UninitializedValues.cpp revision 1.1.1.1 
1//===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements uninitialized values analysis for source-level CFGs.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/Analysis/Analyses/UninitializedValues.h"
14#include "clang/AST/Attr.h"
15#include "clang/AST/Decl.h"
16#include "clang/AST/DeclBase.h"
17#include "clang/AST/Expr.h"
18#include "clang/AST/OperationKinds.h"
19#include "clang/AST/Stmt.h"
20#include "clang/AST/StmtObjC.h"
21#include "clang/AST/StmtVisitor.h"
22#include "clang/AST/Type.h"
23#include "clang/Analysis/Analyses/PostOrderCFGView.h"
24#include "clang/Analysis/AnalysisDeclContext.h"
25#include "clang/Analysis/CFG.h"
26#include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
27#include "clang/Basic/LLVM.h"
28#include "llvm/ADT/BitVector.h"
29#include "llvm/ADT/DenseMap.h"
30#include "llvm/ADT/None.h"
31#include "llvm/ADT/Optional.h"
32#include "llvm/ADT/PackedVector.h"
33#include "llvm/ADT/SmallBitVector.h"
34#include "llvm/ADT/SmallVector.h"
35#include "llvm/Support/Casting.h"
36#include <algorithm>
37#include <cassert>
38
39using namespace clang;
40
41#define DEBUG_LOGGING 0
42
43static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
44  if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
45      !vd->isExceptionVariable() && !vd->isInitCapture() &&
46      !vd->isImplicit() && vd->getDeclContext() == dc) {
47    QualType ty = vd->getType();
48    return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
49  }
50  return false;
51}
52
53//------------------------------------------------------------------------====//
54// DeclToIndex: a mapping from Decls we track to value indices.
55//====------------------------------------------------------------------------//
56
57namespace {
58
59class DeclToIndex {
60  llvm::DenseMap<const VarDecl *, unsigned> map;
61
62public:
63  DeclToIndex() = default;
64
65  /// Compute the actual mapping from declarations to bits.
66  void computeMap(const DeclContext &dc);
67
68  /// Return the number of declarations in the map.
69  unsigned size() const { return map.size(); }
70
71  /// Returns the bit vector index for a given declaration.
72  Optional<unsigned> getValueIndex(const VarDecl *d) const;
73};
74
75} // namespace
76
77void DeclToIndex::computeMap(const DeclContext &dc) {
78  unsigned count = 0;
79  DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
80                                               E(dc.decls_end());
81  for ( ; I != E; ++I) {
82    const VarDecl *vd = *I;
83    if (isTrackedVar(vd, &dc))
84      map[vd] = count++;
85  }
86}
87
88Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
89  llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
90  if (I == map.end())
91    return None;
92  return I->second;
93}
94
95//------------------------------------------------------------------------====//
96// CFGBlockValues: dataflow values for CFG blocks.
97//====------------------------------------------------------------------------//
98
99// These values are defined in such a way that a merge can be done using
100// a bitwise OR.
101enum Value { Unknown = 0x0,         /* 00 */
102             Initialized = 0x1,     /* 01 */
103             Uninitialized = 0x2,   /* 10 */
104             MayUninitialized = 0x3 /* 11 */ };
105
106static bool isUninitialized(const Value v) {
107  return v >= Uninitialized;
108}
109
110static bool isAlwaysUninit(const Value v) {
111  return v == Uninitialized;
112}
113
114namespace {
115
116using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
117
118class CFGBlockValues {
119  const CFG &cfg;
120  SmallVector<ValueVector, 8> vals;
121  ValueVector scratch;
122  DeclToIndex declToIndex;
123
124public:
125  CFGBlockValues(const CFG &cfg);
126
127  unsigned getNumEntries() const { return declToIndex.size(); }
128
129  void computeSetOfDeclarations(const DeclContext &dc);
130
131  ValueVector &getValueVector(const CFGBlock *block) {
132    return vals[block->getBlockID()];
133  }
134
135  void setAllScratchValues(Value V);
136  void mergeIntoScratch(ValueVector const &source, bool isFirst);
137  bool updateValueVectorWithScratch(const CFGBlock *block);
138
139  bool hasNoDeclarations() const {
140    return declToIndex.size() == 0;
141  }
142
143  void resetScratch();
144
145  ValueVector::reference operator[](const VarDecl *vd);
146
147  Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
148                 const VarDecl *vd) {
149    const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
150    assert(idx.hasValue());
151    return getValueVector(block)[idx.getValue()];
