1//===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements uninitialized values analysis for source-level CFGs.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/Analysis/Analyses/UninitializedValues.h"
14#include "clang/AST/Attr.h"
15#include "clang/AST/Decl.h"
16#include "clang/AST/DeclBase.h"
17#include "clang/AST/Expr.h"
18#include "clang/AST/OperationKinds.h"
19#include "clang/AST/Stmt.h"
20#include "clang/AST/StmtObjC.h"
21#include "clang/AST/StmtVisitor.h"
22#include "clang/AST/Type.h"
23#include "clang/Analysis/Analyses/PostOrderCFGView.h"
24#include "clang/Analysis/AnalysisDeclContext.h"
25#include "clang/Analysis/CFG.h"
26#include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
27#include "clang/Analysis/FlowSensitive/DataflowWorklist.h"
28#include "clang/Basic/LLVM.h"
29#include "llvm/ADT/BitVector.h"
30#include "llvm/ADT/DenseMap.h"
31#include "llvm/ADT/PackedVector.h"
32#include "llvm/ADT/SmallBitVector.h"
33#include "llvm/ADT/SmallVector.h"
34#include "llvm/Support/Casting.h"
35#include <algorithm>
36#include <cassert>
37#include <optional>
38
39using namespace clang;
40
41#define DEBUG_LOGGING 0
42
43static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
44  if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
45      !vd->isExceptionVariable() && !vd->isInitCapture() &&
46      !vd->isImplicit() && vd->getDeclContext() == dc) {
47    QualType ty = vd->getType();
48    return ty->isScalarType() || ty->isVectorType() || ty->isRecordType() ||
49           ty->isRVVType();
50  }
51  return false;
52}
53
54//------------------------------------------------------------------------====//
55// DeclToIndex: a mapping from Decls we track to value indices.
56//====------------------------------------------------------------------------//
57
58namespace {
59
60class DeclToIndex {
61  llvm::DenseMap<const VarDecl *, unsigned> map;
62
63public:
64  DeclToIndex() = default;
65
66  /// Compute the actual mapping from declarations to bits.
67  void computeMap(const DeclContext &dc);
68
69  /// Return the number of declarations in the map.
70  unsigned size() const { return map.size(); }
71
72  /// Returns the bit vector index for a given declaration.
73  std::optional<unsigned> getValueIndex(const VarDecl *d) const;
74};
75
76} // namespace
77
78void DeclToIndex::computeMap(const DeclContext &dc) {
79  unsigned count = 0;
80  DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
81                                               E(dc.decls_end());
82  for ( ; I != E; ++I) {
83    const VarDecl *vd = *I;
84    if (isTrackedVar(vd, &dc))
85      map[vd] = count++;
86  }
87}
88
89std::optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
90  llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
91  if (I == map.end())
92    return std::nullopt;
93  return I->second;
94}
95
96//------------------------------------------------------------------------====//
97// CFGBlockValues: dataflow values for CFG blocks.
98//====------------------------------------------------------------------------//
99
100// These values are defined in such a way that a merge can be done using
101// a bitwise OR.
