.AdvanceToTokenCharacter(StrTokLoc, Offset);
90    }
91
92    // Move to the next string token.
93    ++TokNo;
94    ByteNo -= TokNumBytes;
95  }
96}
97
98/// CheckablePrintfAttr - does a function call have a "printf" attribute
99/// and arguments that merit checking?
100bool Sema::CheckablePrintfAttr(const FormatAttr *Format, CallExpr *TheCall) {
101  if (Format->getType() == "printf") return true;
102  if (Format->getType() == "printf0") {
103    // printf0 allows null "format" string; if so don't check format/args
104    unsigned format_idx = Format->getFormatIdx() - 1;
105    // Does the index refer to the implicit object argument?
106    if (isa<CXXMemberCallExpr>(TheCall)) {
107      if (format_idx == 0)
108        return false;
109      --format_idx;
110    }
111    if (format_idx < TheCall->getNumArgs()) {
112      Expr *Format = TheCall->getArg(format_idx)->IgnoreParenCasts();
113      if (!Format->isNullPointerConstant(Context,
114                                         Expr::NPC_ValueDependentIsNull))
115        return true;
116    }
117  }
118  return false;
119}
120
121Action::OwningExprResult
122Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
123  OwningExprResult TheCallResult(Owned(TheCall));
124
125  switch (BuiltinID) {
126  case Builtin::BI__builtin___CFStringMakeConstantString:
127    assert(TheCall->getNumArgs() == 1 &&
128           "Wrong # arguments to builtin CFStringMakeConstantString");
129    if (CheckObjCString(TheCall->getArg(0)))
130      return ExprError();
131    break;
132  case Builtin::BI__builtin_stdarg_start:
133  case Builtin::BI__builtin_va_start:
134    if (SemaBuiltinVAStart(TheCall))
135      return ExprError();
136    break;
137  case Builtin::BI__builtin_isgreater:
138  case Builtin::BI__builtin_isgreaterequal:
139  case Builtin::BI__builtin_isless:
140  case Builtin::BI__builtin_islessequal:
141  case Builtin::BI__builtin_islessgreater:
142  case Builtin::BI__builtin_isunordered:
143    if (SemaBuiltinUnorderedCompare(TheCall))
144      return ExprError();
145    break;
146  case Builtin::BI__builtin_fpclassify:
147    if (SemaBuiltinFPClassification(TheCall, 6))
148      return ExprError();
149    break;
150  case Builtin::BI__builtin_isfinite:
151  case Builtin::BI__builtin_isinf:
152  case Builtin::BI__builtin_isinf_sign:
153  case Builtin::BI__builtin_isnan:
154  case Builtin::BI__builtin_isnormal:
155    if (SemaBuiltinFPClassification(TheCall, 1))
156      return ExprError();
157    break;
158  case Builtin::BI__builtin_return_address:
159  case Builtin::BI__builtin_frame_address: {
160    llvm::APSInt Result;
161    if (SemaBuiltinConstantArg(TheCall, 0, Result))
162      return ExprError();
163    break;
164  }
165  case Builtin::BI__builtin_eh_return_data_regno: {
166    llvm::APSInt Result;
167    if (SemaBuiltinConstantArg(TheCall, 0, Result))
168      return ExprError();
169    break;
170  }
171  case Builtin::BI__builtin_shufflevector:
172    return SemaBuiltinShuffleVector(TheCall);
173    // TheCall will be freed by the smart pointer here, but that's fine, since
174    // SemaBuiltinShuffleVector guts it, but then doesn't release it.
175  case Builtin::BI__builtin_prefetch:
176    if (SemaBuiltinPrefetch(TheCall))
177      return ExprError();
178    break;
179  case Builtin::BI__builtin_object_size:
180    if (SemaBuiltinObjectSize(TheCall))
181      return ExprError();
182    break;
183  case Builtin::BI__builtin_longjmp:
184    if (SemaBuiltinLongjmp(TheCall))
185      return ExprError();
186    break;
187  case Builtin::BI__sync_fetch_and_add:
188  case Builtin::BI__sync_fetch_and_sub:
189  case Builtin::BI__sync_fetch_and_or:
190  case Builtin::BI__sync_fetch_and_and:
191  case Builtin::BI__sync_fetch_and_xor:
192  case Builtin::BI__sync_add_and_fetch:
193  case Builtin::BI__sync_sub_and_fetch:
194  case Builtin::BI__sync_and_and_fetch:
195  case Builtin::BI__sync_or_and_fetch:
196  case Builtin::BI__sync_xor_and_fetch:
197  case Builtin::BI__sync_val_compare_and_swap:
198  case Builtin::BI__sync_bool_compare_and_swap:
199  case Builtin::BI__sync_lock_test_and_set:
200  case Builtin::BI__sync_lock_release:
201    if (SemaBuiltinAtomicOverloaded(TheCall))
202      return ExprError();
203    break;
204
205  // Target specific builtins start here.
206  case X86::BI__builtin_ia32_palignr128:
207  case X86::BI__builtin_ia32_palignr: {
208    llvm::APSInt Result;
209    if (SemaBuiltinConstantArg(TheCall, 2, Result))
210      return ExprError();
211    break;
212  }
213  }
214
215  return move(TheCallResult);
216}
217
218/// CheckFunctionCall - Check a direct function call for various correctness
219/// and safety properties not strictly enforced by the C type system.
220bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall) {
221  // Get the IdentifierInfo* for the called function.
222  IdentifierInfo *FnInfo = FDecl->getIdentifier();
223
224  // None of the checks below are needed for functions that don't have
225  // simple names (e.g., C++ conversion functions).
226  if (!FnInfo)
227    return false;
228
229  // FIXME: This mechanism should be abstracted to be less fragile and
230  // more efficient. For example, just map function ids to custom
231  // handlers.
232
233  // Printf checking.
234  if (const FormatAttr *Format = FDecl->getAttr<FormatAttr>()) {
235    if (CheckablePrintfAttr(Format, TheCall)) {
236      bool HasVAListArg = Format->getFirstArg() == 0;
237      CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
238                           HasVAListArg ? 0 : Format->getFirstArg() - 1);
239    }
240  }
241
242  for (const NonNullAttr *NonNull = FDecl->getAttr<NonNullAttr>(); NonNull;
243       NonNull = NonNull->getNext<NonNullAttr>())
244    CheckNonNullArguments(NonNull, TheCall);
245
246  return false;
247}
248
249bool Sema::CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall) {
250  // Printf checking.
251  const FormatAttr *Format = NDecl->getAttr<FormatAttr>();
252  if (!Format)
253    return false;
254
255  const VarDecl *V = dyn_cast<VarDecl>(NDecl);
256  if (!V)
257    return false;
258
259  QualType Ty = V->getType();
260  if (!Ty->isBlockPointerType())
261    return false;
262
263  if (!CheckablePrintfAttr(Format, TheCall))
264    return false;
265
266  bool HasVAListArg = Format->getFirstArg() == 0;
267  CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
268                       HasVAListArg ? 0 : Format->getFirstArg() - 1);
269
270  return false;
271}
272
273/// SemaBuiltinAtomicOverloaded - We have a call to a function like
274/// __sync_fetch_and_add, which is an overloaded function based on the pointer
275/// type of its first argument.  The main ActOnCallExpr routines have already
276/// promoted the types of arguments because all of these calls are prototyped as
277/// void(...).
278///
279/// This function goes through and does final semantic checking for these
280/// builtins,
281bool Sema::SemaBuiltinAtomicOverloaded(CallExpr *TheCall) {
282  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
283  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
284
285  // Ensure that we have at least one argument to do type inference from.
286  if (TheCall->getNumArgs() < 1)
287    return Diag(TheCall->getLocEnd(),
288              diag::err_typecheck_call_too_few_args_at_least)
289              << 0 << 1 << TheCall->getNumArgs()
290              << TheCall->getCallee()->getSourceRange();
291
292  // Inspect the first argument of the atomic builtin.  This should always be
293  // a pointer type, whose element is an integral scalar or pointer type.
294  // Because it is a pointer type, we don't have to worry about any implicit
295  // casts here.
296  Expr *FirstArg = TheCall->getArg(0);
297  if (!FirstArg->getType()->isPointerType())
298    return Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
299             << FirstArg->getType() << FirstArg->getSourceRange();
300
301  QualType ValType = FirstArg->getType()->getAs<PointerType>()->getPointeeType();
302  if (!ValType->isIntegerType() && !ValType->isPointerType() &&
303      !ValType->isBlockPointerType())
304    return Diag(DRE->getLocStart(),
305                diag::err_atomic_builtin_must_be_pointer_intptr)
306             << FirstArg->getType() << FirstArg->getSourceRange();
307
308  // We need to figure out which concrete builtin this maps onto.  For example,
309  // __sync_fetch_and_add with a 2 byte object turns into
310  // __sync_fetch_and_add_2.
311#define BUILTIN_ROW(x) \
312  { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
313    Builtin::BI##x##_8, Builtin::BI##x##_16 }
314
315  static const unsigned BuiltinIndices[][5] = {
316    BUILTIN_ROW(__sync_fetch_and_add),
317    BUILTIN_ROW(__sync_fetch_and_sub),
318    BUILTIN_ROW(__sync_fetch_and_or),
319    BUILTIN_ROW(__sync_fetch_and_and),
320    BUILTIN_ROW(__sync_fetch_and_xor),
321
322    BUILTIN_ROW(__sync_add_and_fetch),
323    BUILTIN_ROW(__sync_sub_and_fetch),
324    BUILTIN_ROW(__sync_and_and_fetch),
325    BUILTIN_ROW(__sync_or_and_fetch),
326    BUILTIN_ROW(__sync_xor_and_fetch),
327
328    BUILTIN_ROW(__sync_val_compare_and_swap),
329    BUILTIN_ROW(__sync_bool_compare_and_swap),
330    BUILTIN_ROW(__sync_lock_test_and_set),
331    BUILTIN_ROW(__sync_lock_release)
332  };
333#undef BUILTIN_ROW
334
335  // Determine the index of the size.
336  unsigned SizeIndex;
337  switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
338  case 1: SizeIndex = 0; break;
339  case 2: SizeIndex = 1; break;
340  case 4: SizeIndex = 2; break;
341  case 8: SizeIndex = 3; break;
342  case 16: SizeIndex = 4; break;
343  default:
344    return Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
345             << FirstArg->getType() << FirstArg->getSourceRange();
346  }
347
348  // Each of these builtins has one pointer argument, followed by some number of
349  // values (0, 1 or 2) followed by a potentially empty varags list of stuff
350  // that we ignore.  Find out which row of BuiltinIndices to read from as well
351  // as the number of fixed args.
