1 //==- UninitializedValues.cpp - Find Uninitialized Values -------*- C++ --*-==//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file implements uninitialized values analysis for source-level CFGs.
12 //===----------------------------------------------------------------------===//
14 #include "clang/AST/ASTContext.h"
15 #include "clang/AST/Attr.h"
16 #include "clang/AST/Decl.h"
17 #include "clang/AST/StmtVisitor.h"
18 #include "clang/Analysis/Analyses/PostOrderCFGView.h"
19 #include "clang/Analysis/Analyses/UninitializedValues.h"
20 #include "clang/Analysis/AnalysisContext.h"
21 #include "clang/Analysis/CFG.h"
22 #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
23 #include "llvm/ADT/DenseMap.h"
24 #include "llvm/ADT/Optional.h"
25 #include "llvm/ADT/PackedVector.h"
26 #include "llvm/ADT/SmallBitVector.h"
27 #include "llvm/ADT/SmallVector.h"
28 #include "llvm/Support/SaveAndRestore.h"
31 using namespace clang;
33 #define DEBUG_LOGGING 0
35 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
36 if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
37 !vd->isExceptionVariable() && !vd->isInitCapture() &&
38 vd->getDeclContext() == dc) {
39 QualType ty = vd->getType();
40 return ty->isScalarType() || ty->isVectorType();
45 //------------------------------------------------------------------------====//
46 // DeclToIndex: a mapping from Decls we track to value indices.
47 //====------------------------------------------------------------------------//
51 llvm::DenseMap<const VarDecl *, unsigned> map;
55 /// Compute the actual mapping from declarations to bits.
56 void computeMap(const DeclContext &dc);
58 /// Return the number of declarations in the map.
59 unsigned size() const { return map.size(); }
61 /// Returns the bit vector index for a given declaration.
62 Optional<unsigned> getValueIndex(const VarDecl *d) const;
66 void DeclToIndex::computeMap(const DeclContext &dc) {
68 DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
70 for ( ; I != E; ++I) {
71 const VarDecl *vd = *I;
72 if (isTrackedVar(vd, &dc))
77 Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
78 llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
84 //------------------------------------------------------------------------====//
85 // CFGBlockValues: dataflow values for CFG blocks.
86 //====------------------------------------------------------------------------//
88 // These values are defined in such a way that a merge can be done using
90 enum Value { Unknown = 0x0, /* 00 */
91 Initialized = 0x1, /* 01 */
92 Uninitialized = 0x2, /* 10 */
93 MayUninitialized = 0x3 /* 11 */ };
95 static bool isUninitialized(const Value v) {
96 return v >= Uninitialized;
98 static bool isAlwaysUninit(const Value v) {
99 return v == Uninitialized;
104 typedef llvm::PackedVector<Value, 2, llvm::SmallBitVector> ValueVector;
106 class CFGBlockValues {
108 SmallVector<ValueVector, 8> vals;
110 DeclToIndex declToIndex;
112 CFGBlockValues(const CFG &cfg);
114 unsigned getNumEntries() const { return declToIndex.size(); }
116 void computeSetOfDeclarations(const DeclContext &dc);
117 ValueVector &getValueVector(const CFGBlock *block) {
118 return vals[block->getBlockID()];
121 void setAllScratchValues(Value V);
122 void mergeIntoScratch(ValueVector const &source, bool isFirst);
123 bool updateValueVectorWithScratch(const CFGBlock *block);
125 bool hasNoDeclarations() const {
126 return declToIndex.size() == 0;
131 ValueVector::reference operator[](const VarDecl *vd);
133 Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
135 const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
136 assert(idx.hasValue());
137 return getValueVector(block)[idx.getValue()];
140 } // end anonymous namespace
142 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
144 void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
145 declToIndex.computeMap(dc);
146 unsigned decls = declToIndex.size();
147 scratch.resize(decls);
148 unsigned n = cfg.getNumBlockIDs();
152 for (unsigned i = 0; i < n; ++i)
153 vals[i].resize(decls);
157 static void printVector(const CFGBlock *block, ValueVector &bv,
159 llvm::errs() << block->getBlockID() << " :";
160 for (unsigned i = 0; i < bv.size(); ++i) {
161 llvm::errs() << ' ' << bv[i];
163 llvm::errs() << " : " << num << '\n';
167 void CFGBlockValues::setAllScratchValues(Value V) {
168 for (unsigned I = 0, E = scratch.size(); I != E; ++I)
172 void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
180 bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
181 ValueVector &dst = getValueVector(block);
182 bool changed = (dst != scratch);
186 printVector(block, scratch, 0);
191 void CFGBlockValues::resetScratch() {
195 ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
196 const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
197 assert(idx.hasValue());
198 return scratch[idx.getValue()];
201 //------------------------------------------------------------------------====//
202 // Worklist: worklist for dataflow analysis.
