1 //===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file implements extra semantic analysis beyond what is enforced
11 // by the C type system.
13 //===----------------------------------------------------------------------===//
16 #include "clang/Analysis/AnalysisContext.h"
17 #include "clang/Analysis/CFG.h"
18 #include "clang/Analysis/Analyses/ReachableCode.h"
19 #include "clang/Analysis/Analyses/PrintfFormatString.h"
20 #include "clang/AST/ASTContext.h"
21 #include "clang/AST/CharUnits.h"
22 #include "clang/AST/DeclObjC.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/DeclObjC.h"
26 #include "clang/AST/StmtCXX.h"
27 #include "clang/AST/StmtObjC.h"
28 #include "clang/Lex/LiteralSupport.h"
29 #include "clang/Lex/Preprocessor.h"
30 #include "llvm/ADT/BitVector.h"
31 #include "llvm/ADT/STLExtras.h"
34 using namespace clang;
36 /// getLocationOfStringLiteralByte - Return a source location that points to the
37 /// specified byte of the specified string literal.
39 /// Strings are amazingly complex. They can be formed from multiple tokens and
40 /// can have escape sequences in them in addition to the usual trigraph and
41 /// escaped newline business. This routine handles this complexity.
43 SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
44 unsigned ByteNo) const {
45 assert(!SL->isWide() && "This doesn't work for wide strings yet");
47 // Loop over all of the tokens in this string until we find the one that
48 // contains the byte we're looking for.
51 assert(TokNo < SL->getNumConcatenated() && "Invalid byte number!");
52 SourceLocation StrTokLoc = SL->getStrTokenLoc(TokNo);
54 // Get the spelling of the string so that we can get the data that makes up
55 // the string literal, not the identifier for the macro it is potentially
57 SourceLocation StrTokSpellingLoc = SourceMgr.getSpellingLoc(StrTokLoc);
59 // Re-lex the token to get its length and original spelling.
60 std::pair<FileID, unsigned> LocInfo =
61 SourceMgr.getDecomposedLoc(StrTokSpellingLoc);
62 std::pair<const char *,const char *> Buffer =
63 SourceMgr.getBufferData(LocInfo.first);
64 const char *StrData = Buffer.first+LocInfo.second;
66 // Create a langops struct and enable trigraphs. This is sufficient for
69 LangOpts.Trigraphs = true;
71 // Create a lexer starting at the beginning of this token.
72 Lexer TheLexer(StrTokSpellingLoc, LangOpts, Buffer.first, StrData,
75 TheLexer.LexFromRawLexer(TheTok);
77 // Use the StringLiteralParser to compute the length of the string in bytes.
78 StringLiteralParser SLP(&TheTok, 1, PP);
79 unsigned TokNumBytes = SLP.GetStringLength();
81 // If the byte is in this token, return the location of the byte.
82 if (ByteNo < TokNumBytes ||
83 (ByteNo == TokNumBytes && TokNo == SL->getNumConcatenated())) {
85 StringLiteralParser::getOffsetOfStringByte(TheTok, ByteNo, PP);
87 // Now that we know the offset of the token in the spelling, use the
88 // preprocessor to get the offset in the original source.
89 return PP.AdvanceToTokenCharacter(StrTokLoc, Offset);
92 // Move to the next string token.
94 ByteNo -= TokNumBytes;
98 /// CheckablePrintfAttr - does a function call have a "printf" attribute
99 /// and arguments that merit checking?
100 bool Sema::CheckablePrintfAttr(const FormatAttr *Format, CallExpr *TheCall) {
101 if (Format->getType() == "printf") return true;
102 if (Format->getType() == "printf0") {
103 // printf0 allows null "format" string; if so don't check format/args
104 unsigned format_idx = Format->getFormatIdx() - 1;
105 // Does the index refer to the implicit object argument?
106 if (isa<CXXMemberCallExpr>(TheCall)) {
111 if (format_idx < TheCall->getNumArgs()) {
112 Expr *Format = TheCall->getArg(format_idx)->IgnoreParenCasts();
113 if (!Format->isNullPointerConstant(Context,
114 Expr::NPC_ValueDependentIsNull))
121 Action::OwningExprResult
122 Sema::CheckBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
123 OwningExprResult TheCallResult(Owned(TheCall));
126 case Builtin::BI__builtin___CFStringMakeConstantString:
127 assert(TheCall->getNumArgs() == 1 &&
128 "Wrong # arguments to builtin CFStringMakeConstantString");
129 if (CheckObjCString(TheCall->getArg(0)))
132 case Builtin::BI__builtin_stdarg_start:
133 case Builtin::BI__builtin_va_start:
134 if (SemaBuiltinVAStart(TheCall))
137 case Builtin::BI__builtin_isgreater:
138 case Builtin::BI__builtin_isgreaterequal:
139 case Builtin::BI__builtin_isless:
140 case Builtin::BI__builtin_islessequal:
141 case Builtin::BI__builtin_islessgreater:
142 case Builtin::BI__builtin_isunordered:
143 if (SemaBuiltinUnorderedCompare(TheCall))
146 case Builtin::BI__builtin_fpclassify:
147 if (SemaBuiltinFPClassification(TheCall, 6))
150 case Builtin::BI__builtin_isfinite:
151 case Builtin::BI__builtin_isinf:
152 case Builtin::BI__builtin_isinf_sign:
153 case Builtin::BI__builtin_isnan:
154 case Builtin::BI__builtin_isnormal:
155 if (SemaBuiltinFPClassification(TheCall, 1))
158 case Builtin::BI__builtin_return_address:
159 case Builtin::BI__builtin_frame_address:
160 if (SemaBuiltinStackAddress(TheCall))
163 case Builtin::BI__builtin_eh_return_data_regno:
164 if (SemaBuiltinEHReturnDataRegNo(TheCall))
167 case Builtin::BI__builtin_shufflevector:
168 return SemaBuiltinShuffleVector(TheCall);
169 // TheCall will be freed by the smart pointer here, but that's fine, since
170 // SemaBuiltinShuffleVector guts it, but then doesn't release it.
171 case Builtin::BI__builtin_prefetch:
172 if (SemaBuiltinPrefetch(TheCall))
175 case Builtin::BI__builtin_object_size:
176 if (SemaBuiltinObjectSize(TheCall))
179 case Builtin::BI__builtin_longjmp:
180 if (SemaBuiltinLongjmp(TheCall))
183 case Builtin::BI__sync_fetch_and_add:
184 case Builtin::BI__sync_fetch_and_sub:
185 case Builtin::BI__sync_fetch_and_or:
186 case Builtin::BI__sync_fetch_and_and:
187 case Builtin::BI__sync_fetch_and_xor:
188 case Builtin::BI__sync_fetch_and_nand:
189 case Builtin::BI__sync_add_and_fetch:
190 case Builtin::BI__sync_sub_and_fetch:
191 case Builtin::BI__sync_and_and_fetch:
192 case Builtin::BI__sync_or_and_fetch:
193 case Builtin::BI__sync_xor_and_fetch:
194 case Builtin::BI__sync_nand_and_fetch:
195 case Builtin::BI__sync_val_compare_and_swap:
196 case Builtin::BI__sync_bool_compare_and_swap:
197 case Builtin::BI__sync_lock_test_and_set:
198 case Builtin::BI__sync_lock_release:
199 if (SemaBuiltinAtomicOverloaded(TheCall))
204 return move(TheCallResult);
207 /// CheckFunctionCall - Check a direct function call for various correctness
208 /// and safety properties not strictly enforced by the C type system.
209 bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall) {
210 // Get the IdentifierInfo* for the called function.
211 IdentifierInfo *FnInfo = FDecl->getIdentifier();
213 // None of the checks below are needed for functions that don't have
214 // simple names (e.g., C++ conversion functions).
218 // FIXME: This mechanism should be abstracted to be less fragile and
219 // more efficient. For example, just map function ids to custom
223 if (const FormatAttr *Format = FDecl->getAttr<FormatAttr>()) {
224 if (CheckablePrintfAttr(Format, TheCall)) {
225 bool HasVAListArg = Format->getFirstArg() == 0;
227 if (const FunctionProtoType *Proto
228 = FDecl->getType()->getAs<FunctionProtoType>())
229 HasVAListArg = !Proto->isVariadic();
231 CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
232 HasVAListArg ? 0 : Format->getFirstArg() - 1);
236 for (const NonNullAttr *NonNull = FDecl->getAttr<NonNullAttr>(); NonNull;
237 NonNull = NonNull->getNext<NonNullAttr>())
238 CheckNonNullArguments(NonNull, TheCall);
243 bool Sema::CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall) {
245 const FormatAttr *Format = NDecl->getAttr<FormatAttr>();
249 const VarDecl *V = dyn_cast<VarDecl>(NDecl);
253 QualType Ty = V->getType();
254 if (!Ty->isBlockPointerType())
257 if (!CheckablePrintfAttr(Format, TheCall))
260 bool HasVAListArg = Format->getFirstArg() == 0;
262 const FunctionType *FT =
263 Ty->getAs<BlockPointerType>()->getPointeeType()->getAs<FunctionType>();
264 if (const FunctionProtoType *Proto = dyn_cast<FunctionProtoType>(FT))
265 HasVAListArg = !Proto->isVariadic();
267 CheckPrintfArguments(TheCall, HasVAListArg, Format->getFormatIdx() - 1,
268 HasVAListArg ? 0 : Format->getFirstArg() - 1);
273 /// SemaBuiltinAtomicOverloaded - We have a call to a function like
274 /// __sync_fetch_and_add, which is an overloaded function based on the pointer
275 /// type of its first argument. The main ActOnCallExpr routines have already
276 /// promoted the types of arguments because all of these calls are prototyped as
279 /// This function goes through and does final semantic checking for these
281 bool Sema::SemaBuiltinAtomicOverloaded(CallExpr *TheCall) {
282 DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
283 FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
285 // Ensure that we have at least one argument to do type inference from.
