SemaChecking.cpp revision d9b859a74ecaede23a78d37f364498102ef418c9 
1//===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file implements extra semantic analysis beyond what is enforced
11//  by the C type system.
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/Sema/Initialization.h"
16#include "clang/Sema/Sema.h"
17#include "clang/Sema/SemaInternal.h"
18#include "clang/Sema/Initialization.h"
19#include "clang/Sema/ScopeInfo.h"
20#include "clang/Analysis/Analyses/FormatString.h"
21#include "clang/AST/ASTContext.h"
22#include "clang/AST/CharUnits.h"
23#include "clang/AST/DeclCXX.h"
24#include "clang/AST/DeclObjC.h"
25#include "clang/AST/ExprCXX.h"
26#include "clang/AST/ExprObjC.h"
27#include "clang/AST/EvaluatedExprVisitor.h"
28#include "clang/AST/DeclObjC.h"
29#include "clang/AST/StmtCXX.h"
30#include "clang/AST/StmtObjC.h"
31#include "clang/Lex/Preprocessor.h"
32#include "llvm/ADT/BitVector.h"
33#include "llvm/ADT/STLExtras.h"
34#include "llvm/Support/raw_ostream.h"
35#include "clang/Basic/TargetBuiltins.h"
36#include "clang/Basic/TargetInfo.h"
37#include "clang/Basic/ConvertUTF.h"
38#include <limits>
39using namespace clang;
40using namespace sema;
41
42SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
43                                                    unsigned ByteNo) const {
44  return SL->getLocationOfByte(ByteNo, PP.getSourceManager(),
45                               PP.getLangOptions(), PP.getTargetInfo());
46}
47
48
49/// CheckablePrintfAttr - does a function call have a "printf" attribute
50/// and arguments that merit checking?
51bool Sema::CheckablePrintfAttr(const FormatAttr *Format, CallExpr *TheCall) {
52  if (Format->getType() == "printf") return true;
53  if (Format->getType() == "printf0") {
54    // printf0 allows null "format" string; if so don't check format/args
55    unsigned format_idx = Format->getFormatIdx() - 1;
56    // Does the index refer to the implicit object argument?
57    if (isa<CXXMemberCallExpr>(TheCall)) {
58      if (format_idx == 0)
59        return false;
60      --format_idx;
61    }
62    if (format_idx < TheCall->getNumArgs()) {
63      Expr *Format = TheCall->getArg(format_idx)->IgnoreParenCasts();
64      if (!Format->isNullPointerConstant(Context,
65                                         Expr::NPC_ValueDependentIsNull))
66        return true;
67    }
68  }
69  return false;
70}
71
72/// Checks that a call expression's argument count is the desired number.
73/// This is useful when doing custom type-checking.  Returns true on error.
74static bool checkArgCount(Sema &S, CallExpr *call, unsigned desiredArgCount) {
75  unsigned argCount = call->getNumArgs();
76  if (argCount == desiredArgCount) return false;
77
78  if (argCount < desiredArgCount)
79    return S.Diag(call->getLocEnd(), diag::err_typecheck_call_too_few_args)
80        << 0 /*function call*/ << desiredArgCount << argCount
81        << call->getSourceRange();
82
83  // Highlight all the excess arguments.
84  SourceRange range(call->getArg(desiredArgCount)->getLocStart(),
85                    call->getArg(argCount - 1)->getLocEnd());
86
87  return S.Diag(range.getBegin(), diag::err_typecheck_call_too_many_args)
88    << 0 /*function call*/ << desiredArgCount << argCount
89    << call->getArg(1)->getSourceRange();
90}
91
92/// CheckBuiltinAnnotationString - Checks that string argument to the builtin
93/// annotation is a non wide string literal.
94static bool CheckBuiltinAnnotationString(Sema &S, Expr *Arg) {
95  Arg = Arg->IgnoreParenCasts();
96  StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
97  if (!Literal || !Literal->isAscii()) {
98    S.Diag(Arg->getLocStart(), diag::err_builtin_annotation_not_string_constant)
99      << Arg->getSourceRange();
100    return true;
101  }
102  return false;
103}
104
105ExprResult
106Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
107  ExprResult TheCallResult(Owned(TheCall));
108
109  // Find out if any arguments are required to be integer constant expressions.
110  unsigned ICEArguments = 0;
111  ASTContext::GetBuiltinTypeError Error;
112  Context.GetBuiltinType(BuiltinID, Error, &ICEArguments);
113  if (Error != ASTContext::GE_None)
114    ICEArguments = 0;  // Don't diagnose previously diagnosed errors.
115
116  // If any arguments are required to be ICE's, check and diagnose.
117  for (unsigned ArgNo = 0; ICEArguments != 0; ++ArgNo) {
118    // Skip arguments not required to be ICE's.
119    if ((ICEArguments & (1 << ArgNo)) == 0) continue;
120
121    llvm::APSInt Result;
122    if (SemaBuiltinConstantArg(TheCall, ArgNo, Result))
123      return true;
124    ICEArguments &= ~(1 << ArgNo);
125  }
126
127  switch (BuiltinID) {
128  case Builtin::BI__builtin___CFStringMakeConstantString:
129    assert(TheCall->getNumArgs() == 1 &&
130           "Wrong # arguments to builtin CFStringMakeConstantString");
131    if (CheckObjCString(TheCall->getArg(0)))
132      return ExprError();
133    break;
134  case Builtin::BI__builtin_stdarg_start:
135  case Builtin::BI__builtin_va_start:
136    if (SemaBuiltinVAStart(TheCall))
137      return ExprError();
138    break;
139  case Builtin::BI__builtin_isgreater:
140  case Builtin::BI__builtin_isgreaterequal:
141  case Builtin::BI__builtin_isless:
142  case Builtin::BI__builtin_islessequal:
143  case Builtin::BI__builtin_islessgreater:
144  case Builtin::BI__builtin_isunordered:
145    if (SemaBuiltinUnorderedCompare(TheCall))
146      return ExprError();
147    break;
148  case Builtin::BI__builtin_fpclassify:
149    if (SemaBuiltinFPClassification(TheCall, 6))
150      return ExprError();
151    break;
152  case Builtin::BI__builtin_isfinite:
153  case Builtin::BI__builtin_isinf:
154  case Builtin::BI__builtin_isinf_sign:
155  case Builtin::BI__builtin_isnan:
156  case Builtin::BI__builtin_isnormal:
157    if (SemaBuiltinFPClassification(TheCall, 1))
158      return ExprError();
159    break;
160  case Builtin::BI__builtin_shufflevector:
161    return SemaBuiltinShuffleVector(TheCall);
162    // TheCall will be freed by the smart pointer here, but that's fine, since
163    // SemaBuiltinShuffleVector guts it, but then doesn't release it.
164  case Builtin::BI__builtin_prefetch:
165    if (SemaBuiltinPrefetch(TheCall))
166      return ExprError();
167    break;
168  case Builtin::BI__builtin_object_size:
169    if (SemaBuiltinObjectSize(TheCall))
170      return ExprError();
171    break;
172  case Builtin::BI__builtin_longjmp:
173    if (SemaBuiltinLongjmp(TheCall))
174      return ExprError();
175    break;
176
177  case Builtin::BI__builtin_classify_type:
178    if (checkArgCount(*this, TheCall, 1)) return true;
179    TheCall->setType(Context.IntTy);
180    break;
181  case Builtin::BI__builtin_constant_p:
182    if (checkArgCount(*this, TheCall, 1)) return true;
183    TheCall->setType(Context.IntTy);
184    break;
185  case Builtin::BI__sync_fetch_and_add:
186  case Builtin::BI__sync_fetch_and_add_1:
187  case Builtin::BI__sync_fetch_and_add_2:
188  case Builtin::BI__sync_fetch_and_add_4:
189  case Builtin::BI__sync_fetch_and_add_8:
190  case Builtin::BI__sync_fetch_and_add_16:
191  case Builtin::BI__sync_fetch_and_sub:
192  case Builtin::BI__sync_fetch_and_sub_1:
193  case Builtin::BI__sync_fetch_and_sub_2:
194  case Builtin::BI__sync_fetch_and_sub_4:
195  case Builtin::BI__sync_fetch_and_sub_8:
196  case Builtin::BI__sync_fetch_and_sub_16:
197  case Builtin::BI__sync_fetch_and_or:
198  case Builtin::BI__sync_fetch_and_or_1:
199  case Builtin::BI__sync_fetch_and_or_2:
200  case Builtin::BI__sync_fetch_and_or_4:
201  case Builtin::BI__sync_fetch_and_or_8:
202  case Builtin::BI__sync_fetch_and_or_16:
203  case Builtin::BI__sync_fetch_and_and:
204  case Builtin::BI__sync_fetch_and_and_1:
205  case Builtin::BI__sync_fetch_and_and_2:
206  case Builtin::BI__sync_fetch_and_and_4:
207  case Builtin::BI__sync_fetch_and_and_8:
208  case Builtin::BI__sync_fetch_and_and_16:
209  case Builtin::BI__sync_fetch_and_xor:
210  case Builtin::BI__sync_fetch_and_xor_1:
211  case Builtin::BI__sync_fetch_and_xor_2:
212  case Builtin::BI__sync_fetch_and_xor_4:
213  case Builtin::BI__sync_fetch_and_xor_8:
214  case Builtin::BI__sync_fetch_and_xor_16:
215  case Builtin::BI__sync_add_and_fetch:
216  case Builtin::BI__sync_add_and_fetch_1:
217  case Builtin::BI__sync_add_and_fetch_2:
218  case Builtin::BI__sync_add_and_fetch_4:
219  case Builtin::BI__sync_add_and_fetch_8:
220  case Builtin::BI__sync_add_and_fetch_16:
221  case Builtin::BI__sync_sub_and_fetch:
222  case Builtin::BI__sync_sub_and_fetch_1:
223  case Builtin::BI__sync_sub_and_fetch_2:
224  case Builtin::BI__sync_sub_and_fetch_4:
225  case Builtin::BI__sync_sub_and_fetch_8:
226  case Builtin::BI__sync_sub_and_fetch_16:
227  case Builtin::BI__sync_and_and_fetch:
228  case Builtin::BI__sync_and_and_fetch_1:
229  case Builtin::BI__sync_and_and_fetch_2:
230  case Builtin::BI__sync_and_and_fetch_4:
231  case Builtin::BI__sync_and_and_fetch_8:
232  case Builtin::BI__sync_and_and_fetch_16:
233  case Builtin::BI__sync_or_and_fetch:
234  case Builtin::BI__sync_or_and_fetch_1:
235  case Builtin::BI__sync_or_and_fetch_2:
236  case Builtin::BI__sync_or_and_fetch_4:
237  case Builtin::BI__sync_or_and_fetch_8:
238  case Builtin::BI__sync_or_and_fetch_16:
239  case Builtin::BI__sync_xor_and_fetch:
240  case Builtin::BI__sync_xor_and_fetch_1:
241  case Builtin::BI__sync_xor_and_fetch_2:
242  case Builtin::BI__sync_xor_and_fetch_4:
243  case Builtin::BI__sync_xor_and_fetch_8:
244  case Builtin::BI__sync_xor_and_fetch_16:
245  case Builtin::BI__sync_val_compare_and_swap:
246  case Builtin::BI__sync_val_compare_and_swap_1:
247  case Builtin::BI__sync_val_compare_and_swap_2:
248  case Builtin::BI__sync_val_compare_and_swap_4:
249  case Builtin::BI__sync_val_compare_and_swap_8:
250  case Builtin::BI__sync_val_compare_and_swap_16:
251  case Builtin::BI__sync_bool_compare_and_swap:
252  case Builtin::BI__sync_bool_compare_and_swap_1:
253  case Builtin::BI__sync_bool_compare_and_swap_2:
254  case Builtin::BI__sync_bool_compare_and_swap_4:
255  case Builtin::BI__sync_bool_compare_and_swap_8:
256  case Builtin::BI__sync_bool_compare_and_swap_16:
257  case Builtin::BI__sync_lock_test_and_set:
258  case Builtin::BI__sync_lock_test_and_set_1:
259  case Builtin::BI__sync_lock_test_and_set_2:
260  case Builtin::BI__sync_lock_test_and_set_4:
261  case Builtin::BI__sync_lock_test_and_set_8:
262  case Builtin::BI__sync_lock_test_and_set_16:
263  case Builtin::BI__sync_lock_release:
264  case Builtin::BI__sync_lock_release_1:
265  case Builtin::BI__sync_lock_release_2:
266  case Builtin::BI__sync_lock_release_4:
267  case Builtin::BI__sync_lock_release_8:
268  case Builtin::BI__sync_lock_release_16:
269  case Builtin::BI__sync_swap:
270  case Builtin::BI__sync_swap_1:
271  case Builtin::BI__sync_swap_2:
272  case Builtin::BI__sync_swap_4:
273  case Builtin::BI__sync_swap_8:
274  case Builtin::BI__sync_swap_16:
275    return SemaBuiltinAtomicOverloaded(move(TheCallResult));
276  case Builtin::BI__atomic_load:
277    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Load);
278  case Builtin::BI__atomic_store:
279    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Store);
280  case Builtin::BI__atomic_exchange:
281    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Xchg);
282  case Builtin::BI__atomic_compare_exchange_strong:
283    return SemaAtomicOpsOverloaded(move(TheCallResult),
284                                   AtomicExpr::CmpXchgStrong);
285  case Builtin::BI__atomic_compare_exchange_weak:
286    return SemaAtomicOpsOverloaded(move(TheCallResult),
287                                   AtomicExpr::CmpXchgWeak);
288  case Builtin::BI__atomic_fetch_add:
289    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Add);
290  case Builtin::BI__atomic_fetch_sub:
291    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Sub);
292  case Builtin::BI__atomic_fetch_and:
293    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::And);
294  case Builtin::BI__atomic_fetch_or:
295    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Or);
296  case Builtin::BI__atomic_fetch_xor:
297    return SemaAtomicOpsOverloaded(move(TheCallResult), AtomicExpr::Xor);
298  case Builtin::BI__builtin_annotation:
299    if (CheckBuiltinAnnotationString(*this, TheCall->getArg(1)))
300      return ExprError();
301    break;
302  }
303
304  // Since the target specific builtins for each arch overlap, only check those
305  // of the arch we are compiling for.
306  if (BuiltinID >= Builtin::FirstTSBuiltin) {
307    switch (Context.getTargetInfo().getTriple().getArch()) {
308      case llvm::Triple::arm:
309      case llvm::Triple::thumb:
310        if (CheckARMBuiltinFunctionCall(BuiltinID, TheCall))
311          return ExprError();
312        break;
313      default:
314        break;
315    }
316  }
317
318  return move(TheCallResult);
319}
320
321// Get the valid immediate range for the specified NEON type code.
322static unsigned RFT(unsigned t, bool shift = false) {
323  NeonTypeFlags Type(t);
324  int IsQuad = Type.isQuad();
325  switch (Type.getEltType()) {
326  case NeonTypeFlags::Int8:
327  case NeonTypeFlags::Poly8:
328    return shift ? 7 : (8 << IsQuad) - 1;
329  case NeonTypeFlags::Int16:
330  case NeonTypeFlags::Poly16:
331    return shift ? 15 : (4 << IsQuad) - 1;
332  case NeonTypeFlags::Int32:
333    return shift ? 31 : (2 << IsQuad) - 1;
334  case NeonTypeFlags::Int64:
335    return shift ? 63 : (1 << IsQuad) - 1;
336  case NeonTypeFlags::Float16:
337    assert(!shift && "cannot shift float types!");
338    return (4 << IsQuad) - 1;
339  case NeonTypeFlags::Float32:
340    assert(!shift && "cannot shift float types!");
341    return (2 << IsQuad) - 1;
342  }
343  return 0;
344}
345
346/// getNeonEltType - Return the QualType corresponding to the elements of
347/// the vector type specified by the NeonTypeFlags.  This is used to check
348/// the pointer arguments for Neon load/store intrinsics.
349static QualType getNeonEltType(NeonTypeFlags Flags, ASTContext &Context) {
350  switch (Flags.getEltType()) {
351  case NeonTypeFlags::Int8:
352    return Flags.isUnsigned() ? Context.UnsignedCharTy : Context.SignedCharTy;
353  case NeonTypeFlags::Int16:
354    return Flags.isUnsigned() ? Context.UnsignedShortTy : Context.ShortTy;
355  case NeonTypeFlags::Int32:
356    return Flags.isUnsigned() ? Context.UnsignedIntTy : Context.IntTy;
357  case NeonTypeFlags::Int64:
358    return Flags.isUnsigned() ? Context.UnsignedLongLongTy : Context.LongLongTy;
359  case NeonTypeFlags::Poly8:
360    return Context.SignedCharTy;
361  case NeonTypeFlags::Poly16:
362    return Context.ShortTy;
363  case NeonTypeFlags::Float16:
364    return Context.UnsignedShortTy;
365  case NeonTypeFlags::Float32:
366    return Context.FloatTy;
367  }
368  return QualType();
369}
370
371bool Sema::CheckARMBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
372  llvm::APSInt Result;
373
374  unsigned mask = 0;
375  unsigned TV = 0;
376  int PtrArgNum = -1;
377  bool HasConstPtr = false;
378  switch (BuiltinID) {
379#define GET_NEON_OVERLOAD_CHECK
380#include "clang/Basic/arm_neon.inc"
381#undef GET_NEON_OVERLOAD_CHECK
382  }
383
384  // For NEON intrinsics which are overloaded on vector element type, validate
385  // the immediate which specifies which variant to emit.
386  unsigned ImmArg = TheCall->getNumArgs()-1;
387  if (mask) {
388    if (SemaBuiltinConstantArg(TheCall, ImmArg, Result))
389      return true;
390
391    TV = Result.getLimitedValue(64);
392    if ((TV > 63) || (mask & (1 << TV)) == 0)
393      return Diag(TheCall->getLocStart(), diag::err_invalid_neon_type_code)
394        << TheCall->getArg(ImmArg)->getSourceRange();
395  }
396
397  if (PtrArgNum >= 0) {
398    // Check that pointer arguments have the specified type.
399    Expr *Arg = TheCall->getArg(PtrArgNum);
400    if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg))
401      Arg = ICE->getSubExpr();
402    ExprResult RHS = DefaultFunctionArrayLvalueConversion(Arg);
403    QualType RHSTy = RHS.get()->getType();
404    QualType EltTy = getNeonEltType(NeonTypeFlags(TV), Context);
405    if (HasConstPtr)
406      EltTy = EltTy.withConst();
407    QualType LHSTy = Context.getPointerType(EltTy);
408    AssignConvertType ConvTy;
409    ConvTy = CheckSingleAssignmentConstraints(LHSTy, RHS);
410    if (RHS.isInvalid())
411      return true;
412    if (DiagnoseAssignmentResult(ConvTy, Arg->getLocStart(), LHSTy, RHSTy,
413                                 RHS.get(), AA_Assigning))
414      return true;
415  }
416
417  // For NEON intrinsics which take an immediate value as part of the
418  // instruction, range check them here.
419  unsigned i = 0, l = 0, u = 0;
420  switch (BuiltinID) {
421  default: return false;
422  case ARM::BI__builtin_arm_ssat: i = 1; l = 1; u = 31; break;
423  case ARM::BI__builtin_arm_usat: i = 1; u = 31; break;
424  case ARM::BI__builtin_arm_vcvtr_f:
425  case ARM::BI__builtin_arm_vcvtr_d: i = 1; u = 1; break;
426#define GET_NEON_IMMEDIATE_CHECK
427#include "clang/Basic/arm_neon.inc"
428#undef GET_NEON_IMMEDIATE_CHECK
429  };
430
431  // Check that the immediate argument is actually a constant.
432  if (SemaBuiltinConstantArg(TheCall, i, Result))
433    return true;
434
435  // Range check against the upper/lower values for this isntruction.
436  unsigned Val = Result.getZExtValue();
437  if (Val < l || Val > (u + l))
438    return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
439      << l << u+l << TheCall->getArg(i)->getSourceRange();
440
441  // FIXME: VFP Intrinsics should error if VFP not present.
442  return false;
443}
444
445/// CheckFunctionCall - Check a direct function call for various correctness
446/// and safety properties not strictly enforced by the C type system.
447bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall) {
448  // Get the IdentifierInfo* for the called function.
449  IdentifierInfo *FnInfo = FDecl->getIdentifier();
450
451  // None of the checks below are needed for functions that don't have
452  // simple names (e.g., C++ conversion functions).
453  if (!FnInfo)
454    return false;
455
456  // FIXME: This mechanism should be abstracted to be less fragile and
457  // more efficient. For example, just map function ids to custom
458  // handlers.
459
460  // Printf and scanf checking.
461  for (specific_attr_iterator<FormatAttr>
462         i = FDecl->specific_attr_begin<FormatAttr>(),
463         e = FDecl->specific_attr_end<FormatAttr>(); i != e ; ++i) {
464
465    const FormatAttr *Format = *i;
466    const bool b = Format->getType() == "scanf";
467    if (b || CheckablePrintfAttr(Format, TheCall)) {
468      bool HasVAListArg = Format->getFirstArg() == 0;
469      CheckPrintfScanfArguments(TheCall, HasVAListArg,
470                                Format->getFormatIdx() - 1,
471                                HasVAListArg ? 0 : Format->getFirstArg() - 1,
472                                !b);
473    }
474  }
475
476  for (specific_attr_iterator<NonNullAttr>
477         i = FDecl->specific_attr_begin<NonNullAttr>(),
478         e = FDecl->specific_attr_end<NonNullAttr>(); i != e; ++i) {
479    CheckNonNullArguments(*i, TheCall->getArgs(),
480                          TheCall->getCallee()->getLocStart());
481  }
482
483  FunctionDecl::MemoryFunctionKind CMF = FDecl->getMemoryFunctionKind();
484  if (CMF == FunctionDecl::MFK_Invalid)
485    return false;
486
487  // Handle memory setting and copying functions.
488  if (CMF == FunctionDecl::MFK_Strlcpy || CMF == FunctionDecl::MFK_Strlcat)
489    CheckStrlcpycatArguments(TheCall, FnInfo);
490  else
491    CheckMemaccessArguments(TheCall, CMF, FnInfo);
492
493  return false;
494}
495
496bool Sema::CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall) {
497  // Printf checking.
498  const FormatAttr *Format = NDecl->getAttr<FormatAttr>();
499  if (!Format)
500    return false;
501
502  const VarDecl *V = dyn_cast<VarDecl>(NDecl);
503  if (!V)
504    return false;
505
506  QualType Ty = V->getType();
507  if (!Ty->isBlockPointerType())
508    return false;
509
510  const bool b = Format->getType() == "scanf";
511  if (!b && !CheckablePrintfAttr(Format, TheCall))
512    return false;
513
514  bool HasVAListArg = Format->getFirstArg() == 0;
515  CheckPrintfScanfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
516                            HasVAListArg ? 0 : Format->getFirstArg() - 1, !b);
517
518  return false;
519}
520
521ExprResult
522Sema::SemaAtomicOpsOverloaded(ExprResult TheCallResult, AtomicExpr::AtomicOp Op) {
523  CallExpr *TheCall = cast<CallExpr>(TheCallResult.get());
524  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
525
526  // All these operations take one of the following four forms:
527  // T   __atomic_load(_Atomic(T)*, int)                              (loads)
528  // T*  __atomic_add(_Atomic(T*)*, ptrdiff_t, int)         (pointer add/sub)
529  // int __atomic_compare_exchange_strong(_Atomic(T)*, T*, T, int, int)
530  //                                                                (cmpxchg)
531  // T   __atomic_exchange(_Atomic(T)*, T, int)             (everything else)
532  // where T is an appropriate type, and the int paremeterss are for orderings.
533  unsigned NumVals = 1;
534  unsigned NumOrders = 1;
535  if (Op == AtomicExpr::Load) {
536    NumVals = 0;
537  } else if (Op == AtomicExpr::CmpXchgWeak || Op == AtomicExpr::CmpXchgStrong) {
538    NumVals = 2;
539    NumOrders = 2;
540  }
541
542  if (TheCall->getNumArgs() < NumVals+NumOrders+1) {
543    Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
544      << 0 << NumVals+NumOrders+1 << TheCall->getNumArgs()
545      << TheCall->getCallee()->getSourceRange();
546    return ExprError();
547  } else if (TheCall->getNumArgs() > NumVals+NumOrders+1) {
548    Diag(TheCall->getArg(NumVals+NumOrders+1)->getLocStart(),
549         diag::err_typecheck_call_too_many_args)
550      << 0 << NumVals+NumOrders+1 << TheCall->getNumArgs()
551      << TheCall->getCallee()->getSourceRange();
552    return ExprError();
553  }
554
555  // Inspect the first argument of the atomic operation.  This should always be
556  // a pointer to an _Atomic type.
