JumpDiagnostics.cpp revision 8f5e3dd32e443768d9dbbad7191e123e6733750c
1//===--- JumpDiagnostics.cpp - Analyze Jump Targets for VLA issues --------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file implements the JumpScopeChecker class, which is used to diagnose 11// jumps that enter a VLA scope in an invalid way. 12// 13//===----------------------------------------------------------------------===// 14 15#include "Sema.h" 16#include "clang/AST/Expr.h" 17#include "clang/AST/StmtObjC.h" 18#include "clang/AST/StmtCXX.h" 19using namespace clang; 20 21namespace { 22 23/// JumpScopeChecker - This object is used by Sema to diagnose invalid jumps 24/// into VLA and other protected scopes. For example, this rejects: 25/// goto L; 26/// int a[n]; 27/// L: 28/// 29class JumpScopeChecker { 30 Sema &S; 31 32 /// GotoScope - This is a record that we use to keep track of all of the 33 /// scopes that are introduced by VLAs and other things that scope jumps like 34 /// gotos. This scope tree has nothing to do with the source scope tree, 35 /// because you can have multiple VLA scopes per compound statement, and most 36 /// compound statements don't introduce any scopes. 37 struct GotoScope { 38 /// ParentScope - The index in ScopeMap of the parent scope. This is 0 for 39 /// the parent scope is the function body. 40 unsigned ParentScope; 41 42 /// Diag - The diagnostic to emit if there is a jump into this scope. 43 unsigned Diag; 44 45 /// Loc - Location to emit the diagnostic. 46 SourceLocation Loc; 47 48 GotoScope(unsigned parentScope, unsigned diag, SourceLocation L) 49 : ParentScope(parentScope), Diag(diag), Loc(L) {} 50 }; 51 52 llvm::SmallVector<GotoScope, 48> Scopes; 53 llvm::DenseMap<Stmt*, unsigned> LabelAndGotoScopes; 54 llvm::SmallVector<Stmt*, 16> Jumps; 55public: 56 JumpScopeChecker(Stmt *Body, Sema &S); 57private: 58 void BuildScopeInformation(Stmt *S, unsigned ParentScope); 59 void VerifyJumps(); 60 void CheckJump(Stmt *From, Stmt *To, 61 SourceLocation DiagLoc, unsigned JumpDiag); 62}; 63} // end anonymous namespace 64 65 66JumpScopeChecker::JumpScopeChecker(Stmt *Body, Sema &s) : S(s) { 67 // Add a scope entry for function scope. 68 Scopes.push_back(GotoScope(~0U, ~0U, SourceLocation())); 69 70 // Build information for the top level compound statement, so that we have a 71 // defined scope record for every "goto" and label. 72 BuildScopeInformation(Body, 0); 73 74 // Check that all jumps we saw are kosher. 75 VerifyJumps(); 76} 77 78/// GetDiagForGotoScopeDecl - If this decl induces a new goto scope, return a 79/// diagnostic that should be emitted if control goes over it. If not, return 0. 80static unsigned GetDiagForGotoScopeDecl(const Decl *D, bool isCPlusPlus) { 81 if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 82 if (VD->getType()->isVariablyModifiedType()) 83 return diag::note_protected_by_vla; 84 if (VD->hasAttr<CleanupAttr>()) 85 return diag::note_protected_by_cleanup; 86 if (VD->hasAttr<BlocksAttr>()) 87 return diag::note_protected_by___block; 88 // FIXME: In C++0x, we have to check more conditions than "did we 89 // just give it an initializer?". See 6.7p3. 90 if (isCPlusPlus && VD->hasLocalStorage() && VD->hasInit()) 91 return diag::note_protected_by_variable_init; 92 93 } else if (const TypedefDecl *TD = dyn_cast<TypedefDecl>(D)) { 94 if (TD->getUnderlyingType()->isVariablyModifiedType()) 95 return diag::note_protected_by_vla_typedef; 96 } 97 98 return 0; 99} 100 101 102/// BuildScopeInformation - The statements from CI to CE are known to form a 103/// coherent VLA scope with a specified parent node. Walk through the 104/// statements, adding any labels or gotos to LabelAndGotoScopes and recursively 105/// walking the AST as needed. 106void JumpScopeChecker::BuildScopeInformation(Stmt *S, unsigned ParentScope) { 107 108 // If we found a label, remember that it is in ParentScope scope. 109 if (isa<LabelStmt>(S) || isa<DefaultStmt>(S) || isa<CaseStmt>(S)) { 110 LabelAndGotoScopes[S] = ParentScope; 111 } else if (isa<GotoStmt>(S) || isa<SwitchStmt>(S) || 112 isa<IndirectGotoStmt>(S) || isa<AddrLabelExpr>(S)) { 113 // Remember both what scope a goto is in as well as the fact that we have 114 // it. This makes the second scan not have to walk the AST again. 