203 //====------------------------------------------------------------------------//
206 class DataflowWorklist {
207 PostOrderCFGView::iterator PO_I, PO_E;
208 SmallVector<const CFGBlock *, 20> worklist;
209 llvm::BitVector enqueuedBlocks;
211 DataflowWorklist(const CFG &cfg, PostOrderCFGView &view)
212 : PO_I(view.begin()), PO_E(view.end()),
213 enqueuedBlocks(cfg.getNumBlockIDs(), true) {
214 // Treat the first block as already analyzed.
216 assert(*PO_I == &cfg.getEntry());
217 enqueuedBlocks[(*PO_I)->getBlockID()] = false;
222 void enqueueSuccessors(const CFGBlock *block);
223 const CFGBlock *dequeue();
227 void DataflowWorklist::enqueueSuccessors(const clang::CFGBlock *block) {
228 for (CFGBlock::const_succ_iterator I = block->succ_begin(),
229 E = block->succ_end(); I != E; ++I) {
230 const CFGBlock *Successor = *I;
231 if (!Successor || enqueuedBlocks[Successor->getBlockID()])
233 worklist.push_back(Successor);
234 enqueuedBlocks[Successor->getBlockID()] = true;
238 const CFGBlock *DataflowWorklist::dequeue() {
239 const CFGBlock *B = nullptr;
241 // First dequeue from the worklist. This can represent
242 // updates along backedges that we want propagated as quickly as possible.
243 if (!worklist.empty())
244 B = worklist.pop_back_val();
246 // Next dequeue from the initial reverse post order. This is the
247 // theoretical ideal in the presence of no back edges.
248 else if (PO_I != PO_E) {
256 assert(enqueuedBlocks[B->getBlockID()] == true);
257 enqueuedBlocks[B->getBlockID()] = false;
261 //------------------------------------------------------------------------====//
262 // Classification of DeclRefExprs as use or initialization.
263 //====------------------------------------------------------------------------//
266 class FindVarResult {
268 const DeclRefExpr *dr;
270 FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
272 const DeclRefExpr *getDeclRefExpr() const { return dr; }
273 const VarDecl *getDecl() const { return vd; }
276 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
278 Ex = Ex->IgnoreParenNoopCasts(C);
279 if (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) {
280 if (CE->getCastKind() == CK_LValueBitCast) {
281 Ex = CE->getSubExpr();
290 /// If E is an expression comprising a reference to a single variable, find that
292 static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
293 if (const DeclRefExpr *DRE =
294 dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
295 if (const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl()))
296 if (isTrackedVar(VD, DC))
297 return FindVarResult(VD, DRE);
298 return FindVarResult(nullptr, nullptr);
301 /// \brief Classify each DeclRefExpr as an initialization or a use. Any
302 /// DeclRefExpr which isn't explicitly classified will be assumed to have
303 /// escaped the analysis and will be treated as an initialization.
