1//===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements uninitialized values analysis for source-level CFGs.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/Analysis/Analyses/UninitializedValues.h"
14#include "clang/AST/Attr.h"
15#include "clang/AST/Decl.h"
16#include "clang/AST/DeclBase.h"
17#include "clang/AST/Expr.h"
18#include "clang/AST/OperationKinds.h"
19#include "clang/AST/Stmt.h"
20#include "clang/AST/StmtObjC.h"
21#include "clang/AST/StmtVisitor.h"
22#include "clang/AST/Type.h"
23#include "clang/Analysis/Analyses/PostOrderCFGView.h"
24#include "clang/Analysis/AnalysisDeclContext.h"
25#include "clang/Analysis/CFG.h"
26#include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
27#include "clang/Analysis/FlowSensitive/DataflowWorklist.h"
28#include "clang/Basic/LLVM.h"
29#include "llvm/ADT/BitVector.h"
30#include "llvm/ADT/DenseMap.h"
31#include "llvm/ADT/None.h"
32#include "llvm/ADT/Optional.h"
33#include "llvm/ADT/PackedVector.h"
34#include "llvm/ADT/SmallBitVector.h"
35#include "llvm/ADT/SmallVector.h"
36#include "llvm/Support/Casting.h"
37#include <algorithm>
38#include <cassert>
39
40using namespace clang;
41
42#define DEBUG_LOGGING 0
43
44static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
45  if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
46      !vd->isExceptionVariable() && !vd->isInitCapture() &&
47      !vd->isImplicit() && vd->getDeclContext() == dc) {
48    QualType ty = vd->getType();
49    return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
50  }
51  return false;
52}
53
54//------------------------------------------------------------------------====//
55// DeclToIndex: a mapping from Decls we track to value indices.
56//====------------------------------------------------------------------------//
57
58namespace {
59
60class DeclToIndex {
61  llvm::DenseMap<const VarDecl *, unsigned> map;
62
63public:
64  DeclToIndex() = default;
65
66  /// Compute the actual mapping from declarations to bits.
67  void computeMap(const DeclContext &dc);
68
69  /// Return the number of declarations in the map.
70  unsigned size() const { return map.size(); }
71
72  /// Returns the bit vector index for a given declaration.
73  Optional<unsigned> getValueIndex(const VarDecl *d) const;
74};
75
76} // namespace
77
78void DeclToIndex::computeMap(const DeclContext &dc) {
79  unsigned count = 0;
80  DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
81                                               E(dc.decls_end());
82  for ( ; I != E; ++I) {
83    const VarDecl *vd = *I;
84    if (isTrackedVar(vd, &dc))
85      map[vd] = count++;
86  }
87}
88
89Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
90  llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
91  if (I == map.end())
92    return None;
93  return I->second;
94}
95
96//------------------------------------------------------------------------====//
97// CFGBlockValues: dataflow values for CFG blocks.
98//====------------------------------------------------------------------------//
99
100// These values are defined in such a way that a merge can be done using
101// a bitwise OR.
