CallAndMessageChecker.cpp revision 321369
1263970Sdes//===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==// 257429Smarkm// 357429Smarkm// The LLVM Compiler Infrastructure 457429Smarkm// 557429Smarkm// This file is distributed under the University of Illinois Open Source 657429Smarkm// License. See LICENSE.TXT for details. 757429Smarkm// 876259Sgreen//===----------------------------------------------------------------------===// 965668Skris// 1065668Skris// This defines CallAndMessageChecker, a builtin checker that checks for various 1165668Skris// errors of call and objc message expressions. 1265668Skris// 1365668Skris//===----------------------------------------------------------------------===// 1457429Smarkm 1557429Smarkm#include "ClangSACheckers.h" 1657429Smarkm#include "clang/AST/ParentMap.h" 1757429Smarkm#include "clang/Basic/TargetInfo.h" 18162852Sdes#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 19162852Sdes#include "clang/StaticAnalyzer/Core/Checker.h" 20162852Sdes#include "clang/StaticAnalyzer/Core/CheckerManager.h" 21162852Sdes#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 22162852Sdes#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 23162852Sdes#include "llvm/ADT/SmallString.h" 2476259Sgreen#include "llvm/ADT/StringExtras.h" 2576259Sgreen#include "llvm/Support/raw_ostream.h" 2657429Smarkm 2757429Smarkmusing namespace clang; 2857429Smarkmusing namespace ento; 2957429Smarkm 3076259Sgreennamespace { 3176259Sgreen 3276259Sgreenstruct ChecksFilter { 3376259Sgreen DefaultBool Check_CallAndMessageUnInitRefArg; 3476259Sgreen DefaultBool Check_CallAndMessageChecker; 3557429Smarkm 36263970Sdes CheckName CheckName_CallAndMessageUnInitRefArg; 3757429Smarkm CheckName CheckName_CallAndMessageChecker; 3857429Smarkm}; 3957429Smarkm 4057429Smarkmclass CallAndMessageChecker 41162852Sdes : public Checker< check::PreStmt<CallExpr>, 4257429Smarkm check::PreStmt<CXXDeleteExpr>, 43162852Sdes check::PreObjCMessage, 44162852Sdes check::ObjCMessageNil, 45162852Sdes check::PreCall > { 46162852Sdes mutable std::unique_ptr<BugType> BT_call_null; 47162852Sdes mutable std::unique_ptr<BugType> BT_call_undef; 48162852Sdes mutable std::unique_ptr<BugType> BT_cxx_call_null; 49162852Sdes mutable std::unique_ptr<BugType> BT_cxx_call_undef; 50162852Sdes mutable std::unique_ptr<BugType> BT_call_arg; 51263970Sdes mutable std::unique_ptr<BugType> BT_cxx_delete_undef; 52263970Sdes mutable std::unique_ptr<BugType> BT_msg_undef; 53162852Sdes mutable std::unique_ptr<BugType> BT_objc_prop_undef; 54162852Sdes mutable std::unique_ptr<BugType> BT_objc_subscript_undef; 55162852Sdes mutable std::unique_ptr<BugType> BT_msg_arg; 56162852Sdes mutable std::unique_ptr<BugType> BT_msg_ret; 57162852Sdes mutable std::unique_ptr<BugType> BT_call_few_args; 58162852Sdes 5957429Smarkmpublic: 60162852Sdes ChecksFilter Filter; 6157429Smarkm 6276259Sgreen void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 6376259Sgreen void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const; 64162852Sdes void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const; 65162852Sdes 6657429Smarkm /// Fill in the return value that results from messaging nil based on the 6776259Sgreen /// return type and architecture and diagnose if the return value will be 6876259Sgreen /// garbage. 