352  unsigned BuiltinID = FDecl->getBuiltinID();
353  unsigned BuiltinIndex, NumFixed = 1;
354  switch (BuiltinID) {
355  default: assert(0 && "Unknown overloaded atomic builtin!");
356  case Builtin::BI__sync_fetch_and_add: BuiltinIndex = 0; break;
357  case Builtin::BI__sync_fetch_and_sub: BuiltinIndex = 1; break;
358  case Builtin::BI__sync_fetch_and_or:  BuiltinIndex = 2; break;
359  case Builtin::BI__sync_fetch_and_and: BuiltinIndex = 3; break;
360  case Builtin::BI__sync_fetch_and_xor: BuiltinIndex = 4; break;
361
362  case Builtin::BI__sync_add_and_fetch: BuiltinIndex = 5; break;
363  case Builtin::BI__sync_sub_and_fetch: BuiltinIndex = 6; break;
364  case Builtin::BI__sync_and_and_fetch: BuiltinIndex = 7; break;
365  case Builtin::BI__sync_or_and_fetch:  BuiltinIndex = 8; break;
366  case Builtin::BI__sync_xor_and_fetch: BuiltinIndex = 9; break;
367
368  case Builtin::BI__sync_val_compare_and_swap:
369    BuiltinIndex = 10;
370    NumFixed = 2;
371    break;
372  case Builtin::BI__sync_bool_compare_and_swap:
373    BuiltinIndex = 11;
374    NumFixed = 2;
375    break;
376  case Builtin::BI__sync_lock_test_and_set: BuiltinIndex = 12; break;
377  case Builtin::BI__sync_lock_release:
378    BuiltinIndex = 13;
379    NumFixed = 0;
380    break;
381  }
382
383  // Now that we know how many fixed arguments we expect, first check that we
384  // have at least that many.
385  if (TheCall->getNumArgs() < 1+NumFixed)
386    return Diag(TheCall->getLocEnd(),
387            diag::err_typecheck_call_too_few_args_at_least)
388            << 0 << 1+NumFixed << TheCall->getNumArgs()
389            << TheCall->getCallee()->getSourceRange();
390
391
392  // Get the decl for the concrete builtin from this, we can tell what the
393  // concrete integer type we should convert to is.
394  unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
395  const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
396  IdentifierInfo *NewBuiltinII = PP.getIdentifierInfo(NewBuiltinName);
397  FunctionDecl *NewBuiltinDecl =
398    cast<FunctionDecl>(LazilyCreateBuiltin(NewBuiltinII, NewBuiltinID,
399                                           TUScope, false, DRE->getLocStart()));
400  const FunctionProtoType *BuiltinFT =
401    NewBuiltinDecl->getType()->getAs<FunctionProtoType>();
402  ValType = BuiltinFT->getArgType(0)->getAs<PointerType>()->getPointeeType();
403
404  // If the first type needs to be converted (e.g. void** -> int*), do it now.
405  if (BuiltinFT->getArgType(0) != FirstArg->getType()) {
406    ImpCastExprToType(FirstArg, BuiltinFT->getArgType(0), CastExpr::CK_BitCast);
407    TheCall->setArg(0, FirstArg);
408  }
409
410  // Next, walk the valid ones promoting to the right type.
411  for (unsigned i = 0; i != NumFixed; ++i) {
412    Expr *Arg = TheCall->getArg(i+1);
413
414    // If the argument is an implicit cast, then there was a promotion due to
415    // "...", just remove it now.
416    if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
417      Arg = ICE->getSubExpr();
418      ICE->setSubExpr(0);
419      ICE->Destroy(Context);
420      TheCall->setArg(i+1, Arg);
421    }
422
423    // GCC does an implicit conversion to the pointer or integer ValType.  This
424    // can fail in some cases (1i -> int**), check for this error case now.
425    CastExpr::CastKind Kind = CastExpr::CK_Unknown;
426    CXXBaseSpecifierArray BasePath;
427    if (CheckCastTypes(Arg->getSourceRange(), ValType, Arg, Kind, BasePath))
428      return true;
429
430    // Okay, we have something that *can* be converted to the right type.  Check
431    // to see if there is a potentially weird extension going on here.  This can
432    // happen when you do an atomic operation on something like an char* and
433    // pass in 42.  The 42 gets converted to char.  This is even more strange
434    // for things like 45.123 -> char, etc.
435    // FIXME: Do this check.
436    ImpCastExprToType(Arg, ValType, Kind);
437    TheCall->setArg(i+1, Arg);
438  }
439
440  // Switch the DeclRefExpr to refer to the new decl.
441  DRE->setDecl(NewBuiltinDecl);
442  DRE->setType(NewBuiltinDecl->getType());
443
444  // Set the callee in the CallExpr.
445  // FIXME: This leaks the original parens and implicit casts.
446  Expr *PromotedCall = DRE;
447  UsualUnaryConversions(PromotedCall);
448  TheCall->setCallee(PromotedCall);
449
450
451  // Change the result type of the call to match the result type of the decl.
452  TheCall->setType(NewBuiltinDecl->getResultType());
453  return false;
454}
455
456
457/// CheckObjCString - Checks that the argument to the builtin
458/// CFString constructor is correct
459/// FIXME: GCC currently emits the following warning:
460/// "warning: input conversion stopped due to an input byte that does not
461///           belong to the input codeset UTF-8"
462/// Note: It might also make sense to do the UTF-16 conversion here (would
463/// simplify the backend).
464bool Sema::CheckObjCString(Expr *Arg) {
465  Arg = Arg->IgnoreParenCasts();
466  StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
467
468  if (!Literal || Literal->isWide()) {
469    Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
470      << Arg->getSourceRange();
471    return true;
472  }
473
474  const char *Data = Literal->getStrData();
475  unsigned Length = Literal->getByteLength();
476
477  for (unsigned i = 0; i < Length; ++i) {
478    if (!Data[i]) {
479      Diag(getLocationOfStringLiteralByte(Literal, i),
480           diag::warn_cfstring_literal_contains_nul_character)
481        << Arg->getSourceRange();
482      break;
483    }
484  }
485
486  return false;
487}
488
489/// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
490/// Emit an error and return true on failure, return false on success.
491bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
492  Expr *Fn = TheCall->getCallee();
493  if (TheCall->getNumArgs() > 2) {
494    Diag(TheCall->getArg(2)->getLocStart(),
495         diag::err_typecheck_call_too_many_args)
496      << 0 /*function call*/ << 2 << TheCall->getNumArgs()
497      << Fn->getSourceRange()
498      << SourceRange(TheCall->getArg(2)->getLocStart(),
499                     (*(TheCall->arg_end()-1))->getLocEnd());
500    return true;
501  }
502
503  if (TheCall->getNumArgs() < 2) {
504    return Diag(TheCall->getLocEnd(),
505      diag::err_typecheck_call_too_few_args_at_least)
506      << 0 /*function call*/ << 2 << TheCall->getNumArgs();
507  }
508
509  // Determine whether the current function is variadic or not.
510  BlockScopeInfo *CurBlock = getCurBlock();
511  bool isVariadic;
512  if (CurBlock)
513    isVariadic = CurBlock->isVariadic;
514  else if (getCurFunctionDecl()) {
515    if (FunctionProtoType* FTP =
516            dyn_cast<FunctionProtoType>(getCurFunctionDecl()->getType()))
517      isVariadic = FTP->isVariadic();
518    else
519      isVariadic = false;
520  } else {
521    isVariadic = getCurMethodDecl()->isVariadic();
522  }
523
524  if (!isVariadic) {
525    Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
526    return true;
527  }
528
529  // Verify that the second argument to the builtin is the last argument of the
530  // current function or method.
531  bool SecondArgIsLastNamedArgument = false;
532  const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
533
534  if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
535    if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
536      // FIXME: This isn't correct for methods (results in bogus warning).
537      // Get the last formal in the current function.
538      const ParmVarDecl *LastArg;
539      if (CurBlock)
540        LastArg = *(CurBlock->TheDecl->param_end()-1);
541      else if (FunctionDecl *FD = getCurFunctionDecl())
542        LastArg = *(FD->param_end()-1);
543      else
544        LastArg = *(getCurMethodDecl()->param_end()-1);
545      SecondArgIsLastNamedArgument = PV == LastArg;
546    }
547  }
548
549  if (!SecondArgIsLastNamedArgument)
550    Diag(TheCall->getArg(1)->getLocStart(),
551         diag::warn_second_parameter_of_va_start_not_last_named_argument);
552  return false;
553}
554
555/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
556/// friends.  This is declared to take (...), so we have to check everything.
557bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
558  if (TheCall->getNumArgs() < 2)
559    return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
560      << 0 << 2 << TheCall->getNumArgs()/*function call*/;
561  if (TheCall->getNumArgs() > 2)
562    return Diag(TheCall->getArg(2)->getLocStart(),
563                diag::err_typecheck_call_too_many_args)
564      << 0 /*function call*/ << 2 << TheCall->getNumArgs()
565      << SourceRange(TheCall->getArg(2)->getLocStart(),
566                     (*(TheCall->arg_end()-1))->getLocEnd());
567
568  Expr *OrigArg0 = TheCall->getArg(0);
569  Expr *OrigArg1 = TheCall->getArg(1);
570
571  // Do standard promotions between the two arguments, returning their common
572  // type.
573  QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
574
575  // Make sure any conversions are pushed back into the call; this is
576  // type safe since unordered compare builtins are declared as "_Bool
577  // foo(...)".
578  TheCall->setArg(0, OrigArg0);
579  TheCall->setArg(1, OrigArg1);
580
581  if (OrigArg0->isTypeDependent() || OrigArg1->isTypeDependent())
582    return false;
583
584  // If the common type isn't a real floating type, then the arguments were
585  // invalid for this operation.
586  if (!Res->isRealFloatingType())
587    return Diag(OrigArg0->getLocStart(),
588                diag::err_typecheck_call_invalid_ordered_compare)
589      << OrigArg0->getType() << OrigArg1->getType()
590      << SourceRange(OrigArg0->getLocStart(), OrigArg1->getLocEnd());
591
592  return false;
593}
594
595/// SemaBuiltinSemaBuiltinFPClassification - Handle functions like
596/// __builtin_isnan and friends.  This is declared to take (...), so we have
597/// to check everything. We expect the last argument to be a floating point
598/// value.
599bool Sema::SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs) {
600  if (TheCall->getNumArgs() < NumArgs)
601    return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
602      << 0 << NumArgs << TheCall->getNumArgs()/*function call*/;
603  if (TheCall->getNumArgs() > NumArgs)
604    return Diag(TheCall->getArg(NumArgs)->getLocStart(),
605                diag::err_typecheck_call_too_many_args)
606      << 0 /*function call*/ << NumArgs << TheCall->getNumArgs()
607      << SourceRange(TheCall->getArg(NumArgs)->getLocStart(),
608                     (*(TheCall->arg_end()-1))->getLocEnd());
609
610  Expr *OrigArg = TheCall->getArg(NumArgs-1);
611
612  if (OrigArg->isTypeDependent())
613    return false;
614
615  // This operation requires a floating-point number
616  if (!OrigArg->getType()->isRealFloatingType())
617    return Diag(OrigArg->getLocStart(),
618                diag::err_typecheck_call_invalid_unary_fp)
619      << OrigArg->getType() << OrigArg->getSourceRange();
620
621  return false;
622}
623
624/// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
625// This is declared to take (...), so we have to check everything.