102enum Value { Unknown = 0x0,         /* 00 */
103             Initialized = 0x1,     /* 01 */
104             Uninitialized = 0x2,   /* 10 */
105             MayUninitialized = 0x3 /* 11 */ };
106
107static bool isUninitialized(const Value v) {
108  return v >= Uninitialized;
109}
110
111static bool isAlwaysUninit(const Value v) {
112  return v == Uninitialized;
113}
114
115namespace {
116
117using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
118
119class CFGBlockValues {
120  const CFG &cfg;
121  SmallVector<ValueVector, 8> vals;
122  ValueVector scratch;
123  DeclToIndex declToIndex;
124
125public:
126  CFGBlockValues(const CFG &cfg);
127
128  unsigned getNumEntries() const { return declToIndex.size(); }
129
130  void computeSetOfDeclarations(const DeclContext &dc);
131
132  ValueVector &getValueVector(const CFGBlock *block) {
133    return vals[block->getBlockID()];
134  }
135
136  void setAllScratchValues(Value V);
137  void mergeIntoScratch(ValueVector const &source, bool isFirst);
138  bool updateValueVectorWithScratch(const CFGBlock *block);
139
140  bool hasNoDeclarations() const {
141    return declToIndex.size() == 0;
142  }
143
144  void resetScratch();
145
146  ValueVector::reference operator[](const VarDecl *vd);
147
148  Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
149                 const VarDecl *vd) {
150    std::optional<unsigned> idx = declToIndex.getValueIndex(vd);
151    return getValueVector(block)[*idx];
152  }
153};
154
155} // namespace
156
157CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
158
159void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
160  declToIndex.computeMap(dc);
161  unsigned decls = declToIndex.size();
162  scratch.resize(decls);
163  unsigned n = cfg.getNumBlockIDs();
164  if (!n)
165    return;
166  vals.resize(n);
167  for (auto &val : vals)
168    val.resize(decls);
169}
170
171#if DEBUG_LOGGING
172static void printVector(const CFGBlock *block, ValueVector &bv,
173                        unsigned num) {
174  llvm::errs() << block->getBlockID() << " :";
175  for (const auto &i : bv)
176    llvm::errs() << ' ' << i;
177  llvm::errs() << " : " << num << '\n';
178}
179#endif
180
181void CFGBlockValues::setAllScratchValues(Value V) {
182  for (unsigned I = 0, E = scratch.size(); I != E; ++I)
183    scratch[I] = V;
184}
185
186void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
187                                      bool isFirst) {
188  if (isFirst)
189    scratch = source;
190  else
191    scratch |= source;
192}
193
194bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
195  ValueVector &dst = getValueVector(block);
196  bool changed = (dst != scratch);
197  if (changed)
198    dst = scratch;
199#if DEBUG_LOGGING
200  printVector(block, scratch, 0);
201#endif
202  return changed;
203}
204
205void CFGBlockValues::resetScratch() {
206  scratch.reset();
207}
208
209ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
210  return scratch[*declToIndex.getValueIndex(vd)];
211}
212
213//------------------------------------------------------------------------====//
214// Classification of DeclRefExprs as use or initialization.
215//====------------------------------------------------------------------------//
216
217namespace {
218
219class FindVarResult {
220  const VarDecl *vd;
221  const DeclRefExpr *dr;
222
223public:
224  FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
225
226  const DeclRefExpr *getDeclRefExpr() const { return dr; }
227  const VarDecl *getDecl() const { return vd; }
228};
229
230} // namespace
231
232static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
233  while (Ex) {
234    Ex = Ex->IgnoreParenNoopCasts(C);
235    if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
236      if (CE->getCastKind() == CK_LValueBitCast) {
237        Ex = CE->getSubExpr();
238        continue;
239      }
240    }
241    break;
242  }
243  return Ex;
244}
245
246/// If E is an expression comprising a reference to a single variable, find that
247/// variable.
248static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
249  if (const auto *DRE =
250          dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
251    if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
252      if (isTrackedVar(VD, DC))
253        return FindVarResult(VD, DRE);
254  return FindVarResult(nullptr, nullptr);
255}
256
257namespace {
258
259/// Classify each DeclRefExpr as an initialization or a use. Any
260/// DeclRefExpr which isn't explicitly classified will be assumed to have
261/// escaped the analysis and will be treated as an initialization.