304 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
314 const DeclContext *DC;
315 llvm::DenseMap<const DeclRefExpr*, Class> Classification;
317 bool isTrackedVar(const VarDecl *VD) const {
318 return ::isTrackedVar(VD, DC);
321 void classify(const Expr *E, Class C);
324 ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
326 void VisitDeclStmt(DeclStmt *DS);
327 void VisitUnaryOperator(UnaryOperator *UO);
328 void VisitBinaryOperator(BinaryOperator *BO);
329 void VisitCallExpr(CallExpr *CE);
330 void VisitCastExpr(CastExpr *CE);
332 void operator()(Stmt *S) { Visit(S); }
334 Class get(const DeclRefExpr *DRE) const {
335 llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
336 = Classification.find(DRE);
337 if (I != Classification.end())
340 const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl());
341 if (!VD || !isTrackedVar(VD))
349 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
350 if (Expr *Init = VD->getInit()) {
351 const DeclRefExpr *DRE
352 = dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
353 if (DRE && DRE->getDecl() == VD)
359 void ClassifyRefs::classify(const Expr *E, Class C) {
360 // The result of a ?: could also be an lvalue.
361 E = E->IgnoreParens();
362 if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
363 classify(CO->getTrueExpr(), C);
364 classify(CO->getFalseExpr(), C);
368 if (const BinaryConditionalOperator *BCO =
369 dyn_cast<BinaryConditionalOperator>(E)) {
370 classify(BCO->getFalseExpr(), C);
374 if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) {
375 classify(OVE->getSourceExpr(), C);
379 if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
380 if (BO->getOpcode() == BO_Comma)
381 classify(BO->getRHS(), C);
385 FindVarResult Var = findVar(E, DC);
386 if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
387 Classification[DRE] = std::max(Classification[DRE], C);
390 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
391 for (auto *DI : DS->decls()) {
392 VarDecl *VD = dyn_cast<VarDecl>(DI);
393 if (VD && isTrackedVar(VD))
394 if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
395 Classification[DRE] = SelfInit;
399 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
400 // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
401 // is not a compound-assignment, we will treat it as initializing the variable
402 // when TransferFunctions visits it. A compound-assignment does not affect
403 // whether a variable is uninitialized, and there's no point counting it as a
405 if (BO->isCompoundAssignmentOp())
406 classify(BO->getLHS(), Use);
407 else if (BO->getOpcode() == BO_Assign)
408 classify(BO->getLHS(), Ignore);
411 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
412 // Increment and decrement are uses despite there being no lvalue-to-rvalue
414 if (UO->isIncrementDecrementOp())
415 classify(UO->getSubExpr(), Use);
418 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
419 // Classify arguments to std::move as used.
420 if (CE->getNumArgs() == 1) {
421 if (FunctionDecl *FD = CE->getDirectCallee()) {
422 if (FD->isInStdNamespace() && FD->getIdentifier() &&
423 FD->getIdentifier()->isStr("move")) {
424 classify(CE->getArg(0), Use);
430 // If a value is passed by const reference to a function, we should not assume
431 // that it is initialized by the call, and we conservatively do not assume
433 for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
435 if ((*I)->getType().isConstQualified() && (*I)->isGLValue())
436 classify(*I, Ignore);
439 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
440 if (CE->getCastKind() == CK_LValueToRValue)
441 classify(CE->getSubExpr(), Use);
442 else if (CStyleCastExpr *CSE = dyn_cast<CStyleCastExpr>(CE)) {
443 if (CSE->getType()->isVoidType()) {
444 // Squelch any detected load of an uninitialized value if
445 // we cast it to void.
447 classify(CSE->getSubExpr(), Ignore);
452 //------------------------------------------------------------------------====//
453 // Transfer function for uninitialized values analysis.
454 //====------------------------------------------------------------------------//
457 class TransferFunctions : public StmtVisitor<TransferFunctions> {
458 CFGBlockValues &vals;
460 const CFGBlock *block;
461 AnalysisDeclContext ∾
462 const ClassifyRefs &classification;
463 ObjCNoReturn objCNoRet;
464 UninitVariablesHandler &handler;
467 TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
468 const CFGBlock *block, AnalysisDeclContext &ac,
469 const ClassifyRefs &classification,
470 UninitVariablesHandler &handler)
471 : vals(vals), cfg(cfg), block(block), ac(ac),
472 classification(classification), objCNoRet(ac.getASTContext()),
475 void reportUse(const Expr *ex, const VarDecl *vd);
477 void VisitBinaryOperator(BinaryOperator *bo);
478 void VisitBlockExpr(BlockExpr *be);
479 void VisitCallExpr(CallExpr *ce);
480 void VisitDeclRefExpr(DeclRefExpr *dr);
481 void VisitDeclStmt(DeclStmt *ds);
482 void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
483 void VisitObjCMessageExpr(ObjCMessageExpr *ME);
485 bool isTrackedVar(const VarDecl *vd) {
486 return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
489 FindVarResult findVar(const Expr *ex) {
490 return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
493 UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
494 UninitUse Use(ex, isAlwaysUninit(v));
496 assert(isUninitialized(v));
497 if (Use.getKind() == UninitUse::Always)
500 // If an edge which leads unconditionally to this use did not initialize
501 // the variable, we can say something stronger than 'may be uninitialized':
502 // we can say 'either it's used uninitialized or you have dead code'.