626Action::OwningExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) {
627  if (TheCall->getNumArgs() < 3)
628    return ExprError(Diag(TheCall->getLocEnd(),
629                          diag::err_typecheck_call_too_few_args_at_least)
630      << 0 /*function call*/ << 3 << TheCall->getNumArgs()
631      << TheCall->getSourceRange());
632
633  unsigned numElements = std::numeric_limits<unsigned>::max();
634  if (!TheCall->getArg(0)->isTypeDependent() &&
635      !TheCall->getArg(1)->isTypeDependent()) {
636    QualType FAType = TheCall->getArg(0)->getType();
637    QualType SAType = TheCall->getArg(1)->getType();
638
639    if (!FAType->isVectorType() || !SAType->isVectorType()) {
640      Diag(TheCall->getLocStart(), diag::err_shufflevector_non_vector)
641        << SourceRange(TheCall->getArg(0)->getLocStart(),
642                       TheCall->getArg(1)->getLocEnd());
643      return ExprError();
644    }
645
646    if (!Context.hasSameUnqualifiedType(FAType, SAType)) {
647      Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
648        << SourceRange(TheCall->getArg(0)->getLocStart(),
649                       TheCall->getArg(1)->getLocEnd());
650      return ExprError();
651    }
652
653    numElements = FAType->getAs<VectorType>()->getNumElements();
654    if (TheCall->getNumArgs() != numElements+2) {
655      if (TheCall->getNumArgs() < numElements+2)
656        return ExprError(Diag(TheCall->getLocEnd(),
657                              diag::err_typecheck_call_too_few_args)
658                 << 0 /*function call*/
659                 << numElements+2 << TheCall->getNumArgs()
660                 << TheCall->getSourceRange());
661      return ExprError(Diag(TheCall->getLocEnd(),
662                            diag::err_typecheck_call_too_many_args)
663                 << 0 /*function call*/
664                 << numElements+2 << TheCall->getNumArgs()
665                 << TheCall->getSourceRange());
666    }
667  }
668
669  for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
670    if (TheCall->getArg(i)->isTypeDependent() ||
671        TheCall->getArg(i)->isValueDependent())
672      continue;
673
674    llvm::APSInt Result;
675    if (SemaBuiltinConstantArg(TheCall, i, Result))
676      return ExprError();
677
678    if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
679      return ExprError(Diag(TheCall->getLocStart(),
680                  diag::err_shufflevector_argument_too_large)
681               << TheCall->getArg(i)->getSourceRange());
682  }
683
684  llvm::SmallVector<Expr*, 32> exprs;
685
686  for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
687    exprs.push_back(TheCall->getArg(i));
688    TheCall->setArg(i, 0);
689  }
690
691  return Owned(new (Context) ShuffleVectorExpr(Context, exprs.begin(),
692                                            exprs.size(), exprs[0]->getType(),
693                                            TheCall->getCallee()->getLocStart(),
694                                            TheCall->getRParenLoc()));
695}
696
697/// SemaBuiltinPrefetch - Handle __builtin_prefetch.
698// This is declared to take (const void*, ...) and can take two
699// optional constant int args.
700bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
701  unsigned NumArgs = TheCall->getNumArgs();
702
703  if (NumArgs > 3)
704    return Diag(TheCall->getLocEnd(),
705             diag::err_typecheck_call_too_many_args_at_most)
706             << 0 /*function call*/ << 3 << NumArgs
707             << TheCall->getSourceRange();
708
709  // Argument 0 is checked for us and the remaining arguments must be
710  // constant integers.
711  for (unsigned i = 1; i != NumArgs; ++i) {
712    Expr *Arg = TheCall->getArg(i);
713
714    llvm::APSInt Result;
715    if (SemaBuiltinConstantArg(TheCall, i, Result))
716      return true;
717
718    // FIXME: gcc issues a warning and rewrites these to 0. These
719    // seems especially odd for the third argument since the default
720    // is 3.
721    if (i == 1) {
722      if (Result.getLimitedValue() > 1)
723        return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
724             << "0" << "1" << Arg->getSourceRange();
725    } else {
726      if (Result.getLimitedValue() > 3)
727        return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
728            << "0" << "3" << Arg->getSourceRange();
729    }
730  }
731
732  return false;
733}
734
735/// SemaBuiltinConstantArg - Handle a check if argument ArgNum of CallExpr
736/// TheCall is a constant expression.
737bool Sema::SemaBuiltinConstantArg(CallExpr *TheCall, int ArgNum,
738                                  llvm::APSInt &Result) {
739  Expr *Arg = TheCall->getArg(ArgNum);
740  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
741  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
742
743  if (Arg->isTypeDependent() || Arg->isValueDependent()) return false;
744
745  if (!Arg->isIntegerConstantExpr(Result, Context))
746    return Diag(TheCall->getLocStart(), diag::err_constant_integer_arg_type)
747                << FDecl->getDeclName() <<  Arg->getSourceRange();
748
749  return false;
750}
751
752/// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
753/// int type). This simply type checks that type is one of the defined
754/// constants (0-3).
755// For compatability check 0-3, llvm only handles 0 and 2.
756bool Sema::SemaBuiltinObjectSize(CallExpr *TheCall) {
757  llvm::APSInt Result;
758
759  // Check constant-ness first.
760  if (SemaBuiltinConstantArg(TheCall, 1, Result))
761    return true;
762
763  Expr *Arg = TheCall->getArg(1);
764  if (Result.getSExtValue() < 0 || Result.getSExtValue() > 3) {
765    return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
766             << "0" << "3" << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
767  }
768
769  return false;
770}
771
772/// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
773/// This checks that val is a constant 1.
774bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
775  Expr *Arg = TheCall->getArg(1);
776  llvm::APSInt Result;
777
778  // TODO: This is less than ideal. Overload this to take a value.
779  if (SemaBuiltinConstantArg(TheCall, 1, Result))
780    return true;
781
782  if (Result != 1)
783    return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
784             << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
785
786  return false;
787}
788
789// Handle i > 1 ? "x" : "y", recursivelly
790bool Sema::SemaCheckStringLiteral(const Expr *E, const CallExpr *TheCall,
791                                  bool HasVAListArg,
792                                  unsigned format_idx, unsigned firstDataArg) {
793  if (E->isTypeDependent() || E->isValueDependent())
794    return false;
795
796  switch (E->getStmtClass()) {
797  case Stmt::ConditionalOperatorClass: {
798    const ConditionalOperator *C = cast<ConditionalOperator>(E);
799    return SemaCheckStringLiteral(C->getTrueExpr(), TheCall,
800                                  HasVAListArg, format_idx, firstDataArg)
801        && SemaCheckStringLiteral(C->getRHS(), TheCall,
802                                  HasVAListArg, format_idx, firstDataArg);
803  }
804
805  case Stmt::ImplicitCastExprClass: {
806    const ImplicitCastExpr *Expr = cast<ImplicitCastExpr>(E);
807    return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
808                                  format_idx, firstDataArg);
809  }
810
811  case Stmt::ParenExprClass: {
812    const ParenExpr *Expr = cast<ParenExpr>(E);
813    return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
814                                  format_idx, firstDataArg);
815  }
816
817  case Stmt::DeclRefExprClass: {
818    const DeclRefExpr *DR = cast<DeclRefExpr>(E);
819
820    // As an exception, do not flag errors for variables binding to
821    // const string literals.
822    if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
823      bool isConstant = false;
824      QualType T = DR->getType();
825
826      if (const ArrayType *AT = Context.getAsArrayType(T)) {
827        isConstant = AT->getElementType().isConstant(Context);
828      } else if (const PointerType *PT = T->getAs<PointerType>()) {
829        isConstant = T.isConstant(Context) &&
830                     PT->getPointeeType().isConstant(Context);
831      }
832
833      if (isConstant) {
834        if (const Expr *Init = VD->getAnyInitializer())
835          return SemaCheckStringLiteral(Init, TheCall,
836                                        HasVAListArg, format_idx, firstDataArg);
837      }
838
839      // For vprintf* functions (i.e., HasVAListArg==true), we add a
840      // special check to see if the format string is a function parameter
841      // of the function calling the printf function.  If the function
842      // has an attribute indicating it is a printf-like function, then we
843      // should suppress warnings concerning non-literals being used in a call
844      // to a vprintf function.  For example:
845      //
846      // void
847      // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
848      //      va_list ap;
849      //      va_start(ap, fmt);
850      //      vprintf(fmt, ap);  // Do NOT emit a warning about "fmt".
851      //      ...
852      //
853      //
854      //  FIXME: We don't have full attribute support yet, so just check to see
855      //    if the argument is a DeclRefExpr that references a parameter.  We'll
856      //    add proper support for checking the attribute later.
857      if (HasVAListArg)
858        if (isa<ParmVarDecl>(VD))
859          return true;
860    }
861
862    return false;
863  }
864
865  case Stmt::CallExprClass: {
866    const CallExpr *CE = cast<CallExpr>(E);
867    if (const ImplicitCastExpr *ICE
868          = dyn_cast<ImplicitCastExpr>(CE->getCallee())) {
869      if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ICE->getSubExpr())) {
870        if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(DRE->getDecl())) {
871          if (const FormatArgAttr *FA = FD->getAttr<FormatArgAttr>()) {
872            unsigned ArgIndex = FA->getFormatIdx();
873            const Expr *Arg = CE->getArg(ArgIndex - 1);
874
875            return SemaCheckStringLiteral(Arg, TheCall, HasVAListArg,
876                                          format_idx, firstDataArg);
877          }
878        }
879      }
880    }
881
882    return false;
883  }
884  case Stmt::ObjCStringLiteralClass:
885  case Stmt::StringLiteralClass: {
886    const StringLiteral *StrE = NULL;
887
888    if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
889      StrE = ObjCFExpr->getString();
890    else
891      StrE = cast<StringLiteral>(E);
892
893    if (StrE) {
894      CheckPrintfString(StrE, E, TheCall, HasVAListArg, format_idx,
895                        firstDataArg);
896      return true;
897    }
898
899    return false;
900  }
901
902  default:
903    return false;
904  }
905}
906
907void
908Sema::CheckNonNullArguments(const NonNullAttr *NonNull,
909                            const CallExpr *TheCall) {
910  for (NonNullAttr::iterator i = NonNull->begin(), e = NonNull->end();
911       i != e; ++i) {
912    const Expr *ArgExpr = TheCall->getArg(*i);
913    if (ArgExpr->isNullPointerConstant(Context,
914                                       Expr::NPC_ValueDependentIsNotNull))
915      Diag(TheCall->getCallee()->getLocStart(), diag::warn_null_arg)
916        << ArgExpr->getSourceRange();
917  }
918}
919
920/// CheckPrintfArguments - Check calls to printf (and similar functions) for
921/// correct use of format strings.