286 if (TheCall->getNumArgs() < 1)
287 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
288 << 0 << TheCall->getCallee()->getSourceRange();
290 // Inspect the first argument of the atomic builtin. This should always be
291 // a pointer type, whose element is an integral scalar or pointer type.
292 // Because it is a pointer type, we don't have to worry about any implicit
294 Expr *FirstArg = TheCall->getArg(0);
295 if (!FirstArg->getType()->isPointerType())
296 return Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
297 << FirstArg->getType() << FirstArg->getSourceRange();
299 QualType ValType = FirstArg->getType()->getAs<PointerType>()->getPointeeType();
300 if (!ValType->isIntegerType() && !ValType->isPointerType() &&
301 !ValType->isBlockPointerType())
302 return Diag(DRE->getLocStart(),
303 diag::err_atomic_builtin_must_be_pointer_intptr)
304 << FirstArg->getType() << FirstArg->getSourceRange();
306 // We need to figure out which concrete builtin this maps onto. For example,
307 // __sync_fetch_and_add with a 2 byte object turns into
308 // __sync_fetch_and_add_2.
309 #define BUILTIN_ROW(x) \
310 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
311 Builtin::BI##x##_8, Builtin::BI##x##_16 }
313 static const unsigned BuiltinIndices[][5] = {
314 BUILTIN_ROW(__sync_fetch_and_add),
315 BUILTIN_ROW(__sync_fetch_and_sub),
316 BUILTIN_ROW(__sync_fetch_and_or),
317 BUILTIN_ROW(__sync_fetch_and_and),
318 BUILTIN_ROW(__sync_fetch_and_xor),
319 BUILTIN_ROW(__sync_fetch_and_nand),
321 BUILTIN_ROW(__sync_add_and_fetch),
322 BUILTIN_ROW(__sync_sub_and_fetch),
323 BUILTIN_ROW(__sync_and_and_fetch),
324 BUILTIN_ROW(__sync_or_and_fetch),
325 BUILTIN_ROW(__sync_xor_and_fetch),
326 BUILTIN_ROW(__sync_nand_and_fetch),
328 BUILTIN_ROW(__sync_val_compare_and_swap),
329 BUILTIN_ROW(__sync_bool_compare_and_swap),
330 BUILTIN_ROW(__sync_lock_test_and_set),
331 BUILTIN_ROW(__sync_lock_release)
335 // Determine the index of the size.
337 switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
338 case 1: SizeIndex = 0; break;
339 case 2: SizeIndex = 1; break;
340 case 4: SizeIndex = 2; break;
341 case 8: SizeIndex = 3; break;
342 case 16: SizeIndex = 4; break;
344 return Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
345 << FirstArg->getType() << FirstArg->getSourceRange();
348 // Each of these builtins has one pointer argument, followed by some number of
349 // values (0, 1 or 2) followed by a potentially empty varags list of stuff
350 // that we ignore. Find out which row of BuiltinIndices to read from as well
351 // as the number of fixed args.
352 unsigned BuiltinID = FDecl->getBuiltinID();
353 unsigned BuiltinIndex, NumFixed = 1;
355 default: assert(0 && "Unknown overloaded atomic builtin!");
356 case Builtin::BI__sync_fetch_and_add: BuiltinIndex = 0; break;
357 case Builtin::BI__sync_fetch_and_sub: BuiltinIndex = 1; break;
358 case Builtin::BI__sync_fetch_and_or: BuiltinIndex = 2; break;
359 case Builtin::BI__sync_fetch_and_and: BuiltinIndex = 3; break;
360 case Builtin::BI__sync_fetch_and_xor: BuiltinIndex = 4; break;
361 case Builtin::BI__sync_fetch_and_nand:BuiltinIndex = 5; break;
363 case Builtin::BI__sync_add_and_fetch: BuiltinIndex = 6; break;
364 case Builtin::BI__sync_sub_and_fetch: BuiltinIndex = 7; break;
365 case Builtin::BI__sync_and_and_fetch: BuiltinIndex = 8; break;
366 case Builtin::BI__sync_or_and_fetch: BuiltinIndex = 9; break;
367 case Builtin::BI__sync_xor_and_fetch: BuiltinIndex =10; break;
368 case Builtin::BI__sync_nand_and_fetch:BuiltinIndex =11; break;
370 case Builtin::BI__sync_val_compare_and_swap:
374 case Builtin::BI__sync_bool_compare_and_swap:
378 case Builtin::BI__sync_lock_test_and_set: BuiltinIndex = 14; break;
379 case Builtin::BI__sync_lock_release:
385 // Now that we know how many fixed arguments we expect, first check that we
386 // have at least that many.
387 if (TheCall->getNumArgs() < 1+NumFixed)
388 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
389 << 0 << TheCall->getCallee()->getSourceRange();
392 // Get the decl for the concrete builtin from this, we can tell what the
393 // concrete integer type we should convert to is.
394 unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
395 const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
396 IdentifierInfo *NewBuiltinII = PP.getIdentifierInfo(NewBuiltinName);
397 FunctionDecl *NewBuiltinDecl =
398 cast<FunctionDecl>(LazilyCreateBuiltin(NewBuiltinII, NewBuiltinID,
399 TUScope, false, DRE->getLocStart()));
400 const FunctionProtoType *BuiltinFT =
401 NewBuiltinDecl->getType()->getAs<FunctionProtoType>();
402 ValType = BuiltinFT->getArgType(0)->getAs<PointerType>()->getPointeeType();
404 // If the first type needs to be converted (e.g. void** -> int*), do it now.
405 if (BuiltinFT->getArgType(0) != FirstArg->getType()) {
406 ImpCastExprToType(FirstArg, BuiltinFT->getArgType(0), CastExpr::CK_BitCast);
407 TheCall->setArg(0, FirstArg);
410 // Next, walk the valid ones promoting to the right type.
411 for (unsigned i = 0; i != NumFixed; ++i) {
412 Expr *Arg = TheCall->getArg(i+1);
414 // If the argument is an implicit cast, then there was a promotion due to
415 // "...", just remove it now.
416 if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
417 Arg = ICE->getSubExpr();
419 ICE->Destroy(Context);
420 TheCall->setArg(i+1, Arg);
423 // GCC does an implicit conversion to the pointer or integer ValType. This
424 // can fail in some cases (1i -> int**), check for this error case now.
425 CastExpr::CastKind Kind = CastExpr::CK_Unknown;
426 CXXMethodDecl *ConversionDecl = 0;
427 if (CheckCastTypes(Arg->getSourceRange(), ValType, Arg, Kind,
431 // Okay, we have something that *can* be converted to the right type. Check
432 // to see if there is a potentially weird extension going on here. This can
433 // happen when you do an atomic operation on something like an char* and
434 // pass in 42. The 42 gets converted to char. This is even more strange
435 // for things like 45.123 -> char, etc.
436 // FIXME: Do this check.
437 ImpCastExprToType(Arg, ValType, Kind, /*isLvalue=*/false);
438 TheCall->setArg(i+1, Arg);
441 // Switch the DeclRefExpr to refer to the new decl.
442 DRE->setDecl(NewBuiltinDecl);
443 DRE->setType(NewBuiltinDecl->getType());
445 // Set the callee in the CallExpr.
446 // FIXME: This leaks the original parens and implicit casts.
447 Expr *PromotedCall = DRE;
448 UsualUnaryConversions(PromotedCall);
449 TheCall->setCallee(PromotedCall);
452 // Change the result type of the call to match the result type of the decl.
453 TheCall->setType(NewBuiltinDecl->getResultType());
458 /// CheckObjCString - Checks that the argument to the builtin
459 /// CFString constructor is correct
460 /// FIXME: GCC currently emits the following warning:
461 /// "warning: input conversion stopped due to an input byte that does not
462 /// belong to the input codeset UTF-8"
463 /// Note: It might also make sense to do the UTF-16 conversion here (would
464 /// simplify the backend).
465 bool Sema::CheckObjCString(Expr *Arg) {
466 Arg = Arg->IgnoreParenCasts();
467 StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
469 if (!Literal || Literal->isWide()) {
470 Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
471 << Arg->getSourceRange();
475 const char *Data = Literal->getStrData();
476 unsigned Length = Literal->getByteLength();
478 for (unsigned i = 0; i < Length; ++i) {
480 Diag(getLocationOfStringLiteralByte(Literal, i),
481 diag::warn_cfstring_literal_contains_nul_character)
482 << Arg->getSourceRange();
490 /// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
491 /// Emit an error and return true on failure, return false on success.
492 bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
493 Expr *Fn = TheCall->getCallee();
494 if (TheCall->getNumArgs() > 2) {
495 Diag(TheCall->getArg(2)->getLocStart(),
496 diag::err_typecheck_call_too_many_args)
497 << 0 /*function call*/ << Fn->getSourceRange()
498 << SourceRange(TheCall->getArg(2)->getLocStart(),
499 (*(TheCall->arg_end()-1))->getLocEnd());
503 if (TheCall->getNumArgs() < 2) {
504 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
505 << 0 /*function call*/;
508 // Determine whether the current function is variadic or not.
509 BlockScopeInfo *CurBlock = getCurBlock();
512 isVariadic = CurBlock->isVariadic;
513 else if (getCurFunctionDecl()) {
514 if (FunctionProtoType* FTP =
515 dyn_cast<FunctionProtoType>(getCurFunctionDecl()->getType()))
516 isVariadic = FTP->isVariadic();
520 isVariadic = getCurMethodDecl()->isVariadic();
524 Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
528 // Verify that the second argument to the builtin is the last argument of the
529 // current function or method.
