1 //===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file implements extra semantic analysis beyond what is enforced 11 // by the C type system. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "clang/Sema/SemaInternal.h" 16 #include "clang/AST/ASTContext.h" 17 #include "clang/AST/CharUnits.h" 18 #include "clang/AST/DeclCXX.h" 19 #include "clang/AST/DeclObjC.h" 20 #include "clang/AST/EvaluatedExprVisitor.h" 21 #include "clang/AST/Expr.h" 22 #include "clang/AST/ExprCXX.h" 23 #include "clang/AST/ExprObjC.h" 24 #include "clang/AST/StmtCXX.h" 25 #include "clang/AST/StmtObjC.h" 26 #include "clang/Analysis/Analyses/FormatString.h" 27 #include "clang/Basic/CharInfo.h" 28 #include "clang/Basic/TargetBuiltins.h" 29 #include "clang/Basic/TargetInfo.h" 30 #include "clang/Lex/Lexer.h" // TODO: Extract static functions to fix layering. 31 #include "clang/Sema/Initialization.h" 32 #include "clang/Sema/Lookup.h" 33 #include "clang/Sema/ScopeInfo.h" 34 #include "clang/Sema/Sema.h" 35 #include "llvm/ADT/STLExtras.h" 36 #include "llvm/ADT/SmallBitVector.h" 37 #include "llvm/ADT/SmallString.h" 38 #include "llvm/Support/ConvertUTF.h" 39 #include "llvm/Support/raw_ostream.h" 40 #include <limits> 41 using namespace clang; 42 using namespace sema; 43 44 SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL, 45 unsigned ByteNo) const { 46 return SL->getLocationOfByte(ByteNo, getSourceManager(), LangOpts, 47 Context.getTargetInfo()); 48 } 49 50 /// Checks that a call expression's argument count is the desired number. 51 /// This is useful when doing custom type-checking. Returns true on error. 52 static bool checkArgCount(Sema &S, CallExpr *call, unsigned desiredArgCount) { 53 unsigned argCount = call->getNumArgs(); 54 if (argCount == desiredArgCount) return false; 55 56 if (argCount < desiredArgCount) 57 return S.Diag(call->getLocEnd(), diag::err_typecheck_call_too_few_args) 58 << 0 /*function call*/ << desiredArgCount << argCount 59 << call->getSourceRange(); 60 61 // Highlight all the excess arguments. 62 SourceRange range(call->getArg(desiredArgCount)->getLocStart(), 63 call->getArg(argCount - 1)->getLocEnd()); 64 65 return S.Diag(range.getBegin(), diag::err_typecheck_call_too_many_args) 66 << 0 /*function call*/ << desiredArgCount << argCount 67 << call->getArg(1)->getSourceRange(); 68 } 69 70 /// Check that the first argument to __builtin_annotation is an integer 71 /// and the second argument is a non-wide string literal. 72 static bool SemaBuiltinAnnotation(Sema &S, CallExpr *TheCall) { 73 if (checkArgCount(S, TheCall, 2)) 74 return true; 75 76 // First argument should be an integer. 77 Expr *ValArg = TheCall->getArg(0); 78 QualType Ty = ValArg->getType(); 79 if (!Ty->isIntegerType()) { 80 S.Diag(ValArg->getLocStart(), diag::err_builtin_annotation_first_arg) 81 << ValArg->getSourceRange(); 82 return true; 83 } 84 85 // Second argument should be a constant string. 86 Expr *StrArg = TheCall->getArg(1)->IgnoreParenCasts(); 87 StringLiteral *Literal = dyn_cast<StringLiteral>(StrArg); 88 if (!Literal || !Literal->isAscii()) { 89 S.Diag(StrArg->getLocStart(), diag::err_builtin_annotation_second_arg) 90 << StrArg->getSourceRange(); 91 return true; 92 } 93 94 TheCall->setType(Ty); 95 return false; 96 } 97 98 /// Check that the argument to __builtin_addressof is a glvalue, and set the 99 /// result type to the corresponding pointer type. 100 static bool SemaBuiltinAddressof(Sema &S, CallExpr *TheCall) { 101 if (checkArgCount(S, TheCall, 1)) 102 return true; 103 104 ExprResult Arg(TheCall->getArg(0)); 105 QualType ResultType = S.CheckAddressOfOperand(Arg, TheCall->getLocStart()); 106 if (ResultType.isNull()) 107 return true; 108 109 TheCall->setArg(0, Arg.get()); 110 TheCall->setType(ResultType); 111 return false; 112 } 113 114 ExprResult 115 Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) { 116 ExprResult TheCallResult(TheCall); 117 118 // Find out if any arguments are required to be integer constant expressions. 119 unsigned ICEArguments = 0; 120 ASTContext::GetBuiltinTypeError Error; 121 Context.GetBuiltinType(BuiltinID, Error, &ICEArguments); 122 if (Error != ASTContext::GE_None) 123 ICEArguments = 0; // Don't diagnose previously diagnosed errors. 124 125 // If any arguments are required to be ICE's, check and diagnose. 126 for (unsigned ArgNo = 0; ICEArguments != 0; ++ArgNo) { 127 // Skip arguments not required to be ICE's. 128 if ((ICEArguments & (1 << ArgNo)) == 0) continue; 129 130 llvm::APSInt Result; 131 if (SemaBuiltinConstantArg(TheCall, ArgNo, Result)) 132 return true; 133 ICEArguments &= ~(1 << ArgNo); 134 } 135 136 switch (BuiltinID) { 137 case Builtin::BI__builtin___CFStringMakeConstantString: 138 assert(TheCall->getNumArgs() == 1 && 139 "Wrong # arguments to builtin CFStringMakeConstantString"); 140 if (CheckObjCString(TheCall->getArg(0))) 141 return ExprError(); 142 break; 143 case Builtin::BI__builtin_stdarg_start: 144 case Builtin::BI__builtin_va_start: 145 case Builtin::BI__va_start: 146 if (SemaBuiltinVAStart(TheCall)) 147 return ExprError(); 148 break; 149 case Builtin::BI__builtin_isgreater: 150 case Builtin::BI__builtin_isgreaterequal: 151 case Builtin::BI__builtin_isless: 152 case Builtin::BI__builtin_islessequal: 153 case Builtin::BI__builtin_islessgreater: 154 case Builtin::BI__builtin_isunordered: 155 if (SemaBuiltinUnorderedCompare(TheCall)) 156 return ExprError(); 157 break; 158 case Builtin::BI__builtin_fpclassify: 159 if (SemaBuiltinFPClassification(TheCall, 6)) 160 return ExprError(); 161 break; 162 case Builtin::BI__builtin_isfinite: 163 case Builtin::BI__builtin_isinf: 164 case Builtin::BI__builtin_isinf_sign: 165 case Builtin::BI__builtin_isnan: 166 case Builtin::BI__builtin_isnormal: 167 if (SemaBuiltinFPClassification(TheCall, 1)) 168 return ExprError(); 169 break; 170 case Builtin::BI__builtin_shufflevector: 171 return SemaBuiltinShuffleVector(TheCall); 172 // TheCall will be freed by the smart pointer here, but that's fine, since 173 // SemaBuiltinShuffleVector guts it, but then doesn't release it. 174 case Builtin::BI__builtin_prefetch: 175 if (SemaBuiltinPrefetch(TheCall)) 176 return ExprError(); 177 break; 178 case Builtin::BI__builtin_object_size: 179 if (SemaBuiltinConstantArgRange(TheCall, 1, 0, 3)) 180 return ExprError(); 181 break; 182 case Builtin::BI__builtin_longjmp: 183 if (SemaBuiltinLongjmp(TheCall)) 184 return ExprError(); 185 break; 186 187 case Builtin::BI__builtin_classify_type: 188 if (checkArgCount(*this, TheCall, 1)) return true; 189 TheCall->setType(Context.IntTy); 190 break; 191 case Builtin::BI__builtin_constant_p: 192 if (checkArgCount(*this, TheCall, 1)) return true; 193 TheCall->setType(Context.IntTy); 194 break; 195 case Builtin::BI__sync_fetch_and_add: 196 case Builtin::BI__sync_fetch_and_add_1: 197 case Builtin::BI__sync_fetch_and_add_2: 198 case Builtin::BI__sync_fetch_and_add_4: 199 case Builtin::BI__sync_fetch_and_add_8: 200 case Builtin::BI__sync_fetch_and_add_16: 201 case Builtin::BI__sync_fetch_and_sub: 202 case Builtin::BI__sync_fetch_and_sub_1: 203 case Builtin::BI__sync_fetch_and_sub_2: 204 case Builtin::BI__sync_fetch_and_sub_4: 205 case Builtin::BI__sync_fetch_and_sub_8: 206 case Builtin::BI__sync_fetch_and_sub_16: 207 case Builtin::BI__sync_fetch_and_or: 208 case Builtin::BI__sync_fetch_and_or_1: 209 case Builtin::BI__sync_fetch_and_or_2: 210 case Builtin::BI__sync_fetch_and_or_4: 211 case Builtin::BI__sync_fetch_and_or_8: 212 case Builtin::BI__sync_fetch_and_or_16: 213 case Builtin::BI__sync_fetch_and_and: 214 case Builtin::BI__sync_fetch_and_and_1: 215 case Builtin::BI__sync_fetch_and_and_2: 216 case Builtin::BI__sync_fetch_and_and_4: 217 case Builtin::BI__sync_fetch_and_and_8: 218 case Builtin::BI__sync_fetch_and_and_16: 219 case Builtin::BI__sync_fetch_and_xor: 220 case Builtin::BI__sync_fetch_and_xor_1: 221 case Builtin::BI__sync_fetch_and_xor_2: 222 case Builtin::BI__sync_fetch_and_xor_4: 223 case Builtin::BI__sync_fetch_and_xor_8: 224 case Builtin::BI__sync_fetch_and_xor_16: 225 case Builtin::BI__sync_add_and_fetch: 226 case Builtin::BI__sync_add_and_fetch_1: 227 case Builtin::BI__sync_add_and_fetch_2: 228 case Builtin::BI__sync_add_and_fetch_4: 229 case Builtin::BI__sync_add_and_fetch_8: 230 case Builtin::BI__sync_add_and_fetch_16: 231 case Builtin::BI__sync_sub_and_fetch: 232 case Builtin::BI__sync_sub_and_fetch_1: 233 case Builtin::BI__sync_sub_and_fetch_2: 234 case Builtin::BI__sync_sub_and_fetch_4: 235 case Builtin::BI__sync_sub_and_fetch_8: 236 case Builtin::BI__sync_sub_and_fetch_16: 237 case Builtin::BI__sync_and_and_fetch: 238 case Builtin::BI__sync_and_and_fetch_1: 239 case Builtin::BI__sync_and_and_fetch_2: 240 case Builtin::BI__sync_and_and_fetch_4: 241 case Builtin::BI__sync_and_and_fetch_8: 242 case Builtin::BI__sync_and_and_fetch_16: 243 case Builtin::BI__sync_or_and_fetch: 244 case Builtin::BI__sync_or_and_fetch_1: 245 case Builtin::BI__sync_or_and_fetch_2: 246 case Builtin::BI__sync_or_and_fetch_4: 247 case Builtin::BI__sync_or_and_fetch_8: 248 case Builtin::BI__sync_or_and_fetch_16: 249 case Builtin::BI__sync_xor_and_fetch: 250 case Builtin::BI__sync_xor_and_fetch_1: 251 case Builtin::BI__sync_xor_and_fetch_2: 252 case Builtin::BI__sync_xor_and_fetch_4: 253 case Builtin::BI__sync_xor_and_fetch_8: 254 case Builtin::BI__sync_xor_and_fetch_16: 255 case Builtin::BI__sync_val_compare_and_swap: 256 case Builtin::BI__sync_val_compare_and_swap_1: 257 case Builtin::BI__sync_val_compare_and_swap_2: 258 case Builtin::BI__sync_val_compare_and_swap_4: 259 case Builtin::BI__sync_val_compare_and_swap_8: 260 case Builtin::BI__sync_val_compare_and_swap_16: 261 case Builtin::BI__sync_bool_compare_and_swap: 262 case Builtin::BI__sync_bool_compare_and_swap_1: 263 case Builtin::BI__sync_bool_compare_and_swap_2: 264 case Builtin::BI__sync_bool_compare_and_swap_4: 265 case Builtin::BI__sync_bool_compare_and_swap_8: 266 case Builtin::BI__sync_bool_compare_and_swap_16: 267 case Builtin::BI__sync_lock_test_and_set: 268 case Builtin::BI__sync_lock_test_and_set_1: 269 case Builtin::BI__sync_lock_test_and_set_2: 270 case Builtin::BI__sync_lock_test_and_set_4: 271 case Builtin::BI__sync_lock_test_and_set_8: 272 case Builtin::BI__sync_lock_test_and_set_16: 273 case Builtin::BI__sync_lock_release: 274 case Builtin::BI__sync_lock_release_1: 275 case Builtin::BI__sync_lock_release_2: 276 case Builtin::BI__sync_lock_release_4: 277 case Builtin::BI__sync_lock_release_8: 278 case Builtin::BI__sync_lock_release_16: 279 case Builtin::BI__sync_swap: 280 case Builtin::BI__sync_swap_1: 281 case Builtin::BI__sync_swap_2: 282 case Builtin::BI__sync_swap_4: 283 case Builtin::BI__sync_swap_8: 284 case Builtin::BI__sync_swap_16: 285 return SemaBuiltinAtomicOverloaded(TheCallResult); 286 #define BUILTIN(ID, TYPE, ATTRS) 287 #define ATOMIC_BUILTIN(ID, TYPE, ATTRS) \ 288 case Builtin::BI##ID: \ 289 return SemaAtomicOpsOverloaded(TheCallResult, AtomicExpr::AO##ID); 290 #include "clang/Basic/Builtins.def" 291 case Builtin::BI__builtin_annotation: 292 if (SemaBuiltinAnnotation(*this, TheCall)) 293 return ExprError(); 294 break; 295 case Builtin::BI__builtin_addressof: 296 if (SemaBuiltinAddressof(*this, TheCall)) 297 return ExprError(); 298 break; 299 case Builtin::BI__builtin_operator_new: 300 case Builtin::BI__builtin_operator_delete: 301 if (!getLangOpts().CPlusPlus) { 302 Diag(TheCall->getExprLoc(), diag::err_builtin_requires_language) 303 << (BuiltinID == Builtin::BI__builtin_operator_new 304 ? "__builtin_operator_new" 305 : "__builtin_operator_delete") 306 << "C++"; 307 return ExprError(); 308 } 309 // CodeGen assumes it can find the global new and delete to call, 310 // so ensure that they are declared. 311 DeclareGlobalNewDelete(); 312 break; 313 } 314 315 // Since the target specific builtins for each arch overlap, only check those 316 // of the arch we are compiling for. 317 if (BuiltinID >= Builtin::FirstTSBuiltin) { 318 switch (Context.getTargetInfo().getTriple().getArch()) { 319 case llvm::Triple::arm: 320 case llvm::Triple::armeb: 321 case llvm::Triple::thumb: 322 case llvm::Triple::thumbeb: 323 if (CheckARMBuiltinFunctionCall(BuiltinID, TheCall)) 324 return ExprError(); 325 break; 326 case llvm::Triple::aarch64: 327 case llvm::Triple::aarch64_be: 328 case llvm::Triple::arm64: 329 case llvm::Triple::arm64_be: 330 if (CheckAArch64BuiltinFunctionCall(BuiltinID, TheCall)) 331 return ExprError(); 332 break; 333 case llvm::Triple::mips: 334 case llvm::Triple::mipsel: 335 case llvm::Triple::mips64: 336 case llvm::Triple::mips64el: 337 if (CheckMipsBuiltinFunctionCall(BuiltinID, TheCall)) 338 return ExprError(); 339 break; 340 case llvm::Triple::x86: 341 case llvm::Triple::x86_64: 342 if (CheckX86BuiltinFunctionCall(BuiltinID, TheCall)) 343 return ExprError(); 344 break; 345 default: 346 break; 347 } 348 } 349 350 return TheCallResult; 351 } 352 353 // Get the valid immediate range for the specified NEON type code. 354 static unsigned RFT(unsigned t, bool shift = false, bool ForceQuad = false) { 355 NeonTypeFlags Type(t); 356 int IsQuad = ForceQuad ? true : Type.isQuad(); 357 switch (Type.getEltType()) { 358 case NeonTypeFlags::Int8: 359 case NeonTypeFlags::Poly8: 360 return shift ? 7 : (8 << IsQuad) - 1; 361 case NeonTypeFlags::Int16: 362 case NeonTypeFlags::Poly16: 363 return shift ? 15 : (4 << IsQuad) - 1; 364 case NeonTypeFlags::Int32: 365 return shift ? 31 : (2 << IsQuad) - 1; 366 case NeonTypeFlags::Int64: 367 case NeonTypeFlags::Poly64: 368 return shift ? 63 : (1 << IsQuad) - 1; 369 case NeonTypeFlags::Poly128: 370 return shift ? 127 : (1 << IsQuad) - 1; 371 case NeonTypeFlags::Float16: 372 assert(!shift && "cannot shift float types!"); 373 return (4 << IsQuad) - 1; 374 case NeonTypeFlags::Float32: 375 assert(!shift && "cannot shift float types!"); 376 return (2 << IsQuad) - 1; 377 case NeonTypeFlags::Float64: 378 assert(!shift && "cannot shift float types!"); 379 return (1 << IsQuad) - 1; 380 } 381 llvm_unreachable("Invalid NeonTypeFlag!"); 382 } 383 384 /// getNeonEltType - Return the QualType corresponding to the elements of 385 /// the vector type specified by the NeonTypeFlags. This is used to check 386 /// the pointer arguments for Neon load/store intrinsics. 387 static QualType getNeonEltType(NeonTypeFlags Flags, ASTContext &Context, 388 bool IsPolyUnsigned, bool IsInt64Long) { 389 switch (Flags.getEltType()) { 390 case NeonTypeFlags::Int8: 391 return Flags.isUnsigned() ? Context.UnsignedCharTy : Context.SignedCharTy; 392 case NeonTypeFlags::Int16: 393 return Flags.isUnsigned() ? Context.UnsignedShortTy : Context.ShortTy; 394 case NeonTypeFlags::Int32: 395 return Flags.isUnsigned() ? Context.UnsignedIntTy : Context.IntTy; 396 case NeonTypeFlags::Int64: 397 if (IsInt64Long) 398 return Flags.isUnsigned() ? Context.UnsignedLongTy : Context.LongTy; 399 else 400 return Flags.isUnsigned() ? Context.UnsignedLongLongTy 401 : Context.LongLongTy; 402 case NeonTypeFlags::Poly8: 403 return IsPolyUnsigned ? Context.UnsignedCharTy : Context.SignedCharTy; 404 case NeonTypeFlags::Poly16: 405 return IsPolyUnsigned ? Context.UnsignedShortTy : Context.ShortTy; 406 case NeonTypeFlags::Poly64: 407 return Context.UnsignedLongTy; 408 case NeonTypeFlags::Poly128: 409 break; 410 case NeonTypeFlags::Float16: 411 return Context.HalfTy; 412 case NeonTypeFlags::Float32: 413 return Context.FloatTy; 414 case NeonTypeFlags::Float64: 415 return Context.DoubleTy; 416 } 417 llvm_unreachable("Invalid NeonTypeFlag!"); 418 } 419 420 bool Sema::CheckNeonBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) { 421 llvm::APSInt Result; 422 uint64_t mask = 0; 423 unsigned TV = 0; 424 int PtrArgNum = -1; 425 bool HasConstPtr = false; 426 switch (BuiltinID) { 427 #define GET_NEON_OVERLOAD_CHECK 428 #include "clang/Basic/arm_neon.inc" 429 #undef GET_NEON_OVERLOAD_CHECK 430 } 431 432 // For NEON intrinsics which are overloaded on vector element type, validate 433 // the immediate which specifies which variant to emit. 434 unsigned ImmArg = TheCall->getNumArgs()-1; 435 if (mask) { 436 if (SemaBuiltinConstantArg(TheCall, ImmArg, Result)) 437 return true; 438 439 TV = Result.getLimitedValue(64); 440 if ((TV > 63) || (mask & (1ULL << TV)) == 0) 441 return Diag(TheCall->getLocStart(), diag::err_invalid_neon_type_code) 442 << TheCall->getArg(ImmArg)->getSourceRange(); 443 } 444 445 if (PtrArgNum >= 0) { 446 // Check that pointer arguments have the specified type. 447 Expr *Arg = TheCall->getArg(PtrArgNum); 448 if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) 449 Arg = ICE->getSubExpr(); 450 ExprResult RHS = DefaultFunctionArrayLvalueConversion(Arg); 451 QualType RHSTy = RHS.get()->getType(); 452 453 llvm::Triple::ArchType Arch = Context.getTargetInfo().getTriple().getArch(); 454 bool IsPolyUnsigned = 455 Arch == llvm::Triple::aarch64 || Arch == llvm::Triple::arm64; 456 bool IsInt64Long = 457 Context.getTargetInfo().getInt64Type() == TargetInfo::SignedLong; 458 QualType EltTy = 459 getNeonEltType(NeonTypeFlags(TV), Context, IsPolyUnsigned, IsInt64Long); 460 if (HasConstPtr) 461 EltTy = EltTy.withConst(); 462 QualType LHSTy = Context.getPointerType(EltTy); 463 AssignConvertType ConvTy; 464 ConvTy = CheckSingleAssignmentConstraints(LHSTy, RHS); 465 if (RHS.isInvalid()) 466 return true; 467 if (DiagnoseAssignmentResult(ConvTy, Arg->getLocStart(), LHSTy, RHSTy, 468 RHS.get(), AA_Assigning)) 469 return true; 470 } 471 472 // For NEON intrinsics which take an immediate value as part of the 473 // instruction, range check them here. 474 unsigned i = 0, l = 0, u = 0; 475 switch (BuiltinID) { 476 default: 477 return false; 478 #define GET_NEON_IMMEDIATE_CHECK 479 #include "clang/Basic/arm_neon.inc" 480 #undef GET_NEON_IMMEDIATE_CHECK 481 } 482 483 return SemaBuiltinConstantArgRange(TheCall, i, l, u + l); 484 } 485 486 bool Sema::CheckARMBuiltinExclusiveCall(unsigned BuiltinID, CallExpr *TheCall, 487 unsigned MaxWidth) { 488 assert((BuiltinID == ARM::BI__builtin_arm_ldrex || 489 BuiltinID == ARM::BI__builtin_arm_ldaex || 490 BuiltinID == ARM::BI__builtin_arm_strex || 491 BuiltinID == ARM::BI__builtin_arm_stlex || 492 BuiltinID == AArch64::BI__builtin_arm_ldrex || 493 BuiltinID == AArch64::BI__builtin_arm_ldaex || 494 BuiltinID == AArch64::BI__builtin_arm_strex || 495 BuiltinID == AArch64::BI__builtin_arm_stlex) && 496 "unexpected ARM builtin"); 497 bool IsLdrex = BuiltinID == ARM::BI__builtin_arm_ldrex || 498 BuiltinID == ARM::BI__builtin_arm_ldaex || 499 BuiltinID == AArch64::BI__builtin_arm_ldrex || 500 BuiltinID == AArch64::BI__builtin_arm_ldaex; 501 502 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts()); 503 504 // Ensure that we have the proper number of arguments. 505 if (checkArgCount(*this, TheCall, IsLdrex ? 1 : 2)) 506 return true; 507 508 // Inspect the pointer argument of the atomic builtin. This should always be 509 // a pointer type, whose element is an integral scalar or pointer type. 510 // Because it is a pointer type, we don't have to worry about any implicit 511 // casts here. 512 Expr *PointerArg = TheCall->getArg(IsLdrex ? 0 : 1); 513 ExprResult PointerArgRes = DefaultFunctionArrayLvalueConversion(PointerArg); 514 if (PointerArgRes.isInvalid()) 515 return true; 516 PointerArg = PointerArgRes.get(); 517 518 const PointerType *pointerType = PointerArg->getType()->getAs<PointerType>(); 519 if (!pointerType) { 520 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer) 521 << PointerArg->getType() << PointerArg->getSourceRange(); 522 return true; 523 } 524 525 // ldrex takes a "const volatile T*" and strex takes a "volatile T*". Our next 526 // task is to insert the appropriate casts into the AST. First work out just 527 // what the appropriate type is. 528 QualType ValType = pointerType->getPointeeType(); 529 QualType AddrType = ValType.getUnqualifiedType().withVolatile(); 530 if (IsLdrex) 531 AddrType.addConst(); 532 533 // Issue a warning if the cast is dodgy. 534 CastKind CastNeeded = CK_NoOp; 535 if (!AddrType.isAtLeastAsQualifiedAs(ValType)) { 536 CastNeeded = CK_BitCast; 537 Diag(DRE->getLocStart(), diag::ext_typecheck_convert_discards_qualifiers) 538 << PointerArg->getType() 539 << Context.getPointerType(AddrType) 540 << AA_Passing << PointerArg->getSourceRange(); 541 } 542 543 // Finally, do the cast and replace the argument with the corrected version. 544 AddrType = Context.getPointerType(AddrType); 545 PointerArgRes = ImpCastExprToType(PointerArg, AddrType, CastNeeded); 546 if (PointerArgRes.isInvalid()) 547 return true; 548 PointerArg = PointerArgRes.get(); 549 550 TheCall->setArg(IsLdrex ? 0 : 1, PointerArg); 551 552 // In general, we allow ints, floats and pointers to be loaded and stored. 553 if (!ValType->isIntegerType() && !ValType->isAnyPointerType() && 554 !ValType->isBlockPointerType() && !ValType->isFloatingType()) { 555 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intfltptr) 556 << PointerArg->getType() << PointerArg->getSourceRange(); 557 return true; 558 } 559 560 // But ARM doesn't have instructions to deal with 128-bit versions. 561 if (Context.getTypeSize(ValType) > MaxWidth) { 562 assert(MaxWidth == 64 && "Diagnostic unexpectedly inaccurate"); 563 Diag(DRE->getLocStart(), diag::err_atomic_exclusive_builtin_pointer_size) 564 << PointerArg->getType() << PointerArg->getSourceRange(); 565 return true; 566 } 567 568 switch (ValType.getObjCLifetime()) { 569 case Qualifiers::OCL_None: 570 case Qualifiers::OCL_ExplicitNone: 571 // okay 572 break; 573 574 case Qualifiers::OCL_Weak: 575 case Qualifiers::OCL_Strong: 576 case Qualifiers::OCL_Autoreleasing: 577 Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership) 578 << ValType << PointerArg->getSourceRange(); 579 return true; 580 } 581 582 583 if (IsLdrex) { 584 TheCall->setType(ValType); 585 return false; 586 } 587 588 // Initialize the argument to be stored. 589 ExprResult ValArg = TheCall->getArg(0); 590 InitializedEntity Entity = InitializedEntity::InitializeParameter( 591 Context, ValType, /*consume*/ false); 592 ValArg = PerformCopyInitialization(Entity, SourceLocation(), ValArg); 593 if (ValArg.isInvalid()) 594 return true; 595 TheCall->setArg(0, ValArg.get()); 596 597 // __builtin_arm_strex always returns an int. It's marked as such in the .def, 598 // but the custom checker bypasses all default analysis. 599 TheCall->setType(Context.IntTy); 600 return false; 601 } 602 603 bool Sema::CheckARMBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) { 604 llvm::APSInt Result; 605 606 if (BuiltinID == ARM::BI__builtin_arm_ldrex || 607 BuiltinID == ARM::BI__builtin_arm_ldaex || 608 BuiltinID == ARM::BI__builtin_arm_strex || 609 BuiltinID == ARM::BI__builtin_arm_stlex) { 610 return CheckARMBuiltinExclusiveCall(BuiltinID, TheCall, 64); 611 } 612 613 if (CheckNeonBuiltinFunctionCall(BuiltinID, TheCall)) 614 return true; 615 616 // For intrinsics which take an immediate value as part of the instruction, 617 // range check them here. 618 unsigned i = 0, l = 0, u = 0; 619 switch (BuiltinID) { 620 default: return false; 621 case ARM::BI__builtin_arm_ssat: i = 1; l = 1; u = 31; break; 622 case ARM::BI__builtin_arm_usat: i = 1; u = 31; break; 623 case ARM::BI__builtin_arm_vcvtr_f: 624 case ARM::BI__builtin_arm_vcvtr_d: i = 1; u = 1; break; 625 case ARM::BI__builtin_arm_dmb: 626 case ARM::BI__builtin_arm_dsb: 627 case ARM::BI__builtin_arm_isb: l = 0; u = 15; break; 628 } 629 630 // FIXME: VFP Intrinsics should error if VFP not present. 631 return SemaBuiltinConstantArgRange(TheCall, i, l, u + l); 632 } 633 634 bool Sema::CheckAArch64BuiltinFunctionCall(unsigned BuiltinID, 635 CallExpr *TheCall) { 636 llvm::APSInt Result; 637 638 if (BuiltinID == AArch64::BI__builtin_arm_ldrex || 639 BuiltinID == AArch64::BI__builtin_arm_ldaex || 640 BuiltinID == AArch64::BI__builtin_arm_strex || 641 BuiltinID == AArch64::BI__builtin_arm_stlex) { 642 return CheckARMBuiltinExclusiveCall(BuiltinID, TheCall, 128); 643 } 644 645 if (CheckNeonBuiltinFunctionCall(BuiltinID, TheCall)) 646 return true; 647 648 return false; 649 } 650 651 bool Sema::CheckMipsBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) { 652 unsigned i = 0, l = 0, u = 0; 653 switch (BuiltinID) { 654 default: return false; 655 case Mips::BI__builtin_mips_wrdsp: i = 1; l = 0; u = 63; break; 656 case Mips::BI__builtin_mips_rddsp: i = 0; l = 0; u = 63; break; 657 case Mips::BI__builtin_mips_append: i = 2; l = 0; u = 31; break; 658 case Mips::BI__builtin_mips_balign: i = 2; l = 0; u = 3; break; 659 case Mips::BI__builtin_mips_precr_sra_ph_w: i = 2; l = 0; u = 31; break; 660 case Mips::BI__builtin_mips_precr_sra_r_ph_w: i = 2; l = 0; u = 31; break; 661 case Mips::BI__builtin_mips_prepend: i = 2; l = 0; u = 31; break; 662 } 663 664 return SemaBuiltinConstantArgRange(TheCall, i, l, u); 665 } 666 667 bool Sema::CheckX86BuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) { 668 switch (BuiltinID) { 669 case X86::BI_mm_prefetch: 670 // This is declared to take (const char*, int) 671 return SemaBuiltinConstantArgRange(TheCall, 1, 0, 3); 672 } 673 return false; 674 } 675 676 /// Given a FunctionDecl's FormatAttr, attempts to populate the FomatStringInfo 677 /// parameter with the FormatAttr's correct format_idx and firstDataArg. 678 /// Returns true when the format fits the function and the FormatStringInfo has 679 /// been populated. 680 bool Sema::getFormatStringInfo(const FormatAttr *Format, bool IsCXXMember, 681 FormatStringInfo *FSI) { 682 FSI->HasVAListArg = Format->getFirstArg() == 0; 683 FSI->FormatIdx = Format->getFormatIdx() - 1; 684 FSI->FirstDataArg = FSI->HasVAListArg ? 0 : Format->getFirstArg() - 1; 685 686 // The way the format attribute works in GCC, the implicit this argument 687 // of member functions is counted. However, it doesn't appear in our own 688 // lists, so decrement format_idx in that case. 689 if (IsCXXMember) { 690 if(FSI->FormatIdx == 0) 691 return false; 692 --FSI->FormatIdx; 693 if (FSI->FirstDataArg != 0) 694 --FSI->FirstDataArg; 695 } 696 return true; 697 } 698 699 /// Checks if a the given expression evaluates to null. 700 /// 701 /// \brief Returns true if the value evaluates to null. 702 static bool CheckNonNullExpr(Sema &S, 703 const Expr *Expr) { 704 // As a special case, transparent unions initialized with zero are 705 // considered null for the purposes of the nonnull attribute. 706 if (const RecordType *UT = Expr->getType()->getAsUnionType()) { 707 if (UT->getDecl()->hasAttr<TransparentUnionAttr>()) 708 if (const CompoundLiteralExpr *CLE = 709 dyn_cast<CompoundLiteralExpr>(Expr)) 710 if (const InitListExpr *ILE = 711 dyn_cast<InitListExpr>(CLE->getInitializer())) 712 Expr = ILE->getInit(0); 713 } 714 715 bool Result; 716 return (!Expr->isValueDependent() && 717 Expr->EvaluateAsBooleanCondition(Result, S.Context) && 718 !Result); 719 } 720 721 static void CheckNonNullArgument(Sema &S, 722 const Expr *ArgExpr, 723 SourceLocation CallSiteLoc) { 724 if (CheckNonNullExpr(S, ArgExpr)) 725 S.Diag(CallSiteLoc, diag::warn_null_arg) << ArgExpr->getSourceRange(); 726 } 727 728 static void CheckNonNullArguments(Sema &S, 729 const NamedDecl *FDecl, 730 const Expr * const *ExprArgs, 731 SourceLocation CallSiteLoc) { 732 // Check the attributes attached to the method/function itself. 733 for (const auto *NonNull : FDecl->specific_attrs<NonNullAttr>()) { 734 for (const auto &Val : NonNull->args()) 735 CheckNonNullArgument(S, ExprArgs[Val], CallSiteLoc); 736 } 737 738 // Check the attributes on the parameters. 739 ArrayRef<ParmVarDecl*> parms; 740 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FDecl)) 741 parms = FD->parameters(); 742 else if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(FDecl)) 743 parms = MD->parameters(); 744 745 unsigned argIndex = 0; 746 for (ArrayRef<ParmVarDecl*>::iterator I = parms.begin(), E = parms.end(); 747 I != E; ++I, ++argIndex) { 748 const ParmVarDecl *PVD = *I; 749 if (PVD->hasAttr<NonNullAttr>()) 750 CheckNonNullArgument(S, ExprArgs[argIndex], CallSiteLoc); 751 } 752 } 753 754 /// Handles the checks for format strings, non-POD arguments to vararg 755 /// functions, and NULL arguments passed to non-NULL parameters. 756 void Sema::checkCall(NamedDecl *FDecl, ArrayRef<const Expr *> Args, 757 unsigned NumParams, bool IsMemberFunction, 758 SourceLocation Loc, SourceRange Range, 759 VariadicCallType CallType) { 760 // FIXME: We should check as much as we can in the template definition. 761 if (CurContext->isDependentContext()) 762 return; 763 764 // Printf and scanf checking. 765 llvm::SmallBitVector CheckedVarArgs; 766 if (FDecl) { 767 for (const auto *I : FDecl->specific_attrs<FormatAttr>()) { 768 // Only create vector if there are format attributes. 769 CheckedVarArgs.resize(Args.size()); 770 771 CheckFormatArguments(I, Args, IsMemberFunction, CallType, Loc, Range, 772 CheckedVarArgs); 773 } 774 } 775 776 // Refuse POD arguments that weren't caught by the format string 777 // checks above. 778 if (CallType != VariadicDoesNotApply) { 779 for (unsigned ArgIdx = NumParams; ArgIdx < Args.size(); ++ArgIdx) { 780 // Args[ArgIdx] can be null in malformed code. 781 if (const Expr *Arg = Args[ArgIdx]) { 782 if (CheckedVarArgs.empty() || !CheckedVarArgs[ArgIdx]) 783 checkVariadicArgument(Arg, CallType); 784 } 785 } 786 } 787 788 if (FDecl) { 789 CheckNonNullArguments(*this, FDecl, Args.data(), Loc); 790 791 // Type safety checking. 792 for (const auto *I : FDecl->specific_attrs<ArgumentWithTypeTagAttr>()) 793 CheckArgumentWithTypeTag(I, Args.data()); 794 } 795 } 796 797 /// CheckConstructorCall - Check a constructor call for correctness and safety 798 /// properties not enforced by the C type system. 799 void Sema::CheckConstructorCall(FunctionDecl *FDecl, 800 ArrayRef<const Expr *> Args, 801 const FunctionProtoType *Proto, 802 SourceLocation Loc) { 803 VariadicCallType CallType = 804 Proto->isVariadic() ? VariadicConstructor : VariadicDoesNotApply; 805 checkCall(FDecl, Args, Proto->getNumParams(), 806 /*IsMemberFunction=*/true, Loc, SourceRange(), CallType); 807 } 808 809 /// CheckFunctionCall - Check a direct function call for various correctness 810 /// and safety properties not strictly enforced by the C type system. 811 bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall, 812 const FunctionProtoType *Proto) { 813 bool IsMemberOperatorCall = isa<CXXOperatorCallExpr>(TheCall) && 814 isa<CXXMethodDecl>(FDecl); 815 bool IsMemberFunction = isa<CXXMemberCallExpr>(TheCall) || 816 IsMemberOperatorCall; 817 VariadicCallType CallType = getVariadicCallType(FDecl, Proto, 818 TheCall->getCallee()); 819 unsigned NumParams = Proto ? Proto->getNumParams() : 0; 820 Expr** Args = TheCall->getArgs(); 821 unsigned NumArgs = TheCall->getNumArgs(); 822 if (IsMemberOperatorCall) { 823 // If this is a call to a member operator, hide the first argument 824 // from checkCall. 825 // FIXME: Our choice of AST representation here is less than ideal. 826 ++Args; 827 --NumArgs; 828 } 829 checkCall(FDecl, llvm::makeArrayRef<const Expr *>(Args, NumArgs), NumParams, 830 IsMemberFunction, TheCall->getRParenLoc(), 831 TheCall->getCallee()->getSourceRange(), CallType); 832 833 IdentifierInfo *FnInfo = FDecl->getIdentifier(); 834 // None of the checks below are needed for functions that don't have 835 // simple names (e.g., C++ conversion functions). 836 if (!FnInfo) 837 return false; 838 839 CheckAbsoluteValueFunction(TheCall, FDecl, FnInfo); 840 841 unsigned CMId = FDecl->getMemoryFunctionKind(); 842 if (CMId == 0) 843 return false; 844 845 // Handle memory setting and copying functions. 846 if (CMId == Builtin::BIstrlcpy || CMId == Builtin::BIstrlcat) 847 CheckStrlcpycatArguments(TheCall, FnInfo); 848 else if (CMId == Builtin::BIstrncat) 849 CheckStrncatArguments(TheCall, FnInfo); 850 else 851 CheckMemaccessArguments(TheCall, CMId, FnInfo); 852 853 return false; 854 } 855 856 bool Sema::CheckObjCMethodCall(ObjCMethodDecl *Method, SourceLocation lbrac, 857 ArrayRef<const Expr *> Args) { 858 VariadicCallType CallType = 859 Method->isVariadic() ? VariadicMethod : VariadicDoesNotApply; 860 861 checkCall(Method, Args, Method->param_size(), 862 /*IsMemberFunction=*/false, 863 lbrac, Method->getSourceRange(), CallType); 864 865 return false; 866 } 867 868 bool Sema::CheckPointerCall(NamedDecl *NDecl, CallExpr *TheCall, 869 const FunctionProtoType *Proto) { 870 const VarDecl *V = dyn_cast<VarDecl>(NDecl); 871 if (!V) 872 return false; 873 874 QualType Ty = V->getType(); 875 if (!Ty->isBlockPointerType() && !Ty->isFunctionPointerType()) 876 return false; 877 878 VariadicCallType CallType; 879 if (!Proto || !Proto->isVariadic()) { 880 CallType = VariadicDoesNotApply; 881 } else if (Ty->isBlockPointerType()) { 882 CallType = VariadicBlock; 883 } else { // Ty->isFunctionPointerType() 884 CallType = VariadicFunction; 885 } 886 unsigned NumParams = Proto ? Proto->getNumParams() : 0; 887 888 checkCall(NDecl, llvm::makeArrayRef<const Expr *>(TheCall->getArgs(), 889 TheCall->getNumArgs()), 890 NumParams, /*IsMemberFunction=*/false, TheCall->getRParenLoc(), 891 TheCall->getCallee()->getSourceRange(), CallType); 892 893 return false; 894 } 895 896 /// Checks function calls when a FunctionDecl or a NamedDecl is not available, 897 /// such as function pointers returned from functions. 898 bool Sema::CheckOtherCall(CallExpr *TheCall, const FunctionProtoType *Proto) { 899 VariadicCallType CallType = getVariadicCallType(/*FDecl=*/nullptr, Proto, 900 TheCall->getCallee()); 901 unsigned NumParams = Proto ? Proto->getNumParams() : 0; 902 903 checkCall(/*FDecl=*/nullptr, 904 llvm::makeArrayRef<const Expr *>(TheCall->getArgs(), 905 TheCall->getNumArgs()), 906 NumParams, /*IsMemberFunction=*/false, TheCall->getRParenLoc(), 907 TheCall->getCallee()->getSourceRange(), CallType); 908 909 return false; 910 } 911 912 static bool isValidOrderingForOp(int64_t Ordering, AtomicExpr::AtomicOp Op) { 913 if (Ordering < AtomicExpr::AO_ABI_memory_order_relaxed || 914 Ordering > AtomicExpr::AO_ABI_memory_order_seq_cst) 915 return false; 916 917 switch (Op) { 918 case AtomicExpr::AO__c11_atomic_init: 919 llvm_unreachable("There is no ordering argument for an init"); 920 921 case AtomicExpr::AO__c11_atomic_load: 922 case AtomicExpr::AO__atomic_load_n: 923 case AtomicExpr::AO__atomic_load: 924 return Ordering != AtomicExpr::AO_ABI_memory_order_release && 925 Ordering != AtomicExpr::AO_ABI_memory_order_acq_rel; 926 927 case AtomicExpr::AO__c11_atomic_store: 928 case AtomicExpr::AO__atomic_store: 929 case AtomicExpr::AO__atomic_store_n: 930 return Ordering != AtomicExpr::AO_ABI_memory_order_consume && 931 Ordering != AtomicExpr::AO_ABI_memory_order_acquire && 932 Ordering != AtomicExpr::AO_ABI_memory_order_acq_rel; 933 934 default: 935 return true; 936 } 937 } 938 939 ExprResult Sema::SemaAtomicOpsOverloaded(ExprResult TheCallResult, 940 AtomicExpr::AtomicOp Op) { 941 CallExpr *TheCall = cast<CallExpr>(TheCallResult.get()); 942 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts()); 943 944 // All these operations take one of the following forms: 945 enum { 946 // C __c11_atomic_init(A *, C) 947 Init, 948 // C __c11_atomic_load(A *, int) 949 Load, 950 // void __atomic_load(A *, CP, int) 951 Copy, 952 // C __c11_atomic_add(A *, M, int) 953 Arithmetic, 954 // C __atomic_exchange_n(A *, CP, int) 955 Xchg, 956 // void __atomic_exchange(A *, C *, CP, int) 957 GNUXchg, 958 // bool __c11_atomic_compare_exchange_strong(A *, C *, CP, int, int) 959 C11CmpXchg, 960 // bool __atomic_compare_exchange(A *, C *, CP, bool, int, int) 961 GNUCmpXchg 962 } Form = Init; 963 const unsigned NumArgs[] = { 2, 2, 3, 3, 3, 4, 5, 6 }; 964 const unsigned NumVals[] = { 1, 0, 1, 1, 1, 2, 2, 3 }; 965 // where: 966 // C is an appropriate type, 967 // A is volatile _Atomic(C) for __c11 builtins and is C for GNU builtins, 968 // CP is C for __c11 builtins and GNU _n builtins and is C * otherwise, 969 // M is C if C is an integer, and ptrdiff_t if C is a pointer, and 970 // the int parameters are for orderings. 971 972 assert(AtomicExpr::AO__c11_atomic_init == 0 && 973 AtomicExpr::AO__c11_atomic_fetch_xor + 1 == AtomicExpr::AO__atomic_load 974 && "need to update code for modified C11 atomics"); 975 bool IsC11 = Op >= AtomicExpr::AO__c11_atomic_init && 976 Op <= AtomicExpr::AO__c11_atomic_fetch_xor; 977 bool IsN = Op == AtomicExpr::AO__atomic_load_n || 978 Op == AtomicExpr::AO__atomic_store_n || 979 Op == AtomicExpr::AO__atomic_exchange_n || 980 Op == AtomicExpr::AO__atomic_compare_exchange_n; 981 bool IsAddSub = false; 982 983 switch (Op) { 984 case AtomicExpr::AO__c11_atomic_init: 985 Form = Init; 986 break; 987 988 case AtomicExpr::AO__c11_atomic_load: 989 case AtomicExpr::AO__atomic_load_n: 990 Form = Load; 991 break; 992 993 case AtomicExpr::AO__c11_atomic_store: 994 case AtomicExpr::AO__atomic_load: 995 case AtomicExpr::AO__atomic_store: 996 case AtomicExpr::AO__atomic_store_n: 997 Form = Copy; 998 break; 999 1000 case AtomicExpr::AO__c11_atomic_fetch_add: 1001 case AtomicExpr::AO__c11_atomic_fetch_sub: 1002 case AtomicExpr::AO__atomic_fetch_add: 1003 case AtomicExpr::AO__atomic_fetch_sub: 1004 case AtomicExpr::AO__atomic_add_fetch: 1005 case AtomicExpr::AO__atomic_sub_fetch: 1006 IsAddSub = true; 1007 // Fall through. 