NoReturnFunctionChecker.cpp revision d9f5a709ddbffe35dcc419c9c3fa6a852e833f7a
1//=== NoReturnFunctionChecker.cpp -------------------------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This defines NoReturnFunctionChecker, which evaluates functions that do not 11// return to the caller. 12// 13//===----------------------------------------------------------------------===// 14 15#include "ClangSACheckers.h" 16#include "clang/StaticAnalyzer/Core/Checker.h" 17#include "clang/StaticAnalyzer/Core/CheckerManager.h" 18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19#include "llvm/ADT/StringSwitch.h" 20#include <cstdarg> 21 22using namespace clang; 23using namespace ento; 24 25namespace { 26 27class NoReturnFunctionChecker : public Checker< check::PostStmt<CallExpr>, 28 check::PostObjCMessage > { 29public: 30 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; 31 void checkPostObjCMessage(const ObjCMessage &msg, CheckerContext &C) const; 32}; 33 34} 35 36void NoReturnFunctionChecker::checkPostStmt(const CallExpr *CE, 37 CheckerContext &C) const { 38 const ProgramState *state = C.getState(); 39 const Expr *Callee = CE->getCallee(); 40 41 bool BuildSinks = getFunctionExtInfo(Callee->getType()).getNoReturn(); 42 43 if (!BuildSinks) { 44 SVal L = state->getSVal(Callee); 45 const FunctionDecl *FD = L.getAsFunctionDecl(); 46 if (!FD) 47 return; 48 49 if (FD->getAttr<AnalyzerNoReturnAttr>()) 50 BuildSinks = true; 51 else if (const IdentifierInfo *II = FD->getIdentifier()) { 52 // HACK: Some functions are not marked noreturn, and don't return. 53 // Here are a few hardwired ones. If this takes too long, we can 54 // potentially cache these results. 55 BuildSinks 56 = llvm::StringSwitch<bool>(StringRef(II->getName())) 57 .Case("exit", true) 58 .Case("panic", true) 59 .Case("error", true) 60 .Case("Assert", true) 61 // FIXME: This is just a wrapper around throwing an exception. 62 // Eventually inter-procedural analysis should handle this easily. 63 .Case("ziperr", true) 64 .Case("assfail", true) 65 .Case("db_error", true) 66 .Case("__assert", true) 67 .Case("__assert_rtn", true) 68 .Case("__assert_fail", true) 69 .Case("dtrace_assfail", true) 70 .Case("yy_fatal_error", true) 71 .Case("_XCAssertionFailureHandler", true) 72 .Case("_DTAssertionFailureHandler", true) 73 .Case("_TSAssertionFailureHandler", true) 74 .Default(false); 75 } 76 } 77 78 if (BuildSinks) 79 C.generateSink(CE); 80} 81 82static bool END_WITH_NULL isMultiArgSelector(Selector Sel, ...) { 83 va_list argp; 84 va_start(argp, Sel); 85 86 unsigned Slot = 0; 87 const char *Arg; 88 while ((Arg = va_arg(argp, const char *))) { 89 if (!Sel.getNameForSlot(Slot).equals(Arg)) 90 break; // still need to va_end! 91 ++Slot; 92 } 93 94 va_end(argp); 95 96 // We only succeeded if we made it to the end of the argument list. 97 return (Arg == NULL); 98} 99 100void NoReturnFunctionChecker::checkPostObjCMessage(const ObjCMessage &Msg, 101 CheckerContext &C) const { 102 // HACK: This entire check is to handle two messages in the Cocoa frameworks: 103 // -[NSAssertionHandler 104 // handleFailureInMethod:object:file:lineNumber:description:] 105 // -[NSAssertionHandler 106 // handleFailureInFunction:file:lineNumber:description:] 107 // Eventually these should be annotated with __attribute__((noreturn)). 108 // Because ObjC messages use dynamic dispatch, it is not generally safe to 109 // assume certain methods can't return. In cases where it is definitely valid, 110 // see if you can mark the methods noreturn or analyzer_noreturn instead of 111 // adding more explicit checks to this method. 112 113 if (!Msg.isInstanceMessage()) 114 return; 115 116 const ObjCInterfaceDecl *Receiver = Msg.getReceiverInterface(); 117 if (!Receiver) 118 return; 119 if (!Receiver->getIdentifier()->isStr("NSAssertionHandler")) 120 return; 121 122 Selector Sel = Msg.getSelector(); 123 switch (Sel.getNumArgs()) { 124 default: 125 return; 126 case 4: 127 if (!isMultiArgSelector(Sel, "handleFailureInFunction", "file", 128 "lineNumber", "description", NULL)) 129 return; 130 break; 131 case 5: 132 if (!isMultiArgSelector(Sel, "handleFailureInMethod", "object", "file", 133 "lineNumber", "description", NULL)) 134 return; 135 break; 136 } 137 138 // If we got here, it's one of the messages we care about. 139 C.generateSink(); 140} 141 142 143void ento::registerNoReturnFunctionChecker(CheckerManager &mgr) { 144 mgr.registerChecker<NoReturnFunctionChecker>(); 145} 146