152  }
153};
154
155} // namespace
156
157CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
158
159void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
160  declToIndex.computeMap(dc);
161  unsigned decls = declToIndex.size();
162  scratch.resize(decls);
163  unsigned n = cfg.getNumBlockIDs();
164  if (!n)
165    return;
166  vals.resize(n);
167  for (auto &val : vals)
168    val.resize(decls);
169}
170
171#if DEBUG_LOGGING
172static void printVector(const CFGBlock *block, ValueVector &bv,
173                        unsigned num) {
174  llvm::errs() << block->getBlockID() << " :";
175  for (const auto &i : bv)
176    llvm::errs() << ' ' << i;
177  llvm::errs() << " : " << num << '\n';
178}
179#endif
180
181void CFGBlockValues::setAllScratchValues(Value V) {
182  for (unsigned I = 0, E = scratch.size(); I != E; ++I)
183    scratch[I] = V;
184}
185
186void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
187                                      bool isFirst) {
188  if (isFirst)
189    scratch = source;
190  else
191    scratch |= source;
192}
193
194bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
195  ValueVector &dst = getValueVector(block);
196  bool changed = (dst != scratch);
197  if (changed)
198    dst = scratch;
199#if DEBUG_LOGGING
200  printVector(block, scratch, 0);
201#endif
202  return changed;
203}
204
205void CFGBlockValues::resetScratch() {
206  scratch.reset();
207}
208
209ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
210  const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
211  assert(idx.hasValue());
212  return scratch[idx.getValue()];
213}
214
215//------------------------------------------------------------------------====//
216// Worklist: worklist for dataflow analysis.
217//====------------------------------------------------------------------------//
218
219namespace {
220
221class DataflowWorklist {
222  PostOrderCFGView::iterator PO_I, PO_E;
223  SmallVector<const CFGBlock *, 20> worklist;
224  llvm::BitVector enqueuedBlocks;
225
226public:
227  DataflowWorklist(const CFG &cfg, PostOrderCFGView &view)
228      : PO_I(view.begin()), PO_E(view.end()),
229        enqueuedBlocks(cfg.getNumBlockIDs(), true) {
230    // Treat the first block as already analyzed.
231    if (PO_I != PO_E) {
232      assert(*PO_I == &cfg.getEntry());
233      enqueuedBlocks[(*PO_I)->getBlockID()] = false;
234      ++PO_I;
235    }
236  }
237
238  void enqueueSuccessors(const CFGBlock *block);
239  const CFGBlock *dequeue();
240};
241
242} // namespace
243
244void DataflowWorklist::enqueueSuccessors(const CFGBlock *block) {
245  for (CFGBlock::const_succ_iterator I = block->succ_begin(),
246       E = block->succ_end(); I != E; ++I) {
247    const CFGBlock *Successor = *I;
248    if (!Successor || enqueuedBlocks[Successor->getBlockID()])
249      continue;
250    worklist.push_back(Successor);
251    enqueuedBlocks[Successor->getBlockID()] = true;
252  }
253}
254
255const CFGBlock *DataflowWorklist::dequeue() {
256  const CFGBlock *B = nullptr;
257
258  // First dequeue from the worklist.  This can represent
259  // updates along backedges that we want propagated as quickly as possible.
260  if (!worklist.empty())
261    B = worklist.pop_back_val();
262
263  // Next dequeue from the initial reverse post order.  This is the
264  // theoretical ideal in the presence of no back edges.
265  else if (PO_I != PO_E) {
266    B = *PO_I;
267    ++PO_I;
268  }
269  else
270    return nullptr;
271
272  assert(enqueuedBlocks[B->getBlockID()] == true);
273  enqueuedBlocks[B->getBlockID()] = false;
274  return B;
275}
276
277//------------------------------------------------------------------------====//
278// Classification of DeclRefExprs as use or initialization.
279//====------------------------------------------------------------------------//
280
281namespace {
282
283class FindVarResult {
284  const VarDecl *vd;
285  const DeclRefExpr *dr;
286
287public:
288  FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
289
290  const DeclRefExpr *getDeclRefExpr() const { return dr; }
291  const VarDecl *getDecl() const { return vd; }
292};
293
294} // namespace
295
296static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
297  while (Ex) {
298    Ex = Ex->IgnoreParenNoopCasts(C);
299    if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
300      if (CE->getCastKind() == CK_LValueBitCast) {
301        Ex = CE->getSubExpr();
302        continue;
303      }
304    }
305    break;
306  }
307  return Ex;
308}
309
310/// If E is an expression comprising a reference to a single variable, find that
311/// variable.