102enum Value { Unknown = 0x0,         /* 00 */
103             Initialized = 0x1,     /* 01 */
104             Uninitialized = 0x2,   /* 10 */
105             MayUninitialized = 0x3 /* 11 */ };
106
107static bool isUninitialized(const Value v) {
108  return v >= Uninitialized;
109}
110
111static bool isAlwaysUninit(const Value v) {
112  return v == Uninitialized;
113}
114
115namespace {
116
117using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
118
119class CFGBlockValues {
120  const CFG &cfg;
121  SmallVector<ValueVector, 8> vals;
122  ValueVector scratch;
123  DeclToIndex declToIndex;
124
125public:
126  CFGBlockValues(const CFG &cfg);
127
128  unsigned getNumEntries() const { return declToIndex.size(); }
129
130  void computeSetOfDeclarations(const DeclContext &dc);
131
132  ValueVector &getValueVector(const CFGBlock *block) {
133    return vals[block->getBlockID()];
134  }
135
136  void setAllScratchValues(Value V);
137  void mergeIntoScratch(ValueVector const &source, bool isFirst);
138  bool updateValueVectorWithScratch(const CFGBlock *block);
139
140  bool hasNoDeclarations() const {
141    return declToIndex.size() == 0;
142  }
143
144  void resetScratch();
145
146  ValueVector::reference operator[](const VarDecl *vd);
147
148  Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
149                 const VarDecl *vd) {
150    const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
151    assert(idx.hasValue());
152    return getValueVector(block)[idx.getValue()];
153  }
154};
155
156} // namespace
157
158CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
159
160void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
161  declToIndex.computeMap(dc);
162  unsigned decls = declToIndex.size();
163  scratch.resize(decls);
164  unsigned n = cfg.getNumBlockIDs();
165  if (!n)
166    return;
167  vals.resize(n);
168  for (auto &val : vals)
169    val.resize(decls);
170}
171
172#if DEBUG_LOGGING
173static void printVector(const CFGBlock *block, ValueVector &bv,
174                        unsigned num) {
175  llvm::errs() << block->getBlockID() << " :";
176  for (const auto &i : bv)
177    llvm::errs() << ' ' << i;
178  llvm::errs() << " : " << num << '\n';
179}
180#endif
181
182void CFGBlockValues::setAllScratchValues(Value V) {
183  for (unsigned I = 0, E = scratch.size(); I != E; ++I)
184    scratch[I] = V;
185}
186
187void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
188                                      bool isFirst) {
189  if (isFirst)
190    scratch = source;
191  else
192    scratch |= source;
193}
194
195bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
196  ValueVector &dst = getValueVector(block);
197  bool changed = (dst != scratch);
198  if (changed)
199    dst = scratch;
200#if DEBUG_LOGGING
201  printVector(block, scratch, 0);
202#endif
203  return changed;
204}
205
206void CFGBlockValues::resetScratch() {
207  scratch.reset();
208}
209
210ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
211  const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
212  assert(idx.hasValue());
213  return scratch[idx.getValue()];
214}
215
216//------------------------------------------------------------------------====//
217// Classification of DeclRefExprs as use or initialization.
218//====------------------------------------------------------------------------//
219
220namespace {
221
222class FindVarResult {
223  const VarDecl *vd;
224  const DeclRefExpr *dr;
225
226public:
227  FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
228
229  const DeclRefExpr *getDeclRefExpr() const { return dr; }
230  const VarDecl *getDecl() const { return vd; }
231};
232
233} // namespace
234
235static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
236  while (Ex) {
237    Ex = Ex->IgnoreParenNoopCasts(C);
238    if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
239      if (CE->getCastKind() == CK_LValueBitCast) {
240        Ex = CE->getSubExpr();
241        continue;
242      }
243    }
244    break;
245  }
246  return Ex;
247}
248
249/// If E is an expression comprising a reference to a single variable, find that
250/// variable.
251static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
252  if (const auto *DRE =
253          dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
254    if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
255      if (isTrackedVar(VD, DC))
256        return FindVarResult(VD, DRE);
257  return FindVarResult(nullptr, nullptr);
258}
259
260namespace {
261
262/// Classify each DeclRefExpr as an initialization or a use. Any
263/// DeclRefExpr which isn't explicitly classified will be assumed to have
264/// escaped the analysis and will be treated as an initialization.