262class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
263public:
264  enum Class {
265    Init,
266    Use,
267    SelfInit,
268    ConstRefUse,
269    Ignore
270  };
271
272private:
273  const DeclContext *DC;
274  llvm::DenseMap<const DeclRefExpr *, Class> Classification;
275
276  bool isTrackedVar(const VarDecl *VD) const {
277    return ::isTrackedVar(VD, DC);
278  }
279
280  void classify(const Expr *E, Class C);
281
282public:
283  ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
284
285  void VisitDeclStmt(DeclStmt *DS);
286  void VisitUnaryOperator(UnaryOperator *UO);
287  void VisitBinaryOperator(BinaryOperator *BO);
288  void VisitCallExpr(CallExpr *CE);
289  void VisitCastExpr(CastExpr *CE);
290  void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
291
292  void operator()(Stmt *S) { Visit(S); }
293
294  Class get(const DeclRefExpr *DRE) const {
295    llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
296        = Classification.find(DRE);
297    if (I != Classification.end())
298      return I->second;
299
300    const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
301    if (!VD || !isTrackedVar(VD))
302      return Ignore;
303
304    return Init;
305  }
306};
307
308} // namespace
309
310static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
311  if (VD->getType()->isRecordType())
312    return nullptr;
313  if (Expr *Init = VD->getInit()) {
314    const auto *DRE =
315        dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
316    if (DRE && DRE->getDecl() == VD)
317      return DRE;
318  }
319  return nullptr;
320}
321
322void ClassifyRefs::classify(const Expr *E, Class C) {
323  // The result of a ?: could also be an lvalue.
324  E = E->IgnoreParens();
325  if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
326    classify(CO->getTrueExpr(), C);
327    classify(CO->getFalseExpr(), C);
328    return;
329  }
330
331  if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
332    classify(BCO->getFalseExpr(), C);
333    return;
334  }
335
336  if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
337    classify(OVE->getSourceExpr(), C);
338    return;
339  }
340
341  if (const auto *ME = dyn_cast<MemberExpr>(E)) {
342    if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
343      if (!VD->isStaticDataMember())
344        classify(ME->getBase(), C);
345    }
346    return;
347  }
348
349  if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
350    switch (BO->getOpcode()) {
351    case BO_PtrMemD:
352    case BO_PtrMemI:
353      classify(BO->getLHS(), C);
354      return;
355    case BO_Comma:
356      classify(BO->getRHS(), C);
357      return;
358    default:
359      return;
360    }
361  }
362
363  FindVarResult Var = findVar(E, DC);
364  if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
365    Classification[DRE] = std::max(Classification[DRE], C);
366}
367
368void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
369  for (auto *DI : DS->decls()) {
370    auto *VD = dyn_cast<VarDecl>(DI);
371    if (VD && isTrackedVar(VD))
372      if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
373        Classification[DRE] = SelfInit;
374  }
375}
376
377void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
378  // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
379  // is not a compound-assignment, we will treat it as initializing the variable
380  // when TransferFunctions visits it. A compound-assignment does not affect
381  // whether a variable is uninitialized, and there's no point counting it as a
382  // use.
383  if (BO->isCompoundAssignmentOp())
384    classify(BO->getLHS(), Use);
385  else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
386    classify(BO->getLHS(), Ignore);
387}
388
389void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
390  // Increment and decrement are uses despite there being no lvalue-to-rvalue
391  // conversion.
392  if (UO->isIncrementDecrementOp())
393    classify(UO->getSubExpr(), Use);
394}
395
396void ClassifyRefs::VisitOMPExecutableDirective(OMPExecutableDirective *ED) {
397  for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses()))
398    classify(cast<Expr>(S), Use);
399}
400
401static bool isPointerToConst(const QualType &QT) {
402  return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
403}
404
405static bool hasTrivialBody(CallExpr *CE) {
406  if (FunctionDecl *FD = CE->getDirectCallee()) {
407    if (FunctionTemplateDecl *FTD = FD->getPrimaryTemplate())
408      return FTD->getTemplatedDecl()->hasTrivialBody();
409    return FD->hasTrivialBody();
410  }
411  return false;
412}
413
414void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
415  // Classify arguments to std::move as used.
416  if (CE->isCallToStdMove()) {
417    // RecordTypes are handled in SemaDeclCXX.cpp.
418    if (!CE->getArg(0)->getType()->isRecordType())
419      classify(CE->getArg(0), Use);
420    return;
421  }
422  bool isTrivialBody = hasTrivialBody(CE);
423  // If a value is passed by const pointer to a function,
424  // we should not assume that it is initialized by the call, and we
425  // conservatively do not assume that it is used.