557  Expr *Ptr = TheCall->getArg(0);
558  Ptr = DefaultFunctionArrayLvalueConversion(Ptr).get();
559  const PointerType *pointerType = Ptr->getType()->getAs<PointerType>();
560  if (!pointerType) {
561    Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic)
562      << Ptr->getType() << Ptr->getSourceRange();
563    return ExprError();
564  }
565
566  QualType AtomTy = pointerType->getPointeeType();
567  if (!AtomTy->isAtomicType()) {
568    Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic)
569      << Ptr->getType() << Ptr->getSourceRange();
570    return ExprError();
571  }
572  QualType ValType = AtomTy->getAs<AtomicType>()->getValueType();
573
574  if ((Op == AtomicExpr::Add || Op == AtomicExpr::Sub) &&
575      !ValType->isIntegerType() && !ValType->isPointerType()) {
576    Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic_int_or_ptr)
577      << Ptr->getType() << Ptr->getSourceRange();
578    return ExprError();
579  }
580
581  if (!ValType->isIntegerType() &&
582      (Op == AtomicExpr::And || Op == AtomicExpr::Or || Op == AtomicExpr::Xor)){
583    Diag(DRE->getLocStart(), diag::err_atomic_op_logical_needs_atomic_int)
584      << Ptr->getType() << Ptr->getSourceRange();
585    return ExprError();
586  }
587
588  switch (ValType.getObjCLifetime()) {
589  case Qualifiers::OCL_None:
590  case Qualifiers::OCL_ExplicitNone:
591    // okay
592    break;
593
594  case Qualifiers::OCL_Weak:
595  case Qualifiers::OCL_Strong:
596  case Qualifiers::OCL_Autoreleasing:
597    Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership)
598      << ValType << Ptr->getSourceRange();
599    return ExprError();
600  }
601
602  QualType ResultType = ValType;
603  if (Op == AtomicExpr::Store)
604    ResultType = Context.VoidTy;
605  else if (Op == AtomicExpr::CmpXchgWeak || Op == AtomicExpr::CmpXchgStrong)
606    ResultType = Context.BoolTy;
607
608  // The first argument --- the pointer --- has a fixed type; we
609  // deduce the types of the rest of the arguments accordingly.  Walk
610  // the remaining arguments, converting them to the deduced value type.
611  for (unsigned i = 1; i != NumVals+NumOrders+1; ++i) {
612    ExprResult Arg = TheCall->getArg(i);
613    QualType Ty;
614    if (i < NumVals+1) {
615      // The second argument to a cmpxchg is a pointer to the data which will
616      // be exchanged. The second argument to a pointer add/subtract is the
617      // amount to add/subtract, which must be a ptrdiff_t.  The third
618      // argument to a cmpxchg and the second argument in all other cases
619      // is the type of the value.
620      if (i == 1 && (Op == AtomicExpr::CmpXchgWeak ||
621                     Op == AtomicExpr::CmpXchgStrong))
622         Ty = Context.getPointerType(ValType.getUnqualifiedType());
623      else if (!ValType->isIntegerType() &&
624               (Op == AtomicExpr::Add || Op == AtomicExpr::Sub))
625        Ty = Context.getPointerDiffType();
626      else
627        Ty = ValType;
628    } else {
629      // The order(s) are always converted to int.
630      Ty = Context.IntTy;
631    }
632    InitializedEntity Entity =
633        InitializedEntity::InitializeParameter(Context, Ty, false);
634    Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg);
635    if (Arg.isInvalid())
636      return true;
637    TheCall->setArg(i, Arg.get());
638  }
639
640  SmallVector<Expr*, 5> SubExprs;
641  SubExprs.push_back(Ptr);
642  if (Op == AtomicExpr::Load) {
643    SubExprs.push_back(TheCall->getArg(1)); // Order
644  } else if (Op != AtomicExpr::CmpXchgWeak && Op != AtomicExpr::CmpXchgStrong) {
645    SubExprs.push_back(TheCall->getArg(2)); // Order
646    SubExprs.push_back(TheCall->getArg(1)); // Val1
647  } else {
648    SubExprs.push_back(TheCall->getArg(3)); // Order
649    SubExprs.push_back(TheCall->getArg(1)); // Val1
650    SubExprs.push_back(TheCall->getArg(2)); // Val2
651    SubExprs.push_back(TheCall->getArg(4)); // OrderFail
652  }
653
654  return Owned(new (Context) AtomicExpr(TheCall->getCallee()->getLocStart(),
655                                        SubExprs.data(), SubExprs.size(),
656                                        ResultType, Op,
657                                        TheCall->getRParenLoc()));
658}
659
660
661/// checkBuiltinArgument - Given a call to a builtin function, perform
662/// normal type-checking on the given argument, updating the call in
663/// place.  This is useful when a builtin function requires custom
664/// type-checking for some of its arguments but not necessarily all of
665/// them.
666///
667/// Returns true on error.
668static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) {
669  FunctionDecl *Fn = E->getDirectCallee();
670  assert(Fn && "builtin call without direct callee!");
671
672  ParmVarDecl *Param = Fn->getParamDecl(ArgIndex);
673  InitializedEntity Entity =
674    InitializedEntity::InitializeParameter(S.Context, Param);
675
676  ExprResult Arg = E->getArg(0);
677  Arg = S.PerformCopyInitialization(Entity, SourceLocation(), Arg);
678  if (Arg.isInvalid())
679    return true;
680
681  E->setArg(ArgIndex, Arg.take());
682  return false;
683}
684
685/// SemaBuiltinAtomicOverloaded - We have a call to a function like
686/// __sync_fetch_and_add, which is an overloaded function based on the pointer
687/// type of its first argument.  The main ActOnCallExpr routines have already
688/// promoted the types of arguments because all of these calls are prototyped as
689/// void(...).
690///
691/// This function goes through and does final semantic checking for these
692/// builtins,
693ExprResult
694Sema::SemaBuiltinAtomicOverloaded(ExprResult TheCallResult) {
695  CallExpr *TheCall = (CallExpr *)TheCallResult.get();
696  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
697  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
698
699  // Ensure that we have at least one argument to do type inference from.
700  if (TheCall->getNumArgs() < 1) {
701    Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least)
702      << 0 << 1 << TheCall->getNumArgs()
703      << TheCall->getCallee()->getSourceRange();
704    return ExprError();
705  }
706
707  // Inspect the first argument of the atomic builtin.  This should always be
708  // a pointer type, whose element is an integral scalar or pointer type.
709  // Because it is a pointer type, we don't have to worry about any implicit
710  // casts here.
711  // FIXME: We don't allow floating point scalars as input.
712  Expr *FirstArg = TheCall->getArg(0);
713  const PointerType *pointerType = FirstArg->getType()->getAs<PointerType>();
714  if (!pointerType) {
715    Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
716      << FirstArg->getType() << FirstArg->getSourceRange();
717    return ExprError();
718  }
719
720  QualType ValType = pointerType->getPointeeType();
721  if (!ValType->isIntegerType() && !ValType->isAnyPointerType() &&
722      !ValType->isBlockPointerType()) {
723    Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intptr)
724      << FirstArg->getType() << FirstArg->getSourceRange();
725    return ExprError();
726  }
727
728  switch (ValType.getObjCLifetime()) {
729  case Qualifiers::OCL_None:
730  case Qualifiers::OCL_ExplicitNone:
731    // okay
732    break;
733
734  case Qualifiers::OCL_Weak:
735  case Qualifiers::OCL_Strong:
736  case Qualifiers::OCL_Autoreleasing:
737    Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership)
738      << ValType << FirstArg->getSourceRange();
739    return ExprError();
740  }
741
742  // Strip any qualifiers off ValType.
743  ValType = ValType.getUnqualifiedType();
744
745  // The majority of builtins return a value, but a few have special return
746  // types, so allow them to override appropriately below.
747  QualType ResultType = ValType;
748
749  // We need to figure out which concrete builtin this maps onto.  For example,
750  // __sync_fetch_and_add with a 2 byte object turns into
751  // __sync_fetch_and_add_2.
752#define BUILTIN_ROW(x) \
753  { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
754    Builtin::BI##x##_8, Builtin::BI##x##_16 }
755
756  static const unsigned BuiltinIndices[][5] = {
757    BUILTIN_ROW(__sync_fetch_and_add),
758    BUILTIN_ROW(__sync_fetch_and_sub),
759    BUILTIN_ROW(__sync_fetch_and_or),
760    BUILTIN_ROW(__sync_fetch_and_and),
761    BUILTIN_ROW(__sync_fetch_and_xor),
762
763    BUILTIN_ROW(__sync_add_and_fetch),
764    BUILTIN_ROW(__sync_sub_and_fetch),
765    BUILTIN_ROW(__sync_and_and_fetch),
766    BUILTIN_ROW(__sync_or_and_fetch),
767    BUILTIN_ROW(__sync_xor_and_fetch),
768
769    BUILTIN_ROW(__sync_val_compare_and_swap),
770    BUILTIN_ROW(__sync_bool_compare_and_swap),
771    BUILTIN_ROW(__sync_lock_test_and_set),
772    BUILTIN_ROW(__sync_lock_release),
773    BUILTIN_ROW(__sync_swap)
774  };
775#undef BUILTIN_ROW
776
777  // Determine the index of the size.
778  unsigned SizeIndex;
779  switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
780  case 1: SizeIndex = 0; break;
781  case 2: SizeIndex = 1; break;
782  case 4: SizeIndex = 2; break;
783  case 8: SizeIndex = 3; break;
784  case 16: SizeIndex = 4; break;
785  default:
786    Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
787      << FirstArg->getType() << FirstArg->getSourceRange();
788    return ExprError();
789  }
790
791  // Each of these builtins has one pointer argument, followed by some number of
792  // values (0, 1 or 2) followed by a potentially empty varags list of stuff
793  // that we ignore.  Find out which row of BuiltinIndices to read from as well
794  // as the number of fixed args.
795  unsigned BuiltinID = FDecl->getBuiltinID();
796  unsigned BuiltinIndex, NumFixed = 1;
797  switch (BuiltinID) {
798  default: llvm_unreachable("Unknown overloaded atomic builtin!");
799  case Builtin::BI__sync_fetch_and_add:
800  case Builtin::BI__sync_fetch_and_add_1:
801  case Builtin::BI__sync_fetch_and_add_2:
802  case Builtin::BI__sync_fetch_and_add_4:
803  case Builtin::BI__sync_fetch_and_add_8:
804  case Builtin::BI__sync_fetch_and_add_16:
805    BuiltinIndex = 0;
806    break;
807
808  case Builtin::BI__sync_fetch_and_sub:
809  case Builtin::BI__sync_fetch_and_sub_1:
810  case Builtin::BI__sync_fetch_and_sub_2:
811  case Builtin::BI__sync_fetch_and_sub_4:
812  case Builtin::BI__sync_fetch_and_sub_8:
813  case Builtin::BI__sync_fetch_and_sub_16:
814    BuiltinIndex = 1;
815    break;
816
817  case Builtin::BI__sync_fetch_and_or:
818  case Builtin::BI__sync_fetch_and_or_1:
819  case Builtin::BI__sync_fetch_and_or_2:
820  case Builtin::BI__sync_fetch_and_or_4:
821  case Builtin::BI__sync_fetch_and_or_8:
822  case Builtin::BI__sync_fetch_and_or_16:
823    BuiltinIndex = 2;
824    break;
825
826  case Builtin::BI__sync_fetch_and_and:
827  case Builtin::BI__sync_fetch_and_and_1:
828  case Builtin::BI__sync_fetch_and_and_2:
829  case Builtin::BI__sync_fetch_and_and_4:
830  case Builtin::BI__sync_fetch_and_and_8:
831  case Builtin::BI__sync_fetch_and_and_16:
832    BuiltinIndex = 3;
833    break;
834
835  case Builtin::BI__sync_fetch_and_xor:
836  case Builtin::BI__sync_fetch_and_xor_1:
837  case Builtin::BI__sync_fetch_and_xor_2:
838  case Builtin::BI__sync_fetch_and_xor_4:
839  case Builtin::BI__sync_fetch_and_xor_8:
840  case Builtin::BI__sync_fetch_and_xor_16:
841    BuiltinIndex = 4;
842    break;
843
844  case Builtin::BI__sync_add_and_fetch:
845  case Builtin::BI__sync_add_and_fetch_1:
846  case Builtin::BI__sync_add_and_fetch_2:
847  case Builtin::BI__sync_add_and_fetch_4:
848  case Builtin::BI__sync_add_and_fetch_8:
849  case Builtin::BI__sync_add_and_fetch_16:
850    BuiltinIndex = 5;
851    break;
852
853  case Builtin::BI__sync_sub_and_fetch:
854  case Builtin::BI__sync_sub_and_fetch_1:
855  case Builtin::BI__sync_sub_and_fetch_2:
856  case Builtin::BI__sync_sub_and_fetch_4:
857  case Builtin::BI__sync_sub_and_fetch_8:
858  case Builtin::BI__sync_sub_and_fetch_16:
859    BuiltinIndex = 6;
860    break;
861
862  case Builtin::BI__sync_and_and_fetch:
863  case Builtin::BI__sync_and_and_fetch_1:
864  case Builtin::BI__sync_and_and_fetch_2:
865  case Builtin::BI__sync_and_and_fetch_4:
866  case Builtin::BI__sync_and_and_fetch_8:
867  case Builtin::BI__sync_and_and_fetch_16:
868    BuiltinIndex = 7;
869    break;
870
871  case Builtin::BI__sync_or_and_fetch:
872  case Builtin::BI__sync_or_and_fetch_1:
873  case Builtin::BI__sync_or_and_fetch_2:
874  case Builtin::BI__sync_or_and_fetch_4:
875  case Builtin::BI__sync_or_and_fetch_8:
876  case Builtin::BI__sync_or_and_fetch_16:
877    BuiltinIndex = 8;
878    break;
879
880  case Builtin::BI__sync_xor_and_fetch:
881  case Builtin::BI__sync_xor_and_fetch_1:
882  case Builtin::BI__sync_xor_and_fetch_2:
883  case Builtin::BI__sync_xor_and_fetch_4:
884  case Builtin::BI__sync_xor_and_fetch_8:
885  case Builtin::BI__sync_xor_and_fetch_16:
886    BuiltinIndex = 9;
887    break;
888
889  case Builtin::BI__sync_val_compare_and_swap:
890  case Builtin::BI__sync_val_compare_and_swap_1:
891  case Builtin::BI__sync_val_compare_and_swap_2:
892  case Builtin::BI__sync_val_compare_and_swap_4:
893  case Builtin::BI__sync_val_compare_and_swap_8:
894  case Builtin::BI__sync_val_compare_and_swap_16:
895    BuiltinIndex = 10;
896    NumFixed = 2;
897    break;
898
899  case Builtin::BI__sync_bool_compare_and_swap:
900  case Builtin::BI__sync_bool_compare_and_swap_1:
901  case Builtin::BI__sync_bool_compare_and_swap_2:
902  case Builtin::BI__sync_bool_compare_and_swap_4:
903  case Builtin::BI__sync_bool_compare_and_swap_8:
904  case Builtin::BI__sync_bool_compare_and_swap_16:
905    BuiltinIndex = 11;
906    NumFixed = 2;
907    ResultType = Context.BoolTy;
908    break;
909
910  case Builtin::BI__sync_lock_test_and_set:
911  case Builtin::BI__sync_lock_test_and_set_1:
912  case Builtin::BI__sync_lock_test_and_set_2:
913  case Builtin::BI__sync_lock_test_and_set_4:
914  case Builtin::BI__sync_lock_test_and_set_8:
915  case Builtin::BI__sync_lock_test_and_set_16:
916    BuiltinIndex = 12;
917    break;
918
919  case Builtin::BI__sync_lock_release:
920  case Builtin::BI__sync_lock_release_1:
921  case Builtin::BI__sync_lock_release_2:
922  case Builtin::BI__sync_lock_release_4:
923  case Builtin::BI__sync_lock_release_8:
924  case Builtin::BI__sync_lock_release_16:
925    BuiltinIndex = 13;
926    NumFixed = 0;
927    ResultType = Context.VoidTy;
928    break;
929
930  case Builtin::BI__sync_swap:
931  case Builtin::BI__sync_swap_1:
932  case Builtin::BI__sync_swap_2:
933  case Builtin::BI__sync_swap_4:
934  case Builtin::BI__sync_swap_8:
935  case Builtin::BI__sync_swap_16:
936    BuiltinIndex = 14;
937    break;
938  }
939
940  // Now that we know how many fixed arguments we expect, first check that we
941  // have at least that many.
942  if (TheCall->getNumArgs() < 1+NumFixed) {
943    Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least)
944      << 0 << 1+NumFixed << TheCall->getNumArgs()
945      << TheCall->getCallee()->getSourceRange();
946    return ExprError();
947  }
948
949  // Get the decl for the concrete builtin from this, we can tell what the
950  // concrete integer type we should convert to is.
951  unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
952  const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
953  IdentifierInfo *NewBuiltinII = PP.getIdentifierInfo(NewBuiltinName);
954  FunctionDecl *NewBuiltinDecl =
955    cast<FunctionDecl>(LazilyCreateBuiltin(NewBuiltinII, NewBuiltinID,
956                                           TUScope, false, DRE->getLocStart()));
957
958  // The first argument --- the pointer --- has a fixed type; we
959  // deduce the types of the rest of the arguments accordingly.  Walk
960  // the remaining arguments, converting them to the deduced value type.
961  for (unsigned i = 0; i != NumFixed; ++i) {
962    ExprResult Arg = TheCall->getArg(i+1);
963
964    // GCC does an implicit conversion to the pointer or integer ValType.  This
965    // can fail in some cases (1i -> int**), check for this error case now.
966    // Initialize the argument.
967    InitializedEntity Entity = InitializedEntity::InitializeParameter(Context,
968                                                   ValType, /*consume*/ false);
969    Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg);
970    if (Arg.isInvalid())
971      return ExprError();
972
973    // Okay, we have something that *can* be converted to the right type.  Check
974    // to see if there is a potentially weird extension going on here.  This can
975    // happen when you do an atomic operation on something like an char* and
976    // pass in 42.  The 42 gets converted to char.  This is even more strange
977    // for things like 45.123 -> char, etc.
978    // FIXME: Do this check.
979    TheCall->setArg(i+1, Arg.take());
980  }
981
982  ASTContext& Context = this->getASTContext();
983
984  // Create a new DeclRefExpr to refer to the new decl.
985  DeclRefExpr* NewDRE = DeclRefExpr::Create(
986      Context,
987      DRE->getQualifierLoc(),
988      NewBuiltinDecl,
989      DRE->getLocation(),
990      NewBuiltinDecl->getType(),
991      DRE->getValueKind());
992
993  // Set the callee in the CallExpr.
994  // FIXME: This leaks the original parens and implicit casts.
995  ExprResult PromotedCall = UsualUnaryConversions(NewDRE);
996  if (PromotedCall.isInvalid())
997    return ExprError();
998  TheCall->setCallee(PromotedCall.take());
999
1000  // Change the result type of the call to match the original value type. This
1001  // is arbitrary, but the codegen for these builtins ins design to handle it
1002  // gracefully.
1003  TheCall->setType(ResultType);
1004
1005  return move(TheCallResult);
1006}
1007
1008/// CheckObjCString - Checks that the argument to the builtin
1009/// CFString constructor is correct
1010/// Note: It might also make sense to do the UTF-16 conversion here (would
1011/// simplify the backend).
1012bool Sema::CheckObjCString(Expr *Arg) {
1013  Arg = Arg->IgnoreParenCasts();
1014  StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
1015
1016  if (!Literal || !Literal->isAscii()) {
1017    Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
1018      << Arg->getSourceRange();
1019    return true;
1020  }
1021
1022  if (Literal->containsNonAsciiOrNull()) {
1023    StringRef String = Literal->getString();
1024    unsigned NumBytes = String.size();
1025    SmallVector<UTF16, 128> ToBuf(NumBytes);
1026    const UTF8 *FromPtr = (UTF8 *)String.data();
1027    UTF16 *ToPtr = &ToBuf[0];
1028
1029    ConversionResult Result = ConvertUTF8toUTF16(&FromPtr, FromPtr + NumBytes,
1030                                                 &ToPtr, ToPtr + NumBytes,
1031                                                 strictConversion);
1032    // Check for conversion failure.
1033    if (Result != conversionOK)
1034      Diag(Arg->getLocStart(),
1035           diag::warn_cfstring_truncated) << Arg->getSourceRange();
1036  }
1037  return false;
1038}
1039
1040/// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
1041/// Emit an error and return true on failure, return false on success.
1042bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
1043  Expr *Fn = TheCall->getCallee();
1044  if (TheCall->getNumArgs() > 2) {
1045    Diag(TheCall->getArg(2)->getLocStart(),
1046         diag::err_typecheck_call_too_many_args)
1047      << 0 /*function call*/ << 2 << TheCall->getNumArgs()
1048      << Fn->getSourceRange()
1049      << SourceRange(TheCall->getArg(2)->getLocStart(),
1050                     (*(TheCall->arg_end()-1))->getLocEnd());
1051    return true;
1052  }
1053
1054  if (TheCall->getNumArgs() < 2) {
1055    return Diag(TheCall->getLocEnd(),
1056      diag::err_typecheck_call_too_few_args_at_least)
1057      << 0 /*function call*/ << 2 << TheCall->getNumArgs();
1058  }
1059
1060  // Type-check the first argument normally.
1061  if (checkBuiltinArgument(*this, TheCall, 0))
1062    return true;
1063
1064  // Determine whether the current function is variadic or not.
1065  BlockScopeInfo *CurBlock = getCurBlock();
1066  bool isVariadic;
1067  if (CurBlock)
1068    isVariadic = CurBlock->TheDecl->isVariadic();
1069  else if (FunctionDecl *FD = getCurFunctionDecl())
1070    isVariadic = FD->isVariadic();
1071  else
1072    isVariadic = getCurMethodDecl()->isVariadic();
1073
1074  if (!isVariadic) {
1075    Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
1076    return true;
1077  }
1078
1079  // Verify that the second argument to the builtin is the last argument of the
1080  // current function or method.
1081  bool SecondArgIsLastNamedArgument = false;
1082  const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
1083
1084  if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
1085    if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
1086      // FIXME: This isn't correct for methods (results in bogus warning).
1087      // Get the last formal in the current function.
1088      const ParmVarDecl *LastArg;
1089      if (CurBlock)
1090        LastArg = *(CurBlock->TheDecl->param_end()-1);
1091      else if (FunctionDecl *FD = getCurFunctionDecl())
1092        LastArg = *(FD->param_end()-1);
1093      else
1094        LastArg = *(getCurMethodDecl()->param_end()-1);
1095      SecondArgIsLastNamedArgument = PV == LastArg;
1096    }
1097  }
1098
1099  if (!SecondArgIsLastNamedArgument)
1100    Diag(TheCall->getArg(1)->getLocStart(),
1101         diag::warn_second_parameter_of_va_start_not_last_named_argument);
1102  return false;
1103}
1104
1105/// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
1106/// friends.  This is declared to take (...), so we have to check everything.
1107bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
1108  if (TheCall->getNumArgs() < 2)
1109    return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
1110      << 0 << 2 << TheCall->getNumArgs()/*function call*/;
1111  if (TheCall->getNumArgs() > 2)
1112    return Diag(TheCall->getArg(2)->getLocStart(),
1113                diag::err_typecheck_call_too_many_args)
1114      << 0 /*function call*/ << 2 << TheCall->getNumArgs()
1115      << SourceRange(TheCall->getArg(2)->getLocStart(),
1116                     (*(TheCall->arg_end()-1))->getLocEnd());
1117
1118  ExprResult OrigArg0 = TheCall->getArg(0);
1119  ExprResult OrigArg1 = TheCall->getArg(1);
1120
1121  // Do standard promotions between the two arguments, returning their common
1122  // type.
1123  QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
1124  if (OrigArg0.isInvalid() || OrigArg1.isInvalid())
1125    return true;
1126
1127  // Make sure any conversions are pushed back into the call; this is
1128  // type safe since unordered compare builtins are declared as "_Bool
1129  // foo(...)".