6976259Sgreen void checkObjCMessageNil(const ObjCMethodCall &msg, CheckerContext &C) const; 7057429Smarkm 71263970Sdes void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 72263970Sdes 7357429Smarkmprivate: 7457429Smarkm bool PreVisitProcessArg(CheckerContext &C, SVal V, SourceRange ArgRange, 7557429Smarkm const Expr *ArgEx, int ArgumentNumber, 7657429Smarkm bool CheckUninitFields, const CallEvent &Call, 7757429Smarkm std::unique_ptr<BugType> &BT, 7857429Smarkm const ParmVarDecl *ParamDecl) const; 7992555Sdes 8076259Sgreen static void emitBadCall(BugType *BT, CheckerContext &C, const Expr *BadE); 8157429Smarkm void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg, 8292555Sdes ExplodedNode *N) const; 8376259Sgreen 8457429Smarkm void HandleNilReceiver(CheckerContext &C, 8557429Smarkm ProgramStateRef state, 8657429Smarkm const ObjCMethodCall &msg) const; 87162852Sdes 88162852Sdes void LazyInit_BT(const char *desc, std::unique_ptr<BugType> &BT) const { 89162852Sdes if (!BT) 90162852Sdes BT.reset(new BuiltinBug(this, desc)); 91162852Sdes } 92162852Sdes bool uninitRefOrPointer(CheckerContext &C, const SVal &V, 93162852Sdes SourceRange ArgRange, const Expr *ArgEx, 94162852Sdes std::unique_ptr<BugType> &BT, 95162852Sdes const ParmVarDecl *ParamDecl, const char *BD, 96162852Sdes int ArgumentNumber) const; 97162852Sdes}; 98162852Sdes} // end anonymous namespace 99162852Sdes 100162852Sdesvoid CallAndMessageChecker::emitBadCall(BugType *BT, CheckerContext &C, 101162852Sdes const Expr *BadE) { 102162852Sdes ExplodedNode *N = C.generateErrorNode(); 103 if (!N) 104 return; 105 106 auto R = llvm::make_unique<BugReport>(*BT, BT->getName(), N); 107 if (BadE) { 108 R->addRange(BadE->getSourceRange()); 109 if (BadE->isGLValue()) 110 BadE = bugreporter::getDerefExpr(BadE); 111 bugreporter::trackNullOrUndefValue(N, BadE, *R); 112 } 113 C.emitReport(std::move(R)); 114} 115 116static void describeUninitializedArgumentInCall(const CallEvent &Call, 117 int ArgumentNumber, 118 llvm::raw_svector_ostream &Os) { 119 switch (Call.getKind()) { 120 case CE_ObjCMessage: { 121 const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call); 122 switch (Msg.getMessageKind()) { 123 case OCM_Message: 124 Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1) 125 << " argument in message expression is an uninitialized value"; 126 return; 127 case OCM_PropertyAccess: 128 assert(Msg.isSetter() && "Getters have no args"); 129 Os << "Argument for property setter is an uninitialized value"; 130 return; 131 case OCM_Subscript: 132 if (Msg.isSetter() && (ArgumentNumber == 0)) 133 Os << "Argument for subscript setter is an uninitialized value"; 134 else 135 Os << "Subscript index is an uninitialized value"; 136 return; 137 } 138 llvm_unreachable("Unknown message kind."); 139 } 140 case CE_Block: 141 Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1) 142 << " block call argument is an uninitialized value"; 143 return; 144 default: 145 Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1) 146 << " function call argument is an uninitialized value"; 147 return; 148 } 149} 150 151bool CallAndMessageChecker::uninitRefOrPointer( 152 CheckerContext &C, const SVal &V, SourceRange ArgRange, const Expr *ArgEx, 153 std::unique_ptr<BugType> &BT, const ParmVarDecl *ParamDecl, const char *BD, 154 int ArgumentNumber) const { 155 if (!Filter.Check_CallAndMessageUnInitRefArg) 156 return false; 157 158 // No parameter declaration available, i.e. variadic function argument. 159 if(!ParamDecl) 160 return false; 161 162 // If parameter is declared as pointer to const in function declaration, 163 // then check if corresponding argument in function call is 164 // pointing to undefined symbol value (uninitialized memory). 