504 // We track the number of successors of a node which have been visited, and
505 // visit a node once we have visited all of its successors. Only edges where
506 // the variable might still be uninitialized are followed. Since a variable
507 // can't transfer from being initialized to being uninitialized, this will
508 // trace out the subgraph which inevitably leads to the use and does not
509 // initialize the variable. We do not want to skip past loops, since their
510 // non-termination might be correlated with the initialization condition.
514 // void f(bool a, bool b) {
519 // block4: } else if (b) {
520 // block5: while (!a) {
521 // block6: do_work(&a);
530 // Starting from the maybe-uninitialized use in block 9:
531 // * Block 7 is not visited because we have only visited one of its two
533 // * Block 8 is visited because we've visited its only successor.
535 // * Block 7 is visited because we've now visited both of its successors.
537 // * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
538 // of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
539 // * Block 3 is not visited because it initializes 'n'.
540 // Now the algorithm terminates, having visited blocks 7 and 8, and having
541 // found the frontier is blocks 2, 4, and 5.
543 // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
544 // and 4), so we report that any time either of those edges is taken (in
545 // each case when 'b == false'), 'n' is used uninitialized.
546 SmallVector<const CFGBlock*, 32> Queue;
547 SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
548 Queue.push_back(block);
549 // Specify that we've already visited all successors of the starting block.
550 // This has the dual purpose of ensuring we never add it to the queue, and
551 // of marking it as not being a candidate element of the frontier.
552 SuccsVisited[block->getBlockID()] = block->succ_size();
553 while (!Queue.empty()) {
554 const CFGBlock *B = Queue.pop_back_val();
556 // If the use is always reached from the entry block, make a note of that.
557 if (B == &cfg.getEntry())
558 Use.setUninitAfterCall();
560 for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
562 const CFGBlock *Pred = *I;
566 Value AtPredExit = vals.getValue(Pred, B, vd);
567 if (AtPredExit == Initialized)
568 // This block initializes the variable.
570 if (AtPredExit == MayUninitialized &&
571 vals.getValue(B, nullptr, vd) == Uninitialized) {
572 // This block declares the variable (uninitialized), and is reachable
573 // from a block that initializes the variable. We can't guarantee to
574 // give an earlier location for the diagnostic (and it appears that
575 // this code is intended to be reachable) so give a diagnostic here
576 // and go no further down this path.
577 Use.setUninitAfterDecl();
581 unsigned &SV = SuccsVisited[Pred->getBlockID()];
583 // When visiting the first successor of a block, mark all NULL
584 // successors as having been visited.
585 for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
586 SE = Pred->succ_end();
592 if (++SV == Pred->succ_size())
593 // All paths from this block lead to the use and don't initialize the
595 Queue.push_back(Pred);
599 // Scan the frontier, looking for blocks where the variable was
601 for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) {
602 const CFGBlock *Block = *BI;
603 unsigned BlockID = Block->getBlockID();
604 const Stmt *Term = Block->getTerminator();
605 if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
607 // This block inevitably leads to the use. If we have an edge from here
608 // to a post-dominator block, and the variable is uninitialized on that
609 // edge, we have found a bug.