1130  TheCall->setArg(0, OrigArg0.get());
1131  TheCall->setArg(1, OrigArg1.get());
1132
1133  if (OrigArg0.get()->isTypeDependent() || OrigArg1.get()->isTypeDependent())
1134    return false;
1135
1136  // If the common type isn't a real floating type, then the arguments were
1137  // invalid for this operation.
1138  if (!Res->isRealFloatingType())
1139    return Diag(OrigArg0.get()->getLocStart(),
1140                diag::err_typecheck_call_invalid_ordered_compare)
1141      << OrigArg0.get()->getType() << OrigArg1.get()->getType()
1142      << SourceRange(OrigArg0.get()->getLocStart(), OrigArg1.get()->getLocEnd());
1143
1144  return false;
1145}
1146
1147/// SemaBuiltinSemaBuiltinFPClassification - Handle functions like
1148/// __builtin_isnan and friends.  This is declared to take (...), so we have
1149/// to check everything. We expect the last argument to be a floating point
1150/// value.
1151bool Sema::SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs) {
1152  if (TheCall->getNumArgs() < NumArgs)
1153    return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
1154      << 0 << NumArgs << TheCall->getNumArgs()/*function call*/;
1155  if (TheCall->getNumArgs() > NumArgs)
1156    return Diag(TheCall->getArg(NumArgs)->getLocStart(),
1157                diag::err_typecheck_call_too_many_args)
1158      << 0 /*function call*/ << NumArgs << TheCall->getNumArgs()
1159      << SourceRange(TheCall->getArg(NumArgs)->getLocStart(),
1160                     (*(TheCall->arg_end()-1))->getLocEnd());
1161
1162  Expr *OrigArg = TheCall->getArg(NumArgs-1);
1163
1164  if (OrigArg->isTypeDependent())
1165    return false;
1166
1167  // This operation requires a non-_Complex floating-point number.
1168  if (!OrigArg->getType()->isRealFloatingType())
1169    return Diag(OrigArg->getLocStart(),
1170                diag::err_typecheck_call_invalid_unary_fp)
1171      << OrigArg->getType() << OrigArg->getSourceRange();
1172
1173  // If this is an implicit conversion from float -> double, remove it.
1174  if (ImplicitCastExpr *Cast = dyn_cast<ImplicitCastExpr>(OrigArg)) {
1175    Expr *CastArg = Cast->getSubExpr();
1176    if (CastArg->getType()->isSpecificBuiltinType(BuiltinType::Float)) {
1177      assert(Cast->getType()->isSpecificBuiltinType(BuiltinType::Double) &&
1178             "promotion from float to double is the only expected cast here");
1179      Cast->setSubExpr(0);
1180      TheCall->setArg(NumArgs-1, CastArg);
1181      OrigArg = CastArg;
1182    }
1183  }
1184
1185  return false;
1186}
1187
1188/// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
1189// This is declared to take (...), so we have to check everything.
1190ExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) {
1191  if (TheCall->getNumArgs() < 2)
1192    return ExprError(Diag(TheCall->getLocEnd(),
1193                          diag::err_typecheck_call_too_few_args_at_least)
1194      << 0 /*function call*/ << 2 << TheCall->getNumArgs()
1195      << TheCall->getSourceRange());
1196
1197  // Determine which of the following types of shufflevector we're checking:
1198  // 1) unary, vector mask: (lhs, mask)
1199  // 2) binary, vector mask: (lhs, rhs, mask)
1200  // 3) binary, scalar mask: (lhs, rhs, index, ..., index)
1201  QualType resType = TheCall->getArg(0)->getType();
1202  unsigned numElements = 0;
1203
1204  if (!TheCall->getArg(0)->isTypeDependent() &&
1205      !TheCall->getArg(1)->isTypeDependent()) {
1206    QualType LHSType = TheCall->getArg(0)->getType();
1207    QualType RHSType = TheCall->getArg(1)->getType();
1208
1209    if (!LHSType->isVectorType() || !RHSType->isVectorType()) {
1210      Diag(TheCall->getLocStart(), diag::err_shufflevector_non_vector)
1211        << SourceRange(TheCall->getArg(0)->getLocStart(),
1212                       TheCall->getArg(1)->getLocEnd());
1213      return ExprError();
1214    }
1215
1216    numElements = LHSType->getAs<VectorType>()->getNumElements();
1217    unsigned numResElements = TheCall->getNumArgs() - 2;
1218
1219    // Check to see if we have a call with 2 vector arguments, the unary shuffle
1220    // with mask.  If so, verify that RHS is an integer vector type with the
1221    // same number of elts as lhs.
1222    if (TheCall->getNumArgs() == 2) {
1223      if (!RHSType->hasIntegerRepresentation() ||
1224          RHSType->getAs<VectorType>()->getNumElements() != numElements)
1225        Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
1226          << SourceRange(TheCall->getArg(1)->getLocStart(),
1227                         TheCall->getArg(1)->getLocEnd());
1228      numResElements = numElements;
1229    }
1230    else if (!Context.hasSameUnqualifiedType(LHSType, RHSType)) {
1231      Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
1232        << SourceRange(TheCall->getArg(0)->getLocStart(),
1233                       TheCall->getArg(1)->getLocEnd());
1234      return ExprError();
1235    } else if (numElements != numResElements) {
1236      QualType eltType = LHSType->getAs<VectorType>()->getElementType();
1237      resType = Context.getVectorType(eltType, numResElements,
1238                                      VectorType::GenericVector);
1239    }
1240  }
1241
1242  for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
1243    if (TheCall->getArg(i)->isTypeDependent() ||
1244        TheCall->getArg(i)->isValueDependent())
1245      continue;
1246
1247    llvm::APSInt Result(32);
1248    if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context))
1249      return ExprError(Diag(TheCall->getLocStart(),
1250                  diag::err_shufflevector_nonconstant_argument)
1251                << TheCall->getArg(i)->getSourceRange());
1252
1253    if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
1254      return ExprError(Diag(TheCall->getLocStart(),
1255                  diag::err_shufflevector_argument_too_large)
1256               << TheCall->getArg(i)->getSourceRange());
1257  }
1258
1259  SmallVector<Expr*, 32> exprs;
1260
1261  for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
1262    exprs.push_back(TheCall->getArg(i));
1263    TheCall->setArg(i, 0);
1264  }
1265
1266  return Owned(new (Context) ShuffleVectorExpr(Context, exprs.begin(),
1267                                            exprs.size(), resType,
1268                                            TheCall->getCallee()->getLocStart(),
1269                                            TheCall->getRParenLoc()));
1270}
1271
1272/// SemaBuiltinPrefetch - Handle __builtin_prefetch.
1273// This is declared to take (const void*, ...) and can take two
1274// optional constant int args.
1275bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
1276  unsigned NumArgs = TheCall->getNumArgs();
1277
1278  if (NumArgs > 3)
1279    return Diag(TheCall->getLocEnd(),
1280             diag::err_typecheck_call_too_many_args_at_most)
1281             << 0 /*function call*/ << 3 << NumArgs
1282             << TheCall->getSourceRange();
1283
1284  // Argument 0 is checked for us and the remaining arguments must be
1285  // constant integers.
1286  for (unsigned i = 1; i != NumArgs; ++i) {
1287    Expr *Arg = TheCall->getArg(i);
1288
1289    llvm::APSInt Result;
1290    if (SemaBuiltinConstantArg(TheCall, i, Result))
1291      return true;
1292
1293    // FIXME: gcc issues a warning and rewrites these to 0. These
1294    // seems especially odd for the third argument since the default
1295    // is 3.
1296    if (i == 1) {
1297      if (Result.getLimitedValue() > 1)
1298        return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
1299             << "0" << "1" << Arg->getSourceRange();
1300    } else {
1301      if (Result.getLimitedValue() > 3)
1302        return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
1303            << "0" << "3" << Arg->getSourceRange();
1304    }
1305  }
1306
1307  return false;
1308}
1309
1310/// SemaBuiltinConstantArg - Handle a check if argument ArgNum of CallExpr
1311/// TheCall is a constant expression.
1312bool Sema::SemaBuiltinConstantArg(CallExpr *TheCall, int ArgNum,
1313                                  llvm::APSInt &Result) {
1314  Expr *Arg = TheCall->getArg(ArgNum);
1315  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
1316  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
1317
1318  if (Arg->isTypeDependent() || Arg->isValueDependent()) return false;
1319
1320  if (!Arg->isIntegerConstantExpr(Result, Context))
1321    return Diag(TheCall->getLocStart(), diag::err_constant_integer_arg_type)
1322                << FDecl->getDeclName() <<  Arg->getSourceRange();
1323
1324  return false;
1325}
1326
1327/// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
1328/// int type). This simply type checks that type is one of the defined
1329/// constants (0-3).
1330// For compatibility check 0-3, llvm only handles 0 and 2.
1331bool Sema::SemaBuiltinObjectSize(CallExpr *TheCall) {
1332  llvm::APSInt Result;
1333
1334  // Check constant-ness first.
1335  if (SemaBuiltinConstantArg(TheCall, 1, Result))
1336    return true;
1337
1338  Expr *Arg = TheCall->getArg(1);
1339  if (Result.getSExtValue() < 0 || Result.getSExtValue() > 3) {
1340    return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
1341             << "0" << "3" << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
1342  }
1343
1344  return false;
1345}
1346
1347/// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
1348/// This checks that val is a constant 1.
1349bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
1350  Expr *Arg = TheCall->getArg(1);
1351  llvm::APSInt Result;
1352
1353  // TODO: This is less than ideal. Overload this to take a value.
1354  if (SemaBuiltinConstantArg(TheCall, 1, Result))
1355    return true;
1356
1357  if (Result != 1)
1358    return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
1359             << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
1360
1361  return false;
1362}
1363
1364// Handle i > 1 ? "x" : "y", recursively.
1365bool Sema::SemaCheckStringLiteral(const Expr *E, const CallExpr *TheCall,
1366                                  bool HasVAListArg,
1367                                  unsigned format_idx, unsigned firstDataArg,
1368                                  bool isPrintf, bool inFunctionCall) {
1369 tryAgain:
1370  if (E->isTypeDependent() || E->isValueDependent())
1371    return false;
1372
1373  E = E->IgnoreParens();
1374
1375  switch (E->getStmtClass()) {
1376  case Stmt::BinaryConditionalOperatorClass:
1377  case Stmt::ConditionalOperatorClass: {
1378    const AbstractConditionalOperator *C = cast<AbstractConditionalOperator>(E);
1379    return SemaCheckStringLiteral(C->getTrueExpr(), TheCall, HasVAListArg,
1380                                  format_idx, firstDataArg, isPrintf,
1381                                  inFunctionCall)
1382        && SemaCheckStringLiteral(C->getFalseExpr(), TheCall, HasVAListArg,
1383                                  format_idx, firstDataArg, isPrintf,
1384                                  inFunctionCall);
1385  }
1386
1387  case Stmt::IntegerLiteralClass:
1388    // Technically -Wformat-nonliteral does not warn about this case.
1389    // The behavior of printf and friends in this case is implementation
1390    // dependent.  Ideally if the format string cannot be null then
1391    // it should have a 'nonnull' attribute in the function prototype.
1392    return true;
1393
1394  case Stmt::ImplicitCastExprClass: {
1395    E = cast<ImplicitCastExpr>(E)->getSubExpr();
1396    goto tryAgain;
1397  }
1398
1399  case Stmt::OpaqueValueExprClass:
1400    if (const Expr *src = cast<OpaqueValueExpr>(E)->getSourceExpr()) {
1401      E = src;
1402      goto tryAgain;
1403    }
1404    return false;
1405
1406  case Stmt::PredefinedExprClass:
1407    // While __func__, etc., are technically not string literals, they
1408    // cannot contain format specifiers and thus are not a security
1409    // liability.
1410    return true;
1411
1412  case Stmt::DeclRefExprClass: {
1413    const DeclRefExpr *DR = cast<DeclRefExpr>(E);
1414
1415    // As an exception, do not flag errors for variables binding to
1416    // const string literals.
1417    if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
1418      bool isConstant = false;
1419      QualType T = DR->getType();
1420
1421      if (const ArrayType *AT = Context.getAsArrayType(T)) {
1422        isConstant = AT->getElementType().isConstant(Context);
1423      } else if (const PointerType *PT = T->getAs<PointerType>()) {
1424        isConstant = T.isConstant(Context) &&
1425                     PT->getPointeeType().isConstant(Context);
1426      }
1427
1428      if (isConstant) {
1429        if (const Expr *Init = VD->getAnyInitializer())
1430          return SemaCheckStringLiteral(Init, TheCall,
1431                                        HasVAListArg, format_idx, firstDataArg,
1432                                        isPrintf, /*inFunctionCall*/false);
1433      }
1434
1435      // For vprintf* functions (i.e., HasVAListArg==true), we add a
1436      // special check to see if the format string is a function parameter
1437      // of the function calling the printf function.  If the function
1438      // has an attribute indicating it is a printf-like function, then we
1439      // should suppress warnings concerning non-literals being used in a call
1440      // to a vprintf function.  For example:
1441      //
1442      // void
1443      // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
1444      //      va_list ap;
1445      //      va_start(ap, fmt);
1446      //      vprintf(fmt, ap);  // Do NOT emit a warning about "fmt".
1447      //      ...
1448      //
1449      //
1450      //  FIXME: We don't have full attribute support yet, so just check to see
1451      //    if the argument is a DeclRefExpr that references a parameter.  We'll
1452      //    add proper support for checking the attribute later.
1453      if (HasVAListArg)
1454        if (isa<ParmVarDecl>(VD))
1455          return true;
1456    }
1457
1458    return false;
1459  }
1460
1461  case Stmt::CallExprClass: {
1462    const CallExpr *CE = cast<CallExpr>(E);
1463    if (const ImplicitCastExpr *ICE
1464          = dyn_cast<ImplicitCastExpr>(CE->getCallee())) {
1465      if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ICE->getSubExpr())) {
1466        if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(DRE->getDecl())) {
1467          if (const FormatArgAttr *FA = FD->getAttr<FormatArgAttr>()) {
1468            unsigned ArgIndex = FA->getFormatIdx();
1469            const Expr *Arg = CE->getArg(ArgIndex - 1);
1470
1471            return SemaCheckStringLiteral(Arg, TheCall, HasVAListArg,
1472                                          format_idx, firstDataArg, isPrintf,
1473                                          inFunctionCall);
1474          }
1475        }
1476      }
1477    }
1478
1479    return false;
1480  }
1481  case Stmt::ObjCStringLiteralClass:
1482  case Stmt::StringLiteralClass: {
1483    const StringLiteral *StrE = NULL;
1484
1485    if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
1486      StrE = ObjCFExpr->getString();
1487    else
1488      StrE = cast<StringLiteral>(E);
1489
1490    if (StrE) {
1491      CheckFormatString(StrE, E, TheCall, HasVAListArg, format_idx,
1492                        firstDataArg, isPrintf, inFunctionCall);
1493      return true;
1494    }
1495
1496    return false;
1497  }
1498
1499  default:
1500    return false;
1501  }
1502}
1503
1504void
1505Sema::CheckNonNullArguments(const NonNullAttr *NonNull,
1506                            const Expr * const *ExprArgs,
1507                            SourceLocation CallSiteLoc) {
1508  for (NonNullAttr::args_iterator i = NonNull->args_begin(),
1509                                  e = NonNull->args_end();
1510       i != e; ++i) {
1511    const Expr *ArgExpr = ExprArgs[*i];
1512    if (ArgExpr->isNullPointerConstant(Context,
1513                                       Expr::NPC_ValueDependentIsNotNull))
1514      Diag(CallSiteLoc, diag::warn_null_arg) << ArgExpr->getSourceRange();
1515  }
1516}
1517
1518/// CheckPrintfScanfArguments - Check calls to printf and scanf (and similar
1519/// functions) for correct use of format strings.
1520void
1521Sema::CheckPrintfScanfArguments(const CallExpr *TheCall, bool HasVAListArg,
1522                                unsigned format_idx, unsigned firstDataArg,
1523                                bool isPrintf) {
1524
1525  const Expr *Fn = TheCall->getCallee();
1526
1527  // The way the format attribute works in GCC, the implicit this argument
1528  // of member functions is counted. However, it doesn't appear in our own
1529  // lists, so decrement format_idx in that case.
1530  if (isa<CXXMemberCallExpr>(TheCall)) {
1531    const CXXMethodDecl *method_decl =
1532      dyn_cast<CXXMethodDecl>(TheCall->getCalleeDecl());
1533    if (method_decl && method_decl->isInstance()) {
1534      // Catch a format attribute mistakenly referring to the object argument.
1535      if (format_idx == 0)
1536        return;
1537      --format_idx;
1538      if(firstDataArg != 0)
1539        --firstDataArg;
1540    }
1541  }
1542
1543  // CHECK: printf/scanf-like function is called with no format string.
1544  if (format_idx >= TheCall->getNumArgs()) {
1545    Diag(TheCall->getRParenLoc(), diag::warn_missing_format_string)
1546      << Fn->getSourceRange();
1547    return;
1548  }
1549
1550  const Expr *OrigFormatExpr = TheCall->getArg(format_idx)->IgnoreParenCasts();
1551
1552  // CHECK: format string is not a string literal.
1553  //
1554  // Dynamically generated format strings are difficult to
1555  // automatically vet at compile time.  Requiring that format strings
1556  // are string literals: (1) permits the checking of format strings by
1557  // the compiler and thereby (2) can practically remove the source of
1558  // many format string exploits.
1559
1560  // Format string can be either ObjC string (e.g. @"%d") or
1561  // C string (e.g. "%d")
1562  // ObjC string uses the same format specifiers as C string, so we can use
1563  // the same format string checking logic for both ObjC and C strings.
1564  if (SemaCheckStringLiteral(OrigFormatExpr, TheCall, HasVAListArg, format_idx,
1565                             firstDataArg, isPrintf))
1566    return;  // Literal format string found, check done!
1567
1568  // If there are no arguments specified, warn with -Wformat-security, otherwise
1569  // warn only with -Wformat-nonliteral.
1570  if (TheCall->getNumArgs() == format_idx+1)
1571    Diag(TheCall->getArg(format_idx)->getLocStart(),
1572         diag::warn_format_nonliteral_noargs)
1573      << OrigFormatExpr->getSourceRange();
1574  else
1575    Diag(TheCall->getArg(format_idx)->getLocStart(),
1576         diag::warn_format_nonliteral)
1577           << OrigFormatExpr->getSourceRange();
1578}
1579
1580namespace {
1581class CheckFormatHandler : public analyze_format_string::FormatStringHandler {
1582protected:
1583  Sema &S;
1584  const StringLiteral *FExpr;
1585  const Expr *OrigFormatExpr;
1586  const unsigned FirstDataArg;
1587  const unsigned NumDataArgs;
1588  const bool IsObjCLiteral;
1589  const char *Beg; // Start of format string.
1590  const bool HasVAListArg;
1591  const CallExpr *TheCall;
1592  unsigned FormatIdx;
1593  llvm::BitVector CoveredArgs;
1594  bool usesPositionalArgs;
1595  bool atFirstArg;
1596  bool inFunctionCall;
1597public:
1598  CheckFormatHandler(Sema &s, const StringLiteral *fexpr,
1599                     const Expr *origFormatExpr, unsigned firstDataArg,
1600                     unsigned numDataArgs, bool isObjCLiteral,
1601                     const char *beg, bool hasVAListArg,
1602                     const CallExpr *theCall, unsigned formatIdx,
1603                     bool inFunctionCall)
1604    : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
1605      FirstDataArg(firstDataArg),
1606      NumDataArgs(numDataArgs),
1607      IsObjCLiteral(isObjCLiteral), Beg(beg),
1608      HasVAListArg(hasVAListArg),
1609      TheCall(theCall), FormatIdx(formatIdx),
1610      usesPositionalArgs(false), atFirstArg(true),
1611      inFunctionCall(inFunctionCall) {
1612        CoveredArgs.resize(numDataArgs);
1613        CoveredArgs.reset();
1614      }
1615
1616  void DoneProcessing();
1617
1618  void HandleIncompleteSpecifier(const char *startSpecifier,
1619                                 unsigned specifierLen);
1620
1621  virtual void HandleInvalidPosition(const char *startSpecifier,
1622                                     unsigned specifierLen,
1623                                     analyze_format_string::PositionContext p);
1624
1625  virtual void HandleZeroPosition(const char *startPos, unsigned posLen);
1626
1627  void HandleNullChar(const char *nullCharacter);
1628
1629  template <typename Range>
1630  static void EmitFormatDiagnostic(Sema &S, bool inFunctionCall,
1631                                   const Expr *ArgumentExpr,
1632                                   PartialDiagnostic PDiag,
1633                                   SourceLocation StringLoc,
1634                                   bool IsStringLocation, Range StringRange,
1635                                   FixItHint Fixit = FixItHint());
1636
1637protected:
1638  bool HandleInvalidConversionSpecifier(unsigned argIndex, SourceLocation Loc,
1639                                        const char *startSpec,
1640                                        unsigned specifierLen,
1641                                        const char *csStart, unsigned csLen);
1642
1643  void HandlePositionalNonpositionalArgs(SourceLocation Loc,
1644                                         const char *startSpec,
1645                                         unsigned specifierLen);
1646
1647  SourceRange getFormatStringRange();
1648  CharSourceRange getSpecifierRange(const char *startSpecifier,
1649                                    unsigned specifierLen);
1650  SourceLocation getLocationOfByte(const char *x);
1651
1652  const Expr *getDataArg(unsigned i) const;
1653
1654  bool CheckNumArgs(const analyze_format_string::FormatSpecifier &FS,
1655                    const analyze_format_string::ConversionSpecifier &CS,
1656                    const char *startSpecifier, unsigned specifierLen,
1657                    unsigned argIndex);
1658
1659  template <typename Range>
1660  void EmitFormatDiagnostic(PartialDiagnostic PDiag, SourceLocation StringLoc,
1661                            bool IsStringLocation, Range StringRange,
1662                            FixItHint Fixit = FixItHint());
1663
1664  void CheckPositionalAndNonpositionalArgs(
1665      const analyze_format_string::FormatSpecifier *FS);
1666};
1667}
1668
1669SourceRange CheckFormatHandler::getFormatStringRange() {
1670  return OrigFormatExpr->getSourceRange();
1671}
1672
1673CharSourceRange CheckFormatHandler::
1674getSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
1675  SourceLocation Start = getLocationOfByte(startSpecifier);
1676  SourceLocation End   = getLocationOfByte(startSpecifier + specifierLen - 1);
1677
1678  // Advance the end SourceLocation by one due to half-open ranges.
1679  End = End.getLocWithOffset(1);
1680
1681  return CharSourceRange::getCharRange(Start, End);
1682}
1683
1684SourceLocation CheckFormatHandler::getLocationOfByte(const char *x) {
1685  return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
1686}
1687
1688void CheckFormatHandler::HandleIncompleteSpecifier(const char *startSpecifier,
1689                                                   unsigned specifierLen){
1690  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_incomplete_specifier),
1691                       getLocationOfByte(startSpecifier),
1692                       /*IsStringLocation*/true,
1693                       getSpecifierRange(startSpecifier, specifierLen));
1694}
1695
1696void
1697CheckFormatHandler::HandleInvalidPosition(const char *startPos, unsigned posLen,
1698                                     analyze_format_string::PositionContext p) {
1699  EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_positional_specifier)
1700                         << (unsigned) p,
1701                       getLocationOfByte(startPos), /*IsStringLocation*/true,
1702                       getSpecifierRange(startPos, posLen));
1703}
1704
1705void CheckFormatHandler::HandleZeroPosition(const char *startPos,
1706                                            unsigned posLen) {
1707  EmitFormatDiagnostic(S.PDiag(diag::warn_format_zero_positional_specifier),
1708                               getLocationOfByte(startPos),
1709                               /*IsStringLocation*/true,
1710                               getSpecifierRange(startPos, posLen));
1711}
1712
1713void CheckFormatHandler::HandleNullChar(const char *nullCharacter) {
1714  if (!IsObjCLiteral) {
1715    // The presence of a null character is likely an error.
1716    EmitFormatDiagnostic(
1717      S.PDiag(diag::warn_printf_format_string_contains_null_char),
1718      getLocationOfByte(nullCharacter), /*IsStringLocation*/true,
1719      getFormatStringRange());
1720  }
1721}
1722
1723const Expr *CheckFormatHandler::getDataArg(unsigned i) const {
1724  return TheCall->getArg(FirstDataArg + i);
1725}
1726
1727void CheckFormatHandler::DoneProcessing() {
1728    // Does the number of data arguments exceed the number of
1729    // format conversions in the format string?