265class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
266public:
267  enum Class {
268    Init,
269    Use,
270    SelfInit,
271    ConstRefUse,
272    Ignore
273  };
274
275private:
276  const DeclContext *DC;
277  llvm::DenseMap<const DeclRefExpr *, Class> Classification;
278
279  bool isTrackedVar(const VarDecl *VD) const {
280    return ::isTrackedVar(VD, DC);
281  }
282
283  void classify(const Expr *E, Class C);
284
285public:
286  ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
287
288  void VisitDeclStmt(DeclStmt *DS);
289  void VisitUnaryOperator(UnaryOperator *UO);
290  void VisitBinaryOperator(BinaryOperator *BO);
291  void VisitCallExpr(CallExpr *CE);
292  void VisitCastExpr(CastExpr *CE);
293  void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
294
295  void operator()(Stmt *S) { Visit(S); }
296
297  Class get(const DeclRefExpr *DRE) const {
298    llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
299        = Classification.find(DRE);
300    if (I != Classification.end())
301      return I->second;
302
303    const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
304    if (!VD || !isTrackedVar(VD))
305      return Ignore;
306
307    return Init;
308  }
309};
310
311} // namespace
312
313static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
314  if (VD->getType()->isRecordType())
315    return nullptr;
316  if (Expr *Init = VD->getInit()) {
317    const auto *DRE =
318        dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
319    if (DRE && DRE->getDecl() == VD)
320      return DRE;
321  }
322  return nullptr;
323}
324
325void ClassifyRefs::classify(const Expr *E, Class C) {
326  // The result of a ?: could also be an lvalue.
327  E = E->IgnoreParens();
328  if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
329    classify(CO->getTrueExpr(), C);
330    classify(CO->getFalseExpr(), C);
331    return;
332  }
333
334  if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
335    classify(BCO->getFalseExpr(), C);
336    return;
337  }
338
339  if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
340    classify(OVE->getSourceExpr(), C);
341    return;
342  }
343
344  if (const auto *ME = dyn_cast<MemberExpr>(E)) {
345    if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
346      if (!VD->isStaticDataMember())
347        classify(ME->getBase(), C);
348    }
349    return;
350  }
351
352  if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
353    switch (BO->getOpcode()) {
354    case BO_PtrMemD:
355    case BO_PtrMemI:
356      classify(BO->getLHS(), C);
357      return;
358    case BO_Comma:
359      classify(BO->getRHS(), C);
360      return;
361    default:
362      return;
363    }
364  }
365
366  FindVarResult Var = findVar(E, DC);
367  if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
368    Classification[DRE] = std::max(Classification[DRE], C);
369}
370
371void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
372  for (auto *DI : DS->decls()) {
373    auto *VD = dyn_cast<VarDecl>(DI);
374    if (VD && isTrackedVar(VD))
375      if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
376        Classification[DRE] = SelfInit;
377  }
378}
379
380void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
381  // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
382  // is not a compound-assignment, we will treat it as initializing the variable
383  // when TransferFunctions visits it. A compound-assignment does not affect
384  // whether a variable is uninitialized, and there's no point counting it as a
385  // use.
386  if (BO->isCompoundAssignmentOp())
387    classify(BO->getLHS(), Use);
388  else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
389    classify(BO->getLHS(), Ignore);
390}
391
392void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
393  // Increment and decrement are uses despite there being no lvalue-to-rvalue
394  // conversion.
395  if (UO->isIncrementDecrementOp())
396    classify(UO->getSubExpr(), Use);
397}
398
399void ClassifyRefs::VisitOMPExecutableDirective(OMPExecutableDirective *ED) {
400  for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses()))
401    classify(cast<Expr>(S), Use);
402}
403
404static bool isPointerToConst(const QualType &QT) {
405  return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
406}
407
408static bool hasTrivialBody(CallExpr *CE) {
409  if (FunctionDecl *FD = CE->getDirectCallee()) {
410    if (FunctionTemplateDecl *FTD = FD->getPrimaryTemplate())
411      return FTD->getTemplatedDecl()->hasTrivialBody();
412    return FD->hasTrivialBody();
413  }
414  return false;
415}
416
417void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
418  // Classify arguments to std::move as used.
419  if (CE->isCallToStdMove()) {
420    // RecordTypes are handled in SemaDeclCXX.cpp.