426  // If a value is passed by const reference to a function,
427  // it should already be initialized.
428  for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
429       I != E; ++I) {
430    if ((*I)->isGLValue()) {
431      if ((*I)->getType().isConstQualified())
432        classify((*I), isTrivialBody ? Ignore : ConstRefUse);
433    } else if (isPointerToConst((*I)->getType())) {
434      const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
435      const auto *UO = dyn_cast<UnaryOperator>(Ex);
436      if (UO && UO->getOpcode() == UO_AddrOf)
437        Ex = UO->getSubExpr();
438      classify(Ex, Ignore);
439    }
440  }
441}
442
443void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
444  if (CE->getCastKind() == CK_LValueToRValue)
445    classify(CE->getSubExpr(), Use);
446  else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
447    if (CSE->getType()->isVoidType()) {
448      // Squelch any detected load of an uninitialized value if
449      // we cast it to void.
450      // e.g. (void) x;
451      classify(CSE->getSubExpr(), Ignore);
452    }
453  }
454}
455
456//------------------------------------------------------------------------====//
457// Transfer function for uninitialized values analysis.
458//====------------------------------------------------------------------------//
459
460namespace {
461
462class TransferFunctions : public StmtVisitor<TransferFunctions> {
463  CFGBlockValues &vals;
464  const CFG &cfg;
465  const CFGBlock *block;
466  AnalysisDeclContext &ac;
467  const ClassifyRefs &classification;
468  ObjCNoReturn objCNoRet;
469  UninitVariablesHandler &handler;
470
471public:
472  TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
473                    const CFGBlock *block, AnalysisDeclContext &ac,
474                    const ClassifyRefs &classification,
475                    UninitVariablesHandler &handler)
476      : vals(vals), cfg(cfg), block(block), ac(ac),
477        classification(classification), objCNoRet(ac.getASTContext()),
478        handler(handler) {}
479
480  void reportUse(const Expr *ex, const VarDecl *vd);
481  void reportConstRefUse(const Expr *ex, const VarDecl *vd);
482
483  void VisitBinaryOperator(BinaryOperator *bo);
484  void VisitBlockExpr(BlockExpr *be);
485  void VisitCallExpr(CallExpr *ce);
486  void VisitDeclRefExpr(DeclRefExpr *dr);
487  void VisitDeclStmt(DeclStmt *ds);
488  void VisitGCCAsmStmt(GCCAsmStmt *as);
489  void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
490  void VisitObjCMessageExpr(ObjCMessageExpr *ME);
491  void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
492
493  bool isTrackedVar(const VarDecl *vd) {
494    return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
495  }
496
497  FindVarResult findVar(const Expr *ex) {
498    return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
499  }
500
501  UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
502    UninitUse Use(ex, isAlwaysUninit(v));
503
504    assert(isUninitialized(v));
505    if (Use.getKind() == UninitUse::Always)
506      return Use;
507
508    // If an edge which leads unconditionally to this use did not initialize
509    // the variable, we can say something stronger than 'may be uninitialized':
510    // we can say 'either it's used uninitialized or you have dead code'.
511    //
512    // We track the number of successors of a node which have been visited, and
513    // visit a node once we have visited all of its successors. Only edges where
514    // the variable might still be uninitialized are followed. Since a variable
515    // can't transfer from being initialized to being uninitialized, this will
516    // trace out the subgraph which inevitably leads to the use and does not
517    // initialize the variable. We do not want to skip past loops, since their
518    // non-termination might be correlated with the initialization condition.
519    //
520    // For example:
521    //
522    //         void f(bool a, bool b) {
523    // block1:   int n;
524    //           if (a) {
525    // block2:     if (b)
526    // block3:       n = 1;
527    // block4:   } else if (b) {
528    // block5:     while (!a) {
529    // block6:       do_work(&a);
530    //               n = 2;
531    //             }
532    //           }
533    // block7:   if (a)
534    // block8:     g();
535    // block9:   return n;
536    //         }
537    //
538    // Starting from the maybe-uninitialized use in block 9:
539    //  * Block 7 is not visited because we have only visited one of its two
540    //    successors.