1730  if (!HasVAListArg) {
1731      // Find any arguments that weren't covered.
1732    CoveredArgs.flip();
1733    signed notCoveredArg = CoveredArgs.find_first();
1734    if (notCoveredArg >= 0) {
1735      assert((unsigned)notCoveredArg < NumDataArgs);
1736      EmitFormatDiagnostic(S.PDiag(diag::warn_printf_data_arg_not_used),
1737                           getDataArg((unsigned) notCoveredArg)->getLocStart(),
1738                           /*IsStringLocation*/false, getFormatStringRange());
1739    }
1740  }
1741}
1742
1743bool
1744CheckFormatHandler::HandleInvalidConversionSpecifier(unsigned argIndex,
1745                                                     SourceLocation Loc,
1746                                                     const char *startSpec,
1747                                                     unsigned specifierLen,
1748                                                     const char *csStart,
1749                                                     unsigned csLen) {
1750
1751  bool keepGoing = true;
1752  if (argIndex < NumDataArgs) {
1753    // Consider the argument coverered, even though the specifier doesn't
1754    // make sense.
1755    CoveredArgs.set(argIndex);
1756  }
1757  else {
1758    // If argIndex exceeds the number of data arguments we
1759    // don't issue a warning because that is just a cascade of warnings (and
1760    // they may have intended '%%' anyway). We don't want to continue processing
1761    // the format string after this point, however, as we will like just get
1762    // gibberish when trying to match arguments.
1763    keepGoing = false;
1764  }
1765
1766  EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_conversion)
1767                         << StringRef(csStart, csLen),
1768                       Loc, /*IsStringLocation*/true,
1769                       getSpecifierRange(startSpec, specifierLen));
1770
1771  return keepGoing;
1772}
1773
1774void
1775CheckFormatHandler::HandlePositionalNonpositionalArgs(SourceLocation Loc,
1776                                                      const char *startSpec,
1777                                                      unsigned specifierLen) {
1778  EmitFormatDiagnostic(
1779    S.PDiag(diag::warn_format_mix_positional_nonpositional_args),
1780    Loc, /*isStringLoc*/true, getSpecifierRange(startSpec, specifierLen));
1781}
1782
1783bool
1784CheckFormatHandler::CheckNumArgs(
1785  const analyze_format_string::FormatSpecifier &FS,
1786  const analyze_format_string::ConversionSpecifier &CS,
1787  const char *startSpecifier, unsigned specifierLen, unsigned argIndex) {
1788
1789  if (argIndex >= NumDataArgs) {
1790    PartialDiagnostic PDiag = FS.usesPositionalArg()
1791      ? (S.PDiag(diag::warn_printf_positional_arg_exceeds_data_args)
1792           << (argIndex+1) << NumDataArgs)
1793      : S.PDiag(diag::warn_printf_insufficient_data_args);
1794    EmitFormatDiagnostic(
1795      PDiag, getLocationOfByte(CS.getStart()), /*IsStringLocation*/true,
1796      getSpecifierRange(startSpecifier, specifierLen));
1797    return false;
1798  }
1799  return true;
1800}
1801
1802template<typename Range>
1803void CheckFormatHandler::EmitFormatDiagnostic(PartialDiagnostic PDiag,
1804                                              SourceLocation Loc,
1805                                              bool IsStringLocation,
1806                                              Range StringRange,
1807                                              FixItHint FixIt) {
1808  EmitFormatDiagnostic(S, inFunctionCall, TheCall->getArg(FormatIdx), PDiag,
1809                       Loc, IsStringLocation, StringRange, FixIt);
1810}
1811
1812/// \brief If the format string is not within the funcion call, emit a note
1813/// so that the function call and string are in diagnostic messages.
1814///
1815/// \param inFunctionCall if true, the format string is within the function
1816/// call and only one diagnostic message will be produced.  Otherwise, an
1817/// extra note will be emitted pointing to location of the format string.
1818///
1819/// \param ArgumentExpr the expression that is passed as the format string
1820/// argument in the function call.  Used for getting locations when two
1821/// diagnostics are emitted.
1822///
1823/// \param PDiag the callee should already have provided any strings for the
1824/// diagnostic message.  This function only adds locations and fixits
1825/// to diagnostics.
1826///
1827/// \param Loc primary location for diagnostic.  If two diagnostics are
1828/// required, one will be at Loc and a new SourceLocation will be created for
1829/// the other one.
1830///
1831/// \param IsStringLocation if true, Loc points to the format string should be
1832/// used for the note.  Otherwise, Loc points to the argument list and will
1833/// be used with PDiag.
1834///
1835/// \param StringRange some or all of the string to highlight.  This is
1836/// templated so it can accept either a CharSourceRange or a SourceRange.
1837///
1838/// \param Fixit optional fix it hint for the format string.
1839template<typename Range>
1840void CheckFormatHandler::EmitFormatDiagnostic(Sema &S, bool InFunctionCall,
1841                                              const Expr *ArgumentExpr,
1842                                              PartialDiagnostic PDiag,
1843                                              SourceLocation Loc,
1844                                              bool IsStringLocation,
1845                                              Range StringRange,
1846                                              FixItHint FixIt) {
1847  if (InFunctionCall)
1848    S.Diag(Loc, PDiag) << StringRange << FixIt;
1849  else {
1850    S.Diag(IsStringLocation ? ArgumentExpr->getExprLoc() : Loc, PDiag)
1851      << ArgumentExpr->getSourceRange();
1852    S.Diag(IsStringLocation ? Loc : StringRange.getBegin(),
1853           diag::note_format_string_defined)
1854      << StringRange << FixIt;
1855  }
1856}
1857
1858//===--- CHECK: Printf format string checking ------------------------------===//
1859
1860namespace {
1861class CheckPrintfHandler : public CheckFormatHandler {
1862public:
1863  CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
1864                     const Expr *origFormatExpr, unsigned firstDataArg,
1865                     unsigned numDataArgs, bool isObjCLiteral,
1866                     const char *beg, bool hasVAListArg,
1867                     const CallExpr *theCall, unsigned formatIdx,
1868                     bool inFunctionCall)
1869  : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg,
1870                       numDataArgs, isObjCLiteral, beg, hasVAListArg,
1871                       theCall, formatIdx, inFunctionCall) {}
1872
1873
1874  bool HandleInvalidPrintfConversionSpecifier(
1875                                      const analyze_printf::PrintfSpecifier &FS,
1876                                      const char *startSpecifier,
1877                                      unsigned specifierLen);
1878
1879  bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
1880                             const char *startSpecifier,
1881                             unsigned specifierLen);
1882
1883  bool HandleAmount(const analyze_format_string::OptionalAmount &Amt, unsigned k,
1884                    const char *startSpecifier, unsigned specifierLen);
1885  void HandleInvalidAmount(const analyze_printf::PrintfSpecifier &FS,
1886                           const analyze_printf::OptionalAmount &Amt,
1887                           unsigned type,
1888                           const char *startSpecifier, unsigned specifierLen);
1889  void HandleFlag(const analyze_printf::PrintfSpecifier &FS,
1890                  const analyze_printf::OptionalFlag &flag,
1891                  const char *startSpecifier, unsigned specifierLen);
1892  void HandleIgnoredFlag(const analyze_printf::PrintfSpecifier &FS,
1893                         const analyze_printf::OptionalFlag &ignoredFlag,
1894                         const analyze_printf::OptionalFlag &flag,
1895                         const char *startSpecifier, unsigned specifierLen);
1896};
1897}
1898
1899bool CheckPrintfHandler::HandleInvalidPrintfConversionSpecifier(
1900                                      const analyze_printf::PrintfSpecifier &FS,
1901                                      const char *startSpecifier,
1902                                      unsigned specifierLen) {
1903  const analyze_printf::PrintfConversionSpecifier &CS =
1904    FS.getConversionSpecifier();
1905
1906  return HandleInvalidConversionSpecifier(FS.getArgIndex(),
1907                                          getLocationOfByte(CS.getStart()),
1908                                          startSpecifier, specifierLen,
1909                                          CS.getStart(), CS.getLength());
1910}
1911
1912bool CheckPrintfHandler::HandleAmount(
1913                               const analyze_format_string::OptionalAmount &Amt,
1914                               unsigned k, const char *startSpecifier,
1915                               unsigned specifierLen) {
1916
1917  if (Amt.hasDataArgument()) {
1918    if (!HasVAListArg) {
1919      unsigned argIndex = Amt.getArgIndex();
1920      if (argIndex >= NumDataArgs) {
1921        EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_missing_arg)
1922                               << k,
1923                             getLocationOfByte(Amt.getStart()),
1924                             /*IsStringLocation*/true,
1925                             getSpecifierRange(startSpecifier, specifierLen));
1926        // Don't do any more checking.  We will just emit
1927        // spurious errors.
1928        return false;
1929      }
1930
1931      // Type check the data argument.  It should be an 'int'.
1932      // Although not in conformance with C99, we also allow the argument to be
1933      // an 'unsigned int' as that is a reasonably safe case.  GCC also
1934      // doesn't emit a warning for that case.
1935      CoveredArgs.set(argIndex);
1936      const Expr *Arg = getDataArg(argIndex);
1937      QualType T = Arg->getType();
1938
1939      const analyze_printf::ArgTypeResult &ATR = Amt.getArgType(S.Context);
1940      assert(ATR.isValid());
1941
1942      if (!ATR.matchesType(S.Context, T)) {
1943        EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_wrong_type)
1944                               << k << ATR.getRepresentativeTypeName(S.Context)
1945                               << T << Arg->getSourceRange(),
1946                             getLocationOfByte(Amt.getStart()),
1947                             /*IsStringLocation*/true,
1948                             getSpecifierRange(startSpecifier, specifierLen));
1949        // Don't do any more checking.  We will just emit
1950        // spurious errors.
1951        return false;
1952      }
1953    }
1954  }
1955  return true;
1956}
1957
1958void CheckPrintfHandler::HandleInvalidAmount(
1959                                      const analyze_printf::PrintfSpecifier &FS,
1960                                      const analyze_printf::OptionalAmount &Amt,
1961                                      unsigned type,
1962                                      const char *startSpecifier,
1963                                      unsigned specifierLen) {
1964  const analyze_printf::PrintfConversionSpecifier &CS =
1965    FS.getConversionSpecifier();
1966
1967  FixItHint fixit =
1968    Amt.getHowSpecified() == analyze_printf::OptionalAmount::Constant
1969      ? FixItHint::CreateRemoval(getSpecifierRange(Amt.getStart(),
1970                                 Amt.getConstantLength()))
1971      : FixItHint();
1972
1973  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_optional_amount)
1974                         << type << CS.toString(),
1975                       getLocationOfByte(Amt.getStart()),
1976                       /*IsStringLocation*/true,
1977                       getSpecifierRange(startSpecifier, specifierLen),
1978                       fixit);
1979}
1980
1981void CheckPrintfHandler::HandleFlag(const analyze_printf::PrintfSpecifier &FS,
1982                                    const analyze_printf::OptionalFlag &flag,
1983                                    const char *startSpecifier,
1984                                    unsigned specifierLen) {
1985  // Warn about pointless flag with a fixit removal.
1986  const analyze_printf::PrintfConversionSpecifier &CS =
1987    FS.getConversionSpecifier();
1988  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_flag)
1989                         << flag.toString() << CS.toString(),
1990                       getLocationOfByte(flag.getPosition()),
1991                       /*IsStringLocation*/true,
1992                       getSpecifierRange(startSpecifier, specifierLen),
1993                       FixItHint::CreateRemoval(
1994                         getSpecifierRange(flag.getPosition(), 1)));
1995}
1996
1997void CheckPrintfHandler::HandleIgnoredFlag(
1998                                const analyze_printf::PrintfSpecifier &FS,
1999                                const analyze_printf::OptionalFlag &ignoredFlag,
2000                                const analyze_printf::OptionalFlag &flag,
2001                                const char *startSpecifier,
2002                                unsigned specifierLen) {
2003  // Warn about ignored flag with a fixit removal.
2004  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_ignored_flag)
2005                         << ignoredFlag.toString() << flag.toString(),
2006                       getLocationOfByte(ignoredFlag.getPosition()),
2007                       /*IsStringLocation*/true,
2008                       getSpecifierRange(startSpecifier, specifierLen),
2009                       FixItHint::CreateRemoval(
2010                         getSpecifierRange(ignoredFlag.getPosition(), 1)));
2011}
2012
2013bool
2014CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
2015                                            &FS,
2016                                          const char *startSpecifier,
2017                                          unsigned specifierLen) {
2018
2019  using namespace analyze_format_string;
2020  using namespace analyze_printf;
2021  const PrintfConversionSpecifier &CS = FS.getConversionSpecifier();
2022
2023  if (FS.consumesDataArgument()) {
2024    if (atFirstArg) {
2025        atFirstArg = false;
2026        usesPositionalArgs = FS.usesPositionalArg();
2027    }
2028    else if (usesPositionalArgs != FS.usesPositionalArg()) {
2029      HandlePositionalNonpositionalArgs(getLocationOfByte(CS.getStart()),
2030                                        startSpecifier, specifierLen);
2031      return false;
2032    }
2033  }
2034
2035  // First check if the field width, precision, and conversion specifier
2036  // have matching data arguments.
2037  if (!HandleAmount(FS.getFieldWidth(), /* field width */ 0,
2038                    startSpecifier, specifierLen)) {
2039    return false;
2040  }
2041
2042  if (!HandleAmount(FS.getPrecision(), /* precision */ 1,
2043                    startSpecifier, specifierLen)) {
2044    return false;
2045  }
2046
2047  if (!CS.consumesDataArgument()) {
2048    // FIXME: Technically specifying a precision or field width here
2049    // makes no sense.  Worth issuing a warning at some point.
2050    return true;
2051  }
2052
2053  // Consume the argument.
2054  unsigned argIndex = FS.getArgIndex();
2055  if (argIndex < NumDataArgs) {
2056    // The check to see if the argIndex is valid will come later.
2057    // We set the bit here because we may exit early from this
2058    // function if we encounter some other error.
2059    CoveredArgs.set(argIndex);
2060  }
2061
2062  // Check for using an Objective-C specific conversion specifier
2063  // in a non-ObjC literal.
2064  if (!IsObjCLiteral && CS.isObjCArg()) {
2065    return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier,
2066                                                  specifierLen);
2067  }
2068
2069  // Check for invalid use of field width
2070  if (!FS.hasValidFieldWidth()) {
2071    HandleInvalidAmount(FS, FS.getFieldWidth(), /* field width */ 0,
2072        startSpecifier, specifierLen);
2073  }
2074
2075  // Check for invalid use of precision
2076  if (!FS.hasValidPrecision()) {
2077    HandleInvalidAmount(FS, FS.getPrecision(), /* precision */ 1,
2078        startSpecifier, specifierLen);
2079  }
2080
2081  // Check each flag does not conflict with any other component.
2082  if (!FS.hasValidThousandsGroupingPrefix())
2083    HandleFlag(FS, FS.hasThousandsGrouping(), startSpecifier, specifierLen);
2084  if (!FS.hasValidLeadingZeros())
2085    HandleFlag(FS, FS.hasLeadingZeros(), startSpecifier, specifierLen);
2086  if (!FS.hasValidPlusPrefix())
2087    HandleFlag(FS, FS.hasPlusPrefix(), startSpecifier, specifierLen);
2088  if (!FS.hasValidSpacePrefix())
2089    HandleFlag(FS, FS.hasSpacePrefix(), startSpecifier, specifierLen);
2090  if (!FS.hasValidAlternativeForm())
2091    HandleFlag(FS, FS.hasAlternativeForm(), startSpecifier, specifierLen);
2092  if (!FS.hasValidLeftJustified())
2093    HandleFlag(FS, FS.isLeftJustified(), startSpecifier, specifierLen);
2094
2095  // Check that flags are not ignored by another flag
2096  if (FS.hasSpacePrefix() && FS.hasPlusPrefix()) // ' ' ignored by '+'
2097    HandleIgnoredFlag(FS, FS.hasSpacePrefix(), FS.hasPlusPrefix(),
2098        startSpecifier, specifierLen);
2099  if (FS.hasLeadingZeros() && FS.isLeftJustified()) // '0' ignored by '-'
2100    HandleIgnoredFlag(FS, FS.hasLeadingZeros(), FS.isLeftJustified(),
2101            startSpecifier, specifierLen);
2102
2103  // Check the length modifier is valid with the given conversion specifier.
2104  const LengthModifier &LM = FS.getLengthModifier();
2105  if (!FS.hasValidLengthModifier())
2106    EmitFormatDiagnostic(S.PDiag(diag::warn_format_nonsensical_length)
2107                           << LM.toString() << CS.toString(),
2108                         getLocationOfByte(LM.getStart()),
2109                         /*IsStringLocation*/true,
2110                         getSpecifierRange(startSpecifier, specifierLen),
2111                         FixItHint::CreateRemoval(
2112                           getSpecifierRange(LM.getStart(),
2113                                             LM.getLength())));
2114
2115  // Are we using '%n'?
2116  if (CS.getKind() == ConversionSpecifier::nArg) {
2117    // Issue a warning about this being a possible security issue.
2118    EmitFormatDiagnostic(S.PDiag(diag::warn_printf_write_back),
2119                         getLocationOfByte(CS.getStart()),
2120                         /*IsStringLocation*/true,
2121                         getSpecifierRange(startSpecifier, specifierLen));
2122    // Continue checking the other format specifiers.
2123    return true;
2124  }
2125
2126  // The remaining checks depend on the data arguments.
2127  if (HasVAListArg)
2128    return true;
2129
2130  if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
2131    return false;
2132
2133  // Now type check the data expression that matches the
2134  // format specifier.
2135  const Expr *Ex = getDataArg(argIndex);
2136  const analyze_printf::ArgTypeResult &ATR = FS.getArgType(S.Context);
2137  if (ATR.isValid() && !ATR.matchesType(S.Context, Ex->getType())) {
2138    // Check if we didn't match because of an implicit cast from a 'char'
2139    // or 'short' to an 'int'.  This is done because printf is a varargs
2140    // function.
2141    if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Ex))
2142      if (ICE->getType() == S.Context.IntTy) {
2143        // All further checking is done on the subexpression.
2144        Ex = ICE->getSubExpr();
2145        if (ATR.matchesType(S.Context, Ex->getType()))
2146          return true;
2147      }
2148
2149    // We may be able to offer a FixItHint if it is a supported type.
2150    PrintfSpecifier fixedFS = FS;
2151    bool success = fixedFS.fixType(Ex->getType(), S.getLangOptions());
2152
2153    if (success) {
2154      // Get the fix string from the fixed format specifier
2155      llvm::SmallString<128> buf;
2156      llvm::raw_svector_ostream os(buf);
2157      fixedFS.toString(os);
2158
2159      EmitFormatDiagnostic(
2160        S.PDiag(diag::warn_printf_conversion_argument_type_mismatch)
2161          << ATR.getRepresentativeTypeName(S.Context) << Ex->getType()
2162          << Ex->getSourceRange(),
2163        getLocationOfByte(CS.getStart()),
2164        /*IsStringLocation*/true,
2165        getSpecifierRange(startSpecifier, specifierLen),
2166        FixItHint::CreateReplacement(
2167          getSpecifierRange(startSpecifier, specifierLen),
2168          os.str()));
2169    }
2170    else {
2171      S.Diag(getLocationOfByte(CS.getStart()),
2172             diag::warn_printf_conversion_argument_type_mismatch)
2173        << ATR.getRepresentativeTypeName(S.Context) << Ex->getType()
2174        << getSpecifierRange(startSpecifier, specifierLen)
2175        << Ex->getSourceRange();
2176    }
2177  }
2178
2179  return true;
2180}
2181
2182//===--- CHECK: Scanf format string checking ------------------------------===//
2183
2184namespace {
2185class CheckScanfHandler : public CheckFormatHandler {
2186public:
2187  CheckScanfHandler(Sema &s, const StringLiteral *fexpr,
2188                    const Expr *origFormatExpr, unsigned firstDataArg,
2189                    unsigned numDataArgs, bool isObjCLiteral,
2190                    const char *beg, bool hasVAListArg,
2191                    const CallExpr *theCall, unsigned formatIdx,
2192                    bool inFunctionCall)
2193  : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg,
2194                       numDataArgs, isObjCLiteral, beg, hasVAListArg,
2195                       theCall, formatIdx, inFunctionCall) {}
2196
2197  bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,
2198                            const char *startSpecifier,
2199                            unsigned specifierLen);
2200
2201  bool HandleInvalidScanfConversionSpecifier(
2202          const analyze_scanf::ScanfSpecifier &FS,
2203          const char *startSpecifier,
2204          unsigned specifierLen);
2205
2206  void HandleIncompleteScanList(const char *start, const char *end);
2207};
2208}
2209
2210void CheckScanfHandler::HandleIncompleteScanList(const char *start,
2211                                                 const char *end) {
2212  EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_scanlist_incomplete),
2213                       getLocationOfByte(end), /*IsStringLocation*/true,
2214                       getSpecifierRange(start, end - start));
2215}
2216
2217bool CheckScanfHandler::HandleInvalidScanfConversionSpecifier(
2218                                        const analyze_scanf::ScanfSpecifier &FS,
2219                                        const char *startSpecifier,
2220                                        unsigned specifierLen) {
2221
2222  const analyze_scanf::ScanfConversionSpecifier &CS =
2223    FS.getConversionSpecifier();
2224
2225  return HandleInvalidConversionSpecifier(FS.getArgIndex(),
2226                                          getLocationOfByte(CS.getStart()),
2227                                          startSpecifier, specifierLen,
2228                                          CS.getStart(), CS.getLength());
2229}
2230
2231bool CheckScanfHandler::HandleScanfSpecifier(
2232                                       const analyze_scanf::ScanfSpecifier &FS,
2233                                       const char *startSpecifier,
2234                                       unsigned specifierLen) {
2235
2236  using namespace analyze_scanf;
2237  using namespace analyze_format_string;
2238
2239  const ScanfConversionSpecifier &CS = FS.getConversionSpecifier();
2240
2241  // Handle case where '%' and '*' don't consume an argument.  These shouldn't
2242  // be used to decide if we are using positional arguments consistently.
2243  if (FS.consumesDataArgument()) {
2244    if (atFirstArg) {
2245      atFirstArg = false;
2246      usesPositionalArgs = FS.usesPositionalArg();
2247    }
2248    else if (usesPositionalArgs != FS.usesPositionalArg()) {
2249      HandlePositionalNonpositionalArgs(getLocationOfByte(CS.getStart()),
2250                                        startSpecifier, specifierLen);
2251      return false;
2252    }
2253  }
2254
2255  // Check if the field with is non-zero.
2256  const OptionalAmount &Amt = FS.getFieldWidth();
2257  if (Amt.getHowSpecified() == OptionalAmount::Constant) {
2258    if (Amt.getConstantAmount() == 0) {
2259      const CharSourceRange &R = getSpecifierRange(Amt.getStart(),
2260                                                   Amt.getConstantLength());
2261      EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_nonzero_width),
2262                           getLocationOfByte(Amt.getStart()),
2263                           /*IsStringLocation*/true, R,
2264                           FixItHint::CreateRemoval(R));
2265    }
2266  }
2267
2268  if (!FS.consumesDataArgument()) {
2269    // FIXME: Technically specifying a precision or field width here
2270    // makes no sense.  Worth issuing a warning at some point.
2271    return true;
2272  }
2273
2274  // Consume the argument.
2275  unsigned argIndex = FS.getArgIndex();
2276  if (argIndex < NumDataArgs) {
2277      // The check to see if the argIndex is valid will come later.
2278      // We set the bit here because we may exit early from this
2279      // function if we encounter some other error.
2280    CoveredArgs.set(argIndex);
2281  }
2282
2283  // Check the length modifier is valid with the given conversion specifier.
2284  const LengthModifier &LM = FS.getLengthModifier();
2285  if (!FS.hasValidLengthModifier()) {
2286    S.Diag(getLocationOfByte(LM.getStart()),
2287           diag::warn_format_nonsensical_length)
2288      << LM.toString() << CS.toString()
2289      << getSpecifierRange(startSpecifier, specifierLen)
2290      << FixItHint::CreateRemoval(getSpecifierRange(LM.getStart(),
2291                                                    LM.getLength()));
2292  }
2293
2294  // The remaining checks depend on the data arguments.
2295  if (HasVAListArg)
2296    return true;
2297
2298  if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
2299    return false;
2300
2301  // Check that the argument type matches the format specifier.