922///
923///  HasVAListArg - A predicate indicating whether the printf-like
924///    function is passed an explicit va_arg argument (e.g., vprintf)
925///
926///  format_idx - The index into Args for the format string.
927///
928/// Improper format strings to functions in the printf family can be
929/// the source of bizarre bugs and very serious security holes.  A
930/// good source of information is available in the following paper
931/// (which includes additional references):
932///
933///  FormatGuard: Automatic Protection From printf Format String
934///  Vulnerabilities, Proceedings of the 10th USENIX Security Symposium, 2001.
935///
936/// TODO:
937/// Functionality implemented:
938///
939///  We can statically check the following properties for string
940///  literal format strings for non v.*printf functions (where the
941///  arguments are passed directly):
942//
943///  (1) Are the number of format conversions equal to the number of
944///      data arguments?
945///
946///  (2) Does each format conversion correctly match the type of the
947///      corresponding data argument?
948///
949/// Moreover, for all printf functions we can:
950///
951///  (3) Check for a missing format string (when not caught by type checking).
952///
953///  (4) Check for no-operation flags; e.g. using "#" with format
954///      conversion 'c'  (TODO)
955///
956///  (5) Check the use of '%n', a major source of security holes.
957///
958///  (6) Check for malformed format conversions that don't specify anything.
959///
960///  (7) Check for empty format strings.  e.g: printf("");
961///
962///  (8) Check that the format string is a wide literal.
963///
964/// All of these checks can be done by parsing the format string.
965///
966void
967Sema::CheckPrintfArguments(const CallExpr *TheCall, bool HasVAListArg,
968                           unsigned format_idx, unsigned firstDataArg) {
969  const Expr *Fn = TheCall->getCallee();
970
971  // The way the format attribute works in GCC, the implicit this argument
972  // of member functions is counted. However, it doesn't appear in our own
973  // lists, so decrement format_idx in that case.
974  if (isa<CXXMemberCallExpr>(TheCall)) {
975    // Catch a format attribute mistakenly referring to the object argument.
976    if (format_idx == 0)
977      return;
978    --format_idx;
979    if(firstDataArg != 0)
980      --firstDataArg;
981  }
982
983  // CHECK: printf-like function is called with no format string.
984  if (format_idx >= TheCall->getNumArgs()) {
985    Diag(TheCall->getRParenLoc(), diag::warn_printf_missing_format_string)
986      << Fn->getSourceRange();
987    return;
988  }
989
990  const Expr *OrigFormatExpr = TheCall->getArg(format_idx)->IgnoreParenCasts();
991
992  // CHECK: format string is not a string literal.
993  //
994  // Dynamically generated format strings are difficult to
995  // automatically vet at compile time.  Requiring that format strings
996  // are string literals: (1) permits the checking of format strings by
997  // the compiler and thereby (2) can practically remove the source of
998  // many format string exploits.
999
1000  // Format string can be either ObjC string (e.g. @"%d") or
1001  // C string (e.g. "%d")
1002  // ObjC string uses the same format specifiers as C string, so we can use
1003  // the same format string checking logic for both ObjC and C strings.
1004  if (SemaCheckStringLiteral(OrigFormatExpr, TheCall, HasVAListArg, format_idx,
1005                             firstDataArg))
1006    return;  // Literal format string found, check done!
1007
1008  // If there are no arguments specified, warn with -Wformat-security, otherwise
1009  // warn only with -Wformat-nonliteral.
1010  if (TheCall->getNumArgs() == format_idx+1)
1011    Diag(TheCall->getArg(format_idx)->getLocStart(),
1012         diag::warn_printf_nonliteral_noargs)
1013      << OrigFormatExpr->getSourceRange();
1014  else
1015    Diag(TheCall->getArg(format_idx)->getLocStart(),
1016         diag::warn_printf_nonliteral)
1017           << OrigFormatExpr->getSourceRange();
1018}
1019
1020namespace {
1021class CheckPrintfHandler : public analyze_printf::FormatStringHandler {
1022  Sema &S;
1023  const StringLiteral *FExpr;
1024  const Expr *OrigFormatExpr;
1025  const unsigned FirstDataArg;
1026  const unsigned NumDataArgs;
1027  const bool IsObjCLiteral;
1028  const char *Beg; // Start of format string.
1029  const bool HasVAListArg;
1030  const CallExpr *TheCall;
1031  unsigned FormatIdx;
1032  llvm::BitVector CoveredArgs;
1033  bool usesPositionalArgs;
1034  bool atFirstArg;
1035public:
1036  CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
1037                     const Expr *origFormatExpr, unsigned firstDataArg,
1038                     unsigned numDataArgs, bool isObjCLiteral,
1039                     const char *beg, bool hasVAListArg,
1040                     const CallExpr *theCall, unsigned formatIdx)
1041    : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
1042      FirstDataArg(firstDataArg),
1043      NumDataArgs(numDataArgs),
1044      IsObjCLiteral(isObjCLiteral), Beg(beg),
1045      HasVAListArg(hasVAListArg),
1046      TheCall(theCall), FormatIdx(formatIdx),
1047      usesPositionalArgs(false), atFirstArg(true) {
1048        CoveredArgs.resize(numDataArgs);
1049        CoveredArgs.reset();
1050      }
1051
1052  void DoneProcessing();
1053
1054  void HandleIncompleteFormatSpecifier(const char *startSpecifier,
1055                                       unsigned specifierLen);
1056
1057  bool
1058  HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1059                                   const char *startSpecifier,
1060                                   unsigned specifierLen);
1061
1062  virtual void HandleInvalidPosition(const char *startSpecifier,
1063                                     unsigned specifierLen,
1064                                     analyze_printf::PositionContext p);
1065
1066  virtual void HandleZeroPosition(const char *startPos, unsigned posLen);
1067
1068  void HandleNullChar(const char *nullCharacter);
1069
1070  bool HandleFormatSpecifier(const analyze_printf::FormatSpecifier &FS,
1071                             const char *startSpecifier,
1072                             unsigned specifierLen);
1073private:
1074  SourceRange getFormatStringRange();
1075  SourceRange getFormatSpecifierRange(const char *startSpecifier,
1076                                      unsigned specifierLen);
1077  SourceLocation getLocationOfByte(const char *x);
1078
1079  bool HandleAmount(const analyze_printf::OptionalAmount &Amt, unsigned k,
1080                    const char *startSpecifier, unsigned specifierLen);
1081  void HandleFlags(const analyze_printf::FormatSpecifier &FS,
1082                   llvm::StringRef flag, llvm::StringRef cspec,
1083                   const char *startSpecifier, unsigned specifierLen);
1084
1085  const Expr *getDataArg(unsigned i) const;
1086};
1087}
1088
1089SourceRange CheckPrintfHandler::getFormatStringRange() {
1090  return OrigFormatExpr->getSourceRange();
1091}
1092
1093SourceRange CheckPrintfHandler::
1094getFormatSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
1095  return SourceRange(getLocationOfByte(startSpecifier),
1096                     getLocationOfByte(startSpecifier+specifierLen-1));
1097}
1098
1099SourceLocation CheckPrintfHandler::getLocationOfByte(const char *x) {
1100  return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
1101}
1102
1103void CheckPrintfHandler::
1104HandleIncompleteFormatSpecifier(const char *startSpecifier,
1105                                unsigned specifierLen) {
1106  SourceLocation Loc = getLocationOfByte(startSpecifier);
1107  S.Diag(Loc, diag::warn_printf_incomplete_specifier)
1108    << getFormatSpecifierRange(startSpecifier, specifierLen);
1109}
1110
1111void
1112CheckPrintfHandler::HandleInvalidPosition(const char *startPos, unsigned posLen,
1113                                          analyze_printf::PositionContext p) {
1114  SourceLocation Loc = getLocationOfByte(startPos);
1115  S.Diag(Loc, diag::warn_printf_invalid_positional_specifier)
1116    << (unsigned) p << getFormatSpecifierRange(startPos, posLen);
1117}
1118
1119void CheckPrintfHandler::HandleZeroPosition(const char *startPos,
1120                                            unsigned posLen) {
1121  SourceLocation Loc = getLocationOfByte(startPos);
1122  S.Diag(Loc, diag::warn_printf_zero_positional_specifier)
1123    << getFormatSpecifierRange(startPos, posLen);
1124}
1125
1126bool CheckPrintfHandler::
1127HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1128                                 const char *startSpecifier,
1129                                 unsigned specifierLen) {
1130
1131  unsigned argIndex = FS.getArgIndex();
1132  bool keepGoing = true;
1133  if (argIndex < NumDataArgs) {
1134    // Consider the argument coverered, even though the specifier doesn't
1135    // make sense.
1136    CoveredArgs.set(argIndex);
1137  }
1138  else {
1139    // If argIndex exceeds the number of data arguments we
1140    // don't issue a warning because that is just a cascade of warnings (and
1141    // they may have intended '%%' anyway). We don't want to continue processing
1142    // the format string after this point, however, as we will like just get
1143    // gibberish when trying to match arguments.
1144    keepGoing = false;
1145  }
1146
1147  const analyze_printf::ConversionSpecifier &CS =
1148    FS.getConversionSpecifier();
1149  SourceLocation Loc = getLocationOfByte(CS.getStart());
1150  S.Diag(Loc, diag::warn_printf_invalid_conversion)
1151      << llvm::StringRef(CS.getStart(), CS.getLength())
1152      << getFormatSpecifierRange(startSpecifier, specifierLen);
1153
1154  return keepGoing;
1155}
1156
1157void CheckPrintfHandler::HandleNullChar(const char *nullCharacter) {
1158  // The presence of a null character is likely an error.
1159  S.Diag(getLocationOfByte(nullCharacter),
1160         diag::warn_printf_format_string_contains_null_char)
1161    << getFormatStringRange();
1162}
1163
1164const Expr *CheckPrintfHandler::getDataArg(unsigned i) const {
1165  return TheCall->getArg(FirstDataArg + i);
1166}
1167
1168void CheckPrintfHandler::HandleFlags(const analyze_printf::FormatSpecifier &FS,
1169                                     llvm::StringRef flag,
1170                                     llvm::StringRef cspec,
1171                                     const char *startSpecifier,
1172                                     unsigned specifierLen) {
1173  const analyze_printf::ConversionSpecifier &CS = FS.getConversionSpecifier();
1174  S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_nonsensical_flag)
1175    << flag << cspec << getFormatSpecifierRange(startSpecifier, specifierLen);
1176}
1177
1178bool
1179CheckPrintfHandler::HandleAmount(const analyze_printf::OptionalAmount &Amt,
1180                                 unsigned k, const char *startSpecifier,
1181                                 unsigned specifierLen) {
1182
1183  if (Amt.hasDataArgument()) {
1184    if (!HasVAListArg) {
1185      unsigned argIndex = Amt.getArgIndex();
1186      if (argIndex >= NumDataArgs) {
1187        S.Diag(getLocationOfByte(Amt.getStart()),
1188               diag::warn_printf_asterisk_missing_arg)
1189          << k << getFormatSpecifierRange(startSpecifier, specifierLen);
1190        // Don't do any more checking.  We will just emit
1191        // spurious errors.