541    //  * Block 8 is visited because we've visited its only successor.
542    // From block 8:
543    //  * Block 7 is visited because we've now visited both of its successors.
544    // From block 7:
545    //  * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
546    //    of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
547    //  * Block 3 is not visited because it initializes 'n'.
548    // Now the algorithm terminates, having visited blocks 7 and 8, and having
549    // found the frontier is blocks 2, 4, and 5.
550    //
551    // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
552    // and 4), so we report that any time either of those edges is taken (in
553    // each case when 'b == false'), 'n' is used uninitialized.
554    SmallVector<const CFGBlock*, 32> Queue;
555    SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
556    Queue.push_back(block);
557    // Specify that we've already visited all successors of the starting block.
558    // This has the dual purpose of ensuring we never add it to the queue, and
559    // of marking it as not being a candidate element of the frontier.
560    SuccsVisited[block->getBlockID()] = block->succ_size();
561    while (!Queue.empty()) {
562      const CFGBlock *B = Queue.pop_back_val();
563
564      // If the use is always reached from the entry block, make a note of that.
565      if (B == &cfg.getEntry())
566        Use.setUninitAfterCall();
567
568      for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
569           I != E; ++I) {
570        const CFGBlock *Pred = *I;
571        if (!Pred)
572          continue;
573
574        Value AtPredExit = vals.getValue(Pred, B, vd);
575        if (AtPredExit == Initialized)
576          // This block initializes the variable.
577          continue;
578        if (AtPredExit == MayUninitialized &&
579            vals.getValue(B, nullptr, vd) == Uninitialized) {
580          // This block declares the variable (uninitialized), and is reachable
581          // from a block that initializes the variable. We can't guarantee to
582          // give an earlier location for the diagnostic (and it appears that
583          // this code is intended to be reachable) so give a diagnostic here
584          // and go no further down this path.
585          Use.setUninitAfterDecl();
586          continue;
587        }
588
589        if (AtPredExit == MayUninitialized) {
590          // If the predecessor's terminator is an "asm goto" that initializes
591          // the variable, then don't count it as "initialized" on the indirect
592          // paths.
593          CFGTerminator term = Pred->getTerminator();
594          if (const auto *as = dyn_cast_or_null<GCCAsmStmt>(term.getStmt())) {
595            const CFGBlock *fallthrough = *Pred->succ_begin();
596            if (as->isAsmGoto() &&
597                llvm::any_of(as->outputs(), [&](const Expr *output) {
598                    return vd == findVar(output).getDecl() &&
599                        llvm::any_of(as->labels(),
600                                     [&](const AddrLabelExpr *label) {
601                          return label->getLabel()->getStmt() == B->Label &&
602                              B != fallthrough;
603                        });
604                })) {
605              Use.setUninitAfterDecl();
606              continue;
607            }
608          }
609        }
610
611        unsigned &SV = SuccsVisited[Pred->getBlockID()];
612        if (!SV) {
613          // When visiting the first successor of a block, mark all NULL
614          // successors as having been visited.
615          for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
616                                             SE = Pred->succ_end();
617               SI != SE; ++SI)
618            if (!*SI)
619              ++SV;
620        }
621
622        if (++SV == Pred->succ_size())
623          // All paths from this block lead to the use and don't initialize the
624          // variable.
625          Queue.push_back(Pred);
626      }
627    }
628
629    // Scan the frontier, looking for blocks where the variable was
630    // uninitialized.
631    for (const auto *Block : cfg) {
632      unsigned BlockID = Block->getBlockID();
633      const Stmt *Term = Block->getTerminatorStmt();
634      if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
635          Term) {
636        // This block inevitably leads to the use. If we have an edge from here
637        // to a post-dominator block, and the variable is uninitialized on that
638        // edge, we have found a bug.