421    if (!CE->getArg(0)->getType()->isRecordType())
422      classify(CE->getArg(0), Use);
423    return;
424  }
425  bool isTrivialBody = hasTrivialBody(CE);
426  // If a value is passed by const pointer to a function,
427  // we should not assume that it is initialized by the call, and we
428  // conservatively do not assume that it is used.
429  // If a value is passed by const reference to a function,
430  // it should already be initialized.
431  for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
432       I != E; ++I) {
433    if ((*I)->isGLValue()) {
434      if ((*I)->getType().isConstQualified())
435        classify((*I), isTrivialBody ? Ignore : ConstRefUse);
436    } else if (isPointerToConst((*I)->getType())) {
437      const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
438      const auto *UO = dyn_cast<UnaryOperator>(Ex);
439      if (UO && UO->getOpcode() == UO_AddrOf)
440        Ex = UO->getSubExpr();
441      classify(Ex, Ignore);
442    }
443  }
444}
445
446void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
447  if (CE->getCastKind() == CK_LValueToRValue)
448    classify(CE->getSubExpr(), Use);
449  else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
450    if (CSE->getType()->isVoidType()) {
451      // Squelch any detected load of an uninitialized value if
452      // we cast it to void.
453      // e.g. (void) x;
454      classify(CSE->getSubExpr(), Ignore);
455    }
456  }
457}
458
459//------------------------------------------------------------------------====//
460// Transfer function for uninitialized values analysis.
461//====------------------------------------------------------------------------//
462
463namespace {
464
465class TransferFunctions : public StmtVisitor<TransferFunctions> {
466  CFGBlockValues &vals;
467  const CFG &cfg;
468  const CFGBlock *block;
469  AnalysisDeclContext &ac;
470  const ClassifyRefs &classification;
471  ObjCNoReturn objCNoRet;
472  UninitVariablesHandler &handler;
473
474public:
475  TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
476                    const CFGBlock *block, AnalysisDeclContext &ac,
477                    const ClassifyRefs &classification,
478                    UninitVariablesHandler &handler)
479      : vals(vals), cfg(cfg), block(block), ac(ac),
480        classification(classification), objCNoRet(ac.getASTContext()),
481        handler(handler) {}
482
483  void reportUse(const Expr *ex, const VarDecl *vd);
484  void reportConstRefUse(const Expr *ex, const VarDecl *vd);
485
486  void VisitBinaryOperator(BinaryOperator *bo);
487  void VisitBlockExpr(BlockExpr *be);
488  void VisitCallExpr(CallExpr *ce);
489  void VisitDeclRefExpr(DeclRefExpr *dr);
490  void VisitDeclStmt(DeclStmt *ds);
491  void VisitGCCAsmStmt(GCCAsmStmt *as);
492  void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
493  void VisitObjCMessageExpr(ObjCMessageExpr *ME);
494  void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
495
496  bool isTrackedVar(const VarDecl *vd) {
497    return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
498  }
499
500  FindVarResult findVar(const Expr *ex) {
501    return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
502  }
503
504  UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
505    UninitUse Use(ex, isAlwaysUninit(v));
506
507    assert(isUninitialized(v));
508    if (Use.getKind() == UninitUse::Always)
509      return Use;
510
511    // If an edge which leads unconditionally to this use did not initialize
512    // the variable, we can say something stronger than 'may be uninitialized':
513    // we can say 'either it's used uninitialized or you have dead code'.
514    //
515    // We track the number of successors of a node which have been visited, and
516    // visit a node once we have visited all of its successors. Only edges where
517    // the variable might still be uninitialized are followed. Since a variable
518    // can't transfer from being initialized to being uninitialized, this will
519    // trace out the subgraph which inevitably leads to the use and does not
520    // initialize the variable. We do not want to skip past loops, since their
521    // non-termination might be correlated with the initialization condition.
