Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/lib/StaticAnalyzer/Core/ExprEngineObjC.cpp
Line
Count
Source (jump to first uncovered line)
1
//=-- ExprEngineObjC.cpp - ExprEngine support for Objective-C ---*- C++ -*-===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines ExprEngine's support for Objective-C expressions.
10
//
11
//===----------------------------------------------------------------------===//
12
13
#include "clang/AST/StmtObjC.h"
14
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
15
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17
18
using namespace clang;
19
using namespace ento;
20
21
void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex,
22
                                          ExplodedNode *Pred,
23
997
                                          ExplodedNodeSet &Dst) {
24
997
  ProgramStateRef state = Pred->getState();
25
997
  const LocationContext *LCtx = Pred->getLocationContext();
26
997
  SVal baseVal = state->getSVal(Ex->getBase(), LCtx);
27
997
  SVal location = state->getLValue(Ex->getDecl(), baseVal);
28
997
29
997
  ExplodedNodeSet dstIvar;
30
997
  StmtNodeBuilder Bldr(Pred, dstIvar, *currBldrCtx);
31
997
  Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, location));
32
997
33
997
  // Perform the post-condition check of the ObjCIvarRefExpr and store
34
997
  // the created nodes in 'Dst'.
35
997
  getCheckerManager().runCheckersForPostStmt(Dst, dstIvar, Ex, *this);
36
997
}
37
38
void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
39
                                             ExplodedNode *Pred,
40
19
                                             ExplodedNodeSet &Dst) {
41
19
  getCheckerManager().runCheckersForPreStmt(Dst, Pred, S, *this);
42
19
}
43
44
/// Generate a node in \p Bldr for an iteration statement using ObjC
45
/// for-loop iterator.
46
static void populateObjCForDestinationSet(
47
    ExplodedNodeSet &dstLocation, SValBuilder &svalBuilder,
48
    const ObjCForCollectionStmt *S, const Stmt *elem, SVal elementV,
49
    SymbolManager &SymMgr, const NodeBuilderContext *currBldrCtx,
50
513
    StmtNodeBuilder &Bldr, bool hasElements) {
51
513
52
513
  for (ExplodedNode *Pred : dstLocation) {
53
513
    ProgramStateRef state = Pred->getState();
54
513
    const LocationContext *LCtx = Pred->getLocationContext();
55
513
56
513
    SVal hasElementsV = svalBuilder.makeTruthVal(hasElements);
57
513
58
513
    // FIXME: S is not an expression. We should not be binding values to it.
59
513
    ProgramStateRef nextState = state->BindExpr(S, LCtx, hasElementsV);
60
513
61
513
    if (auto MV = elementV.getAs<loc::MemRegionVal>())
62
513
      if (const auto *R = dyn_cast<TypedValueRegion>(MV->getRegion())) {
63
513
        // FIXME: The proper thing to do is to really iterate over the
64
513
        //  container.  We will do this with dispatch logic to the store.
65
513
        //  For now, just 'conjure' up a symbolic value.
66
513
        QualType T = R->getValueType();
67
513
        assert(Loc::isLocType(T));
68
513
69
513
        SVal V;
70
513
        if (hasElements) {
71
255
          SymbolRef Sym = SymMgr.conjureSymbol(elem, LCtx, T,
72
255
                                               currBldrCtx->blockCount());
73
255
          V = svalBuilder.makeLoc(Sym);
74
258
        } else {
75
258
          V = svalBuilder.makeIntVal(0, T);
76
258
        }
77
513
78
513
        nextState = nextState->bindLoc(elementV, V, LCtx);
79
513
      }
80
513
81
513
    Bldr.generateNode(S, Pred, nextState);
82
513
  }
83
513
}
84
85
void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
86
                                            ExplodedNode *Pred,
87
258
                                            ExplodedNodeSet &Dst) {
88
258
89
258
  // ObjCForCollectionStmts are processed in two places.  This method
90
258
  // handles the case where an ObjCForCollectionStmt* occurs as one of the
91
258
  // statements within a basic block.  This transfer function does two things:
92
258
  //
93
258
  //  (1) binds the next container value to 'element'.  This creates a new
94
258
  //      node in the ExplodedGraph.
95
258
  //
96
258
  //  (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating
97
258
  //      whether or not the container has any more elements.  This value
98
258
  //      will be tested in ProcessBranch.  We need to explicitly bind
99
258
  //      this value because a container can contain nil elements.
100
258
  //
101
258
  // FIXME: Eventually this logic should actually do dispatches to
102
258
  //   'countByEnumeratingWithState:objects:count:' (NSFastEnumeration).
103
258
  //   This will require simulating a temporary NSFastEnumerationState, either
104
258
  //   through an SVal or through the use of MemRegions.  This value can
105
258
  //   be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop
106
258
  //   terminates we reclaim the temporary (it goes out of scope) and we
107
258
  //   we can test if the SVal is 0 or if the MemRegion is null (depending
108
258
  //   on what approach we take).