165 SmallString<200> Buf; 166 llvm::raw_svector_ostream Os(Buf); 167 168 if (ParamDecl->getType()->isPointerType()) { 169 Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1) 170 << " function call argument is a pointer to uninitialized value"; 171 } else if (ParamDecl->getType()->isReferenceType()) { 172 Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1) 173 << " function call argument is an uninitialized value"; 174 } else 175 return false; 176 177 if(!ParamDecl->getType()->getPointeeType().isConstQualified()) 178 return false; 179 180 if (const MemRegion *SValMemRegion = V.getAsRegion()) { 181 const ProgramStateRef State = C.getState(); 182 const SVal PSV = State->getSVal(SValMemRegion); 183 if (PSV.isUndef()) { 184 if (ExplodedNode *N = C.generateErrorNode()) { 185 LazyInit_BT(BD, BT); 186 auto R = llvm::make_unique<BugReport>(*BT, Os.str(), N); 187 R->addRange(ArgRange); 188 if (ArgEx) { 189 bugreporter::trackNullOrUndefValue(N, ArgEx, *R); 190 } 191 C.emitReport(std::move(R)); 192 } 193 return true; 194 } 195 } 196 return false; 197} 198 199bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C, 200 SVal V, 201 SourceRange ArgRange, 202 const Expr *ArgEx, 203 int ArgumentNumber, 204 bool CheckUninitFields, 205 const CallEvent &Call, 206 std::unique_ptr<BugType> &BT, 207 const ParmVarDecl *ParamDecl 208 ) const { 209 const char *BD = "Uninitialized argument value"; 210 211 if (uninitRefOrPointer(C, V, ArgRange, ArgEx, BT, ParamDecl, BD, 212 ArgumentNumber)) 213 return true; 214 215 if (V.isUndef()) { 216 if (ExplodedNode *N = C.generateErrorNode()) { 217 LazyInit_BT(BD, BT); 218 // Generate a report for this bug. 219 SmallString<200> Buf; 220 llvm::raw_svector_ostream Os(Buf); 221 describeUninitializedArgumentInCall(Call, ArgumentNumber, Os); 222 auto R = llvm::make_unique<BugReport>(*BT, Os.str(), N); 223 224 R->addRange(ArgRange); 225 if (ArgEx) 226 bugreporter::trackNullOrUndefValue(N, ArgEx, *R); 227 C.emitReport(std::move(R)); 228 } 229 return true; 230 } 231 232 if (!CheckUninitFields) 233 return false; 234 235 if (Optional<nonloc::LazyCompoundVal> LV = 236 V.getAs<nonloc::LazyCompoundVal>()) { 237 238 class FindUninitializedField { 239 public: 240 SmallVector<const FieldDecl *, 10> FieldChain; 241 private: 242 StoreManager &StoreMgr; 243 MemRegionManager &MrMgr; 244 Store store; 245 public: 246 FindUninitializedField(StoreManager &storeMgr, 247 MemRegionManager &mrMgr, Store s) 248 : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {} 249 250 bool Find(const TypedValueRegion *R) { 251 QualType T = R->getValueType(); 252 if (const RecordType *RT = T->getAsStructureType()) { 253 const RecordDecl *RD = RT->getDecl()->getDefinition(); 254 assert(RD && "Referred record has no definition"); 255 for (const auto *I : RD->fields()) { 256 const FieldRegion *FR = MrMgr.getFieldRegion(I, R); 257 FieldChain.push_back(I); 258 T = I->getType(); 259 if (T->getAsStructureType()) { 260 if (Find(FR)) 261 return true; 262 } 263 else { 264 const SVal &V = StoreMgr.getBinding(store, loc::MemRegionVal(FR)); 265 if (V.isUndef()) 266 return true; 267 } 268 FieldChain.pop_back(); 269 } 270 } 271 272 return false; 273 } 274 }; 275 276 const LazyCompoundValData *D = LV->getCVData(); 277 FindUninitializedField F(C.getState()->getStateManager().getStoreManager(), 278 C.getSValBuilder().getRegionManager(), 279 D->getStore()); 280 281 if (F.Find(D->getRegion())) { 282 if (ExplodedNode *N = C.generateErrorNode()) { 283 LazyInit_BT(BD, BT); 284 SmallString<512> Str; 285 llvm::raw_svector_ostream os(Str); 286 os << "Passed-by-value struct argument contains uninitialized data"; 287 288 if (F.FieldChain.size() == 1) 289 os << " (e.g., field: '" << *F.FieldChain[0] << "')"; 290 else { 291 