2302  const Expr *Ex = getDataArg(argIndex);
2303  const analyze_scanf::ScanfArgTypeResult &ATR = FS.getArgType(S.Context);
2304  if (ATR.isValid() && !ATR.matchesType(S.Context, Ex->getType())) {
2305    ScanfSpecifier fixedFS = FS;
2306    bool success = fixedFS.fixType(Ex->getType(), S.getLangOptions());
2307
2308    if (success) {
2309      // Get the fix string from the fixed format specifier.
2310      llvm::SmallString<128> buf;
2311      llvm::raw_svector_ostream os(buf);
2312      fixedFS.toString(os);
2313
2314      EmitFormatDiagnostic(
2315        S.PDiag(diag::warn_printf_conversion_argument_type_mismatch)
2316          << ATR.getRepresentativeTypeName(S.Context) << Ex->getType()
2317          << Ex->getSourceRange(),
2318        getLocationOfByte(CS.getStart()),
2319        /*IsStringLocation*/true,
2320        getSpecifierRange(startSpecifier, specifierLen),
2321        FixItHint::CreateReplacement(
2322          getSpecifierRange(startSpecifier, specifierLen),
2323          os.str()));
2324    } else {
2325      S.Diag(getLocationOfByte(CS.getStart()),
2326             diag::warn_printf_conversion_argument_type_mismatch)
2327          << ATR.getRepresentativeTypeName(S.Context) << Ex->getType()
2328          << getSpecifierRange(startSpecifier, specifierLen)
2329          << Ex->getSourceRange();
2330    }
2331  }
2332
2333  return true;
2334}
2335
2336void Sema::CheckFormatString(const StringLiteral *FExpr,
2337                             const Expr *OrigFormatExpr,
2338                             const CallExpr *TheCall, bool HasVAListArg,
2339                             unsigned format_idx, unsigned firstDataArg,
2340                             bool isPrintf, bool inFunctionCall) {
2341
2342  // CHECK: is the format string a wide literal?
2343  if (!FExpr->isAscii()) {
2344    CheckFormatHandler::EmitFormatDiagnostic(
2345      *this, inFunctionCall, TheCall->getArg(format_idx),
2346      PDiag(diag::warn_format_string_is_wide_literal), FExpr->getLocStart(),
2347      /*IsStringLocation*/true, OrigFormatExpr->getSourceRange());
2348    return;
2349  }
2350
2351  // Str - The format string.  NOTE: this is NOT null-terminated!
2352  StringRef StrRef = FExpr->getString();
2353  const char *Str = StrRef.data();
2354  unsigned StrLen = StrRef.size();
2355  const unsigned numDataArgs = TheCall->getNumArgs() - firstDataArg;
2356
2357  // CHECK: empty format string?
2358  if (StrLen == 0 && numDataArgs > 0) {
2359    CheckFormatHandler::EmitFormatDiagnostic(
2360      *this, inFunctionCall, TheCall->getArg(format_idx),
2361      PDiag(diag::warn_empty_format_string), FExpr->getLocStart(),
2362      /*IsStringLocation*/true, OrigFormatExpr->getSourceRange());
2363    return;
2364  }
2365
2366  if (isPrintf) {
2367    CheckPrintfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg,
2368                         numDataArgs, isa<ObjCStringLiteral>(OrigFormatExpr),
2369                         Str, HasVAListArg, TheCall, format_idx,
2370                         inFunctionCall);
2371
2372    if (!analyze_format_string::ParsePrintfString(H, Str, Str + StrLen,
2373                                                  getLangOptions()))
2374      H.DoneProcessing();
2375  }
2376  else {
2377    CheckScanfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg,
2378                        numDataArgs, isa<ObjCStringLiteral>(OrigFormatExpr),
2379                        Str, HasVAListArg, TheCall, format_idx,
2380                        inFunctionCall);
2381
2382    if (!analyze_format_string::ParseScanfString(H, Str, Str + StrLen,
2383                                                 getLangOptions()))
2384      H.DoneProcessing();
2385  }
2386}
2387
2388//===--- CHECK: Standard memory functions ---------------------------------===//
2389
2390/// \brief Determine whether the given type is a dynamic class type (e.g.,
2391/// whether it has a vtable).
2392static bool isDynamicClassType(QualType T) {
2393  if (CXXRecordDecl *Record = T->getAsCXXRecordDecl())
2394    if (CXXRecordDecl *Definition = Record->getDefinition())
2395      if (Definition->isDynamicClass())
2396        return true;
2397
2398  return false;
2399}
2400
2401/// \brief If E is a sizeof expression, returns its argument expression,
2402/// otherwise returns NULL.
2403static const Expr *getSizeOfExprArg(const Expr* E) {
2404  if (const UnaryExprOrTypeTraitExpr *SizeOf =
2405      dyn_cast<UnaryExprOrTypeTraitExpr>(E))
2406    if (SizeOf->getKind() == clang::UETT_SizeOf && !SizeOf->isArgumentType())
2407      return SizeOf->getArgumentExpr()->IgnoreParenImpCasts();
2408
2409  return 0;
2410}
2411
2412/// \brief If E is a sizeof expression, returns its argument type.
2413static QualType getSizeOfArgType(const Expr* E) {
2414  if (const UnaryExprOrTypeTraitExpr *SizeOf =
2415      dyn_cast<UnaryExprOrTypeTraitExpr>(E))
2416    if (SizeOf->getKind() == clang::UETT_SizeOf)
2417      return SizeOf->getTypeOfArgument();
2418
2419  return QualType();
2420}
2421
2422/// \brief Check for dangerous or invalid arguments to memset().
2423///
2424/// This issues warnings on known problematic, dangerous or unspecified
2425/// arguments to the standard 'memset', 'memcpy', 'memmove', and 'memcmp'
2426/// function calls.
2427///
2428/// \param Call The call expression to diagnose.
2429void Sema::CheckMemaccessArguments(const CallExpr *Call,
2430                                   FunctionDecl::MemoryFunctionKind CMF,
2431                                   IdentifierInfo *FnName) {
2432  // It is possible to have a non-standard definition of memset.  Validate
2433  // we have enough arguments, and if not, abort further checking.
2434  unsigned ExpectedNumArgs = (CMF == FunctionDecl::MFK_Strndup ? 2 : 3);
2435  if (Call->getNumArgs() < ExpectedNumArgs)
2436    return;
2437
2438  unsigned LastArg = (CMF == FunctionDecl::MFK_Memset ||
2439                      CMF == FunctionDecl::MFK_Strndup ? 1 : 2);
2440  unsigned LenArg = (CMF == FunctionDecl::MFK_Strndup ? 1 : 2);
2441  const Expr *LenExpr = Call->getArg(LenArg)->IgnoreParenImpCasts();
2442
2443  // We have special checking when the length is a sizeof expression.
2444  QualType SizeOfArgTy = getSizeOfArgType(LenExpr);
2445  const Expr *SizeOfArg = getSizeOfExprArg(LenExpr);
2446  llvm::FoldingSetNodeID SizeOfArgID;
2447
2448  for (unsigned ArgIdx = 0; ArgIdx != LastArg; ++ArgIdx) {
2449    const Expr *Dest = Call->getArg(ArgIdx)->IgnoreParenImpCasts();
2450    SourceRange ArgRange = Call->getArg(ArgIdx)->getSourceRange();
2451
2452    QualType DestTy = Dest->getType();
2453    if (const PointerType *DestPtrTy = DestTy->getAs<PointerType>()) {
2454      QualType PointeeTy = DestPtrTy->getPointeeType();
2455
2456      // Never warn about void type pointers. This can be used to suppress
2457      // false positives.
2458      if (PointeeTy->isVoidType())
2459        continue;
2460
2461      // Catch "memset(p, 0, sizeof(p))" -- needs to be sizeof(*p). Do this by
2462      // actually comparing the expressions for equality. Because computing the
2463      // expression IDs can be expensive, we only do this if the diagnostic is
2464      // enabled.
2465      if (SizeOfArg &&
2466          Diags.getDiagnosticLevel(diag::warn_sizeof_pointer_expr_memaccess,
2467                                   SizeOfArg->getExprLoc())) {
2468        // We only compute IDs for expressions if the warning is enabled, and
2469        // cache the sizeof arg's ID.
2470        if (SizeOfArgID == llvm::FoldingSetNodeID())
2471          SizeOfArg->Profile(SizeOfArgID, Context, true);
2472        llvm::FoldingSetNodeID DestID;
2473        Dest->Profile(DestID, Context, true);
2474        if (DestID == SizeOfArgID) {
2475          // TODO: For strncpy() and friends, this could suggest sizeof(dst)
2476          //       over sizeof(src) as well.
2477          unsigned ActionIdx = 0; // Default is to suggest dereferencing.
2478          if (const UnaryOperator *UnaryOp = dyn_cast<UnaryOperator>(Dest))
2479            if (UnaryOp->getOpcode() == UO_AddrOf)
2480              ActionIdx = 1; // If its an address-of operator, just remove it.
2481          if (Context.getTypeSize(PointeeTy) == Context.getCharWidth())
2482            ActionIdx = 2; // If the pointee's size is sizeof(char),
2483                           // suggest an explicit length.
2484          unsigned DestSrcSelect =
2485            (CMF == FunctionDecl::MFK_Strndup ? 1 : ArgIdx);
2486          DiagRuntimeBehavior(SizeOfArg->getExprLoc(), Dest,
2487                              PDiag(diag::warn_sizeof_pointer_expr_memaccess)
2488                                << FnName << DestSrcSelect << ActionIdx
2489                                << Dest->getSourceRange()
2490                                << SizeOfArg->getSourceRange());
2491          break;
2492        }
2493      }
2494
2495      // Also check for cases where the sizeof argument is the exact same
2496      // type as the memory argument, and where it points to a user-defined
2497      // record type.
2498      if (SizeOfArgTy != QualType()) {
2499        if (PointeeTy->isRecordType() &&
2500            Context.typesAreCompatible(SizeOfArgTy, DestTy)) {
2501          DiagRuntimeBehavior(LenExpr->getExprLoc(), Dest,
2502                              PDiag(diag::warn_sizeof_pointer_type_memaccess)
2503                                << FnName << SizeOfArgTy << ArgIdx
2504                                << PointeeTy << Dest->getSourceRange()
2505                                << LenExpr->getSourceRange());
2506          break;
2507        }
2508      }
2509
2510      // Always complain about dynamic classes.
2511      if (isDynamicClassType(PointeeTy))
2512        DiagRuntimeBehavior(
2513          Dest->getExprLoc(), Dest,
2514          PDiag(diag::warn_dyn_class_memaccess)
2515            << (CMF == FunctionDecl::MFK_Memcmp ? ArgIdx + 2 : ArgIdx)
2516            << FnName << PointeeTy
2517            // "overwritten" if we're warning about the destination for any call
2518            // but memcmp; otherwise a verb appropriate to the call.
2519            << (ArgIdx == 0 &&
2520                CMF != FunctionDecl::MFK_Memcmp ? 0 : (unsigned)CMF)
2521            << Call->getCallee()->getSourceRange());
2522      else if (PointeeTy.hasNonTrivialObjCLifetime() &&
2523               CMF != FunctionDecl::MFK_Memset)
2524        DiagRuntimeBehavior(
2525          Dest->getExprLoc(), Dest,
2526          PDiag(diag::warn_arc_object_memaccess)
2527            << ArgIdx << FnName << PointeeTy
2528            << Call->getCallee()->getSourceRange());
2529      else
2530        continue;
2531
2532      DiagRuntimeBehavior(
2533        Dest->getExprLoc(), Dest,
2534        PDiag(diag::note_bad_memaccess_silence)
2535          << FixItHint::CreateInsertion(ArgRange.getBegin(), "(void*)"));
2536      break;
2537    }
2538  }
2539}
2540
2541// A little helper routine: ignore addition and subtraction of integer literals.
2542// This intentionally does not ignore all integer constant expressions because
2543// we don't want to remove sizeof().
2544static const Expr *ignoreLiteralAdditions(const Expr *Ex, ASTContext &Ctx) {
2545  Ex = Ex->IgnoreParenCasts();
2546
2547  for (;;) {
2548    const BinaryOperator * BO = dyn_cast<BinaryOperator>(Ex);
2549    if (!BO || !BO->isAdditiveOp())
2550      break;
2551
2552    const Expr *RHS = BO->getRHS()->IgnoreParenCasts();
2553    const Expr *LHS = BO->getLHS()->IgnoreParenCasts();
2554
2555    if (isa<IntegerLiteral>(RHS))
2556      Ex = LHS;
2557    else if (isa<IntegerLiteral>(LHS))
2558      Ex = RHS;
2559    else
2560      break;
2561  }
2562
2563  return Ex;
2564}
2565
2566// Warn if the user has made the 'size' argument to strlcpy or strlcat
2567// be the size of the source, instead of the destination.
2568void Sema::CheckStrlcpycatArguments(const CallExpr *Call,
2569                                    IdentifierInfo *FnName) {
2570
2571  // Don't crash if the user has the wrong number of arguments
2572  if (Call->getNumArgs() != 3)
2573    return;
2574
2575  const Expr *SrcArg = ignoreLiteralAdditions(Call->getArg(1), Context);
2576  const Expr *SizeArg = ignoreLiteralAdditions(Call->getArg(2), Context);
2577  const Expr *CompareWithSrc = NULL;
2578
2579  // Look for 'strlcpy(dst, x, sizeof(x))'
2580  if (const Expr *Ex = getSizeOfExprArg(SizeArg))
2581    CompareWithSrc = Ex;
2582  else {
2583    // Look for 'strlcpy(dst, x, strlen(x))'
2584    if (const CallExpr *SizeCall = dyn_cast<CallExpr>(SizeArg)) {
2585      if (SizeCall->isBuiltinCall() == Builtin::BIstrlen
2586          && SizeCall->getNumArgs() == 1)
2587        CompareWithSrc = ignoreLiteralAdditions(SizeCall->getArg(0), Context);
2588    }
2589  }
2590
2591  if (!CompareWithSrc)
2592    return;
2593
2594  // Determine if the argument to sizeof/strlen is equal to the source
2595  // argument.  In principle there's all kinds of things you could do
2596  // here, for instance creating an == expression and evaluating it with
2597  // EvaluateAsBooleanCondition, but this uses a more direct technique:
2598  const DeclRefExpr *SrcArgDRE = dyn_cast<DeclRefExpr>(SrcArg);
2599  if (!SrcArgDRE)
2600    return;
2601
2602  const DeclRefExpr *CompareWithSrcDRE = dyn_cast<DeclRefExpr>(CompareWithSrc);
2603  if (!CompareWithSrcDRE ||
2604      SrcArgDRE->getDecl() != CompareWithSrcDRE->getDecl())
2605    return;
2606
2607  const Expr *OriginalSizeArg = Call->getArg(2);
2608  Diag(CompareWithSrcDRE->getLocStart(), diag::warn_strlcpycat_wrong_size)
2609    << OriginalSizeArg->getSourceRange() << FnName;
2610
2611  // Output a FIXIT hint if the destination is an array (rather than a
2612  // pointer to an array).  This could be enhanced to handle some
2613  // pointers if we know the actual size, like if DstArg is 'array+2'
2614  // we could say 'sizeof(array)-2'.
2615  const Expr *DstArg = Call->getArg(0)->IgnoreParenImpCasts();
2616  QualType DstArgTy = DstArg->getType();
2617
2618  // Only handle constant-sized or VLAs, but not flexible members.
2619  if (const ConstantArrayType *CAT = Context.getAsConstantArrayType(DstArgTy)) {
2620    // Only issue the FIXIT for arrays of size > 1.
2621    if (CAT->getSize().getSExtValue() <= 1)
2622      return;
2623  } else if (!DstArgTy->isVariableArrayType()) {
2624    return;
2625  }
2626
2627  llvm::SmallString<128> sizeString;
2628  llvm::raw_svector_ostream OS(sizeString);
2629  OS << "sizeof(";
2630  DstArg->printPretty(OS, Context, 0, getPrintingPolicy());
2631  OS << ")";
2632
2633  Diag(OriginalSizeArg->getLocStart(), diag::note_strlcpycat_wrong_size)
2634    << FixItHint::CreateReplacement(OriginalSizeArg->getSourceRange(),
2635                                    OS.str());
2636}
2637
2638//===--- CHECK: Return Address of Stack Variable --------------------------===//
2639
2640static Expr *EvalVal(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars);
2641static Expr *EvalAddr(Expr* E, SmallVectorImpl<DeclRefExpr *> &refVars);
2642
2643/// CheckReturnStackAddr - Check if a return statement returns the address
2644///   of a stack variable.
2645void
2646Sema::CheckReturnStackAddr(Expr *RetValExp, QualType lhsType,
2647                           SourceLocation ReturnLoc) {
2648
2649  Expr *stackE = 0;
2650  SmallVector<DeclRefExpr *, 8> refVars;
2651
2652  // Perform checking for returned stack addresses, local blocks,
2653  // label addresses or references to temporaries.
2654  if (lhsType->isPointerType() ||
2655      (!getLangOptions().ObjCAutoRefCount && lhsType->isBlockPointerType())) {
2656    stackE = EvalAddr(RetValExp, refVars);
2657  } else if (lhsType->isReferenceType()) {
2658    stackE = EvalVal(RetValExp, refVars);
2659  }
2660
2661  if (stackE == 0)
2662    return; // Nothing suspicious was found.
2663
2664  SourceLocation diagLoc;
2665  SourceRange diagRange;
2666  if (refVars.empty()) {
2667    diagLoc = stackE->getLocStart();
2668    diagRange = stackE->getSourceRange();
2669  } else {
2670    // We followed through a reference variable. 'stackE' contains the
2671    // problematic expression but we will warn at the return statement pointing
2672    // at the reference variable. We will later display the "trail" of
2673    // reference variables using notes.
2674    diagLoc = refVars[0]->getLocStart();
2675    diagRange = refVars[0]->getSourceRange();
2676  }
2677
2678  if (DeclRefExpr *DR = dyn_cast<DeclRefExpr>(stackE)) { //address of local var.
2679    Diag(diagLoc, lhsType->isReferenceType() ? diag::warn_ret_stack_ref
2680                                             : diag::warn_ret_stack_addr)
2681     << DR->getDecl()->getDeclName() << diagRange;
2682  } else if (isa<BlockExpr>(stackE)) { // local block.
2683    Diag(diagLoc, diag::err_ret_local_block) << diagRange;
2684  } else if (isa<AddrLabelExpr>(stackE)) { // address of label.
2685    Diag(diagLoc, diag::warn_ret_addr_label) << diagRange;
2686  } else { // local temporary.
2687    Diag(diagLoc, lhsType->isReferenceType() ? diag::warn_ret_local_temp_ref
2688                                             : diag::warn_ret_local_temp_addr)
2689     << diagRange;
2690  }
2691
2692  // Display the "trail" of reference variables that we followed until we
2693  // found the problematic expression using notes.
2694  for (unsigned i = 0, e = refVars.size(); i != e; ++i) {
2695    VarDecl *VD = cast<VarDecl>(refVars[i]->getDecl());
2696    // If this var binds to another reference var, show the range of the next
2697    // var, otherwise the var binds to the problematic expression, in which case
2698    // show the range of the expression.
2699    SourceRange range = (i < e-1) ? refVars[i+1]->getSourceRange()
2700                                  : stackE->getSourceRange();
2701    Diag(VD->getLocation(), diag::note_ref_var_local_bind)
2702      << VD->getDeclName() << range;
2703  }
2704}
2705
2706/// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
2707///  check if the expression in a return statement evaluates to an address
2708///  to a location on the stack, a local block, an address of a label, or a
2709///  reference to local temporary. The recursion is used to traverse the
2710///  AST of the return expression, with recursion backtracking when we
2711///  encounter a subexpression that (1) clearly does not lead to one of the
2712///  above problematic expressions (2) is something we cannot determine leads to
2713///  a problematic expression based on such local checking.
2714///
2715///  Both EvalAddr and EvalVal follow through reference variables to evaluate
2716///  the expression that they point to. Such variables are added to the
2717///  'refVars' vector so that we know what the reference variable "trail" was.
2718///
2719///  EvalAddr processes expressions that are pointers that are used as
2720///  references (and not L-values).  EvalVal handles all other values.
2721///  At the base case of the recursion is a check for the above problematic
2722///  expressions.
2723///
2724///  This implementation handles:
2725///
2726///   * pointer-to-pointer casts
2727///   * implicit conversions from array references to pointers
2728///   * taking the address of fields
2729///   * arbitrary interplay between "&" and "*" operators
2730///   * pointer arithmetic from an address of a stack variable
2731///   * taking the address of an array element where the array is on the stack
2732static Expr *EvalAddr(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars) {
2733  if (E->isTypeDependent())
2734      return NULL;
2735
2736  // We should only be called for evaluating pointer expressions.
2737  assert((E->getType()->isAnyPointerType() ||
2738          E->getType()->isBlockPointerType() ||
2739          E->getType()->isObjCQualifiedIdType()) &&
2740         "EvalAddr only works on pointers");
2741
2742  E = E->IgnoreParens();
2743
2744  // Our "symbolic interpreter" is just a dispatch off the currently
2745  // viewed AST node.  We then recursively traverse the AST by calling
2746  // EvalAddr and EvalVal appropriately.
2747  switch (E->getStmtClass()) {
2748  case Stmt::DeclRefExprClass: {
2749    DeclRefExpr *DR = cast<DeclRefExpr>(E);
2750
2751    if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
2752      // If this is a reference variable, follow through to the expression that
2753      // it points to.
2754      if (V->hasLocalStorage() &&
2755          V->getType()->isReferenceType() && V->hasInit()) {
2756        // Add the reference variable to the "trail".
2757        refVars.push_back(DR);
2758        return EvalAddr(V->getInit(), refVars);
2759      }
2760
2761    return NULL;
2762  }
2763
2764  case Stmt::UnaryOperatorClass: {
2765    // The only unary operator that make sense to handle here
2766    // is AddrOf.  All others don't make sense as pointers.
2767    UnaryOperator *U = cast<UnaryOperator>(E);
2768
2769    if (U->getOpcode() == UO_AddrOf)
2770      return EvalVal(U->getSubExpr(), refVars);
2771    else
2772      return NULL;
2773  }
2774
2775  case Stmt::BinaryOperatorClass: {
2776    // Handle pointer arithmetic.  All other binary operators are not valid
2777    // in this context.
2778    BinaryOperator *B = cast<BinaryOperator>(E);
2779    BinaryOperatorKind op = B->getOpcode();
2780
2781    if (op != BO_Add && op != BO_Sub)
2782      return NULL;
2783
2784    Expr *Base = B->getLHS();
2785
2786    // Determine which argument is the real pointer base.  It could be
2787    // the RHS argument instead of the LHS.
2788    if (!Base->getType()->isPointerType()) Base = B->getRHS();
2789
2790    assert (Base->getType()->isPointerType());
2791    return EvalAddr(Base, refVars);
2792  }
2793
2794  // For conditional operators we need to see if either the LHS or RHS are
2795  // valid DeclRefExpr*s.  If one of them is valid, we return it.
2796  case Stmt::ConditionalOperatorClass: {
2797    ConditionalOperator *C = cast<ConditionalOperator>(E);
2798
2799    // Handle the GNU extension for missing LHS.
2800    if (Expr *lhsExpr = C->getLHS()) {
2801    // In C++, we can have a throw-expression, which has 'void' type.
2802      if (!lhsExpr->getType()->isVoidType())
2803        if (Expr* LHS = EvalAddr(lhsExpr, refVars))
2804          return LHS;
2805    }
2806
2807    // In C++, we can have a throw-expression, which has 'void' type.
2808    if (C->getRHS()->getType()->isVoidType())
2809      return NULL;
2810
2811    return EvalAddr(C->getRHS(), refVars);
2812  }
2813
2814  case Stmt::BlockExprClass:
2815    if (cast<BlockExpr>(E)->getBlockDecl()->hasCaptures())
2816      return E; // local block.
2817    return NULL;
2818
2819  case Stmt::AddrLabelExprClass:
2820    return E; // address of label.
2821
2822  case Stmt::ExprWithCleanupsClass:
2823    return EvalAddr(cast<ExprWithCleanups>(E)->getSubExpr(), refVars);
2824
2825  // For casts, we need to handle conversions from arrays to
2826  // pointer values, and pointer-to-pointer conversions.