1008 case AtomicExpr::AO__c11_atomic_fetch_and: 1009 case AtomicExpr::AO__c11_atomic_fetch_or: 1010 case AtomicExpr::AO__c11_atomic_fetch_xor: 1011 case AtomicExpr::AO__atomic_fetch_and: 1012 case AtomicExpr::AO__atomic_fetch_or: 1013 case AtomicExpr::AO__atomic_fetch_xor: 1014 case AtomicExpr::AO__atomic_fetch_nand: 1015 case AtomicExpr::AO__atomic_and_fetch: 1016 case AtomicExpr::AO__atomic_or_fetch: 1017 case AtomicExpr::AO__atomic_xor_fetch: 1018 case AtomicExpr::AO__atomic_nand_fetch: 1019 Form = Arithmetic; 1020 break; 1021 1022 case AtomicExpr::AO__c11_atomic_exchange: 1023 case AtomicExpr::AO__atomic_exchange_n: 1024 Form = Xchg; 1025 break; 1026 1027 case AtomicExpr::AO__atomic_exchange: 1028 Form = GNUXchg; 1029 break; 1030 1031 case AtomicExpr::AO__c11_atomic_compare_exchange_strong: 1032 case AtomicExpr::AO__c11_atomic_compare_exchange_weak: 1033 Form = C11CmpXchg; 1034 break; 1035 1036 case AtomicExpr::AO__atomic_compare_exchange: 1037 case AtomicExpr::AO__atomic_compare_exchange_n: 1038 Form = GNUCmpXchg; 1039 break; 1040 } 1041 1042 // Check we have the right number of arguments. 1043 if (TheCall->getNumArgs() < NumArgs[Form]) { 1044 Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args) 1045 << 0 << NumArgs[Form] << TheCall->getNumArgs() 1046 << TheCall->getCallee()->getSourceRange(); 1047 return ExprError(); 1048 } else if (TheCall->getNumArgs() > NumArgs[Form]) { 1049 Diag(TheCall->getArg(NumArgs[Form])->getLocStart(), 1050 diag::err_typecheck_call_too_many_args) 1051 << 0 << NumArgs[Form] << TheCall->getNumArgs() 1052 << TheCall->getCallee()->getSourceRange(); 1053 return ExprError(); 1054 } 1055 1056 // Inspect the first argument of the atomic operation. 1057 Expr *Ptr = TheCall->getArg(0); 1058 Ptr = DefaultFunctionArrayLvalueConversion(Ptr).get(); 1059 const PointerType *pointerType = Ptr->getType()->getAs<PointerType>(); 1060 if (!pointerType) { 1061 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer) 1062 << Ptr->getType() << Ptr->getSourceRange(); 1063 return ExprError(); 1064 } 1065 1066 // For a __c11 builtin, this should be a pointer to an _Atomic type. 1067 QualType AtomTy = pointerType->getPointeeType(); // 'A' 1068 QualType ValType = AtomTy; // 'C' 1069 if (IsC11) { 1070 if (!AtomTy->isAtomicType()) { 1071 Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic) 1072 << Ptr->getType() << Ptr->getSourceRange(); 1073 return ExprError(); 1074 } 1075 if (AtomTy.isConstQualified()) { 1076 Diag(DRE->getLocStart(), diag::err_atomic_op_needs_non_const_atomic) 1077 << Ptr->getType() << Ptr->getSourceRange(); 1078 return ExprError(); 1079 } 1080 ValType = AtomTy->getAs<AtomicType>()->getValueType(); 1081 } 1082 1083 // For an arithmetic operation, the implied arithmetic must be well-formed. 1084 if (Form == Arithmetic) { 1085 // gcc does not enforce these rules for GNU atomics, but we do so for sanity. 1086 if (IsAddSub && !ValType->isIntegerType() && !ValType->isPointerType()) { 1087 Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic_int_or_ptr) 1088 << IsC11 << Ptr->getType() << Ptr->getSourceRange(); 1089 return ExprError(); 1090 } 1091 if (!IsAddSub && !ValType->isIntegerType()) { 1092 Diag(DRE->getLocStart(), diag::err_atomic_op_bitwise_needs_atomic_int) 1093 << IsC11 << Ptr->getType() << Ptr->getSourceRange(); 1094 return ExprError(); 1095 } 1096 } else if (IsN && !ValType->isIntegerType() && !ValType->isPointerType()) { 1097 // For __atomic_*_n operations, the value type must be a scalar integral or 1098 // pointer type which is 1, 2, 4, 8 or 16 bytes in length. 1099 Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic_int_or_ptr) 1100 << IsC11 << Ptr->getType() << Ptr->getSourceRange(); 1101 return ExprError(); 1102 } 1103 1104 if (!IsC11 && !AtomTy.isTriviallyCopyableType(Context) && 1105 !AtomTy->isScalarType()) { 1106 // For GNU atomics, require a trivially-copyable type. This is not part of 1107 // the GNU atomics specification, but we enforce it for sanity. 1108 Diag(DRE->getLocStart(), diag::err_atomic_op_needs_trivial_copy) 1109 << Ptr->getType() << Ptr->getSourceRange(); 1110 return ExprError(); 1111 } 1112 1113 // FIXME: For any builtin other than a load, the ValType must not be 1114 // const-qualified. 1115 1116 switch (ValType.getObjCLifetime()) { 1117 case Qualifiers::OCL_None: 1118 case Qualifiers::OCL_ExplicitNone: 1119 // okay 1120 break; 1121 1122 case Qualifiers::OCL_Weak: 1123 case Qualifiers::OCL_Strong: 1124 case Qualifiers::OCL_Autoreleasing: 1125 // FIXME: Can this happen? By this point, ValType should be known 1126 // to be trivially copyable. 1127 Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership) 1128 << ValType << Ptr->getSourceRange(); 1129 return ExprError(); 1130 } 1131 1132 QualType ResultType = ValType; 1133 if (Form == Copy || Form == GNUXchg || Form == Init) 1134 ResultType = Context.VoidTy; 1135 else if (Form == C11CmpXchg || Form == GNUCmpXchg) 1136 ResultType = Context.BoolTy; 1137 1138 // The type of a parameter passed 'by value'. In the GNU atomics, such 1139 // arguments are actually passed as pointers. 1140 QualType ByValType = ValType; // 'CP' 1141 if (!IsC11 && !IsN) 1142 ByValType = Ptr->getType(); 1143 1144 // The first argument --- the pointer --- has a fixed type; we 1145 // deduce the types of the rest of the arguments accordingly. Walk 1146 // the remaining arguments, converting them to the deduced value type. 1147 for (unsigned i = 1; i != NumArgs[Form]; ++i) { 1148 QualType Ty; 1149 if (i < NumVals[Form] + 1) { 1150 switch (i) { 1151 case 1: 1152 // The second argument is the non-atomic operand. For arithmetic, this 1153 // is always passed by value, and for a compare_exchange it is always 1154 // passed by address. For the rest, GNU uses by-address and C11 uses 1155 // by-value. 1156 assert(Form != Load); 1157 if (Form == Init || (Form == Arithmetic && ValType->isIntegerType())) 1158 Ty = ValType; 1159 else if (Form == Copy || Form == Xchg) 1160 Ty = ByValType; 1161 else if (Form == Arithmetic) 1162 Ty = Context.getPointerDiffType(); 1163 else 1164 Ty = Context.getPointerType(ValType.getUnqualifiedType()); 1165 break; 1166 case 2: 1167 // The third argument to compare_exchange / GNU exchange is a 1168 // (pointer to a) desired value. 1169 Ty = ByValType; 1170 break; 1171 case 3: 1172 // The fourth argument to GNU compare_exchange is a 'weak' flag. 1173 Ty = Context.BoolTy; 1174 break; 1175 } 1176 } else { 1177 // The order(s) are always converted to int. 1178 Ty = Context.IntTy; 1179 } 1180 1181 InitializedEntity Entity = 1182 InitializedEntity::InitializeParameter(Context, Ty, false); 1183 ExprResult Arg = TheCall->getArg(i); 1184 Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg); 1185 if (Arg.isInvalid()) 1186 return true; 1187 TheCall->setArg(i, Arg.get()); 1188 } 1189 1190 // Permute the arguments into a 'consistent' order. 1191 SmallVector<Expr*, 5> SubExprs; 1192 SubExprs.push_back(Ptr); 1193 switch (Form) { 1194 case Init: 1195 // Note, AtomicExpr::getVal1() has a special case for this atomic. 1196 SubExprs.push_back(TheCall->getArg(1)); // Val1 1197 break; 1198 case Load: 1199 SubExprs.push_back(TheCall->getArg(1)); // Order 1200 break; 1201 case Copy: 1202 case Arithmetic: 1203 case Xchg: 1204 SubExprs.push_back(TheCall->getArg(2)); // Order 1205 SubExprs.push_back(TheCall->getArg(1)); // Val1 1206 break; 1207 case GNUXchg: 1208 // Note, AtomicExpr::getVal2() has a special case for this atomic. 1209 SubExprs.push_back(TheCall->getArg(3)); // Order 1210 SubExprs.push_back(TheCall->getArg(1)); // Val1 1211 SubExprs.push_back(TheCall->getArg(2)); // Val2 1212 break; 1213 case C11CmpXchg: 1214 SubExprs.push_back(TheCall->getArg(3)); // Order 1215 SubExprs.push_back(TheCall->getArg(1)); // Val1 1216 SubExprs.push_back(TheCall->getArg(4)); // OrderFail 1217 SubExprs.push_back(TheCall->getArg(2)); // Val2 1218 break; 1219 case GNUCmpXchg: 1220 SubExprs.push_back(TheCall->getArg(4)); // Order 1221 SubExprs.push_back(TheCall->getArg(1)); // Val1 1222 SubExprs.push_back(TheCall->getArg(5)); // OrderFail 1223 SubExprs.push_back(TheCall->getArg(2)); // Val2 1224 SubExprs.push_back(TheCall->getArg(3)); // Weak 1225 break; 1226 } 1227 1228 if (SubExprs.size() >= 2 && Form != Init) { 1229 llvm::APSInt Result(32); 1230 if (SubExprs[1]->isIntegerConstantExpr(Result, Context) && 1231 !isValidOrderingForOp(Result.getSExtValue(), Op)) 1232 Diag(SubExprs[1]->getLocStart(), 1233 diag::warn_atomic_op_has_invalid_memory_order) 1234 << SubExprs[1]->getSourceRange(); 1235 } 1236 1237 AtomicExpr *AE = new (Context) AtomicExpr(TheCall->getCallee()->getLocStart(), 1238 SubExprs, ResultType, Op, 1239 TheCall->getRParenLoc()); 1240 1241 if ((Op == AtomicExpr::AO__c11_atomic_load || 1242 (Op == AtomicExpr::AO__c11_atomic_store)) && 1243 Context.AtomicUsesUnsupportedLibcall(AE)) 1244 Diag(AE->getLocStart(), diag::err_atomic_load_store_uses_lib) << 1245 ((Op == AtomicExpr::AO__c11_atomic_load) ? 0 : 1); 1246 1247 return AE; 1248 } 1249 1250 1251 /// checkBuiltinArgument - Given a call to a builtin function, perform 1252 /// normal type-checking on the given argument, updating the call in 1253 /// place. This is useful when a builtin function requires custom 1254 /// type-checking for some of its arguments but not necessarily all of 1255 /// them. 1256 /// 1257 /// Returns true on error. 1258 static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) { 1259 FunctionDecl *Fn = E->getDirectCallee(); 1260 assert(Fn && "builtin call without direct callee!"); 1261 1262 ParmVarDecl *Param = Fn->getParamDecl(ArgIndex); 1263 InitializedEntity Entity = 1264 InitializedEntity::InitializeParameter(S.Context, Param); 1265 1266 ExprResult Arg = E->getArg(0); 1267 Arg = S.PerformCopyInitialization(Entity, SourceLocation(), Arg); 1268 if (Arg.isInvalid()) 1269 return true; 1270 1271 E->setArg(ArgIndex, Arg.get()); 1272 return false; 1273 } 1274 1275 /// SemaBuiltinAtomicOverloaded - We have a call to a function like 1276 /// __sync_fetch_and_add, which is an overloaded function based on the pointer 1277 /// type of its first argument. The main ActOnCallExpr routines have already 1278 /// promoted the types of arguments because all of these calls are prototyped as 1279 /// void(...). 1280 /// 1281 /// This function goes through and does final semantic checking for these 1282 /// builtins, 1283 ExprResult 1284 Sema::SemaBuiltinAtomicOverloaded(ExprResult TheCallResult) { 1285 CallExpr *TheCall = (CallExpr *)TheCallResult.get(); 1286 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts()); 1287 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl()); 1288 1289 // Ensure that we have at least one argument to do type inference from. 1290 if (TheCall->getNumArgs() < 1) { 1291 Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least) 1292 << 0 << 1 << TheCall->getNumArgs() 1293 << TheCall->getCallee()->getSourceRange(); 1294 return ExprError(); 1295 } 1296 1297 // Inspect the first argument of the atomic builtin. This should always be 1298 // a pointer type, whose element is an integral scalar or pointer type. 1299 // Because it is a pointer type, we don't have to worry about any implicit 1300 // casts here. 1301 // FIXME: We don't allow floating point scalars as input. 1302 Expr *FirstArg = TheCall->getArg(0); 1303 ExprResult FirstArgResult = DefaultFunctionArrayLvalueConversion(FirstArg); 1304 if (FirstArgResult.isInvalid()) 1305 return ExprError(); 1306 FirstArg = FirstArgResult.get(); 1307 TheCall->setArg(0, FirstArg); 1308 1309 const PointerType *pointerType = FirstArg->getType()->getAs<PointerType>(); 1310 if (!pointerType) { 1311 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer) 1312 << FirstArg->getType() << FirstArg->getSourceRange(); 1313 return ExprError(); 1314 } 1315 1316 QualType ValType = pointerType->getPointeeType(); 1317 if (!ValType->isIntegerType() && !ValType->isAnyPointerType() && 1318 !ValType->isBlockPointerType()) { 1319 Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intptr) 1320 << FirstArg->getType() << FirstArg->getSourceRange(); 1321 return ExprError(); 1322 } 1323 1324 switch (ValType.getObjCLifetime()) { 1325 case Qualifiers::OCL_None: 1326 case Qualifiers::OCL_ExplicitNone: 1327 // okay 1328 break; 1329 1330 case Qualifiers::OCL_Weak: 1331 case Qualifiers::OCL_Strong: 1332 case Qualifiers::OCL_Autoreleasing: 1333 Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership) 1334 << ValType << FirstArg->getSourceRange(); 1335 return ExprError(); 1336 } 1337 1338 // Strip any qualifiers off ValType. 1339 ValType = ValType.getUnqualifiedType(); 1340 1341 // The majority of builtins return a value, but a few have special return 1342 // types, so allow them to override appropriately below. 1343 QualType ResultType = ValType; 1344 1345 // We need to figure out which concrete builtin this maps onto. For example, 1346 // __sync_fetch_and_add with a 2 byte object turns into 1347 // __sync_fetch_and_add_2. 1348 #define BUILTIN_ROW(x) \ 1349 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \ 1350 Builtin::BI##x##_8, Builtin::BI##x##_16 } 1351 1352 static const unsigned BuiltinIndices[][5] = { 1353 BUILTIN_ROW(__sync_fetch_and_add), 1354 BUILTIN_ROW(__sync_fetch_and_sub), 1355 BUILTIN_ROW(__sync_fetch_and_or), 1356 BUILTIN_ROW(__sync_fetch_and_and), 1357 BUILTIN_ROW(__sync_fetch_and_xor), 1358 1359 BUILTIN_ROW(__sync_add_and_fetch), 1360 BUILTIN_ROW(__sync_sub_and_fetch), 1361 BUILTIN_ROW(__sync_and_and_fetch), 1362 BUILTIN_ROW(__sync_or_and_fetch), 1363 BUILTIN_ROW(__sync_xor_and_fetch), 1364 1365 BUILTIN_ROW(__sync_val_compare_and_swap), 1366 BUILTIN_ROW(__sync_bool_compare_and_swap), 1367 BUILTIN_ROW(__sync_lock_test_and_set), 1368 BUILTIN_ROW(__sync_lock_release), 1369 BUILTIN_ROW(__sync_swap) 1370 }; 1371 #undef BUILTIN_ROW 1372 1373 // Determine the index of the size. 1374 unsigned SizeIndex; 1375 switch (Context.getTypeSizeInChars(ValType).getQuantity()) { 1376 case 1: SizeIndex = 0; break; 1377 case 2: SizeIndex = 1; break; 1378 case 4: SizeIndex = 2; break; 1379 case 8: SizeIndex = 3; break; 1380 case 16: SizeIndex = 4; break; 1381 default: 1382 Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size) 1383 << FirstArg->getType() << FirstArg->getSourceRange(); 1384 return ExprError(); 1385 } 1386 1387 // Each of these builtins has one pointer argument, followed by some number of 1388 // values (0, 1 or 2) followed by a potentially empty varags list of stuff 1389 // that we ignore. Find out which row of BuiltinIndices to read from as well 1390 // as the number of fixed args. 1391 unsigned BuiltinID = FDecl->getBuiltinID(); 1392 unsigned BuiltinIndex, NumFixed = 1; 1393 switch (BuiltinID) { 1394 default: llvm_unreachable("Unknown overloaded atomic builtin!"); 1395 case Builtin::BI__sync_fetch_and_add: 1396 case Builtin::BI__sync_fetch_and_add_1: 1397 case Builtin::BI__sync_fetch_and_add_2: 1398 case Builtin::BI__sync_fetch_and_add_4: 1399 case Builtin::BI__sync_fetch_and_add_8: 1400 case Builtin::BI__sync_fetch_and_add_16: 1401 BuiltinIndex = 0; 1402 break; 1403 1404 case Builtin::BI__sync_fetch_and_sub: 1405 case Builtin::BI__sync_fetch_and_sub_1: 1406 case Builtin::BI__sync_fetch_and_sub_2: 1407 case Builtin::BI__sync_fetch_and_sub_4: 1408 case Builtin::BI__sync_fetch_and_sub_8: 1409 case Builtin::BI__sync_fetch_and_sub_16: 1410 BuiltinIndex = 1; 1411 break; 1412 1413 case Builtin::BI__sync_fetch_and_or: 1414 case Builtin::BI__sync_fetch_and_or_1: 1415 case Builtin::BI__sync_fetch_and_or_2: 1416 case Builtin::BI__sync_fetch_and_or_4: 1417 case Builtin::BI__sync_fetch_and_or_8: 1418 case Builtin::BI__sync_fetch_and_or_16: 1419 BuiltinIndex = 2; 1420 break; 1421 1422 case Builtin::BI__sync_fetch_and_and: 1423 case Builtin::BI__sync_fetch_and_and_1: 1424 case Builtin::BI__sync_fetch_and_and_2: 1425 case Builtin::BI__sync_fetch_and_and_4: 1426 case Builtin::BI__sync_fetch_and_and_8: 1427 case Builtin::BI__sync_fetch_and_and_16: 1428 BuiltinIndex = 3; 1429 break; 1430 1431 case Builtin::BI__sync_fetch_and_xor: 1432 case Builtin::BI__sync_fetch_and_xor_1: 1433 case Builtin::BI__sync_fetch_and_xor_2: 1434 case Builtin::BI__sync_fetch_and_xor_4: 1435 case Builtin::BI__sync_fetch_and_xor_8: 1436 case Builtin::BI__sync_fetch_and_xor_16: 1437 BuiltinIndex = 4; 1438 break; 1439 1440 case Builtin::BI__sync_add_and_fetch: 1441 case Builtin::BI__sync_add_and_fetch_1: 1442 case Builtin::BI__sync_add_and_fetch_2: 1443 case Builtin::BI__sync_add_and_fetch_4: 1444 case Builtin::BI__sync_add_and_fetch_8: 1445 case Builtin::BI__sync_add_and_fetch_16: 1446 BuiltinIndex = 5; 1447 break; 1448 1449 case Builtin::BI__sync_sub_and_fetch: 1450 case Builtin::BI__sync_sub_and_fetch_1: 1451 case Builtin::BI__sync_sub_and_fetch_2: 1452 case Builtin::BI__sync_sub_and_fetch_4: 1453 case Builtin::BI__sync_sub_and_fetch_8: 1454 case Builtin::BI__sync_sub_and_fetch_16: 1455 BuiltinIndex = 6; 1456 break; 1457 1458 case Builtin::BI__sync_and_and_fetch: 1459 case Builtin::BI__sync_and_and_fetch_1: 1460 case Builtin::BI__sync_and_and_fetch_2: 1461 case Builtin::BI__sync_and_and_fetch_4: 1462 case Builtin::BI__sync_and_and_fetch_8: 1463 case Builtin::BI__sync_and_and_fetch_16: 1464 BuiltinIndex = 7; 1465 break; 1466 1467 case Builtin::BI__sync_or_and_fetch: 1468 case Builtin::BI__sync_or_and_fetch_1: 1469 case Builtin::BI__sync_or_and_fetch_2: 1470 case Builtin::BI__sync_or_and_fetch_4: 1471 case Builtin::BI__sync_or_and_fetch_8: 1472 case Builtin::BI__sync_or_and_fetch_16: 1473 BuiltinIndex = 8; 1474 break; 1475 1476 case Builtin::BI__sync_xor_and_fetch: 1477 case Builtin::BI__sync_xor_and_fetch_1: 1478 case Builtin::BI__sync_xor_and_fetch_2: 1479 case Builtin::BI__sync_xor_and_fetch_4: 1480 case Builtin::BI__sync_xor_and_fetch_8: 1481 case Builtin::BI__sync_xor_and_fetch_16: 1482 BuiltinIndex = 9; 1483 break; 1484 1485 case Builtin::BI__sync_val_compare_and_swap: 1486 case Builtin::BI__sync_val_compare_and_swap_1: 1487 case Builtin::BI__sync_val_compare_and_swap_2: 1488 case Builtin::BI__sync_val_compare_and_swap_4: 1489 case Builtin::BI__sync_val_compare_and_swap_8: 1490 case Builtin::BI__sync_val_compare_and_swap_16: 1491 BuiltinIndex = 10; 1492 NumFixed = 2; 1493 break; 1494 1495 case Builtin::BI__sync_bool_compare_and_swap: 1496 case Builtin::BI__sync_bool_compare_and_swap_1: 1497 case Builtin::BI__sync_bool_compare_and_swap_2: 1498 case Builtin::BI__sync_bool_compare_and_swap_4: 1499 case Builtin::BI__sync_bool_compare_and_swap_8: 1500 case Builtin::BI__sync_bool_compare_and_swap_16: 1501 BuiltinIndex = 11; 1502 NumFixed = 2; 1503 ResultType = Context.BoolTy; 1504 break; 1505 1506 case Builtin::BI__sync_lock_test_and_set: 1507 case Builtin::BI__sync_lock_test_and_set_1: 1508 case Builtin::BI__sync_lock_test_and_set_2: 1509 case Builtin::BI__sync_lock_test_and_set_4: 1510 case Builtin::BI__sync_lock_test_and_set_8: 1511 case Builtin::BI__sync_lock_test_and_set_16: 1512 BuiltinIndex = 12; 1513 break; 1514 1515 case Builtin::BI__sync_lock_release: 1516 case Builtin::BI__sync_lock_release_1: 1517 case Builtin::BI__sync_lock_release_2: 1518 case Builtin::BI__sync_lock_release_4: 1519 case Builtin::BI__sync_lock_release_8: 1520 case Builtin::BI__sync_lock_release_16: 1521 BuiltinIndex = 13; 1522 NumFixed = 0; 1523 ResultType = Context.VoidTy; 1524 break; 1525 1526 case Builtin::BI__sync_swap: 1527 case Builtin::BI__sync_swap_1: 1528 case Builtin::BI__sync_swap_2: 1529 case Builtin::BI__sync_swap_4: 1530 case Builtin::BI__sync_swap_8: 1531 case Builtin::BI__sync_swap_16: 1532 BuiltinIndex = 14; 1533 break; 1534 } 1535 1536 // Now that we know how many fixed arguments we expect, first check that we 1537 // have at least that many. 1538 if (TheCall->getNumArgs() < 1+NumFixed) { 1539 Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least) 1540 << 0 << 1+NumFixed << TheCall->getNumArgs() 1541 << TheCall->getCallee()->getSourceRange(); 1542 return ExprError(); 1543 } 1544 1545 // Get the decl for the concrete builtin from this, we can tell what the 1546 // concrete integer type we should convert to is. 1547 unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex]; 1548 const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID); 1549 FunctionDecl *NewBuiltinDecl; 1550 if (NewBuiltinID == BuiltinID) 1551 NewBuiltinDecl = FDecl; 1552 else { 1553 // Perform builtin lookup to avoid redeclaring it. 1554 DeclarationName DN(&Context.Idents.get(NewBuiltinName)); 1555 LookupResult Res(*this, DN, DRE->getLocStart(), LookupOrdinaryName); 1556 LookupName(Res, TUScope, /*AllowBuiltinCreation=*/true); 1557 assert(Res.getFoundDecl()); 1558 NewBuiltinDecl = dyn_cast<FunctionDecl>(Res.getFoundDecl()); 1559 if (!NewBuiltinDecl) 1560 return ExprError(); 1561 } 1562 1563 // The first argument --- the pointer --- has a fixed type; we 1564 // deduce the types of the rest of the arguments accordingly. Walk 1565 // the remaining arguments, converting them to the deduced value type. 1566 for (unsigned i = 0; i != NumFixed; ++i) { 1567 ExprResult Arg = TheCall->getArg(i+1); 1568 1569 // GCC does an implicit conversion to the pointer or integer ValType. This 1570 // can fail in some cases (1i -> int**), check for this error case now. 1571 // Initialize the argument. 1572 InitializedEntity Entity = InitializedEntity::InitializeParameter(Context, 1573 ValType, /*consume*/ false); 1574 Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg); 1575 if (Arg.isInvalid()) 1576 return ExprError(); 1577 1578 // Okay, we have something that *can* be converted to the right type. Check 1579 // to see if there is a potentially weird extension going on here. This can 1580 // happen when you do an atomic operation on something like an char* and 1581 // pass in 42. The 42 gets converted to char. This is even more strange 1582 // for things like 45.123 -> char, etc. 1583 // FIXME: Do this check. 1584 TheCall->setArg(i+1, Arg.get()); 1585 } 1586 1587 ASTContext& Context = this->getASTContext(); 1588 1589 // Create a new DeclRefExpr to refer to the new decl. 1590 DeclRefExpr* NewDRE = DeclRefExpr::Create( 1591 Context, 1592 DRE->getQualifierLoc(), 1593 SourceLocation(), 1594 NewBuiltinDecl, 1595 /*enclosing*/ false, 1596 DRE->getLocation(), 1597 Context.BuiltinFnTy, 1598 DRE->getValueKind()); 1599 1600 // Set the callee in the CallExpr. 1601 // FIXME: This loses syntactic information. 1602 QualType CalleePtrTy = Context.getPointerType(NewBuiltinDecl->getType()); 1603 ExprResult PromotedCall = ImpCastExprToType(NewDRE, CalleePtrTy, 1604 CK_BuiltinFnToFnPtr); 1605 TheCall->setCallee(PromotedCall.get()); 1606 1607 // Change the result type of the call to match the original value type. This 1608 // is arbitrary, but the codegen for these builtins ins design to handle it 1609 // gracefully. 1610 TheCall->setType(ResultType); 1611 1612 return TheCallResult; 1613 } 1614 1615 /// CheckObjCString - Checks that the argument to the builtin 1616 /// CFString constructor is correct 1617 /// Note: It might also make sense to do the UTF-16 conversion here (would 1618 /// simplify the backend). 1619 bool Sema::CheckObjCString(Expr *Arg) { 1620 Arg = Arg->IgnoreParenCasts(); 1621 StringLiteral *Literal = dyn_cast<StringLiteral>(Arg); 1622 1623 if (!Literal || !Literal->isAscii()) { 1624 Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant) 1625 << Arg->getSourceRange(); 1626 return true; 1627 } 1628 1629 if (Literal->containsNonAsciiOrNull()) { 1630 StringRef String = Literal->getString(); 1631 unsigned NumBytes = String.size(); 1632 SmallVector<UTF16, 128> ToBuf(NumBytes); 1633 const UTF8 *FromPtr = (const UTF8 *)String.data(); 1634 UTF16 *ToPtr = &ToBuf[0]; 1635 1636 ConversionResult Result = ConvertUTF8toUTF16(&FromPtr, FromPtr + NumBytes, 1637 &ToPtr, ToPtr + NumBytes, 1638 strictConversion); 1639 // Check for conversion failure. 1640 if (Result != conversionOK) 1641 Diag(Arg->getLocStart(), 1642 diag::warn_cfstring_truncated) << Arg->getSourceRange(); 1643 } 1644 return false; 1645 } 1646 1647 /// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity. 1648 /// Emit an error and return true on failure, return false on success. 1649 bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) { 1650 Expr *Fn = TheCall->getCallee(); 1651 if (TheCall->getNumArgs() > 2) { 1652 Diag(TheCall->getArg(2)->getLocStart(), 1653 diag::err_typecheck_call_too_many_args) 1654 << 0 /*function call*/ << 2 << TheCall->getNumArgs() 1655 << Fn->getSourceRange() 1656 << SourceRange(TheCall->getArg(2)->getLocStart(), 1657 (*(TheCall->arg_end()-1))->getLocEnd()); 1658 return true; 1659 } 1660 1661 if (TheCall->getNumArgs() < 2) { 1662 return Diag(TheCall->getLocEnd(), 1663 diag::err_typecheck_call_too_few_args_at_least) 1664 << 0 /*function call*/ << 2 << TheCall->getNumArgs(); 1665 } 1666 1667 // Type-check the first argument normally. 1668 if (checkBuiltinArgument(*this, TheCall, 0)) 1669 return true; 1670 1671 // Determine whether the current function is variadic or not. 1672 BlockScopeInfo *CurBlock = getCurBlock(); 1673 bool isVariadic; 1674 if (CurBlock) 1675 isVariadic = CurBlock->TheDecl->isVariadic(); 1676 else if (FunctionDecl *FD = getCurFunctionDecl()) 1677 isVariadic = FD->isVariadic(); 1678 else 1679 isVariadic = getCurMethodDecl()->isVariadic(); 1680 1681 if (!isVariadic) { 1682 Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function); 1683 return true; 1684 } 1685 1686 // Verify that the second argument to the builtin is the last argument of the 1687 // current function or method. 1688 bool SecondArgIsLastNamedArgument = false; 1689 const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts(); 1690 1691 // These are valid if SecondArgIsLastNamedArgument is false after the next 1692 // block. 1693 QualType Type; 1694 SourceLocation ParamLoc; 1695 1696 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) { 1697 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) { 1698 // FIXME: This isn't correct for methods (results in bogus warning). 1699 // Get the last formal in the current function. 1700 const ParmVarDecl *LastArg; 1701 if (CurBlock) 1702 LastArg = *(CurBlock->TheDecl->param_end()-1); 1703 else if (FunctionDecl *FD = getCurFunctionDecl()) 1704 LastArg = *(FD->param_end()-1); 1705 else 1706 LastArg = *(getCurMethodDecl()->param_end()-1); 1707 SecondArgIsLastNamedArgument = PV == LastArg; 1708 1709 Type = PV->getType(); 1710 ParamLoc = PV->getLocation(); 1711 } 1712 } 1713 1714 if (!SecondArgIsLastNamedArgument) 1715 Diag(TheCall->getArg(1)->getLocStart(), 1716 diag::warn_second_parameter_of_va_start_not_last_named_argument); 1717 else if (Type->isReferenceType()) { 1718 Diag(Arg->getLocStart(), 1719 diag::warn_va_start_of_reference_type_is_undefined); 1720 Diag(ParamLoc, diag::note_parameter_type) << Type; 1721 } 1722 1723 TheCall->setType(Context.VoidTy); 1724 return false; 1725 } 1726 1727 /// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and 1728 /// friends. This is declared to take (...), so we have to check everything. 1729 bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) { 1730 if (TheCall->getNumArgs() < 2) 1731 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args) 1732 << 0 << 2 << TheCall->getNumArgs()/*function call*/; 1733 if (TheCall->getNumArgs() > 2) 1734 return Diag(TheCall->getArg(2)->getLocStart(), 1735 diag::err_typecheck_call_too_many_args) 1736 << 0 /*function call*/ << 2 << TheCall->getNumArgs() 1737 << SourceRange(TheCall->getArg(2)->getLocStart(), 1738 (*(TheCall->arg_end()-1))->getLocEnd()); 1739 1740 ExprResult OrigArg0 = TheCall->getArg(0); 1741 ExprResult OrigArg1 = TheCall->getArg(1); 1742 1743 // Do standard promotions between the two arguments, returning their common 1744 // type. 1745 QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false); 1746 if (OrigArg0.isInvalid() || OrigArg1.isInvalid()) 1747 return true; 1748 1749 // Make sure any conversions are pushed back into the call; this is 1750 // type safe since unordered compare builtins are declared as "_Bool 1751 // foo(...)". 1752 TheCall->setArg(0, OrigArg0.get()); 1753 TheCall->setArg(1, OrigArg1.get()); 1754 1755 if (OrigArg0.get()->isTypeDependent() || OrigArg1.get()->isTypeDependent()) 1756 return false; 1757 1758 // If the common type isn't a real floating type, then the arguments were 1759 // invalid for this operation. 1760 if (Res.isNull() || !Res->isRealFloatingType()) 1761 return Diag(OrigArg0.get()->getLocStart(), 1762 diag::err_typecheck_call_invalid_ordered_compare) 1763 << OrigArg0.get()->getType() << OrigArg1.get()->getType() 1764 << SourceRange(OrigArg0.get()->getLocStart(), OrigArg1.get()->getLocEnd()); 1765 1766 return false; 1767 } 1768 1769 /// SemaBuiltinSemaBuiltinFPClassification - Handle functions like 1770 /// __builtin_isnan and friends. This is declared to take (...), so we have 1771 /// to check everything. We expect the last argument to be a floating point 1772 /// value. 1773 bool Sema::SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs) { 1774 if (TheCall->getNumArgs() < NumArgs) 1775 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args) 1776 << 0 << NumArgs << TheCall->getNumArgs()/*function call*/; 1777 if (TheCall->getNumArgs() > NumArgs) 1778 return Diag(TheCall->getArg(NumArgs)->getLocStart(), 1779 diag::err_typecheck_call_too_many_args) 1780 << 0 /*function call*/ << NumArgs << TheCall->getNumArgs() 1781 << SourceRange(TheCall->getArg(NumArgs)->getLocStart(), 1782 (*(TheCall->arg_end()-1))->getLocEnd()); 1783 1784 Expr *OrigArg = TheCall->getArg(NumArgs-1); 1785 1786 if (OrigArg->isTypeDependent()) 1787 return false; 1788 1789 // This operation requires a non-_Complex floating-point number. 1790 if (!OrigArg->getType()->isRealFloatingType()) 1791 return Diag(OrigArg->getLocStart(), 1792 diag::err_typecheck_call_invalid_unary_fp) 1793 << OrigArg->getType() << OrigArg->getSourceRange(); 1794 1795 // If this is an implicit conversion from float -> double, remove it. 1796 if (ImplicitCastExpr *Cast = dyn_cast<ImplicitCastExpr>(OrigArg)) { 1797 Expr *CastArg = Cast->getSubExpr(); 1798 if (CastArg->getType()->isSpecificBuiltinType(BuiltinType::Float)) { 1799 assert(Cast->getType()->isSpecificBuiltinType(BuiltinType::Double) && 1800 "promotion from float to double is the only expected cast here"); 1801 Cast->setSubExpr(nullptr); 1802 TheCall->setArg(NumArgs-1, CastArg); 1803 } 1804 } 1805 1806 return false; 1807 } 1808 1809 /// SemaBuiltinShuffleVector - Handle __builtin_shufflevector. 1810 // This is declared to take (...), so we have to check everything. 1811 ExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) { 1812 if (TheCall->getNumArgs() < 2) 1813 return ExprError(Diag(TheCall->getLocEnd(), 1814 diag::err_typecheck_call_too_few_args_at_least) 1815 << 0 /*function call*/ << 2 << TheCall->getNumArgs() 1816 << TheCall->getSourceRange()); 1817 1818 // Determine which of the following types of shufflevector we're checking: 1819 // 1) unary, vector mask: (lhs, mask) 1820 // 2) binary, vector mask: (lhs, rhs, mask) 1821 // 3) binary, scalar mask: (lhs, rhs, index, ..., index) 1822 QualType resType = TheCall->getArg(0)->getType(); 1823 unsigned numElements = 0; 1824 1825 if (!TheCall->getArg(0)->isTypeDependent() && 1826 !TheCall->getArg(1)->isTypeDependent()) { 1827 QualType LHSType = TheCall->getArg(0)->getType(); 1828 QualType RHSType = TheCall->getArg(1)->getType(); 1829 1830 if (!LHSType->isVectorType() || !RHSType->isVectorType()) 1831 return ExprError(Diag(TheCall->getLocStart(), 1832 diag::err_shufflevector_non_vector) 1833 << SourceRange(TheCall->getArg(0)->getLocStart(), 1834 TheCall->getArg(1)->getLocEnd())); 1835 1836 numElements = LHSType->getAs<VectorType>()->getNumElements(); 1837 unsigned numResElements = TheCall->getNumArgs() - 2; 1838 1839 // Check to see if we have a call with 2 vector arguments, the unary shuffle 1840 // with mask. If so, verify that RHS is an integer vector type with the 1841 // same number of elts as lhs. 1842 if (TheCall->getNumArgs() == 2) { 1843 if (!RHSType->hasIntegerRepresentation() || 1844 RHSType->getAs<VectorType>()->getNumElements() != numElements) 1845 return ExprError(Diag(TheCall->getLocStart(), 1846 diag::err_shufflevector_incompatible_vector) 1847 << SourceRange(TheCall->getArg(1)->getLocStart(), 1848 TheCall->getArg(1)->getLocEnd())); 1849 } else if (!Context.hasSameUnqualifiedType(LHSType, RHSType)) { 1850 return ExprError(Diag(TheCall->getLocStart(), 1851 diag::err_shufflevector_incompatible_vector) 1852 << SourceRange(TheCall->getArg(0)->getLocStart(), 1853 TheCall->getArg(1)->getLocEnd())); 1854 } else if (numElements != numResElements) { 1855 QualType eltType = LHSType->getAs<VectorType>()->getElementType(); 1856 resType = Context.getVectorType(eltType, numResElements, 1857 VectorType::GenericVector); 1858 } 1859 } 1860 1861 for (unsigned i = 2; i < TheCall->getNumArgs(); i++) { 1862 if (TheCall->getArg(i)->isTypeDependent() || 1863 TheCall->getArg(i)->isValueDependent()) 1864 continue; 1865 1866 llvm::APSInt Result(32); 1867 if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context)) 1868 return ExprError(Diag(TheCall->getLocStart(), 1869 diag::err_shufflevector_nonconstant_argument) 1870 << TheCall->getArg(i)->getSourceRange()); 1871 1872 // Allow -1 which will be translated to undef in the IR. 1873 if (Result.isSigned() && Result.isAllOnesValue()) 1874 continue; 1875 1876 if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2) 1877 return ExprError(Diag(TheCall->getLocStart(), 1878 diag::err_shufflevector_argument_too_large) 1879 << TheCall->getArg(i)->getSourceRange()); 1880 } 1881 1882 SmallVector<Expr*, 32> exprs; 1883 1884 for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) { 1885 exprs.push_back(TheCall->getArg(i)); 1886 TheCall->setArg(i, nullptr); 1887 } 1888 1889 return new (Context) ShuffleVectorExpr(Context, exprs, resType, 1890 TheCall->getCallee()->getLocStart(), 1891 TheCall->getRParenLoc()); 1892 } 1893 1894 /// SemaConvertVectorExpr - Handle __builtin_convertvector 1895 ExprResult Sema::SemaConvertVectorExpr(Expr *E, TypeSourceInfo *TInfo, 1896 SourceLocation BuiltinLoc, 1897 SourceLocation RParenLoc) { 1898 ExprValueKind VK = VK_RValue; 1899 ExprObjectKind OK = OK_Ordinary; 1900 QualType DstTy = TInfo->getType(); 1901 QualType SrcTy = E->getType(); 1902 1903 if (!SrcTy->isVectorType() && !SrcTy->isDependentType()) 1904 return ExprError(Diag(BuiltinLoc, 1905 diag::err_convertvector_non_vector) 1906 << E->getSourceRange()); 1907 if (!DstTy->isVectorType() && !DstTy->isDependentType()) 1908 return ExprError(Diag(BuiltinLoc, 1909 diag::err_convertvector_non_vector_type)); 1910 1911 if (!SrcTy->isDependentType() && !DstTy->isDependentType()) { 1912 unsigned SrcElts = SrcTy->getAs<VectorType>()->getNumElements(); 1913 unsigned DstElts = DstTy->getAs<VectorType>()->getNumElements(); 1914 if (SrcElts != DstElts) 1915 return ExprError(Diag(BuiltinLoc, 1916 diag::err_convertvector_incompatible_vector) 1917 << E->getSourceRange()); 1918 } 1919 1920 return new (Context) 1921 ConvertVectorExpr(E, TInfo, DstTy, VK, OK, BuiltinLoc, RParenLoc); 1922 } 1923 1924 /// SemaBuiltinPrefetch - Handle __builtin_prefetch. 1925 // This is declared to take (const void*, ...) and can take two 1926 // optional constant int args. 1927 bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) { 1928 unsigned NumArgs = TheCall->getNumArgs(); 1929 1930 if (NumArgs > 3) 1931 return Diag(TheCall->getLocEnd(), 1932 diag::err_typecheck_call_too_many_args_at_most) 1933 << 0 /*function call*/ << 3 << NumArgs 1934 << TheCall->getSourceRange(); 1935 1936 // Argument 0 is checked for us and the remaining arguments must be 1937 // constant integers. 1938 for (unsigned i = 1; i != NumArgs; ++i) 1939 if (SemaBuiltinConstantArgRange(TheCall, i, 0, i == 1 ? 1 : 3)) 1940 return true; 1941 1942 return false; 1943 } 1944 1945 /// SemaBuiltinConstantArg - Handle a check if argument ArgNum of CallExpr 1946 /// TheCall is a constant expression. 1947 bool Sema::SemaBuiltinConstantArg(CallExpr *TheCall, int ArgNum, 1948 llvm::APSInt &Result) { 1949 Expr *Arg = TheCall->getArg(ArgNum); 1950 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts()); 1951 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl()); 1952 1953 if (Arg->isTypeDependent() || Arg->isValueDependent()) return false; 1954 1955 if (!Arg->isIntegerConstantExpr(Result, Context)) 1956 return Diag(TheCall->getLocStart(), diag::err_constant_integer_arg_type) 1957 << FDecl->getDeclName() << Arg->getSourceRange(); 1958 1959 return false; 1960 } 1961 1962 /// SemaBuiltinConstantArgRange - Handle a check if argument ArgNum of CallExpr 1963 /// TheCall is a constant expression in the range [Low, High]. 1964 bool Sema::SemaBuiltinConstantArgRange(CallExpr *TheCall, int ArgNum, 1965 int Low, int High) { 1966 llvm::APSInt Result; 1967 1968 // We can't check the value of a dependent argument. 1969 Expr *Arg = TheCall->getArg(ArgNum); 1970 if (Arg->isTypeDependent() || Arg->isValueDependent()) 1971 return false; 1972 1973 // Check constant-ness first. 1974 if (SemaBuiltinConstantArg(TheCall, ArgNum, Result)) 1975 return true; 1976 1977 if (Result.getSExtValue() < Low || Result.getSExtValue() > High) 1978 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range) 1979 << Low << High << Arg->getSourceRange(); 1980 1981 return false; 1982 } 1983 1984 /// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val). 