639        for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
640             E = Block->succ_end(); I != E; ++I) {
641          const CFGBlock *Succ = *I;
642          if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
643              vals.getValue(Block, Succ, vd) == Uninitialized) {
644            // Switch cases are a special case: report the label to the caller
645            // as the 'terminator', not the switch statement itself. Suppress
646            // situations where no label matched: we can't be sure that's
647            // possible.
648            if (isa<SwitchStmt>(Term)) {
649              const Stmt *Label = Succ->getLabel();
650              if (!Label || !isa<SwitchCase>(Label))
651                // Might not be possible.
652                continue;
653              UninitUse::Branch Branch;
654              Branch.Terminator = Label;
655              Branch.Output = 0; // Ignored.
656              Use.addUninitBranch(Branch);
657            } else {
658              UninitUse::Branch Branch;
659              Branch.Terminator = Term;
660              Branch.Output = I - Block->succ_begin();
661              Use.addUninitBranch(Branch);
662            }
663          }
664        }
665      }
666    }
667
668    return Use;
669  }
670};
671
672} // namespace
673
674void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
675  Value v = vals[vd];
676  if (isUninitialized(v))
677    handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
678}
679
680void TransferFunctions::reportConstRefUse(const Expr *ex, const VarDecl *vd) {
681  Value v = vals[vd];
682  if (isAlwaysUninit(v))
683    handler.handleConstRefUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
684}
685
686void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
687  // This represents an initialization of the 'element' value.
688  if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
689    const auto *VD = cast<VarDecl>(DS->getSingleDecl());
690    if (isTrackedVar(VD))
691      vals[VD] = Initialized;
692  }
693}
694
695void TransferFunctions::VisitOMPExecutableDirective(
696    OMPExecutableDirective *ED) {
697  for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses())) {
698    assert(S && "Expected non-null used-in-clause child.");
699    Visit(S);
700  }
701  if (!ED->isStandaloneDirective())
702    Visit(ED->getStructuredBlock());
703}
704
705void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
706  const BlockDecl *bd = be->getBlockDecl();
707  for (const auto &I : bd->captures()) {
708    const VarDecl *vd = I.getVariable();
709    if (!isTrackedVar(vd))
710      continue;
711    if (I.isByRef()) {
712      vals[vd] = Initialized;
713      continue;
714    }
715    reportUse(be, vd);
716  }
717}
718
719void TransferFunctions::VisitCallExpr(CallExpr *ce) {
720  if (Decl *Callee = ce->getCalleeDecl()) {
721    if (Callee->hasAttr<ReturnsTwiceAttr>()) {
722      // After a call to a function like setjmp or vfork, any variable which is
723      // initialized anywhere within this function may now be initialized. For
724      // now, just assume such a call initializes all variables.  FIXME: Only
725      // mark variables as initialized if they have an initializer which is
726      // reachable from here.
727      vals.setAllScratchValues(Initialized);
728    }
729    else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
730      // Functions labeled like "analyzer_noreturn" are often used to denote
731      // "panic" functions that in special debug situations can still return,
732      // but for the most part should not be treated as returning.  This is a
733      // useful annotation borrowed from the static analyzer that is useful for
734      // suppressing branch-specific false positives when we call one of these
735      // functions but keep pretending the path continues (when in reality the
736      // user doesn't care).