522    //
523    // For example:
524    //
525    //         void f(bool a, bool b) {
526    // block1:   int n;
527    //           if (a) {
528    // block2:     if (b)
529    // block3:       n = 1;
530    // block4:   } else if (b) {
531    // block5:     while (!a) {
532    // block6:       do_work(&a);
533    //               n = 2;
534    //             }
535    //           }
536    // block7:   if (a)
537    // block8:     g();
538    // block9:   return n;
539    //         }
540    //
541    // Starting from the maybe-uninitialized use in block 9:
542    //  * Block 7 is not visited because we have only visited one of its two
543    //    successors.
544    //  * Block 8 is visited because we've visited its only successor.
545    // From block 8:
546    //  * Block 7 is visited because we've now visited both of its successors.
547    // From block 7:
548    //  * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
549    //    of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
550    //  * Block 3 is not visited because it initializes 'n'.
551    // Now the algorithm terminates, having visited blocks 7 and 8, and having
552    // found the frontier is blocks 2, 4, and 5.
553    //
554    // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
555    // and 4), so we report that any time either of those edges is taken (in
556    // each case when 'b == false'), 'n' is used uninitialized.
557    SmallVector<const CFGBlock*, 32> Queue;
558    SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
559    Queue.push_back(block);
560    // Specify that we've already visited all successors of the starting block.
561    // This has the dual purpose of ensuring we never add it to the queue, and
562    // of marking it as not being a candidate element of the frontier.
563    SuccsVisited[block->getBlockID()] = block->succ_size();
564    while (!Queue.empty()) {
565      const CFGBlock *B = Queue.pop_back_val();
566
567      // If the use is always reached from the entry block, make a note of that.
568      if (B == &cfg.getEntry())
569        Use.setUninitAfterCall();
570
571      for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
572           I != E; ++I) {
573        const CFGBlock *Pred = *I;
574        if (!Pred)
575          continue;
576
577        Value AtPredExit = vals.getValue(Pred, B, vd);
578        if (AtPredExit == Initialized)
579          // This block initializes the variable.
580          continue;
581        if (AtPredExit == MayUninitialized &&
582            vals.getValue(B, nullptr, vd) == Uninitialized) {
583          // This block declares the variable (uninitialized), and is reachable
584          // from a block that initializes the variable. We can't guarantee to
585          // give an earlier location for the diagnostic (and it appears that
586          // this code is intended to be reachable) so give a diagnostic here
587          // and go no further down this path.
588          Use.setUninitAfterDecl();
589          continue;
590        }
591
592        if (AtPredExit == MayUninitialized) {
593          // If the predecessor's terminator is an "asm goto" that initializes
594          // the variable, then it won't be counted as "initialized" on the
595          // non-fallthrough paths.
596          CFGTerminator term = Pred->getTerminator();
597          if (const auto *as = dyn_cast_or_null<GCCAsmStmt>(term.getStmt())) {
598            const CFGBlock *fallthrough = *Pred->succ_begin();
599            if (as->isAsmGoto() &&
600                llvm::any_of(as->outputs(), [&](const Expr *output) {
601                    return vd == findVar(output).getDecl() &&
602                        llvm::any_of(as->labels(),
603                                     [&](const AddrLabelExpr *label) {
604                          return label->getLabel()->getStmt() == B->Label &&
605                              B != fallthrough;
606                        });
607                })) {
608              Use.setUninitAfterDecl();
609              continue;
610            }
611          }
612        }
613
614        unsigned &SV = SuccsVisited[Pred->getBlockID()];
615        if (!SV) {
616          // When visiting the first successor of a block, mark all NULL
617          // successors as having been visited.
618          for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
619                                             SE = Pred->succ_end();
620               SI != SE; ++SI)
621            if (!*SI)
622              ++SV;
623        }
624
625        if (++SV == Pred->succ_size())
626          // All paths from this block lead to the use and don't initialize the
627          // variable.
628          Queue.push_back(Pred);
629      }
630    }
631
632    // Scan the frontier, looking for blocks where the variable was
633    // uninitialized.