1985 /// This checks that val is a constant 1. 1986 bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) { 1987 Expr *Arg = TheCall->getArg(1); 1988 llvm::APSInt Result; 1989 1990 // TODO: This is less than ideal. Overload this to take a value. 1991 if (SemaBuiltinConstantArg(TheCall, 1, Result)) 1992 return true; 1993 1994 if (Result != 1) 1995 return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val) 1996 << SourceRange(Arg->getLocStart(), Arg->getLocEnd()); 1997 1998 return false; 1999 } 2000 2001 namespace { 2002 enum StringLiteralCheckType { 2003 SLCT_NotALiteral, 2004 SLCT_UncheckedLiteral, 2005 SLCT_CheckedLiteral 2006 }; 2007 } 2008 2009 // Determine if an expression is a string literal or constant string. 2010 // If this function returns false on the arguments to a function expecting a 2011 // format string, we will usually need to emit a warning. 2012 // True string literals are then checked by CheckFormatString. 2013 static StringLiteralCheckType 2014 checkFormatStringExpr(Sema &S, const Expr *E, ArrayRef<const Expr *> Args, 2015 bool HasVAListArg, unsigned format_idx, 2016 unsigned firstDataArg, Sema::FormatStringType Type, 2017 Sema::VariadicCallType CallType, bool InFunctionCall, 2018 llvm::SmallBitVector &CheckedVarArgs) { 2019 tryAgain: 2020 if (E->isTypeDependent() || E->isValueDependent()) 2021 return SLCT_NotALiteral; 2022 2023 E = E->IgnoreParenCasts(); 2024 2025 if (E->isNullPointerConstant(S.Context, Expr::NPC_ValueDependentIsNotNull)) 2026 // Technically -Wformat-nonliteral does not warn about this case. 2027 // The behavior of printf and friends in this case is implementation 2028 // dependent. Ideally if the format string cannot be null then 2029 // it should have a 'nonnull' attribute in the function prototype. 2030 return SLCT_UncheckedLiteral; 2031 2032 switch (E->getStmtClass()) { 2033 case Stmt::BinaryConditionalOperatorClass: 2034 case Stmt::ConditionalOperatorClass: { 2035 // The expression is a literal if both sub-expressions were, and it was 2036 // completely checked only if both sub-expressions were checked. 2037 const AbstractConditionalOperator *C = 2038 cast<AbstractConditionalOperator>(E); 2039 StringLiteralCheckType Left = 2040 checkFormatStringExpr(S, C->getTrueExpr(), Args, 2041 HasVAListArg, format_idx, firstDataArg, 2042 Type, CallType, InFunctionCall, CheckedVarArgs); 2043 if (Left == SLCT_NotALiteral) 2044 return SLCT_NotALiteral; 2045 StringLiteralCheckType Right = 2046 checkFormatStringExpr(S, C->getFalseExpr(), Args, 2047 HasVAListArg, format_idx, firstDataArg, 2048 Type, CallType, InFunctionCall, CheckedVarArgs); 2049 return Left < Right ? Left : Right; 2050 } 2051 2052 case Stmt::ImplicitCastExprClass: { 2053 E = cast<ImplicitCastExpr>(E)->getSubExpr(); 2054 goto tryAgain; 2055 } 2056 2057 case Stmt::OpaqueValueExprClass: 2058 if (const Expr *src = cast<OpaqueValueExpr>(E)->getSourceExpr()) { 2059 E = src; 2060 goto tryAgain; 2061 } 2062 return SLCT_NotALiteral; 2063 2064 case Stmt::PredefinedExprClass: 2065 // While __func__, etc., are technically not string literals, they 2066 // cannot contain format specifiers and thus are not a security 2067 // liability. 2068 return SLCT_UncheckedLiteral; 2069 2070 case Stmt::DeclRefExprClass: { 2071 const DeclRefExpr *DR = cast<DeclRefExpr>(E); 2072 2073 // As an exception, do not flag errors for variables binding to 2074 // const string literals. 2075 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { 2076 bool isConstant = false; 2077 QualType T = DR->getType(); 2078 2079 if (const ArrayType *AT = S.Context.getAsArrayType(T)) { 2080 isConstant = AT->getElementType().isConstant(S.Context); 2081 } else if (const PointerType *PT = T->getAs<PointerType>()) { 2082 isConstant = T.isConstant(S.Context) && 2083 PT->getPointeeType().isConstant(S.Context); 2084 } else if (T->isObjCObjectPointerType()) { 2085 // In ObjC, there is usually no "const ObjectPointer" type, 2086 // so don't check if the pointee type is constant. 2087 isConstant = T.isConstant(S.Context); 2088 } 2089 2090 if (isConstant) { 2091 if (const Expr *Init = VD->getAnyInitializer()) { 2092 // Look through initializers like const char c[] = { "foo" } 2093 if (const InitListExpr *InitList = dyn_cast<InitListExpr>(Init)) { 2094 if (InitList->isStringLiteralInit()) 2095 Init = InitList->getInit(0)->IgnoreParenImpCasts(); 2096 } 2097 return checkFormatStringExpr(S, Init, Args, 2098 HasVAListArg, format_idx, 2099 firstDataArg, Type, CallType, 2100 /*InFunctionCall*/false, CheckedVarArgs); 2101 } 2102 } 2103 2104 // For vprintf* functions (i.e., HasVAListArg==true), we add a 2105 // special check to see if the format string is a function parameter 2106 // of the function calling the printf function. If the function 2107 // has an attribute indicating it is a printf-like function, then we 2108 // should suppress warnings concerning non-literals being used in a call 2109 // to a vprintf function. For example: 2110 // 2111 // void 2112 // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){ 2113 // va_list ap; 2114 // va_start(ap, fmt); 2115 // vprintf(fmt, ap); // Do NOT emit a warning about "fmt". 2116 // ... 2117 // } 2118 if (HasVAListArg) { 2119 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(VD)) { 2120 if (const NamedDecl *ND = dyn_cast<NamedDecl>(PV->getDeclContext())) { 2121 int PVIndex = PV->getFunctionScopeIndex() + 1; 2122 for (const auto *PVFormat : ND->specific_attrs<FormatAttr>()) { 2123 // adjust for implicit parameter 2124 if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(ND)) 2125 if (MD->isInstance()) 2126 ++PVIndex; 2127 // We also check if the formats are compatible. 2128 // We can't pass a 'scanf' string to a 'printf' function. 2129 if (PVIndex == PVFormat->getFormatIdx() && 2130 Type == S.GetFormatStringType(PVFormat)) 2131 return SLCT_UncheckedLiteral; 2132 } 2133 } 2134 } 2135 } 2136 } 2137 2138 return SLCT_NotALiteral; 2139 } 2140 2141 case Stmt::CallExprClass: 2142 case Stmt::CXXMemberCallExprClass: { 2143 const CallExpr *CE = cast<CallExpr>(E); 2144 if (const NamedDecl *ND = dyn_cast_or_null<NamedDecl>(CE->getCalleeDecl())) { 2145 if (const FormatArgAttr *FA = ND->getAttr<FormatArgAttr>()) { 2146 unsigned ArgIndex = FA->getFormatIdx(); 2147 if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(ND)) 2148 if (MD->isInstance()) 2149 --ArgIndex; 2150 const Expr *Arg = CE->getArg(ArgIndex - 1); 2151 2152 return checkFormatStringExpr(S, Arg, Args, 2153 HasVAListArg, format_idx, firstDataArg, 2154 Type, CallType, InFunctionCall, 2155 CheckedVarArgs); 2156 } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(ND)) { 2157 unsigned BuiltinID = FD->getBuiltinID(); 2158 if (BuiltinID == Builtin::BI__builtin___CFStringMakeConstantString || 2159 BuiltinID == Builtin::BI__builtin___NSStringMakeConstantString) { 2160 const Expr *Arg = CE->getArg(0); 2161 return checkFormatStringExpr(S, Arg, Args, 2162 HasVAListArg, format_idx, 2163 firstDataArg, Type, CallType, 2164 InFunctionCall, CheckedVarArgs); 2165 } 2166 } 2167 } 2168 2169 return SLCT_NotALiteral; 2170 } 2171 case Stmt::ObjCStringLiteralClass: 2172 case Stmt::StringLiteralClass: { 2173 const StringLiteral *StrE = nullptr; 2174 2175 if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E)) 2176 StrE = ObjCFExpr->getString(); 2177 else 2178 StrE = cast<StringLiteral>(E); 2179 2180 if (StrE) { 2181 S.CheckFormatString(StrE, E, Args, HasVAListArg, format_idx, firstDataArg, 2182 Type, InFunctionCall, CallType, CheckedVarArgs); 2183 return SLCT_CheckedLiteral; 2184 } 2185 2186 return SLCT_NotALiteral; 2187 } 2188 2189 default: 2190 return SLCT_NotALiteral; 2191 } 2192 } 2193 2194 Sema::FormatStringType Sema::GetFormatStringType(const FormatAttr *Format) { 2195 return llvm::StringSwitch<FormatStringType>(Format->getType()->getName()) 2196 .Case("scanf", FST_Scanf) 2197 .Cases("printf", "printf0", FST_Printf) 2198 .Cases("NSString", "CFString", FST_NSString) 2199 .Case("strftime", FST_Strftime) 2200 .Case("strfmon", FST_Strfmon) 2201 .Cases("kprintf", "cmn_err", "vcmn_err", "zcmn_err", FST_Kprintf) 2202 .Default(FST_Unknown); 2203 } 2204 2205 /// CheckFormatArguments - Check calls to printf and scanf (and similar 2206 /// functions) for correct use of format strings. 2207 /// Returns true if a format string has been fully checked. 2208 bool Sema::CheckFormatArguments(const FormatAttr *Format, 2209 ArrayRef<const Expr *> Args, 2210 bool IsCXXMember, 2211 VariadicCallType CallType, 2212 SourceLocation Loc, SourceRange Range, 2213 llvm::SmallBitVector &CheckedVarArgs) { 2214 FormatStringInfo FSI; 2215 if (getFormatStringInfo(Format, IsCXXMember, &FSI)) 2216 return CheckFormatArguments(Args, FSI.HasVAListArg, FSI.FormatIdx, 2217 FSI.FirstDataArg, GetFormatStringType(Format), 2218 CallType, Loc, Range, CheckedVarArgs); 2219 return false; 2220 } 2221 2222 bool Sema::CheckFormatArguments(ArrayRef<const Expr *> Args, 2223 bool HasVAListArg, unsigned format_idx, 2224 unsigned firstDataArg, FormatStringType Type, 2225 VariadicCallType CallType, 2226 SourceLocation Loc, SourceRange Range, 2227 llvm::SmallBitVector &CheckedVarArgs) { 2228 // CHECK: printf/scanf-like function is called with no format string. 2229 if (format_idx >= Args.size()) { 2230 Diag(Loc, diag::warn_missing_format_string) << Range; 2231 return false; 2232 } 2233 2234 const Expr *OrigFormatExpr = Args[format_idx]->IgnoreParenCasts(); 2235 2236 // CHECK: format string is not a string literal. 2237 // 2238 // Dynamically generated format strings are difficult to 2239 // automatically vet at compile time. Requiring that format strings 2240 // are string literals: (1) permits the checking of format strings by 2241 // the compiler and thereby (2) can practically remove the source of 2242 // many format string exploits. 2243 2244 // Format string can be either ObjC string (e.g. @"%d") or 2245 // C string (e.g. "%d") 2246 // ObjC string uses the same format specifiers as C string, so we can use 2247 // the same format string checking logic for both ObjC and C strings. 2248 StringLiteralCheckType CT = 2249 checkFormatStringExpr(*this, OrigFormatExpr, Args, HasVAListArg, 2250 format_idx, firstDataArg, Type, CallType, 2251 /*IsFunctionCall*/true, CheckedVarArgs); 2252 if (CT != SLCT_NotALiteral) 2253 // Literal format string found, check done! 2254 return CT == SLCT_CheckedLiteral; 2255 2256 // Strftime is particular as it always uses a single 'time' argument, 2257 // so it is safe to pass a non-literal string. 2258 if (Type == FST_Strftime) 2259 return false; 2260 2261 // Do not emit diag when the string param is a macro expansion and the 2262 // format is either NSString or CFString. This is a hack to prevent 2263 // diag when using the NSLocalizedString and CFCopyLocalizedString macros 2264 // which are usually used in place of NS and CF string literals. 2265 if (Type == FST_NSString && 2266 SourceMgr.isInSystemMacro(Args[format_idx]->getLocStart())) 2267 return false; 2268 2269 // If there are no arguments specified, warn with -Wformat-security, otherwise 2270 // warn only with -Wformat-nonliteral. 2271 if (Args.size() == firstDataArg) 2272 Diag(Args[format_idx]->getLocStart(), 2273 diag::warn_format_nonliteral_noargs) 2274 << OrigFormatExpr->getSourceRange(); 2275 else 2276 Diag(Args[format_idx]->getLocStart(), 2277 diag::warn_format_nonliteral) 2278 << OrigFormatExpr->getSourceRange(); 2279 return false; 2280 } 2281 2282 namespace { 2283 class CheckFormatHandler : public analyze_format_string::FormatStringHandler { 2284 protected: 2285 Sema &S; 2286 const StringLiteral *FExpr; 2287 const Expr *OrigFormatExpr; 2288 const unsigned FirstDataArg; 2289 const unsigned NumDataArgs; 2290 const char *Beg; // Start of format string. 2291 const bool HasVAListArg; 2292 ArrayRef<const Expr *> Args; 2293 unsigned FormatIdx; 2294 llvm::SmallBitVector CoveredArgs; 2295 bool usesPositionalArgs; 2296 bool atFirstArg; 2297 bool inFunctionCall; 2298 Sema::VariadicCallType CallType; 2299 llvm::SmallBitVector &CheckedVarArgs; 2300 public: 2301 CheckFormatHandler(Sema &s, const StringLiteral *fexpr, 2302 const Expr *origFormatExpr, unsigned firstDataArg, 2303 unsigned numDataArgs, const char *beg, bool hasVAListArg, 2304 ArrayRef<const Expr *> Args, 2305 unsigned formatIdx, bool inFunctionCall, 2306 Sema::VariadicCallType callType, 2307 llvm::SmallBitVector &CheckedVarArgs) 2308 : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr), 2309 FirstDataArg(firstDataArg), NumDataArgs(numDataArgs), 2310 Beg(beg), HasVAListArg(hasVAListArg), 2311 Args(Args), FormatIdx(formatIdx), 2312 usesPositionalArgs(false), atFirstArg(true), 2313 inFunctionCall(inFunctionCall), CallType(callType), 2314 CheckedVarArgs(CheckedVarArgs) { 2315 CoveredArgs.resize(numDataArgs); 2316 CoveredArgs.reset(); 2317 } 2318 2319 void DoneProcessing(); 2320 2321 void HandleIncompleteSpecifier(const char *startSpecifier, 2322 unsigned specifierLen) override; 2323 2324 void HandleInvalidLengthModifier( 2325 const analyze_format_string::FormatSpecifier &FS, 2326 const analyze_format_string::ConversionSpecifier &CS, 2327 const char *startSpecifier, unsigned specifierLen, 2328 unsigned DiagID); 2329 2330 void HandleNonStandardLengthModifier( 2331 const analyze_format_string::FormatSpecifier &FS, 2332 const char *startSpecifier, unsigned specifierLen); 2333 2334 void HandleNonStandardConversionSpecifier( 2335 const analyze_format_string::ConversionSpecifier &CS, 2336 const char *startSpecifier, unsigned specifierLen); 2337 2338 void HandlePosition(const char *startPos, unsigned posLen) override; 2339 2340 void HandleInvalidPosition(const char *startSpecifier, 2341 unsigned specifierLen, 2342 analyze_format_string::PositionContext p) override; 2343 2344 void HandleZeroPosition(const char *startPos, unsigned posLen) override; 2345 2346 void HandleNullChar(const char *nullCharacter) override; 2347 2348 template <typename Range> 2349 static void EmitFormatDiagnostic(Sema &S, bool inFunctionCall, 2350 const Expr *ArgumentExpr, 2351 PartialDiagnostic PDiag, 2352 SourceLocation StringLoc, 2353 bool IsStringLocation, Range StringRange, 2354 ArrayRef<FixItHint> Fixit = None); 2355 2356 protected: 2357 bool HandleInvalidConversionSpecifier(unsigned argIndex, SourceLocation Loc, 2358 const char *startSpec, 2359 unsigned specifierLen, 2360 const char *csStart, unsigned csLen); 2361 2362 void HandlePositionalNonpositionalArgs(SourceLocation Loc, 2363 const char *startSpec, 2364 unsigned specifierLen); 2365 2366 SourceRange getFormatStringRange(); 2367 CharSourceRange getSpecifierRange(const char *startSpecifier, 2368 unsigned specifierLen); 2369 SourceLocation getLocationOfByte(const char *x); 2370 2371 const Expr *getDataArg(unsigned i) const; 2372 2373 bool CheckNumArgs(const analyze_format_string::FormatSpecifier &FS, 2374 const analyze_format_string::ConversionSpecifier &CS, 2375 const char *startSpecifier, unsigned specifierLen, 2376 unsigned argIndex); 2377 2378 template <typename Range> 2379 void EmitFormatDiagnostic(PartialDiagnostic PDiag, SourceLocation StringLoc, 2380 bool IsStringLocation, Range StringRange, 2381 ArrayRef<FixItHint> Fixit = None); 2382 }; 2383 } 2384 2385 SourceRange CheckFormatHandler::getFormatStringRange() { 2386 return OrigFormatExpr->getSourceRange(); 2387 } 2388 2389 CharSourceRange CheckFormatHandler:: 2390 getSpecifierRange(const char *startSpecifier, unsigned specifierLen) { 2391 SourceLocation Start = getLocationOfByte(startSpecifier); 2392 SourceLocation End = getLocationOfByte(startSpecifier + specifierLen - 1); 2393 2394 // Advance the end SourceLocation by one due to half-open ranges. 2395 End = End.getLocWithOffset(1); 2396 2397 return CharSourceRange::getCharRange(Start, End); 2398 } 2399 2400 SourceLocation CheckFormatHandler::getLocationOfByte(const char *x) { 2401 return S.getLocationOfStringLiteralByte(FExpr, x - Beg); 2402 } 2403 2404 void CheckFormatHandler::HandleIncompleteSpecifier(const char *startSpecifier, 2405 unsigned specifierLen){ 2406 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_incomplete_specifier), 2407 getLocationOfByte(startSpecifier), 2408 /*IsStringLocation*/true, 2409 getSpecifierRange(startSpecifier, specifierLen)); 2410 } 2411 2412 void CheckFormatHandler::HandleInvalidLengthModifier( 2413 const analyze_format_string::FormatSpecifier &FS, 2414 const analyze_format_string::ConversionSpecifier &CS, 2415 const char *startSpecifier, unsigned specifierLen, unsigned DiagID) { 2416 using namespace analyze_format_string; 2417 2418 const LengthModifier &LM = FS.getLengthModifier(); 2419 CharSourceRange LMRange = getSpecifierRange(LM.getStart(), LM.getLength()); 2420 2421 // See if we know how to fix this length modifier. 2422 Optional<LengthModifier> FixedLM = FS.getCorrectedLengthModifier(); 2423 if (FixedLM) { 2424 EmitFormatDiagnostic(S.PDiag(DiagID) << LM.toString() << CS.toString(), 2425 getLocationOfByte(LM.getStart()), 2426 /*IsStringLocation*/true, 2427 getSpecifierRange(startSpecifier, specifierLen)); 2428 2429 S.Diag(getLocationOfByte(LM.getStart()), diag::note_format_fix_specifier) 2430 << FixedLM->toString() 2431 << FixItHint::CreateReplacement(LMRange, FixedLM->toString()); 2432 2433 } else { 2434 FixItHint Hint; 2435 if (DiagID == diag::warn_format_nonsensical_length) 2436 Hint = FixItHint::CreateRemoval(LMRange); 2437 2438 EmitFormatDiagnostic(S.PDiag(DiagID) << LM.toString() << CS.toString(), 2439 getLocationOfByte(LM.getStart()), 2440 /*IsStringLocation*/true, 2441 getSpecifierRange(startSpecifier, specifierLen), 2442 Hint); 2443 } 2444 } 2445 2446 void CheckFormatHandler::HandleNonStandardLengthModifier( 2447 const analyze_format_string::FormatSpecifier &FS, 2448 const char *startSpecifier, unsigned specifierLen) { 2449 using namespace analyze_format_string; 2450 2451 const LengthModifier &LM = FS.getLengthModifier(); 2452 CharSourceRange LMRange = getSpecifierRange(LM.getStart(), LM.getLength()); 2453 2454 // See if we know how to fix this length modifier. 2455 Optional<LengthModifier> FixedLM = FS.getCorrectedLengthModifier(); 2456 if (FixedLM) { 2457 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard) 2458 << LM.toString() << 0, 2459 getLocationOfByte(LM.getStart()), 2460 /*IsStringLocation*/true, 2461 getSpecifierRange(startSpecifier, specifierLen)); 2462 2463 S.Diag(getLocationOfByte(LM.getStart()), diag::note_format_fix_specifier) 2464 << FixedLM->toString() 2465 << FixItHint::CreateReplacement(LMRange, FixedLM->toString()); 2466 2467 } else { 2468 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard) 2469 << LM.toString() << 0, 2470 getLocationOfByte(LM.getStart()), 2471 /*IsStringLocation*/true, 2472 getSpecifierRange(startSpecifier, specifierLen)); 2473 } 2474 } 2475 2476 void CheckFormatHandler::HandleNonStandardConversionSpecifier( 2477 const analyze_format_string::ConversionSpecifier &CS, 2478 const char *startSpecifier, unsigned specifierLen) { 2479 using namespace analyze_format_string; 2480 2481 // See if we know how to fix this conversion specifier. 2482 Optional<ConversionSpecifier> FixedCS = CS.getStandardSpecifier(); 2483 if (FixedCS) { 2484 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard) 2485 << CS.toString() << /*conversion specifier*/1, 2486 getLocationOfByte(CS.getStart()), 2487 /*IsStringLocation*/true, 2488 getSpecifierRange(startSpecifier, specifierLen)); 2489 2490 CharSourceRange CSRange = getSpecifierRange(CS.getStart(), CS.getLength()); 2491 S.Diag(getLocationOfByte(CS.getStart()), diag::note_format_fix_specifier) 2492 << FixedCS->toString() 2493 << FixItHint::CreateReplacement(CSRange, FixedCS->toString()); 2494 } else { 2495 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard) 2496 << CS.toString() << /*conversion specifier*/1, 2497 getLocationOfByte(CS.getStart()), 2498 /*IsStringLocation*/true, 2499 getSpecifierRange(startSpecifier, specifierLen)); 2500 } 2501 } 2502 2503 void CheckFormatHandler::HandlePosition(const char *startPos, 2504 unsigned posLen) { 2505 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard_positional_arg), 2506 getLocationOfByte(startPos), 2507 /*IsStringLocation*/true, 2508 getSpecifierRange(startPos, posLen)); 2509 } 2510 2511 void 2512 CheckFormatHandler::HandleInvalidPosition(const char *startPos, unsigned posLen, 2513 analyze_format_string::PositionContext p) { 2514 EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_positional_specifier) 2515 << (unsigned) p, 2516 getLocationOfByte(startPos), /*IsStringLocation*/true, 2517 getSpecifierRange(startPos, posLen)); 2518 } 2519 2520 void CheckFormatHandler::HandleZeroPosition(const char *startPos, 2521 unsigned posLen) { 2522 EmitFormatDiagnostic(S.PDiag(diag::warn_format_zero_positional_specifier), 2523 getLocationOfByte(startPos), 2524 /*IsStringLocation*/true, 2525 getSpecifierRange(startPos, posLen)); 2526 } 2527 2528 void CheckFormatHandler::HandleNullChar(const char *nullCharacter) { 2529 if (!isa<ObjCStringLiteral>(OrigFormatExpr)) { 2530 // The presence of a null character is likely an error. 2531 EmitFormatDiagnostic( 2532 S.PDiag(diag::warn_printf_format_string_contains_null_char), 2533 getLocationOfByte(nullCharacter), /*IsStringLocation*/true, 2534 getFormatStringRange()); 2535 } 2536 } 2537 2538 // Note that this may return NULL if there was an error parsing or building 2539 // one of the argument expressions. 2540 const Expr *CheckFormatHandler::getDataArg(unsigned i) const { 2541 return Args[FirstDataArg + i]; 2542 } 2543 2544 void CheckFormatHandler::DoneProcessing() { 2545 // Does the number of data arguments exceed the number of 2546 // format conversions in the format string? 2547 if (!HasVAListArg) { 2548 // Find any arguments that weren't covered. 2549 CoveredArgs.flip(); 2550 signed notCoveredArg = CoveredArgs.find_first(); 2551 if (notCoveredArg >= 0) { 2552 assert((unsigned)notCoveredArg < NumDataArgs); 2553 if (const Expr *E = getDataArg((unsigned) notCoveredArg)) { 2554 SourceLocation Loc = E->getLocStart(); 2555 if (!S.getSourceManager().isInSystemMacro(Loc)) { 2556 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_data_arg_not_used), 2557 Loc, /*IsStringLocation*/false, 2558 getFormatStringRange()); 2559 } 2560 } 2561 } 2562 } 2563 } 2564 2565 bool 2566 CheckFormatHandler::HandleInvalidConversionSpecifier(unsigned argIndex, 2567 SourceLocation Loc, 2568 const char *startSpec, 2569 unsigned specifierLen, 2570 const char *csStart, 2571 unsigned csLen) { 2572 2573 bool keepGoing = true; 2574 if (argIndex < NumDataArgs) { 2575 // Consider the argument coverered, even though the specifier doesn't 2576 // make sense. 2577 CoveredArgs.set(argIndex); 2578 } 2579 else { 2580 // If argIndex exceeds the number of data arguments we 2581 // don't issue a warning because that is just a cascade of warnings (and 2582 // they may have intended '%%' anyway). We don't want to continue processing 2583 // the format string after this point, however, as we will like just get 2584 // gibberish when trying to match arguments. 2585 keepGoing = false; 2586 } 2587 2588 EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_conversion) 2589 << StringRef(csStart, csLen), 2590 Loc, /*IsStringLocation*/true, 2591 getSpecifierRange(startSpec, specifierLen)); 2592 2593 return keepGoing; 2594 } 2595 2596 void 2597 CheckFormatHandler::HandlePositionalNonpositionalArgs(SourceLocation Loc, 2598 const char *startSpec, 2599 unsigned specifierLen) { 2600 EmitFormatDiagnostic( 2601 S.PDiag(diag::warn_format_mix_positional_nonpositional_args), 2602 Loc, /*isStringLoc*/true, getSpecifierRange(startSpec, specifierLen)); 2603 } 2604 2605 bool 2606 CheckFormatHandler::CheckNumArgs( 2607 const analyze_format_string::FormatSpecifier &FS, 2608 const analyze_format_string::ConversionSpecifier &CS, 2609 const char *startSpecifier, unsigned specifierLen, unsigned argIndex) { 2610 2611 if (argIndex >= NumDataArgs) { 2612 PartialDiagnostic PDiag = FS.usesPositionalArg() 2613 ? (S.PDiag(diag::warn_printf_positional_arg_exceeds_data_args) 2614 << (argIndex+1) << NumDataArgs) 2615 : S.PDiag(diag::warn_printf_insufficient_data_args); 2616 EmitFormatDiagnostic( 2617 PDiag, getLocationOfByte(CS.getStart()), /*IsStringLocation*/true, 2618 getSpecifierRange(startSpecifier, specifierLen)); 2619 return false; 2620 } 2621 return true; 2622 } 2623 2624 template<typename Range> 2625 void CheckFormatHandler::EmitFormatDiagnostic(PartialDiagnostic PDiag, 2626 SourceLocation Loc, 2627 bool IsStringLocation, 2628 Range StringRange, 2629 ArrayRef<FixItHint> FixIt) { 2630 EmitFormatDiagnostic(S, inFunctionCall, Args[FormatIdx], PDiag, 2631 Loc, IsStringLocation, StringRange, FixIt); 2632 } 2633 2634 /// \brief If the format string is not within the funcion call, emit a note 2635 /// so that the function call and string are in diagnostic messages. 2636 /// 2637 /// \param InFunctionCall if true, the format string is within the function 2638 /// call and only one diagnostic message will be produced. Otherwise, an 2639 /// extra note will be emitted pointing to location of the format string. 2640 /// 2641 /// \param ArgumentExpr the expression that is passed as the format string 2642 /// argument in the function call. Used for getting locations when two 2643 /// diagnostics are emitted. 2644 /// 2645 /// \param PDiag the callee should already have provided any strings for the 2646 /// diagnostic message. This function only adds locations and fixits 2647 /// to diagnostics. 2648 /// 2649 /// \param Loc primary location for diagnostic. If two diagnostics are 2650 /// required, one will be at Loc and a new SourceLocation will be created for 2651 /// the other one. 2652 /// 2653 /// \param IsStringLocation if true, Loc points to the format string should be 2654 /// used for the note. Otherwise, Loc points to the argument list and will 2655 /// be used with PDiag. 2656 /// 2657 /// \param StringRange some or all of the string to highlight. This is 2658 /// templated so it can accept either a CharSourceRange or a SourceRange. 2659 /// 2660 /// \param FixIt optional fix it hint for the format string. 2661 template<typename Range> 2662 void CheckFormatHandler::EmitFormatDiagnostic(Sema &S, bool InFunctionCall, 2663 const Expr *ArgumentExpr, 2664 PartialDiagnostic PDiag, 2665 SourceLocation Loc, 2666 bool IsStringLocation, 2667 Range StringRange, 2668 ArrayRef<FixItHint> FixIt) { 2669 if (InFunctionCall) { 2670 const Sema::SemaDiagnosticBuilder &D = S.Diag(Loc, PDiag); 2671 D << StringRange; 2672 for (ArrayRef<FixItHint>::iterator I = FixIt.begin(), E = FixIt.end(); 2673 I != E; ++I) { 2674 D << *I; 2675 } 2676 } else { 2677 S.Diag(IsStringLocation ? ArgumentExpr->getExprLoc() : Loc, PDiag) 2678 << ArgumentExpr->getSourceRange(); 2679 2680 const Sema::SemaDiagnosticBuilder &Note = 2681 S.Diag(IsStringLocation ? Loc : StringRange.getBegin(), 2682 diag::note_format_string_defined); 2683 2684 Note << StringRange; 2685 for (ArrayRef<FixItHint>::iterator I = FixIt.begin(), E = FixIt.end(); 2686 I != E; ++I) { 2687 Note << *I; 2688 } 2689 } 2690 } 2691 2692 //===--- CHECK: Printf format string checking ------------------------------===// 2693 2694 namespace { 2695 class CheckPrintfHandler : public CheckFormatHandler { 2696 bool ObjCContext; 2697 public: 2698 CheckPrintfHandler(Sema &s, const StringLiteral *fexpr, 2699 const Expr *origFormatExpr, unsigned firstDataArg, 2700 unsigned numDataArgs, bool isObjC, 2701 const char *beg, bool hasVAListArg, 2702 ArrayRef<const Expr *> Args, 2703 unsigned formatIdx, bool inFunctionCall, 2704 Sema::VariadicCallType CallType, 2705 llvm::SmallBitVector &CheckedVarArgs) 2706 : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg, 2707 numDataArgs, beg, hasVAListArg, Args, 2708 formatIdx, inFunctionCall, CallType, CheckedVarArgs), 2709 ObjCContext(isObjC) 2710 {} 2711 2712 2713 bool HandleInvalidPrintfConversionSpecifier( 2714 const analyze_printf::PrintfSpecifier &FS, 2715 const char *startSpecifier, 2716 unsigned specifierLen) override; 2717 2718 bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS, 2719 const char *startSpecifier, 2720 unsigned specifierLen) override; 2721 bool checkFormatExpr(const analyze_printf::PrintfSpecifier &FS, 2722 const char *StartSpecifier, 2723 unsigned SpecifierLen, 2724 const Expr *E); 2725 2726 bool HandleAmount(const analyze_format_string::OptionalAmount &Amt, unsigned k, 2727 const char *startSpecifier, unsigned specifierLen); 2728 void HandleInvalidAmount(const analyze_printf::PrintfSpecifier &FS, 2729 const analyze_printf::OptionalAmount &Amt, 2730 unsigned type, 2731 const char *startSpecifier, unsigned specifierLen); 2732 void HandleFlag(const analyze_printf::PrintfSpecifier &FS, 2733 const analyze_printf::OptionalFlag &flag, 2734 const char *startSpecifier, unsigned specifierLen); 2735 void HandleIgnoredFlag(const analyze_printf::PrintfSpecifier &FS, 2736 const analyze_printf::OptionalFlag &ignoredFlag, 2737 const analyze_printf::OptionalFlag &flag, 2738 const char *startSpecifier, unsigned specifierLen); 2739 bool checkForCStrMembers(const analyze_printf::ArgType &AT, 2740 const Expr *E); 2741 2742 }; 2743 } 2744 2745 bool CheckPrintfHandler::HandleInvalidPrintfConversionSpecifier( 2746 const analyze_printf::PrintfSpecifier &FS, 2747 const char *startSpecifier, 2748 unsigned specifierLen) { 2749 const analyze_printf::PrintfConversionSpecifier &CS = 2750 FS.getConversionSpecifier(); 2751 2752 return HandleInvalidConversionSpecifier(FS.getArgIndex(), 2753 getLocationOfByte(CS.getStart()), 2754 startSpecifier, specifierLen, 2755 CS.getStart(), CS.getLength()); 2756 } 2757 2758 bool CheckPrintfHandler::HandleAmount( 2759 const analyze_format_string::OptionalAmount &Amt, 2760 unsigned k, const char *startSpecifier, 2761 unsigned specifierLen) { 2762 2763 if (Amt.hasDataArgument()) { 2764 if (!HasVAListArg) { 2765 unsigned argIndex = Amt.getArgIndex(); 2766 if (argIndex >= NumDataArgs) { 2767 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_missing_arg) 2768 << k, 2769 getLocationOfByte(Amt.getStart()), 2770 /*IsStringLocation*/true, 2771 getSpecifierRange(startSpecifier, specifierLen)); 2772 // Don't do any more checking. We will just emit 2773 // spurious errors. 2774 return false; 2775 } 2776 2777 // Type check the data argument. It should be an 'int'. 2778 // Although not in conformance with C99, we also allow the argument to be 2779 // an 'unsigned int' as that is a reasonably safe case. GCC also 2780 // doesn't emit a warning for that case. 2781 CoveredArgs.set(argIndex); 2782 const Expr *Arg = getDataArg(argIndex); 2783 if (!Arg) 2784 return false; 2785 2786 QualType T = Arg->getType(); 2787 2788 const analyze_printf::ArgType &AT = Amt.getArgType(S.Context); 2789 assert(AT.isValid()); 2790 2791 if (!AT.matchesType(S.Context, T)) { 2792 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_wrong_type) 2793 << k << AT.getRepresentativeTypeName(S.Context) 2794 << T << Arg->getSourceRange(), 2795 getLocationOfByte(Amt.getStart()), 2796 /*IsStringLocation*/true, 2797 getSpecifierRange(startSpecifier, specifierLen)); 2798 // Don't do any more checking. We will just emit 2799 // spurious errors. 2800 return false; 2801 } 2802 } 2803 } 2804 return true; 2805 } 2806 2807 void CheckPrintfHandler::HandleInvalidAmount( 2808 const analyze_printf::PrintfSpecifier &FS, 2809 const analyze_printf::OptionalAmount &Amt, 2810 unsigned type, 2811 const char *startSpecifier, 2812 unsigned specifierLen) { 2813 const analyze_printf::PrintfConversionSpecifier &CS = 2814 FS.getConversionSpecifier(); 2815 2816 FixItHint fixit = 2817 Amt.getHowSpecified() == analyze_printf::OptionalAmount::Constant 2818 ? FixItHint::CreateRemoval(getSpecifierRange(Amt.getStart(), 2819 Amt.getConstantLength())) 2820 : FixItHint(); 2821 2822 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_optional_amount) 2823 << type << CS.toString(), 2824 getLocationOfByte(Amt.getStart()), 2825 /*IsStringLocation*/true, 2826 getSpecifierRange(startSpecifier, specifierLen), 2827 fixit); 2828 } 2829 2830 void CheckPrintfHandler::HandleFlag(const analyze_printf::PrintfSpecifier &FS, 2831 const analyze_printf::OptionalFlag &flag, 2832 const char *startSpecifier, 2833 unsigned specifierLen) { 2834 // Warn about pointless flag with a fixit removal. 2835 const analyze_printf::PrintfConversionSpecifier &CS = 2836 FS.getConversionSpecifier(); 2837 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_flag) 2838 << flag.toString() << CS.toString(), 2839 getLocationOfByte(flag.getPosition()), 2840 /*IsStringLocation*/true, 2841 getSpecifierRange(startSpecifier, specifierLen), 2842 FixItHint::CreateRemoval( 2843 getSpecifierRange(flag.getPosition(), 1))); 2844 } 2845 2846 void CheckPrintfHandler::HandleIgnoredFlag( 2847 const analyze_printf::PrintfSpecifier &FS, 2848 const analyze_printf::OptionalFlag &ignoredFlag, 2849 const analyze_printf::OptionalFlag &flag, 2850 const char *startSpecifier, 2851 unsigned specifierLen) { 2852 // Warn about ignored flag with a fixit removal. 2853 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_ignored_flag) 2854 << ignoredFlag.toString() << flag.toString(), 2855 getLocationOfByte(ignoredFlag.getPosition()), 2856 /*IsStringLocation*/true, 2857 getSpecifierRange(startSpecifier, specifierLen), 2858 FixItHint::CreateRemoval( 2859 getSpecifierRange(ignoredFlag.getPosition(), 1))); 2860 } 2861 2862 // Determines if the specified is a C++ class or struct containing 2863 // a member with the specified name and kind (e.g. a CXXMethodDecl named 2864 // "c_str()"). 2865 template<typename MemberKind> 2866 static llvm::SmallPtrSet<MemberKind*, 1> 2867 CXXRecordMembersNamed(StringRef Name, Sema &S, QualType Ty) { 2868 const RecordType *RT = Ty->getAs<RecordType>(); 2869 llvm::SmallPtrSet<MemberKind*, 1> Results; 2870 2871 if (!RT) 2872 return Results; 2873 const CXXRecordDecl *RD = dyn_cast<CXXRecordDecl>(RT->getDecl()); 2874 if (!RD || !RD->getDefinition()) 2875 return Results; 2876 2877 LookupResult R(S, &S.Context.Idents.get(Name), SourceLocation(), 2878 Sema::LookupMemberName); 2879 R.suppressDiagnostics(); 2880 2881 // We just need to include all members of the right kind turned up by the 2882 // filter, at this point. 2883 if (S.LookupQualifiedName(R, RT->getDecl())) 2884 for (LookupResult::iterator I = R.begin(), E = R.end(); I != E; ++I) { 2885 NamedDecl *decl = (*I)->getUnderlyingDecl(); 2886 if (MemberKind *FK = dyn_cast<MemberKind>(decl)) 2887 Results.insert(FK); 2888 } 2889 return Results; 2890 } 2891 2892 /// Check if we could call '.c_str()' on an object. 2893 /// 2894 /// FIXME: This returns the wrong results in some cases (if cv-qualifiers don't 2895 /// allow the call, or if it would be ambiguous). 2896 bool Sema::hasCStrMethod(const Expr *E) { 2897 typedef llvm::SmallPtrSet<CXXMethodDecl*, 1> MethodSet; 2898 MethodSet Results = 2899 CXXRecordMembersNamed<CXXMethodDecl>("c_str", *this, E->getType()); 2900 for (MethodSet::iterator MI = Results.begin(), ME = Results.end(); 2901 MI != ME; ++MI) 2902 if ((*MI)->getMinRequiredArguments() == 0) 2903 return true; 2904 return false; 2905 } 2906 2907 // Check if a (w)string was passed when a (w)char* was needed, and offer a 2908 // better diagnostic if so. AT is assumed to be valid. 2909 // Returns true when a c_str() conversion method is found. 2910 bool CheckPrintfHandler::checkForCStrMembers( 2911 const analyze_printf::ArgType &AT, const Expr *E) { 2912 typedef llvm::SmallPtrSet<CXXMethodDecl*, 1> MethodSet; 2913 2914 MethodSet Results = 2915 CXXRecordMembersNamed<CXXMethodDecl>("c_str", S, E->getType()); 2916 2917 for (MethodSet::iterator MI = Results.begin(), ME = Results.end(); 2918 MI != ME; ++MI) { 2919 const CXXMethodDecl *Method = *MI; 2920 if (Method->getMinRequiredArguments() == 0 && 2921 AT.matchesType(S.Context, Method->getReturnType())) { 2922 // FIXME: Suggest parens if the expression needs them. 2923 SourceLocation EndLoc = S.getLocForEndOfToken(E->getLocEnd()); 2924 S.Diag(E->getLocStart(), diag::note_printf_c_str) 2925 << "c_str()" 2926 << FixItHint::CreateInsertion(EndLoc, ".c_str()"); 2927 return true; 2928 } 2929 } 2930 2931 return false; 2932 } 2933 2934 bool 2935 CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier 2936 &FS, 2937 const char *startSpecifier, 2938 unsigned specifierLen) { 2939 2940 using namespace analyze_format_string; 2941 using namespace analyze_printf; 2942 const PrintfConversionSpecifier &CS = FS.getConversionSpecifier(); 2943 2944 if (FS.consumesDataArgument()) { 2945 if (atFirstArg) { 2946 atFirstArg = false; 2947 usesPositionalArgs = FS.usesPositionalArg(); 2948 } 2949 else if (usesPositionalArgs != FS.usesPositionalArg()) { 2950 HandlePositionalNonpositionalArgs(getLocationOfByte(CS.getStart()), 2951 startSpecifier, specifierLen); 2952 return false; 2953 } 2954 } 2955 2956 // First check if the field width, precision, and conversion specifier 2957 // have matching data arguments. 2958 if (!HandleAmount(FS.getFieldWidth(), /* field width */ 0, 2959 startSpecifier, specifierLen)) { 2960 return false; 2961 } 2962 2963 if (!HandleAmount(FS.getPrecision(), /* precision */ 1, 2964 startSpecifier, specifierLen)) { 2965 return false; 2966 } 2967 2968 if (!CS.consumesDataArgument()) { 2969 // FIXME: Technically specifying a precision or field width here 2970 // makes no sense. Worth issuing a warning at some point. 