312static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
313  if (const auto *DRE =
314          dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
315    if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
316      if (isTrackedVar(VD, DC))
317        return FindVarResult(VD, DRE);
318  return FindVarResult(nullptr, nullptr);
319}
320
321namespace {
322
323/// Classify each DeclRefExpr as an initialization or a use. Any
324/// DeclRefExpr which isn't explicitly classified will be assumed to have
325/// escaped the analysis and will be treated as an initialization.
326class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
327public:
328  enum Class {
329    Init,
330    Use,
331    SelfInit,
332    Ignore
333  };
334
335private:
336  const DeclContext *DC;
337  llvm::DenseMap<const DeclRefExpr *, Class> Classification;
338
339  bool isTrackedVar(const VarDecl *VD) const {
340    return ::isTrackedVar(VD, DC);
341  }
342
343  void classify(const Expr *E, Class C);
344
345public:
346  ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
347
348  void VisitDeclStmt(DeclStmt *DS);
349  void VisitUnaryOperator(UnaryOperator *UO);
350  void VisitBinaryOperator(BinaryOperator *BO);
351  void VisitCallExpr(CallExpr *CE);
352  void VisitCastExpr(CastExpr *CE);
353  void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
354
355  void operator()(Stmt *S) { Visit(S); }
356
357  Class get(const DeclRefExpr *DRE) const {
358    llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
359        = Classification.find(DRE);
360    if (I != Classification.end())
361      return I->second;
362
363    const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
364    if (!VD || !isTrackedVar(VD))
365      return Ignore;
366
367    return Init;
368  }
369};
370
371} // namespace
372
373static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
374  if (VD->getType()->isRecordType())
375    return nullptr;
376  if (Expr *Init = VD->getInit()) {
377    const auto *DRE =
378        dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
379    if (DRE && DRE->getDecl() == VD)
380      return DRE;
381  }
382  return nullptr;
383}
384
385void ClassifyRefs::classify(const Expr *E, Class C) {
386  // The result of a ?: could also be an lvalue.
387  E = E->IgnoreParens();
388  if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
389    classify(CO->getTrueExpr(), C);
390    classify(CO->getFalseExpr(), C);
391    return;
392  }
393
394  if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
395    classify(BCO->getFalseExpr(), C);
396    return;
397  }
398
399  if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
400    classify(OVE->getSourceExpr(), C);
401    return;
402  }
403
404  if (const auto *ME = dyn_cast<MemberExpr>(E)) {
405    if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
406      if (!VD->isStaticDataMember())
407        classify(ME->getBase(), C);
408    }
409    return;
410  }
411
412  if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
413    switch (BO->getOpcode()) {
414    case BO_PtrMemD:
415    case BO_PtrMemI:
416      classify(BO->getLHS(), C);
417      return;
418    case BO_Comma:
419      classify(BO->getRHS(), C);
420      return;
421    default:
422      return;
423    }
424  }
425
426  FindVarResult Var = findVar(E, DC);
427  if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
428    Classification[DRE] = std::max(Classification[DRE], C);
429}
430
431void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
432  for (auto *DI : DS->decls()) {
433    auto *VD = dyn_cast<VarDecl>(DI);
434    if (VD && isTrackedVar(VD))
435      if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
436        Classification[DRE] = SelfInit;
437  }
438}
439
440void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
441  // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
442  // is not a compound-assignment, we will treat it as initializing the variable
443  // when TransferFunctions visits it. A compound-assignment does not affect
444  // whether a variable is uninitialized, and there's no point counting it as a
445  // use.
446  if (BO->isCompoundAssignmentOp())
447    classify(BO->getLHS(), Use);
448  else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
449    classify(BO->getLHS(), Ignore);
450}
451
452void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
453  // Increment and decrement are uses despite there being no lvalue-to-rvalue
454  // conversion.