530 bool SecondArgIsLastNamedArgument = false;
531 const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
533 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
534 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
535 // FIXME: This isn't correct for methods (results in bogus warning).
536 // Get the last formal in the current function.
537 const ParmVarDecl *LastArg;
539 LastArg = *(CurBlock->TheDecl->param_end()-1);
540 else if (FunctionDecl *FD = getCurFunctionDecl())
541 LastArg = *(FD->param_end()-1);
543 LastArg = *(getCurMethodDecl()->param_end()-1);
544 SecondArgIsLastNamedArgument = PV == LastArg;
548 if (!SecondArgIsLastNamedArgument)
549 Diag(TheCall->getArg(1)->getLocStart(),
550 diag::warn_second_parameter_of_va_start_not_last_named_argument);
554 /// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
555 /// friends. This is declared to take (...), so we have to check everything.
556 bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
557 if (TheCall->getNumArgs() < 2)
558 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
559 << 0 /*function call*/;
560 if (TheCall->getNumArgs() > 2)
561 return Diag(TheCall->getArg(2)->getLocStart(),
562 diag::err_typecheck_call_too_many_args)
563 << 0 /*function call*/
564 << SourceRange(TheCall->getArg(2)->getLocStart(),
565 (*(TheCall->arg_end()-1))->getLocEnd());
567 Expr *OrigArg0 = TheCall->getArg(0);
568 Expr *OrigArg1 = TheCall->getArg(1);
570 // Do standard promotions between the two arguments, returning their common
572 QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
574 // Make sure any conversions are pushed back into the call; this is
575 // type safe since unordered compare builtins are declared as "_Bool
577 TheCall->setArg(0, OrigArg0);
578 TheCall->setArg(1, OrigArg1);
580 if (OrigArg0->isTypeDependent() || OrigArg1->isTypeDependent())
583 // If the common type isn't a real floating type, then the arguments were
584 // invalid for this operation.
585 if (!Res->isRealFloatingType())
586 return Diag(OrigArg0->getLocStart(),
587 diag::err_typecheck_call_invalid_ordered_compare)
588 << OrigArg0->getType() << OrigArg1->getType()
589 << SourceRange(OrigArg0->getLocStart(), OrigArg1->getLocEnd());
594 /// SemaBuiltinSemaBuiltinFPClassification - Handle functions like
595 /// __builtin_isnan and friends. This is declared to take (...), so we have
596 /// to check everything. We expect the last argument to be a floating point
598 bool Sema::SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs) {
599 if (TheCall->getNumArgs() < NumArgs)
600 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
601 << 0 /*function call*/;
602 if (TheCall->getNumArgs() > NumArgs)
603 return Diag(TheCall->getArg(NumArgs)->getLocStart(),
604 diag::err_typecheck_call_too_many_args)
605 << 0 /*function call*/
606 << SourceRange(TheCall->getArg(NumArgs)->getLocStart(),
607 (*(TheCall->arg_end()-1))->getLocEnd());
609 Expr *OrigArg = TheCall->getArg(NumArgs-1);
611 if (OrigArg->isTypeDependent())
614 // This operation requires a floating-point number
615 if (!OrigArg->getType()->isRealFloatingType())
616 return Diag(OrigArg->getLocStart(),
617 diag::err_typecheck_call_invalid_unary_fp)
618 << OrigArg->getType() << OrigArg->getSourceRange();
623 bool Sema::SemaBuiltinStackAddress(CallExpr *TheCall) {
624 // The signature for these builtins is exact; the only thing we need
625 // to check is that the argument is a constant.
627 if (!TheCall->getArg(0)->isTypeDependent() &&
628 !TheCall->getArg(0)->isValueDependent() &&
629 !TheCall->getArg(0)->isIntegerConstantExpr(Context, &Loc))
630 return Diag(Loc, diag::err_stack_const_level) << TheCall->getSourceRange();
635 /// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
636 // This is declared to take (...), so we have to check everything.
637 Action::OwningExprResult Sema::SemaBuiltinShuffleVector(CallExpr *TheCall) {
638 if (TheCall->getNumArgs() < 3)
639 return ExprError(Diag(TheCall->getLocEnd(),
640 diag::err_typecheck_call_too_few_args)
641 << 0 /*function call*/ << TheCall->getSourceRange());
643 unsigned numElements = std::numeric_limits<unsigned>::max();
644 if (!TheCall->getArg(0)->isTypeDependent() &&
645 !TheCall->getArg(1)->isTypeDependent()) {
646 QualType FAType = TheCall->getArg(0)->getType();
647 QualType SAType = TheCall->getArg(1)->getType();
649 if (!FAType->isVectorType() || !SAType->isVectorType()) {
650 Diag(TheCall->getLocStart(), diag::err_shufflevector_non_vector)
651 << SourceRange(TheCall->getArg(0)->getLocStart(),
652 TheCall->getArg(1)->getLocEnd());
656 if (!Context.hasSameUnqualifiedType(FAType, SAType)) {
657 Diag(TheCall->getLocStart(), diag::err_shufflevector_incompatible_vector)
658 << SourceRange(TheCall->getArg(0)->getLocStart(),
659 TheCall->getArg(1)->getLocEnd());
663 numElements = FAType->getAs<VectorType>()->getNumElements();
664 if (TheCall->getNumArgs() != numElements+2) {
665 if (TheCall->getNumArgs() < numElements+2)
666 return ExprError(Diag(TheCall->getLocEnd(),
667 diag::err_typecheck_call_too_few_args)
668 << 0 /*function call*/ << TheCall->getSourceRange());
669 return ExprError(Diag(TheCall->getLocEnd(),
670 diag::err_typecheck_call_too_many_args)
671 << 0 /*function call*/ << TheCall->getSourceRange());
675 for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
676 if (TheCall->getArg(i)->isTypeDependent() ||
677 TheCall->getArg(i)->isValueDependent())
680 llvm::APSInt Result(32);
681 if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context))
682 return ExprError(Diag(TheCall->getLocStart(),
683 diag::err_shufflevector_nonconstant_argument)
684 << TheCall->getArg(i)->getSourceRange());
686 if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
687 return ExprError(Diag(TheCall->getLocStart(),
688 diag::err_shufflevector_argument_too_large)
689 << TheCall->getArg(i)->getSourceRange());
692 llvm::SmallVector<Expr*, 32> exprs;
694 for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
695 exprs.push_back(TheCall->getArg(i));
696 TheCall->setArg(i, 0);
699 return Owned(new (Context) ShuffleVectorExpr(Context, exprs.begin(),
700 exprs.size(), exprs[0]->getType(),
701 TheCall->getCallee()->getLocStart(),
702 TheCall->getRParenLoc()));
705 /// SemaBuiltinPrefetch - Handle __builtin_prefetch.
706 // This is declared to take (const void*, ...) and can take two
707 // optional constant int args.
708 bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
709 unsigned NumArgs = TheCall->getNumArgs();
712 return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_many_args)
713 << 0 /*function call*/ << TheCall->getSourceRange();
715 // Argument 0 is checked for us and the remaining arguments must be
716 // constant integers.
717 for (unsigned i = 1; i != NumArgs; ++i) {
718 Expr *Arg = TheCall->getArg(i);
719 if (Arg->isTypeDependent())
722 if (!Arg->getType()->isIntegralType())
723 return Diag(TheCall->getLocStart(), diag::err_prefetch_invalid_arg_type)
724 << Arg->getSourceRange();
726 ImpCastExprToType(Arg, Context.IntTy, CastExpr::CK_IntegralCast);
727 TheCall->setArg(i, Arg);
729 if (Arg->isValueDependent())
733 if (!Arg->isIntegerConstantExpr(Result, Context))
734 return Diag(TheCall->getLocStart(), diag::err_prefetch_invalid_arg_ice)
735 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
737 // FIXME: gcc issues a warning and rewrites these to 0. These
738 // seems especially odd for the third argument since the default
741 if (Result.getLimitedValue() > 1)
742 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
743 << "0" << "1" << Arg->getSourceRange();
745 if (Result.getLimitedValue() > 3)
746 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
747 << "0" << "3" << Arg->getSourceRange();
754 /// SemaBuiltinEHReturnDataRegNo - Handle __builtin_eh_return_data_regno, the
755 /// operand must be an integer constant.
756 bool Sema::SemaBuiltinEHReturnDataRegNo(CallExpr *TheCall) {
758 if (!TheCall->getArg(0)->isIntegerConstantExpr(Result, Context))
759 return Diag(TheCall->getLocStart(), diag::err_expr_not_ice)
760 << TheCall->getArg(0)->getSourceRange();
766 /// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
767 /// int type). This simply type checks that type is one of the defined
769 // For compatability check 0-3, llvm only handles 0 and 2.
770 bool Sema::SemaBuiltinObjectSize(CallExpr *TheCall) {
771 Expr *Arg = TheCall->getArg(1);
772 if (Arg->isTypeDependent())
775 QualType ArgType = Arg->getType();
776 const BuiltinType *BT = ArgType->getAs<BuiltinType>();
777 llvm::APSInt Result(32);
778 if (!BT || BT->getKind() != BuiltinType::Int)
779 return Diag(TheCall->getLocStart(), diag::err_object_size_invalid_argument)
780 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
782 if (Arg->isValueDependent())
785 if (!Arg->isIntegerConstantExpr(Result, Context)) {
786 return Diag(TheCall->getLocStart(), diag::err_object_size_invalid_argument)
787 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
790 if (Result.getSExtValue() < 0 || Result.getSExtValue() > 3) {
791 return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
792 << "0" << "3" << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
798 /// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
799 /// This checks that val is a constant 1.