2971 return true; 2972 } 2973 2974 // Consume the argument. 2975 unsigned argIndex = FS.getArgIndex(); 2976 if (argIndex < NumDataArgs) { 2977 // The check to see if the argIndex is valid will come later. 2978 // We set the bit here because we may exit early from this 2979 // function if we encounter some other error. 2980 CoveredArgs.set(argIndex); 2981 } 2982 2983 // Check for using an Objective-C specific conversion specifier 2984 // in a non-ObjC literal. 2985 if (!ObjCContext && CS.isObjCArg()) { 2986 return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier, 2987 specifierLen); 2988 } 2989 2990 // Check for invalid use of field width 2991 if (!FS.hasValidFieldWidth()) { 2992 HandleInvalidAmount(FS, FS.getFieldWidth(), /* field width */ 0, 2993 startSpecifier, specifierLen); 2994 } 2995 2996 // Check for invalid use of precision 2997 if (!FS.hasValidPrecision()) { 2998 HandleInvalidAmount(FS, FS.getPrecision(), /* precision */ 1, 2999 startSpecifier, specifierLen); 3000 } 3001 3002 // Check each flag does not conflict with any other component. 3003 if (!FS.hasValidThousandsGroupingPrefix()) 3004 HandleFlag(FS, FS.hasThousandsGrouping(), startSpecifier, specifierLen); 3005 if (!FS.hasValidLeadingZeros()) 3006 HandleFlag(FS, FS.hasLeadingZeros(), startSpecifier, specifierLen); 3007 if (!FS.hasValidPlusPrefix()) 3008 HandleFlag(FS, FS.hasPlusPrefix(), startSpecifier, specifierLen); 3009 if (!FS.hasValidSpacePrefix()) 3010 HandleFlag(FS, FS.hasSpacePrefix(), startSpecifier, specifierLen); 3011 if (!FS.hasValidAlternativeForm()) 3012 HandleFlag(FS, FS.hasAlternativeForm(), startSpecifier, specifierLen); 3013 if (!FS.hasValidLeftJustified()) 3014 HandleFlag(FS, FS.isLeftJustified(), startSpecifier, specifierLen); 3015 3016 // Check that flags are not ignored by another flag 3017 if (FS.hasSpacePrefix() && FS.hasPlusPrefix()) // ' ' ignored by '+' 3018 HandleIgnoredFlag(FS, FS.hasSpacePrefix(), FS.hasPlusPrefix(), 3019 startSpecifier, specifierLen); 3020 if (FS.hasLeadingZeros() && FS.isLeftJustified()) // '0' ignored by '-' 3021 HandleIgnoredFlag(FS, FS.hasLeadingZeros(), FS.isLeftJustified(), 3022 startSpecifier, specifierLen); 3023 3024 // Check the length modifier is valid with the given conversion specifier. 3025 if (!FS.hasValidLengthModifier(S.getASTContext().getTargetInfo())) 3026 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen, 3027 diag::warn_format_nonsensical_length); 3028 else if (!FS.hasStandardLengthModifier()) 3029 HandleNonStandardLengthModifier(FS, startSpecifier, specifierLen); 3030 else if (!FS.hasStandardLengthConversionCombination()) 3031 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen, 3032 diag::warn_format_non_standard_conversion_spec); 3033 3034 if (!FS.hasStandardConversionSpecifier(S.getLangOpts())) 3035 HandleNonStandardConversionSpecifier(CS, startSpecifier, specifierLen); 3036 3037 // The remaining checks depend on the data arguments. 3038 if (HasVAListArg) 3039 return true; 3040 3041 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex)) 3042 return false; 3043 3044 const Expr *Arg = getDataArg(argIndex); 3045 if (!Arg) 3046 return true; 3047 3048 return checkFormatExpr(FS, startSpecifier, specifierLen, Arg); 3049 } 3050 3051 static bool requiresParensToAddCast(const Expr *E) { 3052 // FIXME: We should have a general way to reason about operator 3053 // precedence and whether parens are actually needed here. 3054 // Take care of a few common cases where they aren't. 3055 const Expr *Inside = E->IgnoreImpCasts(); 3056 if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(Inside)) 3057 Inside = POE->getSyntacticForm()->IgnoreImpCasts(); 3058 3059 switch (Inside->getStmtClass()) { 3060 case Stmt::ArraySubscriptExprClass: 3061 case Stmt::CallExprClass: 3062 case Stmt::CharacterLiteralClass: 3063 case Stmt::CXXBoolLiteralExprClass: 3064 case Stmt::DeclRefExprClass: 3065 case Stmt::FloatingLiteralClass: 3066 case Stmt::IntegerLiteralClass: 3067 case Stmt::MemberExprClass: 3068 case Stmt::ObjCArrayLiteralClass: 3069 case Stmt::ObjCBoolLiteralExprClass: 3070 case Stmt::ObjCBoxedExprClass: 3071 case Stmt::ObjCDictionaryLiteralClass: 3072 case Stmt::ObjCEncodeExprClass: 3073 case Stmt::ObjCIvarRefExprClass: 3074 case Stmt::ObjCMessageExprClass: 3075 case Stmt::ObjCPropertyRefExprClass: 3076 case Stmt::ObjCStringLiteralClass: 3077 case Stmt::ObjCSubscriptRefExprClass: 3078 case Stmt::ParenExprClass: 3079 case Stmt::StringLiteralClass: 3080 case Stmt::UnaryOperatorClass: 3081 return false; 3082 default: 3083 return true; 3084 } 3085 } 3086 3087 bool 3088 CheckPrintfHandler::checkFormatExpr(const analyze_printf::PrintfSpecifier &FS, 3089 const char *StartSpecifier, 3090 unsigned SpecifierLen, 3091 const Expr *E) { 3092 using namespace analyze_format_string; 3093 using namespace analyze_printf; 3094 // Now type check the data expression that matches the 3095 // format specifier. 3096 const analyze_printf::ArgType &AT = FS.getArgType(S.Context, 3097 ObjCContext); 3098 if (!AT.isValid()) 3099 return true; 3100 3101 QualType ExprTy = E->getType(); 3102 while (const TypeOfExprType *TET = dyn_cast<TypeOfExprType>(ExprTy)) { 3103 ExprTy = TET->getUnderlyingExpr()->getType(); 3104 } 3105 3106 if (AT.matchesType(S.Context, ExprTy)) 3107 return true; 3108 3109 // Look through argument promotions for our error message's reported type. 3110 // This includes the integral and floating promotions, but excludes array 3111 // and function pointer decay; seeing that an argument intended to be a 3112 // string has type 'char [6]' is probably more confusing than 'char *'. 3113 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(E)) { 3114 if (ICE->getCastKind() == CK_IntegralCast || 3115 ICE->getCastKind() == CK_FloatingCast) { 3116 E = ICE->getSubExpr(); 3117 ExprTy = E->getType(); 3118 3119 // Check if we didn't match because of an implicit cast from a 'char' 3120 // or 'short' to an 'int'. This is done because printf is a varargs 3121 // function. 3122 if (ICE->getType() == S.Context.IntTy || 3123 ICE->getType() == S.Context.UnsignedIntTy) { 3124 // All further checking is done on the subexpression. 3125 if (AT.matchesType(S.Context, ExprTy)) 3126 return true; 3127 } 3128 } 3129 } else if (const CharacterLiteral *CL = dyn_cast<CharacterLiteral>(E)) { 3130 // Special case for 'a', which has type 'int' in C. 3131 // Note, however, that we do /not/ want to treat multibyte constants like 3132 // 'MooV' as characters! This form is deprecated but still exists. 3133 if (ExprTy == S.Context.IntTy) 3134 if (llvm::isUIntN(S.Context.getCharWidth(), CL->getValue())) 3135 ExprTy = S.Context.CharTy; 3136 } 3137 3138 // Look through enums to their underlying type. 3139 bool IsEnum = false; 3140 if (auto EnumTy = ExprTy->getAs<EnumType>()) { 3141 ExprTy = EnumTy->getDecl()->getIntegerType(); 3142 IsEnum = true; 3143 } 3144 3145 // %C in an Objective-C context prints a unichar, not a wchar_t. 3146 // If the argument is an integer of some kind, believe the %C and suggest 3147 // a cast instead of changing the conversion specifier. 3148 QualType IntendedTy = ExprTy; 3149 if (ObjCContext && 3150 FS.getConversionSpecifier().getKind() == ConversionSpecifier::CArg) { 3151 if (ExprTy->isIntegralOrUnscopedEnumerationType() && 3152 !ExprTy->isCharType()) { 3153 // 'unichar' is defined as a typedef of unsigned short, but we should 3154 // prefer using the typedef if it is visible. 3155 IntendedTy = S.Context.UnsignedShortTy; 3156 3157 // While we are here, check if the value is an IntegerLiteral that happens 3158 // to be within the valid range. 3159 if (const IntegerLiteral *IL = dyn_cast<IntegerLiteral>(E)) { 3160 const llvm::APInt &V = IL->getValue(); 3161 if (V.getActiveBits() <= S.Context.getTypeSize(IntendedTy)) 3162 return true; 3163 } 3164 3165 LookupResult Result(S, &S.Context.Idents.get("unichar"), E->getLocStart(), 3166 Sema::LookupOrdinaryName); 3167 if (S.LookupName(Result, S.getCurScope())) { 3168 NamedDecl *ND = Result.getFoundDecl(); 3169 if (TypedefNameDecl *TD = dyn_cast<TypedefNameDecl>(ND)) 3170 if (TD->getUnderlyingType() == IntendedTy) 3171 IntendedTy = S.Context.getTypedefType(TD); 3172 } 3173 } 3174 } 3175 3176 // Special-case some of Darwin's platform-independence types by suggesting 3177 // casts to primitive types that are known to be large enough. 3178 bool ShouldNotPrintDirectly = false; 3179 if (S.Context.getTargetInfo().getTriple().isOSDarwin()) { 3180 // Use a 'while' to peel off layers of typedefs. 3181 QualType TyTy = IntendedTy; 3182 while (const TypedefType *UserTy = TyTy->getAs<TypedefType>()) { 3183 StringRef Name = UserTy->getDecl()->getName(); 3184 QualType CastTy = llvm::StringSwitch<QualType>(Name) 3185 .Case("NSInteger", S.Context.LongTy) 3186 .Case("NSUInteger", S.Context.UnsignedLongTy) 3187 .Case("SInt32", S.Context.IntTy) 3188 .Case("UInt32", S.Context.UnsignedIntTy) 3189 .Default(QualType()); 3190 3191 if (!CastTy.isNull()) { 3192 ShouldNotPrintDirectly = true; 3193 IntendedTy = CastTy; 3194 break; 3195 } 3196 TyTy = UserTy->desugar(); 3197 } 3198 } 3199 3200 // We may be able to offer a FixItHint if it is a supported type. 3201 PrintfSpecifier fixedFS = FS; 3202 bool success = fixedFS.fixType(IntendedTy, S.getLangOpts(), 3203 S.Context, ObjCContext); 3204 3205 if (success) { 3206 // Get the fix string from the fixed format specifier 3207 SmallString<16> buf; 3208 llvm::raw_svector_ostream os(buf); 3209 fixedFS.toString(os); 3210 3211 CharSourceRange SpecRange = getSpecifierRange(StartSpecifier, SpecifierLen); 3212 3213 if (IntendedTy == ExprTy) { 3214 // In this case, the specifier is wrong and should be changed to match 3215 // the argument. 3216 EmitFormatDiagnostic( 3217 S.PDiag(diag::warn_format_conversion_argument_type_mismatch) 3218 << AT.getRepresentativeTypeName(S.Context) << IntendedTy << IsEnum 3219 << E->getSourceRange(), 3220 E->getLocStart(), 3221 /*IsStringLocation*/false, 3222 SpecRange, 3223 FixItHint::CreateReplacement(SpecRange, os.str())); 3224 3225 } else { 3226 // The canonical type for formatting this value is different from the 3227 // actual type of the expression. (This occurs, for example, with Darwin's 3228 // NSInteger on 32-bit platforms, where it is typedef'd as 'int', but 3229 // should be printed as 'long' for 64-bit compatibility.) 3230 // Rather than emitting a normal format/argument mismatch, we want to 3231 // add a cast to the recommended type (and correct the format string 3232 // if necessary). 3233 SmallString<16> CastBuf; 3234 llvm::raw_svector_ostream CastFix(CastBuf); 3235 CastFix << "("; 3236 IntendedTy.print(CastFix, S.Context.getPrintingPolicy()); 3237 CastFix << ")"; 3238 3239 SmallVector<FixItHint,4> Hints; 3240 if (!AT.matchesType(S.Context, IntendedTy)) 3241 Hints.push_back(FixItHint::CreateReplacement(SpecRange, os.str())); 3242 3243 if (const CStyleCastExpr *CCast = dyn_cast<CStyleCastExpr>(E)) { 3244 // If there's already a cast present, just replace it. 3245 SourceRange CastRange(CCast->getLParenLoc(), CCast->getRParenLoc()); 3246 Hints.push_back(FixItHint::CreateReplacement(CastRange, CastFix.str())); 3247 3248 } else if (!requiresParensToAddCast(E)) { 3249 // If the expression has high enough precedence, 3250 // just write the C-style cast. 3251 Hints.push_back(FixItHint::CreateInsertion(E->getLocStart(), 3252 CastFix.str())); 3253 } else { 3254 // Otherwise, add parens around the expression as well as the cast. 3255 CastFix << "("; 3256 Hints.push_back(FixItHint::CreateInsertion(E->getLocStart(), 3257 CastFix.str())); 3258 3259 SourceLocation After = S.getLocForEndOfToken(E->getLocEnd()); 3260 Hints.push_back(FixItHint::CreateInsertion(After, ")")); 3261 } 3262 3263 if (ShouldNotPrintDirectly) { 3264 // The expression has a type that should not be printed directly. 3265 // We extract the name from the typedef because we don't want to show 3266 // the underlying type in the diagnostic. 3267 StringRef Name = cast<TypedefType>(ExprTy)->getDecl()->getName(); 3268 3269 EmitFormatDiagnostic(S.PDiag(diag::warn_format_argument_needs_cast) 3270 << Name << IntendedTy << IsEnum 3271 << E->getSourceRange(), 3272 E->getLocStart(), /*IsStringLocation=*/false, 3273 SpecRange, Hints); 3274 } else { 3275 // In this case, the expression could be printed using a different 3276 // specifier, but we've decided that the specifier is probably correct 3277 // and we should cast instead. Just use the normal warning message. 3278 EmitFormatDiagnostic( 3279 S.PDiag(diag::warn_format_conversion_argument_type_mismatch) 3280 << AT.getRepresentativeTypeName(S.Context) << ExprTy << IsEnum 3281 << E->getSourceRange(), 3282 E->getLocStart(), /*IsStringLocation*/false, 3283 SpecRange, Hints); 3284 } 3285 } 3286 } else { 3287 const CharSourceRange &CSR = getSpecifierRange(StartSpecifier, 3288 SpecifierLen); 3289 // Since the warning for passing non-POD types to variadic functions 3290 // was deferred until now, we emit a warning for non-POD 3291 // arguments here. 3292 switch (S.isValidVarArgType(ExprTy)) { 3293 case Sema::VAK_Valid: 3294 case Sema::VAK_ValidInCXX11: 3295 EmitFormatDiagnostic( 3296 S.PDiag(diag::warn_format_conversion_argument_type_mismatch) 3297 << AT.getRepresentativeTypeName(S.Context) << ExprTy << IsEnum 3298 << CSR 3299 << E->getSourceRange(), 3300 E->getLocStart(), /*IsStringLocation*/false, CSR); 3301 break; 3302 3303 case Sema::VAK_Undefined: 3304 EmitFormatDiagnostic( 3305 S.PDiag(diag::warn_non_pod_vararg_with_format_string) 3306 << S.getLangOpts().CPlusPlus11 3307 << ExprTy 3308 << CallType 3309 << AT.getRepresentativeTypeName(S.Context) 3310 << CSR 3311 << E->getSourceRange(), 3312 E->getLocStart(), /*IsStringLocation*/false, CSR); 3313 checkForCStrMembers(AT, E); 3314 break; 3315 3316 case Sema::VAK_Invalid: 3317 if (ExprTy->isObjCObjectType()) 3318 EmitFormatDiagnostic( 3319 S.PDiag(diag::err_cannot_pass_objc_interface_to_vararg_format) 3320 << S.getLangOpts().CPlusPlus11 3321 << ExprTy 3322 << CallType 3323 << AT.getRepresentativeTypeName(S.Context) 3324 << CSR 3325 << E->getSourceRange(), 3326 E->getLocStart(), /*IsStringLocation*/false, CSR); 3327 else 3328 // FIXME: If this is an initializer list, suggest removing the braces 3329 // or inserting a cast to the target type. 3330 S.Diag(E->getLocStart(), diag::err_cannot_pass_to_vararg_format) 3331 << isa<InitListExpr>(E) << ExprTy << CallType 3332 << AT.getRepresentativeTypeName(S.Context) 3333 << E->getSourceRange(); 3334 break; 3335 } 3336 3337 assert(FirstDataArg + FS.getArgIndex() < CheckedVarArgs.size() && 3338 "format string specifier index out of range"); 3339 CheckedVarArgs[FirstDataArg + FS.getArgIndex()] = true; 3340 } 3341 3342 return true; 3343 } 3344 3345 //===--- CHECK: Scanf format string checking ------------------------------===// 3346 3347 namespace { 3348 class CheckScanfHandler : public CheckFormatHandler { 3349 public: 3350 CheckScanfHandler(Sema &s, const StringLiteral *fexpr, 3351 const Expr *origFormatExpr, unsigned firstDataArg, 3352 unsigned numDataArgs, const char *beg, bool hasVAListArg, 3353 ArrayRef<const Expr *> Args, 3354 unsigned formatIdx, bool inFunctionCall, 3355 Sema::VariadicCallType CallType, 3356 llvm::SmallBitVector &CheckedVarArgs) 3357 : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg, 3358 numDataArgs, beg, hasVAListArg, 3359 Args, formatIdx, inFunctionCall, CallType, 3360 CheckedVarArgs) 3361 {} 3362 3363 bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS, 3364 const char *startSpecifier, 3365 unsigned specifierLen) override; 3366 3367 bool HandleInvalidScanfConversionSpecifier( 3368 const analyze_scanf::ScanfSpecifier &FS, 3369 const char *startSpecifier, 3370 unsigned specifierLen) override; 3371 3372 void HandleIncompleteScanList(const char *start, const char *end) override; 3373 }; 3374 } 3375 3376 void CheckScanfHandler::HandleIncompleteScanList(const char *start, 3377 const char *end) { 3378 EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_scanlist_incomplete), 3379 getLocationOfByte(end), /*IsStringLocation*/true, 3380 getSpecifierRange(start, end - start)); 3381 } 3382 3383 bool CheckScanfHandler::HandleInvalidScanfConversionSpecifier( 3384 const analyze_scanf::ScanfSpecifier &FS, 3385 const char *startSpecifier, 3386 unsigned specifierLen) { 3387 3388 const analyze_scanf::ScanfConversionSpecifier &CS = 3389 FS.getConversionSpecifier(); 3390 3391 return HandleInvalidConversionSpecifier(FS.getArgIndex(), 3392 getLocationOfByte(CS.getStart()), 3393 startSpecifier, specifierLen, 3394 CS.getStart(), CS.getLength()); 3395 } 3396 3397 bool CheckScanfHandler::HandleScanfSpecifier( 3398 const analyze_scanf::ScanfSpecifier &FS, 3399 const char *startSpecifier, 3400 unsigned specifierLen) { 3401 3402 using namespace analyze_scanf; 3403 using namespace analyze_format_string; 3404 3405 const ScanfConversionSpecifier &CS = FS.getConversionSpecifier(); 3406 3407 // Handle case where '%' and '*' don't consume an argument. These shouldn't 3408 // be used to decide if we are using positional arguments consistently. 3409 if (FS.consumesDataArgument()) { 3410 if (atFirstArg) { 3411 atFirstArg = false; 3412 usesPositionalArgs = FS.usesPositionalArg(); 3413 } 3414 else if (usesPositionalArgs != FS.usesPositionalArg()) { 3415 HandlePositionalNonpositionalArgs(getLocationOfByte(CS.getStart()), 3416 startSpecifier, specifierLen); 3417 return false; 3418 } 3419 } 3420 3421 // Check if the field with is non-zero. 3422 const OptionalAmount &Amt = FS.getFieldWidth(); 3423 if (Amt.getHowSpecified() == OptionalAmount::Constant) { 3424 if (Amt.getConstantAmount() == 0) { 3425 const CharSourceRange &R = getSpecifierRange(Amt.getStart(), 3426 Amt.getConstantLength()); 3427 EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_nonzero_width), 3428 getLocationOfByte(Amt.getStart()), 3429 /*IsStringLocation*/true, R, 3430 FixItHint::CreateRemoval(R)); 3431 } 3432 } 3433 3434 if (!FS.consumesDataArgument()) { 3435 // FIXME: Technically specifying a precision or field width here 3436 // makes no sense. Worth issuing a warning at some point. 3437 return true; 3438 } 3439 3440 // Consume the argument. 3441 unsigned argIndex = FS.getArgIndex(); 3442 if (argIndex < NumDataArgs) { 3443 // The check to see if the argIndex is valid will come later. 3444 // We set the bit here because we may exit early from this 3445 // function if we encounter some other error. 3446 CoveredArgs.set(argIndex); 3447 } 3448 3449 // Check the length modifier is valid with the given conversion specifier. 3450 if (!FS.hasValidLengthModifier(S.getASTContext().getTargetInfo())) 3451 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen, 3452 diag::warn_format_nonsensical_length); 3453 else if (!FS.hasStandardLengthModifier()) 3454 HandleNonStandardLengthModifier(FS, startSpecifier, specifierLen); 3455 else if (!FS.hasStandardLengthConversionCombination()) 3456 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen, 3457 diag::warn_format_non_standard_conversion_spec); 3458 3459 if (!FS.hasStandardConversionSpecifier(S.getLangOpts())) 3460 HandleNonStandardConversionSpecifier(CS, startSpecifier, specifierLen); 3461 3462 // The remaining checks depend on the data arguments. 3463 if (HasVAListArg) 3464 return true; 3465 3466 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex)) 3467 return false; 3468 3469 // Check that the argument type matches the format specifier. 3470 const Expr *Ex = getDataArg(argIndex); 3471 if (!Ex) 3472 return true; 3473 3474 const analyze_format_string::ArgType &AT = FS.getArgType(S.Context); 3475 if (AT.isValid() && !AT.matchesType(S.Context, Ex->getType())) { 3476 ScanfSpecifier fixedFS = FS; 3477 bool success = fixedFS.fixType(Ex->getType(), 3478 Ex->IgnoreImpCasts()->getType(), 3479 S.getLangOpts(), S.Context); 3480 3481 if (success) { 3482 // Get the fix string from the fixed format specifier. 3483 SmallString<128> buf; 3484 llvm::raw_svector_ostream os(buf); 3485 fixedFS.toString(os); 3486 3487 EmitFormatDiagnostic( 3488 S.PDiag(diag::warn_format_conversion_argument_type_mismatch) 3489 << AT.getRepresentativeTypeName(S.Context) << Ex->getType() << false 3490 << Ex->getSourceRange(), 3491 Ex->getLocStart(), 3492 /*IsStringLocation*/false, 3493 getSpecifierRange(startSpecifier, specifierLen), 3494 FixItHint::CreateReplacement( 3495 getSpecifierRange(startSpecifier, specifierLen), 3496 os.str())); 3497 } else { 3498 EmitFormatDiagnostic( 3499 S.PDiag(diag::warn_format_conversion_argument_type_mismatch) 3500 << AT.getRepresentativeTypeName(S.Context) << Ex->getType() << false 3501 << Ex->getSourceRange(), 3502 Ex->getLocStart(), 3503 /*IsStringLocation*/false, 3504 getSpecifierRange(startSpecifier, specifierLen)); 3505 } 3506 } 3507 3508 return true; 3509 } 3510 3511 void Sema::CheckFormatString(const StringLiteral *FExpr, 3512 const Expr *OrigFormatExpr, 3513 ArrayRef<const Expr *> Args, 3514 bool HasVAListArg, unsigned format_idx, 3515 unsigned firstDataArg, FormatStringType Type, 3516 bool inFunctionCall, VariadicCallType CallType, 3517 llvm::SmallBitVector &CheckedVarArgs) { 3518 3519 // CHECK: is the format string a wide literal? 3520 if (!FExpr->isAscii() && !FExpr->isUTF8()) { 3521 CheckFormatHandler::EmitFormatDiagnostic( 3522 *this, inFunctionCall, Args[format_idx], 3523 PDiag(diag::warn_format_string_is_wide_literal), FExpr->getLocStart(), 3524 /*IsStringLocation*/true, OrigFormatExpr->getSourceRange()); 3525 return; 3526 } 3527 3528 // Str - The format string. NOTE: this is NOT null-terminated! 3529 StringRef StrRef = FExpr->getString(); 3530 const char *Str = StrRef.data(); 3531 // Account for cases where the string literal is truncated in a declaration. 3532 const ConstantArrayType *T = Context.getAsConstantArrayType(FExpr->getType()); 3533 assert(T && "String literal not of constant array type!"); 3534 size_t TypeSize = T->getSize().getZExtValue(); 3535 size_t StrLen = std::min(std::max(TypeSize, size_t(1)) - 1, StrRef.size()); 3536 const unsigned numDataArgs = Args.size() - firstDataArg; 3537 3538 // Emit a warning if the string literal is truncated and does not contain an 3539 // embedded null character. 3540 if (TypeSize <= StrRef.size() && 3541 StrRef.substr(0, TypeSize).find('\0') == StringRef::npos) { 3542 CheckFormatHandler::EmitFormatDiagnostic( 3543 *this, inFunctionCall, Args[format_idx], 3544 PDiag(diag::warn_printf_format_string_not_null_terminated), 3545 FExpr->getLocStart(), 3546 /*IsStringLocation=*/true, OrigFormatExpr->getSourceRange()); 3547 return; 3548 } 3549 3550 // CHECK: empty format string? 3551 if (StrLen == 0 && numDataArgs > 0) { 3552 CheckFormatHandler::EmitFormatDiagnostic( 3553 *this, inFunctionCall, Args[format_idx], 3554 PDiag(diag::warn_empty_format_string), FExpr->getLocStart(), 3555 /*IsStringLocation*/true, OrigFormatExpr->getSourceRange()); 3556 return; 3557 } 3558 3559 if (Type == FST_Printf || Type == FST_NSString) { 3560 CheckPrintfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg, 3561 numDataArgs, (Type == FST_NSString), 3562 Str, HasVAListArg, Args, format_idx, 3563 inFunctionCall, CallType, CheckedVarArgs); 3564 3565 if (!analyze_format_string::ParsePrintfString(H, Str, Str + StrLen, 3566 getLangOpts(), 3567 Context.getTargetInfo())) 3568 H.DoneProcessing(); 3569 } else if (Type == FST_Scanf) { 3570 CheckScanfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg, numDataArgs, 3571 Str, HasVAListArg, Args, format_idx, 3572 inFunctionCall, CallType, CheckedVarArgs); 3573 3574 if (!analyze_format_string::ParseScanfString(H, Str, Str + StrLen, 3575 getLangOpts(), 3576 Context.getTargetInfo())) 3577 H.DoneProcessing(); 3578 } // TODO: handle other formats 3579 } 3580 3581 //===--- CHECK: Warn on use of wrong absolute value function. -------------===// 3582 3583 // Returns the related absolute value function that is larger, of 0 if one 3584 // does not exist. 3585 static unsigned getLargerAbsoluteValueFunction(unsigned AbsFunction) { 3586 switch (AbsFunction) { 3587 default: 3588 return 0; 3589 3590 case Builtin::BI__builtin_abs: 3591 return Builtin::BI__builtin_labs; 3592 case Builtin::BI__builtin_labs: 3593 return Builtin::BI__builtin_llabs; 3594 case Builtin::BI__builtin_llabs: 3595 return 0; 3596 3597 case Builtin::BI__builtin_fabsf: 3598 return Builtin::BI__builtin_fabs; 3599 case Builtin::BI__builtin_fabs: 3600 return Builtin::BI__builtin_fabsl; 3601 case Builtin::BI__builtin_fabsl: 3602 return 0; 3603 3604 case Builtin::BI__builtin_cabsf: 3605 return Builtin::BI__builtin_cabs; 3606 case Builtin::BI__builtin_cabs: 3607 return Builtin::BI__builtin_cabsl; 3608 case Builtin::BI__builtin_cabsl: 3609 return 0; 3610 3611 case Builtin::BIabs: 3612 return Builtin::BIlabs; 3613 case Builtin::BIlabs: 3614 return Builtin::BIllabs; 3615 case Builtin::BIllabs: 3616 return 0; 3617 3618 case Builtin::BIfabsf: 3619 return Builtin::BIfabs; 3620 case Builtin::BIfabs: 3621 return Builtin::BIfabsl; 3622 case Builtin::BIfabsl: 3623 return 0; 3624 3625 case Builtin::BIcabsf: 3626 return Builtin::BIcabs; 3627 case Builtin::BIcabs: 3628 return Builtin::BIcabsl; 3629 case Builtin::BIcabsl: 3630 return 0; 3631 } 3632 } 3633 3634 // Returns the argument type of the absolute value function. 3635 static QualType getAbsoluteValueArgumentType(ASTContext &Context, 3636 unsigned AbsType) { 3637 if (AbsType == 0) 3638 return QualType(); 3639 3640 ASTContext::GetBuiltinTypeError Error = ASTContext::GE_None; 3641 QualType BuiltinType = Context.GetBuiltinType(AbsType, Error); 3642 if (Error != ASTContext::GE_None) 3643 return QualType(); 3644 3645 const FunctionProtoType *FT = BuiltinType->getAs<FunctionProtoType>(); 3646 if (!FT) 3647 return QualType(); 3648 3649 if (FT->getNumParams() != 1) 3650 return QualType(); 3651 3652 return FT->getParamType(0); 3653 } 3654 3655 // Returns the best absolute value function, or zero, based on type and 3656 // current absolute value function. 3657 static unsigned getBestAbsFunction(ASTContext &Context, QualType ArgType, 3658 unsigned AbsFunctionKind) { 3659 unsigned BestKind = 0; 3660 uint64_t ArgSize = Context.getTypeSize(ArgType); 3661 for (unsigned Kind = AbsFunctionKind; Kind != 0; 3662 Kind = getLargerAbsoluteValueFunction(Kind)) { 3663 QualType ParamType = getAbsoluteValueArgumentType(Context, Kind); 3664 if (Context.getTypeSize(ParamType) >= ArgSize) { 3665 if (BestKind == 0) 3666 BestKind = Kind; 3667 else if (Context.hasSameType(ParamType, ArgType)) { 3668 BestKind = Kind; 3669 break; 3670 } 3671 } 3672 } 3673 return BestKind; 3674 } 3675 3676 enum AbsoluteValueKind { 3677 AVK_Integer, 3678 AVK_Floating, 3679 AVK_Complex 3680 }; 3681 3682 static AbsoluteValueKind getAbsoluteValueKind(QualType T) { 3683 if (T->isIntegralOrEnumerationType()) 3684 return AVK_Integer; 3685 if (T->isRealFloatingType()) 3686 return AVK_Floating; 3687 if (T->isAnyComplexType()) 3688 return AVK_Complex; 3689 3690 llvm_unreachable("Type not integer, floating, or complex"); 3691 } 3692 3693 // Changes the absolute value function to a different type. Preserves whether 3694 // the function is a builtin. 3695 static unsigned changeAbsFunction(unsigned AbsKind, 3696 AbsoluteValueKind ValueKind) { 3697 switch (ValueKind) { 3698 case AVK_Integer: 3699 switch (AbsKind) { 3700 default: 3701 return 0; 3702 case Builtin::BI__builtin_fabsf: 3703 case Builtin::BI__builtin_fabs: 3704 case Builtin::BI__builtin_fabsl: 3705 case Builtin::BI__builtin_cabsf: 3706 case Builtin::BI__builtin_cabs: 3707 case Builtin::BI__builtin_cabsl: 3708 return Builtin::BI__builtin_abs; 3709 case Builtin::BIfabsf: 3710 case Builtin::BIfabs: 3711 case Builtin::BIfabsl: 3712 case Builtin::BIcabsf: 3713 case Builtin::BIcabs: 3714 case Builtin::BIcabsl: 3715 return Builtin::BIabs; 3716 } 3717 case AVK_Floating: 3718 switch (AbsKind) { 3719 default: 3720 return 0; 3721 case Builtin::BI__builtin_abs: 3722 case Builtin::BI__builtin_labs: 3723 case Builtin::BI__builtin_llabs: 3724 case Builtin::BI__builtin_cabsf: 3725 case Builtin::BI__builtin_cabs: 3726 case Builtin::BI__builtin_cabsl: 3727 return Builtin::BI__builtin_fabsf; 3728 case Builtin::BIabs: 3729 case Builtin::BIlabs: 3730 case Builtin::BIllabs: 3731 case Builtin::BIcabsf: 3732 case Builtin::BIcabs: 3733 case Builtin::BIcabsl: 3734 return Builtin::BIfabsf; 3735 } 3736 case AVK_Complex: 3737 switch (AbsKind) { 3738 default: 3739 return 0; 3740 case Builtin::BI__builtin_abs: 3741 case Builtin::BI__builtin_labs: 3742 case Builtin::BI__builtin_llabs: 3743 case Builtin::BI__builtin_fabsf: 3744 case Builtin::BI__builtin_fabs: 3745 case Builtin::BI__builtin_fabsl: 3746 return Builtin::BI__builtin_cabsf; 3747 case Builtin::BIabs: 3748 case Builtin::BIlabs: 3749 case Builtin::BIllabs: 3750 case Builtin::BIfabsf: 3751 case Builtin::BIfabs: 3752 case Builtin::BIfabsl: 3753 return Builtin::BIcabsf; 3754 } 3755 } 3756 llvm_unreachable("Unable to convert function"); 3757 } 3758 3759 static unsigned getAbsoluteValueFunctionKind(const FunctionDecl *FDecl) { 3760 const IdentifierInfo *FnInfo = FDecl->getIdentifier(); 3761 if (!FnInfo) 3762 return 0; 3763 3764 switch (FDecl->getBuiltinID()) { 3765 default: 3766 return 0; 3767 case Builtin::BI__builtin_abs: 3768 case Builtin::BI__builtin_fabs: 3769 case Builtin::BI__builtin_fabsf: 3770 case Builtin::BI__builtin_fabsl: 3771 case Builtin::BI__builtin_labs: 3772 case Builtin::BI__builtin_llabs: 3773 case Builtin::BI__builtin_cabs: 3774 case Builtin::BI__builtin_cabsf: 3775 case Builtin::BI__builtin_cabsl: 3776 case Builtin::BIabs: 3777 case Builtin::BIlabs: 3778 case Builtin::BIllabs: 3779 case Builtin::BIfabs: 3780 case Builtin::BIfabsf: 3781 case Builtin::BIfabsl: 3782 case Builtin::BIcabs: 3783 case Builtin::BIcabsf: 3784 case Builtin::BIcabsl: 3785 return FDecl->getBuiltinID(); 3786 } 3787 llvm_unreachable("Unknown Builtin type"); 3788 } 3789 3790 // If the replacement is valid, emit a note with replacement function. 3791 // Additionally, suggest including the proper header if not already included. 3792 static void emitReplacement(Sema &S, SourceLocation Loc, SourceRange Range, 3793 unsigned AbsKind, QualType ArgType) { 3794 bool EmitHeaderHint = true; 3795 const char *HeaderName = nullptr; 3796 const char *FunctionName = nullptr; 3797 if (S.getLangOpts().CPlusPlus && !ArgType->isAnyComplexType()) { 3798 FunctionName = "std::abs"; 3799 if (ArgType->isIntegralOrEnumerationType()) { 3800 HeaderName = "cstdlib"; 3801 } else if (ArgType->isRealFloatingType()) { 3802 HeaderName = "cmath"; 3803 } else { 3804 llvm_unreachable("Invalid Type"); 3805 } 3806 3807 // Lookup all std::abs 3808 if (NamespaceDecl *Std = S.getStdNamespace()) { 3809 LookupResult R(S, &S.Context.Idents.get("abs"), Loc, Sema::LookupAnyName); 3810 R.suppressDiagnostics(); 3811 S.LookupQualifiedName(R, Std); 3812 3813 for (const auto *I : R) { 3814 const FunctionDecl *FDecl = nullptr; 3815 if (const UsingShadowDecl *UsingD = dyn_cast<UsingShadowDecl>(I)) { 3816 FDecl = dyn_cast<FunctionDecl>(UsingD->getTargetDecl()); 3817 } else { 3818 FDecl = dyn_cast<FunctionDecl>(I); 3819 } 3820 if (!FDecl) 3821 continue; 3822 3823 // Found std::abs(), check that they are the right ones. 3824 if (FDecl->getNumParams() != 1) 3825 continue; 3826 3827 // Check that the parameter type can handle the argument. 3828 QualType ParamType = FDecl->getParamDecl(0)->getType(); 3829 if (getAbsoluteValueKind(ArgType) == getAbsoluteValueKind(ParamType) && 3830 S.Context.getTypeSize(ArgType) <= 3831 S.Context.getTypeSize(ParamType)) { 3832 // Found a function, don't need the header hint. 3833 EmitHeaderHint = false; 3834 break; 3835 } 3836 } 3837 } 3838 } else { 3839 FunctionName = S.Context.BuiltinInfo.GetName(AbsKind); 3840 HeaderName = S.Context.BuiltinInfo.getHeaderName(AbsKind); 3841 3842 if (HeaderName) { 3843 DeclarationName DN(&S.Context.Idents.get(FunctionName)); 3844 LookupResult R(S, DN, Loc, Sema::LookupAnyName); 3845 R.suppressDiagnostics(); 3846 S.LookupName(R, S.getCurScope()); 3847 3848 if (R.isSingleResult()) { 3849 FunctionDecl *FD = dyn_cast<FunctionDecl>(R.getFoundDecl()); 3850 if (FD && FD->getBuiltinID() == AbsKind) { 3851 EmitHeaderHint = false; 3852 } else { 3853 return; 3854 } 3855 } else if (!R.empty()) { 3856 return; 3857 } 3858 } 3859 } 3860 3861 S.Diag(Loc, diag::note_replace_abs_function) 3862 << FunctionName << FixItHint::CreateReplacement(Range, FunctionName); 3863 3864 if (!HeaderName) 3865 return; 3866 3867 if (!EmitHeaderHint) 3868 return; 3869 3870 S.Diag(Loc, diag::note_please_include_header) << HeaderName << FunctionName; 3871 } 3872 3873 static bool IsFunctionStdAbs(const FunctionDecl *FDecl) { 3874 if (!FDecl) 3875 return false; 3876 3877 if (!FDecl->getIdentifier() || !FDecl->getIdentifier()->isStr("abs")) 3878 return false; 3879 3880 const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(FDecl->getDeclContext()); 3881 3882 while (ND && ND->isInlineNamespace()) { 3883 ND = dyn_cast<NamespaceDecl>(ND->getDeclContext()); 3884 } 3885 3886 if (!ND || !ND->getIdentifier() || !ND->getIdentifier()->isStr("std")) 3887 return false; 3888 3889 if (!isa<TranslationUnitDecl>(ND->getDeclContext())) 3890 return false; 3891 3892 return true; 3893 } 3894 3895 // Warn when using the wrong abs() function. 3896 void Sema::CheckAbsoluteValueFunction(const CallExpr *Call, 3897 const FunctionDecl *FDecl, 3898 IdentifierInfo *FnInfo) { 3899 if (Call->getNumArgs() != 1) 3900 return; 3901 3902 unsigned AbsKind = getAbsoluteValueFunctionKind(FDecl); 3903 bool IsStdAbs = IsFunctionStdAbs(FDecl); 3904 if (AbsKind == 0 && !IsStdAbs) 3905 return; 3906 3907 QualType ArgType = Call->getArg(0)->IgnoreParenImpCasts()->getType(); 3908 QualType ParamType = Call->getArg(0)->getType(); 3909 3910 // Unsigned types can not be negative. Suggest to drop the absolute value 3911 // function. 3912 if (ArgType->isUnsignedIntegerType()) { 3913 const char *FunctionName = 3914 IsStdAbs ? "std::abs" : Context.BuiltinInfo.GetName(AbsKind); 3915 Diag(Call->getExprLoc(), diag::warn_unsigned_abs) << ArgType << ParamType; 3916 Diag(Call->getExprLoc(), diag::note_remove_abs) 3917 << FunctionName 3918 << FixItHint::CreateRemoval(Call->getCallee()->getSourceRange()); 3919 return; 3920 } 3921 3922 // std::abs has overloads which prevent most of the absolute value problems 3923 // from occurring. 3924 if (IsStdAbs) 3925 return; 3926 3927 AbsoluteValueKind ArgValueKind = getAbsoluteValueKind(ArgType); 3928 AbsoluteValueKind ParamValueKind = getAbsoluteValueKind(ParamType); 3929 3930 // The argument and parameter are the same kind. Check if they are the right 3931 // size. 3932 if (ArgValueKind == ParamValueKind) { 3933 if (Context.getTypeSize(ArgType) <= Context.getTypeSize(ParamType)) 3934 return; 3935 3936 unsigned NewAbsKind = getBestAbsFunction(Context, ArgType, AbsKind); 3937 Diag(Call->getExprLoc(), diag::warn_abs_too_small) 3938 << FDecl << ArgType << ParamType; 3939 3940 if (NewAbsKind == 0) 3941 return; 3942 3943 emitReplacement(*this, Call->getExprLoc(), 3944 Call->getCallee()->getSourceRange(), NewAbsKind, ArgType); 3945 return; 3946 } 3947 3948 // ArgValueKind != ParamValueKind 3949 // The wrong type of absolute value function was used. Attempt to find the 3950 // proper one. 3951 unsigned NewAbsKind = changeAbsFunction(AbsKind, ArgValueKind); 3952 NewAbsKind = getBestAbsFunction(Context, ArgType, NewAbsKind); 3953 if (NewAbsKind == 0) 3954 return; 3955 3956 Diag(Call->getExprLoc(), diag::warn_wrong_absolute_value_type) 3957 << FDecl << ParamValueKind << ArgValueKind; 3958 3959 emitReplacement(*this, Call->getExprLoc(), 3960 Call->getCallee()->getSourceRange(), NewAbsKind, ArgType); 3961 return; 3962 } 3963 3964 //===--- CHECK: Standard memory functions ---------------------------------===// 3965 3966 /// \brief Takes the expression passed to the size_t parameter of functions 3967 /// such as memcmp, strncat, etc and warns if it's a comparison. 3968 /// 3969 /// This is to catch typos like `if (memcmp(&a, &b, sizeof(a) > 0))`. 3970 static bool CheckMemorySizeofForComparison(Sema &S, const Expr *E, 3971 IdentifierInfo *FnName, 3972 SourceLocation FnLoc, 3973 SourceLocation RParenLoc) { 3974 const BinaryOperator *Size = dyn_cast<BinaryOperator>(E); 3975 if (!Size) 3976 return false; 3977 3978 // if E is binop and op is >, <, >=, <=, ==, &&, ||: 3979 if (!Size->isComparisonOp() && !Size->isEqualityOp() && !Size->isLogicalOp()) 3980 return false; 3981 3982 SourceRange SizeRange = Size->getSourceRange(); 3983 S.Diag(Size->getOperatorLoc(), diag::warn_memsize_comparison) 3984 << SizeRange << FnName; 3985 S.Diag(FnLoc, diag::note_memsize_comparison_paren) 3986 << FnName << FixItHint::CreateInsertion( 3987 S.getLocForEndOfToken(Size->getLHS()->getLocEnd()), ")") 3988 << FixItHint::CreateRemoval(RParenLoc); 3989 S.Diag(SizeRange.getBegin(), diag::note_memsize_comparison_cast_silence) 3990 << FixItHint::CreateInsertion(SizeRange.getBegin(), "(size_t)(") 3991 << FixItHint::CreateInsertion(S.getLocForEndOfToken(SizeRange.getEnd()), 3992 ")"); 3993 3994 return true; 3995 } 3996 3997 /// \brief Determine whether the given type is or contains a dynamic class type 3998 /// (e.g., whether it has a vtable). 