455  if (UO->isIncrementDecrementOp())
456    classify(UO->getSubExpr(), Use);
457}
458
459void ClassifyRefs::VisitOMPExecutableDirective(OMPExecutableDirective *ED) {
460  for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses()))
461    classify(cast<Expr>(S), Use);
462}
463
464static bool isPointerToConst(const QualType &QT) {
465  return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
466}
467
468void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
469  // Classify arguments to std::move as used.
470  if (CE->isCallToStdMove()) {
471    // RecordTypes are handled in SemaDeclCXX.cpp.
472    if (!CE->getArg(0)->getType()->isRecordType())
473      classify(CE->getArg(0), Use);
474    return;
475  }
476
477  // If a value is passed by const pointer or by const reference to a function,
478  // we should not assume that it is initialized by the call, and we
479  // conservatively do not assume that it is used.
480  for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
481       I != E; ++I) {
482    if ((*I)->isGLValue()) {
483      if ((*I)->getType().isConstQualified())
484        classify((*I), Ignore);
485    } else if (isPointerToConst((*I)->getType())) {
486      const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
487      const auto *UO = dyn_cast<UnaryOperator>(Ex);
488      if (UO && UO->getOpcode() == UO_AddrOf)
489        Ex = UO->getSubExpr();
490      classify(Ex, Ignore);
491    }
492  }
493}
494
495void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
496  if (CE->getCastKind() == CK_LValueToRValue)
497    classify(CE->getSubExpr(), Use);
498  else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
499    if (CSE->getType()->isVoidType()) {
500      // Squelch any detected load of an uninitialized value if
501      // we cast it to void.
502      // e.g. (void) x;
503      classify(CSE->getSubExpr(), Ignore);
504    }
505  }
506}
507
508//------------------------------------------------------------------------====//
509// Transfer function for uninitialized values analysis.
510//====------------------------------------------------------------------------//
511
512namespace {
513
514class TransferFunctions : public StmtVisitor<TransferFunctions> {
515  CFGBlockValues &vals;
516  const CFG &cfg;
517  const CFGBlock *block;
518  AnalysisDeclContext &ac;
519  const ClassifyRefs &classification;
520  ObjCNoReturn objCNoRet;
521  UninitVariablesHandler &handler;
522
523public:
524  TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
525                    const CFGBlock *block, AnalysisDeclContext &ac,
526                    const ClassifyRefs &classification,
527                    UninitVariablesHandler &handler)
528      : vals(vals), cfg(cfg), block(block), ac(ac),
529        classification(classification), objCNoRet(ac.getASTContext()),
530        handler(handler) {}
531
532  void reportUse(const Expr *ex, const VarDecl *vd);
533
534  void VisitBinaryOperator(BinaryOperator *bo);
535  void VisitBlockExpr(BlockExpr *be);
536  void VisitCallExpr(CallExpr *ce);
537  void VisitDeclRefExpr(DeclRefExpr *dr);
538  void VisitDeclStmt(DeclStmt *ds);
539  void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
540  void VisitObjCMessageExpr(ObjCMessageExpr *ME);
541  void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
542
543  bool isTrackedVar(const VarDecl *vd) {
544    return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
545  }
546
547  FindVarResult findVar(const Expr *ex) {
548    return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
549  }
550
551  UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
552    UninitUse Use(ex, isAlwaysUninit(v));
553
554    assert(isUninitialized(v));
555    if (Use.getKind() == UninitUse::Always)
556      return Use;
557
558    // If an edge which leads unconditionally to this use did not initialize
559    // the variable, we can say something stronger than 'may be uninitialized':
560    // we can say 'either it's used uninitialized or you have dead code'.
561    //
562    // We track the number of successors of a node which have been visited, and
563    // visit a node once we have visited all of its successors. Only edges where
564    // the variable might still be uninitialized are followed. Since a variable
565    // can't transfer from being initialized to being uninitialized, this will
566    // trace out the subgraph which inevitably leads to the use and does not
567    // initialize the variable. We do not want to skip past loops, since their
568    // non-termination might be correlated with the initialization condition.
569    //
570    // For example:
571    //
572    //         void f(bool a, bool b) {
573    // block1:   int n;
574    //           if (a) {
575    // block2:     if (b)
576    // block3:       n = 1;
577    // block4:   } else if (b) {
578    // block5:     while (!a) {
579    // block6:       do_work(&a);
580    //               n = 2;
581    //             }
582    //           }
583    // block7:   if (a)
584    // block8:     g();
585    // block9:   return n;
586    //         }
587    //
588    // Starting from the maybe-uninitialized use in block 9:
589    //  * Block 7 is not visited because we have only visited one of its two
590    //    successors.