610 for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
611 E = Block->succ_end(); I != E; ++I) {
612 const CFGBlock *Succ = *I;
613 if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
614 vals.getValue(Block, Succ, vd) == Uninitialized) {
615 // Switch cases are a special case: report the label to the caller
616 // as the 'terminator', not the switch statement itself. Suppress
617 // situations where no label matched: we can't be sure that's
619 if (isa<SwitchStmt>(Term)) {
620 const Stmt *Label = Succ->getLabel();
621 if (!Label || !isa<SwitchCase>(Label))
622 // Might not be possible.
624 UninitUse::Branch Branch;
625 Branch.Terminator = Label;
626 Branch.Output = 0; // Ignored.
627 Use.addUninitBranch(Branch);
629 UninitUse::Branch Branch;
630 Branch.Terminator = Term;
631 Branch.Output = I - Block->succ_begin();
632 Use.addUninitBranch(Branch);
644 void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
646 if (isUninitialized(v))
647 handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
650 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
651 // This represents an initialization of the 'element' value.
652 if (DeclStmt *DS = dyn_cast<DeclStmt>(FS->getElement())) {
653 const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl());
654 if (isTrackedVar(VD))
655 vals[VD] = Initialized;
659 void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
660 const BlockDecl *bd = be->getBlockDecl();
661 for (const auto &I : bd->captures()) {
662 const VarDecl *vd = I.getVariable();
663 if (!isTrackedVar(vd))
666 vals[vd] = Initialized;
673 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
674 if (Decl *Callee = ce->getCalleeDecl()) {
675 if (Callee->hasAttr<ReturnsTwiceAttr>()) {
676 // After a call to a function like setjmp or vfork, any variable which is
677 // initialized anywhere within this function may now be initialized. For
678 // now, just assume such a call initializes all variables. FIXME: Only
679 // mark variables as initialized if they have an initializer which is
680 // reachable from here.
681 vals.setAllScratchValues(Initialized);
683 else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
684 // Functions labeled like "analyzer_noreturn" are often used to denote
685 // "panic" functions that in special debug situations can still return,
686 // but for the most part should not be treated as returning. This is a
687 // useful annotation borrowed from the static analyzer that is useful for
688 // suppressing branch-specific false positives when we call one of these
689 // functions but keep pretending the path continues (when in reality the
690 // user doesn't care).
691 vals.setAllScratchValues(Unknown);
696 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
697 switch (classification.get(dr)) {
698 case ClassifyRefs::Ignore:
700 case ClassifyRefs::Use:
701 reportUse(dr, cast<VarDecl>(dr->getDecl()));
703 case ClassifyRefs::Init:
704 vals[cast<VarDecl>(dr->getDecl())] = Initialized;
706 case ClassifyRefs::SelfInit:
707 handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
712 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
713 if (BO->getOpcode() == BO_Assign) {
714 FindVarResult Var = findVar(BO->getLHS());
715 if (const VarDecl *VD = Var.getDecl())
716 vals[VD] = Initialized;
720 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
721 for (auto *DI : DS->decls()) {
722 VarDecl *VD = dyn_cast<VarDecl>(DI);
723 if (VD && isTrackedVar(VD)) {
724 if (getSelfInitExpr(VD)) {
725 // If the initializer consists solely of a reference to itself, we
726 // explicitly mark the variable as uninitialized. This allows code
727 // like the following:
731 // to deliberately leave a variable uninitialized. Different analysis
732 // clients can detect this pattern and adjust their reporting
733 // appropriately, but we need to continue to analyze subsequent uses
735 vals[VD] = Uninitialized;
736 } else if (VD->getInit()) {
737 // Treat the new variable as initialized.
738 vals[VD] = Initialized;
740 // No initializer: the variable is now uninitialized. This matters
747 // FIXME: Mark the variable as uninitialized whenever its scope is
748 // left, since its scope could be re-entered by a jump over the
750 vals[VD] = Uninitialized;
756 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
757 // If the Objective-C message expression is an implicit no-return that
758 // is not modeled in the CFG, set the tracked dataflow values to Unknown.
759 if (objCNoRet.isImplicitNoReturn(ME)) {
760 vals.setAllScratchValues(Unknown);
764 //------------------------------------------------------------------------====//
765 // High-level "driver" logic for uninitialized values analysis.