109
258
  //
110
258
  //  For now: simulate (1) by assigning either a symbol or nil if the
111
258
  //    container is empty.  Thus this transfer function will by default
112
258
  //    result in state splitting.
113
258
114
258
  const Stmt *elem = S->getElement();
115
258
  const Stmt *collection = S->getCollection();
116
258
  ProgramStateRef state = Pred->getState();
117
258
  SVal collectionV = state->getSVal(collection, Pred->getLocationContext());
118
258
119
258
  SVal elementV;
120
258
  if (const auto *DS = dyn_cast<DeclStmt>(elem)) {
121
125
    const VarDecl *elemD = cast<VarDecl>(DS->getSingleDecl());
122
125
    assert(elemD->getInit() == nullptr);
123
125
    elementV = state->getLValue(elemD, Pred->getLocationContext());
124
133
  } else {
125
133
    elementV = state->getSVal(elem, Pred->getLocationContext());
126
133
  }
127
258
128
258
  bool isContainerNull = state->isNull(collectionV).isConstrainedTrue();
129
258
130
258
  ExplodedNodeSet dstLocation;
131
258
  evalLocation(dstLocation, S, elem, Pred, state, elementV, false);
132
258
133
258
  ExplodedNodeSet Tmp;
134
258
  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
135
258
136
258
  if (!isContainerNull)
137
255
    populateObjCForDestinationSet(dstLocation, svalBuilder, S, elem, elementV,
138
255
                                  SymMgr, currBldrCtx, Bldr,
139
255
                                  /*hasElements=*/true);
140
258
141
258
  populateObjCForDestinationSet(dstLocation, svalBuilder, S, elem, elementV,
142
258
                                SymMgr, currBldrCtx, Bldr,
143
258
                                /*hasElements=*/false);
144
258
145
258
  // Finally, run any custom checkers.
146
258
  // FIXME: Eventually all pre- and post-checks should live in VisitStmt.
147
258
  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this);
148
258
}
149
150
void ExprEngine::VisitObjCMessage(const ObjCMessageExpr *ME,
151
                                  ExplodedNode *Pred,
152
4.06k
                                  ExplodedNodeSet &Dst) {
153
4.06k
  CallEventManager &CEMgr = getStateManager().getCallEventManager();
154
4.06k
  CallEventRef<ObjCMethodCall> Msg =
155
4.06k
    CEMgr.getObjCMethodCall(ME, Pred->getState(), Pred->getLocationContext());
156
4.06k
157
4.06k
  // There are three cases for the receiver:
158
4.06k
  //   (1) it is definitely nil,
159
4.06k
  //   (2) it is definitely non-nil, and
160
4.06k
  //   (3) we don't know.
161
4.06k
  //
162
4.06k
  // If the receiver is definitely nil, we skip the pre/post callbacks and
163
4.06k
  // instead call the ObjCMessageNil callbacks and return.
164
4.06k
  //
165
4.06k
  // If the receiver is definitely non-nil, we call the pre- callbacks,
166
4.06k
  // evaluate the call, and call the post- callbacks.
167
4.06k
  //
168
4.06k
  // If we don't know, we drop the potential nil flow and instead
169
4.06k
  // continue from the assumed non-nil state as in (2). This approach
170
4.06k
  // intentionally drops coverage in order to prevent false alarms
171
4.06k
  // in the following scenario:
172
4.06k
  //
173
4.06k
  // id result = [o someMethod]
174
4.06k
  // if (result) {
175
4.06k
  //   if (!o) {
176
4.06k
  //     // <-- This program point should be unreachable because if o is nil
177
4.06k
  //     // it must the case that result is nil as well.
178
4.06k
  //   }
179
4.06k
  // }
180
4.06k
  //
181
4.06k
  // We could avoid dropping coverage by performing an explicit case split
182
4.06k
  // on each method call -- but this would get very expensive. An alternative
183
4.06k
  // would be to introduce lazy constraints.
184
4.06k
  // FIXME: This ignores many potential bugs (<rdar://problem/11733396>).
185
4.06k
  // Revisit once we have lazier constraints.
186
4.06k
  if (Msg->isInstanceMessage()) {
187
3.08k
    SVal recVal = Msg->getReceiverSVal();
188
3.08k
    if (!recVal.isUndef()) {
189
3.07k
      // Bifurcate the state into nil and non-nil ones.
190
3.07k
      DefinedOrUnknownSVal receiverVal =
191
3.07k
          recVal.castAs<DefinedOrUnknownSVal>();
192
3.07k
      ProgramStateRef State = Pred->getState();
193
3.07k
194
3.07k
      ProgramStateRef notNilState, nilState;
195
3.07k
      std::tie(notNilState, nilState) = State->assume(receiverVal);
196
3.07k
197
3.07k
      // Receiver is definitely nil, so run ObjCMessageNil callbacks and return.