1192        return false;
1193      }
1194
1195      // Type check the data argument.  It should be an 'int'.
1196      // Although not in conformance with C99, we also allow the argument to be
1197      // an 'unsigned int' as that is a reasonably safe case.  GCC also
1198      // doesn't emit a warning for that case.
1199      CoveredArgs.set(argIndex);
1200      const Expr *Arg = getDataArg(argIndex);
1201      QualType T = Arg->getType();
1202
1203      const analyze_printf::ArgTypeResult &ATR = Amt.getArgType(S.Context);
1204      assert(ATR.isValid());
1205
1206      if (!ATR.matchesType(S.Context, T)) {
1207        S.Diag(getLocationOfByte(Amt.getStart()),
1208               diag::warn_printf_asterisk_wrong_type)
1209          << k
1210          << ATR.getRepresentativeType(S.Context) << T
1211          << getFormatSpecifierRange(startSpecifier, specifierLen)
1212          << Arg->getSourceRange();
1213        // Don't do any more checking.  We will just emit
1214        // spurious errors.
1215        return false;
1216      }
1217    }
1218  }
1219  return true;
1220}
1221
1222bool
1223CheckPrintfHandler::HandleFormatSpecifier(const analyze_printf::FormatSpecifier
1224                                            &FS,
1225                                          const char *startSpecifier,
1226                                          unsigned specifierLen) {
1227
1228  using namespace analyze_printf;
1229  const ConversionSpecifier &CS = FS.getConversionSpecifier();
1230
1231  if (atFirstArg) {
1232    atFirstArg = false;
1233    usesPositionalArgs = FS.usesPositionalArg();
1234  }
1235  else if (usesPositionalArgs != FS.usesPositionalArg()) {
1236    // Cannot mix-and-match positional and non-positional arguments.
1237    S.Diag(getLocationOfByte(CS.getStart()),
1238           diag::warn_printf_mix_positional_nonpositional_args)
1239      << getFormatSpecifierRange(startSpecifier, specifierLen);
1240    return false;
1241  }
1242
1243  // First check if the field width, precision, and conversion specifier
1244  // have matching data arguments.
1245  if (!HandleAmount(FS.getFieldWidth(), /* field width */ 0,
1246                    startSpecifier, specifierLen)) {
1247    return false;
1248  }
1249
1250  if (!HandleAmount(FS.getPrecision(), /* precision */ 1,
1251                    startSpecifier, specifierLen)) {
1252    return false;
1253  }
1254
1255  if (!CS.consumesDataArgument()) {
1256    // FIXME: Technically specifying a precision or field width here
1257    // makes no sense.  Worth issuing a warning at some point.
1258    return true;
1259  }
1260
1261  // Consume the argument.
1262  unsigned argIndex = FS.getArgIndex();
1263  if (argIndex < NumDataArgs) {
1264    // The check to see if the argIndex is valid will come later.
1265    // We set the bit here because we may exit early from this
1266    // function if we encounter some other error.
1267    CoveredArgs.set(argIndex);
1268  }
1269
1270  // Check for using an Objective-C specific conversion specifier
1271  // in a non-ObjC literal.
1272  if (!IsObjCLiteral && CS.isObjCArg()) {
1273    return HandleInvalidConversionSpecifier(FS, startSpecifier, specifierLen);
1274  }
1275
1276  // Are we using '%n'?  Issue a warning about this being
1277  // a possible security issue.
1278  if (CS.getKind() == ConversionSpecifier::OutIntPtrArg) {
1279    S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_write_back)
1280      << getFormatSpecifierRange(startSpecifier, specifierLen);
1281    // Continue checking the other format specifiers.
1282    return true;
1283  }
1284
1285  if (CS.getKind() == ConversionSpecifier::VoidPtrArg) {
1286    if (FS.getPrecision().getHowSpecified() != OptionalAmount::NotSpecified)
1287      S.Diag(getLocationOfByte(CS.getStart()),
1288             diag::warn_printf_nonsensical_precision)
1289        << CS.getCharacters()
1290        << getFormatSpecifierRange(startSpecifier, specifierLen);
1291  }
1292  if (CS.getKind() == ConversionSpecifier::VoidPtrArg ||
1293      CS.getKind() == ConversionSpecifier::CStrArg) {
1294    // FIXME: Instead of using "0", "+", etc., eventually get them from
1295    // the FormatSpecifier.
1296    if (FS.hasLeadingZeros())
1297      HandleFlags(FS, "0", CS.getCharacters(), startSpecifier, specifierLen);
1298    if (FS.hasPlusPrefix())
1299      HandleFlags(FS, "+", CS.getCharacters(), startSpecifier, specifierLen);
1300    if (FS.hasSpacePrefix())
1301      HandleFlags(FS, " ", CS.getCharacters(), startSpecifier, specifierLen);
1302  }
1303
1304  // The remaining checks depend on the data arguments.
1305  if (HasVAListArg)
1306    return true;
1307
1308  if (argIndex >= NumDataArgs) {
1309    if (FS.usesPositionalArg())  {
1310      S.Diag(getLocationOfByte(CS.getStart()),
1311             diag::warn_printf_positional_arg_exceeds_data_args)
1312        << (argIndex+1) << NumDataArgs
1313        << getFormatSpecifierRange(startSpecifier, specifierLen);
1314    }
1315    else {
1316      S.Diag(getLocationOfByte(CS.getStart()),
1317             diag::warn_printf_insufficient_data_args)
1318        << getFormatSpecifierRange(startSpecifier, specifierLen);
1319    }
1320
1321    // Don't do any more checking.
1322    return false;
1323  }
1324
1325  // Now type check the data expression that matches the
1326  // format specifier.
1327  const Expr *Ex = getDataArg(argIndex);
1328  const analyze_printf::ArgTypeResult &ATR = FS.getArgType(S.Context);
1329  if (ATR.isValid() && !ATR.matchesType(S.Context, Ex->getType())) {
1330    // Check if we didn't match because of an implicit cast from a 'char'
1331    // or 'short' to an 'int'.  This is done because printf is a varargs
1332    // function.
1333    if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Ex))
1334      if (ICE->getType() == S.Context.IntTy)
1335        if (ATR.matchesType(S.Context, ICE->getSubExpr()->getType()))
1336          return true;
1337
1338    S.Diag(getLocationOfByte(CS.getStart()),
1339           diag::warn_printf_conversion_argument_type_mismatch)
1340      << ATR.getRepresentativeType(S.Context) << Ex->getType()
1341      << getFormatSpecifierRange(startSpecifier, specifierLen)
1342      << Ex->getSourceRange();
1343  }
1344
1345  return true;
1346}
1347
1348void CheckPrintfHandler::DoneProcessing() {
1349  // Does the number of data arguments exceed the number of
1350  // format conversions in the format string?
1351  if (!HasVAListArg) {
1352    // Find any arguments that weren't covered.
1353    CoveredArgs.flip();
1354    signed notCoveredArg = CoveredArgs.find_first();
1355    if (notCoveredArg >= 0) {
1356      assert((unsigned)notCoveredArg < NumDataArgs);
1357      S.Diag(getDataArg((unsigned) notCoveredArg)->getLocStart(),
1358             diag::warn_printf_data_arg_not_used)
1359        << getFormatStringRange();
1360    }
1361  }
1362}
1363
1364void Sema::CheckPrintfString(const StringLiteral *FExpr,
1365                             const Expr *OrigFormatExpr,
1366                             const CallExpr *TheCall, bool HasVAListArg,
1367                             unsigned format_idx, unsigned firstDataArg) {
1368
1369  // CHECK: is the format string a wide literal?
1370  if (FExpr->isWide()) {
1371    Diag(FExpr->getLocStart(),
1372         diag::warn_printf_format_string_is_wide_literal)
1373    << OrigFormatExpr->getSourceRange();
1374    return;
1375  }
1376
1377  // Str - The format string.  NOTE: this is NOT null-terminated!
1378  const char *Str = FExpr->getStrData();
1379
1380  // CHECK: empty format string?
1381  unsigned StrLen = FExpr->getByteLength();
1382
1383  if (StrLen == 0) {
1384    Diag(FExpr->getLocStart(), diag::warn_printf_empty_format_string)
1385    << OrigFormatExpr->getSourceRange();
1386    return;
1387  }
1388
1389  CheckPrintfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg,
1390                       TheCall->getNumArgs() - firstDataArg,
1391                       isa<ObjCStringLiteral>(OrigFormatExpr), Str,
1392                       HasVAListArg, TheCall, format_idx);
1393
1394  if (!analyze_printf::ParseFormatString(H, Str, Str + StrLen))
1395    H.DoneProcessing();
1396}
1397
1398//===--- CHECK: Return Address of Stack Variable --------------------------===//
1399
1400static DeclRefExpr* EvalVal(Expr *E);
1401static DeclRefExpr* EvalAddr(Expr* E);
1402
1403/// CheckReturnStackAddr - Check if a return statement returns the address
1404///   of a stack variable.
1405void
1406Sema::CheckReturnStackAddr(Expr *RetValExp, QualType lhsType,
1407                           SourceLocation ReturnLoc) {
1408
1409  // Perform checking for returned stack addresses.
1410  if (lhsType->isPointerType() || lhsType->isBlockPointerType()) {
1411    if (DeclRefExpr *DR = EvalAddr(RetValExp))
1412      Diag(DR->getLocStart(), diag::warn_ret_stack_addr)
1413       << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
1414
1415    // Skip over implicit cast expressions when checking for block expressions.
1416    RetValExp = RetValExp->IgnoreParenCasts();
1417
1418    if (BlockExpr *C = dyn_cast<BlockExpr>(RetValExp))
1419      if (C->hasBlockDeclRefExprs())
1420        Diag(C->getLocStart(), diag::err_ret_local_block)
1421          << C->getSourceRange();
1422
1423    if (AddrLabelExpr *ALE = dyn_cast<AddrLabelExpr>(RetValExp))
1424      Diag(ALE->getLocStart(), diag::warn_ret_addr_label)
1425        << ALE->getSourceRange();
1426
1427  } else if (lhsType->isReferenceType()) {
1428    // Perform checking for stack values returned by reference.