2827  case Stmt::ImplicitCastExprClass:
2828  case Stmt::CStyleCastExprClass:
2829  case Stmt::CXXFunctionalCastExprClass:
2830  case Stmt::ObjCBridgedCastExprClass: {
2831    Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
2832    QualType T = SubExpr->getType();
2833
2834    if (SubExpr->getType()->isPointerType() ||
2835        SubExpr->getType()->isBlockPointerType() ||
2836        SubExpr->getType()->isObjCQualifiedIdType())
2837      return EvalAddr(SubExpr, refVars);
2838    else if (T->isArrayType())
2839      return EvalVal(SubExpr, refVars);
2840    else
2841      return 0;
2842  }
2843
2844  // C++ casts.  For dynamic casts, static casts, and const casts, we
2845  // are always converting from a pointer-to-pointer, so we just blow
2846  // through the cast.  In the case the dynamic cast doesn't fail (and
2847  // return NULL), we take the conservative route and report cases
2848  // where we return the address of a stack variable.  For Reinterpre
2849  // FIXME: The comment about is wrong; we're not always converting
2850  // from pointer to pointer. I'm guessing that this code should also
2851  // handle references to objects.
2852  case Stmt::CXXStaticCastExprClass:
2853  case Stmt::CXXDynamicCastExprClass:
2854  case Stmt::CXXConstCastExprClass:
2855  case Stmt::CXXReinterpretCastExprClass: {
2856      Expr *S = cast<CXXNamedCastExpr>(E)->getSubExpr();
2857      if (S->getType()->isPointerType() || S->getType()->isBlockPointerType())
2858        return EvalAddr(S, refVars);
2859      else
2860        return NULL;
2861  }
2862
2863  case Stmt::MaterializeTemporaryExprClass:
2864    if (Expr *Result = EvalAddr(
2865                         cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr(),
2866                                refVars))
2867      return Result;
2868
2869    return E;
2870
2871  // Everything else: we simply don't reason about them.
2872  default:
2873    return NULL;
2874  }
2875}
2876
2877
2878///  EvalVal - This function is complements EvalAddr in the mutual recursion.
2879///   See the comments for EvalAddr for more details.
2880static Expr *EvalVal(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars) {
2881do {
2882  // We should only be called for evaluating non-pointer expressions, or
2883  // expressions with a pointer type that are not used as references but instead
2884  // are l-values (e.g., DeclRefExpr with a pointer type).
2885
2886  // Our "symbolic interpreter" is just a dispatch off the currently
2887  // viewed AST node.  We then recursively traverse the AST by calling
2888  // EvalAddr and EvalVal appropriately.
2889
2890  E = E->IgnoreParens();
2891  switch (E->getStmtClass()) {
2892  case Stmt::ImplicitCastExprClass: {
2893    ImplicitCastExpr *IE = cast<ImplicitCastExpr>(E);
2894    if (IE->getValueKind() == VK_LValue) {
2895      E = IE->getSubExpr();
2896      continue;
2897    }
2898    return NULL;
2899  }
2900
2901  case Stmt::ExprWithCleanupsClass:
2902    return EvalVal(cast<ExprWithCleanups>(E)->getSubExpr(), refVars);
2903
2904  case Stmt::DeclRefExprClass: {
2905    // When we hit a DeclRefExpr we are looking at code that refers to a
2906    // variable's name. If it's not a reference variable we check if it has
2907    // local storage within the function, and if so, return the expression.
2908    DeclRefExpr *DR = cast<DeclRefExpr>(E);
2909
2910    if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
2911      if (V->hasLocalStorage()) {
2912        if (!V->getType()->isReferenceType())
2913          return DR;
2914
2915        // Reference variable, follow through to the expression that
2916        // it points to.
2917        if (V->hasInit()) {
2918          // Add the reference variable to the "trail".
2919          refVars.push_back(DR);
2920          return EvalVal(V->getInit(), refVars);
2921        }
2922      }
2923
2924    return NULL;
2925  }
2926
2927  case Stmt::UnaryOperatorClass: {
2928    // The only unary operator that make sense to handle here
2929    // is Deref.  All others don't resolve to a "name."  This includes
2930    // handling all sorts of rvalues passed to a unary operator.
2931    UnaryOperator *U = cast<UnaryOperator>(E);
2932
2933    if (U->getOpcode() == UO_Deref)
2934      return EvalAddr(U->getSubExpr(), refVars);
2935
2936    return NULL;
2937  }
2938
2939  case Stmt::ArraySubscriptExprClass: {
2940    // Array subscripts are potential references to data on the stack.  We
2941    // retrieve the DeclRefExpr* for the array variable if it indeed
2942    // has local storage.
2943    return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase(), refVars);
2944  }
2945
2946  case Stmt::ConditionalOperatorClass: {
2947    // For conditional operators we need to see if either the LHS or RHS are
2948    // non-NULL Expr's.  If one is non-NULL, we return it.
2949    ConditionalOperator *C = cast<ConditionalOperator>(E);
2950
2951    // Handle the GNU extension for missing LHS.
2952    if (Expr *lhsExpr = C->getLHS())
2953      if (Expr *LHS = EvalVal(lhsExpr, refVars))
2954        return LHS;
2955
2956    return EvalVal(C->getRHS(), refVars);
2957  }
2958
2959  // Accesses to members are potential references to data on the stack.
2960  case Stmt::MemberExprClass: {
2961    MemberExpr *M = cast<MemberExpr>(E);
2962
2963    // Check for indirect access.  We only want direct field accesses.
2964    if (M->isArrow())
2965      return NULL;
2966
2967    // Check whether the member type is itself a reference, in which case
2968    // we're not going to refer to the member, but to what the member refers to.
2969    if (M->getMemberDecl()->getType()->isReferenceType())
2970      return NULL;
2971
2972    return EvalVal(M->getBase(), refVars);
2973  }
2974
2975  case Stmt::MaterializeTemporaryExprClass:
2976    if (Expr *Result = EvalVal(
2977                          cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr(),
2978                               refVars))
2979      return Result;
2980
2981    return E;
2982
2983  default:
2984    // Check that we don't return or take the address of a reference to a
2985    // temporary. This is only useful in C++.
2986    if (!E->isTypeDependent() && E->isRValue())
2987      return E;
2988
2989    // Everything else: we simply don't reason about them.
2990    return NULL;
2991  }
2992} while (true);
2993}
2994
2995//===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
2996
2997/// Check for comparisons of floating point operands using != and ==.
2998/// Issue a warning if these are no self-comparisons, as they are not likely
2999/// to do what the programmer intended.
3000void Sema::CheckFloatComparison(SourceLocation Loc, Expr* LHS, Expr *RHS) {
3001  bool EmitWarning = true;
3002
3003  Expr* LeftExprSansParen = LHS->IgnoreParenImpCasts();
3004  Expr* RightExprSansParen = RHS->IgnoreParenImpCasts();
3005
3006  // Special case: check for x == x (which is OK).
3007  // Do not emit warnings for such cases.
3008  if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
3009    if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
3010      if (DRL->getDecl() == DRR->getDecl())
3011        EmitWarning = false;
3012
3013
3014  // Special case: check for comparisons against literals that can be exactly
3015  //  represented by APFloat.  In such cases, do not emit a warning.  This
3016  //  is a heuristic: often comparison against such literals are used to
3017  //  detect if a value in a variable has not changed.  This clearly can
3018  //  lead to false negatives.
3019  if (EmitWarning) {
3020    if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
3021      if (FLL->isExact())
3022        EmitWarning = false;
3023    } else
3024      if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)){
3025        if (FLR->isExact())
3026          EmitWarning = false;
3027    }
3028  }
3029
3030  // Check for comparisons with builtin types.
3031  if (EmitWarning)
3032    if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
3033      if (CL->isBuiltinCall())
3034        EmitWarning = false;
3035
3036  if (EmitWarning)
3037    if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
3038      if (CR->isBuiltinCall())
3039        EmitWarning = false;
3040
3041  // Emit the diagnostic.
3042  if (EmitWarning)
3043    Diag(Loc, diag::warn_floatingpoint_eq)
3044      << LHS->getSourceRange() << RHS->getSourceRange();
3045}
3046
3047//===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
3048//===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
3049
3050namespace {
3051
3052/// Structure recording the 'active' range of an integer-valued
3053/// expression.
3054struct IntRange {
3055  /// The number of bits active in the int.
3056  unsigned Width;
3057
3058  /// True if the int is known not to have negative values.
3059  bool NonNegative;
3060
3061  IntRange(unsigned Width, bool NonNegative)
3062    : Width(Width), NonNegative(NonNegative)
3063  {}
3064
3065  /// Returns the range of the bool type.
3066  static IntRange forBoolType() {
3067    return IntRange(1, true);
3068  }
3069
3070  /// Returns the range of an opaque value of the given integral type.
3071  static IntRange forValueOfType(ASTContext &C, QualType T) {
3072    return forValueOfCanonicalType(C,
3073                          T->getCanonicalTypeInternal().getTypePtr());
3074  }
3075
3076  /// Returns the range of an opaque value of a canonical integral type.
3077  static IntRange forValueOfCanonicalType(ASTContext &C, const Type *T) {
3078    assert(T->isCanonicalUnqualified());
3079
3080    if (const VectorType *VT = dyn_cast<VectorType>(T))
3081      T = VT->getElementType().getTypePtr();
3082    if (const ComplexType *CT = dyn_cast<ComplexType>(T))
3083      T = CT->getElementType().getTypePtr();
3084
3085    // For enum types, use the known bit width of the enumerators.
3086    if (const EnumType *ET = dyn_cast<EnumType>(T)) {
3087      EnumDecl *Enum = ET->getDecl();
3088      if (!Enum->isCompleteDefinition())
3089        return IntRange(C.getIntWidth(QualType(T, 0)), false);
3090
3091      unsigned NumPositive = Enum->getNumPositiveBits();
3092      unsigned NumNegative = Enum->getNumNegativeBits();
3093
3094      return IntRange(std::max(NumPositive, NumNegative), NumNegative == 0);
3095    }
3096
3097    const BuiltinType *BT = cast<BuiltinType>(T);
3098    assert(BT->isInteger());
3099
3100    return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
3101  }
3102
3103  /// Returns the "target" range of a canonical integral type, i.e.
3104  /// the range of values expressible in the type.
3105  ///
3106  /// This matches forValueOfCanonicalType except that enums have the
3107  /// full range of their type, not the range of their enumerators.
3108  static IntRange forTargetOfCanonicalType(ASTContext &C, const Type *T) {
3109    assert(T->isCanonicalUnqualified());
3110
3111    if (const VectorType *VT = dyn_cast<VectorType>(T))
3112      T = VT->getElementType().getTypePtr();
3113    if (const ComplexType *CT = dyn_cast<ComplexType>(T))
3114      T = CT->getElementType().getTypePtr();
3115    if (const EnumType *ET = dyn_cast<EnumType>(T))
3116      T = C.getCanonicalType(ET->getDecl()->getIntegerType()).getTypePtr();
3117
3118    const BuiltinType *BT = cast<BuiltinType>(T);
3119    assert(BT->isInteger());
3120
3121    return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
3122  }
3123
3124  /// Returns the supremum of two ranges: i.e. their conservative merge.
3125  static IntRange join(IntRange L, IntRange R) {
3126    return IntRange(std::max(L.Width, R.Width),
3127                    L.NonNegative && R.NonNegative);
3128  }
3129
3130  /// Returns the infinum of two ranges: i.e. their aggressive merge.
3131  static IntRange meet(IntRange L, IntRange R) {
3132    return IntRange(std::min(L.Width, R.Width),
3133                    L.NonNegative || R.NonNegative);
3134  }
3135};
3136
3137IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, unsigned MaxWidth) {
3138  if (value.isSigned() && value.isNegative())
3139    return IntRange(value.getMinSignedBits(), false);
3140
3141  if (value.getBitWidth() > MaxWidth)
3142    value = value.trunc(MaxWidth);
3143
3144  // isNonNegative() just checks the sign bit without considering
3145  // signedness.
3146  return IntRange(value.getActiveBits(), true);
3147}
3148
3149IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
3150                       unsigned MaxWidth) {
3151  if (result.isInt())
3152    return GetValueRange(C, result.getInt(), MaxWidth);
3153
3154  if (result.isVector()) {
3155    IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
3156    for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
3157      IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
3158      R = IntRange::join(R, El);
3159    }
3160    return R;
3161  }
3162
3163  if (result.isComplexInt()) {
3164    IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
3165    IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
3166    return IntRange::join(R, I);
3167  }
3168
3169  // This can happen with lossless casts to intptr_t of "based" lvalues.
3170  // Assume it might use arbitrary bits.
3171  // FIXME: The only reason we need to pass the type in here is to get
3172  // the sign right on this one case.  It would be nice if APValue
3173  // preserved this.
3174  assert(result.isLValue() || result.isAddrLabelDiff());
3175  return IntRange(MaxWidth, Ty->isUnsignedIntegerOrEnumerationType());
3176}
3177
3178/// Pseudo-evaluate the given integer expression, estimating the
3179/// range of values it might take.
3180///
3181/// \param MaxWidth - the width to which the value will be truncated
3182IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
3183  E = E->IgnoreParens();
3184
3185  // Try a full evaluation first.
3186  Expr::EvalResult result;
3187  if (E->EvaluateAsRValue(result, C))
3188    return GetValueRange(C, result.Val, E->getType(), MaxWidth);
3189
3190  // I think we only want to look through implicit casts here; if the
3191  // user has an explicit widening cast, we should treat the value as
3192  // being of the new, wider type.
3193  if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
3194    if (CE->getCastKind() == CK_NoOp || CE->getCastKind() == CK_LValueToRValue)
3195      return GetExprRange(C, CE->getSubExpr(), MaxWidth);
3196
3197    IntRange OutputTypeRange = IntRange::forValueOfType(C, CE->getType());
3198
3199    bool isIntegerCast = (CE->getCastKind() == CK_IntegralCast);
3200
3201    // Assume that non-integer casts can span the full range of the type.
3202    if (!isIntegerCast)
3203      return OutputTypeRange;
3204
3205    IntRange SubRange
3206      = GetExprRange(C, CE->getSubExpr(),
3207                     std::min(MaxWidth, OutputTypeRange.Width));
3208
3209    // Bail out if the subexpr's range is as wide as the cast type.
3210    if (SubRange.Width >= OutputTypeRange.Width)
3211      return OutputTypeRange;
3212
3213    // Otherwise, we take the smaller width, and we're non-negative if
3214    // either the output type or the subexpr is.
3215    return IntRange(SubRange.Width,
3216                    SubRange.NonNegative || OutputTypeRange.NonNegative);
3217  }
3218
3219  if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
3220    // If we can fold the condition, just take that operand.
3221    bool CondResult;
3222    if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
3223      return GetExprRange(C, CondResult ? CO->getTrueExpr()
3224                                        : CO->getFalseExpr(),
3225                          MaxWidth);
3226
3227    // Otherwise, conservatively merge.
3228    IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
3229    IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
3230    return IntRange::join(L, R);
3231  }
3232
3233  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
3234    switch (BO->getOpcode()) {
3235
3236    // Boolean-valued operations are single-bit and positive.
3237    case BO_LAnd:
3238    case BO_LOr:
3239    case BO_LT:
3240    case BO_GT:
3241    case BO_LE:
3242    case BO_GE:
3243    case BO_EQ:
3244    case BO_NE:
3245      return IntRange::forBoolType();
3246
3247    // The type of the assignments is the type of the LHS, so the RHS
3248    // is not necessarily the same type.
3249    case BO_MulAssign:
3250    case BO_DivAssign:
3251    case BO_RemAssign:
3252    case BO_AddAssign:
3253    case BO_SubAssign:
3254    case BO_XorAssign:
3255    case BO_OrAssign:
3256      // TODO: bitfields?
3257      return IntRange::forValueOfType(C, E->getType());
3258
3259    // Simple assignments just pass through the RHS, which will have
3260    // been coerced to the LHS type.
3261    case BO_Assign:
3262      // TODO: bitfields?
3263      return GetExprRange(C, BO->getRHS(), MaxWidth);
3264
3265    // Operations with opaque sources are black-listed.
3266    case BO_PtrMemD:
3267    case BO_PtrMemI:
3268      return IntRange::forValueOfType(C, E->getType());
3269
3270    // Bitwise-and uses the *infinum* of the two source ranges.
3271    case BO_And:
3272    case BO_AndAssign:
3273      return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
3274                            GetExprRange(C, BO->getRHS(), MaxWidth));
3275
3276    // Left shift gets black-listed based on a judgement call.
3277    case BO_Shl:
3278      // ...except that we want to treat '1 << (blah)' as logically
3279      // positive.  It's an important idiom.
3280      if (IntegerLiteral *I
3281            = dyn_cast<IntegerLiteral>(BO->getLHS()->IgnoreParenCasts())) {
3282        if (I->getValue() == 1) {
3283          IntRange R = IntRange::forValueOfType(C, E->getType());
3284          return IntRange(R.Width, /*NonNegative*/ true);
3285        }
3286      }
3287      // fallthrough
3288
3289    case BO_ShlAssign:
3290      return IntRange::forValueOfType(C, E->getType());
3291
3292    // Right shift by a constant can narrow its left argument.
3293    case BO_Shr:
3294    case BO_ShrAssign: {
3295      IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
3296
3297      // If the shift amount is a positive constant, drop the width by
3298      // that much.
3299      llvm::APSInt shift;
3300      if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
3301          shift.isNonNegative()) {
3302        unsigned zext = shift.getZExtValue();
3303        if (zext >= L.Width)
3304          L.Width = (L.NonNegative ? 0 : 1);
3305        else
3306          L.Width -= zext;
3307      }
3308
3309      return L;
3310    }
3311
3312    // Comma acts as its right operand.
3313    case BO_Comma:
3314      return GetExprRange(C, BO->getRHS(), MaxWidth);
3315
3316    // Black-list pointer subtractions.
3317    case BO_Sub:
3318      if (BO->getLHS()->getType()->isPointerType())
3319        return IntRange::forValueOfType(C, E->getType());
3320      break;
3321
3322    // The width of a division result is mostly determined by the size
3323    // of the LHS.
3324    case BO_Div: {
3325      // Don't 'pre-truncate' the operands.
3326      unsigned opWidth = C.getIntWidth(E->getType());
3327      IntRange L = GetExprRange(C, BO->getLHS(), opWidth);
3328
3329      // If the divisor is constant, use that.
3330      llvm::APSInt divisor;
3331      if (BO->getRHS()->isIntegerConstantExpr(divisor, C)) {
3332        unsigned log2 = divisor.logBase2(); // floor(log_2(divisor))
3333        if (log2 >= L.Width)
3334          L.Width = (L.NonNegative ? 0 : 1);
3335        else
3336          L.Width = std::min(L.Width - log2, MaxWidth);
3337        return L;
3338      }
3339
3340      // Otherwise, just use the LHS's width.
3341      IntRange R = GetExprRange(C, BO->getRHS(), opWidth);
3342      return IntRange(L.Width, L.NonNegative && R.NonNegative);
3343    }
3344
3345    // The result of a remainder can't be larger than the result of
3346    // either side.
3347    case BO_Rem: {
3348      // Don't 'pre-truncate' the operands.
3349      unsigned opWidth = C.getIntWidth(E->getType());
3350      IntRange L = GetExprRange(C, BO->getLHS(), opWidth);
3351      IntRange R = GetExprRange(C, BO->getRHS(), opWidth);
3352
3353      IntRange meet = IntRange::meet(L, R);
3354      meet.Width = std::min(meet.Width, MaxWidth);
3355      return meet;
3356    }
3357
3358    // The default behavior is okay for these.
3359    case BO_Mul:
3360    case BO_Add:
3361    case BO_Xor:
3362    case BO_Or:
3363      break;
3364    }
3365
3366    // The default case is to treat the operation as if it were closed
3367    // on the narrowest type that encompasses both operands.
3368    IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
3369    IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
3370    return IntRange::join(L, R);
3371  }
3372
3373  if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
3374    switch (UO->getOpcode()) {
3375    // Boolean-valued operations are white-listed.
3376    case UO_LNot:
3377      return IntRange::forBoolType();
3378
3379    // Operations with opaque sources are black-listed.
3380    case UO_Deref:
3381    case UO_AddrOf: // should be impossible
3382      return IntRange::forValueOfType(C, E->getType());
3383
3384    default:
3385      return GetExprRange(C, UO->getSubExpr(), MaxWidth);
3386    }
3387  }
3388
3389  if (dyn_cast<OffsetOfExpr>(E)) {
3390    IntRange::forValueOfType(C, E->getType());
3391  }
3392
3393  if (FieldDecl *BitField = E->getBitField())
3394    return IntRange(BitField->getBitWidthValue(C),
3395                    BitField->getType()->isUnsignedIntegerOrEnumerationType());
3396
3397  return IntRange::forValueOfType(C, E->getType());
3398}
3399
3400IntRange GetExprRange(ASTContext &C, Expr *E) {
3401  return GetExprRange(C, E, C.getIntWidth(E->getType()));
3402}
3403
3404/// Checks whether the given value, which currently has the given
3405/// source semantics, has the same value when coerced through the
3406/// target semantics.
3407bool IsSameFloatAfterCast(const llvm::APFloat &value,
3408                          const llvm::fltSemantics &Src,
3409                          const llvm::fltSemantics &Tgt) {
3410  llvm::APFloat truncated = value;
3411
3412  bool ignored;
3413  truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
3414  truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
3415
3416  return truncated.bitwiseIsEqual(value);
3417}
3418
3419/// Checks whether the given value, which currently has the given
3420/// source semantics, has the same value when coerced through the
3421/// target semantics.
3422///
3423/// The value might be a vector of floats (or a complex number).
3424bool IsSameFloatAfterCast(const APValue &value,
3425                          const llvm::fltSemantics &Src,
3426                          const llvm::fltSemantics &Tgt) {
3427  if (value.isFloat())
3428    return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
3429
3430  if (value.isVector()) {
3431    for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
3432      if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
3433        return false;
3434    return true;
3435  }
3436
3437  assert(value.isComplexFloat());
3438  return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
3439          IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
3440}
3441
3442void AnalyzeImplicitConversions(Sema &S, Expr *E, SourceLocation CC);
3443
3444static bool IsZero(Sema &S, Expr *E) {
3445  // Suppress cases where we are comparing against an enum constant.
3446  if (const DeclRefExpr *DR =
3447      dyn_cast<DeclRefExpr>(E->IgnoreParenImpCasts()))
3448    if (isa<EnumConstantDecl>(DR->getDecl()))
3449      return false;
3450
3451  // Suppress cases where the '0' value is expanded from a macro.
3452  if (E->getLocStart().isMacroID())
3453    return false;
3454
3455  llvm::APSInt Value;
3456  return E->isIntegerConstantExpr(Value, S.Context) && Value == 0;
3457}
3458
3459static bool HasEnumType(Expr *E) {
3460  // Strip off implicit integral promotions.
3461  while (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(E)) {
3462    if (ICE->getCastKind() != CK_IntegralCast &&
3463        ICE->getCastKind() != CK_NoOp)
3464      break;
3465    E = ICE->getSubExpr();
3466  }
3467
3468  return E->getType()->isEnumeralType();
3469}
3470
3471void CheckTrivialUnsignedComparison(Sema &S, BinaryOperator *E) {
3472  BinaryOperatorKind op = E->getOpcode();
3473  if (E->isValueDependent())
3474    return;
3475
3476  if (op == BO_LT && IsZero(S, E->getRHS())) {
3477    S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison)
3478      << "< 0" << "false" << HasEnumType(E->getLHS())
3479      << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
3480  } else if (op == BO_GE && IsZero(S, E->getRHS())) {
3481    S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison)
3482      << ">= 0" << "true" << HasEnumType(E->getLHS())
3483      << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
3484  } else if (op == BO_GT && IsZero(S, E->getLHS())) {
3485    S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison)
3486      << "0 >" << "false" << HasEnumType(E->getRHS())
3487      << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
3488  } else if (op == BO_LE && IsZero(S, E->getLHS())) {
3489    S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison)
3490      << "0 <=" << "true" << HasEnumType(E->getRHS())
3491      << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
3492  }
3493}
3494
3495/// Analyze the operands of the given comparison.  Implements the
3496/// fallback case from AnalyzeComparison.
3497void AnalyzeImpConvsInComparison(Sema &S, BinaryOperator *E) {
3498  AnalyzeImplicitConversions(S, E->getLHS(), E->getOperatorLoc());
3499  AnalyzeImplicitConversions(S, E->getRHS(), E->getOperatorLoc());
3500}
3501
3502/// \brief Implements -Wsign-compare.