os << " (e.g., via the field chain: '"; 292 bool first = true; 293 for (SmallVectorImpl<const FieldDecl *>::iterator 294 DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){ 295 if (first) 296 first = false; 297 else 298 os << '.'; 299 os << **DI; 300 } 301 os << "')"; 302 } 303 304 // Generate a report for this bug. 305 auto R = llvm::make_unique<BugReport>(*BT, os.str(), N); 306 R->addRange(ArgRange); 307 308 // FIXME: enhance track back for uninitialized value for arbitrary 309 // memregions 310 C.emitReport(std::move(R)); 311 } 312 return true; 313 } 314 } 315 316 return false; 317} 318 319void CallAndMessageChecker::checkPreStmt(const CallExpr *CE, 320 CheckerContext &C) const{ 321 322 const Expr *Callee = CE->getCallee()->IgnoreParens(); 323 ProgramStateRef State = C.getState(); 324 const LocationContext *LCtx = C.getLocationContext(); 325 SVal L = State->getSVal(Callee, LCtx); 326 327 if (L.isUndef()) { 328 if (!BT_call_undef) 329 BT_call_undef.reset(new BuiltinBug( 330 this, "Called function pointer is an uninitialized pointer value")); 331 emitBadCall(BT_call_undef.get(), C, Callee); 332 return; 333 } 334 335 ProgramStateRef StNonNull, StNull; 336 std::tie(StNonNull, StNull) = State->assume(L.castAs<DefinedOrUnknownSVal>()); 337 338 if (StNull && !StNonNull) { 339 if (!BT_call_null) 340 BT_call_null.reset(new BuiltinBug( 341 this, "Called function pointer is null (null dereference)")); 342 emitBadCall(BT_call_null.get(), C, Callee); 343 return; 344 } 345 346 C.addTransition(StNonNull); 347} 348 349void CallAndMessageChecker::checkPreStmt(const CXXDeleteExpr *DE, 350 CheckerContext &C) const { 351 352 SVal Arg = C.getSVal(DE->getArgument()); 353 if (Arg.isUndef()) { 354 StringRef Desc; 355 ExplodedNode *N = C.generateErrorNode(); 356 if (!N) 357 return; 358 if (!BT_cxx_delete_undef) 359 BT_cxx_delete_undef.reset( 360 new BuiltinBug(this, "Uninitialized argument value")); 361 if (DE->isArrayFormAsWritten()) 362 Desc = "Argument to 'delete[]' is uninitialized"; 363 else 364 Desc = "Argument to 'delete' is uninitialized"; 365 BugType *BT = BT_cxx_delete_undef.get(); 366 auto R = llvm::make_unique<BugReport>(*BT, Desc, N); 367 bugreporter::trackNullOrUndefValue(N, DE, *R); 368 C.emitReport(std::move(R)); 369 return; 370 } 371} 372 373void CallAndMessageChecker::checkPreCall(const CallEvent &Call, 374 CheckerContext &C) const { 375 ProgramStateRef State = C.getState(); 376 377 // If this is a call to a C++ method, check if the callee is null or 378 // undefined. 379 if (const CXXInstanceCall *CC = dyn_cast<CXXInstanceCall>(&Call)) { 380 SVal V = CC->getCXXThisVal(); 381 if (V.isUndef()) { 382 if (!BT_cxx_call_undef) 383 BT_cxx_call_undef.reset( 384 new BuiltinBug(this, "Called C++ object pointer is uninitialized")); 385 emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr()); 386 return; 387 } 388 389 ProgramStateRef StNonNull, StNull; 390 std::tie(StNonNull, StNull) = 391 State->assume(V.castAs<DefinedOrUnknownSVal>()); 392 393 if (StNull && !StNonNull) { 394 if (!BT_cxx_call_null) 395 BT_cxx_call_null.reset( 396 new BuiltinBug(this, "Called C++ object pointer is null")); 397 emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr()); 398 return; 399 } 400 401 State = StNonNull; 402 } 403 404 const Decl *D = Call.getDecl(); 405 if (D && (isa<FunctionDecl>(D) || isa<BlockDecl>(D))) { 406 // If we have a function or block declaration, we can make sure we pass 407 // enough parameters. 