1429    // Check for a reference to the stack
1430    if (DeclRefExpr *DR = EvalVal(RetValExp))
1431      Diag(DR->getLocStart(), diag::warn_ret_stack_ref)
1432        << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
1433  }
1434}
1435
1436/// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
1437///  check if the expression in a return statement evaluates to an address
1438///  to a location on the stack.  The recursion is used to traverse the
1439///  AST of the return expression, with recursion backtracking when we
1440///  encounter a subexpression that (1) clearly does not lead to the address
1441///  of a stack variable or (2) is something we cannot determine leads to
1442///  the address of a stack variable based on such local checking.
1443///
1444///  EvalAddr processes expressions that are pointers that are used as
1445///  references (and not L-values).  EvalVal handles all other values.
1446///  At the base case of the recursion is a check for a DeclRefExpr* in
1447///  the refers to a stack variable.
1448///
1449///  This implementation handles:
1450///
1451///   * pointer-to-pointer casts
1452///   * implicit conversions from array references to pointers
1453///   * taking the address of fields
1454///   * arbitrary interplay between "&" and "*" operators
1455///   * pointer arithmetic from an address of a stack variable
1456///   * taking the address of an array element where the array is on the stack
1457static DeclRefExpr* EvalAddr(Expr *E) {
1458  // We should only be called for evaluating pointer expressions.
1459  assert((E->getType()->isAnyPointerType() ||
1460          E->getType()->isBlockPointerType() ||
1461          E->getType()->isObjCQualifiedIdType()) &&
1462         "EvalAddr only works on pointers");
1463
1464  // Our "symbolic interpreter" is just a dispatch off the currently
1465  // viewed AST node.  We then recursively traverse the AST by calling
1466  // EvalAddr and EvalVal appropriately.
1467  switch (E->getStmtClass()) {
1468  case Stmt::ParenExprClass:
1469    // Ignore parentheses.
1470    return EvalAddr(cast<ParenExpr>(E)->getSubExpr());
1471
1472  case Stmt::UnaryOperatorClass: {
1473    // The only unary operator that make sense to handle here
1474    // is AddrOf.  All others don't make sense as pointers.
1475    UnaryOperator *U = cast<UnaryOperator>(E);
1476
1477    if (U->getOpcode() == UnaryOperator::AddrOf)
1478      return EvalVal(U->getSubExpr());
1479    else
1480      return NULL;
1481  }
1482
1483  case Stmt::BinaryOperatorClass: {
1484    // Handle pointer arithmetic.  All other binary operators are not valid
1485    // in this context.
1486    BinaryOperator *B = cast<BinaryOperator>(E);
1487    BinaryOperator::Opcode op = B->getOpcode();
1488
1489    if (op != BinaryOperator::Add && op != BinaryOperator::Sub)
1490      return NULL;
1491
1492    Expr *Base = B->getLHS();
1493
1494    // Determine which argument is the real pointer base.  It could be
1495    // the RHS argument instead of the LHS.
1496    if (!Base->getType()->isPointerType()) Base = B->getRHS();
1497
1498    assert (Base->getType()->isPointerType());
1499    return EvalAddr(Base);
1500  }
1501
1502  // For conditional operators we need to see if either the LHS or RHS are
1503  // valid DeclRefExpr*s.  If one of them is valid, we return it.
1504  case Stmt::ConditionalOperatorClass: {
1505    ConditionalOperator *C = cast<ConditionalOperator>(E);
1506
1507    // Handle the GNU extension for missing LHS.
1508    if (Expr *lhsExpr = C->getLHS())
1509      if (DeclRefExpr* LHS = EvalAddr(lhsExpr))
1510        return LHS;
1511
1512     return EvalAddr(C->getRHS());
1513  }
1514
1515  // For casts, we need to handle conversions from arrays to
1516  // pointer values, and pointer-to-pointer conversions.
1517  case Stmt::ImplicitCastExprClass:
1518  case Stmt::CStyleCastExprClass:
1519  case Stmt::CXXFunctionalCastExprClass: {
1520    Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
1521    QualType T = SubExpr->getType();
1522
1523    if (SubExpr->getType()->isPointerType() ||
1524        SubExpr->getType()->isBlockPointerType() ||
1525        SubExpr->getType()->isObjCQualifiedIdType())
1526      return EvalAddr(SubExpr);
1527    else if (T->isArrayType())
1528      return EvalVal(SubExpr);
1529    else
1530      return 0;
1531  }
1532
1533  // C++ casts.  For dynamic casts, static casts, and const casts, we
1534  // are always converting from a pointer-to-pointer, so we just blow
1535  // through the cast.  In the case the dynamic cast doesn't fail (and
1536  // return NULL), we take the conservative route and report cases
1537  // where we return the address of a stack variable.  For Reinterpre
1538  // FIXME: The comment about is wrong; we're not always converting
1539  // from pointer to pointer. I'm guessing that this code should also
1540  // handle references to objects.
1541  case Stmt::CXXStaticCastExprClass:
1542  case Stmt::CXXDynamicCastExprClass:
1543  case Stmt::CXXConstCastExprClass:
1544  case Stmt::CXXReinterpretCastExprClass: {
1545      Expr *S = cast<CXXNamedCastExpr>(E)->getSubExpr();
1546      if (S->getType()->isPointerType() || S->getType()->isBlockPointerType())
1547        return EvalAddr(S);
1548      else
1549        return NULL;
1550  }
1551
1552  // Everything else: we simply don't reason about them.
1553  default:
1554    return NULL;
1555  }
1556}
1557
1558
1559///  EvalVal - This function is complements EvalAddr in the mutual recursion.
1560///   See the comments for EvalAddr for more details.
1561static DeclRefExpr* EvalVal(Expr *E) {
1562
1563  // We should only be called for evaluating non-pointer expressions, or
1564  // expressions with a pointer type that are not used as references but instead
1565  // are l-values (e.g., DeclRefExpr with a pointer type).
1566
1567  // Our "symbolic interpreter" is just a dispatch off the currently
1568  // viewed AST node.  We then recursively traverse the AST by calling
1569  // EvalAddr and EvalVal appropriately.
1570  switch (E->getStmtClass()) {
1571  case Stmt::DeclRefExprClass: {
1572    // DeclRefExpr: the base case.  When we hit a DeclRefExpr we are looking
1573    //  at code that refers to a variable's name.  We check if it has local
1574    //  storage within the function, and if so, return the expression.
1575    DeclRefExpr *DR = cast<DeclRefExpr>(E);
1576
1577    if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
1578      if (V->hasLocalStorage() && !V->getType()->isReferenceType()) return DR;
1579
1580    return NULL;
1581  }
1582
1583  case Stmt::ParenExprClass:
1584    // Ignore parentheses.
1585    return EvalVal(cast<ParenExpr>(E)->getSubExpr());
1586
1587  case Stmt::UnaryOperatorClass: {
1588    // The only unary operator that make sense to handle here
1589    // is Deref.  All others don't resolve to a "name."  This includes
1590    // handling all sorts of rvalues passed to a unary operator.
1591    UnaryOperator *U = cast<UnaryOperator>(E);
1592
1593    if (U->getOpcode() == UnaryOperator::Deref)
1594      return EvalAddr(U->getSubExpr());
1595
1596    return NULL;
1597  }
1598
1599  case Stmt::ArraySubscriptExprClass: {
1600    // Array subscripts are potential references to data on the stack.  We
1601    // retrieve the DeclRefExpr* for the array variable if it indeed
1602    // has local storage.
1603    return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase());
1604  }
1605
1606  case Stmt::ConditionalOperatorClass: {
1607    // For conditional operators we need to see if either the LHS or RHS are
1608    // non-NULL DeclRefExpr's.  If one is non-NULL, we return it.
1609    ConditionalOperator *C = cast<ConditionalOperator>(E);
1610
1611    // Handle the GNU extension for missing LHS.
1612    if (Expr *lhsExpr = C->getLHS())
1613      if (DeclRefExpr *LHS = EvalVal(lhsExpr))
1614        return LHS;
1615
1616    return EvalVal(C->getRHS());
1617  }
1618
1619  // Accesses to members are potential references to data on the stack.
1620  case Stmt::MemberExprClass: {
1621    MemberExpr *M = cast<MemberExpr>(E);
1622
1623    // Check for indirect access.  We only want direct field accesses.
1624    if (!M->isArrow())
1625      return EvalVal(M->getBase());
1626    else
1627      return NULL;
1628  }
1629
1630  // Everything else: we simply don't reason about them.
1631  default:
1632    return NULL;
1633  }
1634}
1635
1636//===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
1637
1638/// Check for comparisons of floating point operands using != and ==.
1639/// Issue a warning if these are no self-comparisons, as they are not likely
1640/// to do what the programmer intended.
1641void Sema::CheckFloatComparison(SourceLocation loc, Expr* lex, Expr *rex) {
1642  bool EmitWarning = true;
1643
1644  Expr* LeftExprSansParen = lex->IgnoreParens();
1645  Expr* RightExprSansParen = rex->IgnoreParens();
1646
1647  // Special case: check for x == x (which is OK).
1648  // Do not emit warnings for such cases.
1649  if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
1650    if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
1651      if (DRL->getDecl() == DRR->getDecl())
1652        EmitWarning = false;
1653
1654
1655  // Special case: check for comparisons against literals that can be exactly
1656  //  represented by APFloat.  In such cases, do not emit a warning.  This
1657  //  is a heuristic: often comparison against such literals are used to
1658  //  detect if a value in a variable has not changed.  This clearly can
1659  //  lead to false negatives.
1660  if (EmitWarning) {
1661    if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
1662      if (FLL->isExact())
1663        EmitWarning = false;
1664    } else
1665      if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)){
1666        if (FLR->isExact())
1667          EmitWarning = false;
1668    }
1669  }
1670
1671  // Check for comparisons with builtin types.
1672  if (EmitWarning)
1673    if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
1674      if (CL->isBuiltinCall(Context))
1675        EmitWarning = false;
1676
1677  if (EmitWarning)
1678    if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
1679      if (CR->isBuiltinCall(Context))
1680        EmitWarning = false;
1681
1682  // Emit the diagnostic.
1683  if (EmitWarning)
1684    Diag(loc, diag::warn_floatingpoint_eq)
1685      << lex->getSourceRange() << rex->getSourceRange();
1686}
1687
1688//===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
1689//===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
1690
1691namespace {
1692
1693/// Structure recording the 'active' range of an integer-valued
1694/// expression.
1695struct IntRange {
1696  /// The number of bits active in the int.
1697  unsigned Width;
1698
1699  /// True if the int is known not to have negative values.
1700  bool NonNegative;
1701
1702  IntRange() {}
1703  IntRange(unsigned Width, bool NonNegative)
1704    : Width(Width), NonNegative(NonNegative)
1705  {}
1706
1707  // Returns the range of the bool type.