800 bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
801 Expr *Arg = TheCall->getArg(1);
802 if (Arg->isTypeDependent() || Arg->isValueDependent())
805 llvm::APSInt Result(32);
806 if (!Arg->isIntegerConstantExpr(Result, Context) || Result != 1)
807 return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
808 << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
813 // Handle i > 1 ? "x" : "y", recursivelly
814 bool Sema::SemaCheckStringLiteral(const Expr *E, const CallExpr *TheCall,
816 unsigned format_idx, unsigned firstDataArg) {
817 if (E->isTypeDependent() || E->isValueDependent())
820 switch (E->getStmtClass()) {
821 case Stmt::ConditionalOperatorClass: {
822 const ConditionalOperator *C = cast<ConditionalOperator>(E);
823 return SemaCheckStringLiteral(C->getTrueExpr(), TheCall,
824 HasVAListArg, format_idx, firstDataArg)
825 && SemaCheckStringLiteral(C->getRHS(), TheCall,
826 HasVAListArg, format_idx, firstDataArg);
829 case Stmt::ImplicitCastExprClass: {
830 const ImplicitCastExpr *Expr = cast<ImplicitCastExpr>(E);
831 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
832 format_idx, firstDataArg);
835 case Stmt::ParenExprClass: {
836 const ParenExpr *Expr = cast<ParenExpr>(E);
837 return SemaCheckStringLiteral(Expr->getSubExpr(), TheCall, HasVAListArg,
838 format_idx, firstDataArg);
841 case Stmt::DeclRefExprClass: {
842 const DeclRefExpr *DR = cast<DeclRefExpr>(E);
844 // As an exception, do not flag errors for variables binding to
845 // const string literals.
846 if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
847 bool isConstant = false;
848 QualType T = DR->getType();
850 if (const ArrayType *AT = Context.getAsArrayType(T)) {
851 isConstant = AT->getElementType().isConstant(Context);
852 } else if (const PointerType *PT = T->getAs<PointerType>()) {
853 isConstant = T.isConstant(Context) &&
854 PT->getPointeeType().isConstant(Context);
858 if (const Expr *Init = VD->getAnyInitializer())
859 return SemaCheckStringLiteral(Init, TheCall,
860 HasVAListArg, format_idx, firstDataArg);
863 // For vprintf* functions (i.e., HasVAListArg==true), we add a
864 // special check to see if the format string is a function parameter
865 // of the function calling the printf function. If the function
866 // has an attribute indicating it is a printf-like function, then we
867 // should suppress warnings concerning non-literals being used in a call
868 // to a vprintf function. For example:
871 // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
873 // va_start(ap, fmt);
874 // vprintf(fmt, ap); // Do NOT emit a warning about "fmt".
878 // FIXME: We don't have full attribute support yet, so just check to see
879 // if the argument is a DeclRefExpr that references a parameter. We'll
880 // add proper support for checking the attribute later.
882 if (isa<ParmVarDecl>(VD))
889 case Stmt::CallExprClass: {
890 const CallExpr *CE = cast<CallExpr>(E);
891 if (const ImplicitCastExpr *ICE
892 = dyn_cast<ImplicitCastExpr>(CE->getCallee())) {
893 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ICE->getSubExpr())) {
894 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(DRE->getDecl())) {
895 if (const FormatArgAttr *FA = FD->getAttr<FormatArgAttr>()) {
896 unsigned ArgIndex = FA->getFormatIdx();
897 const Expr *Arg = CE->getArg(ArgIndex - 1);
899 return SemaCheckStringLiteral(Arg, TheCall, HasVAListArg,
900 format_idx, firstDataArg);
908 case Stmt::ObjCStringLiteralClass:
909 case Stmt::StringLiteralClass: {
910 const StringLiteral *StrE = NULL;
912 if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
913 StrE = ObjCFExpr->getString();
915 StrE = cast<StringLiteral>(E);
918 CheckPrintfString(StrE, E, TheCall, HasVAListArg, format_idx,
932 Sema::CheckNonNullArguments(const NonNullAttr *NonNull,
933 const CallExpr *TheCall) {
934 for (NonNullAttr::iterator i = NonNull->begin(), e = NonNull->end();
936 const Expr *ArgExpr = TheCall->getArg(*i);
937 if (ArgExpr->isNullPointerConstant(Context,
938 Expr::NPC_ValueDependentIsNotNull))
939 Diag(TheCall->getCallee()->getLocStart(), diag::warn_null_arg)
940 << ArgExpr->getSourceRange();
944 /// CheckPrintfArguments - Check calls to printf (and similar functions) for
945 /// correct use of format strings.
947 /// HasVAListArg - A predicate indicating whether the printf-like
948 /// function is passed an explicit va_arg argument (e.g., vprintf)
950 /// format_idx - The index into Args for the format string.
952 /// Improper format strings to functions in the printf family can be
953 /// the source of bizarre bugs and very serious security holes. A
954 /// good source of information is available in the following paper
955 /// (which includes additional references):
957 /// FormatGuard: Automatic Protection From printf Format String
958 /// Vulnerabilities, Proceedings of the 10th USENIX Security Symposium, 2001.
961 /// Functionality implemented:
963 /// We can statically check the following properties for string
964 /// literal format strings for non v.*printf functions (where the
965 /// arguments are passed directly):
967 /// (1) Are the number of format conversions equal to the number of
970 /// (2) Does each format conversion correctly match the type of the
971 /// corresponding data argument?
973 /// Moreover, for all printf functions we can:
975 /// (3) Check for a missing format string (when not caught by type checking).
977 /// (4) Check for no-operation flags; e.g. using "#" with format
978 /// conversion 'c' (TODO)
980 /// (5) Check the use of '%n', a major source of security holes.
982 /// (6) Check for malformed format conversions that don't specify anything.
984 /// (7) Check for empty format strings. e.g: printf("");
986 /// (8) Check that the format string is a wide literal.
988 /// All of these checks can be done by parsing the format string.
991 Sema::CheckPrintfArguments(const CallExpr *TheCall, bool HasVAListArg,
992 unsigned format_idx, unsigned firstDataArg) {
993 const Expr *Fn = TheCall->getCallee();
995 // The way the format attribute works in GCC, the implicit this argument
996 // of member functions is counted. However, it doesn't appear in our own
997 // lists, so decrement format_idx in that case.
998 if (isa<CXXMemberCallExpr>(TheCall)) {
999 // Catch a format attribute mistakenly referring to the object argument.
1000 if (format_idx == 0)
1003 if(firstDataArg != 0)
1007 // CHECK: printf-like function is called with no format string.
1008 if (format_idx >= TheCall->getNumArgs()) {
1009 Diag(TheCall->getRParenLoc(), diag::warn_printf_missing_format_string)
1010 << Fn->getSourceRange();
1014 const Expr *OrigFormatExpr = TheCall->getArg(format_idx)->IgnoreParenCasts();
1016 // CHECK: format string is not a string literal.
1018 // Dynamically generated format strings are difficult to
1019 // automatically vet at compile time. Requiring that format strings
1020 // are string literals: (1) permits the checking of format strings by
1021 // the compiler and thereby (2) can practically remove the source of
1022 // many format string exploits.
1024 // Format string can be either ObjC string (e.g. @"%d") or
1025 // C string (e.g. "%d")
1026 // ObjC string uses the same format specifiers as C string, so we can use
1027 // the same format string checking logic for both ObjC and C strings.
1028 if (SemaCheckStringLiteral(OrigFormatExpr, TheCall, HasVAListArg, format_idx,
1030 return; // Literal format string found, check done!
1032 // If there are no arguments specified, warn with -Wformat-security, otherwise
1033 // warn only with -Wformat-nonliteral.
1034 if (TheCall->getNumArgs() == format_idx+1)
1035 Diag(TheCall->getArg(format_idx)->getLocStart(),
1036 diag::warn_printf_nonliteral_noargs)
1037 << OrigFormatExpr->getSourceRange();
1039 Diag(TheCall->getArg(format_idx)->getLocStart(),
1040 diag::warn_printf_nonliteral)
1041 << OrigFormatExpr->getSourceRange();
1045 class CheckPrintfHandler : public analyze_printf::FormatStringHandler {
1047 const StringLiteral *FExpr;
1048 const Expr *OrigFormatExpr;
1049 const unsigned NumDataArgs;
1050 const bool IsObjCLiteral;
1051 const char *Beg; // Start of format string.