591    //  * Block 8 is visited because we've visited its only successor.
592    // From block 8:
593    //  * Block 7 is visited because we've now visited both of its successors.
594    // From block 7:
595    //  * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
596    //    of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
597    //  * Block 3 is not visited because it initializes 'n'.
598    // Now the algorithm terminates, having visited blocks 7 and 8, and having
599    // found the frontier is blocks 2, 4, and 5.
600    //
601    // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
602    // and 4), so we report that any time either of those edges is taken (in
603    // each case when 'b == false'), 'n' is used uninitialized.
604    SmallVector<const CFGBlock*, 32> Queue;
605    SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
606    Queue.push_back(block);
607    // Specify that we've already visited all successors of the starting block.
608    // This has the dual purpose of ensuring we never add it to the queue, and
609    // of marking it as not being a candidate element of the frontier.
610    SuccsVisited[block->getBlockID()] = block->succ_size();
611    while (!Queue.empty()) {
612      const CFGBlock *B = Queue.pop_back_val();
613
614      // If the use is always reached from the entry block, make a note of that.
615      if (B == &cfg.getEntry())
616        Use.setUninitAfterCall();
617
618      for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
619           I != E; ++I) {
620        const CFGBlock *Pred = *I;
621        if (!Pred)
622          continue;
623
624        Value AtPredExit = vals.getValue(Pred, B, vd);
625        if (AtPredExit == Initialized)
626          // This block initializes the variable.
627          continue;
628        if (AtPredExit == MayUninitialized &&
629            vals.getValue(B, nullptr, vd) == Uninitialized) {
630          // This block declares the variable (uninitialized), and is reachable
631          // from a block that initializes the variable. We can't guarantee to
632          // give an earlier location for the diagnostic (and it appears that
633          // this code is intended to be reachable) so give a diagnostic here
634          // and go no further down this path.
635          Use.setUninitAfterDecl();
636          continue;
637        }
638
639        unsigned &SV = SuccsVisited[Pred->getBlockID()];
640        if (!SV) {
641          // When visiting the first successor of a block, mark all NULL
642          // successors as having been visited.
643          for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
644                                             SE = Pred->succ_end();
645               SI != SE; ++SI)
646            if (!*SI)
647              ++SV;
648        }
649
650        if (++SV == Pred->succ_size())
651          // All paths from this block lead to the use and don't initialize the
652          // variable.
653          Queue.push_back(Pred);
654      }
655    }
656
657    // Scan the frontier, looking for blocks where the variable was
658    // uninitialized.
659    for (const auto *Block : cfg) {
660      unsigned BlockID = Block->getBlockID();
661      const Stmt *Term = Block->getTerminatorStmt();
662      if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
663          Term) {
664        // This block inevitably leads to the use. If we have an edge from here
665        // to a post-dominator block, and the variable is uninitialized on that
666        // edge, we have found a bug.
667        for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
668             E = Block->succ_end(); I != E; ++I) {
669          const CFGBlock *Succ = *I;
670          if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
671              vals.getValue(Block, Succ, vd) == Uninitialized) {
672            // Switch cases are a special case: report the label to the caller
673            // as the 'terminator', not the switch statement itself. Suppress
674            // situations where no label matched: we can't be sure that's
675            // possible.
676            if (isa<SwitchStmt>(Term)) {
677              const Stmt *Label = Succ->getLabel();
678              if (!Label || !isa<SwitchCase>(Label))
679                // Might not be possible.
680                continue;
681              UninitUse::Branch Branch;
682              Branch.Terminator = Label;
683              Branch.Output = 0; // Ignored.
684              Use.addUninitBranch(Branch);
685            } else {
686              UninitUse::Branch Branch;
687              Branch.Terminator = Term;
688              Branch.Output = I - Block->succ_begin();
689              Use.addUninitBranch(Branch);
690            }
691          }
692        }
693      }
694    }
695
696    return Use;
697  }
698};
699
700} // namespace
701
702void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
703  Value v = vals[vd];
704  if (isUninitialized(v))
705    handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
706}
707
708void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
709  // This represents an initialization of the 'element' value.