1708  static IntRange forBoolType() {
1709    return IntRange(1, true);
1710  }
1711
1712  // Returns the range of an integral type.
1713  static IntRange forType(ASTContext &C, QualType T) {
1714    return forCanonicalType(C, T->getCanonicalTypeInternal().getTypePtr());
1715  }
1716
1717  // Returns the range of an integeral type based on its canonical
1718  // representation.
1719  static IntRange forCanonicalType(ASTContext &C, const Type *T) {
1720    assert(T->isCanonicalUnqualified());
1721
1722    if (const VectorType *VT = dyn_cast<VectorType>(T))
1723      T = VT->getElementType().getTypePtr();
1724    if (const ComplexType *CT = dyn_cast<ComplexType>(T))
1725      T = CT->getElementType().getTypePtr();
1726    if (const EnumType *ET = dyn_cast<EnumType>(T))
1727      T = ET->getDecl()->getIntegerType().getTypePtr();
1728
1729    const BuiltinType *BT = cast<BuiltinType>(T);
1730    assert(BT->isInteger());
1731
1732    return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
1733  }
1734
1735  // Returns the supremum of two ranges: i.e. their conservative merge.
1736  static IntRange join(IntRange L, IntRange R) {
1737    return IntRange(std::max(L.Width, R.Width),
1738                    L.NonNegative && R.NonNegative);
1739  }
1740
1741  // Returns the infinum of two ranges: i.e. their aggressive merge.
1742  static IntRange meet(IntRange L, IntRange R) {
1743    return IntRange(std::min(L.Width, R.Width),
1744                    L.NonNegative || R.NonNegative);
1745  }
1746};
1747
1748IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, unsigned MaxWidth) {
1749  if (value.isSigned() && value.isNegative())
1750    return IntRange(value.getMinSignedBits(), false);
1751
1752  if (value.getBitWidth() > MaxWidth)
1753    value.trunc(MaxWidth);
1754
1755  // isNonNegative() just checks the sign bit without considering
1756  // signedness.
1757  return IntRange(value.getActiveBits(), true);
1758}
1759
1760IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
1761                       unsigned MaxWidth) {
1762  if (result.isInt())
1763    return GetValueRange(C, result.getInt(), MaxWidth);
1764
1765  if (result.isVector()) {
1766    IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
1767    for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
1768      IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
1769      R = IntRange::join(R, El);
1770    }
1771    return R;
1772  }
1773
1774  if (result.isComplexInt()) {
1775    IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
1776    IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
1777    return IntRange::join(R, I);
1778  }
1779
1780  // This can happen with lossless casts to intptr_t of "based" lvalues.
1781  // Assume it might use arbitrary bits.
1782  // FIXME: The only reason we need to pass the type in here is to get
1783  // the sign right on this one case.  It would be nice if APValue
1784  // preserved this.
1785  assert(result.isLValue());
1786  return IntRange(MaxWidth, Ty->isUnsignedIntegerType());
1787}
1788
1789/// Pseudo-evaluate the given integer expression, estimating the
1790/// range of values it might take.
1791///
1792/// \param MaxWidth - the width to which the value will be truncated
1793IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
1794  E = E->IgnoreParens();
1795
1796  // Try a full evaluation first.
1797  Expr::EvalResult result;
1798  if (E->Evaluate(result, C))
1799    return GetValueRange(C, result.Val, E->getType(), MaxWidth);
1800
1801  // I think we only want to look through implicit casts here; if the
1802  // user has an explicit widening cast, we should treat the value as
1803  // being of the new, wider type.
1804  if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
1805    if (CE->getCastKind() == CastExpr::CK_NoOp)
1806      return GetExprRange(C, CE->getSubExpr(), MaxWidth);
1807
1808    IntRange OutputTypeRange = IntRange::forType(C, CE->getType());
1809
1810    bool isIntegerCast = (CE->getCastKind() == CastExpr::CK_IntegralCast);
1811    if (!isIntegerCast && CE->getCastKind() == CastExpr::CK_Unknown)
1812      isIntegerCast = CE->getSubExpr()->getType()->isIntegerType();
1813
1814    // Assume that non-integer casts can span the full range of the type.
1815    if (!isIntegerCast)
1816      return OutputTypeRange;
1817
1818    IntRange SubRange
1819      = GetExprRange(C, CE->getSubExpr(),
1820                     std::min(MaxWidth, OutputTypeRange.Width));
1821
1822    // Bail out if the subexpr's range is as wide as the cast type.
1823    if (SubRange.Width >= OutputTypeRange.Width)
1824      return OutputTypeRange;
1825
1826    // Otherwise, we take the smaller width, and we're non-negative if
1827    // either the output type or the subexpr is.
1828    return IntRange(SubRange.Width,
1829                    SubRange.NonNegative || OutputTypeRange.NonNegative);
1830  }
1831
1832  if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
1833    // If we can fold the condition, just take that operand.
1834    bool CondResult;
1835    if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
1836      return GetExprRange(C, CondResult ? CO->getTrueExpr()
1837                                        : CO->getFalseExpr(),
1838                          MaxWidth);
1839
1840    // Otherwise, conservatively merge.
1841    IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
1842    IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
1843    return IntRange::join(L, R);
1844  }
1845
1846  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
1847    switch (BO->getOpcode()) {
1848
1849    // Boolean-valued operations are single-bit and positive.
1850    case BinaryOperator::LAnd:
1851    case BinaryOperator::LOr:
1852    case BinaryOperator::LT:
1853    case BinaryOperator::GT:
1854    case BinaryOperator::LE:
1855    case BinaryOperator::GE:
1856    case BinaryOperator::EQ:
1857    case BinaryOperator::NE:
1858      return IntRange::forBoolType();
1859
1860    // The type of these compound assignments is the type of the LHS,
1861    // so the RHS is not necessarily an integer.
1862    case BinaryOperator::MulAssign:
1863    case BinaryOperator::DivAssign:
1864    case BinaryOperator::RemAssign:
1865    case BinaryOperator::AddAssign:
1866    case BinaryOperator::SubAssign:
1867      return IntRange::forType(C, E->getType());
1868
1869    // Operations with opaque sources are black-listed.
1870    case BinaryOperator::PtrMemD:
1871    case BinaryOperator::PtrMemI:
1872      return IntRange::forType(C, E->getType());
1873
1874    // Bitwise-and uses the *infinum* of the two source ranges.
1875    case BinaryOperator::And:
1876    case BinaryOperator::AndAssign:
1877      return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
1878                            GetExprRange(C, BO->getRHS(), MaxWidth));
1879
1880    // Left shift gets black-listed based on a judgement call.
1881    case BinaryOperator::Shl:
1882      // ...except that we want to treat '1 << (blah)' as logically
1883      // positive.  It's an important idiom.
1884      if (IntegerLiteral *I
1885            = dyn_cast<IntegerLiteral>(BO->getLHS()->IgnoreParenCasts())) {
1886        if (I->getValue() == 1) {
1887          IntRange R = IntRange::forType(C, E->getType());
1888          return IntRange(R.Width, /*NonNegative*/ true);
1889        }
1890      }
1891      // fallthrough
1892
1893    case BinaryOperator::ShlAssign:
1894      return IntRange::forType(C, E->getType());
1895
1896    // Right shift by a constant can narrow its left argument.
1897    case BinaryOperator::Shr:
1898    case BinaryOperator::ShrAssign: {
1899      IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1900
1901      // If the shift amount is a positive constant, drop the width by
1902      // that much.
1903      llvm::APSInt shift;
1904      if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
1905          shift.isNonNegative()) {
1906        unsigned zext = shift.getZExtValue();
1907        if (zext >= L.Width)
1908          L.Width = (L.NonNegative ? 0 : 1);
1909        else
1910          L.Width -= zext;
1911      }
1912
1913      return L;
1914    }
1915
1916    // Comma acts as its right operand.
1917    case BinaryOperator::Comma:
1918      return GetExprRange(C, BO->getRHS(), MaxWidth);
1919
1920    // Black-list pointer subtractions.
1921    case BinaryOperator::Sub:
1922      if (BO->getLHS()->getType()->isPointerType())
1923        return IntRange::forType(C, E->getType());
1924      // fallthrough
1925
1926    default:
1927      break;
1928    }
1929
1930    // Treat every other operator as if it were closed on the
1931    // narrowest type that encompasses both operands.
1932    IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1933    IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
1934    return IntRange::join(L, R);
1935  }
1936
1937  if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
1938    switch (UO->getOpcode()) {
1939    // Boolean-valued operations are white-listed.
1940    case UnaryOperator::LNot:
1941      return IntRange::forBoolType();
1942
1943    // Operations with opaque sources are black-listed.
1944    case UnaryOperator::Deref:
1945    case UnaryOperator::AddrOf: // should be impossible
1946    case UnaryOperator::OffsetOf:
1947      return IntRange::forType(C, E->getType());
1948
1949    default:
1950      return GetExprRange(C, UO->getSubExpr(), MaxWidth);
1951    }
1952  }
1953
1954  FieldDecl *BitField = E->getBitField();
1955  if (BitField) {
1956    llvm::APSInt BitWidthAP = BitField->getBitWidth()->EvaluateAsInt(C);
1957    unsigned BitWidth = BitWidthAP.getZExtValue();
1958
1959    return IntRange(BitWidth, BitField->getType()->isUnsignedIntegerType());
1960  }
1961
1962  return IntRange::forType(C, E->getType());
1963}
1964
1965/// Checks whether the given value, which currently has the given
1966/// source semantics, has the same value when coerced through the
1967/// target semantics.
1968bool IsSameFloatAfterCast(const llvm::APFloat &value,
1969                          const llvm::fltSemantics &Src,
1970                          const llvm::fltSemantics &Tgt) {
1971  llvm::APFloat truncated = value;
1972
1973  bool ignored;
1974  truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
1975  truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
1976
1977  return truncated.bitwiseIsEqual(value);
1978}
1979
1980/// Checks whether the given value, which currently has the given
1981/// source semantics, has the same value when coerced through the
1982/// target semantics.
1983///
1984/// The value might be a vector of floats (or a complex number).
1985bool IsSameFloatAfterCast(const APValue &value,
1986                          const llvm::fltSemantics &Src,
1987                          const llvm::fltSemantics &Tgt) {
1988  if (value.isFloat())
1989    return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
1990
1991  if (value.isVector()) {
1992    for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
1993      if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
1994        return false;
1995    return true;
1996  }
1997
1998  assert(value.isComplexFloat());
1999  return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
2000          IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
2001}
2002
2003} // end anonymous namespace
2004
2005/// \brief Implements -Wsign-compare.
2006///
2007/// \param lex the left-hand expression
2008/// \param rex the right-hand expression
2009/// \param OpLoc the location of the joining operator
2010/// \param BinOpc binary opcode or 0
2011void Sema::CheckSignCompare(Expr *lex, Expr *rex, SourceLocation OpLoc,
2012                            const BinaryOperator::Opcode* BinOpc) {
2013  // Don't warn if we're in an unevaluated context.