737      vals.setAllScratchValues(Unknown);
738    }
739  }
740}
741
742void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
743  switch (classification.get(dr)) {
744  case ClassifyRefs::Ignore:
745    break;
746  case ClassifyRefs::Use:
747    reportUse(dr, cast<VarDecl>(dr->getDecl()));
748    break;
749  case ClassifyRefs::Init:
750    vals[cast<VarDecl>(dr->getDecl())] = Initialized;
751    break;
752  case ClassifyRefs::SelfInit:
753    handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
754    break;
755  case ClassifyRefs::ConstRefUse:
756    reportConstRefUse(dr, cast<VarDecl>(dr->getDecl()));
757    break;
758  }
759}
760
761void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
762  if (BO->getOpcode() == BO_Assign) {
763    FindVarResult Var = findVar(BO->getLHS());
764    if (const VarDecl *VD = Var.getDecl())
765      vals[VD] = Initialized;
766  }
767}
768
769void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
770  for (auto *DI : DS->decls()) {
771    auto *VD = dyn_cast<VarDecl>(DI);
772    if (VD && isTrackedVar(VD)) {
773      if (getSelfInitExpr(VD)) {
774        // If the initializer consists solely of a reference to itself, we
775        // explicitly mark the variable as uninitialized. This allows code
776        // like the following:
777        //
778        //   int x = x;
779        //
780        // to deliberately leave a variable uninitialized. Different analysis
781        // clients can detect this pattern and adjust their reporting
782        // appropriately, but we need to continue to analyze subsequent uses
783        // of the variable.
784        vals[VD] = Uninitialized;
785      } else if (VD->getInit()) {
786        // Treat the new variable as initialized.
787        vals[VD] = Initialized;
788      } else {
789        // No initializer: the variable is now uninitialized. This matters
790        // for cases like:
791        //   while (...) {
792        //     int n;
793        //     use(n);
794        //     n = 0;
795        //   }
796        // FIXME: Mark the variable as uninitialized whenever its scope is
797        // left, since its scope could be re-entered by a jump over the
798        // declaration.
799        vals[VD] = Uninitialized;
800      }
801    }
802  }
803}
804
805void TransferFunctions::VisitGCCAsmStmt(GCCAsmStmt *as) {
806  // An "asm goto" statement is a terminator that may initialize some variables.
807  if (!as->isAsmGoto())
808    return;
809
810  ASTContext &C = ac.getASTContext();
811  for (const Expr *O : as->outputs()) {
812    const Expr *Ex = stripCasts(C, O);
813
814    // Strip away any unary operators. Invalid l-values are reported by other
815    // semantic analysis passes.
816    while (const auto *UO = dyn_cast<UnaryOperator>(Ex))
817      Ex = stripCasts(C, UO->getSubExpr());
818
819    // Mark the variable as potentially uninitialized for those cases where
820    // it's used on an indirect path, where it's not guaranteed to be
821    // defined.
822    if (const VarDecl *VD = findVar(Ex).getDecl())
823      vals[VD] = MayUninitialized;
824  }
825}
826
827void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
828  // If the Objective-C message expression is an implicit no-return that
829  // is not modeled in the CFG, set the tracked dataflow values to Unknown.
830  if (objCNoRet.isImplicitNoReturn(ME)) {
831    vals.setAllScratchValues(Unknown);
832  }
833}
834
835//------------------------------------------------------------------------====//
836// High-level "driver" logic for uninitialized values analysis.
837//====------------------------------------------------------------------------//
838
839static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
840                       AnalysisDeclContext &ac, CFGBlockValues &vals,
841                       const ClassifyRefs &classification,
842                       llvm::BitVector &wasAnalyzed,
843                       UninitVariablesHandler &handler) {
844  wasAnalyzed[block->getBlockID()] = true;
845  vals.resetScratch();
846  // Merge in values of predecessor blocks.
847  bool isFirst = true;
848  for (CFGBlock::const_pred_iterator I = block->pred_begin(),
849       E = block->pred_end(); I != E; ++I) {
850    const CFGBlock *pred = *I;
851    if (!pred)
852      continue;
853    if (wasAnalyzed[pred->getBlockID()]) {
854      vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
855      isFirst = false;
856    }
857  }
858  // Apply the transfer function.