710  if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
711    const auto *VD = cast<VarDecl>(DS->getSingleDecl());
712    if (isTrackedVar(VD))
713      vals[VD] = Initialized;
714  }
715}
716
717void TransferFunctions::VisitOMPExecutableDirective(
718    OMPExecutableDirective *ED) {
719  for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses())) {
720    assert(S && "Expected non-null used-in-clause child.");
721    Visit(S);
722  }
723  if (!ED->isStandaloneDirective())
724    Visit(ED->getStructuredBlock());
725}
726
727void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
728  const BlockDecl *bd = be->getBlockDecl();
729  for (const auto &I : bd->captures()) {
730    const VarDecl *vd = I.getVariable();
731    if (!isTrackedVar(vd))
732      continue;
733    if (I.isByRef()) {
734      vals[vd] = Initialized;
735      continue;
736    }
737    reportUse(be, vd);
738  }
739}
740
741void TransferFunctions::VisitCallExpr(CallExpr *ce) {
742  if (Decl *Callee = ce->getCalleeDecl()) {
743    if (Callee->hasAttr<ReturnsTwiceAttr>()) {
744      // After a call to a function like setjmp or vfork, any variable which is
745      // initialized anywhere within this function may now be initialized. For
746      // now, just assume such a call initializes all variables.  FIXME: Only
747      // mark variables as initialized if they have an initializer which is
748      // reachable from here.
749      vals.setAllScratchValues(Initialized);
750    }
751    else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
752      // Functions labeled like "analyzer_noreturn" are often used to denote
753      // "panic" functions that in special debug situations can still return,
754      // but for the most part should not be treated as returning.  This is a
755      // useful annotation borrowed from the static analyzer that is useful for
756      // suppressing branch-specific false positives when we call one of these
757      // functions but keep pretending the path continues (when in reality the
758      // user doesn't care).
759      vals.setAllScratchValues(Unknown);
760    }
761  }
762}
763
764void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
765  switch (classification.get(dr)) {
766  case ClassifyRefs::Ignore:
767    break;
768  case ClassifyRefs::Use:
769    reportUse(dr, cast<VarDecl>(dr->getDecl()));
770    break;
771  case ClassifyRefs::Init:
772    vals[cast<VarDecl>(dr->getDecl())] = Initialized;
773    break;
774  case ClassifyRefs::SelfInit:
775      handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
776    break;
777  }
778}
779
780void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
781  if (BO->getOpcode() == BO_Assign) {
782    FindVarResult Var = findVar(BO->getLHS());
783    if (const VarDecl *VD = Var.getDecl())
784      vals[VD] = Initialized;
785  }
786}
787
788void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
789  for (auto *DI : DS->decls()) {
790    auto *VD = dyn_cast<VarDecl>(DI);
791    if (VD && isTrackedVar(VD)) {
792      if (getSelfInitExpr(VD)) {
793        // If the initializer consists solely of a reference to itself, we
794        // explicitly mark the variable as uninitialized. This allows code
795        // like the following:
796        //
797        //   int x = x;
798        //
799        // to deliberately leave a variable uninitialized. Different analysis
800        // clients can detect this pattern and adjust their reporting
801        // appropriately, but we need to continue to analyze subsequent uses
802        // of the variable.
803        vals[VD] = Uninitialized;
804      } else if (VD->getInit()) {
805        // Treat the new variable as initialized.
806        vals[VD] = Initialized;
807      } else {
808        // No initializer: the variable is now uninitialized. This matters
809        // for cases like:
810        //   while (...) {
811        //     int n;
812        //     use(n);
813        //     n = 0;
814        //   }
815        // FIXME: Mark the variable as uninitialized whenever its scope is
816        // left, since its scope could be re-entered by a jump over the
817        // declaration.
818        vals[VD] = Uninitialized;
819      }
820    }
821  }
822}
823
824void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
825  // If the Objective-C message expression is an implicit no-return that
826  // is not modeled in the CFG, set the tracked dataflow values to Unknown.
827  if (objCNoRet.isImplicitNoReturn(ME)) {
828    vals.setAllScratchValues(Unknown);
829  }
830}
831
832//------------------------------------------------------------------------====//
833// High-level "driver" logic for uninitialized values analysis.
834//====------------------------------------------------------------------------//
835
836static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
837                       AnalysisDeclContext &ac, CFGBlockValues &vals,
838                       const ClassifyRefs &classification,
839                       llvm::BitVector &wasAnalyzed,
840                       UninitVariablesHandler &handler) {
841  wasAnalyzed[block->getBlockID()] = true;
842  vals.resetScratch();
843  // Merge in values of predecessor blocks.