1052 const bool HasVAListArg;
1053 const CallExpr *TheCall;
1055 llvm::BitVector CoveredArgs;
1056 bool usesPositionalArgs;
1059 CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
1060 const Expr *origFormatExpr,
1061 unsigned numDataArgs, bool isObjCLiteral,
1062 const char *beg, bool hasVAListArg,
1063 const CallExpr *theCall, unsigned formatIdx)
1064 : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
1065 NumDataArgs(numDataArgs),
1066 IsObjCLiteral(isObjCLiteral), Beg(beg),
1067 HasVAListArg(hasVAListArg),
1068 TheCall(theCall), FormatIdx(formatIdx),
1069 usesPositionalArgs(false), atFirstArg(true) {
1070 CoveredArgs.resize(numDataArgs);
1071 CoveredArgs.reset();
1074 void DoneProcessing();
1076 void HandleIncompleteFormatSpecifier(const char *startSpecifier,
1077 unsigned specifierLen);
1080 HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1081 const char *startSpecifier,
1082 unsigned specifierLen);
1084 virtual void HandleInvalidPosition(const char *startSpecifier,
1085 unsigned specifierLen,
1086 analyze_printf::PositionContext p);
1088 virtual void HandleZeroPosition(const char *startPos, unsigned posLen);
1090 void HandleNullChar(const char *nullCharacter);
1092 bool HandleFormatSpecifier(const analyze_printf::FormatSpecifier &FS,
1093 const char *startSpecifier,
1094 unsigned specifierLen);
1096 SourceRange getFormatStringRange();
1097 SourceRange getFormatSpecifierRange(const char *startSpecifier,
1098 unsigned specifierLen);
1099 SourceLocation getLocationOfByte(const char *x);
1101 bool HandleAmount(const analyze_printf::OptionalAmount &Amt, unsigned k,
1102 const char *startSpecifier, unsigned specifierLen);
1103 void HandleFlags(const analyze_printf::FormatSpecifier &FS,
1104 llvm::StringRef flag, llvm::StringRef cspec,
1105 const char *startSpecifier, unsigned specifierLen);
1107 const Expr *getDataArg(unsigned i) const;
1111 SourceRange CheckPrintfHandler::getFormatStringRange() {
1112 return OrigFormatExpr->getSourceRange();
1115 SourceRange CheckPrintfHandler::
1116 getFormatSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
1117 return SourceRange(getLocationOfByte(startSpecifier),
1118 getLocationOfByte(startSpecifier+specifierLen-1));
1121 SourceLocation CheckPrintfHandler::getLocationOfByte(const char *x) {
1122 return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
1125 void CheckPrintfHandler::
1126 HandleIncompleteFormatSpecifier(const char *startSpecifier,
1127 unsigned specifierLen) {
1128 SourceLocation Loc = getLocationOfByte(startSpecifier);
1129 S.Diag(Loc, diag::warn_printf_incomplete_specifier)
1130 << getFormatSpecifierRange(startSpecifier, specifierLen);
1134 CheckPrintfHandler::HandleInvalidPosition(const char *startPos, unsigned posLen,
1135 analyze_printf::PositionContext p) {
1136 SourceLocation Loc = getLocationOfByte(startPos);
1137 S.Diag(Loc, diag::warn_printf_invalid_positional_specifier)
1138 << (unsigned) p << getFormatSpecifierRange(startPos, posLen);
1141 void CheckPrintfHandler::HandleZeroPosition(const char *startPos,
1143 SourceLocation Loc = getLocationOfByte(startPos);
1144 S.Diag(Loc, diag::warn_printf_zero_positional_specifier)
1145 << getFormatSpecifierRange(startPos, posLen);
1148 bool CheckPrintfHandler::
1149 HandleInvalidConversionSpecifier(const analyze_printf::FormatSpecifier &FS,
1150 const char *startSpecifier,
1151 unsigned specifierLen) {
1153 unsigned argIndex = FS.getArgIndex();
1154 bool keepGoing = true;
1155 if (argIndex < NumDataArgs) {
1156 // Consider the argument coverered, even though the specifier doesn't
1158 CoveredArgs.set(argIndex);
1161 // If argIndex exceeds the number of data arguments we
1162 // don't issue a warning because that is just a cascade of warnings (and
1163 // they may have intended '%%' anyway). We don't want to continue processing
1164 // the format string after this point, however, as we will like just get
1165 // gibberish when trying to match arguments.
1169 const analyze_printf::ConversionSpecifier &CS =
1170 FS.getConversionSpecifier();
1171 SourceLocation Loc = getLocationOfByte(CS.getStart());
1172 S.Diag(Loc, diag::warn_printf_invalid_conversion)
1173 << llvm::StringRef(CS.getStart(), CS.getLength())
1174 << getFormatSpecifierRange(startSpecifier, specifierLen);
1179 void CheckPrintfHandler::HandleNullChar(const char *nullCharacter) {
1180 // The presence of a null character is likely an error.
1181 S.Diag(getLocationOfByte(nullCharacter),
1182 diag::warn_printf_format_string_contains_null_char)
1183 << getFormatStringRange();
1186 const Expr *CheckPrintfHandler::getDataArg(unsigned i) const {
1187 return TheCall->getArg(FormatIdx + i + 1);
1192 void CheckPrintfHandler::HandleFlags(const analyze_printf::FormatSpecifier &FS,
1193 llvm::StringRef flag,
1194 llvm::StringRef cspec,
1195 const char *startSpecifier,
1196 unsigned specifierLen) {
1197 const analyze_printf::ConversionSpecifier &CS = FS.getConversionSpecifier();
1198 S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_nonsensical_flag)
1199 << flag << cspec << getFormatSpecifierRange(startSpecifier, specifierLen);
1203 CheckPrintfHandler::HandleAmount(const analyze_printf::OptionalAmount &Amt,
1204 unsigned k, const char *startSpecifier,
1205 unsigned specifierLen) {
1207 if (Amt.hasDataArgument()) {
1208 if (!HasVAListArg) {
1209 unsigned argIndex = Amt.getArgIndex();
1210 if (argIndex >= NumDataArgs) {
1211 S.Diag(getLocationOfByte(Amt.getStart()),
1212 diag::warn_printf_asterisk_missing_arg)
1213 << k << getFormatSpecifierRange(startSpecifier, specifierLen);
1214 // Don't do any more checking. We will just emit
1219 // Type check the data argument. It should be an 'int'.
1220 // Although not in conformance with C99, we also allow the argument to be
1221 // an 'unsigned int' as that is a reasonably safe case. GCC also
1222 // doesn't emit a warning for that case.
1223 CoveredArgs.set(argIndex);
1224 const Expr *Arg = getDataArg(argIndex);
1225 QualType T = Arg->getType();
1227 const analyze_printf::ArgTypeResult &ATR = Amt.getArgType(S.Context);
1228 assert(ATR.isValid());
1230 if (!ATR.matchesType(S.Context, T)) {
1231 S.Diag(getLocationOfByte(Amt.getStart()),
1232 diag::warn_printf_asterisk_wrong_type)
1234 << ATR.getRepresentativeType(S.Context) << T
1235 << getFormatSpecifierRange(startSpecifier, specifierLen)
1236 << Arg->getSourceRange();
1237 // Don't do any more checking. We will just emit
1247 CheckPrintfHandler::HandleFormatSpecifier(const analyze_printf::FormatSpecifier
1249 const char *startSpecifier,
1250 unsigned specifierLen) {
1252 using namespace analyze_printf;
1253 const ConversionSpecifier &CS = FS.getConversionSpecifier();
1257 usesPositionalArgs = FS.usesPositionalArg();
1259 else if (usesPositionalArgs != FS.usesPositionalArg()) {
1260 // Cannot mix-and-match positional and non-positional arguments.
1261 S.Diag(getLocationOfByte(CS.getStart()),
1262 diag::warn_printf_mix_positional_nonpositional_args)
1263 << getFormatSpecifierRange(startSpecifier, specifierLen);
1267 // First check if the field width, precision, and conversion specifier
1268 // have matching data arguments.
1269 if (!HandleAmount(FS.getFieldWidth(), /* field width */ 0,
1270 startSpecifier, specifierLen)) {
1274 if (!HandleAmount(FS.getPrecision(), /* precision */ 1,
1275 startSpecifier, specifierLen)) {
1279 if (!CS.consumesDataArgument()) {
1280 // FIXME: Technically specifying a precision or field width here
1281 // makes no sense. Worth issuing a warning at some point.
1285 // Consume the argument.
1286 unsigned argIndex = FS.getArgIndex();
1287 if (argIndex < NumDataArgs) {
1288 // The check to see if the argIndex is valid will come later.
1289 // We set the bit here because we may exit early from this
1290 // function if we encounter some other error.
1291 CoveredArgs.set(argIndex);
1294 // Check for using an Objective-C specific conversion specifier
1295 // in a non-ObjC literal.
1296 if (!IsObjCLiteral && CS.isObjCArg()) {
1297 return HandleInvalidConversionSpecifier(FS, startSpecifier, specifierLen);
1300 // Are we using '%n'? Issue a warning about this being
1301 // a possible security issue.
1302 if (CS.getKind() == ConversionSpecifier::OutIntPtrArg) {
1303 S.Diag(getLocationOfByte(CS.getStart()), diag::warn_printf_write_back)
1304 << getFormatSpecifierRange(startSpecifier, specifierLen);
1305 // Continue checking the other format specifiers.
1309 if (CS.getKind() == ConversionSpecifier::VoidPtrArg) {
1310 if (FS.getPrecision().getHowSpecified() != OptionalAmount::NotSpecified)
1311 S.Diag(getLocationOfByte(CS.getStart()),
1312 diag::warn_printf_nonsensical_precision)
1313 << CS.getCharacters()
1314 << getFormatSpecifierRange(startSpecifier, specifierLen);
1316 if (CS.getKind() == ConversionSpecifier::VoidPtrArg ||
1317 CS.getKind() == ConversionSpecifier::CStrArg) {
1318 // FIXME: Instead of using "0", "+", etc., eventually get them from
1319 // the FormatSpecifier.
1320 if (FS.hasLeadingZeros())
1321 HandleFlags(FS, "0", CS.getCharacters(), startSpecifier, specifierLen);
1322 if (FS.hasPlusPrefix())
1323 HandleFlags(FS, "+", CS.getCharacters(), startSpecifier, specifierLen);
1324 if (FS.hasSpacePrefix())
1325 HandleFlags(FS, " ", CS.getCharacters(), startSpecifier, specifierLen);
1328 // The remaining checks depend on the data arguments.
1332 if (argIndex >= NumDataArgs) {
1333 S.Diag(getLocationOfByte(CS.getStart()),
1334 diag::warn_printf_insufficient_data_args)
1335 << getFormatSpecifierRange(startSpecifier, specifierLen);
1336 // Don't do any more checking.
1340 // Now type check the data expression that matches the
1341 // format specifier.