3503///
3504/// \param E the binary operator to check for warnings
3505void AnalyzeComparison(Sema &S, BinaryOperator *E) {
3506  // The type the comparison is being performed in.
3507  QualType T = E->getLHS()->getType();
3508  assert(S.Context.hasSameUnqualifiedType(T, E->getRHS()->getType())
3509         && "comparison with mismatched types");
3510
3511  // We don't do anything special if this isn't an unsigned integral
3512  // comparison:  we're only interested in integral comparisons, and
3513  // signed comparisons only happen in cases we don't care to warn about.
3514  //
3515  // We also don't care about value-dependent expressions or expressions
3516  // whose result is a constant.
3517  if (!T->hasUnsignedIntegerRepresentation()
3518      || E->isValueDependent() || E->isIntegerConstantExpr(S.Context))
3519    return AnalyzeImpConvsInComparison(S, E);
3520
3521  Expr *LHS = E->getLHS()->IgnoreParenImpCasts();
3522  Expr *RHS = E->getRHS()->IgnoreParenImpCasts();
3523
3524  // Check to see if one of the (unmodified) operands is of different
3525  // signedness.
3526  Expr *signedOperand, *unsignedOperand;
3527  if (LHS->getType()->hasSignedIntegerRepresentation()) {
3528    assert(!RHS->getType()->hasSignedIntegerRepresentation() &&
3529           "unsigned comparison between two signed integer expressions?");
3530    signedOperand = LHS;
3531    unsignedOperand = RHS;
3532  } else if (RHS->getType()->hasSignedIntegerRepresentation()) {
3533    signedOperand = RHS;
3534    unsignedOperand = LHS;
3535  } else {
3536    CheckTrivialUnsignedComparison(S, E);
3537    return AnalyzeImpConvsInComparison(S, E);
3538  }
3539
3540  // Otherwise, calculate the effective range of the signed operand.
3541  IntRange signedRange = GetExprRange(S.Context, signedOperand);
3542
3543  // Go ahead and analyze implicit conversions in the operands.  Note
3544  // that we skip the implicit conversions on both sides.
3545  AnalyzeImplicitConversions(S, LHS, E->getOperatorLoc());
3546  AnalyzeImplicitConversions(S, RHS, E->getOperatorLoc());
3547
3548  // If the signed range is non-negative, -Wsign-compare won't fire,
3549  // but we should still check for comparisons which are always true
3550  // or false.
3551  if (signedRange.NonNegative)
3552    return CheckTrivialUnsignedComparison(S, E);
3553
3554  // For (in)equality comparisons, if the unsigned operand is a
3555  // constant which cannot collide with a overflowed signed operand,
3556  // then reinterpreting the signed operand as unsigned will not
3557  // change the result of the comparison.
3558  if (E->isEqualityOp()) {
3559    unsigned comparisonWidth = S.Context.getIntWidth(T);
3560    IntRange unsignedRange = GetExprRange(S.Context, unsignedOperand);
3561
3562    // We should never be unable to prove that the unsigned operand is
3563    // non-negative.
3564    assert(unsignedRange.NonNegative && "unsigned range includes negative?");
3565
3566    if (unsignedRange.Width < comparisonWidth)
3567      return;
3568  }
3569
3570  S.Diag(E->getOperatorLoc(), diag::warn_mixed_sign_comparison)
3571    << LHS->getType() << RHS->getType()
3572    << LHS->getSourceRange() << RHS->getSourceRange();
3573}
3574
3575/// Analyzes an attempt to assign the given value to a bitfield.
3576///
3577/// Returns true if there was something fishy about the attempt.
3578bool AnalyzeBitFieldAssignment(Sema &S, FieldDecl *Bitfield, Expr *Init,
3579                               SourceLocation InitLoc) {
3580  assert(Bitfield->isBitField());
3581  if (Bitfield->isInvalidDecl())
3582    return false;
3583
3584  // White-list bool bitfields.
3585  if (Bitfield->getType()->isBooleanType())
3586    return false;
3587
3588  // Ignore value- or type-dependent expressions.
3589  if (Bitfield->getBitWidth()->isValueDependent() ||
3590      Bitfield->getBitWidth()->isTypeDependent() ||
3591      Init->isValueDependent() ||
3592      Init->isTypeDependent())
3593    return false;
3594
3595  Expr *OriginalInit = Init->IgnoreParenImpCasts();
3596
3597  llvm::APSInt Value;
3598  if (!OriginalInit->EvaluateAsInt(Value, S.Context, Expr::SE_AllowSideEffects))
3599    return false;
3600
3601  unsigned OriginalWidth = Value.getBitWidth();
3602  unsigned FieldWidth = Bitfield->getBitWidthValue(S.Context);
3603
3604  if (OriginalWidth <= FieldWidth)
3605    return false;
3606
3607  llvm::APSInt TruncatedValue = Value.trunc(FieldWidth);
3608
3609  // It's fairly common to write values into signed bitfields
3610  // that, if sign-extended, would end up becoming a different
3611  // value.  We don't want to warn about that.
3612  if (Value.isSigned() && Value.isNegative())
3613    TruncatedValue = TruncatedValue.sext(OriginalWidth);
3614  else
3615    TruncatedValue = TruncatedValue.zext(OriginalWidth);
3616
3617  if (Value == TruncatedValue)
3618    return false;
3619
3620  std::string PrettyValue = Value.toString(10);
3621  std::string PrettyTrunc = TruncatedValue.toString(10);
3622
3623  S.Diag(InitLoc, diag::warn_impcast_bitfield_precision_constant)
3624    << PrettyValue << PrettyTrunc << OriginalInit->getType()
3625    << Init->getSourceRange();
3626
3627  return true;
3628}
3629
3630/// Analyze the given simple or compound assignment for warning-worthy
3631/// operations.
3632void AnalyzeAssignment(Sema &S, BinaryOperator *E) {
3633  // Just recurse on the LHS.
3634  AnalyzeImplicitConversions(S, E->getLHS(), E->getOperatorLoc());
3635
3636  // We want to recurse on the RHS as normal unless we're assigning to
3637  // a bitfield.
3638  if (FieldDecl *Bitfield = E->getLHS()->getBitField()) {
3639    if (AnalyzeBitFieldAssignment(S, Bitfield, E->getRHS(),
3640                                  E->getOperatorLoc())) {
3641      // Recurse, ignoring any implicit conversions on the RHS.
3642      return AnalyzeImplicitConversions(S, E->getRHS()->IgnoreParenImpCasts(),
3643                                        E->getOperatorLoc());
3644    }
3645  }
3646
3647  AnalyzeImplicitConversions(S, E->getRHS(), E->getOperatorLoc());
3648}
3649
3650/// Diagnose an implicit cast;  purely a helper for CheckImplicitConversion.
3651void DiagnoseImpCast(Sema &S, Expr *E, QualType SourceType, QualType T,
3652                     SourceLocation CContext, unsigned diag) {
3653  S.Diag(E->getExprLoc(), diag)
3654    << SourceType << T << E->getSourceRange() << SourceRange(CContext);
3655}
3656
3657/// Diagnose an implicit cast;  purely a helper for CheckImplicitConversion.
3658void DiagnoseImpCast(Sema &S, Expr *E, QualType T, SourceLocation CContext,
3659                     unsigned diag) {
3660  DiagnoseImpCast(S, E, E->getType(), T, CContext, diag);
3661}
3662
3663/// Diagnose an implicit cast from a literal expression. Does not warn when the
3664/// cast wouldn't lose information.
3665void DiagnoseFloatingLiteralImpCast(Sema &S, FloatingLiteral *FL, QualType T,
3666                                    SourceLocation CContext) {
3667  // Try to convert the literal exactly to an integer. If we can, don't warn.
3668  bool isExact = false;
3669  const llvm::APFloat &Value = FL->getValue();
3670  llvm::APSInt IntegerValue(S.Context.getIntWidth(T),
3671                            T->hasUnsignedIntegerRepresentation());
3672  if (Value.convertToInteger(IntegerValue,
3673                             llvm::APFloat::rmTowardZero, &isExact)
3674      == llvm::APFloat::opOK && isExact)
3675    return;
3676
3677  S.Diag(FL->getExprLoc(), diag::warn_impcast_literal_float_to_integer)
3678    << FL->getType() << T << FL->getSourceRange() << SourceRange(CContext);
3679}
3680
3681std::string PrettyPrintInRange(const llvm::APSInt &Value, IntRange Range) {
3682  if (!Range.Width) return "0";
3683
3684  llvm::APSInt ValueInRange = Value;
3685  ValueInRange.setIsSigned(!Range.NonNegative);
3686  ValueInRange = ValueInRange.trunc(Range.Width);
3687  return ValueInRange.toString(10);
3688}
3689
3690void CheckImplicitConversion(Sema &S, Expr *E, QualType T,
3691                             SourceLocation CC, bool *ICContext = 0) {
3692  if (E->isTypeDependent() || E->isValueDependent()) return;
3693
3694  const Type *Source = S.Context.getCanonicalType(E->getType()).getTypePtr();
3695  const Type *Target = S.Context.getCanonicalType(T).getTypePtr();
3696  if (Source == Target) return;
3697  if (Target->isDependentType()) return;
3698
3699  // If the conversion context location is invalid don't complain. We also
3700  // don't want to emit a warning if the issue occurs from the expansion of
3701  // a system macro. The problem is that 'getSpellingLoc()' is slow, so we
3702  // delay this check as long as possible. Once we detect we are in that
3703  // scenario, we just return.
3704  if (CC.isInvalid())
3705    return;
3706
3707  // Diagnose implicit casts to bool.
3708  if (Target->isSpecificBuiltinType(BuiltinType::Bool)) {
3709    if (isa<StringLiteral>(E))
3710      // Warn on string literal to bool.  Checks for string literals in logical
3711      // expressions, for instances, assert(0 && "error here"), is prevented
3712      // by a check in AnalyzeImplicitConversions().
3713      return DiagnoseImpCast(S, E, T, CC,
3714                             diag::warn_impcast_string_literal_to_bool);
3715    if (Source->isFunctionType()) {
3716      // Warn on function to bool. Checks free functions and static member
3717      // functions. Weakly imported functions are excluded from the check,
3718      // since it's common to test their value to check whether the linker
3719      // found a definition for them.
3720      ValueDecl *D = 0;
3721      if (DeclRefExpr* R = dyn_cast<DeclRefExpr>(E)) {
3722        D = R->getDecl();
3723      } else if (MemberExpr *M = dyn_cast<MemberExpr>(E)) {
3724        D = M->getMemberDecl();
3725      }
3726
3727      if (D && !D->isWeak()) {
3728        if (FunctionDecl* F = dyn_cast<FunctionDecl>(D)) {
3729          S.Diag(E->getExprLoc(), diag::warn_impcast_function_to_bool)
3730            << F << E->getSourceRange() << SourceRange(CC);
3731          S.Diag(E->getExprLoc(), diag::note_function_to_bool_silence)
3732            << FixItHint::CreateInsertion(E->getExprLoc(), "&");
3733          QualType ReturnType;
3734          UnresolvedSet<4> NonTemplateOverloads;
3735          S.isExprCallable(*E, ReturnType, NonTemplateOverloads);
3736          if (!ReturnType.isNull()
3737              && ReturnType->isSpecificBuiltinType(BuiltinType::Bool))
3738            S.Diag(E->getExprLoc(), diag::note_function_to_bool_call)
3739              << FixItHint::CreateInsertion(
3740                 S.getPreprocessor().getLocForEndOfToken(E->getLocEnd()), "()");
3741          return;
3742        }
3743      }
3744    }
3745    return; // Other casts to bool are not checked.
3746  }
3747
3748  // Strip vector types.
3749  if (isa<VectorType>(Source)) {
3750    if (!isa<VectorType>(Target)) {
3751      if (S.SourceMgr.isInSystemMacro(CC))
3752        return;
3753      return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_vector_scalar);
3754    }
3755
3756    // If the vector cast is cast between two vectors of the same size, it is
3757    // a bitcast, not a conversion.
3758    if (S.Context.getTypeSize(Source) == S.Context.getTypeSize(Target))
3759      return;
3760
3761    Source = cast<VectorType>(Source)->getElementType().getTypePtr();
3762    Target = cast<VectorType>(Target)->getElementType().getTypePtr();
3763  }
3764
3765  // Strip complex types.
3766  if (isa<ComplexType>(Source)) {
3767    if (!isa<ComplexType>(Target)) {
3768      if (S.SourceMgr.isInSystemMacro(CC))
3769        return;
3770
3771      return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_complex_scalar);
3772    }
3773
3774    Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
3775    Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
3776  }
3777
3778  const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
3779  const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
3780
3781  // If the source is floating point...
3782  if (SourceBT && SourceBT->isFloatingPoint()) {
3783    // ...and the target is floating point...
3784    if (TargetBT && TargetBT->isFloatingPoint()) {
3785      // ...then warn if we're dropping FP rank.
3786
3787      // Builtin FP kinds are ordered by increasing FP rank.
3788      if (SourceBT->getKind() > TargetBT->getKind()) {
3789        // Don't warn about float constants that are precisely
3790        // representable in the target type.
3791        Expr::EvalResult result;
3792        if (E->EvaluateAsRValue(result, S.Context)) {
3793          // Value might be a float, a float vector, or a float complex.
3794          if (IsSameFloatAfterCast(result.Val,
3795                   S.Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
3796                   S.Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
3797            return;
3798        }
3799
3800        if (S.SourceMgr.isInSystemMacro(CC))
3801          return;
3802
3803        DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_float_precision);
3804      }
3805      return;
3806    }
3807
3808    // If the target is integral, always warn.
3809    if ((TargetBT && TargetBT->isInteger())) {
3810      if (S.SourceMgr.isInSystemMacro(CC))
3811        return;
3812
3813      Expr *InnerE = E->IgnoreParenImpCasts();
3814      // We also want to warn on, e.g., "int i = -1.234"
3815      if (UnaryOperator *UOp = dyn_cast<UnaryOperator>(InnerE))
3816        if (UOp->getOpcode() == UO_Minus || UOp->getOpcode() == UO_Plus)
3817          InnerE = UOp->getSubExpr()->IgnoreParenImpCasts();
3818
3819      if (FloatingLiteral *FL = dyn_cast<FloatingLiteral>(InnerE)) {
3820        DiagnoseFloatingLiteralImpCast(S, FL, T, CC);
3821      } else {
3822        DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_float_integer);
3823      }
3824    }
3825
3826    return;
3827  }
3828
3829  if (!Source->isIntegerType() || !Target->isIntegerType())
3830    return;
3831
3832  if ((E->isNullPointerConstant(S.Context, Expr::NPC_ValueDependentIsNotNull)
3833           == Expr::NPCK_GNUNull) && Target->isIntegerType()) {
3834    S.Diag(E->getExprLoc(), diag::warn_impcast_null_pointer_to_integer)
3835        << E->getSourceRange() << clang::SourceRange(CC);
3836    return;
3837  }
3838
3839  IntRange SourceRange = GetExprRange(S.Context, E);
3840  IntRange TargetRange = IntRange::forTargetOfCanonicalType(S.Context, Target);
3841
3842  if (SourceRange.Width > TargetRange.Width) {
3843    // If the source is a constant, use a default-on diagnostic.
3844    // TODO: this should happen for bitfield stores, too.
3845    llvm::APSInt Value(32);
3846    if (E->isIntegerConstantExpr(Value, S.Context)) {
3847      if (S.SourceMgr.isInSystemMacro(CC))
3848        return;
3849
3850      std::string PrettySourceValue = Value.toString(10);
3851      std::string PrettyTargetValue = PrettyPrintInRange(Value, TargetRange);
3852
3853      S.DiagRuntimeBehavior(E->getExprLoc(), E,
3854        S.PDiag(diag::warn_impcast_integer_precision_constant)
3855            << PrettySourceValue << PrettyTargetValue
3856            << E->getType() << T << E->getSourceRange()
3857            << clang::SourceRange(CC));
3858      return;
3859    }
3860
3861    // People want to build with -Wshorten-64-to-32 and not -Wconversion.
3862    if (S.SourceMgr.isInSystemMacro(CC))
3863      return;
3864
3865    if (SourceRange.Width == 64 && TargetRange.Width == 32)
3866      return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_integer_64_32);
3867    return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_integer_precision);
3868  }
3869
3870  if ((TargetRange.NonNegative && !SourceRange.NonNegative) ||
3871      (!TargetRange.NonNegative && SourceRange.NonNegative &&
3872       SourceRange.Width == TargetRange.Width)) {
3873
3874    if (S.SourceMgr.isInSystemMacro(CC))
3875      return;
3876
3877    unsigned DiagID = diag::warn_impcast_integer_sign;
3878
3879    // Traditionally, gcc has warned about this under -Wsign-compare.
3880    // We also want to warn about it in -Wconversion.
3881    // So if -Wconversion is off, use a completely identical diagnostic
3882    // in the sign-compare group.
3883    // The conditional-checking code will
3884    if (ICContext) {
3885      DiagID = diag::warn_impcast_integer_sign_conditional;
3886      *ICContext = true;
3887    }
3888
3889    return DiagnoseImpCast(S, E, T, CC, DiagID);
3890  }
3891
3892  // Diagnose conversions between different enumeration types.
3893  // In C, we pretend that the type of an EnumConstantDecl is its enumeration
3894  // type, to give us better diagnostics.
3895  QualType SourceType = E->getType();
3896  if (!S.getLangOptions().CPlusPlus) {
3897    if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E))
3898      if (EnumConstantDecl *ECD = dyn_cast<EnumConstantDecl>(DRE->getDecl())) {
3899        EnumDecl *Enum = cast<EnumDecl>(ECD->getDeclContext());
3900        SourceType = S.Context.getTypeDeclType(Enum);
3901        Source = S.Context.getCanonicalType(SourceType).getTypePtr();
3902      }
3903  }
3904
3905  if (const EnumType *SourceEnum = Source->getAs<EnumType>())
3906    if (const EnumType *TargetEnum = Target->getAs<EnumType>())
3907      if ((SourceEnum->getDecl()->getIdentifier() ||
3908           SourceEnum->getDecl()->getTypedefNameForAnonDecl()) &&
3909          (TargetEnum->getDecl()->getIdentifier() ||
3910           TargetEnum->getDecl()->getTypedefNameForAnonDecl()) &&
3911          SourceEnum != TargetEnum) {
3912        if (S.SourceMgr.isInSystemMacro(CC))
3913          return;
3914
3915        return DiagnoseImpCast(S, E, SourceType, T, CC,
3916                               diag::warn_impcast_different_enum_types);
3917      }
3918
3919  return;
3920}
3921
3922void CheckConditionalOperator(Sema &S, ConditionalOperator *E, QualType T);
3923
3924void CheckConditionalOperand(Sema &S, Expr *E, QualType T,
3925                             SourceLocation CC, bool &ICContext) {
3926  E = E->IgnoreParenImpCasts();
3927
3928  if (isa<ConditionalOperator>(E))
3929    return CheckConditionalOperator(S, cast<ConditionalOperator>(E), T);
3930
3931  AnalyzeImplicitConversions(S, E, CC);
3932  if (E->getType() != T)
3933    return CheckImplicitConversion(S, E, T, CC, &ICContext);
3934  return;
3935}
3936
3937void CheckConditionalOperator(Sema &S, ConditionalOperator *E, QualType T) {
3938  SourceLocation CC = E->getQuestionLoc();
3939
3940  AnalyzeImplicitConversions(S, E->getCond(), CC);
3941
3942  bool Suspicious = false;
3943  CheckConditionalOperand(S, E->getTrueExpr(), T, CC, Suspicious);
3944  CheckConditionalOperand(S, E->getFalseExpr(), T, CC, Suspicious);
3945
3946  // If -Wconversion would have warned about either of the candidates
3947  // for a signedness conversion to the context type...
3948  if (!Suspicious) return;
3949
3950  // ...but it's currently ignored...
3951  if (S.Diags.getDiagnosticLevel(diag::warn_impcast_integer_sign_conditional,
3952                                 CC))
3953    return;
3954
3955  // ...then check whether it would have warned about either of the
3956  // candidates for a signedness conversion to the condition type.
3957  if (E->getType() == T) return;
3958
3959  Suspicious = false;
3960  CheckImplicitConversion(S, E->getTrueExpr()->IgnoreParenImpCasts(),
3961                          E->getType(), CC, &Suspicious);
3962  if (!Suspicious)
3963    CheckImplicitConversion(S, E->getFalseExpr()->IgnoreParenImpCasts(),
3964                            E->getType(), CC, &Suspicious);
3965}
3966
3967/// AnalyzeImplicitConversions - Find and report any interesting
3968/// implicit conversions in the given expression.  There are a couple
3969/// of competing diagnostics here, -Wconversion and -Wsign-compare.
3970void AnalyzeImplicitConversions(Sema &S, Expr *OrigE, SourceLocation CC) {
3971  QualType T = OrigE->getType();
3972  Expr *E = OrigE->IgnoreParenImpCasts();
3973
3974  if (E->isTypeDependent() || E->isValueDependent())
3975    return;
3976
3977  // For conditional operators, we analyze the arguments as if they
3978  // were being fed directly into the output.
3979  if (isa<ConditionalOperator>(E)) {
3980    ConditionalOperator *CO = cast<ConditionalOperator>(E);
3981    CheckConditionalOperator(S, CO, T);
3982    return;
3983  }
3984
3985  // Go ahead and check any implicit conversions we might have skipped.
3986  // The non-canonical typecheck is just an optimization;
3987  // CheckImplicitConversion will filter out dead implicit conversions.
3988  if (E->getType() != T)
3989    CheckImplicitConversion(S, E, T, CC);
3990
3991  // Now continue drilling into this expression.
3992
3993  // Skip past explicit casts.
3994  if (isa<ExplicitCastExpr>(E)) {
3995    E = cast<ExplicitCastExpr>(E)->getSubExpr()->IgnoreParenImpCasts();
3996    return AnalyzeImplicitConversions(S, E, CC);
3997  }
3998
3999  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
4000    // Do a somewhat different check with comparison operators.
4001    if (BO->isComparisonOp())
4002      return AnalyzeComparison(S, BO);
4003
4004    // And with assignments and compound assignments.
4005    if (BO->isAssignmentOp())
4006      return AnalyzeAssignment(S, BO);
4007  }
4008
4009  // These break the otherwise-useful invariant below.  Fortunately,
4010  // we don't really need to recurse into them, because any internal
4011  // expressions should have been analyzed already when they were
4012  // built into statements.
4013  if (isa<StmtExpr>(E)) return;
4014
4015  // Don't descend into unevaluated contexts.
4016  if (isa<UnaryExprOrTypeTraitExpr>(E)) return;
4017
4018  // Now just recurse over the expression's children.
4019  CC = E->getExprLoc();
4020  BinaryOperator *BO = dyn_cast<BinaryOperator>(E);
4021  bool IsLogicalOperator = BO && BO->isLogicalOp();
4022  for (Stmt::child_range I = E->children(); I; ++I) {
4023    Expr *ChildExpr = cast<Expr>(*I);
4024    if (IsLogicalOperator &&
4025        isa<StringLiteral>(ChildExpr->IgnoreParenImpCasts()))
4026      // Ignore checking string literals that are in logical operators.
4027      continue;
4028    AnalyzeImplicitConversions(S, ChildExpr, CC);
4029  }
4030}
4031
4032} // end anonymous namespace
4033
4034/// Diagnoses "dangerous" implicit conversions within the given
4035/// expression (which is a full expression).  Implements -Wconversion
4036/// and -Wsign-compare.
4037///
4038/// \param CC the "context" location of the implicit conversion, i.e.
4039///   the most location of the syntactic entity requiring the implicit
4040///   conversion
4041void Sema::CheckImplicitConversions(Expr *E, SourceLocation CC) {
4042  // Don't diagnose in unevaluated contexts.
4043  if (ExprEvalContexts.back().Context == Sema::Unevaluated)
4044    return;
4045
4046  // Don't diagnose for value- or type-dependent expressions.
4047  if (E->isTypeDependent() || E->isValueDependent())
4048    return;
4049
4050  // Check for array bounds violations in cases where the check isn't triggered
4051  // elsewhere for other Expr types (like BinaryOperators), e.g. when an
4052  // ArraySubscriptExpr is on the RHS of a variable initialization.
4053  CheckArrayAccess(E);
4054
4055  // This is not the right CC for (e.g.) a variable initialization.