115 LabelAndGotoScopes[S] = ParentScope; 116 Jumps.push_back(S); 117 } 118 119 for (Stmt::child_iterator CI = S->child_begin(), E = S->child_end(); CI != E; 120 ++CI) { 121 Stmt *SubStmt = *CI; 122 if (SubStmt == 0) continue; 123 124 bool isCPlusPlus = this->S.getLangOptions().CPlusPlus; 125 126 // If this is a declstmt with a VLA definition, it defines a scope from here 127 // to the end of the containing context. 128 if (DeclStmt *DS = dyn_cast<DeclStmt>(SubStmt)) { 129 // The decl statement creates a scope if any of the decls in it are VLAs 130 // or have the cleanup attribute. 131 for (DeclStmt::decl_iterator I = DS->decl_begin(), E = DS->decl_end(); 132 I != E; ++I) { 133 // If this decl causes a new scope, push and switch to it. 134 if (unsigned Diag = GetDiagForGotoScopeDecl(*I, isCPlusPlus)) { 135 Scopes.push_back(GotoScope(ParentScope, Diag, (*I)->getLocation())); 136 ParentScope = Scopes.size()-1; 137 } 138 139 // If the decl has an initializer, walk it with the potentially new 140 // scope we just installed. 141 if (VarDecl *VD = dyn_cast<VarDecl>(*I)) 142 if (Expr *Init = VD->getInit()) 143 BuildScopeInformation(Init, ParentScope); 144 } 145 continue; 146 } 147 148 // Disallow jumps into any part of an @try statement by pushing a scope and 149 // walking all sub-stmts in that scope. 150 if (ObjCAtTryStmt *AT = dyn_cast<ObjCAtTryStmt>(SubStmt)) { 151 // Recursively walk the AST for the @try part. 152 Scopes.push_back(GotoScope(ParentScope,diag::note_protected_by_objc_try, 153 AT->getAtTryLoc())); 154 if (Stmt *TryPart = AT->getTryBody()) 155 BuildScopeInformation(TryPart, Scopes.size()-1); 156 157 // Jump from the catch to the finally or try is not valid. 158 for (unsigned I = 0, N = AT->getNumCatchStmts(); I != N; ++I) { 159 ObjCAtCatchStmt *AC = AT->getCatchStmt(I); 160 Scopes.push_back(GotoScope(ParentScope, 161 diag::note_protected_by_objc_catch, 162 AC->getAtCatchLoc())); 163 // @catches are nested and it isn't 164 BuildScopeInformation(AC->getCatchBody(), Scopes.size()-1); 165 } 166 167 // Jump from the finally to the try or catch is not valid. 168 if (ObjCAtFinallyStmt *AF = AT->getFinallyStmt()) { 169 Scopes.push_back(GotoScope(ParentScope, 170 diag::note_protected_by_objc_finally, 171 AF->getAtFinallyLoc())); 172 BuildScopeInformation(AF, Scopes.size()-1); 173 } 174 175 continue; 176 } 177 178 // Disallow jumps into the protected statement of an @synchronized, but 179 // allow jumps into the object expression it protects. 180 if (ObjCAtSynchronizedStmt *AS = dyn_cast<ObjCAtSynchronizedStmt>(SubStmt)){ 181 // Recursively walk the AST for the @synchronized object expr, it is 182 // evaluated in the normal scope. 183 BuildScopeInformation(AS->getSynchExpr(), ParentScope); 184 185 // Recursively walk the AST for the @synchronized part, protected by a new 186 // scope. 187 Scopes.push_back(GotoScope(ParentScope, 188 diag::note_protected_by_objc_synchronized, 189 AS->getAtSynchronizedLoc())); 190 BuildScopeInformation(AS->getSynchBody(), Scopes.size()-1); 191 continue; 192 } 193 194 // Disallow jumps into any part of a C++ try statement. This is pretty 195 // much the same as for Obj-C. 196 if (CXXTryStmt *TS = dyn_cast<CXXTryStmt>(SubStmt)) { 197 Scopes.push_back(GotoScope(ParentScope, diag::note_protected_by_cxx_try, 198 TS->getSourceRange().getBegin())); 199 if (Stmt *TryBlock = TS->getTryBlock()) 200 BuildScopeInformation(TryBlock, Scopes.size()-1); 201 202 // Jump from the catch into the try is not allowed either. 203 for (unsigned I = 0, E = TS->getNumHandlers(); I != E; ++I) { 204 CXXCatchStmt *CS = TS->getHandler(I); 205 Scopes.push_back(GotoScope(ParentScope, 206 diag::note_protected_by_cxx_catch, 207 CS->getSourceRange().getBegin())); 208 BuildScopeInformation(CS->getHandlerBlock(), Scopes.size()-1); 209 } 210 211 continue; 212 } 213 214 // Recursively walk the AST. 215 BuildScopeInformation(SubStmt, ParentScope); 216 } 217} 218 219/// VerifyJumps - Verify each element of the Jumps array to see if they are 220/// valid, emitting diagnostics if not. 221void JumpScopeChecker::VerifyJumps() { 222 while (!Jumps.empty()) { 223 Stmt *Jump = Jumps.pop_back_val(); 224 225 // With a goto, 226 if (GotoStmt *GS = dyn_cast<GotoStmt>(Jump)) { 227 CheckJump(GS, GS->getLabel(), GS->getGotoLoc(), 228 diag::err_goto_into_protected_scope); 229 continue; 230 } 231 232 if (SwitchStmt *SS = dyn_cast<SwitchStmt>(Jump)) { 233 for (SwitchCase *SC = SS->getSwitchCaseList(); SC; 234 SC = SC->getNextSwitchCase()) { 235 assert(LabelAndGotoScopes.count(SC) && "Case not visited?"); 236 CheckJump(SS, SC, SC->getLocStart(), 237 diag::err_switch_into_protected_scope); 238 } 239 continue; 240 } 241 242 unsigned DiagnosticScope; 243 244 // We don't know where an indirect goto goes, require that it be at the 245 // top level of scoping. 