634    for (const auto *Block : cfg) {
635      unsigned BlockID = Block->getBlockID();
636      const Stmt *Term = Block->getTerminatorStmt();
637      if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
638          Term) {
639        // This block inevitably leads to the use. If we have an edge from here
640        // to a post-dominator block, and the variable is uninitialized on that
641        // edge, we have found a bug.
642        for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
643             E = Block->succ_end(); I != E; ++I) {
644          const CFGBlock *Succ = *I;
645          if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
646              vals.getValue(Block, Succ, vd) == Uninitialized) {
647            // Switch cases are a special case: report the label to the caller
648            // as the 'terminator', not the switch statement itself. Suppress
649            // situations where no label matched: we can't be sure that's
650            // possible.
651            if (isa<SwitchStmt>(Term)) {
652              const Stmt *Label = Succ->getLabel();
653              if (!Label || !isa<SwitchCase>(Label))
654                // Might not be possible.
655                continue;
656              UninitUse::Branch Branch;
657              Branch.Terminator = Label;
658              Branch.Output = 0; // Ignored.
659              Use.addUninitBranch(Branch);
660            } else {
661              UninitUse::Branch Branch;
662              Branch.Terminator = Term;
663              Branch.Output = I - Block->succ_begin();
664              Use.addUninitBranch(Branch);
665            }
666          }
667        }
668      }
669    }
670
671    return Use;
672  }
673};
674
675} // namespace
676
677void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
678  Value v = vals[vd];
679  if (isUninitialized(v))
680    handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
681}
682
683void TransferFunctions::reportConstRefUse(const Expr *ex, const VarDecl *vd) {
684  Value v = vals[vd];
685  if (isAlwaysUninit(v))
686    handler.handleConstRefUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
687}
688
689void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
690  // This represents an initialization of the 'element' value.
691  if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
692    const auto *VD = cast<VarDecl>(DS->getSingleDecl());
693    if (isTrackedVar(VD))
694      vals[VD] = Initialized;
695  }
696}
697
698void TransferFunctions::VisitOMPExecutableDirective(
699    OMPExecutableDirective *ED) {
700  for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses())) {
701    assert(S && "Expected non-null used-in-clause child.");
702    Visit(S);
703  }
704  if (!ED->isStandaloneDirective())
705    Visit(ED->getStructuredBlock());
706}
707
708void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
709  const BlockDecl *bd = be->getBlockDecl();
710  for (const auto &I : bd->captures()) {
711    const VarDecl *vd = I.getVariable();
712    if (!isTrackedVar(vd))
713      continue;
714    if (I.isByRef()) {
715      vals[vd] = Initialized;
716      continue;
717    }
718    reportUse(be, vd);
719  }
720}
721
722void TransferFunctions::VisitCallExpr(CallExpr *ce) {
723  if (Decl *Callee = ce->getCalleeDecl()) {
724    if (Callee->hasAttr<ReturnsTwiceAttr>()) {
725      // After a call to a function like setjmp or vfork, any variable which is
726      // initialized anywhere within this function may now be initialized. For
727      // now, just assume such a call initializes all variables.  FIXME: Only
728      // mark variables as initialized if they have an initializer which is
729      // reachable from here.
730      vals.setAllScratchValues(Initialized);
731    }
732    else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
733      // Functions labeled like "analyzer_noreturn" are often used to denote
734      // "panic" functions that in special debug situations can still return,
735      // but for the most part should not be treated as returning.  This is a
736      // useful annotation borrowed from the static analyzer that is useful for
737      // suppressing branch-specific false positives when we call one of these
738      // functions but keep pretending the path continues (when in reality the
739      // user doesn't care).