1342 const Expr *Ex = getDataArg(argIndex);
1343 const analyze_printf::ArgTypeResult &ATR = FS.getArgType(S.Context);
1344 if (ATR.isValid() && !ATR.matchesType(S.Context, Ex->getType())) {
1345 // Check if we didn't match because of an implicit cast from a 'char'
1346 // or 'short' to an 'int'. This is done because printf is a varargs
1348 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Ex))
1349 if (ICE->getType() == S.Context.IntTy)
1350 if (ATR.matchesType(S.Context, ICE->getSubExpr()->getType()))
1353 S.Diag(getLocationOfByte(CS.getStart()),
1354 diag::warn_printf_conversion_argument_type_mismatch)
1355 << ATR.getRepresentativeType(S.Context) << Ex->getType()
1356 << getFormatSpecifierRange(startSpecifier, specifierLen)
1357 << Ex->getSourceRange();
1363 void CheckPrintfHandler::DoneProcessing() {
1364 // Does the number of data arguments exceed the number of
1365 // format conversions in the format string?
1366 if (!HasVAListArg) {
1367 // Find any arguments that weren't covered.
1369 signed notCoveredArg = CoveredArgs.find_first();
1370 if (notCoveredArg >= 0) {
1371 assert((unsigned)notCoveredArg < NumDataArgs);
1372 S.Diag(getDataArg((unsigned) notCoveredArg)->getLocStart(),
1373 diag::warn_printf_data_arg_not_used)
1374 << getFormatStringRange();
1379 void Sema::CheckPrintfString(const StringLiteral *FExpr,
1380 const Expr *OrigFormatExpr,
1381 const CallExpr *TheCall, bool HasVAListArg,
1382 unsigned format_idx, unsigned firstDataArg) {
1384 // CHECK: is the format string a wide literal?
1385 if (FExpr->isWide()) {
1386 Diag(FExpr->getLocStart(),
1387 diag::warn_printf_format_string_is_wide_literal)
1388 << OrigFormatExpr->getSourceRange();
1392 // Str - The format string. NOTE: this is NOT null-terminated!
1393 const char *Str = FExpr->getStrData();
1395 // CHECK: empty format string?
1396 unsigned StrLen = FExpr->getByteLength();
1399 Diag(FExpr->getLocStart(), diag::warn_printf_empty_format_string)
1400 << OrigFormatExpr->getSourceRange();
1404 CheckPrintfHandler H(*this, FExpr, OrigFormatExpr,
1405 TheCall->getNumArgs() - firstDataArg,
1406 isa<ObjCStringLiteral>(OrigFormatExpr), Str,
1407 HasVAListArg, TheCall, format_idx);
1409 if (!analyze_printf::ParseFormatString(H, Str, Str + StrLen))
1413 //===--- CHECK: Return Address of Stack Variable --------------------------===//
1415 static DeclRefExpr* EvalVal(Expr *E);
1416 static DeclRefExpr* EvalAddr(Expr* E);
1418 /// CheckReturnStackAddr - Check if a return statement returns the address
1419 /// of a stack variable.
1421 Sema::CheckReturnStackAddr(Expr *RetValExp, QualType lhsType,
1422 SourceLocation ReturnLoc) {
1424 // Perform checking for returned stack addresses.
1425 if (lhsType->isPointerType() || lhsType->isBlockPointerType()) {
1426 if (DeclRefExpr *DR = EvalAddr(RetValExp))
1427 Diag(DR->getLocStart(), diag::warn_ret_stack_addr)
1428 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
1430 // Skip over implicit cast expressions when checking for block expressions.
1431 RetValExp = RetValExp->IgnoreParenCasts();
1433 if (BlockExpr *C = dyn_cast<BlockExpr>(RetValExp))
1434 if (C->hasBlockDeclRefExprs())
1435 Diag(C->getLocStart(), diag::err_ret_local_block)
1436 << C->getSourceRange();
1438 if (AddrLabelExpr *ALE = dyn_cast<AddrLabelExpr>(RetValExp))
1439 Diag(ALE->getLocStart(), diag::warn_ret_addr_label)
1440 << ALE->getSourceRange();
1442 } else if (lhsType->isReferenceType()) {
1443 // Perform checking for stack values returned by reference.
1444 // Check for a reference to the stack
1445 if (DeclRefExpr *DR = EvalVal(RetValExp))
1446 Diag(DR->getLocStart(), diag::warn_ret_stack_ref)
1447 << DR->getDecl()->getDeclName() << RetValExp->getSourceRange();
1451 /// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
1452 /// check if the expression in a return statement evaluates to an address
1453 /// to a location on the stack. The recursion is used to traverse the
1454 /// AST of the return expression, with recursion backtracking when we
1455 /// encounter a subexpression that (1) clearly does not lead to the address
1456 /// of a stack variable or (2) is something we cannot determine leads to
1457 /// the address of a stack variable based on such local checking.
1459 /// EvalAddr processes expressions that are pointers that are used as
1460 /// references (and not L-values). EvalVal handles all other values.
1461 /// At the base case of the recursion is a check for a DeclRefExpr* in
1462 /// the refers to a stack variable.
1464 /// This implementation handles:
1466 /// * pointer-to-pointer casts
1467 /// * implicit conversions from array references to pointers
1468 /// * taking the address of fields
1469 /// * arbitrary interplay between "&" and "*" operators
1470 /// * pointer arithmetic from an address of a stack variable
1471 /// * taking the address of an array element where the array is on the stack
1472 static DeclRefExpr* EvalAddr(Expr *E) {
1473 // We should only be called for evaluating pointer expressions.
1474 assert((E->getType()->isAnyPointerType() ||
1475 E->getType()->isBlockPointerType() ||
1476 E->getType()->isObjCQualifiedIdType()) &&
1477 "EvalAddr only works on pointers");
1479 // Our "symbolic interpreter" is just a dispatch off the currently
1480 // viewed AST node. We then recursively traverse the AST by calling
1481 // EvalAddr and EvalVal appropriately.
1482 switch (E->getStmtClass()) {
1483 case Stmt::ParenExprClass:
1484 // Ignore parentheses.
1485 return EvalAddr(cast<ParenExpr>(E)->getSubExpr());
1487 case Stmt::UnaryOperatorClass: {
1488 // The only unary operator that make sense to handle here
1489 // is AddrOf. All others don't make sense as pointers.
1490 UnaryOperator *U = cast<UnaryOperator>(E);
1492 if (U->getOpcode() == UnaryOperator::AddrOf)
1493 return EvalVal(U->getSubExpr());
1498 case Stmt::BinaryOperatorClass: {
1499 // Handle pointer arithmetic. All other binary operators are not valid
1501 BinaryOperator *B = cast<BinaryOperator>(E);
1502 BinaryOperator::Opcode op = B->getOpcode();
1504 if (op != BinaryOperator::Add && op != BinaryOperator::Sub)
1507 Expr *Base = B->getLHS();
1509 // Determine which argument is the real pointer base. It could be
1510 // the RHS argument instead of the LHS.
1511 if (!Base->getType()->isPointerType()) Base = B->getRHS();
1513 assert (Base->getType()->isPointerType());
1514 return EvalAddr(Base);
1517 // For conditional operators we need to see if either the LHS or RHS are
1518 // valid DeclRefExpr*s. If one of them is valid, we return it.
1519 case Stmt::ConditionalOperatorClass: {
1520 ConditionalOperator *C = cast<ConditionalOperator>(E);
1522 // Handle the GNU extension for missing LHS.
1523 if (Expr *lhsExpr = C->getLHS())
1524 if (DeclRefExpr* LHS = EvalAddr(lhsExpr))
1527 return EvalAddr(C->getRHS());
1530 // For casts, we need to handle conversions from arrays to
1531 // pointer values, and pointer-to-pointer conversions.
1532 case Stmt::ImplicitCastExprClass:
1533 case Stmt::CStyleCastExprClass:
1534 case Stmt::CXXFunctionalCastExprClass: {
1535 Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
1536 QualType T = SubExpr->getType();
1538 if (SubExpr->getType()->isPointerType() ||
1539 SubExpr->getType()->isBlockPointerType() ||
1540 SubExpr->getType()->isObjCQualifiedIdType())
1541 return EvalAddr(SubExpr);
1542 else if (T->isArrayType())
1543 return EvalVal(SubExpr);
1548 // C++ casts. For dynamic casts, static casts, and const casts, we
1549 // are always converting from a pointer-to-pointer, so we just blow
1550 // through the cast. In the case the dynamic cast doesn't fail (and
1551 // return NULL), we take the conservative route and report cases
1552 // where we return the address of a stack variable. For Reinterpre
1553 // FIXME: The comment about is wrong; we're not always converting
1554 // from pointer to pointer. I'm guessing that this code should also
1555 // handle references to objects.
1556 case Stmt::CXXStaticCastExprClass:
1557 case Stmt::CXXDynamicCastExprClass:
1558 case Stmt::CXXConstCastExprClass:
1559 case Stmt::CXXReinterpretCastExprClass: {
1560 Expr *S = cast<CXXNamedCastExpr>(E)->getSubExpr();
1561 if (S->getType()->isPointerType() || S->getType()->isBlockPointerType())
1567 // Everything else: we simply don't reason about them.
1574 /// EvalVal - This function is complements EvalAddr in the mutual recursion.
1575 /// See the comments for EvalAddr for more details.
1576 static DeclRefExpr* EvalVal(Expr *E) {
1578 // We should only be called for evaluating non-pointer expressions, or
1579 // expressions with a pointer type that are not used as references but instead
1580 // are l-values (e.g., DeclRefExpr with a pointer type).
1582 // Our "symbolic interpreter" is just a dispatch off the currently
1583 // viewed AST node. We then recursively traverse the AST by calling
1584 // EvalAddr and EvalVal appropriately.
1585 switch (E->getStmtClass()) {
1586 case Stmt::DeclRefExprClass: {
1587 // DeclRefExpr: the base case. When we hit a DeclRefExpr we are looking
1588 // at code that refers to a variable's name. We check if it has local
1589 // storage within the function, and if so, return the expression.