766 //====------------------------------------------------------------------------//
768 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
769 AnalysisDeclContext &ac, CFGBlockValues &vals,
770 const ClassifyRefs &classification,
771 llvm::BitVector &wasAnalyzed,
772 UninitVariablesHandler &handler) {
773 wasAnalyzed[block->getBlockID()] = true;
775 // Merge in values of predecessor blocks.
777 for (CFGBlock::const_pred_iterator I = block->pred_begin(),
778 E = block->pred_end(); I != E; ++I) {
779 const CFGBlock *pred = *I;
782 if (wasAnalyzed[pred->getBlockID()]) {
783 vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
787 // Apply the transfer function.
788 TransferFunctions tf(vals, cfg, block, ac, classification, handler);
789 for (CFGBlock::const_iterator I = block->begin(), E = block->end();
791 if (Optional<CFGStmt> cs = I->getAs<CFGStmt>())
792 tf.Visit(const_cast<Stmt*>(cs->getStmt()));
794 return vals.updateValueVectorWithScratch(block);
797 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
798 /// to detect when a CFGBlock has any *potential* use of an uninitialized
799 /// variable. It is mainly used to prune out work during the final
802 struct PruneBlocksHandler : public UninitVariablesHandler {
803 PruneBlocksHandler(unsigned numBlocks)
804 : hadUse(numBlocks, false), hadAnyUse(false),
807 virtual ~PruneBlocksHandler() {}
809 /// Records if a CFGBlock had a potential use of an uninitialized variable.
810 llvm::BitVector hadUse;
812 /// Records if any CFGBlock had a potential use of an uninitialized variable.
815 /// The current block to scribble use information.
816 unsigned currentBlock;
818 void handleUseOfUninitVariable(const VarDecl *vd,
819 const UninitUse &use) override {
820 hadUse[currentBlock] = true;
824 /// Called when the uninitialized variable analysis detects the
825 /// idiom 'int x = x'. All other uses of 'x' within the initializer
826 /// are handled by handleUseOfUninitVariable.
827 void handleSelfInit(const VarDecl *vd) override {
828 hadUse[currentBlock] = true;
834 void clang::runUninitializedVariablesAnalysis(
835 const DeclContext &dc,
837 AnalysisDeclContext &ac,
838 UninitVariablesHandler &handler,
839 UninitVariablesAnalysisStats &stats) {
840 CFGBlockValues vals(cfg);
841 vals.computeSetOfDeclarations(dc);
842 if (vals.hasNoDeclarations())
845 stats.NumVariablesAnalyzed = vals.getNumEntries();
847 // Precompute which expressions are uses and which are initializations.
848 ClassifyRefs classification(ac);
849 cfg.VisitBlockStmts(classification);
851 // Mark all variables uninitialized at the entry.
852 const CFGBlock &entry = cfg.getEntry();
853 ValueVector &vec = vals.getValueVector(&entry);
854 const unsigned n = vals.getNumEntries();
855 for (unsigned j = 0; j < n ; ++j) {
856 vec[j] = Uninitialized;
859 // Proceed with the workist.
860 DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>());
861 llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
862 worklist.enqueueSuccessors(&cfg.getEntry());
863 llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
864 wasAnalyzed[cfg.getEntry().getBlockID()] = true;
865 PruneBlocksHandler PBH(cfg.getNumBlockIDs());
867 while (const CFGBlock *block = worklist.dequeue()) {
868 PBH.currentBlock = block->getBlockID();
870 // Did the block change?
871 bool changed = runOnBlock(block, cfg, ac, vals,
872 classification, wasAnalyzed, PBH);
873 ++stats.NumBlockVisits;
874 if (changed || !previouslyVisited[block->getBlockID()])
875 worklist.enqueueSuccessors(block);
876 previouslyVisited[block->getBlockID()] = true;
882 // Run through the blocks one more time, and report uninitialized variables.
883 for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) {
884 const CFGBlock *block = *BI;
885 if (PBH.hadUse[block->getBlockID()]) {
886 runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
887 ++stats.NumBlockVisits;
892 UninitVariablesHandler::~UninitVariablesHandler() {}