198
3.07k
      if (nilState && 
!notNilState1.84k
) {
199
95
        ExplodedNodeSet dstNil;
200
95
        StmtNodeBuilder Bldr(Pred, dstNil, *currBldrCtx);
201
95
        bool HasTag = Pred->getLocation().getTag();
202
95
        Pred = Bldr.generateNode(ME, Pred, nilState, nullptr,
203
95
                                 ProgramPoint::PreStmtKind);
204
95
        assert((Pred || HasTag) && "Should have cached out already!");
205
95
        (void)HasTag;
206
95
        if (!Pred)
207
0
          return;
208
95
209
95
        ExplodedNodeSet dstPostCheckers;
210
95
        getCheckerManager().runCheckersForObjCMessageNil(dstPostCheckers, Pred,
211
95
                                                         *Msg, *this);
212
95
        for (auto I : dstPostCheckers)
213
88
          finishArgumentConstruction(Dst, I, *Msg);
214
95
        return;
215
95
      }
216
2.98k
217
2.98k
      ExplodedNodeSet dstNonNil;
218
2.98k
      StmtNodeBuilder Bldr(Pred, dstNonNil, *currBldrCtx);
219
2.98k
      // Generate a transition to the non-nil state, dropping any potential
220
2.98k
      // nil flow.
221
2.98k
      if (notNilState != State) {
222
1.75k
        bool HasTag = Pred->getLocation().getTag();
223
1.75k
        Pred = Bldr.generateNode(ME, Pred, notNilState);
224
1.75k
        assert((Pred || HasTag) && "Should have cached out already!");
225
1.75k
        (void)HasTag;
226
1.75k
        if (!Pred)
227
0
          return;
228
3.97k
      }
229
2.98k
    }
230
3.08k
  }
231
3.97k
232
3.97k
  // Handle the previsits checks.
233
3.97k
  ExplodedNodeSet dstPrevisit;
234
3.97k
  getCheckerManager().runCheckersForPreObjCMessage(dstPrevisit, Pred,
235
3.97k
                                                   *Msg, *this);
236
3.97k
  ExplodedNodeSet dstGenericPrevisit;
237
3.97k
  getCheckerManager().runCheckersForPreCall(dstGenericPrevisit, dstPrevisit,
238
3.97k
                                            *Msg, *this);
239
3.97k
240
3.97k
  // Proceed with evaluate the message expression.
241
3.97k
  ExplodedNodeSet dstEval;
242
3.97k
  StmtNodeBuilder Bldr(dstGenericPrevisit, dstEval, *currBldrCtx);
243
3.97k
244
3.97k
  for (ExplodedNodeSet::iterator DI = dstGenericPrevisit.begin(),
245
7.86k
       DE = dstGenericPrevisit.end(); DI != DE; 
++DI3.89k
) {
246
3.89k
    ExplodedNode *Pred = *DI;
247
3.89k
    ProgramStateRef State = Pred->getState();
248
3.89k
    CallEventRef<ObjCMethodCall> UpdatedMsg = Msg.cloneWithState(State);
249
3.89k
250
3.89k
    if (UpdatedMsg->isInstanceMessage()) {
251
2.91k
      SVal recVal = UpdatedMsg->getReceiverSVal();
252
2.91k
      if (!recVal.isUndef()) {
253
2.91k
        if (ObjCNoRet.isImplicitNoReturn(ME)) {
254
2
          // If we raise an exception, for now treat it as a sink.
255
2
          // Eventually we will want to handle exceptions properly.
256
2
          Bldr.generateSink(ME, Pred, State);
257
2
          continue;
258
2
        }
259
980
      }
260
980
    } else {
261
980
      // Check for special class methods that are known to not return
262
980
      // and that we should treat as a sink.
263
980
      if (ObjCNoRet.isImplicitNoReturn(ME)) {
264
5
        // If we raise an exception, for now treat it as a sink.
265
5
        // Eventually we will want to handle exceptions properly.
266
5
        Bldr.generateSink(ME, Pred, Pred->getState());
267
5
        continue;
268
5
      }
269
3.88k
    }
270
3.88k
271
3.88k
    defaultEvalCall(Bldr, Pred, *UpdatedMsg);
272
3.88k
  }
273
3.97k
274
3.97k
  // If there were constructors called for object-type arguments, clean them up.
275
3.97k
  ExplodedNodeSet dstArgCleanup;
276
3.97k
  for (auto I : dstEval)
277
3.39k
    finishArgumentConstruction(dstArgCleanup, I, *Msg);
278
3.97k
279
3.97k
  ExplodedNodeSet dstPostvisit;
280
3.97k
  getCheckerManager().runCheckersForPostCall(dstPostvisit, dstArgCleanup,
281
3.97k
                                             *Msg, *this);
282
3.97k
283
3.97k
  // Finally, perform the post-condition check of the ObjCMessageExpr and store
284
3.97k
  // the created nodes in 'Dst'.
285
3.97k
  getCheckerManager().runCheckersForPostObjCMessage(Dst, dstPostvisit,
286
3.97k
                                                    *Msg, *this);
287
3.97k
}