740      vals.setAllScratchValues(Unknown);
741    }
742  }
743}
744
745void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
746  switch (classification.get(dr)) {
747  case ClassifyRefs::Ignore:
748    break;
749  case ClassifyRefs::Use:
750    reportUse(dr, cast<VarDecl>(dr->getDecl()));
751    break;
752  case ClassifyRefs::Init:
753    vals[cast<VarDecl>(dr->getDecl())] = Initialized;
754    break;
755  case ClassifyRefs::SelfInit:
756    handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
757    break;
758  case ClassifyRefs::ConstRefUse:
759    reportConstRefUse(dr, cast<VarDecl>(dr->getDecl()));
760    break;
761  }
762}
763
764void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
765  if (BO->getOpcode() == BO_Assign) {
766    FindVarResult Var = findVar(BO->getLHS());
767    if (const VarDecl *VD = Var.getDecl())
768      vals[VD] = Initialized;
769  }
770}
771
772void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
773  for (auto *DI : DS->decls()) {
774    auto *VD = dyn_cast<VarDecl>(DI);
775    if (VD && isTrackedVar(VD)) {
776      if (getSelfInitExpr(VD)) {
777        // If the initializer consists solely of a reference to itself, we
778        // explicitly mark the variable as uninitialized. This allows code
779        // like the following:
780        //
781        //   int x = x;
782        //
783        // to deliberately leave a variable uninitialized. Different analysis
784        // clients can detect this pattern and adjust their reporting
785        // appropriately, but we need to continue to analyze subsequent uses
786        // of the variable.
787        vals[VD] = Uninitialized;
788      } else if (VD->getInit()) {
789        // Treat the new variable as initialized.
790        vals[VD] = Initialized;
791      } else {
792        // No initializer: the variable is now uninitialized. This matters
793        // for cases like:
794        //   while (...) {
795        //     int n;
796        //     use(n);
797        //     n = 0;
798        //   }
799        // FIXME: Mark the variable as uninitialized whenever its scope is
800        // left, since its scope could be re-entered by a jump over the
801        // declaration.
802        vals[VD] = Uninitialized;
803      }
804    }
805  }
806}
807
808void TransferFunctions::VisitGCCAsmStmt(GCCAsmStmt *as) {
809  // An "asm goto" statement is a terminator that may initialize some variables.
810  if (!as->isAsmGoto())
811    return;
812
813  for (const Expr *o : as->outputs())
814    if (const VarDecl *VD = findVar(o).getDecl())
815      if (vals[VD] != Initialized)
816        // If the variable isn't initialized by the time we get here, then we
817        // mark it as potentially uninitialized for those cases where it's used
818        // on an indirect path, where it's not guaranteed to be defined.
819        vals[VD] = MayUninitialized;
820}
821
822void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
823  // If the Objective-C message expression is an implicit no-return that
824  // is not modeled in the CFG, set the tracked dataflow values to Unknown.
825  if (objCNoRet.isImplicitNoReturn(ME)) {
826    vals.setAllScratchValues(Unknown);
827  }
828}
829
830//------------------------------------------------------------------------====//
831// High-level "driver" logic for uninitialized values analysis.
832//====------------------------------------------------------------------------//
833
834static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
835                       AnalysisDeclContext &ac, CFGBlockValues &vals,
836                       const ClassifyRefs &classification,
837                       llvm::BitVector &wasAnalyzed,
838                       UninitVariablesHandler &handler) {
839  wasAnalyzed[block->getBlockID()] = true;
840  vals.resetScratch();
841  // Merge in values of predecessor blocks.
842  bool isFirst = true;
843  for (CFGBlock::const_pred_iterator I = block->pred_begin(),
844       E = block->pred_end(); I != E; ++I) {
845    const CFGBlock *pred = *I;
846    if (!pred)
847      continue;
848    if (wasAnalyzed[pred->getBlockID()]) {
849      vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
850      isFirst = false;
851    }
852  }
853  // Apply the transfer function.