408 unsigned Params = Call.parameters().size(); 409 if (Call.getNumArgs() < Params) { 410 ExplodedNode *N = C.generateErrorNode(); 411 if (!N) 412 return; 413 414 LazyInit_BT("Function call with too few arguments", BT_call_few_args); 415 416 SmallString<512> Str; 417 llvm::raw_svector_ostream os(Str); 418 if (isa<FunctionDecl>(D)) { 419 os << "Function "; 420 } else { 421 assert(isa<BlockDecl>(D)); 422 os << "Block "; 423 } 424 os << "taking " << Params << " argument" 425 << (Params == 1 ? "" : "s") << " is called with fewer (" 426 << Call.getNumArgs() << ")"; 427 428 C.emitReport( 429 llvm::make_unique<BugReport>(*BT_call_few_args, os.str(), N)); 430 } 431 } 432 433 // Don't check for uninitialized field values in arguments if the 434 // caller has a body that is available and we have the chance to inline it. 435 // This is a hack, but is a reasonable compromise betweens sometimes warning 436 // and sometimes not depending on if we decide to inline a function. 437 const bool checkUninitFields = 438 !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody())); 439 440 std::unique_ptr<BugType> *BT; 441 if (isa<ObjCMethodCall>(Call)) 442 BT = &BT_msg_arg; 443 else 444 BT = &BT_call_arg; 445 446 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D); 447 for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i) { 448 const ParmVarDecl *ParamDecl = nullptr; 449 if(FD && i < FD->getNumParams()) 450 ParamDecl = FD->getParamDecl(i); 451 if (PreVisitProcessArg(C, Call.getArgSVal(i), Call.getArgSourceRange(i), 452 Call.getArgExpr(i), i, 453 checkUninitFields, Call, *BT, ParamDecl)) 454 return; 455 } 456 457 // If we make it here, record our assumptions about the callee. 458 C.addTransition(State); 459} 460 461void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg, 462 CheckerContext &C) const { 463 SVal recVal = msg.getReceiverSVal(); 464 if (recVal.isUndef()) { 465 if (ExplodedNode *N = C.generateErrorNode()) { 466 BugType *BT = nullptr; 467 switch (msg.getMessageKind()) { 468 case OCM_Message: 469 if (!BT_msg_undef) 470 BT_msg_undef.reset(new BuiltinBug(this, 471 "Receiver in message expression " 472 "is an uninitialized value")); 473 BT = BT_msg_undef.get(); 474 break; 475 case OCM_PropertyAccess: 476 if (!BT_objc_prop_undef) 477 BT_objc_prop_undef.reset(new BuiltinBug( 478 this, "Property access on an uninitialized object pointer")); 479 BT = BT_objc_prop_undef.get(); 480 break; 481 case OCM_Subscript: 482 if (!BT_objc_subscript_undef) 483 BT_objc_subscript_undef.reset(new BuiltinBug( 484 this, "Subscript access on an uninitialized object pointer")); 485 BT = BT_objc_subscript_undef.get(); 486 break; 487 } 488 assert(BT && "Unknown message kind."); 489 490 auto R = llvm::make_unique<BugReport>(*BT, BT->getName(), N); 491 const ObjCMessageExpr *ME = msg.getOriginExpr(); 492 R->addRange(ME->getReceiverRange()); 493 494 // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet. 495 if (const Expr *ReceiverE = ME->getInstanceReceiver()) 496 bugreporter::trackNullOrUndefValue(N, ReceiverE, *R); 497 C.emitReport(std::move(R)); 498 } 499 return; 500 } 501} 502 503void CallAndMessageChecker::checkObjCMessageNil(const ObjCMethodCall &msg, 504 CheckerContext &C) const { 505 HandleNilReceiver(C, C.getState(), msg); 506} 507 508void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C, 509 const ObjCMethodCall &msg, 510 ExplodedNode *N) const { 511 512 if (!BT_msg_ret) 513 BT_msg_ret.reset( 514 new BuiltinBug(this, "Receiver in message expression is 'nil'")); 515 516 const ObjCMessageExpr *ME = msg.getOriginExpr(); 517 518 QualType ResTy = msg.getResultType(); 519 520 SmallString<200> buf; 521 llvm::raw_svector_ostream os(buf); 522 os << "The receiver of message '"; 523 ME->getSelector().print(os); 524 os << "' is nil"; 525 if (ResTy->isReferenceType()) { 526 os << ", which results in forming a null reference"; 527 } else { 528 os << " and returns a value of type '"; 529 msg.getResultType().print(os, C.getLangOpts()); 530 os << "' that will be garbage"; 531 } 532 533 auto report = llvm::make_unique<BugReport>(*BT_msg_ret, os.str(), N); 534 report->addRange(ME->getReceiverRange()); 535 // FIXME: This won't track "self" in messages to super. 