1590 DeclRefExpr *DR = cast<DeclRefExpr>(E);
1592 if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
1593 if (V->hasLocalStorage() && !V->getType()->isReferenceType()) return DR;
1598 case Stmt::ParenExprClass:
1599 // Ignore parentheses.
1600 return EvalVal(cast<ParenExpr>(E)->getSubExpr());
1602 case Stmt::UnaryOperatorClass: {
1603 // The only unary operator that make sense to handle here
1604 // is Deref. All others don't resolve to a "name." This includes
1605 // handling all sorts of rvalues passed to a unary operator.
1606 UnaryOperator *U = cast<UnaryOperator>(E);
1608 if (U->getOpcode() == UnaryOperator::Deref)
1609 return EvalAddr(U->getSubExpr());
1614 case Stmt::ArraySubscriptExprClass: {
1615 // Array subscripts are potential references to data on the stack. We
1616 // retrieve the DeclRefExpr* for the array variable if it indeed
1617 // has local storage.
1618 return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase());
1621 case Stmt::ConditionalOperatorClass: {
1622 // For conditional operators we need to see if either the LHS or RHS are
1623 // non-NULL DeclRefExpr's. If one is non-NULL, we return it.
1624 ConditionalOperator *C = cast<ConditionalOperator>(E);
1626 // Handle the GNU extension for missing LHS.
1627 if (Expr *lhsExpr = C->getLHS())
1628 if (DeclRefExpr *LHS = EvalVal(lhsExpr))
1631 return EvalVal(C->getRHS());
1634 // Accesses to members are potential references to data on the stack.
1635 case Stmt::MemberExprClass: {
1636 MemberExpr *M = cast<MemberExpr>(E);
1638 // Check for indirect access. We only want direct field accesses.
1640 return EvalVal(M->getBase());
1645 // Everything else: we simply don't reason about them.
1651 //===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
1653 /// Check for comparisons of floating point operands using != and ==.
1654 /// Issue a warning if these are no self-comparisons, as they are not likely
1655 /// to do what the programmer intended.
1656 void Sema::CheckFloatComparison(SourceLocation loc, Expr* lex, Expr *rex) {
1657 bool EmitWarning = true;
1659 Expr* LeftExprSansParen = lex->IgnoreParens();
1660 Expr* RightExprSansParen = rex->IgnoreParens();
1662 // Special case: check for x == x (which is OK).
1663 // Do not emit warnings for such cases.
1664 if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
1665 if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
1666 if (DRL->getDecl() == DRR->getDecl())
1667 EmitWarning = false;
1670 // Special case: check for comparisons against literals that can be exactly
1671 // represented by APFloat. In such cases, do not emit a warning. This
1672 // is a heuristic: often comparison against such literals are used to
1673 // detect if a value in a variable has not changed. This clearly can
1674 // lead to false negatives.
1676 if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
1678 EmitWarning = false;
1680 if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen)){
1682 EmitWarning = false;
1686 // Check for comparisons with builtin types.
1688 if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
1689 if (CL->isBuiltinCall(Context))
1690 EmitWarning = false;
1693 if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
1694 if (CR->isBuiltinCall(Context))
1695 EmitWarning = false;
1697 // Emit the diagnostic.
1699 Diag(loc, diag::warn_floatingpoint_eq)
1700 << lex->getSourceRange() << rex->getSourceRange();
1703 //===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
1704 //===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
1708 /// Structure recording the 'active' range of an integer-valued
1711 /// The number of bits active in the int.
1714 /// True if the int is known not to have negative values.
1718 IntRange(unsigned Width, bool NonNegative)
1719 : Width(Width), NonNegative(NonNegative)
1722 // Returns the range of the bool type.
1723 static IntRange forBoolType() {
1724 return IntRange(1, true);
1727 // Returns the range of an integral type.
1728 static IntRange forType(ASTContext &C, QualType T) {
1729 return forCanonicalType(C, T->getCanonicalTypeInternal().getTypePtr());
1732 // Returns the range of an integeral type based on its canonical
1734 static IntRange forCanonicalType(ASTContext &C, const Type *T) {
1735 assert(T->isCanonicalUnqualified());
1737 if (const VectorType *VT = dyn_cast<VectorType>(T))
1738 T = VT->getElementType().getTypePtr();
1739 if (const ComplexType *CT = dyn_cast<ComplexType>(T))
1740 T = CT->getElementType().getTypePtr();
1741 if (const EnumType *ET = dyn_cast<EnumType>(T))
1742 T = ET->getDecl()->getIntegerType().getTypePtr();
1744 const BuiltinType *BT = cast<BuiltinType>(T);
1745 assert(BT->isInteger());
1747 return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
1750 // Returns the supremum of two ranges: i.e. their conservative merge.
1751 static IntRange join(IntRange L, IntRange R) {
1752 return IntRange(std::max(L.Width, R.Width),
1753 L.NonNegative && R.NonNegative);
1756 // Returns the infinum of two ranges: i.e. their aggressive merge.
1757 static IntRange meet(IntRange L, IntRange R) {
1758 return IntRange(std::min(L.Width, R.Width),
1759 L.NonNegative || R.NonNegative);
1763 IntRange GetValueRange(ASTContext &C, llvm::APSInt &value, unsigned MaxWidth) {
1764 if (value.isSigned() && value.isNegative())
1765 return IntRange(value.getMinSignedBits(), false);
1767 if (value.getBitWidth() > MaxWidth)
1768 value.trunc(MaxWidth);
1770 // isNonNegative() just checks the sign bit without considering
1772 return IntRange(value.getActiveBits(), true);
1775 IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
1776 unsigned MaxWidth) {
1778 return GetValueRange(C, result.getInt(), MaxWidth);
1780 if (result.isVector()) {
1781 IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
1782 for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
1783 IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
1784 R = IntRange::join(R, El);
1789 if (result.isComplexInt()) {
1790 IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
1791 IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
1792 return IntRange::join(R, I);
1795 // This can happen with lossless casts to intptr_t of "based" lvalues.
1796 // Assume it might use arbitrary bits.
1797 // FIXME: The only reason we need to pass the type in here is to get
1798 // the sign right on this one case. It would be nice if APValue
1800 assert(result.isLValue());
1801 return IntRange(MaxWidth, Ty->isUnsignedIntegerType());
1804 /// Pseudo-evaluate the given integer expression, estimating the
1805 /// range of values it might take.
1807 /// \param MaxWidth - the width to which the value will be truncated
1808 IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
1809 E = E->IgnoreParens();
1811 // Try a full evaluation first.
1812 Expr::EvalResult result;
1813 if (E->Evaluate(result, C))
1814 return GetValueRange(C, result.Val, E->getType(), MaxWidth);
1816 // I think we only want to look through implicit casts here; if the
1817 // user has an explicit widening cast, we should treat the value as
1818 // being of the new, wider type.
1819 if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
1820 if (CE->getCastKind() == CastExpr::CK_NoOp)
1821 return GetExprRange(C, CE->getSubExpr(), MaxWidth);
1823 IntRange OutputTypeRange = IntRange::forType(C, CE->getType());
1825 bool isIntegerCast = (CE->getCastKind() == CastExpr::CK_IntegralCast);
1826 if (!isIntegerCast && CE->getCastKind() == CastExpr::CK_Unknown)
1827 isIntegerCast = CE->getSubExpr()->getType()->isIntegerType();
1829 // Assume that non-integer casts can span the full range of the type.
1831 return OutputTypeRange;
1834 = GetExprRange(C, CE->getSubExpr(),
1835 std::min(MaxWidth, OutputTypeRange.Width));
1837 // Bail out if the subexpr's range is as wide as the cast type.
1838 if (SubRange.Width >= OutputTypeRange.Width)
1839 return OutputTypeRange;
1841 // Otherwise, we take the smaller width, and we're non-negative if
1842 // either the output type or the subexpr is.
1843 return IntRange(SubRange.Width,
1844 SubRange.NonNegative || OutputTypeRange.NonNegative);
1847 if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
1848 // If we can fold the condition, just take that operand.
1850 if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
1851 return GetExprRange(C, CondResult ? CO->getTrueExpr()
1852 : CO->getFalseExpr(),
1855 // Otherwise, conservatively merge.
1856 IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
1857 IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
1858 return IntRange::join(L, R);
1861 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
1862 switch (BO->getOpcode()) {
1864 // Boolean-valued operations are single-bit and positive.
1865 case BinaryOperator::LAnd:
1866 case BinaryOperator::LOr:
1867 case BinaryOperator::LT:
1868 case BinaryOperator::GT:
1869 case BinaryOperator::LE:
1870 case BinaryOperator::GE:
1871 case BinaryOperator::EQ:
1872 case BinaryOperator::NE:
1873 return IntRange::forBoolType();
1875 // The type of these compound assignments is the type of the LHS,
1876 // so the RHS is not necessarily an integer.
1877 case BinaryOperator::MulAssign:
1878 case BinaryOperator::DivAssign:
1879 case BinaryOperator::RemAssign:
1880 case BinaryOperator::AddAssign:
1881 case BinaryOperator::SubAssign:
1882 return IntRange::forType(C, E->getType());
1884 // Operations with opaque sources are black-listed.
1885 case BinaryOperator::PtrMemD:
1886 case BinaryOperator::PtrMemI:
1887 return IntRange::forType(C, E->getType());
1889 // Bitwise-and uses the *infinum* of the two source ranges.
1890 case BinaryOperator::And:
1891 case BinaryOperator::AndAssign:
1892 return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
1893 GetExprRange(C, BO->getRHS(), MaxWidth));
1895 // Left shift gets black-listed based on a judgement call.