3999 static const CXXRecordDecl *getContainedDynamicClass(QualType T, 4000 bool &IsContained) { 4001 // Look through array types while ignoring qualifiers. 4002 const Type *Ty = T->getBaseElementTypeUnsafe(); 4003 IsContained = false; 4004 4005 const CXXRecordDecl *RD = Ty->getAsCXXRecordDecl(); 4006 RD = RD ? RD->getDefinition() : nullptr; 4007 if (!RD) 4008 return nullptr; 4009 4010 if (RD->isDynamicClass()) 4011 return RD; 4012 4013 // Check all the fields. If any bases were dynamic, the class is dynamic. 4014 // It's impossible for a class to transitively contain itself by value, so 4015 // infinite recursion is impossible. 4016 for (auto *FD : RD->fields()) { 4017 bool SubContained; 4018 if (const CXXRecordDecl *ContainedRD = 4019 getContainedDynamicClass(FD->getType(), SubContained)) { 4020 IsContained = true; 4021 return ContainedRD; 4022 } 4023 } 4024 4025 return nullptr; 4026 } 4027 4028 /// \brief If E is a sizeof expression, returns its argument expression, 4029 /// otherwise returns NULL. 4030 static const Expr *getSizeOfExprArg(const Expr* E) { 4031 if (const UnaryExprOrTypeTraitExpr *SizeOf = 4032 dyn_cast<UnaryExprOrTypeTraitExpr>(E)) 4033 if (SizeOf->getKind() == clang::UETT_SizeOf && !SizeOf->isArgumentType()) 4034 return SizeOf->getArgumentExpr()->IgnoreParenImpCasts(); 4035 4036 return nullptr; 4037 } 4038 4039 /// \brief If E is a sizeof expression, returns its argument type. 4040 static QualType getSizeOfArgType(const Expr* E) { 4041 if (const UnaryExprOrTypeTraitExpr *SizeOf = 4042 dyn_cast<UnaryExprOrTypeTraitExpr>(E)) 4043 if (SizeOf->getKind() == clang::UETT_SizeOf) 4044 return SizeOf->getTypeOfArgument(); 4045 4046 return QualType(); 4047 } 4048 4049 /// \brief Check for dangerous or invalid arguments to memset(). 4050 /// 4051 /// This issues warnings on known problematic, dangerous or unspecified 4052 /// arguments to the standard 'memset', 'memcpy', 'memmove', and 'memcmp' 4053 /// function calls. 4054 /// 4055 /// \param Call The call expression to diagnose. 4056 void Sema::CheckMemaccessArguments(const CallExpr *Call, 4057 unsigned BId, 4058 IdentifierInfo *FnName) { 4059 assert(BId != 0); 4060 4061 // It is possible to have a non-standard definition of memset. Validate 4062 // we have enough arguments, and if not, abort further checking. 4063 unsigned ExpectedNumArgs = (BId == Builtin::BIstrndup ? 2 : 3); 4064 if (Call->getNumArgs() < ExpectedNumArgs) 4065 return; 4066 4067 unsigned LastArg = (BId == Builtin::BImemset || 4068 BId == Builtin::BIstrndup ? 1 : 2); 4069 unsigned LenArg = (BId == Builtin::BIstrndup ? 1 : 2); 4070 const Expr *LenExpr = Call->getArg(LenArg)->IgnoreParenImpCasts(); 4071 4072 if (CheckMemorySizeofForComparison(*this, LenExpr, FnName, 4073 Call->getLocStart(), Call->getRParenLoc())) 4074 return; 4075 4076 // We have special checking when the length is a sizeof expression. 4077 QualType SizeOfArgTy = getSizeOfArgType(LenExpr); 4078 const Expr *SizeOfArg = getSizeOfExprArg(LenExpr); 4079 llvm::FoldingSetNodeID SizeOfArgID; 4080 4081 for (unsigned ArgIdx = 0; ArgIdx != LastArg; ++ArgIdx) { 4082 const Expr *Dest = Call->getArg(ArgIdx)->IgnoreParenImpCasts(); 4083 SourceRange ArgRange = Call->getArg(ArgIdx)->getSourceRange(); 4084 4085 QualType DestTy = Dest->getType(); 4086 if (const PointerType *DestPtrTy = DestTy->getAs<PointerType>()) { 4087 QualType PointeeTy = DestPtrTy->getPointeeType(); 4088 4089 // Never warn about void type pointers. This can be used to suppress 4090 // false positives. 4091 if (PointeeTy->isVoidType()) 4092 continue; 4093 4094 // Catch "memset(p, 0, sizeof(p))" -- needs to be sizeof(*p). Do this by 4095 // actually comparing the expressions for equality. Because computing the 4096 // expression IDs can be expensive, we only do this if the diagnostic is 4097 // enabled. 4098 if (SizeOfArg && 4099 !Diags.isIgnored(diag::warn_sizeof_pointer_expr_memaccess, 4100 SizeOfArg->getExprLoc())) { 4101 // We only compute IDs for expressions if the warning is enabled, and 4102 // cache the sizeof arg's ID. 4103 if (SizeOfArgID == llvm::FoldingSetNodeID()) 4104 SizeOfArg->Profile(SizeOfArgID, Context, true); 4105 llvm::FoldingSetNodeID DestID; 4106 Dest->Profile(DestID, Context, true); 4107 if (DestID == SizeOfArgID) { 4108 // TODO: For strncpy() and friends, this could suggest sizeof(dst) 4109 // over sizeof(src) as well. 4110 unsigned ActionIdx = 0; // Default is to suggest dereferencing. 4111 StringRef ReadableName = FnName->getName(); 4112 4113 if (const UnaryOperator *UnaryOp = dyn_cast<UnaryOperator>(Dest)) 4114 if (UnaryOp->getOpcode() == UO_AddrOf) 4115 ActionIdx = 1; // If its an address-of operator, just remove it. 4116 if (!PointeeTy->isIncompleteType() && 4117 (Context.getTypeSize(PointeeTy) == Context.getCharWidth())) 4118 ActionIdx = 2; // If the pointee's size is sizeof(char), 4119 // suggest an explicit length. 4120 4121 // If the function is defined as a builtin macro, do not show macro 4122 // expansion. 4123 SourceLocation SL = SizeOfArg->getExprLoc(); 4124 SourceRange DSR = Dest->getSourceRange(); 4125 SourceRange SSR = SizeOfArg->getSourceRange(); 4126 SourceManager &SM = getSourceManager(); 4127 4128 if (SM.isMacroArgExpansion(SL)) { 4129 ReadableName = Lexer::getImmediateMacroName(SL, SM, LangOpts); 4130 SL = SM.getSpellingLoc(SL); 4131 DSR = SourceRange(SM.getSpellingLoc(DSR.getBegin()), 4132 SM.getSpellingLoc(DSR.getEnd())); 4133 SSR = SourceRange(SM.getSpellingLoc(SSR.getBegin()), 4134 SM.getSpellingLoc(SSR.getEnd())); 4135 } 4136 4137 DiagRuntimeBehavior(SL, SizeOfArg, 4138 PDiag(diag::warn_sizeof_pointer_expr_memaccess) 4139 << ReadableName 4140 << PointeeTy 4141 << DestTy 4142 << DSR 4143 << SSR); 4144 DiagRuntimeBehavior(SL, SizeOfArg, 4145 PDiag(diag::warn_sizeof_pointer_expr_memaccess_note) 4146 << ActionIdx 4147 << SSR); 4148 4149 break; 4150 } 4151 } 4152 4153 // Also check for cases where the sizeof argument is the exact same 4154 // type as the memory argument, and where it points to a user-defined 4155 // record type. 4156 if (SizeOfArgTy != QualType()) { 4157 if (PointeeTy->isRecordType() && 4158 Context.typesAreCompatible(SizeOfArgTy, DestTy)) { 4159 DiagRuntimeBehavior(LenExpr->getExprLoc(), Dest, 4160 PDiag(diag::warn_sizeof_pointer_type_memaccess) 4161 << FnName << SizeOfArgTy << ArgIdx 4162 << PointeeTy << Dest->getSourceRange() 4163 << LenExpr->getSourceRange()); 4164 break; 4165 } 4166 } 4167 4168 // Always complain about dynamic classes. 4169 bool IsContained; 4170 if (const CXXRecordDecl *ContainedRD = 4171 getContainedDynamicClass(PointeeTy, IsContained)) { 4172 4173 unsigned OperationType = 0; 4174 // "overwritten" if we're warning about the destination for any call 4175 // but memcmp; otherwise a verb appropriate to the call. 4176 if (ArgIdx != 0 || BId == Builtin::BImemcmp) { 4177 if (BId == Builtin::BImemcpy) 4178 OperationType = 1; 4179 else if(BId == Builtin::BImemmove) 4180 OperationType = 2; 4181 else if (BId == Builtin::BImemcmp) 4182 OperationType = 3; 4183 } 4184 4185 DiagRuntimeBehavior( 4186 Dest->getExprLoc(), Dest, 4187 PDiag(diag::warn_dyn_class_memaccess) 4188 << (BId == Builtin::BImemcmp ? ArgIdx + 2 : ArgIdx) 4189 << FnName << IsContained << ContainedRD << OperationType 4190 << Call->getCallee()->getSourceRange()); 4191 } else if (PointeeTy.hasNonTrivialObjCLifetime() && 4192 BId != Builtin::BImemset) 4193 DiagRuntimeBehavior( 4194 Dest->getExprLoc(), Dest, 4195 PDiag(diag::warn_arc_object_memaccess) 4196 << ArgIdx << FnName << PointeeTy 4197 << Call->getCallee()->getSourceRange()); 4198 else 4199 continue; 4200 4201 DiagRuntimeBehavior( 4202 Dest->getExprLoc(), Dest, 4203 PDiag(diag::note_bad_memaccess_silence) 4204 << FixItHint::CreateInsertion(ArgRange.getBegin(), "(void*)")); 4205 break; 4206 } 4207 } 4208 } 4209 4210 // A little helper routine: ignore addition and subtraction of integer literals. 4211 // This intentionally does not ignore all integer constant expressions because 4212 // we don't want to remove sizeof(). 4213 static const Expr *ignoreLiteralAdditions(const Expr *Ex, ASTContext &Ctx) { 4214 Ex = Ex->IgnoreParenCasts(); 4215 4216 for (;;) { 4217 const BinaryOperator * BO = dyn_cast<BinaryOperator>(Ex); 4218 if (!BO || !BO->isAdditiveOp()) 4219 break; 4220 4221 const Expr *RHS = BO->getRHS()->IgnoreParenCasts(); 4222 const Expr *LHS = BO->getLHS()->IgnoreParenCasts(); 4223 4224 if (isa<IntegerLiteral>(RHS)) 4225 Ex = LHS; 4226 else if (isa<IntegerLiteral>(LHS)) 4227 Ex = RHS; 4228 else 4229 break; 4230 } 4231 4232 return Ex; 4233 } 4234 4235 static bool isConstantSizeArrayWithMoreThanOneElement(QualType Ty, 4236 ASTContext &Context) { 4237 // Only handle constant-sized or VLAs, but not flexible members. 4238 if (const ConstantArrayType *CAT = Context.getAsConstantArrayType(Ty)) { 4239 // Only issue the FIXIT for arrays of size > 1. 4240 if (CAT->getSize().getSExtValue() <= 1) 4241 return false; 4242 } else if (!Ty->isVariableArrayType()) { 4243 return false; 4244 } 4245 return true; 4246 } 4247 4248 // Warn if the user has made the 'size' argument to strlcpy or strlcat 4249 // be the size of the source, instead of the destination. 4250 void Sema::CheckStrlcpycatArguments(const CallExpr *Call, 4251 IdentifierInfo *FnName) { 4252 4253 // Don't crash if the user has the wrong number of arguments 4254 if (Call->getNumArgs() != 3) 4255 return; 4256 4257 const Expr *SrcArg = ignoreLiteralAdditions(Call->getArg(1), Context); 4258 const Expr *SizeArg = ignoreLiteralAdditions(Call->getArg(2), Context); 4259 const Expr *CompareWithSrc = nullptr; 4260 4261 if (CheckMemorySizeofForComparison(*this, SizeArg, FnName, 4262 Call->getLocStart(), Call->getRParenLoc())) 4263 return; 4264 4265 // Look for 'strlcpy(dst, x, sizeof(x))' 4266 if (const Expr *Ex = getSizeOfExprArg(SizeArg)) 4267 CompareWithSrc = Ex; 4268 else { 4269 // Look for 'strlcpy(dst, x, strlen(x))' 4270 if (const CallExpr *SizeCall = dyn_cast<CallExpr>(SizeArg)) { 4271 if (SizeCall->getBuiltinCallee() == Builtin::BIstrlen && 4272 SizeCall->getNumArgs() == 1) 4273 CompareWithSrc = ignoreLiteralAdditions(SizeCall->getArg(0), Context); 4274 } 4275 } 4276 4277 if (!CompareWithSrc) 4278 return; 4279 4280 // Determine if the argument to sizeof/strlen is equal to the source 4281 // argument. In principle there's all kinds of things you could do 4282 // here, for instance creating an == expression and evaluating it with 4283 // EvaluateAsBooleanCondition, but this uses a more direct technique: 4284 const DeclRefExpr *SrcArgDRE = dyn_cast<DeclRefExpr>(SrcArg); 4285 if (!SrcArgDRE) 4286 return; 4287 4288 const DeclRefExpr *CompareWithSrcDRE = dyn_cast<DeclRefExpr>(CompareWithSrc); 4289 if (!CompareWithSrcDRE || 4290 SrcArgDRE->getDecl() != CompareWithSrcDRE->getDecl()) 4291 return; 4292 4293 const Expr *OriginalSizeArg = Call->getArg(2); 4294 Diag(CompareWithSrcDRE->getLocStart(), diag::warn_strlcpycat_wrong_size) 4295 << OriginalSizeArg->getSourceRange() << FnName; 4296 4297 // Output a FIXIT hint if the destination is an array (rather than a 4298 // pointer to an array). This could be enhanced to handle some 4299 // pointers if we know the actual size, like if DstArg is 'array+2' 4300 // we could say 'sizeof(array)-2'. 4301 const Expr *DstArg = Call->getArg(0)->IgnoreParenImpCasts(); 4302 if (!isConstantSizeArrayWithMoreThanOneElement(DstArg->getType(), Context)) 4303 return; 4304 4305 SmallString<128> sizeString; 4306 llvm::raw_svector_ostream OS(sizeString); 4307 OS << "sizeof("; 4308 DstArg->printPretty(OS, nullptr, getPrintingPolicy()); 4309 OS << ")"; 4310 4311 Diag(OriginalSizeArg->getLocStart(), diag::note_strlcpycat_wrong_size) 4312 << FixItHint::CreateReplacement(OriginalSizeArg->getSourceRange(), 4313 OS.str()); 4314 } 4315 4316 /// Check if two expressions refer to the same declaration. 4317 static bool referToTheSameDecl(const Expr *E1, const Expr *E2) { 4318 if (const DeclRefExpr *D1 = dyn_cast_or_null<DeclRefExpr>(E1)) 4319 if (const DeclRefExpr *D2 = dyn_cast_or_null<DeclRefExpr>(E2)) 4320 return D1->getDecl() == D2->getDecl(); 4321 return false; 4322 } 4323 4324 static const Expr *getStrlenExprArg(const Expr *E) { 4325 if (const CallExpr *CE = dyn_cast<CallExpr>(E)) { 4326 const FunctionDecl *FD = CE->getDirectCallee(); 4327 if (!FD || FD->getMemoryFunctionKind() != Builtin::BIstrlen) 4328 return nullptr; 4329 return CE->getArg(0)->IgnoreParenCasts(); 4330 } 4331 return nullptr; 4332 } 4333 4334 // Warn on anti-patterns as the 'size' argument to strncat. 4335 // The correct size argument should look like following: 4336 // strncat(dst, src, sizeof(dst) - strlen(dest) - 1); 4337 void Sema::CheckStrncatArguments(const CallExpr *CE, 4338 IdentifierInfo *FnName) { 4339 // Don't crash if the user has the wrong number of arguments. 4340 if (CE->getNumArgs() < 3) 4341 return; 4342 const Expr *DstArg = CE->getArg(0)->IgnoreParenCasts(); 4343 const Expr *SrcArg = CE->getArg(1)->IgnoreParenCasts(); 4344 const Expr *LenArg = CE->getArg(2)->IgnoreParenCasts(); 4345 4346 if (CheckMemorySizeofForComparison(*this, LenArg, FnName, CE->getLocStart(), 4347 CE->getRParenLoc())) 4348 return; 4349 4350 // Identify common expressions, which are wrongly used as the size argument 4351 // to strncat and may lead to buffer overflows. 4352 unsigned PatternType = 0; 4353 if (const Expr *SizeOfArg = getSizeOfExprArg(LenArg)) { 4354 // - sizeof(dst) 4355 if (referToTheSameDecl(SizeOfArg, DstArg)) 4356 PatternType = 1; 4357 // - sizeof(src) 4358 else if (referToTheSameDecl(SizeOfArg, SrcArg)) 4359 PatternType = 2; 4360 } else if (const BinaryOperator *BE = dyn_cast<BinaryOperator>(LenArg)) { 4361 if (BE->getOpcode() == BO_Sub) { 4362 const Expr *L = BE->getLHS()->IgnoreParenCasts(); 4363 const Expr *R = BE->getRHS()->IgnoreParenCasts(); 4364 // - sizeof(dst) - strlen(dst) 4365 if (referToTheSameDecl(DstArg, getSizeOfExprArg(L)) && 4366 referToTheSameDecl(DstArg, getStrlenExprArg(R))) 4367 PatternType = 1; 4368 // - sizeof(src) - (anything) 4369 else if (referToTheSameDecl(SrcArg, getSizeOfExprArg(L))) 4370 PatternType = 2; 4371 } 4372 } 4373 4374 if (PatternType == 0) 4375 return; 4376 4377 // Generate the diagnostic. 4378 SourceLocation SL = LenArg->getLocStart(); 4379 SourceRange SR = LenArg->getSourceRange(); 4380 SourceManager &SM = getSourceManager(); 4381 4382 // If the function is defined as a builtin macro, do not show macro expansion. 4383 if (SM.isMacroArgExpansion(SL)) { 4384 SL = SM.getSpellingLoc(SL); 4385 SR = SourceRange(SM.getSpellingLoc(SR.getBegin()), 4386 SM.getSpellingLoc(SR.getEnd())); 4387 } 4388 4389 // Check if the destination is an array (rather than a pointer to an array). 4390 QualType DstTy = DstArg->getType(); 4391 bool isKnownSizeArray = isConstantSizeArrayWithMoreThanOneElement(DstTy, 4392 Context); 4393 if (!isKnownSizeArray) { 4394 if (PatternType == 1) 4395 Diag(SL, diag::warn_strncat_wrong_size) << SR; 4396 else 4397 Diag(SL, diag::warn_strncat_src_size) << SR; 4398 return; 4399 } 4400 4401 if (PatternType == 1) 4402 Diag(SL, diag::warn_strncat_large_size) << SR; 4403 else 4404 Diag(SL, diag::warn_strncat_src_size) << SR; 4405 4406 SmallString<128> sizeString; 4407 llvm::raw_svector_ostream OS(sizeString); 4408 OS << "sizeof("; 4409 DstArg->printPretty(OS, nullptr, getPrintingPolicy()); 4410 OS << ") - "; 4411 OS << "strlen("; 4412 DstArg->printPretty(OS, nullptr, getPrintingPolicy()); 4413 OS << ") - 1"; 4414 4415 Diag(SL, diag::note_strncat_wrong_size) 4416 << FixItHint::CreateReplacement(SR, OS.str()); 4417 } 4418 4419 //===--- CHECK: Return Address of Stack Variable --------------------------===// 4420 4421 static Expr *EvalVal(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars, 4422 Decl *ParentDecl); 4423 static Expr *EvalAddr(Expr* E, SmallVectorImpl<DeclRefExpr *> &refVars, 4424 Decl *ParentDecl); 4425 4426 /// CheckReturnStackAddr - Check if a return statement returns the address 4427 /// of a stack variable. 4428 static void 4429 CheckReturnStackAddr(Sema &S, Expr *RetValExp, QualType lhsType, 4430 SourceLocation ReturnLoc) { 4431 4432 Expr *stackE = nullptr; 4433 SmallVector<DeclRefExpr *, 8> refVars; 4434 4435 // Perform checking for returned stack addresses, local blocks, 4436 // label addresses or references to temporaries. 4437 if (lhsType->isPointerType() || 4438 (!S.getLangOpts().ObjCAutoRefCount && lhsType->isBlockPointerType())) { 4439 stackE = EvalAddr(RetValExp, refVars, /*ParentDecl=*/nullptr); 4440 } else if (lhsType->isReferenceType()) { 4441 stackE = EvalVal(RetValExp, refVars, /*ParentDecl=*/nullptr); 4442 } 4443 4444 if (!stackE) 4445 return; // Nothing suspicious was found. 4446 4447 SourceLocation diagLoc; 4448 SourceRange diagRange; 4449 if (refVars.empty()) { 4450 diagLoc = stackE->getLocStart(); 4451 diagRange = stackE->getSourceRange(); 4452 } else { 4453 // We followed through a reference variable. 'stackE' contains the 4454 // problematic expression but we will warn at the return statement pointing 4455 // at the reference variable. We will later display the "trail" of 4456 // reference variables using notes. 4457 diagLoc = refVars[0]->getLocStart(); 4458 diagRange = refVars[0]->getSourceRange(); 4459 } 4460 4461 if (DeclRefExpr *DR = dyn_cast<DeclRefExpr>(stackE)) { //address of local var. 4462 S.Diag(diagLoc, lhsType->isReferenceType() ? diag::warn_ret_stack_ref 4463 : diag::warn_ret_stack_addr) 4464 << DR->getDecl()->getDeclName() << diagRange; 4465 } else if (isa<BlockExpr>(stackE)) { // local block. 4466 S.Diag(diagLoc, diag::err_ret_local_block) << diagRange; 4467 } else if (isa<AddrLabelExpr>(stackE)) { // address of label. 4468 S.Diag(diagLoc, diag::warn_ret_addr_label) << diagRange; 4469 } else { // local temporary. 4470 S.Diag(diagLoc, lhsType->isReferenceType() ? diag::warn_ret_local_temp_ref 4471 : diag::warn_ret_local_temp_addr) 4472 << diagRange; 4473 } 4474 4475 // Display the "trail" of reference variables that we followed until we 4476 // found the problematic expression using notes. 4477 for (unsigned i = 0, e = refVars.size(); i != e; ++i) { 4478 VarDecl *VD = cast<VarDecl>(refVars[i]->getDecl()); 4479 // If this var binds to another reference var, show the range of the next 4480 // var, otherwise the var binds to the problematic expression, in which case 4481 // show the range of the expression. 4482 SourceRange range = (i < e-1) ? refVars[i+1]->getSourceRange() 4483 : stackE->getSourceRange(); 4484 S.Diag(VD->getLocation(), diag::note_ref_var_local_bind) 4485 << VD->getDeclName() << range; 4486 } 4487 } 4488 4489 /// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that 4490 /// check if the expression in a return statement evaluates to an address 4491 /// to a location on the stack, a local block, an address of a label, or a 4492 /// reference to local temporary. The recursion is used to traverse the 4493 /// AST of the return expression, with recursion backtracking when we 4494 /// encounter a subexpression that (1) clearly does not lead to one of the 4495 /// above problematic expressions (2) is something we cannot determine leads to 4496 /// a problematic expression based on such local checking. 4497 /// 4498 /// Both EvalAddr and EvalVal follow through reference variables to evaluate 4499 /// the expression that they point to. Such variables are added to the 4500 /// 'refVars' vector so that we know what the reference variable "trail" was. 4501 /// 4502 /// EvalAddr processes expressions that are pointers that are used as 4503 /// references (and not L-values). EvalVal handles all other values. 4504 /// At the base case of the recursion is a check for the above problematic 4505 /// expressions. 4506 /// 4507 /// This implementation handles: 4508 /// 4509 /// * pointer-to-pointer casts 4510 /// * implicit conversions from array references to pointers 4511 /// * taking the address of fields 4512 /// * arbitrary interplay between "&" and "*" operators 4513 /// * pointer arithmetic from an address of a stack variable 4514 /// * taking the address of an array element where the array is on the stack 4515 static Expr *EvalAddr(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars, 4516 Decl *ParentDecl) { 4517 if (E->isTypeDependent()) 4518 return nullptr; 4519 4520 // We should only be called for evaluating pointer expressions. 4521 assert((E->getType()->isAnyPointerType() || 4522 E->getType()->isBlockPointerType() || 4523 E->getType()->isObjCQualifiedIdType()) && 4524 "EvalAddr only works on pointers"); 4525 4526 E = E->IgnoreParens(); 4527 4528 // Our "symbolic interpreter" is just a dispatch off the currently 4529 // viewed AST node. We then recursively traverse the AST by calling 4530 // EvalAddr and EvalVal appropriately. 4531 switch (E->getStmtClass()) { 4532 case Stmt::DeclRefExprClass: { 4533 DeclRefExpr *DR = cast<DeclRefExpr>(E); 4534 4535 // If we leave the immediate function, the lifetime isn't about to end. 4536 if (DR->refersToEnclosingLocal()) 4537 return nullptr; 4538 4539 if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl())) 4540 // If this is a reference variable, follow through to the expression that 4541 // it points to. 4542 if (V->hasLocalStorage() && 4543 V->getType()->isReferenceType() && V->hasInit()) { 4544 // Add the reference variable to the "trail". 4545 refVars.push_back(DR); 4546 return EvalAddr(V->getInit(), refVars, ParentDecl); 4547 } 4548 4549 return nullptr; 4550 } 4551 4552 case Stmt::UnaryOperatorClass: { 4553 // The only unary operator that make sense to handle here 4554 // is AddrOf. All others don't make sense as pointers. 4555 UnaryOperator *U = cast<UnaryOperator>(E); 4556 4557 if (U->getOpcode() == UO_AddrOf) 4558 return EvalVal(U->getSubExpr(), refVars, ParentDecl); 4559 else 4560 return nullptr; 4561 } 4562 4563 case Stmt::BinaryOperatorClass: { 4564 // Handle pointer arithmetic. All other binary operators are not valid 4565 // in this context. 4566 BinaryOperator *B = cast<BinaryOperator>(E); 4567 BinaryOperatorKind op = B->getOpcode(); 4568 4569 if (op != BO_Add && op != BO_Sub) 4570 return nullptr; 4571 4572 Expr *Base = B->getLHS(); 4573 4574 // Determine which argument is the real pointer base. It could be 4575 // the RHS argument instead of the LHS. 4576 if (!Base->getType()->isPointerType()) Base = B->getRHS(); 4577 4578 assert (Base->getType()->isPointerType()); 4579 return EvalAddr(Base, refVars, ParentDecl); 4580 } 4581 4582 // For conditional operators we need to see if either the LHS or RHS are 4583 // valid DeclRefExpr*s. If one of them is valid, we return it. 4584 case Stmt::ConditionalOperatorClass: { 4585 ConditionalOperator *C = cast<ConditionalOperator>(E); 4586 4587 // Handle the GNU extension for missing LHS. 4588 // FIXME: That isn't a ConditionalOperator, so doesn't get here. 4589 if (Expr *LHSExpr = C->getLHS()) { 4590 // In C++, we can have a throw-expression, which has 'void' type. 4591 if (!LHSExpr->getType()->isVoidType()) 4592 if (Expr *LHS = EvalAddr(LHSExpr, refVars, ParentDecl)) 4593 return LHS; 4594 } 4595 4596 // In C++, we can have a throw-expression, which has 'void' type. 4597 if (C->getRHS()->getType()->isVoidType()) 4598 return nullptr; 4599 4600 return EvalAddr(C->getRHS(), refVars, ParentDecl); 4601 } 4602 4603 case Stmt::BlockExprClass: 4604 if (cast<BlockExpr>(E)->getBlockDecl()->hasCaptures()) 4605 return E; // local block. 4606 return nullptr; 4607 4608 case Stmt::AddrLabelExprClass: 4609 return E; // address of label. 4610 4611 case Stmt::ExprWithCleanupsClass: 4612 return EvalAddr(cast<ExprWithCleanups>(E)->getSubExpr(), refVars, 4613 ParentDecl); 4614 4615 // For casts, we need to handle conversions from arrays to 4616 // pointer values, and pointer-to-pointer conversions. 4617 case Stmt::ImplicitCastExprClass: 4618 case Stmt::CStyleCastExprClass: 4619 case Stmt::CXXFunctionalCastExprClass: 4620 case Stmt::ObjCBridgedCastExprClass: 4621 case Stmt::CXXStaticCastExprClass: 4622 case Stmt::CXXDynamicCastExprClass: 4623 case Stmt::CXXConstCastExprClass: 4624 case Stmt::CXXReinterpretCastExprClass: { 4625 Expr* SubExpr = cast<CastExpr>(E)->getSubExpr(); 4626 switch (cast<CastExpr>(E)->getCastKind()) { 4627 case CK_LValueToRValue: 4628 case CK_NoOp: 4629 case CK_BaseToDerived: 4630 case CK_DerivedToBase: 4631 case CK_UncheckedDerivedToBase: 4632 case CK_Dynamic: 4633 case CK_CPointerToObjCPointerCast: 4634 case CK_BlockPointerToObjCPointerCast: 4635 case CK_AnyPointerToBlockPointerCast: 4636 return EvalAddr(SubExpr, refVars, ParentDecl); 4637 4638 case CK_ArrayToPointerDecay: 4639 return EvalVal(SubExpr, refVars, ParentDecl); 4640 4641 case CK_BitCast: 4642 if (SubExpr->getType()->isAnyPointerType() || 4643 SubExpr->getType()->isBlockPointerType() || 4644 SubExpr->getType()->isObjCQualifiedIdType()) 4645 return EvalAddr(SubExpr, refVars, ParentDecl); 4646 else 4647 return nullptr; 4648 4649 default: 4650 return nullptr; 4651 } 4652 } 4653 4654 case Stmt::MaterializeTemporaryExprClass: 4655 if (Expr *Result = EvalAddr( 4656 cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr(), 4657 refVars, ParentDecl)) 4658 return Result; 4659 4660 return E; 4661 4662 // Everything else: we simply don't reason about them. 4663 default: 4664 return nullptr; 4665 } 4666 } 4667 4668 4669 /// EvalVal - This function is complements EvalAddr in the mutual recursion. 4670 /// See the comments for EvalAddr for more details. 4671 static Expr *EvalVal(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars, 4672 Decl *ParentDecl) { 4673 do { 4674 // We should only be called for evaluating non-pointer expressions, or 4675 // expressions with a pointer type that are not used as references but instead 4676 // are l-values (e.g., DeclRefExpr with a pointer type). 4677 4678 // Our "symbolic interpreter" is just a dispatch off the currently 4679 // viewed AST node. We then recursively traverse the AST by calling 4680 // EvalAddr and EvalVal appropriately. 4681 4682 E = E->IgnoreParens(); 4683 switch (E->getStmtClass()) { 4684 case Stmt::ImplicitCastExprClass: { 4685 ImplicitCastExpr *IE = cast<ImplicitCastExpr>(E); 4686 if (IE->getValueKind() == VK_LValue) { 4687 E = IE->getSubExpr(); 4688 continue; 4689 } 4690 return nullptr; 4691 } 4692 4693 case Stmt::ExprWithCleanupsClass: 4694 return EvalVal(cast<ExprWithCleanups>(E)->getSubExpr(), refVars,ParentDecl); 4695 4696 case Stmt::DeclRefExprClass: { 4697 // When we hit a DeclRefExpr we are looking at code that refers to a 4698 // variable's name. If it's not a reference variable we check if it has 4699 // local storage within the function, and if so, return the expression. 4700 DeclRefExpr *DR = cast<DeclRefExpr>(E); 4701 4702 // If we leave the immediate function, the lifetime isn't about to end. 4703 if (DR->refersToEnclosingLocal()) 4704 return nullptr; 4705 4706 if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl())) { 4707 // Check if it refers to itself, e.g. "int& i = i;". 4708 if (V == ParentDecl) 4709 return DR; 4710 4711 if (V->hasLocalStorage()) { 4712 if (!V->getType()->isReferenceType()) 4713 return DR; 4714 4715 // Reference variable, follow through to the expression that 4716 // it points to. 4717 if (V->hasInit()) { 4718 // Add the reference variable to the "trail". 4719 refVars.push_back(DR); 4720 return EvalVal(V->getInit(), refVars, V); 4721 } 4722 } 4723 } 4724 4725 return nullptr; 4726 } 4727 4728 case Stmt::UnaryOperatorClass: { 4729 // The only unary operator that make sense to handle here 4730 // is Deref. All others don't resolve to a "name." This includes 4731 // handling all sorts of rvalues passed to a unary operator. 4732 UnaryOperator *U = cast<UnaryOperator>(E); 4733 4734 if (U->getOpcode() == UO_Deref) 4735 return EvalAddr(U->getSubExpr(), refVars, ParentDecl); 4736 4737 return nullptr; 4738 } 4739 4740 case Stmt::ArraySubscriptExprClass: { 4741 // Array subscripts are potential references to data on the stack. We 4742 // retrieve the DeclRefExpr* for the array variable if it indeed 4743 // has local storage. 4744 return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase(), refVars,ParentDecl); 4745 } 4746 4747 case Stmt::ConditionalOperatorClass: { 4748 // For conditional operators we need to see if either the LHS or RHS are 4749 // non-NULL Expr's. If one is non-NULL, we return it. 4750 ConditionalOperator *C = cast<ConditionalOperator>(E); 4751 4752 // Handle the GNU extension for missing LHS. 4753 if (Expr *LHSExpr = C->getLHS()) { 4754 // In C++, we can have a throw-expression, which has 'void' type. 4755 if (!LHSExpr->getType()->isVoidType()) 4756 if (Expr *LHS = EvalVal(LHSExpr, refVars, ParentDecl)) 4757 return LHS; 4758 } 4759 4760 // In C++, we can have a throw-expression, which has 'void' type. 4761 if (C->getRHS()->getType()->isVoidType()) 4762 return nullptr; 4763 4764 return EvalVal(C->getRHS(), refVars, ParentDecl); 4765 } 4766 4767 // Accesses to members are potential references to data on the stack. 4768 case Stmt::MemberExprClass: { 4769 MemberExpr *M = cast<MemberExpr>(E); 4770 4771 // Check for indirect access. We only want direct field accesses. 4772 if (M->isArrow()) 4773 return nullptr; 4774 4775 // Check whether the member type is itself a reference, in which case 4776 // we're not going to refer to the member, but to what the member refers to. 4777 if (M->getMemberDecl()->getType()->isReferenceType()) 4778 return nullptr; 4779 4780 return EvalVal(M->getBase(), refVars, ParentDecl); 4781 } 4782 4783 case Stmt::MaterializeTemporaryExprClass: 4784 if (Expr *Result = EvalVal( 4785 cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr(), 4786 refVars, ParentDecl)) 4787 return Result; 4788 4789 return E; 4790 4791 default: 4792 // Check that we don't return or take the address of a reference to a 4793 // temporary. This is only useful in C++. 4794 if (!E->isTypeDependent() && E->isRValue()) 4795 return E; 4796 4797 // Everything else: we simply don't reason about them. 4798 return nullptr; 4799 } 4800 } while (true); 4801 } 4802 4803 void 4804 Sema::CheckReturnValExpr(Expr *RetValExp, QualType lhsType, 4805 SourceLocation ReturnLoc, 4806 bool isObjCMethod, 4807 const AttrVec *Attrs, 4808 const FunctionDecl *FD) { 4809 CheckReturnStackAddr(*this, RetValExp, lhsType, ReturnLoc); 4810 4811 // Check if the return value is null but should not be. 4812 if (Attrs && hasSpecificAttr<ReturnsNonNullAttr>(*Attrs) && 4813 CheckNonNullExpr(*this, RetValExp)) 4814 Diag(ReturnLoc, diag::warn_null_ret) 4815 << (isObjCMethod ? 1 : 0) << RetValExp->getSourceRange(); 4816 4817 // C++11 [basic.stc.dynamic.allocation]p4: 4818 // If an allocation function declared with a non-throwing 4819 // exception-specification fails to allocate storage, it shall return 4820 // a null pointer. Any other allocation function that fails to allocate 4821 // storage shall indicate failure only by throwing an exception [...] 4822 if (FD) { 4823 OverloadedOperatorKind Op = FD->getOverloadedOperator(); 4824 if (Op == OO_New || Op == OO_Array_New) { 4825 const FunctionProtoType *Proto 4826 = FD->getType()->castAs<FunctionProtoType>(); 4827 if (!Proto->isNothrow(Context, /*ResultIfDependent*/true) && 4828 CheckNonNullExpr(*this, RetValExp)) 4829 Diag(ReturnLoc, diag::warn_operator_new_returns_null) 4830 << FD << getLangOpts().CPlusPlus11; 4831 } 4832 } 4833 } 4834 4835 //===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===// 4836 4837 /// Check for comparisons of floating point operands using != and ==. 4838 /// Issue a warning if these are no self-comparisons, as they are not likely 4839 /// to do what the programmer intended. 4840 void Sema::CheckFloatComparison(SourceLocation Loc, Expr* LHS, Expr *RHS) { 4841 Expr* LeftExprSansParen = LHS->IgnoreParenImpCasts(); 4842 Expr* RightExprSansParen = RHS->IgnoreParenImpCasts(); 4843 4844 // Special case: check for x == x (which is OK). 4845 // Do not emit warnings for such cases. 4846 if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen)) 4847 if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen)) 4848 if (DRL->getDecl() == DRR->getDecl()) 4849 return; 4850 4851 4852 // Special case: check for comparisons against literals that can be exactly 4853 // represented by APFloat. In such cases, do not emit a warning. This 4854 // is a heuristic: often comparison against such literals are used to 4855 // detect if a value in a variable has not changed. This clearly can 4856 // lead to false negatives. 4857 if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) { 4858 if (FLL->isExact()) 4859 return; 4860 } else 4861 if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)) 4862 if (FLR->isExact()) 4863 return; 4864 4865 // Check for comparisons with builtin types. 4866 if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen)) 4867 if (CL->getBuiltinCallee()) 4868 return; 4869 4870 if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen)) 4871 if (CR->getBuiltinCallee()) 4872 return; 4873 4874 // Emit the diagnostic. 4875 Diag(Loc, diag::warn_floatingpoint_eq) 4876 << LHS->getSourceRange() << RHS->getSourceRange(); 4877 } 4878 4879 //===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===// 4880 //===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===// 4881 4882 namespace { 4883 4884 /// Structure recording the 'active' range of an integer-valued 4885 /// expression. 4886 struct IntRange { 4887 /// The number of bits active in the int. 4888 unsigned Width; 4889 4890 /// True if the int is known not to have negative values. 4891 bool NonNegative; 4892 4893 IntRange(unsigned Width, bool NonNegative) 4894 : Width(Width), NonNegative(NonNegative) 4895 {} 4896 4897 /// Returns the range of the bool type. 4898 static IntRange forBoolType() { 4899 return IntRange(1, true); 4900 } 4901 4902 /// Returns the range of an opaque value of the given integral type. 4903 static IntRange forValueOfType(ASTContext &C, QualType T) { 4904 return forValueOfCanonicalType(C, 4905 T->getCanonicalTypeInternal().getTypePtr()); 4906 } 4907 4908 /// Returns the range of an opaque value of a canonical integral type. 4909 static IntRange forValueOfCanonicalType(ASTContext &C, const Type *T) { 4910 assert(T->isCanonicalUnqualified()); 4911 4912 if (const VectorType *VT = dyn_cast<VectorType>(T)) 4913 T = VT->getElementType().getTypePtr(); 4914 if (const ComplexType *CT = dyn_cast<ComplexType>(T)) 4915 T = CT->getElementType().getTypePtr(); 4916 4917 // For enum types, use the known bit width of the enumerators. 4918 if (const EnumType *ET = dyn_cast<EnumType>(T)) { 4919 EnumDecl *Enum = ET->getDecl(); 4920 if (!Enum->isCompleteDefinition()) 4921 return IntRange(C.getIntWidth(QualType(T, 0)), false); 4922 4923 unsigned NumPositive = Enum->getNumPositiveBits(); 4924 unsigned NumNegative = Enum->getNumNegativeBits(); 4925 4926 if (NumNegative == 0) 4927 return IntRange(NumPositive, true/*NonNegative*/); 4928 else 4929 return IntRange(std::max(NumPositive + 1, NumNegative), 4930 false/*NonNegative*/); 4931 } 4932 4933 const BuiltinType *BT = cast<BuiltinType>(T); 4934 assert(BT->isInteger()); 4935 4936 return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger()); 4937 } 4938 4939 /// Returns the "target" range of a canonical integral type, i.e. 4940 /// the range of values expressible in the type. 4941 /// 4942 /// This matches forValueOfCanonicalType except that enums have the 4943 /// full range of their type, not the range of their enumerators. 4944 static IntRange forTargetOfCanonicalType(ASTContext &C, const Type *T) { 4945 assert(T->isCanonicalUnqualified()); 4946 4947 if (const VectorType *VT = dyn_cast<VectorType>(T)) 4948 T = VT->getElementType().getTypePtr(); 4949 if (const ComplexType *CT = dyn_cast<ComplexType>(T)) 4950 T = CT->getElementType().getTypePtr(); 4951 if (const EnumType *ET = dyn_cast<EnumType>(T)) 4952 T = C.getCanonicalType(ET->getDecl()->getIntegerType()).getTypePtr(); 4953 4954 const BuiltinType *BT = cast<BuiltinType>(T); 4955 assert(BT->isInteger()); 4956 4957 return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger()); 4958 } 4959 4960 /// Returns the supremum of two ranges: i.e. their conservative merge. 4961 static IntRange join(IntRange L, IntRange R) { 4962 return IntRange(std::max(L.Width, R.Width), 4963 L.NonNegative && R.NonNegative); 4964 } 4965 4966 /// Returns the infinum of two ranges: i.e. their aggressive merge. 4967 static IntRange meet(IntRange L, IntRange R) { 4968 return IntRange(std::min(L.Width, R.Width), 4969 L.NonNegative || R.NonNegative); 4970 } 4971 }; 4972 4973 static IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, 4974 unsigned MaxWidth) { 4975 if (value.isSigned() && value.isNegative()) 4976 return IntRange(value.getMinSignedBits(), false); 4977 4978 if (value.getBitWidth() > MaxWidth) 4979 value = value.trunc(MaxWidth); 4980 4981 // isNonNegative() just checks the sign bit without considering 4982 // signedness. 4983 return IntRange(value.getActiveBits(), true); 4984 } 4985 4986 static IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty, 4987 unsigned MaxWidth) { 4988 if (result.isInt()) 4989 return GetValueRange(C, result.getInt(), MaxWidth); 4990 4991 if (result.isVector()) { 4992 IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth); 4993 for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) { 4994 IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth); 4995 R = IntRange::join(R, El); 4996 } 4997 return R; 4998 } 4999 5000 if (result.isComplexInt()) { 5001 IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth); 5002 IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth); 5003 return IntRange::join(R, I); 5004 } 5005 5006 // This can happen with lossless casts to intptr_t of "based" lvalues. 