2014  if (ExprEvalContexts.back().Context == Unevaluated)
2015    return;
2016
2017  // If either expression is value-dependent, don't warn. We'll get another
2018  // chance at instantiation time.
2019  if (lex->isValueDependent() || rex->isValueDependent())
2020    return;
2021
2022  QualType lt = lex->getType(), rt = rex->getType();
2023
2024  // Only warn if both operands are integral.
2025  if (!lt->isIntegerType() || !rt->isIntegerType())
2026    return;
2027
2028  // In C, the width of a bitfield determines its type, and the
2029  // declared type only contributes the signedness.  This duplicates
2030  // the work that will later be done by UsualUnaryConversions.
2031  // Eventually, this check will be reorganized in a way that avoids
2032  // this duplication.
2033  if (!getLangOptions().CPlusPlus) {
2034    QualType tmp;
2035    tmp = Context.isPromotableBitField(lex);
2036    if (!tmp.isNull()) lt = tmp;
2037    tmp = Context.isPromotableBitField(rex);
2038    if (!tmp.isNull()) rt = tmp;
2039  }
2040
2041  if (const EnumType *E = lt->getAs<EnumType>())
2042    lt = E->getDecl()->getPromotionType();
2043  if (const EnumType *E = rt->getAs<EnumType>())
2044    rt = E->getDecl()->getPromotionType();
2045
2046  // The rule is that the signed operand becomes unsigned, so isolate the
2047  // signed operand.
2048  Expr *signedOperand = lex, *unsignedOperand = rex;
2049  QualType signedType = lt, unsignedType = rt;
2050  if (lt->isSignedIntegerType()) {
2051    if (rt->isSignedIntegerType()) return;
2052  } else {
2053    if (!rt->isSignedIntegerType()) return;
2054    std::swap(signedOperand, unsignedOperand);
2055    std::swap(signedType, unsignedType);
2056  }
2057
2058  unsigned unsignedWidth = Context.getIntWidth(unsignedType);
2059  unsigned signedWidth = Context.getIntWidth(signedType);
2060
2061  // If the unsigned type is strictly smaller than the signed type,
2062  // then (1) the result type will be signed and (2) the unsigned
2063  // value will fit fully within the signed type, and thus the result
2064  // of the comparison will be exact.
2065  if (signedWidth > unsignedWidth)
2066    return;
2067
2068  // Otherwise, calculate the effective ranges.
2069  IntRange signedRange = GetExprRange(Context, signedOperand, signedWidth);
2070  IntRange unsignedRange = GetExprRange(Context, unsignedOperand, unsignedWidth);
2071
2072  // We should never be unable to prove that the unsigned operand is
2073  // non-negative.
2074  assert(unsignedRange.NonNegative && "unsigned range includes negative?");
2075
2076  // If the signed operand is non-negative, then the signed->unsigned
2077  // conversion won't change it.
2078  if (signedRange.NonNegative) {
2079    // Emit warnings for comparisons of unsigned to integer constant 0.
2080    //   always false: x < 0  (or 0 > x)
2081    //   always true:  x >= 0 (or 0 <= x)
2082    llvm::APSInt X;
2083    if (BinOpc && signedOperand->isIntegerConstantExpr(X, Context) && X == 0) {
2084      if (signedOperand != lex) {
2085        if (*BinOpc == BinaryOperator::LT) {
2086          Diag(OpLoc, diag::warn_lunsigned_always_true_comparison)
2087            << "< 0" << "false"
2088            << lex->getSourceRange() << rex->getSourceRange();
2089        }
2090        else if (*BinOpc == BinaryOperator::GE) {
2091          Diag(OpLoc, diag::warn_lunsigned_always_true_comparison)
2092            << ">= 0" << "true"
2093            << lex->getSourceRange() << rex->getSourceRange();
2094        }
2095      }
2096      else {
2097        if (*BinOpc == BinaryOperator::GT) {
2098          Diag(OpLoc, diag::warn_runsigned_always_true_comparison)
2099            << "0 >" << "false"
2100            << lex->getSourceRange() << rex->getSourceRange();
2101        }
2102        else if (*BinOpc == BinaryOperator::LE) {
2103          Diag(OpLoc, diag::warn_runsigned_always_true_comparison)
2104            << "0 <=" << "true"
2105            << lex->getSourceRange() << rex->getSourceRange();
2106        }
2107      }
2108    }
2109    return;
2110  }
2111
2112  // For (in)equality comparisons, if the unsigned operand is a
2113  // constant which cannot collide with a overflowed signed operand,
2114  // then reinterpreting the signed operand as unsigned will not
2115  // change the result of the comparison.
2116  if (BinOpc &&
2117      (*BinOpc == BinaryOperator::EQ || *BinOpc == BinaryOperator::NE) &&
2118      unsignedRange.Width < unsignedWidth)
2119    return;
2120
2121  Diag(OpLoc, BinOpc ? diag::warn_mixed_sign_comparison
2122                     : diag::warn_mixed_sign_conditional)
2123    << lt << rt << lex->getSourceRange() << rex->getSourceRange();
2124}
2125
2126/// Diagnose an implicit cast;  purely a helper for CheckImplicitConversion.
2127static void DiagnoseImpCast(Sema &S, Expr *E, QualType T, unsigned diag) {
2128  S.Diag(E->getExprLoc(), diag) << E->getType() << T << E->getSourceRange();
2129}
2130
2131/// Implements -Wconversion.
2132void Sema::CheckImplicitConversion(Expr *E, QualType T) {
2133  // Don't diagnose in unevaluated contexts.
2134  if (ExprEvalContexts.back().Context == Sema::Unevaluated)
2135    return;
2136
2137  // Don't diagnose for value-dependent expressions.
2138  if (E->isValueDependent())
2139    return;
2140
2141  const Type *Source = Context.getCanonicalType(E->getType()).getTypePtr();
2142  const Type *Target = Context.getCanonicalType(T).getTypePtr();
2143
2144  // Never diagnose implicit casts to bool.
2145  if (Target->isSpecificBuiltinType(BuiltinType::Bool))
2146    return;
2147
2148  // Strip vector types.
2149  if (isa<VectorType>(Source)) {
2150    if (!isa<VectorType>(Target))
2151      return DiagnoseImpCast(*this, E, T, diag::warn_impcast_vector_scalar);
2152
2153    Source = cast<VectorType>(Source)->getElementType().getTypePtr();
2154    Target = cast<VectorType>(Target)->getElementType().getTypePtr();
2155  }
2156
2157  // Strip complex types.
2158  if (isa<ComplexType>(Source)) {
2159    if (!isa<ComplexType>(Target))
2160      return DiagnoseImpCast(*this, E, T, diag::warn_impcast_complex_scalar);
2161
2162    Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
2163    Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
2164  }
2165
2166  const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
2167  const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
2168
2169  // If the source is floating point...
2170  if (SourceBT && SourceBT->isFloatingPoint()) {
2171    // ...and the target is floating point...
2172    if (TargetBT && TargetBT->isFloatingPoint()) {
2173      // ...then warn if we're dropping FP rank.
2174
2175      // Builtin FP kinds are ordered by increasing FP rank.
2176      if (SourceBT->getKind() > TargetBT->getKind()) {
2177        // Don't warn about float constants that are precisely
2178        // representable in the target type.
2179        Expr::EvalResult result;
2180        if (E->Evaluate(result, Context)) {
2181          // Value might be a float, a float vector, or a float complex.
2182          if (IsSameFloatAfterCast(result.Val,
2183                     Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
2184                     Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
2185            return;
2186        }
2187
2188        DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_precision);
2189      }
2190      return;
2191    }
2192
2193    // If the target is integral, always warn.
2194    if ((TargetBT && TargetBT->isInteger()))
2195      // TODO: don't warn for integer values?
2196      return DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_integer);
2197
2198    return;
2199  }
2200
2201  if (!Source->isIntegerType() || !Target->isIntegerType())
2202    return;
2203
2204  IntRange SourceRange = GetExprRange(Context, E, Context.getIntWidth(E->getType()));
2205  IntRange TargetRange = IntRange::forCanonicalType(Context, Target);
2206
2207  // FIXME: also signed<->unsigned?
2208
2209  if (SourceRange.Width > TargetRange.Width) {
2210    // People want to build with -Wshorten-64-to-32 and not -Wconversion
2211    // and by god we'll let them.
2212    if (SourceRange.Width == 64 && TargetRange.Width == 32)
2213      return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_64_32);
2214    return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_precision);
2215  }
2216
2217  return;
2218}
2219
2220/// CheckParmsForFunctionDef - Check that the parameters of the given
2221/// function are appropriate for the definition of a function. This
2222/// takes care of any checks that cannot be performed on the
2223/// declaration itself, e.g., that the types of each of the function
2224/// parameters are complete.
2225bool Sema::CheckParmsForFunctionDef(FunctionDecl *FD) {
2226  bool HasInvalidParm = false;
2227  for (unsigned p = 0, NumParams = FD->getNumParams(); p < NumParams; ++p) {
2228    ParmVarDecl *Param = FD->getParamDecl(p);
2229
2230    // C99 6.7.5.3p4: the parameters in a parameter type list in a
2231    // function declarator that is part of a function definition of
2232    // that function shall not have incomplete type.
2233    //
2234    // This is also C++ [dcl.fct]p6.
2235    if (!Param->isInvalidDecl() &&
2236        RequireCompleteType(Param->getLocation(), Param->getType(),
2237                               diag::err_typecheck_decl_incomplete_type)) {
2238      Param->setInvalidDecl();
2239      HasInvalidParm = true;
2240    }
2241
2242    // C99 6.9.1p5: If the declarator includes a parameter type list, the
2243    // declaration of each parameter shall include an identifier.
2244    if (Param->getIdentifier() == 0 &&
2245        !Param->isImplicit() &&
2246        !getLangOptions().CPlusPlus)
2247      Diag(Param->getLocation(), diag::err_parameter_name_omitted);
2248
2249    // C99 6.7.5.3p12:
2250    //   If the function declarator is not part of a definition of that
2251    //   function, parameters may have incomplete type and may use the [*]
2252    //   notation in their sequences of declarator specifiers to specify
2253    //   variable length array types.
2254    QualType PType = Param->getOriginalType();
2255    if (const ArrayType *AT = Context.getAsArrayType(PType)) {
2256      if (AT->getSizeModifier() == ArrayType::Star) {
2257        // FIXME: This diagnosic should point the the '[*]' if source-location
2258        // information is added for it.
2259        Diag(Param->getLocation(), diag::err_array_star_in_function_definition);
2260      }
2261    }
2262  }
2263
2264  return HasInvalidParm;
2265}
2266