4056  AnalyzeImplicitConversions(*this, E, CC);
4057}
4058
4059void Sema::CheckBitFieldInitialization(SourceLocation InitLoc,
4060                                       FieldDecl *BitField,
4061                                       Expr *Init) {
4062  (void) AnalyzeBitFieldAssignment(*this, BitField, Init, InitLoc);
4063}
4064
4065/// CheckParmsForFunctionDef - Check that the parameters of the given
4066/// function are appropriate for the definition of a function. This
4067/// takes care of any checks that cannot be performed on the
4068/// declaration itself, e.g., that the types of each of the function
4069/// parameters are complete.
4070bool Sema::CheckParmsForFunctionDef(ParmVarDecl **P, ParmVarDecl **PEnd,
4071                                    bool CheckParameterNames) {
4072  bool HasInvalidParm = false;
4073  for (; P != PEnd; ++P) {
4074    ParmVarDecl *Param = *P;
4075
4076    // C99 6.7.5.3p4: the parameters in a parameter type list in a
4077    // function declarator that is part of a function definition of
4078    // that function shall not have incomplete type.
4079    //
4080    // This is also C++ [dcl.fct]p6.
4081    if (!Param->isInvalidDecl() &&
4082        RequireCompleteType(Param->getLocation(), Param->getType(),
4083                               diag::err_typecheck_decl_incomplete_type)) {
4084      Param->setInvalidDecl();
4085      HasInvalidParm = true;
4086    }
4087
4088    // C99 6.9.1p5: If the declarator includes a parameter type list, the
4089    // declaration of each parameter shall include an identifier.
4090    if (CheckParameterNames &&
4091        Param->getIdentifier() == 0 &&
4092        !Param->isImplicit() &&
4093        !getLangOptions().CPlusPlus)
4094      Diag(Param->getLocation(), diag::err_parameter_name_omitted);
4095
4096    // C99 6.7.5.3p12:
4097    //   If the function declarator is not part of a definition of that
4098    //   function, parameters may have incomplete type and may use the [*]
4099    //   notation in their sequences of declarator specifiers to specify
4100    //   variable length array types.
4101    QualType PType = Param->getOriginalType();
4102    if (const ArrayType *AT = Context.getAsArrayType(PType)) {
4103      if (AT->getSizeModifier() == ArrayType::Star) {
4104        // FIXME: This diagnosic should point the the '[*]' if source-location
4105        // information is added for it.
4106        Diag(Param->getLocation(), diag::err_array_star_in_function_definition);
4107      }
4108    }
4109  }
4110
4111  return HasInvalidParm;
4112}
4113
4114/// CheckCastAlign - Implements -Wcast-align, which warns when a
4115/// pointer cast increases the alignment requirements.
4116void Sema::CheckCastAlign(Expr *Op, QualType T, SourceRange TRange) {
4117  // This is actually a lot of work to potentially be doing on every
4118  // cast; don't do it if we're ignoring -Wcast_align (as is the default).
4119  if (getDiagnostics().getDiagnosticLevel(diag::warn_cast_align,
4120                                          TRange.getBegin())
4121        == DiagnosticsEngine::Ignored)
4122    return;
4123
4124  // Ignore dependent types.
4125  if (T->isDependentType() || Op->getType()->isDependentType())
4126    return;
4127
4128  // Require that the destination be a pointer type.
4129  const PointerType *DestPtr = T->getAs<PointerType>();
4130  if (!DestPtr) return;
4131
4132  // If the destination has alignment 1, we're done.
4133  QualType DestPointee = DestPtr->getPointeeType();
4134  if (DestPointee->isIncompleteType()) return;
4135  CharUnits DestAlign = Context.getTypeAlignInChars(DestPointee);
4136  if (DestAlign.isOne()) return;
4137
4138  // Require that the source be a pointer type.
4139  const PointerType *SrcPtr = Op->getType()->getAs<PointerType>();
4140  if (!SrcPtr) return;
4141  QualType SrcPointee = SrcPtr->getPointeeType();
4142
4143  // Whitelist casts from cv void*.  We already implicitly
4144  // whitelisted casts to cv void*, since they have alignment 1.
4145  // Also whitelist casts involving incomplete types, which implicitly
4146  // includes 'void'.
4147  if (SrcPointee->isIncompleteType()) return;
4148
4149  CharUnits SrcAlign = Context.getTypeAlignInChars(SrcPointee);
4150  if (SrcAlign >= DestAlign) return;
4151
4152  Diag(TRange.getBegin(), diag::warn_cast_align)
4153    << Op->getType() << T
4154    << static_cast<unsigned>(SrcAlign.getQuantity())
4155    << static_cast<unsigned>(DestAlign.getQuantity())
4156    << TRange << Op->getSourceRange();
4157}
4158
4159static const Type* getElementType(const Expr *BaseExpr) {
4160  const Type* EltType = BaseExpr->getType().getTypePtr();
4161  if (EltType->isAnyPointerType())
4162    return EltType->getPointeeType().getTypePtr();
4163  else if (EltType->isArrayType())
4164    return EltType->getBaseElementTypeUnsafe();
4165  return EltType;
4166}
4167
4168/// \brief Check whether this array fits the idiom of a size-one tail padded
4169/// array member of a struct.
4170///
4171/// We avoid emitting out-of-bounds access warnings for such arrays as they are
4172/// commonly used to emulate flexible arrays in C89 code.
4173static bool IsTailPaddedMemberArray(Sema &S, llvm::APInt Size,
4174                                    const NamedDecl *ND) {
4175  if (Size != 1 || !ND) return false;
4176
4177  const FieldDecl *FD = dyn_cast<FieldDecl>(ND);
4178  if (!FD) return false;
4179
4180  // Don't consider sizes resulting from macro expansions or template argument
4181  // substitution to form C89 tail-padded arrays.
4182  ConstantArrayTypeLoc TL =
4183    cast<ConstantArrayTypeLoc>(FD->getTypeSourceInfo()->getTypeLoc());
4184  const Expr *SizeExpr = dyn_cast<IntegerLiteral>(TL.getSizeExpr());
4185  if (!SizeExpr || SizeExpr->getExprLoc().isMacroID())
4186    return false;
4187
4188  const RecordDecl *RD = dyn_cast<RecordDecl>(FD->getDeclContext());
4189  if (!RD) return false;
4190  if (RD->isUnion()) return false;
4191  if (const CXXRecordDecl *CRD = dyn_cast<CXXRecordDecl>(RD)) {
4192    if (!CRD->isStandardLayout()) return false;
4193  }
4194
4195  // See if this is the last field decl in the record.
4196  const Decl *D = FD;
4197  while ((D = D->getNextDeclInContext()))
4198    if (isa<FieldDecl>(D))
4199      return false;
4200  return true;
4201}
4202
4203void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr,
4204                            const ArraySubscriptExpr *ASE,
4205                            bool AllowOnePastEnd, bool IndexNegated) {
4206  IndexExpr = IndexExpr->IgnoreParenCasts();
4207  if (IndexExpr->isValueDependent())
4208    return;
4209
4210  const Type *EffectiveType = getElementType(BaseExpr);
4211  BaseExpr = BaseExpr->IgnoreParenCasts();
4212  const ConstantArrayType *ArrayTy =
4213    Context.getAsConstantArrayType(BaseExpr->getType());
4214  if (!ArrayTy)
4215    return;
4216
4217  llvm::APSInt index;
4218  if (!IndexExpr->EvaluateAsInt(index, Context))
4219    return;
4220  if (IndexNegated)
4221    index = -index;
4222
4223  const NamedDecl *ND = NULL;
4224  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr))
4225    ND = dyn_cast<NamedDecl>(DRE->getDecl());
4226  if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr))
4227    ND = dyn_cast<NamedDecl>(ME->getMemberDecl());
4228
4229  if (index.isUnsigned() || !index.isNegative()) {
4230    llvm::APInt size = ArrayTy->getSize();
4231    if (!size.isStrictlyPositive())
4232      return;
4233
4234    const Type* BaseType = getElementType(BaseExpr);
4235    if (BaseType != EffectiveType) {
4236      // Make sure we're comparing apples to apples when comparing index to size
4237      uint64_t ptrarith_typesize = Context.getTypeSize(EffectiveType);
4238      uint64_t array_typesize = Context.getTypeSize(BaseType);
4239      // Handle ptrarith_typesize being zero, such as when casting to void*
4240      if (!ptrarith_typesize) ptrarith_typesize = 1;
4241      if (ptrarith_typesize != array_typesize) {
4242        // There's a cast to a different size type involved
4243        uint64_t ratio = array_typesize / ptrarith_typesize;
4244        // TODO: Be smarter about handling cases where array_typesize is not a
4245        // multiple of ptrarith_typesize
4246        if (ptrarith_typesize * ratio == array_typesize)
4247          size *= llvm::APInt(size.getBitWidth(), ratio);
4248      }
4249    }
4250
4251    if (size.getBitWidth() > index.getBitWidth())
4252      index = index.sext(size.getBitWidth());
4253    else if (size.getBitWidth() < index.getBitWidth())
4254      size = size.sext(index.getBitWidth());
4255
4256    // For array subscripting the index must be less than size, but for pointer
4257    // arithmetic also allow the index (offset) to be equal to size since
4258    // computing the next address after the end of the array is legal and
4259    // commonly done e.g. in C++ iterators and range-based for loops.
4260    if (AllowOnePastEnd ? index.sle(size) : index.slt(size))
4261      return;
4262
4263    // Also don't warn for arrays of size 1 which are members of some
4264    // structure. These are often used to approximate flexible arrays in C89
4265    // code.
4266    if (IsTailPaddedMemberArray(*this, size, ND))
4267      return;
4268
4269    // Suppress the warning if the subscript expression (as identified by the
4270    // ']' location) and the index expression are both from macro expansions
4271    // within a system header.
4272    if (ASE) {
4273      SourceLocation RBracketLoc = SourceMgr.getSpellingLoc(
4274          ASE->getRBracketLoc());
4275      if (SourceMgr.isInSystemHeader(RBracketLoc)) {
4276        SourceLocation IndexLoc = SourceMgr.getSpellingLoc(
4277            IndexExpr->getLocStart());
4278        if (SourceMgr.isFromSameFile(RBracketLoc, IndexLoc))
4279          return;
4280      }
4281    }
4282
4283    unsigned DiagID = diag::warn_ptr_arith_exceeds_bounds;
4284    if (ASE)
4285      DiagID = diag::warn_array_index_exceeds_bounds;
4286
4287    DiagRuntimeBehavior(BaseExpr->getLocStart(), BaseExpr,
4288                        PDiag(DiagID) << index.toString(10, true)
4289                          << size.toString(10, true)
4290                          << (unsigned)size.getLimitedValue(~0U)
4291                          << IndexExpr->getSourceRange());
4292  } else {
4293    unsigned DiagID = diag::warn_array_index_precedes_bounds;
4294    if (!ASE) {
4295      DiagID = diag::warn_ptr_arith_precedes_bounds;
4296      if (index.isNegative()) index = -index;
4297    }
4298
4299    DiagRuntimeBehavior(BaseExpr->getLocStart(), BaseExpr,
4300                        PDiag(DiagID) << index.toString(10, true)
4301                          << IndexExpr->getSourceRange());
4302  }
4303
4304  if (!ND) {
4305    // Try harder to find a NamedDecl to point at in the note.
4306    while (const ArraySubscriptExpr *ASE =
4307           dyn_cast<ArraySubscriptExpr>(BaseExpr))
4308      BaseExpr = ASE->getBase()->IgnoreParenCasts();
4309    if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr))
4310      ND = dyn_cast<NamedDecl>(DRE->getDecl());
4311    if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr))
4312      ND = dyn_cast<NamedDecl>(ME->getMemberDecl());
4313  }
4314
4315  if (ND)
4316    DiagRuntimeBehavior(ND->getLocStart(), BaseExpr,
4317                        PDiag(diag::note_array_index_out_of_bounds)
4318                          << ND->getDeclName());
4319}
4320
4321void Sema::CheckArrayAccess(const Expr *expr) {
4322  int AllowOnePastEnd = 0;
4323  while (expr) {
4324    expr = expr->IgnoreParenImpCasts();
4325    switch (expr->getStmtClass()) {
4326      case Stmt::ArraySubscriptExprClass: {
4327        const ArraySubscriptExpr *ASE = cast<ArraySubscriptExpr>(expr);
4328        CheckArrayAccess(ASE->getBase(), ASE->getIdx(), ASE,
4329                         AllowOnePastEnd > 0);
4330        return;
4331      }
4332      case Stmt::UnaryOperatorClass: {
4333        // Only unwrap the * and & unary operators
4334        const UnaryOperator *UO = cast<UnaryOperator>(expr);
4335        expr = UO->getSubExpr();
4336        switch (UO->getOpcode()) {
4337          case UO_AddrOf:
4338            AllowOnePastEnd++;
4339            break;
4340          case UO_Deref:
4341            AllowOnePastEnd--;
4342            break;
4343          default:
4344            return;
4345        }
4346        break;
4347      }
4348      case Stmt::ConditionalOperatorClass: {
4349        const ConditionalOperator *cond = cast<ConditionalOperator>(expr);
4350        if (const Expr *lhs = cond->getLHS())
4351          CheckArrayAccess(lhs);
4352        if (const Expr *rhs = cond->getRHS())
4353          CheckArrayAccess(rhs);
4354        return;
4355      }
4356      default:
4357        return;
4358    }
4359  }
4360}
4361
4362//===--- CHECK: Objective-C retain cycles ----------------------------------//
4363
4364namespace {
4365  struct RetainCycleOwner {
4366    RetainCycleOwner() : Variable(0), Indirect(false) {}
4367    VarDecl *Variable;
4368    SourceRange Range;
4369    SourceLocation Loc;
4370    bool Indirect;
4371
4372    void setLocsFrom(Expr *e) {
4373      Loc = e->getExprLoc();
4374      Range = e->getSourceRange();
4375    }
4376  };
4377}
4378
4379/// Consider whether capturing the given variable can possibly lead to
4380/// a retain cycle.
4381static bool considerVariable(VarDecl *var, Expr *ref, RetainCycleOwner &owner) {
4382  // In ARC, it's captured strongly iff the variable has __strong
4383  // lifetime.  In MRR, it's captured strongly if the variable is
4384  // __block and has an appropriate type.
4385  if (var->getType().getObjCLifetime() != Qualifiers::OCL_Strong)
4386    return false;
4387
4388  owner.Variable = var;
4389  owner.setLocsFrom(ref);
4390  return true;
4391}
4392
4393static bool findRetainCycleOwner(Sema &S, Expr *e, RetainCycleOwner &owner) {
4394  while (true) {
4395    e = e->IgnoreParens();
4396    if (CastExpr *cast = dyn_cast<CastExpr>(e)) {
4397      switch (cast->getCastKind()) {
4398      case CK_BitCast:
4399      case CK_LValueBitCast:
4400      case CK_LValueToRValue:
4401      case CK_ARCReclaimReturnedObject:
4402        e = cast->getSubExpr();
4403        continue;
4404
4405      default:
4406        return false;
4407      }
4408    }
4409
4410    if (ObjCIvarRefExpr *ref = dyn_cast<ObjCIvarRefExpr>(e)) {
4411      ObjCIvarDecl *ivar = ref->getDecl();
4412      if (ivar->getType().getObjCLifetime() != Qualifiers::OCL_Strong)
4413        return false;
4414
4415      // Try to find a retain cycle in the base.
4416      if (!findRetainCycleOwner(S, ref->getBase(), owner))
4417        return false;
4418
4419      if (ref->isFreeIvar()) owner.setLocsFrom(ref);
4420      owner.Indirect = true;
4421      return true;
4422    }
4423
4424    if (DeclRefExpr *ref = dyn_cast<DeclRefExpr>(e)) {
4425      VarDecl *var = dyn_cast<VarDecl>(ref->getDecl());
4426      if (!var) return false;
4427      return considerVariable(var, ref, owner);
4428    }
4429
4430    if (BlockDeclRefExpr *ref = dyn_cast<BlockDeclRefExpr>(e)) {
4431      owner.Variable = ref->getDecl();
4432      owner.setLocsFrom(ref);
4433      return true;
4434    }
4435
4436    if (MemberExpr *member = dyn_cast<MemberExpr>(e)) {
4437      if (member->isArrow()) return false;
4438
4439      // Don't count this as an indirect ownership.
4440      e = member->getBase();
4441      continue;
4442    }
4443
4444    if (PseudoObjectExpr *pseudo = dyn_cast<PseudoObjectExpr>(e)) {
4445      // Only pay attention to pseudo-objects on property references.
4446      ObjCPropertyRefExpr *pre
4447        = dyn_cast<ObjCPropertyRefExpr>(pseudo->getSyntacticForm()
4448                                              ->IgnoreParens());
4449      if (!pre) return false;
4450      if (pre->isImplicitProperty()) return false;
4451      ObjCPropertyDecl *property = pre->getExplicitProperty();
4452      if (!property->isRetaining() &&
4453          !(property->getPropertyIvarDecl() &&
4454            property->getPropertyIvarDecl()->getType()
4455              .getObjCLifetime() == Qualifiers::OCL_Strong))
4456          return false;
4457
4458      owner.Indirect = true;
4459      if (pre->isSuperReceiver()) {
4460        owner.Variable = S.getCurMethodDecl()->getSelfDecl();
4461        if (!owner.Variable)
4462          return false;
4463        owner.Loc = pre->getLocation();
4464        owner.Range = pre->getSourceRange();
4465        return true;
4466      }
4467      e = const_cast<Expr*>(cast<OpaqueValueExpr>(pre->getBase())
4468                              ->getSourceExpr());
4469      continue;
4470    }
4471
4472    // Array ivars?
4473
4474    return false;
4475  }
4476}
4477
4478namespace {
4479  struct FindCaptureVisitor : EvaluatedExprVisitor<FindCaptureVisitor> {
4480    FindCaptureVisitor(ASTContext &Context, VarDecl *variable)
4481      : EvaluatedExprVisitor<FindCaptureVisitor>(Context),
4482        Variable(variable), Capturer(0) {}
4483
4484    VarDecl *Variable;
4485    Expr *Capturer;
4486
4487    void VisitDeclRefExpr(DeclRefExpr *ref) {
4488      if (ref->getDecl() == Variable && !Capturer)
4489        Capturer = ref;
4490    }
4491
4492    void VisitBlockDeclRefExpr(BlockDeclRefExpr *ref) {
4493      if (ref->getDecl() == Variable && !Capturer)
4494        Capturer = ref;
4495    }
4496
4497    void VisitObjCIvarRefExpr(ObjCIvarRefExpr *ref) {
4498      if (Capturer) return;
4499      Visit(ref->getBase());
4500      if (Capturer && ref->isFreeIvar())
4501        Capturer = ref;
4502    }
4503
4504    void VisitBlockExpr(BlockExpr *block) {
4505      // Look inside nested blocks
4506      if (block->getBlockDecl()->capturesVariable(Variable))
4507        Visit(block->getBlockDecl()->getBody());
4508    }
4509  };
4510}
4511
4512/// Check whether the given argument is a block which captures a
4513/// variable.
4514static Expr *findCapturingExpr(Sema &S, Expr *e, RetainCycleOwner &owner) {
4515  assert(owner.Variable && owner.Loc.isValid());
4516
4517  e = e->IgnoreParenCasts();
4518  BlockExpr *block = dyn_cast<BlockExpr>(e);
4519  if (!block || !block->getBlockDecl()->capturesVariable(owner.Variable))
4520    return 0;
4521
4522  FindCaptureVisitor visitor(S.Context, owner.Variable);
4523  visitor.Visit(block->getBlockDecl()->getBody());
4524  return visitor.Capturer;
4525}
4526
4527static void diagnoseRetainCycle(Sema &S, Expr *capturer,
4528                                RetainCycleOwner &owner) {
4529  assert(capturer);
4530  assert(owner.Variable && owner.Loc.isValid());
4531
4532  S.Diag(capturer->getExprLoc(), diag::warn_arc_retain_cycle)
4533    << owner.Variable << capturer->getSourceRange();
4534  S.Diag(owner.Loc, diag::note_arc_retain_cycle_owner)
4535    << owner.Indirect << owner.Range;
4536}
4537
4538/// Check for a keyword selector that starts with the word 'add' or
4539/// 'set'.
4540static bool isSetterLikeSelector(Selector sel) {
4541  if (sel.isUnarySelector()) return false;
4542
4543  StringRef str = sel.getNameForSlot(0);
4544  while (!str.empty() && str.front() == '_') str = str.substr(1);
4545  if (str.startswith("set"))
4546    str = str.substr(3);
4547  else if (str.startswith("add")) {
4548    // Specially whitelist 'addOperationWithBlock:'.
4549    if (sel.getNumArgs() == 1 && str.startswith("addOperationWithBlock"))
4550      return false;
4551    str = str.substr(3);
4552  }
4553  else
4554    return false;
4555
4556  if (str.empty()) return true;
4557  return !islower(str.front());
4558}
4559
4560/// Check a message send to see if it's likely to cause a retain cycle.
4561void Sema::checkRetainCycles(ObjCMessageExpr *msg) {
4562  // Only check instance methods whose selector looks like a setter.
4563  if (!msg->isInstanceMessage() || !isSetterLikeSelector(msg->getSelector()))
4564    return;
4565
4566  // Try to find a variable that the receiver is strongly owned by.
4567  RetainCycleOwner owner;
4568  if (msg->getReceiverKind() == ObjCMessageExpr::Instance) {
4569    if (!findRetainCycleOwner(*this, msg->getInstanceReceiver(), owner))
4570      return;
4571  } else {
4572    assert(msg->getReceiverKind() == ObjCMessageExpr::SuperInstance);
4573    owner.Variable = getCurMethodDecl()->getSelfDecl();
4574    owner.Loc = msg->getSuperLoc();
4575    owner.Range = msg->getSuperLoc();
4576  }
4577
4578  // Check whether the receiver is captured by any of the arguments.
4579  for (unsigned i = 0, e = msg->getNumArgs(); i != e; ++i)
4580    if (Expr *capturer = findCapturingExpr(*this, msg->getArg(i), owner))
4581      return diagnoseRetainCycle(*this, capturer, owner);
4582}
4583
4584/// Check a property assign to see if it's likely to cause a retain cycle.
4585void Sema::checkRetainCycles(Expr *receiver, Expr *argument) {
4586  RetainCycleOwner owner;
4587  if (!findRetainCycleOwner(*this, receiver, owner))
4588    return;
4589
4590  if (Expr *capturer = findCapturingExpr(*this, argument, owner))
4591    diagnoseRetainCycle(*this, capturer, owner);
4592}
4593
4594bool Sema::checkUnsafeAssigns(SourceLocation Loc,
4595                              QualType LHS, Expr *RHS) {
4596  Qualifiers::ObjCLifetime LT = LHS.getObjCLifetime();
4597  if (LT != Qualifiers::OCL_Weak && LT != Qualifiers::OCL_ExplicitNone)
4598    return false;
4599  // strip off any implicit cast added to get to the one arc-specific
4600  while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(RHS)) {
4601    if (cast->getCastKind() == CK_ARCConsumeObject) {
4602      Diag(Loc, diag::warn_arc_retained_assign)
4603        << (LT == Qualifiers::OCL_ExplicitNone)
4604        << RHS->getSourceRange();
4605      return true;
4606    }
4607    RHS = cast->getSubExpr();
4608  }
4609  return false;
4610}
4611
4612void Sema::checkUnsafeExprAssigns(SourceLocation Loc,
4613                              Expr *LHS, Expr *RHS) {
4614  QualType LHSType = LHS->getType();
4615  if (checkUnsafeAssigns(Loc, LHSType, RHS))
4616    return;
4617  Qualifiers::ObjCLifetime LT = LHSType.getObjCLifetime();
4618  // FIXME. Check for other life times.
4619  if (LT != Qualifiers::OCL_None)
4620    return;
4621
4622  if (ObjCPropertyRefExpr *PRE
4623        = dyn_cast<ObjCPropertyRefExpr>(LHS->IgnoreParens())) {
4624    if (PRE->isImplicitProperty())
4625      return;
4626    const ObjCPropertyDecl *PD = PRE->getExplicitProperty();
4627    if (!PD)
4628      return;
4629
4630    unsigned Attributes = PD->getPropertyAttributes();
4631    if (Attributes & ObjCPropertyDecl::OBJC_PR_assign)
4632      while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(RHS)) {
4633        if (cast->getCastKind() == CK_ARCConsumeObject) {
4634          Diag(Loc, diag::warn_arc_retained_property_assign)
4635          << RHS->getSourceRange();
4636          return;
4637        }
4638        RHS = cast->getSubExpr();
4639      }
4640  }
4641}
4642