844  bool isFirst = true;
845  for (CFGBlock::const_pred_iterator I = block->pred_begin(),
846       E = block->pred_end(); I != E; ++I) {
847    const CFGBlock *pred = *I;
848    if (!pred)
849      continue;
850    if (wasAnalyzed[pred->getBlockID()]) {
851      vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
852      isFirst = false;
853    }
854  }
855  // Apply the transfer function.
856  TransferFunctions tf(vals, cfg, block, ac, classification, handler);
857  for (const auto &I : *block) {
858    if (Optional<CFGStmt> cs = I.getAs<CFGStmt>())
859      tf.Visit(const_cast<Stmt *>(cs->getStmt()));
860  }
861  return vals.updateValueVectorWithScratch(block);
862}
863
864namespace {
865
866/// PruneBlocksHandler is a special UninitVariablesHandler that is used
867/// to detect when a CFGBlock has any *potential* use of an uninitialized
868/// variable.  It is mainly used to prune out work during the final
869/// reporting pass.
870struct PruneBlocksHandler : public UninitVariablesHandler {
871  /// Records if a CFGBlock had a potential use of an uninitialized variable.
872  llvm::BitVector hadUse;
873
874  /// Records if any CFGBlock had a potential use of an uninitialized variable.
875  bool hadAnyUse = false;
876
877  /// The current block to scribble use information.
878  unsigned currentBlock = 0;
879
880  PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
881
882  ~PruneBlocksHandler() override = default;
883
884  void handleUseOfUninitVariable(const VarDecl *vd,
885                                 const UninitUse &use) override {
886    hadUse[currentBlock] = true;
887    hadAnyUse = true;
888  }
889
890  /// Called when the uninitialized variable analysis detects the
891  /// idiom 'int x = x'.  All other uses of 'x' within the initializer
892  /// are handled by handleUseOfUninitVariable.
893  void handleSelfInit(const VarDecl *vd) override {
894    hadUse[currentBlock] = true;
895    hadAnyUse = true;
896  }
897};
898
899} // namespace
900
901void clang::runUninitializedVariablesAnalysis(
902    const DeclContext &dc,
903    const CFG &cfg,
904    AnalysisDeclContext &ac,
905    UninitVariablesHandler &handler,
906    UninitVariablesAnalysisStats &stats) {
907  CFGBlockValues vals(cfg);
908  vals.computeSetOfDeclarations(dc);
909  if (vals.hasNoDeclarations())
910    return;
911
912  stats.NumVariablesAnalyzed = vals.getNumEntries();
913
914  // Precompute which expressions are uses and which are initializations.
915  ClassifyRefs classification(ac);
916  cfg.VisitBlockStmts(classification);
917
918  // Mark all variables uninitialized at the entry.
919  const CFGBlock &entry = cfg.getEntry();
920  ValueVector &vec = vals.getValueVector(&entry);
921  const unsigned n = vals.getNumEntries();
922  for (unsigned j = 0; j < n; ++j) {
923    vec[j] = Uninitialized;
924  }
925
926  // Proceed with the workist.
927  DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>());
928  llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
929  worklist.enqueueSuccessors(&cfg.getEntry());
930  llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
931  wasAnalyzed[cfg.getEntry().getBlockID()] = true;
932  PruneBlocksHandler PBH(cfg.getNumBlockIDs());
933
934  while (const CFGBlock *block = worklist.dequeue()) {
935    PBH.currentBlock = block->getBlockID();
936
937    // Did the block change?
938    bool changed = runOnBlock(block, cfg, ac, vals,
939                              classification, wasAnalyzed, PBH);
940    ++stats.NumBlockVisits;
941    if (changed || !previouslyVisited[block->getBlockID()])
942      worklist.enqueueSuccessors(block);
943    previouslyVisited[block->getBlockID()] = true;
944  }
945
946  if (!PBH.hadAnyUse)
947    return;
948
949  // Run through the blocks one more time, and report uninitialized variables.
950  for (const auto *block : cfg)
951    if (PBH.hadUse[block->getBlockID()]) {
952      runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
953      ++stats.NumBlockVisits;
954    }
955}
956
957UninitVariablesHandler::~UninitVariablesHandler() = default;
958