536 if (const Expr *receiver = ME->getInstanceReceiver()) { 537 bugreporter::trackNullOrUndefValue(N, receiver, *report); 538 } 539 C.emitReport(std::move(report)); 540} 541 542static bool supportsNilWithFloatRet(const llvm::Triple &triple) { 543 return (triple.getVendor() == llvm::Triple::Apple && 544 (triple.isiOS() || triple.isWatchOS() || 545 !triple.isMacOSXVersionLT(10,5))); 546} 547 548void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C, 549 ProgramStateRef state, 550 const ObjCMethodCall &Msg) const { 551 ASTContext &Ctx = C.getASTContext(); 552 static CheckerProgramPointTag Tag(this, "NilReceiver"); 553 554 // Check the return type of the message expression. A message to nil will 555 // return different values depending on the return type and the architecture. 556 QualType RetTy = Msg.getResultType(); 557 CanQualType CanRetTy = Ctx.getCanonicalType(RetTy); 558 const LocationContext *LCtx = C.getLocationContext(); 559 560 if (CanRetTy->isStructureOrClassType()) { 561 // Structure returns are safe since the compiler zeroes them out. 562 SVal V = C.getSValBuilder().makeZeroVal(RetTy); 563 C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag); 564 return; 565 } 566 567 // Other cases: check if sizeof(return type) > sizeof(void*) 568 if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap() 569 .isConsumedExpr(Msg.getOriginExpr())) { 570 // Compute: sizeof(void *) and sizeof(return type) 571 const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy); 572 const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy); 573 574 if (CanRetTy.getTypePtr()->isReferenceType()|| 575 (voidPtrSize < returnTypeSize && 576 !(supportsNilWithFloatRet(Ctx.getTargetInfo().getTriple()) && 577 (Ctx.FloatTy == CanRetTy || 578 Ctx.DoubleTy == CanRetTy || 579 Ctx.LongDoubleTy == CanRetTy || 580 Ctx.LongLongTy == CanRetTy || 581 Ctx.UnsignedLongLongTy == CanRetTy)))) { 582 if (ExplodedNode *N = C.generateErrorNode(state, &Tag)) 583 emitNilReceiverBug(C, Msg, N); 584 return; 585 } 586 587 // Handle the safe cases where the return value is 0 if the 588 // receiver is nil. 589 // 590 // FIXME: For now take the conservative approach that we only 591 // return null values if we *know* that the receiver is nil. 592 // This is because we can have surprises like: 593 // 594 // ... = [[NSScreens screens] objectAtIndex:0]; 595 // 596 // What can happen is that [... screens] could return nil, but 597 // it most likely isn't nil. We should assume the semantics 598 // of this case unless we have *a lot* more knowledge. 599 // 600 SVal V = C.getSValBuilder().makeZeroVal(RetTy); 601 C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag); 602 return; 603 } 604 605 C.addTransition(state); 606} 607 608#define REGISTER_CHECKER(name) \ 609 void ento::register##name(CheckerManager &mgr) { \ 610 CallAndMessageChecker *Checker = \ 611 mgr.registerChecker<CallAndMessageChecker>(); \ 612 Checker->Filter.Check_##name = true; \ 613 Checker->Filter.CheckName_##name = mgr.getCurrentCheckName(); \ 614 } 615 616REGISTER_CHECKER(CallAndMessageUnInitRefArg) 617REGISTER_CHECKER(CallAndMessageChecker) 618