246 if (IndirectGotoStmt *IG = dyn_cast<IndirectGotoStmt>(Jump)) { 247 assert(LabelAndGotoScopes.count(Jump) && 248 "Jump didn't get added to scopes?"); 249 unsigned GotoScope = LabelAndGotoScopes[IG]; 250 if (GotoScope == 0) continue; // indirect jump is ok. 251 S.Diag(IG->getGotoLoc(), diag::err_indirect_goto_in_protected_scope); 252 DiagnosticScope = GotoScope; 253 } else { 254 // We model &&Label as a jump for purposes of scope tracking. We actually 255 // don't care *where* the address of label is, but we require the *label 256 // itself* to be in scope 0. If it is nested inside of a VLA scope, then 257 // it is possible for an indirect goto to illegally enter the VLA scope by 258 // indirectly jumping to the label. 259 assert(isa<AddrLabelExpr>(Jump) && "Unknown jump type"); 260 LabelStmt *TheLabel = cast<AddrLabelExpr>(Jump)->getLabel(); 261 262 assert(LabelAndGotoScopes.count(TheLabel) && 263 "Referenced label didn't get added to scopes?"); 264 unsigned LabelScope = LabelAndGotoScopes[TheLabel]; 265 if (LabelScope == 0) continue; // Addr of label is ok. 266 267 S.Diag(Jump->getLocStart(), diag::err_addr_of_label_in_protected_scope); 268 DiagnosticScope = LabelScope; 269 } 270 271 // Report all the things that would be skipped over by this &&label or 272 // indirect goto. 273 while (DiagnosticScope != 0) { 274 S.Diag(Scopes[DiagnosticScope].Loc, Scopes[DiagnosticScope].Diag); 275 DiagnosticScope = Scopes[DiagnosticScope].ParentScope; 276 } 277 } 278} 279 280/// CheckJump - Validate that the specified jump statement is valid: that it is 281/// jumping within or out of its current scope, not into a deeper one. 282void JumpScopeChecker::CheckJump(Stmt *From, Stmt *To, 283 SourceLocation DiagLoc, unsigned JumpDiag) { 284 assert(LabelAndGotoScopes.count(From) && "Jump didn't get added to scopes?"); 285 unsigned FromScope = LabelAndGotoScopes[From]; 286 287 assert(LabelAndGotoScopes.count(To) && "Jump didn't get added to scopes?"); 288 unsigned ToScope = LabelAndGotoScopes[To]; 289 290 // Common case: exactly the same scope, which is fine. 291 if (FromScope == ToScope) return; 292 293 // The only valid mismatch jump case happens when the jump is more deeply 294 // nested inside the jump target. Do a quick scan to see if the jump is valid 295 // because valid code is more common than invalid code. 296 unsigned TestScope = Scopes[FromScope].ParentScope; 297 while (TestScope != ~0U) { 298 // If we found the jump target, then we're jumping out of our current scope, 299 // which is perfectly fine. 300 if (TestScope == ToScope) return; 301 302 // Otherwise, scan up the hierarchy. 303 TestScope = Scopes[TestScope].ParentScope; 304 } 305 306 // If we get here, then we know we have invalid code. Diagnose the bad jump, 307 // and then emit a note at each VLA being jumped out of. 308 S.Diag(DiagLoc, JumpDiag); 309 310 // Eliminate the common prefix of the jump and the target. Start by 311 // linearizing both scopes, reversing them as we go. 312 std::vector<unsigned> FromScopes, ToScopes; 313 for (TestScope = FromScope; TestScope != ~0U; 314 TestScope = Scopes[TestScope].ParentScope) 315 FromScopes.push_back(TestScope); 316 for (TestScope = ToScope; TestScope != ~0U; 317 TestScope = Scopes[TestScope].ParentScope) 318 ToScopes.push_back(TestScope); 319 320 // Remove any common entries (such as the top-level function scope). 321 while (!FromScopes.empty() && FromScopes.back() == ToScopes.back()) { 322 FromScopes.pop_back(); 323 ToScopes.pop_back(); 324 } 325 326 // Emit diagnostics for whatever is left in ToScopes. 327 for (unsigned i = 0, e = ToScopes.size(); i != e; ++i) 328 S.Diag(Scopes[ToScopes[i]].Loc, Scopes[ToScopes[i]].Diag); 329} 330 331void Sema::DiagnoseInvalidJumps(Stmt *Body) { 332 (void)JumpScopeChecker(Body, *this); 333} 334