5007 // Assume it might use arbitrary bits. 5008 // FIXME: The only reason we need to pass the type in here is to get 5009 // the sign right on this one case. It would be nice if APValue 5010 // preserved this. 5011 assert(result.isLValue() || result.isAddrLabelDiff()); 5012 return IntRange(MaxWidth, Ty->isUnsignedIntegerOrEnumerationType()); 5013 } 5014 5015 static QualType GetExprType(Expr *E) { 5016 QualType Ty = E->getType(); 5017 if (const AtomicType *AtomicRHS = Ty->getAs<AtomicType>()) 5018 Ty = AtomicRHS->getValueType(); 5019 return Ty; 5020 } 5021 5022 /// Pseudo-evaluate the given integer expression, estimating the 5023 /// range of values it might take. 5024 /// 5025 /// \param MaxWidth - the width to which the value will be truncated 5026 static IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) { 5027 E = E->IgnoreParens(); 5028 5029 // Try a full evaluation first. 5030 Expr::EvalResult result; 5031 if (E->EvaluateAsRValue(result, C)) 5032 return GetValueRange(C, result.Val, GetExprType(E), MaxWidth); 5033 5034 // I think we only want to look through implicit casts here; if the 5035 // user has an explicit widening cast, we should treat the value as 5036 // being of the new, wider type. 5037 if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) { 5038 if (CE->getCastKind() == CK_NoOp || CE->getCastKind() == CK_LValueToRValue) 5039 return GetExprRange(C, CE->getSubExpr(), MaxWidth); 5040 5041 IntRange OutputTypeRange = IntRange::forValueOfType(C, GetExprType(CE)); 5042 5043 bool isIntegerCast = (CE->getCastKind() == CK_IntegralCast); 5044 5045 // Assume that non-integer casts can span the full range of the type. 5046 if (!isIntegerCast) 5047 return OutputTypeRange; 5048 5049 IntRange SubRange 5050 = GetExprRange(C, CE->getSubExpr(), 5051 std::min(MaxWidth, OutputTypeRange.Width)); 5052 5053 // Bail out if the subexpr's range is as wide as the cast type. 5054 if (SubRange.Width >= OutputTypeRange.Width) 5055 return OutputTypeRange; 5056 5057 // Otherwise, we take the smaller width, and we're non-negative if 5058 // either the output type or the subexpr is. 5059 return IntRange(SubRange.Width, 5060 SubRange.NonNegative || OutputTypeRange.NonNegative); 5061 } 5062 5063 if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) { 5064 // If we can fold the condition, just take that operand. 5065 bool CondResult; 5066 if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C)) 5067 return GetExprRange(C, CondResult ? CO->getTrueExpr() 5068 : CO->getFalseExpr(), 5069 MaxWidth); 5070 5071 // Otherwise, conservatively merge. 5072 IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth); 5073 IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth); 5074 return IntRange::join(L, R); 5075 } 5076 5077 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) { 5078 switch (BO->getOpcode()) { 5079 5080 // Boolean-valued operations are single-bit and positive. 5081 case BO_LAnd: 5082 case BO_LOr: 5083 case BO_LT: 5084 case BO_GT: 5085 case BO_LE: 5086 case BO_GE: 5087 case BO_EQ: 5088 case BO_NE: 5089 return IntRange::forBoolType(); 5090 5091 // The type of the assignments is the type of the LHS, so the RHS 5092 // is not necessarily the same type. 5093 case BO_MulAssign: 5094 case BO_DivAssign: 5095 case BO_RemAssign: 5096 case BO_AddAssign: 5097 case BO_SubAssign: 5098 case BO_XorAssign: 5099 case BO_OrAssign: 5100 // TODO: bitfields? 5101 return IntRange::forValueOfType(C, GetExprType(E)); 5102 5103 // Simple assignments just pass through the RHS, which will have 5104 // been coerced to the LHS type. 5105 case BO_Assign: 5106 // TODO: bitfields? 5107 return GetExprRange(C, BO->getRHS(), MaxWidth); 5108 5109 // Operations with opaque sources are black-listed. 5110 case BO_PtrMemD: 5111 case BO_PtrMemI: 5112 return IntRange::forValueOfType(C, GetExprType(E)); 5113 5114 // Bitwise-and uses the *infinum* of the two source ranges. 5115 case BO_And: 5116 case BO_AndAssign: 5117 return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth), 5118 GetExprRange(C, BO->getRHS(), MaxWidth)); 5119 5120 // Left shift gets black-listed based on a judgement call. 5121 case BO_Shl: 5122 // ...except that we want to treat '1 << (blah)' as logically 5123 // positive. It's an important idiom. 5124 if (IntegerLiteral *I 5125 = dyn_cast<IntegerLiteral>(BO->getLHS()->IgnoreParenCasts())) { 5126 if (I->getValue() == 1) { 5127 IntRange R = IntRange::forValueOfType(C, GetExprType(E)); 5128 return IntRange(R.Width, /*NonNegative*/ true); 5129 } 5130 } 5131 // fallthrough 5132 5133 case BO_ShlAssign: 5134 return IntRange::forValueOfType(C, GetExprType(E)); 5135 5136 // Right shift by a constant can narrow its left argument. 5137 case BO_Shr: 5138 case BO_ShrAssign: { 5139 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth); 5140 5141 // If the shift amount is a positive constant, drop the width by 5142 // that much. 5143 llvm::APSInt shift; 5144 if (BO->getRHS()->isIntegerConstantExpr(shift, C) && 5145 shift.isNonNegative()) { 5146 unsigned zext = shift.getZExtValue(); 5147 if (zext >= L.Width) 5148 L.Width = (L.NonNegative ? 0 : 1); 5149 else 5150 L.Width -= zext; 5151 } 5152 5153 return L; 5154 } 5155 5156 // Comma acts as its right operand. 5157 case BO_Comma: 5158 return GetExprRange(C, BO->getRHS(), MaxWidth); 5159 5160 // Black-list pointer subtractions. 5161 case BO_Sub: 5162 if (BO->getLHS()->getType()->isPointerType()) 5163 return IntRange::forValueOfType(C, GetExprType(E)); 5164 break; 5165 5166 // The width of a division result is mostly determined by the size 5167 // of the LHS. 5168 case BO_Div: { 5169 // Don't 'pre-truncate' the operands. 5170 unsigned opWidth = C.getIntWidth(GetExprType(E)); 5171 IntRange L = GetExprRange(C, BO->getLHS(), opWidth); 5172 5173 // If the divisor is constant, use that. 5174 llvm::APSInt divisor; 5175 if (BO->getRHS()->isIntegerConstantExpr(divisor, C)) { 5176 unsigned log2 = divisor.logBase2(); // floor(log_2(divisor)) 5177 if (log2 >= L.Width) 5178 L.Width = (L.NonNegative ? 0 : 1); 5179 else 5180 L.Width = std::min(L.Width - log2, MaxWidth); 5181 return L; 5182 } 5183 5184 // Otherwise, just use the LHS's width. 5185 IntRange R = GetExprRange(C, BO->getRHS(), opWidth); 5186 return IntRange(L.Width, L.NonNegative && R.NonNegative); 5187 } 5188 5189 // The result of a remainder can't be larger than the result of 5190 // either side. 5191 case BO_Rem: { 5192 // Don't 'pre-truncate' the operands. 5193 unsigned opWidth = C.getIntWidth(GetExprType(E)); 5194 IntRange L = GetExprRange(C, BO->getLHS(), opWidth); 5195 IntRange R = GetExprRange(C, BO->getRHS(), opWidth); 5196 5197 IntRange meet = IntRange::meet(L, R); 5198 meet.Width = std::min(meet.Width, MaxWidth); 5199 return meet; 5200 } 5201 5202 // The default behavior is okay for these. 5203 case BO_Mul: 5204 case BO_Add: 5205 case BO_Xor: 5206 case BO_Or: 5207 break; 5208 } 5209 5210 // The default case is to treat the operation as if it were closed 5211 // on the narrowest type that encompasses both operands. 5212 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth); 5213 IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth); 5214 return IntRange::join(L, R); 5215 } 5216 5217 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) { 5218 switch (UO->getOpcode()) { 5219 // Boolean-valued operations are white-listed. 5220 case UO_LNot: 5221 return IntRange::forBoolType(); 5222 5223 // Operations with opaque sources are black-listed. 5224 case UO_Deref: 5225 case UO_AddrOf: // should be impossible 5226 return IntRange::forValueOfType(C, GetExprType(E)); 5227 5228 default: 5229 return GetExprRange(C, UO->getSubExpr(), MaxWidth); 5230 } 5231 } 5232 5233 if (OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) 5234 return GetExprRange(C, OVE->getSourceExpr(), MaxWidth); 5235 5236 if (FieldDecl *BitField = E->getSourceBitField()) 5237 return IntRange(BitField->getBitWidthValue(C), 5238 BitField->getType()->isUnsignedIntegerOrEnumerationType()); 5239 5240 return IntRange::forValueOfType(C, GetExprType(E)); 5241 } 5242 5243 static IntRange GetExprRange(ASTContext &C, Expr *E) { 5244 return GetExprRange(C, E, C.getIntWidth(GetExprType(E))); 5245 } 5246 5247 /// Checks whether the given value, which currently has the given 5248 /// source semantics, has the same value when coerced through the 5249 /// target semantics. 5250 static bool IsSameFloatAfterCast(const llvm::APFloat &value, 5251 const llvm::fltSemantics &Src, 5252 const llvm::fltSemantics &Tgt) { 5253 llvm::APFloat truncated = value; 5254 5255 bool ignored; 5256 truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored); 5257 truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored); 5258 5259 return truncated.bitwiseIsEqual(value); 5260 } 5261 5262 /// Checks whether the given value, which currently has the given 5263 /// source semantics, has the same value when coerced through the 5264 /// target semantics. 5265 /// 5266 /// The value might be a vector of floats (or a complex number). 5267 static bool IsSameFloatAfterCast(const APValue &value, 5268 const llvm::fltSemantics &Src, 5269 const llvm::fltSemantics &Tgt) { 5270 if (value.isFloat()) 5271 return IsSameFloatAfterCast(value.getFloat(), Src, Tgt); 5272 5273 if (value.isVector()) { 5274 for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i) 5275 if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt)) 5276 return false; 5277 return true; 5278 } 5279 5280 assert(value.isComplexFloat()); 5281 return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) && 5282 IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt)); 5283 } 5284 5285 static void AnalyzeImplicitConversions(Sema &S, Expr *E, SourceLocation CC); 5286 5287 static bool IsZero(Sema &S, Expr *E) { 5288 // Suppress cases where we are comparing against an enum constant. 5289 if (const DeclRefExpr *DR = 5290 dyn_cast<DeclRefExpr>(E->IgnoreParenImpCasts())) 5291 if (isa<EnumConstantDecl>(DR->getDecl())) 5292 return false; 5293 5294 // Suppress cases where the '0' value is expanded from a macro. 5295 if (E->getLocStart().isMacroID()) 5296 return false; 5297 5298 llvm::APSInt Value; 5299 return E->isIntegerConstantExpr(Value, S.Context) && Value == 0; 5300 } 5301 5302 static bool HasEnumType(Expr *E) { 5303 // Strip off implicit integral promotions. 5304 while (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(E)) { 5305 if (ICE->getCastKind() != CK_IntegralCast && 5306 ICE->getCastKind() != CK_NoOp) 5307 break; 5308 E = ICE->getSubExpr(); 5309 } 5310 5311 return E->getType()->isEnumeralType(); 5312 } 5313 5314 static void CheckTrivialUnsignedComparison(Sema &S, BinaryOperator *E) { 5315 // Disable warning in template instantiations. 5316 if (!S.ActiveTemplateInstantiations.empty()) 5317 return; 5318 5319 BinaryOperatorKind op = E->getOpcode(); 5320 if (E->isValueDependent()) 5321 return; 5322 5323 if (op == BO_LT && IsZero(S, E->getRHS())) { 5324 S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison) 5325 << "< 0" << "false" << HasEnumType(E->getLHS()) 5326 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange(); 5327 } else if (op == BO_GE && IsZero(S, E->getRHS())) { 5328 S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison) 5329 << ">= 0" << "true" << HasEnumType(E->getLHS()) 5330 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange(); 5331 } else if (op == BO_GT && IsZero(S, E->getLHS())) { 5332 S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison) 5333 << "0 >" << "false" << HasEnumType(E->getRHS()) 5334 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange(); 5335 } else if (op == BO_LE && IsZero(S, E->getLHS())) { 5336 S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison) 5337 << "0 <=" << "true" << HasEnumType(E->getRHS()) 5338 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange(); 5339 } 5340 } 5341 5342 static void DiagnoseOutOfRangeComparison(Sema &S, BinaryOperator *E, 5343 Expr *Constant, Expr *Other, 5344 llvm::APSInt Value, 5345 bool RhsConstant) { 5346 // Disable warning in template instantiations. 5347 if (!S.ActiveTemplateInstantiations.empty()) 5348 return; 5349 5350 // TODO: Investigate using GetExprRange() to get tighter bounds 5351 // on the bit ranges. 5352 QualType OtherT = Other->getType(); 5353 IntRange OtherRange = IntRange::forValueOfType(S.Context, OtherT); 5354 unsigned OtherWidth = OtherRange.Width; 5355 5356 bool OtherIsBooleanType = Other->isKnownToHaveBooleanValue(); 5357 5358 // 0 values are handled later by CheckTrivialUnsignedComparison(). 5359 if ((Value == 0) && (!OtherIsBooleanType)) 5360 return; 5361 5362 BinaryOperatorKind op = E->getOpcode(); 5363 bool IsTrue = true; 5364 5365 // Used for diagnostic printout. 5366 enum { 5367 LiteralConstant = 0, 5368 CXXBoolLiteralTrue, 5369 CXXBoolLiteralFalse 5370 } LiteralOrBoolConstant = LiteralConstant; 5371 5372 if (!OtherIsBooleanType) { 5373 QualType ConstantT = Constant->getType(); 5374 QualType CommonT = E->getLHS()->getType(); 5375 5376 if (S.Context.hasSameUnqualifiedType(OtherT, ConstantT)) 5377 return; 5378 assert((OtherT->isIntegerType() && ConstantT->isIntegerType()) && 5379 "comparison with non-integer type"); 5380 5381 bool ConstantSigned = ConstantT->isSignedIntegerType(); 5382 bool CommonSigned = CommonT->isSignedIntegerType(); 5383 5384 bool EqualityOnly = false; 5385 5386 if (CommonSigned) { 5387 // The common type is signed, therefore no signed to unsigned conversion. 5388 if (!OtherRange.NonNegative) { 5389 // Check that the constant is representable in type OtherT. 5390 if (ConstantSigned) { 5391 if (OtherWidth >= Value.getMinSignedBits()) 5392 return; 5393 } else { // !ConstantSigned 5394 if (OtherWidth >= Value.getActiveBits() + 1) 5395 return; 5396 } 5397 } else { // !OtherSigned 5398 // Check that the constant is representable in type OtherT. 5399 // Negative values are out of range. 5400 if (ConstantSigned) { 5401 if (Value.isNonNegative() && OtherWidth >= Value.getActiveBits()) 5402 return; 5403 } else { // !ConstantSigned 5404 if (OtherWidth >= Value.getActiveBits()) 5405 return; 5406 } 5407 } 5408 } else { // !CommonSigned 5409 if (OtherRange.NonNegative) { 5410 if (OtherWidth >= Value.getActiveBits()) 5411 return; 5412 } else { // OtherSigned 5413 assert(!ConstantSigned && 5414 "Two signed types converted to unsigned types."); 5415 // Check to see if the constant is representable in OtherT. 5416 if (OtherWidth > Value.getActiveBits()) 5417 return; 5418 // Check to see if the constant is equivalent to a negative value 5419 // cast to CommonT. 5420 if (S.Context.getIntWidth(ConstantT) == 5421 S.Context.getIntWidth(CommonT) && 5422 Value.isNegative() && Value.getMinSignedBits() <= OtherWidth) 5423 return; 5424 // The constant value rests between values that OtherT can represent 5425 // after conversion. Relational comparison still works, but equality 5426 // comparisons will be tautological. 5427 EqualityOnly = true; 5428 } 5429 } 5430 5431 bool PositiveConstant = !ConstantSigned || Value.isNonNegative(); 5432 5433 if (op == BO_EQ || op == BO_NE) { 5434 IsTrue = op == BO_NE; 5435 } else if (EqualityOnly) { 5436 return; 5437 } else if (RhsConstant) { 5438 if (op == BO_GT || op == BO_GE) 5439 IsTrue = !PositiveConstant; 5440 else // op == BO_LT || op == BO_LE 5441 IsTrue = PositiveConstant; 5442 } else { 5443 if (op == BO_LT || op == BO_LE) 5444 IsTrue = !PositiveConstant; 5445 else // op == BO_GT || op == BO_GE 5446 IsTrue = PositiveConstant; 5447 } 5448 } else { 5449 // Other isKnownToHaveBooleanValue 5450 enum CompareBoolWithConstantResult { AFals, ATrue, Unkwn }; 5451 enum ConstantValue { LT_Zero, Zero, One, GT_One, SizeOfConstVal }; 5452 enum ConstantSide { Lhs, Rhs, SizeOfConstSides }; 5453 5454 static const struct LinkedConditions { 5455 CompareBoolWithConstantResult BO_LT_OP[SizeOfConstSides][SizeOfConstVal]; 5456 CompareBoolWithConstantResult BO_GT_OP[SizeOfConstSides][SizeOfConstVal]; 5457 CompareBoolWithConstantResult BO_LE_OP[SizeOfConstSides][SizeOfConstVal]; 5458 CompareBoolWithConstantResult BO_GE_OP[SizeOfConstSides][SizeOfConstVal]; 5459 CompareBoolWithConstantResult BO_EQ_OP[SizeOfConstSides][SizeOfConstVal]; 5460 CompareBoolWithConstantResult BO_NE_OP[SizeOfConstSides][SizeOfConstVal]; 5461 5462 } TruthTable = { 5463 // Constant on LHS. | Constant on RHS. | 5464 // LT_Zero| Zero | One |GT_One| LT_Zero| Zero | One |GT_One| 5465 { { ATrue, Unkwn, AFals, AFals }, { AFals, AFals, Unkwn, ATrue } }, 5466 { { AFals, AFals, Unkwn, ATrue }, { ATrue, Unkwn, AFals, AFals } }, 5467 { { ATrue, ATrue, Unkwn, AFals }, { AFals, Unkwn, ATrue, ATrue } }, 5468 { { AFals, Unkwn, ATrue, ATrue }, { ATrue, ATrue, Unkwn, AFals } }, 5469 { { AFals, Unkwn, Unkwn, AFals }, { AFals, Unkwn, Unkwn, AFals } }, 5470 { { ATrue, Unkwn, Unkwn, ATrue }, { ATrue, Unkwn, Unkwn, ATrue } } 5471 }; 5472 5473 bool ConstantIsBoolLiteral = isa<CXXBoolLiteralExpr>(Constant); 5474 5475 enum ConstantValue ConstVal = Zero; 5476 if (Value.isUnsigned() || Value.isNonNegative()) { 5477 if (Value == 0) { 5478 LiteralOrBoolConstant = 5479 ConstantIsBoolLiteral ? CXXBoolLiteralFalse : LiteralConstant; 5480 ConstVal = Zero; 5481 } else if (Value == 1) { 5482 LiteralOrBoolConstant = 5483 ConstantIsBoolLiteral ? CXXBoolLiteralTrue : LiteralConstant; 5484 ConstVal = One; 5485 } else { 5486 LiteralOrBoolConstant = LiteralConstant; 5487 ConstVal = GT_One; 5488 } 5489 } else { 5490 ConstVal = LT_Zero; 5491 } 5492 5493 CompareBoolWithConstantResult CmpRes; 5494 5495 switch (op) { 5496 case BO_LT: 5497 CmpRes = TruthTable.BO_LT_OP[RhsConstant][ConstVal]; 5498 break; 5499 case BO_GT: 5500 CmpRes = TruthTable.BO_GT_OP[RhsConstant][ConstVal]; 5501 break; 5502 case BO_LE: 5503 CmpRes = TruthTable.BO_LE_OP[RhsConstant][ConstVal]; 5504 break; 5505 case BO_GE: 5506 CmpRes = TruthTable.BO_GE_OP[RhsConstant][ConstVal]; 5507 break; 5508 case BO_EQ: 5509 CmpRes = TruthTable.BO_EQ_OP[RhsConstant][ConstVal]; 5510 break; 5511 case BO_NE: 5512 CmpRes = TruthTable.BO_NE_OP[RhsConstant][ConstVal]; 5513 break; 5514 default: 5515 CmpRes = Unkwn; 5516 break; 5517 } 5518 5519 if (CmpRes == AFals) { 5520 IsTrue = false; 5521 } else if (CmpRes == ATrue) { 5522 IsTrue = true; 5523 } else { 5524 return; 5525 } 5526 } 5527 5528 // If this is a comparison to an enum constant, include that 5529 // constant in the diagnostic. 5530 const EnumConstantDecl *ED = nullptr; 5531 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Constant)) 5532 ED = dyn_cast<EnumConstantDecl>(DR->getDecl()); 5533 5534 SmallString<64> PrettySourceValue; 5535 llvm::raw_svector_ostream OS(PrettySourceValue); 5536 if (ED) 5537 OS << '\'' << *ED << "' (" << Value << ")"; 5538 else 5539 OS << Value; 5540 5541 S.DiagRuntimeBehavior( 5542 E->getOperatorLoc(), E, 5543 S.PDiag(diag::warn_out_of_range_compare) 5544 << OS.str() << LiteralOrBoolConstant 5545 << OtherT << (OtherIsBooleanType && !OtherT->isBooleanType()) << IsTrue 5546 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange()); 5547 } 5548 5549 /// Analyze the operands of the given comparison. Implements the 5550 /// fallback case from AnalyzeComparison. 5551 static void AnalyzeImpConvsInComparison(Sema &S, BinaryOperator *E) { 5552 AnalyzeImplicitConversions(S, E->getLHS(), E->getOperatorLoc()); 5553 AnalyzeImplicitConversions(S, E->getRHS(), E->getOperatorLoc()); 5554 } 5555 5556 /// \brief Implements -Wsign-compare. 5557 /// 5558 /// \param E the binary operator to check for warnings 5559 static void AnalyzeComparison(Sema &S, BinaryOperator *E) { 5560 // The type the comparison is being performed in. 5561 QualType T = E->getLHS()->getType(); 5562 assert(S.Context.hasSameUnqualifiedType(T, E->getRHS()->getType()) 5563 && "comparison with mismatched types"); 5564 if (E->isValueDependent()) 5565 return AnalyzeImpConvsInComparison(S, E); 5566 5567 Expr *LHS = E->getLHS()->IgnoreParenImpCasts(); 5568 Expr *RHS = E->getRHS()->IgnoreParenImpCasts(); 5569 5570 bool IsComparisonConstant = false; 5571 5572 // Check whether an integer constant comparison results in a value 5573 // of 'true' or 'false'. 5574 if (T->isIntegralType(S.Context)) { 5575 llvm::APSInt RHSValue; 5576 bool IsRHSIntegralLiteral = 5577 RHS->isIntegerConstantExpr(RHSValue, S.Context); 5578 llvm::APSInt LHSValue; 5579 bool IsLHSIntegralLiteral = 5580 LHS->isIntegerConstantExpr(LHSValue, S.Context); 5581 if (IsRHSIntegralLiteral && !IsLHSIntegralLiteral) 5582 DiagnoseOutOfRangeComparison(S, E, RHS, LHS, RHSValue, true); 5583 else if (!IsRHSIntegralLiteral && IsLHSIntegralLiteral) 5584 DiagnoseOutOfRangeComparison(S, E, LHS, RHS, LHSValue, false); 5585 else 5586 IsComparisonConstant = 5587 (IsRHSIntegralLiteral && IsLHSIntegralLiteral); 5588 } else if (!T->hasUnsignedIntegerRepresentation()) 5589 IsComparisonConstant = E->isIntegerConstantExpr(S.Context); 5590 5591 // We don't do anything special if this isn't an unsigned integral 5592 // comparison: we're only interested in integral comparisons, and 5593 // signed comparisons only happen in cases we don't care to warn about. 5594 // 5595 // We also don't care about value-dependent expressions or expressions 5596 // whose result is a constant. 5597 if (!T->hasUnsignedIntegerRepresentation() || IsComparisonConstant) 5598 return AnalyzeImpConvsInComparison(S, E); 5599 5600 // Check to see if one of the (unmodified) operands is of different 5601 // signedness. 5602 Expr *signedOperand, *unsignedOperand; 5603 if (LHS->getType()->hasSignedIntegerRepresentation()) { 5604 assert(!RHS->getType()->hasSignedIntegerRepresentation() && 5605 "unsigned comparison between two signed integer expressions?"); 5606 signedOperand = LHS; 5607 unsignedOperand = RHS; 5608 } else if (RHS->getType()->hasSignedIntegerRepresentation()) { 5609 signedOperand = RHS; 5610 unsignedOperand = LHS; 5611 } else { 5612 CheckTrivialUnsignedComparison(S, E); 5613 return AnalyzeImpConvsInComparison(S, E); 5614 } 5615 5616 // Otherwise, calculate the effective range of the signed operand. 5617 IntRange signedRange = GetExprRange(S.Context, signedOperand); 5618 5619 // Go ahead and analyze implicit conversions in the operands. Note 5620 // that we skip the implicit conversions on both sides. 5621 AnalyzeImplicitConversions(S, LHS, E->getOperatorLoc()); 5622 AnalyzeImplicitConversions(S, RHS, E->getOperatorLoc()); 5623 5624 // If the signed range is non-negative, -Wsign-compare won't fire, 5625 // but we should still check for comparisons which are always true 5626 // or false. 5627 if (signedRange.NonNegative) 5628 return CheckTrivialUnsignedComparison(S, E); 5629 5630 // For (in)equality comparisons, if the unsigned operand is a 5631 // constant which cannot collide with a overflowed signed operand, 5632 // then reinterpreting the signed operand as unsigned will not 5633 // change the result of the comparison. 5634 if (E->isEqualityOp()) { 5635 unsigned comparisonWidth = S.Context.getIntWidth(T); 5636 IntRange unsignedRange = GetExprRange(S.Context, unsignedOperand); 5637 5638 // We should never be unable to prove that the unsigned operand is 5639 // non-negative. 5640 assert(unsignedRange.NonNegative && "unsigned range includes negative?"); 5641 5642 if (unsignedRange.Width < comparisonWidth) 5643 return; 5644 } 5645 5646 S.DiagRuntimeBehavior(E->getOperatorLoc(), E, 5647 S.PDiag(diag::warn_mixed_sign_comparison) 5648 << LHS->getType() << RHS->getType() 5649 << LHS->getSourceRange() << RHS->getSourceRange()); 5650 } 5651 5652 /// Analyzes an attempt to assign the given value to a bitfield. 5653 /// 5654 /// Returns true if there was something fishy about the attempt. 5655 static bool AnalyzeBitFieldAssignment(Sema &S, FieldDecl *Bitfield, Expr *Init, 5656 SourceLocation InitLoc) { 5657 assert(Bitfield->isBitField()); 5658 if (Bitfield->isInvalidDecl()) 5659 return false; 5660 5661 // White-list bool bitfields. 5662 if (Bitfield->getType()->isBooleanType()) 5663 return false; 5664 5665 // Ignore value- or type-dependent expressions. 5666 if (Bitfield->getBitWidth()->isValueDependent() || 5667 Bitfield->getBitWidth()->isTypeDependent() || 5668 Init->isValueDependent() || 5669 Init->isTypeDependent()) 5670 return false; 5671 5672 Expr *OriginalInit = Init->IgnoreParenImpCasts(); 5673 5674 llvm::APSInt Value; 5675 if (!OriginalInit->EvaluateAsInt(Value, S.Context, Expr::SE_AllowSideEffects)) 5676 return false; 5677 5678 unsigned OriginalWidth = Value.getBitWidth(); 5679 unsigned FieldWidth = Bitfield->getBitWidthValue(S.Context); 5680 5681 if (OriginalWidth <= FieldWidth) 5682 return false; 5683 5684 // Compute the value which the bitfield will contain. 5685 llvm::APSInt TruncatedValue = Value.trunc(FieldWidth); 5686 TruncatedValue.setIsSigned(Bitfield->getType()->isSignedIntegerType()); 5687 5688 // Check whether the stored value is equal to the original value. 5689 TruncatedValue = TruncatedValue.extend(OriginalWidth); 5690 if (llvm::APSInt::isSameValue(Value, TruncatedValue)) 5691 return false; 5692 5693 // Special-case bitfields of width 1: booleans are naturally 0/1, and 5694 // therefore don't strictly fit into a signed bitfield of width 1. 5695 if (FieldWidth == 1 && Value == 1) 5696 return false; 5697 5698 std::string PrettyValue = Value.toString(10); 5699 std::string PrettyTrunc = TruncatedValue.toString(10); 5700 5701 S.Diag(InitLoc, diag::warn_impcast_bitfield_precision_constant) 5702 << PrettyValue << PrettyTrunc << OriginalInit->getType() 5703 << Init->getSourceRange(); 5704 5705 return true; 5706 } 5707 5708 /// Analyze the given simple or compound assignment for warning-worthy 5709 /// operations. 5710 static void AnalyzeAssignment(Sema &S, BinaryOperator *E) { 5711 // Just recurse on the LHS. 5712 AnalyzeImplicitConversions(S, E->getLHS(), E->getOperatorLoc()); 5713 5714 // We want to recurse on the RHS as normal unless we're assigning to 5715 // a bitfield. 5716 if (FieldDecl *Bitfield = E->getLHS()->getSourceBitField()) { 5717 if (AnalyzeBitFieldAssignment(S, Bitfield, E->getRHS(), 5718 E->getOperatorLoc())) { 5719 // Recurse, ignoring any implicit conversions on the RHS. 5720 return AnalyzeImplicitConversions(S, E->getRHS()->IgnoreParenImpCasts(), 5721 E->getOperatorLoc()); 5722 } 5723 } 5724 5725 AnalyzeImplicitConversions(S, E->getRHS(), E->getOperatorLoc()); 5726 } 5727 5728 /// Diagnose an implicit cast; purely a helper for CheckImplicitConversion. 5729 static void DiagnoseImpCast(Sema &S, Expr *E, QualType SourceType, QualType T, 5730 SourceLocation CContext, unsigned diag, 5731 bool pruneControlFlow = false) { 5732 if (pruneControlFlow) { 5733 S.DiagRuntimeBehavior(E->getExprLoc(), E, 5734 S.PDiag(diag) 5735 << SourceType << T << E->getSourceRange() 5736 << SourceRange(CContext)); 5737 return; 5738 } 5739 S.Diag(E->getExprLoc(), diag) 5740 << SourceType << T << E->getSourceRange() << SourceRange(CContext); 5741 } 5742 5743 /// Diagnose an implicit cast; purely a helper for CheckImplicitConversion. 5744 static void DiagnoseImpCast(Sema &S, Expr *E, QualType T, 5745 SourceLocation CContext, unsigned diag, 5746 bool pruneControlFlow = false) { 5747 DiagnoseImpCast(S, E, E->getType(), T, CContext, diag, pruneControlFlow); 5748 } 5749 5750 /// Diagnose an implicit cast from a literal expression. Does not warn when the 5751 /// cast wouldn't lose information. 5752 void DiagnoseFloatingLiteralImpCast(Sema &S, FloatingLiteral *FL, QualType T, 5753 SourceLocation CContext) { 5754 // Try to convert the literal exactly to an integer. If we can, don't warn. 5755 bool isExact = false; 5756 const llvm::APFloat &Value = FL->getValue(); 5757 llvm::APSInt IntegerValue(S.Context.getIntWidth(T), 5758 T->hasUnsignedIntegerRepresentation()); 5759 if (Value.convertToInteger(IntegerValue, 5760 llvm::APFloat::rmTowardZero, &isExact) 5761 == llvm::APFloat::opOK && isExact) 5762 return; 5763 5764 // FIXME: Force the precision of the source value down so we don't print 5765 // digits which are usually useless (we don't really care here if we 5766 // truncate a digit by accident in edge cases). Ideally, APFloat::toString 5767 // would automatically print the shortest representation, but it's a bit 5768 // tricky to implement. 5769 SmallString<16> PrettySourceValue; 5770 unsigned precision = llvm::APFloat::semanticsPrecision(Value.getSemantics()); 5771 precision = (precision * 59 + 195) / 196; 5772 Value.toString(PrettySourceValue, precision); 5773 5774 SmallString<16> PrettyTargetValue; 5775 if (T->isSpecificBuiltinType(BuiltinType::Bool)) 5776 PrettyTargetValue = IntegerValue == 0 ? "false" : "true"; 5777 else 5778 IntegerValue.toString(PrettyTargetValue); 5779 5780 S.Diag(FL->getExprLoc(), diag::warn_impcast_literal_float_to_integer) 5781 << FL->getType() << T.getUnqualifiedType() << PrettySourceValue 5782 << PrettyTargetValue << FL->getSourceRange() << SourceRange(CContext); 5783 } 5784 5785 std::string PrettyPrintInRange(const llvm::APSInt &Value, IntRange Range) { 5786 if (!Range.Width) return "0"; 5787 5788 llvm::APSInt ValueInRange = Value; 5789 ValueInRange.setIsSigned(!Range.NonNegative); 5790 ValueInRange = ValueInRange.trunc(Range.Width); 5791 return ValueInRange.toString(10); 5792 } 5793 5794 static bool IsImplicitBoolFloatConversion(Sema &S, Expr *Ex, bool ToBool) { 5795 if (!isa<ImplicitCastExpr>(Ex)) 5796 return false; 5797 5798 Expr *InnerE = Ex->IgnoreParenImpCasts(); 5799 const Type *Target = S.Context.getCanonicalType(Ex->getType()).getTypePtr(); 5800 const Type *Source = 5801 S.Context.getCanonicalType(InnerE->getType()).getTypePtr(); 5802 if (Target->isDependentType()) 5803 return false; 5804 5805 const BuiltinType *FloatCandidateBT = 5806 dyn_cast<BuiltinType>(ToBool ? Source : Target); 5807 const Type *BoolCandidateType = ToBool ? Target : Source; 5808 5809 return (BoolCandidateType->isSpecificBuiltinType(BuiltinType::Bool) && 5810 FloatCandidateBT && (FloatCandidateBT->isFloatingPoint())); 5811 } 5812 5813 void CheckImplicitArgumentConversions(Sema &S, CallExpr *TheCall, 5814 SourceLocation CC) { 5815 unsigned NumArgs = TheCall->getNumArgs(); 5816 for (unsigned i = 0; i < NumArgs; ++i) { 5817 Expr *CurrA = TheCall->getArg(i); 5818 if (!IsImplicitBoolFloatConversion(S, CurrA, true)) 5819 continue; 5820 5821 bool IsSwapped = ((i > 0) && 5822 IsImplicitBoolFloatConversion(S, TheCall->getArg(i - 1), false)); 5823 IsSwapped |= ((i < (NumArgs - 1)) && 5824 IsImplicitBoolFloatConversion(S, TheCall->getArg(i + 1), false)); 5825 if (IsSwapped) { 5826 // Warn on this floating-point to bool conversion. 5827 DiagnoseImpCast(S, CurrA->IgnoreParenImpCasts(), 5828 CurrA->getType(), CC, 5829 diag::warn_impcast_floating_point_to_bool); 5830 } 5831 } 5832 } 5833 5834 void CheckImplicitConversion(Sema &S, Expr *E, QualType T, 5835 SourceLocation CC, bool *ICContext = nullptr) { 5836 if (E->isTypeDependent() || E->isValueDependent()) return; 5837 5838 const Type *Source = S.Context.getCanonicalType(E->getType()).getTypePtr(); 5839 const Type *Target = S.Context.getCanonicalType(T).getTypePtr(); 5840 if (Source == Target) return; 5841 if (Target->isDependentType()) return; 5842 5843 // If the conversion context location is invalid don't complain. We also 5844 // don't want to emit a warning if the issue occurs from the expansion of 5845 // a system macro. The problem is that 'getSpellingLoc()' is slow, so we 5846 // delay this check as long as possible. Once we detect we are in that 5847 // scenario, we just return. 5848 if (CC.isInvalid()) 5849 return; 5850 5851 // Diagnose implicit casts to bool. 5852 if (Target->isSpecificBuiltinType(BuiltinType::Bool)) { 5853 if (isa<StringLiteral>(E)) 5854 // Warn on string literal to bool. Checks for string literals in logical 5855 // and expressions, for instance, assert(0 && "error here"), are 5856 // prevented by a check in AnalyzeImplicitConversions(). 5857 return DiagnoseImpCast(S, E, T, CC, 5858 diag::warn_impcast_string_literal_to_bool); 5859 if (isa<ObjCStringLiteral>(E) || isa<ObjCArrayLiteral>(E) || 5860 isa<ObjCDictionaryLiteral>(E) || isa<ObjCBoxedExpr>(E)) { 5861 // This covers the literal expressions that evaluate to Objective-C 5862 // objects. 5863 return DiagnoseImpCast(S, E, T, CC, 5864 diag::warn_impcast_objective_c_literal_to_bool); 5865 } 5866 if (Source->isPointerType() || Source->canDecayToPointerType()) { 5867 // Warn on pointer to bool conversion that is always true. 5868 S.DiagnoseAlwaysNonNullPointer(E, Expr::NPCK_NotNull, /*IsEqual*/ false, 5869 SourceRange(CC)); 5870 } 5871 } 5872 5873 // Strip vector types. 5874 if (isa<VectorType>(Source)) { 5875 if (!isa<VectorType>(Target)) { 5876 if (S.SourceMgr.isInSystemMacro(CC)) 5877 return; 5878 return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_vector_scalar); 5879 } 5880 5881 // If the vector cast is cast between two vectors of the same size, it is 5882 // a bitcast, not a conversion. 5883 if (S.Context.getTypeSize(Source) == S.Context.getTypeSize(Target)) 5884 return; 5885 5886 Source = cast<VectorType>(Source)->getElementType().getTypePtr(); 5887 Target = cast<VectorType>(Target)->getElementType().getTypePtr(); 5888 } 5889 if (auto VecTy = dyn_cast<VectorType>(Target)) 5890 Target = VecTy->getElementType().getTypePtr(); 5891 5892 // Strip complex types. 5893 if (isa<ComplexType>(Source)) { 5894 if (!isa<ComplexType>(Target)) { 5895 if (S.SourceMgr.isInSystemMacro(CC)) 5896 return; 5897 5898 return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_complex_scalar); 5899 } 5900 5901 Source = cast<ComplexType>(Source)->getElementType().getTypePtr(); 5902 Target = cast<ComplexType>(Target)->getElementType().getTypePtr(); 5903 } 5904 5905 const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source); 5906 const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target); 5907 5908 // If the source is floating point... 5909 if (SourceBT && SourceBT->isFloatingPoint()) { 5910 // ...and the target is floating point... 5911 if (TargetBT && TargetBT->isFloatingPoint()) { 5912 // ...then warn if we're dropping FP rank. 5913 5914 // Builtin FP kinds are ordered by increasing FP rank. 5915 if (SourceBT->getKind() > TargetBT->getKind()) { 5916 // Don't warn about float constants that are precisely 5917 // representable in the target type. 5918 Expr::EvalResult result; 5919 if (E->EvaluateAsRValue(result, S.Context)) { 5920 // Value might be a float, a float vector, or a float complex. 5921 if (IsSameFloatAfterCast(result.Val, 5922 S.Context.getFloatTypeSemantics(QualType(TargetBT, 0)), 5923 S.Context.getFloatTypeSemantics(QualType(SourceBT, 0)))) 5924 return; 5925 } 5926 5927 if (S.SourceMgr.isInSystemMacro(CC)) 5928 return; 5929 5930 DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_float_precision); 5931 } 5932 return; 5933 } 5934 5935 // If the target is integral, always warn. 5936 if (TargetBT && TargetBT->isInteger()) { 5937 if (S.SourceMgr.isInSystemMacro(CC)) 5938 return; 5939 5940 Expr *InnerE = E->IgnoreParenImpCasts(); 5941 // We also want to warn on, e.g., "int i = -1.234" 5942 if (UnaryOperator *UOp = dyn_cast<UnaryOperator>(InnerE)) 5943 if (UOp->getOpcode() == UO_Minus || UOp->getOpcode() == UO_Plus) 5944 InnerE = UOp->getSubExpr()->IgnoreParenImpCasts(); 5945 5946 if (FloatingLiteral *FL = dyn_cast<FloatingLiteral>(InnerE)) { 5947 DiagnoseFloatingLiteralImpCast(S, FL, T, CC); 5948 } else { 5949 DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_float_integer); 5950 } 5951 } 5952 5953 // If the target is bool, warn if expr is a function or method call. 5954 if (Target->isSpecificBuiltinType(BuiltinType::Bool) && 5955 isa<CallExpr>(E)) { 5956 // Check last argument of function call to see if it is an 5957 // implicit cast from a type matching the type the result 5958 // is being cast to. 5959 CallExpr *CEx = cast<CallExpr>(E); 5960 unsigned NumArgs = CEx->getNumArgs(); 5961 if (NumArgs > 0) { 5962 Expr *LastA = CEx->getArg(NumArgs - 1); 5963 Expr *InnerE = LastA->IgnoreParenImpCasts(); 5964 const Type *InnerType = 5965 S.Context.getCanonicalType(InnerE->getType()).getTypePtr(); 5966 if (isa<ImplicitCastExpr>(LastA) && (InnerType == Target)) { 5967 // Warn on this floating-point to bool conversion 5968 DiagnoseImpCast(S, E, T, CC, 5969 diag::warn_impcast_floating_point_to_bool); 5970 } 5971 } 5972 } 5973 return; 5974 } 5975 5976 if ((E->isNullPointerConstant(S.Context, Expr::NPC_ValueDependentIsNotNull) 5977 == Expr::NPCK_GNUNull) && !Target->isAnyPointerType() 5978 && !Target->isBlockPointerType() && !Target->isMemberPointerType() 5979 && Target->isScalarType() && !Target->isNullPtrType()) { 5980 SourceLocation Loc = E->getSourceRange().getBegin(); 5981 if (Loc.isMacroID()) 5982 Loc = S.SourceMgr.getImmediateExpansionRange(Loc).first; 5983 if (!Loc.isMacroID() || CC.isMacroID()) 5984 S.Diag(Loc, diag::warn_impcast_null_pointer_to_integer) 5985 << T << clang::SourceRange(CC) 5986 << FixItHint::CreateReplacement(Loc, 5987 S.getFixItZeroLiteralForType(T, Loc)); 5988 } 5989 5990 if (!Source->isIntegerType() || !Target->isIntegerType()) 5991 return; 5992 5993 // TODO: remove this early return once the false positives for constant->bool 5994 // in templates, macros, etc, are reduced or removed. 