859  TransferFunctions tf(vals, cfg, block, ac, classification, handler);
860  for (const auto &I : *block) {
861    if (std::optional<CFGStmt> cs = I.getAs<CFGStmt>())
862      tf.Visit(const_cast<Stmt *>(cs->getStmt()));
863  }
864  CFGTerminator terminator = block->getTerminator();
865  if (auto *as = dyn_cast_or_null<GCCAsmStmt>(terminator.getStmt()))
866    if (as->isAsmGoto())
867      tf.Visit(as);
868  return vals.updateValueVectorWithScratch(block);
869}
870
871namespace {
872
873/// PruneBlocksHandler is a special UninitVariablesHandler that is used
874/// to detect when a CFGBlock has any *potential* use of an uninitialized
875/// variable.  It is mainly used to prune out work during the final
876/// reporting pass.
877struct PruneBlocksHandler : public UninitVariablesHandler {
878  /// Records if a CFGBlock had a potential use of an uninitialized variable.
879  llvm::BitVector hadUse;
880
881  /// Records if any CFGBlock had a potential use of an uninitialized variable.
882  bool hadAnyUse = false;
883
884  /// The current block to scribble use information.
885  unsigned currentBlock = 0;
886
887  PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
888
889  ~PruneBlocksHandler() override = default;
890
891  void handleUseOfUninitVariable(const VarDecl *vd,
892                                 const UninitUse &use) override {
893    hadUse[currentBlock] = true;
894    hadAnyUse = true;
895  }
896
897  void handleConstRefUseOfUninitVariable(const VarDecl *vd,
898                                         const UninitUse &use) override {
899    hadUse[currentBlock] = true;
900    hadAnyUse = true;
901  }
902
903  /// Called when the uninitialized variable analysis detects the
904  /// idiom 'int x = x'.  All other uses of 'x' within the initializer
905  /// are handled by handleUseOfUninitVariable.
906  void handleSelfInit(const VarDecl *vd) override {
907    hadUse[currentBlock] = true;
908    hadAnyUse = true;
909  }
910};
911
912} // namespace
913
914void clang::runUninitializedVariablesAnalysis(
915    const DeclContext &dc,
916    const CFG &cfg,
917    AnalysisDeclContext &ac,
918    UninitVariablesHandler &handler,
919    UninitVariablesAnalysisStats &stats) {
920  CFGBlockValues vals(cfg);
921  vals.computeSetOfDeclarations(dc);
922  if (vals.hasNoDeclarations())
923    return;
924
925  stats.NumVariablesAnalyzed = vals.getNumEntries();
926
927  // Precompute which expressions are uses and which are initializations.
928  ClassifyRefs classification(ac);
929  cfg.VisitBlockStmts(classification);
930
931  // Mark all variables uninitialized at the entry.
932  const CFGBlock &entry = cfg.getEntry();
933  ValueVector &vec = vals.getValueVector(&entry);
934  const unsigned n = vals.getNumEntries();
935  for (unsigned j = 0; j < n; ++j) {
936    vec[j] = Uninitialized;
937  }
938
939  // Proceed with the workist.
940  ForwardDataflowWorklist worklist(cfg, ac);
941  llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
942  worklist.enqueueSuccessors(&cfg.getEntry());
943  llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
944  wasAnalyzed[cfg.getEntry().getBlockID()] = true;
945  PruneBlocksHandler PBH(cfg.getNumBlockIDs());
946
947  while (const CFGBlock *block = worklist.dequeue()) {
948    PBH.currentBlock = block->getBlockID();
949
950    // Did the block change?
951    bool changed = runOnBlock(block, cfg, ac, vals,
952                              classification, wasAnalyzed, PBH);
953    ++stats.NumBlockVisits;
954    if (changed || !previouslyVisited[block->getBlockID()])
955      worklist.enqueueSuccessors(block);
956    previouslyVisited[block->getBlockID()] = true;
957  }
958
959  if (!PBH.hadAnyUse)
960    return;
961
962  // Run through the blocks one more time, and report uninitialized variables.
963  for (const auto *block : cfg)
964    if (PBH.hadUse[block->getBlockID()]) {
965      runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
966      ++stats.NumBlockVisits;
967    }
968}
969
970UninitVariablesHandler::~UninitVariablesHandler() = default;
971