854  TransferFunctions tf(vals, cfg, block, ac, classification, handler);
855  for (const auto &I : *block) {
856    if (Optional<CFGStmt> cs = I.getAs<CFGStmt>())
857      tf.Visit(const_cast<Stmt *>(cs->getStmt()));
858  }
859  CFGTerminator terminator = block->getTerminator();
860  if (auto *as = dyn_cast_or_null<GCCAsmStmt>(terminator.getStmt()))
861    if (as->isAsmGoto())
862      tf.Visit(as);
863  return vals.updateValueVectorWithScratch(block);
864}
865
866namespace {
867
868/// PruneBlocksHandler is a special UninitVariablesHandler that is used
869/// to detect when a CFGBlock has any *potential* use of an uninitialized
870/// variable.  It is mainly used to prune out work during the final
871/// reporting pass.
872struct PruneBlocksHandler : public UninitVariablesHandler {
873  /// Records if a CFGBlock had a potential use of an uninitialized variable.
874  llvm::BitVector hadUse;
875
876  /// Records if any CFGBlock had a potential use of an uninitialized variable.
877  bool hadAnyUse = false;
878
879  /// The current block to scribble use information.
880  unsigned currentBlock = 0;
881
882  PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
883
884  ~PruneBlocksHandler() override = default;
885
886  void handleUseOfUninitVariable(const VarDecl *vd,
887                                 const UninitUse &use) override {
888    hadUse[currentBlock] = true;
889    hadAnyUse = true;
890  }
891
892  void handleConstRefUseOfUninitVariable(const VarDecl *vd,
893                                         const UninitUse &use) override {
894    hadUse[currentBlock] = true;
895    hadAnyUse = true;
896  }
897
898  /// Called when the uninitialized variable analysis detects the
899  /// idiom 'int x = x'.  All other uses of 'x' within the initializer
900  /// are handled by handleUseOfUninitVariable.
901  void handleSelfInit(const VarDecl *vd) override {
902    hadUse[currentBlock] = true;
903    hadAnyUse = true;
904  }
905};
906
907} // namespace
908
909void clang::runUninitializedVariablesAnalysis(
910    const DeclContext &dc,
911    const CFG &cfg,
912    AnalysisDeclContext &ac,
913    UninitVariablesHandler &handler,
914    UninitVariablesAnalysisStats &stats) {
915  CFGBlockValues vals(cfg);
916  vals.computeSetOfDeclarations(dc);
917  if (vals.hasNoDeclarations())
918    return;
919
920  stats.NumVariablesAnalyzed = vals.getNumEntries();
921
922  // Precompute which expressions are uses and which are initializations.
923  ClassifyRefs classification(ac);
924  cfg.VisitBlockStmts(classification);
925
926  // Mark all variables uninitialized at the entry.
927  const CFGBlock &entry = cfg.getEntry();
928  ValueVector &vec = vals.getValueVector(&entry);
929  const unsigned n = vals.getNumEntries();
930  for (unsigned j = 0; j < n; ++j) {
931    vec[j] = Uninitialized;
932  }
933
934  // Proceed with the workist.
935  ForwardDataflowWorklist worklist(cfg, ac);
936  llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
937  worklist.enqueueSuccessors(&cfg.getEntry());
938  llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
939  wasAnalyzed[cfg.getEntry().getBlockID()] = true;
940  PruneBlocksHandler PBH(cfg.getNumBlockIDs());
941
942  while (const CFGBlock *block = worklist.dequeue()) {
943    PBH.currentBlock = block->getBlockID();
944
945    // Did the block change?
946    bool changed = runOnBlock(block, cfg, ac, vals,
947                              classification, wasAnalyzed, PBH);
948    ++stats.NumBlockVisits;
949    if (changed || !previouslyVisited[block->getBlockID()])
950      worklist.enqueueSuccessors(block);
951    previouslyVisited[block->getBlockID()] = true;
952  }
953
954  if (!PBH.hadAnyUse)
955    return;
956
957  // Run through the blocks one more time, and report uninitialized variables.
958  for (const auto *block : cfg)
959    if (PBH.hadUse[block->getBlockID()]) {
960      runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
961      ++stats.NumBlockVisits;
962    }
963}
964
965UninitVariablesHandler::~UninitVariablesHandler() = default;
966