5995 if (Target->isSpecificBuiltinType(BuiltinType::Bool)) 5996 return; 5997 5998 IntRange SourceRange = GetExprRange(S.Context, E); 5999 IntRange TargetRange = IntRange::forTargetOfCanonicalType(S.Context, Target); 6000 6001 if (SourceRange.Width > TargetRange.Width) { 6002 // If the source is a constant, use a default-on diagnostic. 6003 // TODO: this should happen for bitfield stores, too. 6004 llvm::APSInt Value(32); 6005 if (E->isIntegerConstantExpr(Value, S.Context)) { 6006 if (S.SourceMgr.isInSystemMacro(CC)) 6007 return; 6008 6009 std::string PrettySourceValue = Value.toString(10); 6010 std::string PrettyTargetValue = PrettyPrintInRange(Value, TargetRange); 6011 6012 S.DiagRuntimeBehavior(E->getExprLoc(), E, 6013 S.PDiag(diag::warn_impcast_integer_precision_constant) 6014 << PrettySourceValue << PrettyTargetValue 6015 << E->getType() << T << E->getSourceRange() 6016 << clang::SourceRange(CC)); 6017 return; 6018 } 6019 6020 // People want to build with -Wshorten-64-to-32 and not -Wconversion. 6021 if (S.SourceMgr.isInSystemMacro(CC)) 6022 return; 6023 6024 if (TargetRange.Width == 32 && S.Context.getIntWidth(E->getType()) == 64) 6025 return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_integer_64_32, 6026 /* pruneControlFlow */ true); 6027 return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_integer_precision); 6028 } 6029 6030 if ((TargetRange.NonNegative && !SourceRange.NonNegative) || 6031 (!TargetRange.NonNegative && SourceRange.NonNegative && 6032 SourceRange.Width == TargetRange.Width)) { 6033 6034 if (S.SourceMgr.isInSystemMacro(CC)) 6035 return; 6036 6037 unsigned DiagID = diag::warn_impcast_integer_sign; 6038 6039 // Traditionally, gcc has warned about this under -Wsign-compare. 6040 // We also want to warn about it in -Wconversion. 6041 // So if -Wconversion is off, use a completely identical diagnostic 6042 // in the sign-compare group. 6043 // The conditional-checking code will 6044 if (ICContext) { 6045 DiagID = diag::warn_impcast_integer_sign_conditional; 6046 *ICContext = true; 6047 } 6048 6049 return DiagnoseImpCast(S, E, T, CC, DiagID); 6050 } 6051 6052 // Diagnose conversions between different enumeration types. 6053 // In C, we pretend that the type of an EnumConstantDecl is its enumeration 6054 // type, to give us better diagnostics. 6055 QualType SourceType = E->getType(); 6056 if (!S.getLangOpts().CPlusPlus) { 6057 if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) 6058 if (EnumConstantDecl *ECD = dyn_cast<EnumConstantDecl>(DRE->getDecl())) { 6059 EnumDecl *Enum = cast<EnumDecl>(ECD->getDeclContext()); 6060 SourceType = S.Context.getTypeDeclType(Enum); 6061 Source = S.Context.getCanonicalType(SourceType).getTypePtr(); 6062 } 6063 } 6064 6065 if (const EnumType *SourceEnum = Source->getAs<EnumType>()) 6066 if (const EnumType *TargetEnum = Target->getAs<EnumType>()) 6067 if (SourceEnum->getDecl()->hasNameForLinkage() && 6068 TargetEnum->getDecl()->hasNameForLinkage() && 6069 SourceEnum != TargetEnum) { 6070 if (S.SourceMgr.isInSystemMacro(CC)) 6071 return; 6072 6073 return DiagnoseImpCast(S, E, SourceType, T, CC, 6074 diag::warn_impcast_different_enum_types); 6075 } 6076 6077 return; 6078 } 6079 6080 void CheckConditionalOperator(Sema &S, ConditionalOperator *E, 6081 SourceLocation CC, QualType T); 6082 6083 void CheckConditionalOperand(Sema &S, Expr *E, QualType T, 6084 SourceLocation CC, bool &ICContext) { 6085 E = E->IgnoreParenImpCasts(); 6086 6087 if (isa<ConditionalOperator>(E)) 6088 return CheckConditionalOperator(S, cast<ConditionalOperator>(E), CC, T); 6089 6090 AnalyzeImplicitConversions(S, E, CC); 6091 if (E->getType() != T) 6092 return CheckImplicitConversion(S, E, T, CC, &ICContext); 6093 return; 6094 } 6095 6096 void CheckConditionalOperator(Sema &S, ConditionalOperator *E, 6097 SourceLocation CC, QualType T) { 6098 AnalyzeImplicitConversions(S, E->getCond(), CC); 6099 6100 bool Suspicious = false; 6101 CheckConditionalOperand(S, E->getTrueExpr(), T, CC, Suspicious); 6102 CheckConditionalOperand(S, E->getFalseExpr(), T, CC, Suspicious); 6103 6104 // If -Wconversion would have warned about either of the candidates 6105 // for a signedness conversion to the context type... 6106 if (!Suspicious) return; 6107 6108 // ...but it's currently ignored... 6109 if (!S.Diags.isIgnored(diag::warn_impcast_integer_sign_conditional, CC)) 6110 return; 6111 6112 // ...then check whether it would have warned about either of the 6113 // candidates for a signedness conversion to the condition type. 6114 if (E->getType() == T) return; 6115 6116 Suspicious = false; 6117 CheckImplicitConversion(S, E->getTrueExpr()->IgnoreParenImpCasts(), 6118 E->getType(), CC, &Suspicious); 6119 if (!Suspicious) 6120 CheckImplicitConversion(S, E->getFalseExpr()->IgnoreParenImpCasts(), 6121 E->getType(), CC, &Suspicious); 6122 } 6123 6124 /// AnalyzeImplicitConversions - Find and report any interesting 6125 /// implicit conversions in the given expression. There are a couple 6126 /// of competing diagnostics here, -Wconversion and -Wsign-compare. 6127 void AnalyzeImplicitConversions(Sema &S, Expr *OrigE, SourceLocation CC) { 6128 QualType T = OrigE->getType(); 6129 Expr *E = OrigE->IgnoreParenImpCasts(); 6130 6131 if (E->isTypeDependent() || E->isValueDependent()) 6132 return; 6133 6134 // For conditional operators, we analyze the arguments as if they 6135 // were being fed directly into the output. 6136 if (isa<ConditionalOperator>(E)) { 6137 ConditionalOperator *CO = cast<ConditionalOperator>(E); 6138 CheckConditionalOperator(S, CO, CC, T); 6139 return; 6140 } 6141 6142 // Check implicit argument conversions for function calls. 6143 if (CallExpr *Call = dyn_cast<CallExpr>(E)) 6144 CheckImplicitArgumentConversions(S, Call, CC); 6145 6146 // Go ahead and check any implicit conversions we might have skipped. 6147 // The non-canonical typecheck is just an optimization; 6148 // CheckImplicitConversion will filter out dead implicit conversions. 6149 if (E->getType() != T) 6150 CheckImplicitConversion(S, E, T, CC); 6151 6152 // Now continue drilling into this expression. 6153 6154 if (PseudoObjectExpr * POE = dyn_cast<PseudoObjectExpr>(E)) { 6155 if (POE->getResultExpr()) 6156 E = POE->getResultExpr(); 6157 } 6158 6159 if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) 6160 return AnalyzeImplicitConversions(S, OVE->getSourceExpr(), CC); 6161 6162 // Skip past explicit casts. 6163 if (isa<ExplicitCastExpr>(E)) { 6164 E = cast<ExplicitCastExpr>(E)->getSubExpr()->IgnoreParenImpCasts(); 6165 return AnalyzeImplicitConversions(S, E, CC); 6166 } 6167 6168 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) { 6169 // Do a somewhat different check with comparison operators. 6170 if (BO->isComparisonOp()) 6171 return AnalyzeComparison(S, BO); 6172 6173 // And with simple assignments. 6174 if (BO->getOpcode() == BO_Assign) 6175 return AnalyzeAssignment(S, BO); 6176 } 6177 6178 // These break the otherwise-useful invariant below. Fortunately, 6179 // we don't really need to recurse into them, because any internal 6180 // expressions should have been analyzed already when they were 6181 // built into statements. 6182 if (isa<StmtExpr>(E)) return; 6183 6184 // Don't descend into unevaluated contexts. 6185 if (isa<UnaryExprOrTypeTraitExpr>(E)) return; 6186 6187 // Now just recurse over the expression's children. 6188 CC = E->getExprLoc(); 6189 BinaryOperator *BO = dyn_cast<BinaryOperator>(E); 6190 bool IsLogicalAndOperator = BO && BO->getOpcode() == BO_LAnd; 6191 for (Stmt::child_range I = E->children(); I; ++I) { 6192 Expr *ChildExpr = dyn_cast_or_null<Expr>(*I); 6193 if (!ChildExpr) 6194 continue; 6195 6196 if (IsLogicalAndOperator && 6197 isa<StringLiteral>(ChildExpr->IgnoreParenImpCasts())) 6198 // Ignore checking string literals that are in logical and operators. 6199 // This is a common pattern for asserts. 6200 continue; 6201 AnalyzeImplicitConversions(S, ChildExpr, CC); 6202 } 6203 } 6204 6205 } // end anonymous namespace 6206 6207 enum { 6208 AddressOf, 6209 FunctionPointer, 6210 ArrayPointer 6211 }; 6212 6213 // Helper function for Sema::DiagnoseAlwaysNonNullPointer. 6214 // Returns true when emitting a warning about taking the address of a reference. 6215 static bool CheckForReference(Sema &SemaRef, const Expr *E, 6216 PartialDiagnostic PD) { 6217 E = E->IgnoreParenImpCasts(); 6218 6219 const FunctionDecl *FD = nullptr; 6220 6221 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) { 6222 if (!DRE->getDecl()->getType()->isReferenceType()) 6223 return false; 6224 } else if (const MemberExpr *M = dyn_cast<MemberExpr>(E)) { 6225 if (!M->getMemberDecl()->getType()->isReferenceType()) 6226 return false; 6227 } else if (const CallExpr *Call = dyn_cast<CallExpr>(E)) { 6228 if (!Call->getCallReturnType()->isReferenceType()) 6229 return false; 6230 FD = Call->getDirectCallee(); 6231 } else { 6232 return false; 6233 } 6234 6235 SemaRef.Diag(E->getExprLoc(), PD); 6236 6237 // If possible, point to location of function. 6238 if (FD) { 6239 SemaRef.Diag(FD->getLocation(), diag::note_reference_is_return_value) << FD; 6240 } 6241 6242 return true; 6243 } 6244 6245 /// \brief Diagnose pointers that are always non-null. 6246 /// \param E the expression containing the pointer 6247 /// \param NullKind NPCK_NotNull if E is a cast to bool, otherwise, E is 6248 /// compared to a null pointer 6249 /// \param IsEqual True when the comparison is equal to a null pointer 6250 /// \param Range Extra SourceRange to highlight in the diagnostic 6251 void Sema::DiagnoseAlwaysNonNullPointer(Expr *E, 6252 Expr::NullPointerConstantKind NullKind, 6253 bool IsEqual, SourceRange Range) { 6254 if (!E) 6255 return; 6256 6257 // Don't warn inside macros. 6258 if (E->getExprLoc().isMacroID()) 6259 return; 6260 E = E->IgnoreImpCasts(); 6261 6262 const bool IsCompare = NullKind != Expr::NPCK_NotNull; 6263 6264 if (isa<CXXThisExpr>(E)) { 6265 unsigned DiagID = IsCompare ? diag::warn_this_null_compare 6266 : diag::warn_this_bool_conversion; 6267 Diag(E->getExprLoc(), DiagID) << E->getSourceRange() << Range << IsEqual; 6268 return; 6269 } 6270 6271 bool IsAddressOf = false; 6272 6273 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) { 6274 if (UO->getOpcode() != UO_AddrOf) 6275 return; 6276 IsAddressOf = true; 6277 E = UO->getSubExpr(); 6278 } 6279 6280 if (IsAddressOf) { 6281 unsigned DiagID = IsCompare 6282 ? diag::warn_address_of_reference_null_compare 6283 : diag::warn_address_of_reference_bool_conversion; 6284 PartialDiagnostic PD = PDiag(DiagID) << E->getSourceRange() << Range 6285 << IsEqual; 6286 if (CheckForReference(*this, E, PD)) { 6287 return; 6288 } 6289 } 6290 6291 // Expect to find a single Decl. Skip anything more complicated. 6292 ValueDecl *D = nullptr; 6293 if (DeclRefExpr *R = dyn_cast<DeclRefExpr>(E)) { 6294 D = R->getDecl(); 6295 } else if (MemberExpr *M = dyn_cast<MemberExpr>(E)) { 6296 D = M->getMemberDecl(); 6297 } 6298 6299 // Weak Decls can be null. 6300 if (!D || D->isWeak()) 6301 return; 6302 6303 QualType T = D->getType(); 6304 const bool IsArray = T->isArrayType(); 6305 const bool IsFunction = T->isFunctionType(); 6306 6307 // Address of function is used to silence the function warning. 6308 if (IsAddressOf && IsFunction) { 6309 return; 6310 } 6311 6312 // Found nothing. 6313 if (!IsAddressOf && !IsFunction && !IsArray) 6314 return; 6315 6316 // Pretty print the expression for the diagnostic. 6317 std::string Str; 6318 llvm::raw_string_ostream S(Str); 6319 E->printPretty(S, nullptr, getPrintingPolicy()); 6320 6321 unsigned DiagID = IsCompare ? diag::warn_null_pointer_compare 6322 : diag::warn_impcast_pointer_to_bool; 6323 unsigned DiagType; 6324 if (IsAddressOf) 6325 DiagType = AddressOf; 6326 else if (IsFunction) 6327 DiagType = FunctionPointer; 6328 else if (IsArray) 6329 DiagType = ArrayPointer; 6330 else 6331 llvm_unreachable("Could not determine diagnostic."); 6332 Diag(E->getExprLoc(), DiagID) << DiagType << S.str() << E->getSourceRange() 6333 << Range << IsEqual; 6334 6335 if (!IsFunction) 6336 return; 6337 6338 // Suggest '&' to silence the function warning. 6339 Diag(E->getExprLoc(), diag::note_function_warning_silence) 6340 << FixItHint::CreateInsertion(E->getLocStart(), "&"); 6341 6342 // Check to see if '()' fixit should be emitted. 6343 QualType ReturnType; 6344 UnresolvedSet<4> NonTemplateOverloads; 6345 tryExprAsCall(*E, ReturnType, NonTemplateOverloads); 6346 if (ReturnType.isNull()) 6347 return; 6348 6349 if (IsCompare) { 6350 // There are two cases here. If there is null constant, the only suggest 6351 // for a pointer return type. If the null is 0, then suggest if the return 6352 // type is a pointer or an integer type. 6353 if (!ReturnType->isPointerType()) { 6354 if (NullKind == Expr::NPCK_ZeroExpression || 6355 NullKind == Expr::NPCK_ZeroLiteral) { 6356 if (!ReturnType->isIntegerType()) 6357 return; 6358 } else { 6359 return; 6360 } 6361 } 6362 } else { // !IsCompare 6363 // For function to bool, only suggest if the function pointer has bool 6364 // return type. 6365 if (!ReturnType->isSpecificBuiltinType(BuiltinType::Bool)) 6366 return; 6367 } 6368 Diag(E->getExprLoc(), diag::note_function_to_function_call) 6369 << FixItHint::CreateInsertion(getLocForEndOfToken(E->getLocEnd()), "()"); 6370 } 6371 6372 6373 /// Diagnoses "dangerous" implicit conversions within the given 6374 /// expression (which is a full expression). Implements -Wconversion 6375 /// and -Wsign-compare. 6376 /// 6377 /// \param CC the "context" location of the implicit conversion, i.e. 6378 /// the most location of the syntactic entity requiring the implicit 6379 /// conversion 6380 void Sema::CheckImplicitConversions(Expr *E, SourceLocation CC) { 6381 // Don't diagnose in unevaluated contexts. 6382 if (isUnevaluatedContext()) 6383 return; 6384 6385 // Don't diagnose for value- or type-dependent expressions. 6386 if (E->isTypeDependent() || E->isValueDependent()) 6387 return; 6388 6389 // Check for array bounds violations in cases where the check isn't triggered 6390 // elsewhere for other Expr types (like BinaryOperators), e.g. when an 6391 // ArraySubscriptExpr is on the RHS of a variable initialization. 6392 CheckArrayAccess(E); 6393 6394 // This is not the right CC for (e.g.) a variable initialization. 6395 AnalyzeImplicitConversions(*this, E, CC); 6396 } 6397 6398 /// Diagnose when expression is an integer constant expression and its evaluation 6399 /// results in integer overflow 6400 void Sema::CheckForIntOverflow (Expr *E) { 6401 if (isa<BinaryOperator>(E->IgnoreParens())) 6402 E->EvaluateForOverflow(Context); 6403 } 6404 6405 namespace { 6406 /// \brief Visitor for expressions which looks for unsequenced operations on the 6407 /// same object. 6408 class SequenceChecker : public EvaluatedExprVisitor<SequenceChecker> { 6409 typedef EvaluatedExprVisitor<SequenceChecker> Base; 6410 6411 /// \brief A tree of sequenced regions within an expression. Two regions are 6412 /// unsequenced if one is an ancestor or a descendent of the other. When we 6413 /// finish processing an expression with sequencing, such as a comma 6414 /// expression, we fold its tree nodes into its parent, since they are 6415 /// unsequenced with respect to nodes we will visit later. 6416 class SequenceTree { 6417 struct Value { 6418 explicit Value(unsigned Parent) : Parent(Parent), Merged(false) {} 6419 unsigned Parent : 31; 6420 bool Merged : 1; 6421 }; 6422 SmallVector<Value, 8> Values; 6423 6424 public: 6425 /// \brief A region within an expression which may be sequenced with respect 6426 /// to some other region. 6427 class Seq { 6428 explicit Seq(unsigned N) : Index(N) {} 6429 unsigned Index; 6430 friend class SequenceTree; 6431 public: 6432 Seq() : Index(0) {} 6433 }; 6434 6435 SequenceTree() { Values.push_back(Value(0)); } 6436 Seq root() const { return Seq(0); } 6437 6438 /// \brief Create a new sequence of operations, which is an unsequenced 6439 /// subset of \p Parent. This sequence of operations is sequenced with 6440 /// respect to other children of \p Parent. 6441 Seq allocate(Seq Parent) { 6442 Values.push_back(Value(Parent.Index)); 6443 return Seq(Values.size() - 1); 6444 } 6445 6446 /// \brief Merge a sequence of operations into its parent. 6447 void merge(Seq S) { 6448 Values[S.Index].Merged = true; 6449 } 6450 6451 /// \brief Determine whether two operations are unsequenced. This operation 6452 /// is asymmetric: \p Cur should be the more recent sequence, and \p Old 6453 /// should have been merged into its parent as appropriate. 6454 bool isUnsequenced(Seq Cur, Seq Old) { 6455 unsigned C = representative(Cur.Index); 6456 unsigned Target = representative(Old.Index); 6457 while (C >= Target) { 6458 if (C == Target) 6459 return true; 6460 C = Values[C].Parent; 6461 } 6462 return false; 6463 } 6464 6465 private: 6466 /// \brief Pick a representative for a sequence. 6467 unsigned representative(unsigned K) { 6468 if (Values[K].Merged) 6469 // Perform path compression as we go. 6470 return Values[K].Parent = representative(Values[K].Parent); 6471 return K; 6472 } 6473 }; 6474 6475 /// An object for which we can track unsequenced uses. 6476 typedef NamedDecl *Object; 6477 6478 /// Different flavors of object usage which we track. We only track the 6479 /// least-sequenced usage of each kind. 6480 enum UsageKind { 6481 /// A read of an object. Multiple unsequenced reads are OK. 6482 UK_Use, 6483 /// A modification of an object which is sequenced before the value 6484 /// computation of the expression, such as ++n in C++. 6485 UK_ModAsValue, 6486 /// A modification of an object which is not sequenced before the value 6487 /// computation of the expression, such as n++. 6488 UK_ModAsSideEffect, 6489 6490 UK_Count = UK_ModAsSideEffect + 1 6491 }; 6492 6493 struct Usage { 6494 Usage() : Use(nullptr), Seq() {} 6495 Expr *Use; 6496 SequenceTree::Seq Seq; 6497 }; 6498 6499 struct UsageInfo { 6500 UsageInfo() : Diagnosed(false) {} 6501 Usage Uses[UK_Count]; 6502 /// Have we issued a diagnostic for this variable already? 6503 bool Diagnosed; 6504 }; 6505 typedef llvm::SmallDenseMap<Object, UsageInfo, 16> UsageInfoMap; 6506 6507 Sema &SemaRef; 6508 /// Sequenced regions within the expression. 6509 SequenceTree Tree; 6510 /// Declaration modifications and references which we have seen. 6511 UsageInfoMap UsageMap; 6512 /// The region we are currently within. 6513 SequenceTree::Seq Region; 6514 /// Filled in with declarations which were modified as a side-effect 6515 /// (that is, post-increment operations). 6516 SmallVectorImpl<std::pair<Object, Usage> > *ModAsSideEffect; 6517 /// Expressions to check later. We defer checking these to reduce 6518 /// stack usage. 6519 SmallVectorImpl<Expr *> &WorkList; 6520 6521 /// RAII object wrapping the visitation of a sequenced subexpression of an 6522 /// expression. At the end of this process, the side-effects of the evaluation 6523 /// become sequenced with respect to the value computation of the result, so 6524 /// we downgrade any UK_ModAsSideEffect within the evaluation to 6525 /// UK_ModAsValue. 6526 struct SequencedSubexpression { 6527 SequencedSubexpression(SequenceChecker &Self) 6528 : Self(Self), OldModAsSideEffect(Self.ModAsSideEffect) { 6529 Self.ModAsSideEffect = &ModAsSideEffect; 6530 } 6531 ~SequencedSubexpression() { 6532 for (unsigned I = 0, E = ModAsSideEffect.size(); I != E; ++I) { 6533 UsageInfo &U = Self.UsageMap[ModAsSideEffect[I].first]; 6534 U.Uses[UK_ModAsSideEffect] = ModAsSideEffect[I].second; 6535 Self.addUsage(U, ModAsSideEffect[I].first, 6536 ModAsSideEffect[I].second.Use, UK_ModAsValue); 6537 } 6538 Self.ModAsSideEffect = OldModAsSideEffect; 6539 } 6540 6541 SequenceChecker &Self; 6542 SmallVector<std::pair<Object, Usage>, 4> ModAsSideEffect; 6543 SmallVectorImpl<std::pair<Object, Usage> > *OldModAsSideEffect; 6544 }; 6545 6546 /// RAII object wrapping the visitation of a subexpression which we might 6547 /// choose to evaluate as a constant. If any subexpression is evaluated and 6548 /// found to be non-constant, this allows us to suppress the evaluation of 6549 /// the outer expression. 6550 class EvaluationTracker { 6551 public: 6552 EvaluationTracker(SequenceChecker &Self) 6553 : Self(Self), Prev(Self.EvalTracker), EvalOK(true) { 6554 Self.EvalTracker = this; 6555 } 6556 ~EvaluationTracker() { 6557 Self.EvalTracker = Prev; 6558 if (Prev) 6559 Prev->EvalOK &= EvalOK; 6560 } 6561 6562 bool evaluate(const Expr *E, bool &Result) { 6563 if (!EvalOK || E->isValueDependent()) 6564 return false; 6565 EvalOK = E->EvaluateAsBooleanCondition(Result, Self.SemaRef.Context); 6566 return EvalOK; 6567 } 6568 6569 private: 6570 SequenceChecker &Self; 6571 EvaluationTracker *Prev; 6572 bool EvalOK; 6573 } *EvalTracker; 6574 6575 /// \brief Find the object which is produced by the specified expression, 6576 /// if any. 6577 Object getObject(Expr *E, bool Mod) const { 6578 E = E->IgnoreParenCasts(); 6579 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) { 6580 if (Mod && (UO->getOpcode() == UO_PreInc || UO->getOpcode() == UO_PreDec)) 6581 return getObject(UO->getSubExpr(), Mod); 6582 } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) { 6583 if (BO->getOpcode() == BO_Comma) 6584 return getObject(BO->getRHS(), Mod); 6585 if (Mod && BO->isAssignmentOp()) 6586 return getObject(BO->getLHS(), Mod); 6587 } else if (MemberExpr *ME = dyn_cast<MemberExpr>(E)) { 6588 // FIXME: Check for more interesting cases, like "x.n = ++x.n". 6589 if (isa<CXXThisExpr>(ME->getBase()->IgnoreParenCasts())) 6590 return ME->getMemberDecl(); 6591 } else if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) 6592 // FIXME: If this is a reference, map through to its value. 6593 return DRE->getDecl(); 6594 return nullptr; 6595 } 6596 6597 /// \brief Note that an object was modified or used by an expression. 6598 void addUsage(UsageInfo &UI, Object O, Expr *Ref, UsageKind UK) { 6599 Usage &U = UI.Uses[UK]; 6600 if (!U.Use || !Tree.isUnsequenced(Region, U.Seq)) { 6601 if (UK == UK_ModAsSideEffect && ModAsSideEffect) 6602 ModAsSideEffect->push_back(std::make_pair(O, U)); 6603 U.Use = Ref; 6604 U.Seq = Region; 6605 } 6606 } 6607 /// \brief Check whether a modification or use conflicts with a prior usage. 6608 void checkUsage(Object O, UsageInfo &UI, Expr *Ref, UsageKind OtherKind, 6609 bool IsModMod) { 6610 if (UI.Diagnosed) 6611 return; 6612 6613 const Usage &U = UI.Uses[OtherKind]; 6614 if (!U.Use || !Tree.isUnsequenced(Region, U.Seq)) 6615 return; 6616 6617 Expr *Mod = U.Use; 6618 Expr *ModOrUse = Ref; 6619 if (OtherKind == UK_Use) 6620 std::swap(Mod, ModOrUse); 6621 6622 SemaRef.Diag(Mod->getExprLoc(), 6623 IsModMod ? diag::warn_unsequenced_mod_mod 6624 : diag::warn_unsequenced_mod_use) 6625 << O << SourceRange(ModOrUse->getExprLoc()); 6626 UI.Diagnosed = true; 6627 } 6628 6629 void notePreUse(Object O, Expr *Use) { 6630 UsageInfo &U = UsageMap[O]; 6631 // Uses conflict with other modifications. 6632 checkUsage(O, U, Use, UK_ModAsValue, false); 6633 } 6634 void notePostUse(Object O, Expr *Use) { 6635 UsageInfo &U = UsageMap[O]; 6636 checkUsage(O, U, Use, UK_ModAsSideEffect, false); 6637 addUsage(U, O, Use, UK_Use); 6638 } 6639 6640 void notePreMod(Object O, Expr *Mod) { 6641 UsageInfo &U = UsageMap[O]; 6642 // Modifications conflict with other modifications and with uses. 6643 checkUsage(O, U, Mod, UK_ModAsValue, true); 6644 checkUsage(O, U, Mod, UK_Use, false); 6645 } 6646 void notePostMod(Object O, Expr *Use, UsageKind UK) { 6647 UsageInfo &U = UsageMap[O]; 6648 checkUsage(O, U, Use, UK_ModAsSideEffect, true); 6649 addUsage(U, O, Use, UK); 6650 } 6651 6652 public: 6653 SequenceChecker(Sema &S, Expr *E, SmallVectorImpl<Expr *> &WorkList) 6654 : Base(S.Context), SemaRef(S), Region(Tree.root()), 6655 ModAsSideEffect(nullptr), WorkList(WorkList), EvalTracker(nullptr) { 6656 Visit(E); 6657 } 6658 6659 void VisitStmt(Stmt *S) { 6660 // Skip all statements which aren't expressions for now. 6661 } 6662 6663 void VisitExpr(Expr *E) { 6664 // By default, just recurse to evaluated subexpressions. 6665 Base::VisitStmt(E); 6666 } 6667 6668 void VisitCastExpr(CastExpr *E) { 6669 Object O = Object(); 6670 if (E->getCastKind() == CK_LValueToRValue) 6671 O = getObject(E->getSubExpr(), false); 6672 6673 if (O) 6674 notePreUse(O, E); 6675 VisitExpr(E); 6676 if (O) 6677 notePostUse(O, E); 6678 } 6679 6680 void VisitBinComma(BinaryOperator *BO) { 6681 // C++11 [expr.comma]p1: 6682 // Every value computation and side effect associated with the left 6683 // expression is sequenced before every value computation and side 6684 // effect associated with the right expression. 6685 SequenceTree::Seq LHS = Tree.allocate(Region); 6686 SequenceTree::Seq RHS = Tree.allocate(Region); 6687 SequenceTree::Seq OldRegion = Region; 6688 6689 { 6690 SequencedSubexpression SeqLHS(*this); 6691 Region = LHS; 6692 Visit(BO->getLHS()); 6693 } 6694 6695 Region = RHS; 6696 Visit(BO->getRHS()); 6697 6698 Region = OldRegion; 6699 6700 // Forget that LHS and RHS are sequenced. They are both unsequenced 6701 // with respect to other stuff. 6702 Tree.merge(LHS); 6703 Tree.merge(RHS); 6704 } 6705 6706 void VisitBinAssign(BinaryOperator *BO) { 6707 // The modification is sequenced after the value computation of the LHS 6708 // and RHS, so check it before inspecting the operands and update the 6709 // map afterwards. 6710 Object O = getObject(BO->getLHS(), true); 6711 if (!O) 6712 return VisitExpr(BO); 6713 6714 notePreMod(O, BO); 6715 6716 // C++11 [expr.ass]p7: 6717 // E1 op= E2 is equivalent to E1 = E1 op E2, except that E1 is evaluated 6718 // only once. 6719 // 6720 // Therefore, for a compound assignment operator, O is considered used 6721 // everywhere except within the evaluation of E1 itself. 6722 if (isa<CompoundAssignOperator>(BO)) 6723 notePreUse(O, BO); 6724 6725 Visit(BO->getLHS()); 6726 6727 if (isa<CompoundAssignOperator>(BO)) 6728 notePostUse(O, BO); 6729 6730 Visit(BO->getRHS()); 6731 6732 // C++11 [expr.ass]p1: 6733 // the assignment is sequenced [...] before the value computation of the 6734 // assignment expression. 6735 // C11 6.5.16/3 has no such rule. 6736 notePostMod(O, BO, SemaRef.getLangOpts().CPlusPlus ? UK_ModAsValue 6737 : UK_ModAsSideEffect); 6738 } 6739 void VisitCompoundAssignOperator(CompoundAssignOperator *CAO) { 6740 VisitBinAssign(CAO); 6741 } 6742 6743 void VisitUnaryPreInc(UnaryOperator *UO) { VisitUnaryPreIncDec(UO); } 6744 void VisitUnaryPreDec(UnaryOperator *UO) { VisitUnaryPreIncDec(UO); } 6745 void VisitUnaryPreIncDec(UnaryOperator *UO) { 6746 Object O = getObject(UO->getSubExpr(), true); 6747 if (!O) 6748 return VisitExpr(UO); 6749 6750 notePreMod(O, UO); 6751 Visit(UO->getSubExpr()); 6752 // C++11 [expr.pre.incr]p1: 6753 // the expression ++x is equivalent to x+=1 6754 notePostMod(O, UO, SemaRef.getLangOpts().CPlusPlus ? UK_ModAsValue 6755 : UK_ModAsSideEffect); 6756 } 6757 6758 void VisitUnaryPostInc(UnaryOperator *UO) { VisitUnaryPostIncDec(UO); } 6759 void VisitUnaryPostDec(UnaryOperator *UO) { VisitUnaryPostIncDec(UO); } 6760 void VisitUnaryPostIncDec(UnaryOperator *UO) { 6761 Object O = getObject(UO->getSubExpr(), true); 6762 if (!O) 6763 return VisitExpr(UO); 6764 6765 notePreMod(O, UO); 6766 Visit(UO->getSubExpr()); 6767 notePostMod(O, UO, UK_ModAsSideEffect); 6768 } 6769 6770 /// Don't visit the RHS of '&&' or '||' if it might not be evaluated. 6771 void VisitBinLOr(BinaryOperator *BO) { 6772 // The side-effects of the LHS of an '&&' are sequenced before the 6773 // value computation of the RHS, and hence before the value computation 6774 // of the '&&' itself, unless the LHS evaluates to zero. We treat them 6775 // as if they were unconditionally sequenced. 6776 EvaluationTracker Eval(*this); 6777 { 6778 SequencedSubexpression Sequenced(*this); 6779 Visit(BO->getLHS()); 6780 } 6781 6782 bool Result; 6783 if (Eval.evaluate(BO->getLHS(), Result)) { 6784 if (!Result) 6785 Visit(BO->getRHS()); 6786 } else { 6787 // Check for unsequenced operations in the RHS, treating it as an 6788 // entirely separate evaluation. 6789 // 6790 // FIXME: If there are operations in the RHS which are unsequenced 6791 // with respect to operations outside the RHS, and those operations 6792 // are unconditionally evaluated, diagnose them. 6793 WorkList.push_back(BO->getRHS()); 6794 } 6795 } 6796 void VisitBinLAnd(BinaryOperator *BO) { 6797 EvaluationTracker Eval(*this); 6798 { 6799 SequencedSubexpression Sequenced(*this); 6800 Visit(BO->getLHS()); 6801 } 6802 6803 bool Result; 6804 if (Eval.evaluate(BO->getLHS(), Result)) { 6805 if (Result) 6806 Visit(BO->getRHS()); 6807 } else { 6808 WorkList.push_back(BO->getRHS()); 6809 } 6810 } 6811 6812 // Only visit the condition, unless we can be sure which subexpression will 6813 // be chosen. 6814 void VisitAbstractConditionalOperator(AbstractConditionalOperator *CO) { 6815 EvaluationTracker Eval(*this); 6816 { 6817 SequencedSubexpression Sequenced(*this); 6818 Visit(CO->getCond()); 6819 } 6820 6821 bool Result; 6822 if (Eval.evaluate(CO->getCond(), Result)) 6823 Visit(Result ? CO->getTrueExpr() : CO->getFalseExpr()); 6824 else { 6825 WorkList.push_back(CO->getTrueExpr()); 6826 WorkList.push_back(CO->getFalseExpr()); 6827 } 6828 } 6829 6830 void VisitCallExpr(CallExpr *CE) { 6831 // C++11 [intro.execution]p15: 6832 // When calling a function [...], every value computation and side effect 6833 // associated with any argument expression, or with the postfix expression 6834 // designating the called function, is sequenced before execution of every 6835 // expression or statement in the body of the function [and thus before 6836 // the value computation of its result]. 6837 SequencedSubexpression Sequenced(*this); 6838 Base::VisitCallExpr(CE); 6839 6840 // FIXME: CXXNewExpr and CXXDeleteExpr implicitly call functions. 6841 } 6842 6843 void VisitCXXConstructExpr(CXXConstructExpr *CCE) { 6844 // This is a call, so all subexpressions are sequenced before the result. 6845 SequencedSubexpression Sequenced(*this); 6846 6847 if (!CCE->isListInitialization()) 6848 return VisitExpr(CCE); 6849 6850 // In C++11, list initializations are sequenced. 6851 SmallVector<SequenceTree::Seq, 32> Elts; 6852 SequenceTree::Seq Parent = Region; 6853 for (CXXConstructExpr::arg_iterator I = CCE->arg_begin(), 6854 E = CCE->arg_end(); 6855 I != E; ++I) { 6856 Region = Tree.allocate(Parent); 6857 Elts.push_back(Region); 6858 Visit(*I); 6859 } 6860 6861 // Forget that the initializers are sequenced. 6862 Region = Parent; 6863 for (unsigned I = 0; I < Elts.size(); ++I) 6864 Tree.merge(Elts[I]); 6865 } 6866 6867 void VisitInitListExpr(InitListExpr *ILE) { 6868 if (!SemaRef.getLangOpts().CPlusPlus11) 6869 return VisitExpr(ILE); 6870 6871 // In C++11, list initializations are sequenced. 6872 SmallVector<SequenceTree::Seq, 32> Elts; 6873 SequenceTree::Seq Parent = Region; 6874 for (unsigned I = 0; I < ILE->getNumInits(); ++I) { 6875 Expr *E = ILE->getInit(I); 6876 if (!E) continue; 6877 Region = Tree.allocate(Parent); 6878 Elts.push_back(Region); 6879 Visit(E); 6880 } 6881 6882 // Forget that the initializers are sequenced. 6883 Region = Parent; 6884 for (unsigned I = 0; I < Elts.size(); ++I) 6885 Tree.merge(Elts[I]); 6886 } 6887 }; 6888 } 6889 6890 void Sema::CheckUnsequencedOperations(Expr *E) { 6891 SmallVector<Expr *, 8> WorkList; 6892 WorkList.push_back(E); 6893 while (!WorkList.empty()) { 6894 Expr *Item = WorkList.pop_back_val(); 6895 SequenceChecker(*this, Item, WorkList); 6896 } 6897 } 6898 6899 void Sema::CheckCompletedExpr(Expr *E, SourceLocation CheckLoc, 6900 bool IsConstexpr) { 6901 CheckImplicitConversions(E, CheckLoc); 6902 CheckUnsequencedOperations(E); 6903 if (!IsConstexpr && !E->isValueDependent()) 6904 CheckForIntOverflow(E); 6905 } 6906 6907 void Sema::CheckBitFieldInitialization(SourceLocation InitLoc, 6908 FieldDecl *BitField, 6909 Expr *Init) { 6910 (void) AnalyzeBitFieldAssignment(*this, BitField, Init, InitLoc); 6911 } 6912 6913 /// CheckParmsForFunctionDef - Check that the parameters of the given 6914 /// function are appropriate for the definition of a function. This 6915 /// takes care of any checks that cannot be performed on the 6916 /// declaration itself, e.g., that the types of each of the function 6917 /// parameters are complete. 6918 bool Sema::CheckParmsForFunctionDef(ParmVarDecl *const *P, 6919 ParmVarDecl *const *PEnd, 6920 bool CheckParameterNames) { 6921 bool HasInvalidParm = false; 6922 for (; P != PEnd; ++P) { 6923 ParmVarDecl *Param = *P; 6924 6925 // C99 6.7.5.3p4: the parameters in a parameter type list in a 6926 // function declarator that is part of a function definition of 6927 // that function shall not have incomplete type. 6928 // 6929 // This is also C++ [dcl.fct]p6. 6930 if (!Param->isInvalidDecl() && 6931 RequireCompleteType(Param->getLocation(), Param->getType(), 6932 diag::err_typecheck_decl_incomplete_type)) { 6933 Param->setInvalidDecl(); 6934 HasInvalidParm = true; 6935 } 6936 6937 // C99 6.9.1p5: If the declarator includes a parameter type list, the 6938 // declaration of each parameter shall include an identifier. 6939 if (CheckParameterNames && 6940 Param->getIdentifier() == nullptr && 6941 !Param->isImplicit() && 6942 !getLangOpts().CPlusPlus) 6943 Diag(Param->getLocation(), diag::err_parameter_name_omitted); 6944 6945 // C99 6.7.5.3p12: 6946 // If the function declarator is not part of a definition of that 6947 // function, parameters may have incomplete type and may use the [*] 6948 // notation in their sequences of declarator specifiers to specify 6949 // variable length array types. 6950 QualType PType = Param->getOriginalType(); 6951 while (const ArrayType *AT = Context.getAsArrayType(PType)) { 6952 if (AT->getSizeModifier() == ArrayType::Star) { 6953 // FIXME: This diagnostic should point the '[*]' if source-location 6954 // information is added for it. 6955 Diag(Param->getLocation(), diag::err_array_star_in_function_definition); 6956 break; 6957 } 6958 PType= AT->getElementType(); 6959 } 6960 6961 // MSVC destroys objects passed by value in the callee. Therefore a 6962 // function definition which takes such a parameter must be able to call the 6963 // object's destructor. However, we don't perform any direct access check 6964 // on the dtor. 6965 if (getLangOpts().CPlusPlus && Context.getTargetInfo() 6966 .getCXXABI() 6967 .areArgsDestroyedLeftToRightInCallee()) { 6968 if (!Param->isInvalidDecl()) { 6969 if (const RecordType *RT = Param->getType()->getAs<RecordType>()) { 6970 CXXRecordDecl *ClassDecl = cast<CXXRecordDecl>(RT->getDecl()); 6971 if (!ClassDecl->isInvalidDecl() && 6972 !ClassDecl->hasIrrelevantDestructor() && 6973 !ClassDecl->isDependentContext()) { 6974 CXXDestructorDecl *Destructor = LookupDestructor(ClassDecl); 6975 MarkFunctionReferenced(Param->getLocation(), Destructor); 6976 DiagnoseUseOfDecl(Destructor, Param->getLocation()); 6977 } 6978 } 6979 } 6980 } 6981 } 6982 6983 return HasInvalidParm; 6984 } 6985 6986 /// CheckCastAlign - Implements -Wcast-align, which warns when a 6987 /// pointer cast increases the alignment requirements. 6988 void Sema::CheckCastAlign(Expr *Op, QualType T, SourceRange TRange) { 6989 // This is actually a lot of work to potentially be doing on every 6990 // cast; don't do it if we're ignoring -Wcast_align (as is the default). 6991 if (getDiagnostics().isIgnored(diag::warn_cast_align, TRange.getBegin())) 6992 return; 6993 6994 // Ignore dependent types. 6995 if (T->isDependentType() || Op->getType()->isDependentType()) 6996 return; 6997 6998 // Require that the destination be a pointer type. 6999 const PointerType *DestPtr = T->getAs<PointerType>(); 7000 if (!DestPtr) return; 7001 7002 // If the destination has alignment 1, we're done. 7003 QualType DestPointee = DestPtr->getPointeeType(); 7004 if (DestPointee->isIncompleteType()) return; 7005 CharUnits DestAlign = Context.getTypeAlignInChars(DestPointee); 7006 if (DestAlign.isOne()) return; 7007 7008 // Require that the source be a pointer type. 7009 const PointerType *SrcPtr = Op->getType()->getAs<PointerType>(); 7010 if (!SrcPtr) return; 7011 QualType SrcPointee = SrcPtr->getPointeeType(); 7012 7013 // Whitelist casts from cv void*. We already implicitly 7014 // whitelisted casts to cv void*, since they have alignment 1. 7015 // Also whitelist casts involving incomplete types, which implicitly 7016 // includes 'void'. 7017 if (SrcPointee->isIncompleteType()) return; 7018 7019 CharUnits SrcAlign = Context.getTypeAlignInChars(SrcPointee); 7020 if (SrcAlign >= DestAlign) return; 7021 7022 Diag(TRange.getBegin(), diag::warn_cast_align) 7023 << Op->getType() << T 7024 << static_cast<unsigned>(SrcAlign.getQuantity()) 7025 << static_cast<unsigned>(DestAlign.getQuantity()) 7026 << TRange << Op->getSourceRange(); 7027 } 7028 7029 static const Type* getElementType(const Expr *BaseExpr) { 7030 const Type* EltType = BaseExpr->getType().getTypePtr(); 7031 if (EltType->isAnyPointerType()) 7032 return EltType->getPointeeType().getTypePtr(); 7033 else if (EltType->isArrayType()) 7034 return EltType->getBaseElementTypeUnsafe(); 7035 return EltType; 7036 } 7037 7038 /// \brief Check whether this array fits the idiom of a size-one tail padded 7039 /// array member of a struct. 7040 /// 7041 /// We avoid emitting out-of-bounds access warnings for such arrays as they are 7042 /// commonly used to emulate flexible arrays in C89 code. 7043 static bool IsTailPaddedMemberArray(Sema &S, llvm::APInt Size, 7044 const NamedDecl *ND) { 7045 if (Size != 1 || !ND) return false; 7046 7047 const FieldDecl *FD = dyn_cast<FieldDecl>(ND); 7048 if (!FD) return false; 7049 7050 // Don't consider sizes resulting from macro expansions or template argument 7051 // substitution to form C89 tail-padded arrays. 7052 7053 TypeSourceInfo *TInfo = FD->getTypeSourceInfo(); 7054 while (TInfo) { 7055 TypeLoc TL = TInfo->getTypeLoc(); 7056 // Look through typedefs. 7057 if (TypedefTypeLoc TTL = TL.getAs<TypedefTypeLoc>()) { 7058 const TypedefNameDecl *TDL = TTL.getTypedefNameDecl(); 7059 TInfo = TDL->getTypeSourceInfo(); 7060 continue; 7061 } 7062 if (ConstantArrayTypeLoc CTL = TL.getAs<ConstantArrayTypeLoc>()) { 7063 const Expr *SizeExpr = dyn_cast<IntegerLiteral>(CTL.getSizeExpr()); 7064 if (!SizeExpr || SizeExpr->getExprLoc().isMacroID()) 7065 return false; 7066 } 7067 break; 7068 } 7069 7070 const RecordDecl *RD = dyn_cast<RecordDecl>(FD->getDeclContext()); 7071 if (!RD) return false; 7072 if (RD->isUnion()) return false; 7073 if (const CXXRecordDecl *CRD = dyn_cast<CXXRecordDecl>(RD)) { 7074 if (!CRD->isStandardLayout()) return false; 7075 } 7076 7077 // See if this is the last field decl in the record. 7078 const Decl *D = FD; 7079 while ((D = D->getNextDeclInContext())) 7080 if (isa<FieldDecl>(D)) 7081 return false; 7082 return true; 7083 } 7084 7085 void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr, 7086 const ArraySubscriptExpr *ASE, 7087 bool AllowOnePastEnd, bool IndexNegated) { 7088 IndexExpr = IndexExpr->IgnoreParenImpCasts(); 7089 if (IndexExpr->isValueDependent()) 7090 return; 7091 7092 const Type *EffectiveType = getElementType(BaseExpr); 7093 BaseExpr = BaseExpr->IgnoreParenCasts(); 7094 const ConstantArrayType *ArrayTy = 7095 Context.getAsConstantArrayType(BaseExpr->getType()); 7096 if (!ArrayTy) 7097 return; 7098 7099 llvm::APSInt index; 7100 if (!IndexExpr->EvaluateAsInt(index, Context)) 7101 return; 7102 if (IndexNegated) 7103 index = -index; 7104 7105 const NamedDecl *ND = nullptr; 7106 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr)) 7107 ND = dyn_cast<NamedDecl>(DRE->getDecl()); 7108 if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr)) 7109 ND = dyn_cast<NamedDecl>(ME->getMemberDecl()); 7110 7111 if (index.isUnsigned() || !index.isNegative()) { 7112 llvm::APInt size = ArrayTy->getSize(); 7113 if (!size.isStrictlyPositive()) 7114 return; 7115 7116 const Type* BaseType = getElementType(BaseExpr); 7117 if (BaseType != EffectiveType) { 7118 // Make sure we're comparing apples to apples when comparing index to size 7119 uint64_t ptrarith_typesize = Context.getTypeSize(EffectiveType); 7120 uint64_t array_typesize = Context.getTypeSize(BaseType); 7121 // Handle ptrarith_typesize being zero, such as when casting to void* 7122 if (!ptrarith_typesize) ptrarith_typesize = 1; 7123 if (ptrarith_typesize != array_typesize) { 7124 // There's a cast to a different size type involved 7125 uint64_t ratio = array_typesize / ptrarith_typesize; 7126 // TODO: Be smarter about handling cases where array_typesize is not a 7127 // multiple of ptrarith_typesize 7128 if (ptrarith_typesize * ratio == array_typesize) 7129 size *= llvm::APInt(size.getBitWidth(), ratio); 7130 } 7131 } 7132 7133 if (size.getBitWidth() > index.getBitWidth()) 7134 index = index.zext(size.getBitWidth()); 7135 else if (size.getBitWidth() < index.getBitWidth()) 7136 size = size.zext(index.getBitWidth()); 7137 7138 // For array subscripting the index must be less than size, but for pointer 7139 // arithmetic also allow the index (offset) to be equal to size since 7140 // computing the next address after the end of the array is legal and 7141 // commonly done e.g. in C++ iterators and range-based for loops. 7142 if (AllowOnePastEnd ? index.ule(size) : index.ult(size)) 7143 return; 7144 7145 // Also don't warn for arrays of size 1 which are members of some 7146 // structure. These are often used to approximate flexible arrays in C89 7147 // code. 7148 if (IsTailPaddedMemberArray(*this, size, ND)) 7149 return; 7150 7151 // Suppress the warning if the subscript expression (as identified by the 7152 // ']' location) and the index expression are both from macro expansions 7153 // within a system header. 7154 if (ASE) { 7155 SourceLocation RBracketLoc = SourceMgr.getSpellingLoc( 7156 ASE->getRBracketLoc()); 7157 if (SourceMgr.isInSystemHeader(RBracketLoc)) { 7158 SourceLocation IndexLoc = SourceMgr.getSpellingLoc( 7159 IndexExpr->getLocStart()); 7160 if (SourceMgr.isWrittenInSameFile(RBracketLoc, IndexLoc)) 7161 return; 7162 } 7163 } 7164 7165 unsigned DiagID = diag::warn_ptr_arith_exceeds_bounds; 7166 if (ASE) 7167 DiagID = diag::warn_array_index_exceeds_bounds; 7168 7169 DiagRuntimeBehavior(BaseExpr->getLocStart(), BaseExpr, 7170 PDiag(DiagID) << index.toString(10, true) 7171 << size.toString(10, true) 7172 << (unsigned)size.getLimitedValue(~0U) 7173 << IndexExpr->getSourceRange()); 7174 } else { 7175 unsigned DiagID = diag::warn_array_index_precedes_bounds; 7176 if (!ASE) { 7177 DiagID = diag::warn_ptr_arith_precedes_bounds; 7178 if (index.isNegative()) index = -index; 7179 } 7180 7181 DiagRuntimeBehavior(BaseExpr->getLocStart(), BaseExpr, 7182 PDiag(DiagID) << index.toString(10, true) 7183 << IndexExpr->getSourceRange()); 7184 } 7185 7186 if (!ND) { 7187 // Try harder to find a NamedDecl to point at in the note. 7188 while (const ArraySubscriptExpr *ASE = 7189 dyn_cast<ArraySubscriptExpr>(BaseExpr)) 7190 BaseExpr = ASE->getBase()->IgnoreParenCasts(); 7191 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr)) 7192 ND = dyn_cast<NamedDecl>(DRE->getDecl()); 7193 if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr)) 7194 ND = dyn_cast<NamedDecl>(ME->getMemberDecl()); 7195 } 7196 7197 if (ND) 7198 DiagRuntimeBehavior(ND->getLocStart(), BaseExpr, 7199 PDiag(diag::note_array_index_out_of_bounds) 7200 << ND->getDeclName()); 7201 } 7202 7203 void Sema::CheckArrayAccess(const Expr *expr) { 7204 int AllowOnePastEnd = 0; 7205 while (expr) { 7206 expr = expr->IgnoreParenImpCasts(); 7207 switch (expr->getStmtClass()) { 7208 case Stmt::ArraySubscriptExprClass: { 7209 const ArraySubscriptExpr *ASE = cast<ArraySubscriptExpr>(expr); 7210 CheckArrayAccess(ASE->getBase(), ASE->getIdx(), ASE, 7211 AllowOnePastEnd > 0); 7212 return; 7213 } 7214 case Stmt::UnaryOperatorClass: { 7215 // Only unwrap the * and & unary operators 7216 const UnaryOperator *UO = cast<UnaryOperator>(expr); 7217 expr = UO->getSubExpr(); 7218 switch (UO->getOpcode()) { 7219 case UO_AddrOf: 7220 AllowOnePastEnd++; 7221 break; 7222 case UO_Deref: 7223 AllowOnePastEnd--; 7224 break; 7225 default: 7226 return; 7227 } 7228 break; 7229 } 7230 case Stmt::ConditionalOperatorClass: { 7231 const ConditionalOperator *cond = cast<ConditionalOperator>(expr); 7232 if (const Expr *lhs = cond->getLHS()) 7233 CheckArrayAccess(lhs); 7234 if (const Expr *rhs = cond->getRHS()) 7235 CheckArrayAccess(rhs); 7236 return; 7237 } 7238 default: 7239 return; 7240 } 7241 } 7242 } 7243 7244 //===--- CHECK: Objective-C retain cycles ----------------------------------// 7245 7246 namespace { 7247 struct RetainCycleOwner { 7248 RetainCycleOwner() : Variable(nullptr), Indirect(false) {} 7249 VarDecl *Variable; 7250 SourceRange Range; 7251 SourceLocation Loc; 7252 bool Indirect; 7253 7254 void setLocsFrom(Expr *e) { 7255 Loc = e->getExprLoc(); 7256 Range = e->getSourceRange(); 7257 } 7258 }; 7259 } 7260 7261 /// Consider whether capturing the given variable can possibly lead to 7262 /// a retain cycle. 7263 static bool considerVariable(VarDecl *var, Expr *ref, RetainCycleOwner &owner) { 7264 // In ARC, it's captured strongly iff the variable has __strong 7265 // lifetime. In MRR, it's captured strongly if the variable is 7266 // __block and has an appropriate type. 7267 if (var->getType().getObjCLifetime() != Qualifiers::OCL_Strong) 7268 return false; 7269 7270 owner.Variable = var; 7271 if (ref) 7272 owner.setLocsFrom(ref); 7273 return true; 7274 } 7275 7276 static bool findRetainCycleOwner(Sema &S, Expr *e, RetainCycleOwner &owner) { 7277 while (true) { 7278 e = e->IgnoreParens(); 7279 if (CastExpr *cast = dyn_cast<CastExpr>(e)) { 7280 switch (cast->getCastKind()) { 7281 case CK_BitCast: 7282 case CK_LValueBitCast: 7283 case CK_LValueToRValue: 7284 case CK_ARCReclaimReturnedObject: 7285 e = cast->getSubExpr(); 7286 continue; 7287 7288 default: 7289 return false; 7290 } 7291 } 7292 7293 if (ObjCIvarRefExpr *ref = dyn_cast<ObjCIvarRefExpr>(e)) { 7294 ObjCIvarDecl *ivar = ref->getDecl(); 7295 if (ivar->getType().getObjCLifetime() != Qualifiers::OCL_Strong) 7296 return false; 7297 7298 // Try to find a retain cycle in the base. 7299 if (!findRetainCycleOwner(S, ref->getBase(), owner)) 7300 return false; 7301 7302 if (ref->isFreeIvar()) owner.setLocsFrom(ref); 7303 owner.Indirect = true; 7304 return true; 7305 } 7306 7307 if (DeclRefExpr *ref = dyn_cast<DeclRefExpr>(e)) { 7308 VarDecl *var = dyn_cast<VarDecl>(ref->getDecl()); 7309 if (!var) return false; 7310 return considerVariable(var, ref, owner); 7311 } 7312 7313 if (MemberExpr *member = dyn_cast<MemberExpr>(e)) { 7314 if (member->isArrow()) return false; 7315 7316 // Don't count this as an indirect ownership. 7317 e = member->getBase(); 7318 continue; 7319 } 7320 7321 if (PseudoObjectExpr *pseudo = dyn_cast<PseudoObjectExpr>(e)) { 7322 // Only pay attention to pseudo-objects on property references. 7323 ObjCPropertyRefExpr *pre 7324 = dyn_cast<ObjCPropertyRefExpr>(pseudo->getSyntacticForm() 7325 ->IgnoreParens()); 7326 if (!pre) return false; 7327 if (pre->isImplicitProperty()) return false; 7328 ObjCPropertyDecl *property = pre->getExplicitProperty(); 7329 if (!property->isRetaining() && 7330 !(property->getPropertyIvarDecl() && 7331 property->getPropertyIvarDecl()->getType() 7332 .getObjCLifetime() == Qualifiers::OCL_Strong)) 7333 return false; 7334 7335 owner.Indirect = true; 7336 if (pre->isSuperReceiver()) { 7337 owner.Variable = S.getCurMethodDecl()->getSelfDecl(); 7338 if (!owner.Variable) 7339 return false; 7340 owner.Loc = pre->getLocation(); 7341 owner.Range = pre->getSourceRange(); 7342 return true; 7343 } 7344 e = const_cast<Expr*>(cast<OpaqueValueExpr>(pre->getBase()) 7345 ->getSourceExpr()); 7346 continue; 7347 } 7348 7349 // Array ivars? 7350 7351 return false; 7352 } 7353 } 7354 7355 namespace { 7356 struct FindCaptureVisitor : EvaluatedExprVisitor<FindCaptureVisitor> { 7357 FindCaptureVisitor(ASTContext &Context, VarDecl *variable) 7358 : EvaluatedExprVisitor<FindCaptureVisitor>(Context), 7359 Context(Context), Variable(variable), Capturer(nullptr), 7360 VarWillBeReased(false) {} 7361 ASTContext &Context; 7362 VarDecl *Variable; 7363 Expr *Capturer; 7364 bool VarWillBeReased; 7365 7366 void VisitDeclRefExpr(DeclRefExpr *ref) { 7367 if (ref->getDecl() == Variable && !Capturer) 7368 Capturer = ref; 7369 } 7370 7371 void VisitObjCIvarRefExpr(ObjCIvarRefExpr *ref) { 7372 if (Capturer) return; 7373 Visit(ref->getBase()); 7374 if (Capturer && ref->isFreeIvar()) 7375 Capturer = ref; 7376 } 7377 7378 void VisitBlockExpr(BlockExpr *block) { 7379 // Look inside nested blocks 7380 if (block->getBlockDecl()->capturesVariable(Variable)) 7381 Visit(block->getBlockDecl()->getBody()); 7382 } 7383 7384 void VisitOpaqueValueExpr(OpaqueValueExpr *OVE) { 7385 if (Capturer) return; 7386 if (OVE->getSourceExpr()) 7387 Visit(OVE->getSourceExpr()); 7388 } 7389 void VisitBinaryOperator(BinaryOperator *BinOp) { 7390 if (!Variable || VarWillBeReased || BinOp->getOpcode() != BO_Assign) 7391 return; 7392 Expr *LHS = BinOp->getLHS(); 7393 if (const DeclRefExpr *DRE = dyn_cast_or_null<DeclRefExpr>(LHS)) { 7394 if (DRE->getDecl() != Variable) 7395 return; 7396 if (Expr *RHS = BinOp->getRHS()) { 7397 RHS = RHS->IgnoreParenCasts(); 7398 llvm::APSInt Value; 7399 VarWillBeReased = 7400 (RHS && RHS->isIntegerConstantExpr(Value, Context) && Value == 0); 7401 } 7402 } 7403 } 7404 }; 7405 } 7406 7407 /// Check whether the given argument is a block which captures a 7408 /// variable. 7409 static Expr *findCapturingExpr(Sema &S, Expr *e, RetainCycleOwner &owner) { 7410 assert(owner.Variable && owner.Loc.isValid()); 7411 7412 e = e->IgnoreParenCasts(); 7413 7414 // Look through [^{...} copy] and Block_copy(^{...}). 7415 if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(e)) { 7416 Selector Cmd = ME->getSelector(); 7417 if (Cmd.isUnarySelector() && Cmd.getNameForSlot(0) == "copy") { 7418 e = ME->getInstanceReceiver(); 7419 if (!e) 7420 return nullptr; 7421 e = e->IgnoreParenCasts(); 7422 } 7423 } else if (CallExpr *CE = dyn_cast<CallExpr>(e)) { 7424 if (CE->getNumArgs() == 1) { 7425 FunctionDecl *Fn = dyn_cast_or_null<FunctionDecl>(CE->getCalleeDecl()); 7426 if (Fn) { 7427 const IdentifierInfo *FnI = Fn->getIdentifier(); 7428 if (FnI && FnI->isStr("_Block_copy")) { 7429 e = CE->getArg(0)->IgnoreParenCasts(); 7430 } 7431 } 7432 } 7433 } 7434 7435 BlockExpr *block = dyn_cast<BlockExpr>(e); 7436 if (!block || !block->getBlockDecl()->capturesVariable(owner.Variable)) 7437 return nullptr; 7438 7439 FindCaptureVisitor visitor(S.Context, owner.Variable); 7440 visitor.Visit(block->getBlockDecl()->getBody()); 7441 return visitor.VarWillBeReased ? nullptr : visitor.Capturer; 7442 } 7443 7444 static void diagnoseRetainCycle(Sema &S, Expr *capturer, 7445 RetainCycleOwner &owner) { 7446 assert(capturer); 7447 assert(owner.Variable && owner.Loc.isValid()); 7448 7449 S.Diag(capturer->getExprLoc(), diag::warn_arc_retain_cycle) 7450 << owner.Variable << capturer->getSourceRange(); 7451 S.Diag(owner.Loc, diag::note_arc_retain_cycle_owner) 7452 << owner.Indirect << owner.Range; 7453 } 7454 7455 /// Check for a keyword selector that starts with the word 'add' or 7456 /// 'set'. 7457 static bool isSetterLikeSelector(Selector sel) { 7458 if (sel.isUnarySelector()) return false; 7459 7460 StringRef str = sel.getNameForSlot(0); 7461 while (!str.empty() && str.front() == '_') str = str.substr(1); 7462 if (str.startswith("set")) 7463 str = str.substr(3); 7464 else if (str.startswith("add")) { 7465 // Specially whitelist 'addOperationWithBlock:'. 7466 if (sel.getNumArgs() == 1 && str.startswith("addOperationWithBlock")) 7467 return false; 7468 str = str.substr(3); 7469 } 7470 else 7471 return false; 7472 7473 if (str.empty()) return true; 7474 return !isLowercase(str.front()); 7475 } 7476 7477 /// Check a message send to see if it's likely to cause a retain cycle. 7478 void Sema::checkRetainCycles(ObjCMessageExpr *msg) { 7479 // Only check instance methods whose selector looks like a setter. 7480 if (!msg->isInstanceMessage() || !isSetterLikeSelector(msg->getSelector())) 7481 return; 7482 7483 // Try to find a variable that the receiver is strongly owned by. 7484 RetainCycleOwner owner; 7485 if (msg->getReceiverKind() == ObjCMessageExpr::Instance) { 7486 if (!findRetainCycleOwner(*this, msg->getInstanceReceiver(), owner)) 7487 return; 7488 } else { 7489 assert(msg->getReceiverKind() == ObjCMessageExpr::SuperInstance); 7490 owner.Variable = getCurMethodDecl()->getSelfDecl(); 7491 owner.Loc = msg->getSuperLoc(); 7492 owner.Range = msg->getSuperLoc(); 7493 } 7494 7495 // Check whether the receiver is captured by any of the arguments. 7496 for (unsigned i = 0, e = msg->getNumArgs(); i != e; ++i) 7497 if (Expr *capturer = findCapturingExpr(*this, msg->getArg(i), owner)) 7498 return diagnoseRetainCycle(*this, capturer, owner); 7499 } 7500 7501 /// Check a property assign to see if it's likely to cause a retain cycle. 7502 void Sema::checkRetainCycles(Expr *receiver, Expr *argument) { 7503 RetainCycleOwner owner; 7504 if (!findRetainCycleOwner(*this, receiver, owner)) 7505 return; 7506 7507 if (Expr *capturer = findCapturingExpr(*this, argument, owner)) 7508 diagnoseRetainCycle(*this, capturer, owner); 7509 } 7510 7511 void Sema::checkRetainCycles(VarDecl *Var, Expr *Init) { 7512 RetainCycleOwner Owner; 7513 if (!considerVariable(Var, /*DeclRefExpr=*/nullptr, Owner)) 7514 return; 7515 7516 // Because we don't have an expression for the variable, we have to set the 7517 // location explicitly here. 7518 Owner.Loc = Var->getLocation(); 7519 Owner.Range = Var->getSourceRange(); 7520 7521 if (Expr *Capturer = findCapturingExpr(*this, Init, Owner)) 7522 diagnoseRetainCycle(*this, Capturer, Owner); 7523 } 7524 7525 static bool checkUnsafeAssignLiteral(Sema &S, SourceLocation Loc, 7526 Expr *RHS, bool isProperty) { 7527 // Check if RHS is an Objective-C object literal, which also can get 7528 // immediately zapped in a weak reference. Note that we explicitly 7529 // allow ObjCStringLiterals, since those are designed to never really die. 7530 RHS = RHS->IgnoreParenImpCasts(); 7531 7532 // This enum needs to match with the 'select' in 7533 // warn_objc_arc_literal_assign (off-by-1). 7534 Sema::ObjCLiteralKind Kind = S.CheckLiteralKind(RHS); 7535 if (Kind == Sema::LK_String || Kind == Sema::LK_None) 7536 return false; 7537 7538 S.Diag(Loc, diag::warn_arc_literal_assign) 7539 << (unsigned) Kind 7540 << (isProperty ? 0 : 1) 7541 << RHS->getSourceRange(); 7542 7543 return true; 7544 } 7545 7546 static bool checkUnsafeAssignObject(Sema &S, SourceLocation Loc, 7547 Qualifiers::ObjCLifetime LT, 7548 Expr *RHS, bool isProperty) { 7549 // Strip off any implicit cast added to get to the one ARC-specific. 7550 while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(RHS)) { 7551 if (cast->getCastKind() == CK_ARCConsumeObject) { 7552 S.Diag(Loc, diag::warn_arc_retained_assign) 7553 << (LT == Qualifiers::OCL_ExplicitNone) 7554 << (isProperty ? 0 : 1) 7555 << RHS->getSourceRange(); 7556 return true; 7557 } 7558 RHS = cast->getSubExpr(); 7559 } 7560 7561 if (LT == Qualifiers::OCL_Weak && 7562 checkUnsafeAssignLiteral(S, Loc, RHS, isProperty)) 7563 return true; 7564 7565 return false; 7566 } 7567 7568 bool Sema::checkUnsafeAssigns(SourceLocation Loc, 7569 QualType LHS, Expr *RHS) { 7570 Qualifiers::ObjCLifetime LT = LHS.getObjCLifetime(); 7571 7572 if (LT != Qualifiers::OCL_Weak && LT != Qualifiers::OCL_ExplicitNone) 7573 return false; 7574 7575 if (checkUnsafeAssignObject(*this, Loc, LT, RHS, false)) 7576 return true; 7577 7578 return false; 7579 } 7580 7581 void Sema::checkUnsafeExprAssigns(SourceLocation Loc, 7582 Expr *LHS, Expr *RHS) { 7583 QualType LHSType; 7584 // PropertyRef on LHS type need be directly obtained from 7585 // its declaration as it has a PseudoType. 7586 ObjCPropertyRefExpr *PRE 7587 = dyn_cast<ObjCPropertyRefExpr>(LHS->IgnoreParens()); 7588 if (PRE && !PRE->isImplicitProperty()) { 7589 const ObjCPropertyDecl *PD = PRE->getExplicitProperty(); 7590 if (PD) 7591 LHSType = PD->getType(); 7592 } 7593 7594 if (LHSType.isNull()) 7595 LHSType = LHS->getType(); 7596 7597 Qualifiers::ObjCLifetime LT = LHSType.getObjCLifetime(); 7598 7599 if (LT == Qualifiers::OCL_Weak) { 7600 if (!Diags.isIgnored(diag::warn_arc_repeated_use_of_weak, Loc)) 7601 getCurFunction()->markSafeWeakUse(LHS); 7602 } 7603 7604 if (checkUnsafeAssigns(Loc, LHSType, RHS)) 7605 return; 7606 7607 // FIXME. Check for other life times. 7608 if (LT != Qualifiers::OCL_None) 7609 return; 7610 7611 if (PRE) { 7612 if (PRE->isImplicitProperty()) 7613 return; 7614 const ObjCPropertyDecl *PD = PRE->getExplicitProperty(); 7615 if (!PD) 7616 return; 7617 7618 unsigned Attributes = PD->getPropertyAttributes(); 7619 if (Attributes & ObjCPropertyDecl::OBJC_PR_assign) { 7620 // when 'assign' attribute was not explicitly specified 7621 // by user, ignore it and rely on property type itself 7622 // for lifetime info. 7623 unsigned AsWrittenAttr = PD->getPropertyAttributesAsWritten(); 7624 if (!(AsWrittenAttr & ObjCPropertyDecl::OBJC_PR_assign) && 7625 LHSType->isObjCRetainableType()) 7626 return; 7627 7628 while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(RHS)) { 7629 if (cast->getCastKind() == CK_ARCConsumeObject) { 7630 Diag(Loc, diag::warn_arc_retained_property_assign) 7631 << RHS->getSourceRange(); 7632 return; 7633 } 7634 RHS = cast->getSubExpr(); 7635 } 7636 } 7637 else if (Attributes & ObjCPropertyDecl::OBJC_PR_weak) { 7638 if (checkUnsafeAssignObject(*this, Loc, Qualifiers::OCL_Weak, RHS, true)) 7639 return; 7640 } 7641 } 7642 } 7643 7644 //===--- CHECK: Empty statement body (-Wempty-body) ---------------------===// 7645 7646 namespace { 7647 bool ShouldDiagnoseEmptyStmtBody(const SourceManager &SourceMgr, 7648 SourceLocation StmtLoc, 7649 const NullStmt *Body) { 7650 // Do not warn if the body is a macro that expands to nothing, e.g: 7651 // 7652 // #define CALL(x) 7653 // if (condition) 7654 // CALL(0); 7655 // 7656 if (Body->hasLeadingEmptyMacro()) 7657 return false; 7658 7659 // Get line numbers of statement and body. 7660 bool StmtLineInvalid; 7661 unsigned StmtLine = SourceMgr.getSpellingLineNumber(StmtLoc, 7662 &StmtLineInvalid); 7663 if (StmtLineInvalid) 7664 return false; 7665 7666 bool BodyLineInvalid; 7667 unsigned BodyLine = SourceMgr.getSpellingLineNumber(Body->getSemiLoc(), 7668 &BodyLineInvalid); 7669 if (BodyLineInvalid) 7670 return false; 7671 7672 // Warn if null statement and body are on the same line. 7673 if (StmtLine != BodyLine) 7674 return false; 7675 7676 return true; 7677 } 7678 } // Unnamed namespace 7679 7680 void Sema::DiagnoseEmptyStmtBody(SourceLocation StmtLoc, 7681 const Stmt *Body, 7682 unsigned DiagID) { 7683 // Since this is a syntactic check, don't emit diagnostic for template 7684 // instantiations, this just adds noise. 7685 if (CurrentInstantiationScope) 7686 return; 7687 7688 // The body should be a null statement. 7689 const NullStmt *NBody = dyn_cast<NullStmt>(Body); 7690 if (!NBody) 7691 return; 7692 7693 // Do the usual checks. 7694 if (!ShouldDiagnoseEmptyStmtBody(SourceMgr, StmtLoc, NBody)) 7695 return; 7696 7697 Diag(NBody->getSemiLoc(), DiagID); 7698 Diag(NBody->getSemiLoc(), diag::note_empty_body_on_separate_line); 7699 } 7700 7701 void Sema::DiagnoseEmptyLoopBody(const Stmt *S, 7702 const Stmt *PossibleBody) { 7703 assert(!CurrentInstantiationScope); // Ensured by caller 7704 7705 SourceLocation StmtLoc; 7706 const Stmt *Body; 7707 unsigned DiagID; 7708 if (const ForStmt *FS = dyn_cast<ForStmt>(S)) { 7709 StmtLoc = FS->getRParenLoc(); 7710 Body = FS->getBody(); 7711 DiagID = diag::warn_empty_for_body; 7712 } else if (const WhileStmt *WS = dyn_cast<WhileStmt>(S)) { 7713 StmtLoc = WS->getCond()->getSourceRange().getEnd(); 7714 Body = WS->getBody(); 7715 DiagID = diag::warn_empty_while_body; 7716 } else 7717 return; // Neither `for' nor `while'. 7718 7719 // The body should be a null statement. 7720 const NullStmt *NBody = dyn_cast<NullStmt>(Body); 7721 if (!NBody) 7722 return; 7723 7724 // Skip expensive checks if diagnostic is disabled. 7725 if (Diags.isIgnored(DiagID, NBody->getSemiLoc())) 7726 return; 7727 7728 // Do the usual checks. 7729 if (!ShouldDiagnoseEmptyStmtBody(SourceMgr, StmtLoc, NBody)) 7730 return; 7731 7732 // `for(...);' and `while(...);' are popular idioms, so in order to keep 7733 // noise level low, emit diagnostics only if for/while is followed by a 7734 // CompoundStmt, e.g.: 7735 // for (int i = 0; i < n; i++); 7736 // { 7737 // a(i); 7738 // } 7739 // or if for/while is followed by a statement with more indentation 7740 // than for/while itself: 7741 // for (int i = 0; i < n; i++); 7742 // a(i); 7743 bool ProbableTypo = isa<CompoundStmt>(PossibleBody); 7744 if (!ProbableTypo) { 7745 bool BodyColInvalid; 7746 unsigned BodyCol = SourceMgr.getPresumedColumnNumber( 7747 PossibleBody->getLocStart(), 7748 &BodyColInvalid); 7749 if (BodyColInvalid) 7750 return; 7751 7752 bool StmtColInvalid; 7753 unsigned StmtCol = SourceMgr.getPresumedColumnNumber( 7754 S->getLocStart(), 7755 &StmtColInvalid); 7756 if (StmtColInvalid) 7757 return; 7758 7759 if (BodyCol > StmtCol) 7760 ProbableTypo = true; 7761 } 7762 7763 if (ProbableTypo) { 7764 Diag(NBody->getSemiLoc(), DiagID); 7765 Diag(NBody->getSemiLoc(), diag::note_empty_body_on_separate_line); 7766 } 7767 } 7768 7769 //===--- Layout compatibility ----------------------------------------------// 7770 7771 namespace { 7772 7773 bool isLayoutCompatible(ASTContext &C, QualType T1, QualType T2); 7774 7775 /// \brief Check if two enumeration types are layout-compatible. 7776 bool isLayoutCompatible(ASTContext &C, EnumDecl *ED1, EnumDecl *ED2) { 7777 // C++11 [dcl.enum] p8: 7778 // Two enumeration types are layout-compatible if they have the same 7779 // underlying type. 7780 return ED1->isComplete() && ED2->isComplete() && 7781 C.hasSameType(ED1->getIntegerType(), ED2->getIntegerType()); 7782 } 7783 7784 /// \brief Check if two fields are layout-compatible. 7785 bool isLayoutCompatible(ASTContext &C, FieldDecl *Field1, FieldDecl *Field2) { 7786 if (!isLayoutCompatible(C, Field1->getType(), Field2->getType())) 7787 return false; 7788 7789 if (Field1->isBitField() != Field2->isBitField()) 7790 return false; 7791 7792 if (Field1->isBitField()) { 7793 // Make sure that the bit-fields are the same length. 7794 unsigned Bits1 = Field1->getBitWidthValue(C); 7795 unsigned Bits2 = Field2->getBitWidthValue(C); 7796 7797 if (Bits1 != Bits2) 7798 return false; 7799 } 7800 7801 return true; 7802 } 7803 7804 /// \brief Check if two standard-layout structs are layout-compatible. 7805 /// (C++11 [class.mem] p17) 7806 bool isLayoutCompatibleStruct(ASTContext &C, 7807 RecordDecl *RD1, 7808 RecordDecl *RD2) { 7809 // If both records are C++ classes, check that base classes match. 7810 if (const CXXRecordDecl *D1CXX = dyn_cast<CXXRecordDecl>(RD1)) { 7811 // If one of records is a CXXRecordDecl we are in C++ mode, 7812 // thus the other one is a CXXRecordDecl, too. 7813 const CXXRecordDecl *D2CXX = cast<CXXRecordDecl>(RD2); 7814 // Check number of base classes. 7815 if (D1CXX->getNumBases() != D2CXX->getNumBases()) 7816 return false; 7817 7818 // Check the base classes. 7819 for (CXXRecordDecl::base_class_const_iterator 7820 Base1 = D1CXX->bases_begin(), 7821 BaseEnd1 = D1CXX->bases_end(), 7822 Base2 = D2CXX->bases_begin(); 7823 Base1 != BaseEnd1; 7824 ++Base1, ++Base2) { 7825 if (!isLayoutCompatible(C, Base1->getType(), Base2->getType())) 7826 return false; 7827 } 7828 } else if (const CXXRecordDecl *D2CXX = dyn_cast<CXXRecordDecl>(RD2)) { 7829 // If only RD2 is a C++ class, it should have zero base classes. 7830 if (D2CXX->getNumBases() > 0) 7831 return false; 7832 } 7833 7834 // Check the fields. 7835 RecordDecl::field_iterator Field2 = RD2->field_begin(), 7836 Field2End = RD2->field_end(), 7837 Field1 = RD1->field_begin(), 7838 Field1End = RD1->field_end(); 7839 for ( ; Field1 != Field1End && Field2 != Field2End; ++Field1, ++Field2) { 7840 if (!isLayoutCompatible(C, *Field1, *Field2)) 7841 return false; 7842 } 7843 if (Field1 != Field1End || Field2 != Field2End) 7844 return false; 7845 7846 return true; 7847 } 7848 7849 /// \brief Check if two standard-layout unions are layout-compatible. 7850 /// (C++11 [class.mem] p18) 7851 bool isLayoutCompatibleUnion(ASTContext &C, 7852 RecordDecl *RD1, 7853 RecordDecl *RD2) { 7854 llvm::SmallPtrSet<FieldDecl *, 8> UnmatchedFields; 7855 for (auto *Field2 : RD2->fields()) 7856 UnmatchedFields.insert(Field2); 7857 7858 for (auto *Field1 : RD1->fields()) { 7859 llvm::SmallPtrSet<FieldDecl *, 8>::iterator 7860 I = UnmatchedFields.begin(), 7861 E = UnmatchedFields.end(); 7862 7863 for ( ; I != E; ++I) { 7864 if (isLayoutCompatible(C, Field1, *I)) { 7865 bool Result = UnmatchedFields.erase(*I); 7866 (void) Result; 7867 assert(Result); 7868 break; 7869 } 7870 } 7871 if (I == E) 7872 return false; 7873 } 7874 7875 return UnmatchedFields.empty(); 7876 } 7877 7878 bool isLayoutCompatible(ASTContext &C, RecordDecl *RD1, RecordDecl *RD2) { 7879 if (RD1->isUnion() != RD2->isUnion()) 7880 return false; 7881 7882 if (RD1->isUnion()) 7883 return isLayoutCompatibleUnion(C, RD1, RD2); 7884 else 7885 return isLayoutCompatibleStruct(C, RD1, RD2); 7886 } 7887 7888 /// \brief Check if two types are layout-compatible in C++11 sense. 7889 bool isLayoutCompatible(ASTContext &C, QualType T1, QualType T2) { 7890 if (T1.isNull() || T2.isNull()) 7891 return false; 7892 7893 // C++11 [basic.types] p11: 7894 // If two types T1 and T2 are the same type, then T1 and T2 are 7895 // layout-compatible types. 7896 if (C.hasSameType(T1, T2)) 7897 return true; 7898 7899 T1 = T1.getCanonicalType().getUnqualifiedType(); 7900 T2 = T2.getCanonicalType().getUnqualifiedType(); 7901 7902 const Type::TypeClass TC1 = T1->getTypeClass(); 7903 const Type::TypeClass TC2 = T2->getTypeClass(); 7904 7905 if (TC1 != TC2) 7906 return false; 7907 7908 if (TC1 == Type::Enum) { 7909 return isLayoutCompatible(C, 7910 cast<EnumType>(T1)->getDecl(), 7911 cast<EnumType>(T2)->getDecl()); 7912 } else if (TC1 == Type::Record) { 7913 if (!T1->isStandardLayoutType() || !T2->isStandardLayoutType()) 7914 return false; 7915 7916 return isLayoutCompatible(C, 7917 cast<RecordType>(T1)->getDecl(), 7918 cast<RecordType>(T2)->getDecl()); 7919 } 7920 7921 return false; 7922 } 7923 } 7924 7925 //===--- CHECK: pointer_with_type_tag attribute: datatypes should match ----// 7926 7927 namespace { 7928 /// \brief Given a type tag expression find the type tag itself. 7929 /// 7930 /// \param TypeExpr Type tag expression, as it appears in user's code. 7931 /// 7932 /// \param VD Declaration of an identifier that appears in a type tag. 7933 /// 7934 /// \param MagicValue Type tag magic value. 7935 bool FindTypeTagExpr(const Expr *TypeExpr, const ASTContext &Ctx, 7936 const ValueDecl **VD, uint64_t *MagicValue) { 7937 while(true) { 7938 if (!TypeExpr) 7939 return false; 7940 7941 TypeExpr = TypeExpr->IgnoreParenImpCasts()->IgnoreParenCasts(); 7942 7943 switch (TypeExpr->getStmtClass()) { 7944 case Stmt::UnaryOperatorClass: { 7945 const UnaryOperator *UO = cast<UnaryOperator>(TypeExpr); 7946 if (UO->getOpcode() == UO_AddrOf || UO->getOpcode() == UO_Deref) { 7947 TypeExpr = UO->getSubExpr(); 7948 continue; 7949 } 7950 return false; 7951 } 7952 7953 case Stmt::DeclRefExprClass: { 7954 const DeclRefExpr *DRE = cast<DeclRefExpr>(TypeExpr); 7955 *VD = DRE->getDecl(); 7956 return true; 7957 } 7958 7959 case Stmt::IntegerLiteralClass: { 7960 const IntegerLiteral *IL = cast<IntegerLiteral>(TypeExpr); 7961 llvm::APInt MagicValueAPInt = IL->getValue(); 7962 if (MagicValueAPInt.getActiveBits() <= 64) { 7963 *MagicValue = MagicValueAPInt.getZExtValue(); 7964 return true; 7965 } else 7966 return false; 7967 } 7968 7969 case Stmt::BinaryConditionalOperatorClass: 7970 case Stmt::ConditionalOperatorClass: { 7971 const AbstractConditionalOperator *ACO = 7972 cast<AbstractConditionalOperator>(TypeExpr); 7973 bool Result; 7974 if (ACO->getCond()->EvaluateAsBooleanCondition(Result, Ctx)) { 7975 if (Result) 7976 TypeExpr = ACO->getTrueExpr(); 7977 else 7978 TypeExpr = ACO->getFalseExpr(); 7979 continue; 7980 } 7981 return false; 7982 } 7983 7984 case Stmt::BinaryOperatorClass: { 7985 const BinaryOperator *BO = cast<BinaryOperator>(TypeExpr); 7986 if (BO->getOpcode() == BO_Comma) { 7987 TypeExpr = BO->getRHS(); 7988 continue; 7989 } 7990 return false; 7991 } 7992 7993 default: 7994 return false; 7995 } 7996 } 7997 } 7998 7999 /// \brief Retrieve the C type corresponding to type tag TypeExpr. 8000 /// 8001 /// \param TypeExpr Expression that specifies a type tag. 8002 /// 8003 /// \param MagicValues Registered magic values. 8004 /// 8005 /// \param FoundWrongKind Set to true if a type tag was found, but of a wrong 8006 /// kind. 8007 /// 8008 /// \param TypeInfo Information about the corresponding C type. 8009 /// 8010 /// \returns true if the corresponding C type was found. 8011 bool GetMatchingCType( 8012 const IdentifierInfo *ArgumentKind, 8013 const Expr *TypeExpr, const ASTContext &Ctx, 8014 const llvm::DenseMap<Sema::TypeTagMagicValue, 8015 Sema::TypeTagData> *MagicValues, 8016 bool &FoundWrongKind, 8017 Sema::TypeTagData &TypeInfo) { 8018 FoundWrongKind = false; 8019 8020 // Variable declaration that has type_tag_for_datatype attribute. 8021 const ValueDecl *VD = nullptr; 8022 8023 uint64_t MagicValue; 8024 8025 if (!FindTypeTagExpr(TypeExpr, Ctx, &VD, &MagicValue)) 8026 return false; 8027 8028 if (VD) { 8029 if (TypeTagForDatatypeAttr *I = VD->getAttr<TypeTagForDatatypeAttr>()) { 8030 if (I->getArgumentKind() != ArgumentKind) { 8031 FoundWrongKind = true; 8032 return false; 8033 } 8034 TypeInfo.Type = I->getMatchingCType(); 8035 TypeInfo.LayoutCompatible = I->getLayoutCompatible(); 8036 TypeInfo.MustBeNull = I->getMustBeNull(); 8037 return true; 8038 } 8039 return false; 8040 } 8041 8042 if (!MagicValues) 8043 return false; 8044 8045 llvm::DenseMap<Sema::TypeTagMagicValue, 8046 Sema::TypeTagData>::const_iterator I = 8047 MagicValues->find(std::make_pair(ArgumentKind, MagicValue)); 8048 if (I == MagicValues->end()) 8049 return false; 8050 8051 TypeInfo = I->second; 8052 return true; 8053 } 8054 } // unnamed namespace 8055 8056 void Sema::RegisterTypeTagForDatatype(const IdentifierInfo *ArgumentKind, 8057 uint64_t MagicValue, QualType Type, 8058 bool LayoutCompatible, 8059 bool MustBeNull) { 8060 if (!TypeTagForDatatypeMagicValues) 8061 TypeTagForDatatypeMagicValues.reset( 8062 new llvm::DenseMap<TypeTagMagicValue, TypeTagData>); 8063 8064 TypeTagMagicValue Magic(ArgumentKind, MagicValue); 8065 (*TypeTagForDatatypeMagicValues)[Magic] = 8066 TypeTagData(Type, LayoutCompatible, MustBeNull); 8067 } 8068 8069 namespace { 8070 bool IsSameCharType(QualType T1, QualType T2) { 8071 const BuiltinType *BT1 = T1->getAs<BuiltinType>(); 8072 if (!BT1) 8073 return false; 8074 8075 const BuiltinType *BT2 = T2->getAs<BuiltinType>(); 8076 if (!BT2) 8077 return false; 8078 8079 BuiltinType::Kind T1Kind = BT1->getKind(); 8080 BuiltinType::Kind T2Kind = BT2->getKind(); 8081 8082 return (T1Kind == BuiltinType::SChar && T2Kind == BuiltinType::Char_S) || 8083 (T1Kind == BuiltinType::UChar && T2Kind == BuiltinType::Char_U) || 8084 (T1Kind == BuiltinType::Char_U && T2Kind == BuiltinType::UChar) || 8085 (T1Kind == BuiltinType::Char_S && T2Kind == BuiltinType::SChar); 8086 } 8087 } // unnamed namespace 8088 8089 void Sema::CheckArgumentWithTypeTag(const ArgumentWithTypeTagAttr *Attr, 8090 const Expr * const *ExprArgs) { 8091 const IdentifierInfo *ArgumentKind = Attr->getArgumentKind(); 8092 bool IsPointerAttr = Attr->getIsPointer(); 8093 8094 const Expr *TypeTagExpr = ExprArgs[Attr->getTypeTagIdx()]; 8095 bool FoundWrongKind; 8096 TypeTagData TypeInfo; 8097 if (!GetMatchingCType(ArgumentKind, TypeTagExpr, Context, 8098 TypeTagForDatatypeMagicValues.get(), 8099 FoundWrongKind, TypeInfo)) { 8100 if (FoundWrongKind) 8101 Diag(TypeTagExpr->getExprLoc(), 8102 diag::warn_type_tag_for_datatype_wrong_kind) 8103 << TypeTagExpr->getSourceRange(); 8104 return; 8105 } 8106 8107 const Expr *ArgumentExpr = ExprArgs[Attr->getArgumentIdx()]; 8108 if (IsPointerAttr) { 8109 // Skip implicit cast of pointer to `void *' (as a function argument). 8110 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(ArgumentExpr)) 8111 if (ICE->getType()->isVoidPointerType() && 8112 ICE->getCastKind() == CK_BitCast) 8113 ArgumentExpr = ICE->getSubExpr(); 8114 } 8115 QualType ArgumentType = ArgumentExpr->getType(); 8116 8117 // Passing a `void*' pointer shouldn't trigger a warning. 8118 if (IsPointerAttr && ArgumentType->isVoidPointerType()) 8119 return; 8120 8121 if (TypeInfo.MustBeNull) { 8122 // Type tag with matching void type requires a null pointer. 8123 if (!ArgumentExpr->isNullPointerConstant(Context, 8124 Expr::NPC_ValueDependentIsNotNull)) { 8125 Diag(ArgumentExpr->getExprLoc(), 8126 diag::warn_type_safety_null_pointer_required) 8127 << ArgumentKind->getName() 8128 << ArgumentExpr->getSourceRange() 8129 << TypeTagExpr->getSourceRange(); 8130 } 8131 return; 8132 } 8133 8134 QualType RequiredType = TypeInfo.Type; 8135 if (IsPointerAttr) 8136 RequiredType = Context.getPointerType(RequiredType); 8137 8138 bool mismatch = false; 8139 if (!TypeInfo.LayoutCompatible) { 8140 mismatch = !Context.hasSameType(ArgumentType, RequiredType); 8141 8142 // C++11 [basic.fundamental] p1: 8143 // Plain char, signed char, and unsigned char are three distinct types. 8144 // 8145 // But we treat plain `char' as equivalent to `signed char' or `unsigned 8146 // char' depending on the current char signedness mode. 8147 if (mismatch) 8148 if ((IsPointerAttr && IsSameCharType(ArgumentType->getPointeeType(), 8149 RequiredType->getPointeeType())) || 8150 (!IsPointerAttr && IsSameCharType(ArgumentType, RequiredType))) 8151 mismatch = false; 8152 } else 8153 if (IsPointerAttr) 8154 mismatch = !isLayoutCompatible(Context, 8155 ArgumentType->getPointeeType(), 8156 RequiredType->getPointeeType()); 8157 else 8158 mismatch = !isLayoutCompatible(Context, ArgumentType, RequiredType); 8159 8160 if (mismatch) 8161 Diag(ArgumentExpr->getExprLoc(), diag::warn_type_safety_type_mismatch) 8162 << ArgumentType << ArgumentKind 8163 << TypeInfo.LayoutCompatible << RequiredType 8164 << ArgumentExpr->getSourceRange() 8165 << TypeTagExpr->getSourceRange(); 8166 } 8167 8168