1896 case BinaryOperator::Shl:
1897 case BinaryOperator::ShlAssign:
1898 return IntRange::forType(C, E->getType());
1900 // Right shift by a constant can narrow its left argument.
1901 case BinaryOperator::Shr:
1902 case BinaryOperator::ShrAssign: {
1903 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1905 // If the shift amount is a positive constant, drop the width by
1908 if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
1909 shift.isNonNegative()) {
1910 unsigned zext = shift.getZExtValue();
1911 if (zext >= L.Width)
1912 L.Width = (L.NonNegative ? 0 : 1);
1920 // Comma acts as its right operand.
1921 case BinaryOperator::Comma:
1922 return GetExprRange(C, BO->getRHS(), MaxWidth);
1924 // Black-list pointer subtractions.
1925 case BinaryOperator::Sub:
1926 if (BO->getLHS()->getType()->isPointerType())
1927 return IntRange::forType(C, E->getType());
1934 // Treat every other operator as if it were closed on the
1935 // narrowest type that encompasses both operands.
1936 IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
1937 IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
1938 return IntRange::join(L, R);
1941 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
1942 switch (UO->getOpcode()) {
1943 // Boolean-valued operations are white-listed.
1944 case UnaryOperator::LNot:
1945 return IntRange::forBoolType();
1947 // Operations with opaque sources are black-listed.
1948 case UnaryOperator::Deref:
1949 case UnaryOperator::AddrOf: // should be impossible
1950 case UnaryOperator::OffsetOf:
1951 return IntRange::forType(C, E->getType());
1954 return GetExprRange(C, UO->getSubExpr(), MaxWidth);
1958 FieldDecl *BitField = E->getBitField();
1960 llvm::APSInt BitWidthAP = BitField->getBitWidth()->EvaluateAsInt(C);
1961 unsigned BitWidth = BitWidthAP.getZExtValue();
1963 return IntRange(BitWidth, BitField->getType()->isUnsignedIntegerType());
1966 return IntRange::forType(C, E->getType());
1969 /// Checks whether the given value, which currently has the given
1970 /// source semantics, has the same value when coerced through the
1971 /// target semantics.
1972 bool IsSameFloatAfterCast(const llvm::APFloat &value,
1973 const llvm::fltSemantics &Src,
1974 const llvm::fltSemantics &Tgt) {
1975 llvm::APFloat truncated = value;
1978 truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
1979 truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
1981 return truncated.bitwiseIsEqual(value);
1984 /// Checks whether the given value, which currently has the given
1985 /// source semantics, has the same value when coerced through the
1986 /// target semantics.
1988 /// The value might be a vector of floats (or a complex number).
1989 bool IsSameFloatAfterCast(const APValue &value,
1990 const llvm::fltSemantics &Src,
1991 const llvm::fltSemantics &Tgt) {
1992 if (value.isFloat())
1993 return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
1995 if (value.isVector()) {
1996 for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
1997 if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
2002 assert(value.isComplexFloat());
2003 return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
2004 IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
2007 } // end anonymous namespace
2009 /// \brief Implements -Wsign-compare.
2011 /// \param lex the left-hand expression
2012 /// \param rex the right-hand expression
2013 /// \param OpLoc the location of the joining operator
2014 /// \param Equality whether this is an "equality-like" join, which
2015 /// suppresses the warning in some cases
2016 void Sema::CheckSignCompare(Expr *lex, Expr *rex, SourceLocation OpLoc,
2017 const PartialDiagnostic &PD, bool Equality) {
2018 // Don't warn if we're in an unevaluated context.
2019 if (ExprEvalContexts.back().Context == Unevaluated)
2022 // If either expression is value-dependent, don't warn. We'll get another
2023 // chance at instantiation time.
2024 if (lex->isValueDependent() || rex->isValueDependent())
2027 QualType lt = lex->getType(), rt = rex->getType();
2029 // Only warn if both operands are integral.
2030 if (!lt->isIntegerType() || !rt->isIntegerType())
2033 // In C, the width of a bitfield determines its type, and the
2034 // declared type only contributes the signedness. This duplicates
2035 // the work that will later be done by UsualUnaryConversions.
2036 // Eventually, this check will be reorganized in a way that avoids
2037 // this duplication.
2038 if (!getLangOptions().CPlusPlus) {
2040 tmp = Context.isPromotableBitField(lex);
2041 if (!tmp.isNull()) lt = tmp;
2042 tmp = Context.isPromotableBitField(rex);
2043 if (!tmp.isNull()) rt = tmp;
2046 // The rule is that the signed operand becomes unsigned, so isolate the
2048 Expr *signedOperand = lex, *unsignedOperand = rex;
2049 QualType signedType = lt, unsignedType = rt;
2050 if (lt->isSignedIntegerType()) {
2051 if (rt->isSignedIntegerType()) return;
2053 if (!rt->isSignedIntegerType()) return;
2054 std::swap(signedOperand, unsignedOperand);
2055 std::swap(signedType, unsignedType);
2058 unsigned unsignedWidth = Context.getIntWidth(unsignedType);
2059 unsigned signedWidth = Context.getIntWidth(signedType);
2061 // If the unsigned type is strictly smaller than the signed type,
2062 // then (1) the result type will be signed and (2) the unsigned
2063 // value will fit fully within the signed type, and thus the result
2064 // of the comparison will be exact.
2065 if (signedWidth > unsignedWidth)
2068 // Otherwise, calculate the effective ranges.
2069 IntRange signedRange = GetExprRange(Context, signedOperand, signedWidth);
2070 IntRange unsignedRange = GetExprRange(Context, unsignedOperand, unsignedWidth);
2072 // We should never be unable to prove that the unsigned operand is
2074 assert(unsignedRange.NonNegative && "unsigned range includes negative?");
2076 // If the signed operand is non-negative, then the signed->unsigned
2077 // conversion won't change it.
2078 if (signedRange.NonNegative)
2081 // For (in)equality comparisons, if the unsigned operand is a
2082 // constant which cannot collide with a overflowed signed operand,
2083 // then reinterpreting the signed operand as unsigned will not
2084 // change the result of the comparison.
2085 if (Equality && unsignedRange.Width < unsignedWidth)
2089 << lt << rt << lex->getSourceRange() << rex->getSourceRange();
2092 /// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
2093 static void DiagnoseImpCast(Sema &S, Expr *E, QualType T, unsigned diag) {
2094 S.Diag(E->getExprLoc(), diag) << E->getType() << T << E->getSourceRange();
2097 /// Implements -Wconversion.
2098 void Sema::CheckImplicitConversion(Expr *E, QualType T) {
2099 // Don't diagnose in unevaluated contexts.
2100 if (ExprEvalContexts.back().Context == Sema::Unevaluated)
2103 // Don't diagnose for value-dependent expressions.
2104 if (E->isValueDependent())
2107 const Type *Source = Context.getCanonicalType(E->getType()).getTypePtr();
2108 const Type *Target = Context.getCanonicalType(T).getTypePtr();
2110 // Never diagnose implicit casts to bool.
2111 if (Target->isSpecificBuiltinType(BuiltinType::Bool))
2114 // Strip vector types.
2115 if (isa<VectorType>(Source)) {
2116 if (!isa<VectorType>(Target))
2117 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_vector_scalar);
2119 Source = cast<VectorType>(Source)->getElementType().getTypePtr();
2120 Target = cast<VectorType>(Target)->getElementType().getTypePtr();
2123 // Strip complex types.
2124 if (isa<ComplexType>(Source)) {
2125 if (!isa<ComplexType>(Target))
2126 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_complex_scalar);
2128 Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
2129 Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
2132 const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
2133 const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
2135 // If the source is floating point...
2136 if (SourceBT && SourceBT->isFloatingPoint()) {
2137 // ...and the target is floating point...
2138 if (TargetBT && TargetBT->isFloatingPoint()) {
2139 // ...then warn if we're dropping FP rank.
2141 // Builtin FP kinds are ordered by increasing FP rank.
2142 if (SourceBT->getKind() > TargetBT->getKind()) {
2143 // Don't warn about float constants that are precisely
2144 // representable in the target type.
2145 Expr::EvalResult result;
2146 if (E->Evaluate(result, Context)) {
2147 // Value might be a float, a float vector, or a float complex.
2148 if (IsSameFloatAfterCast(result.Val,
2149 Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
2150 Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
2154 DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_precision);
2159 // If the target is integral, always warn.
2160 if ((TargetBT && TargetBT->isInteger()))
2161 // TODO: don't warn for integer values?
2162 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_float_integer);
2167 if (!Source->isIntegerType() || !Target->isIntegerType())
2170 IntRange SourceRange = GetExprRange(Context, E, Context.getIntWidth(E->getType()));
2171 IntRange TargetRange = IntRange::forCanonicalType(Context, Target);
2173 // FIXME: also signed<->unsigned?
2175 if (SourceRange.Width > TargetRange.Width) {
2176 // People want to build with -Wshorten-64-to-32 and not -Wconversion
2177 // and by god we'll let them.
2178 if (SourceRange.Width == 64 && TargetRange.Width == 32)
2179 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_64_32);
2180 return DiagnoseImpCast(*this, E, T, diag::warn_impcast_integer_precision);
2189 class UnreachableCodeHandler : public reachable_code::Callback {
2192 UnreachableCodeHandler(Sema *s) : S(*s) {}
2194 void HandleUnreachable(SourceLocation L, SourceRange R1, SourceRange R2) {
2195 S.Diag(L, diag::warn_unreachable) << R1 << R2;
2200 /// CheckUnreachable - Check for unreachable code.
2201 void Sema::CheckUnreachable(AnalysisContext &AC) {
2202 // We avoid checking when there are errors, as the CFG won't faithfully match
2204 if (getDiagnostics().hasErrorOccurred() ||
2205 Diags.getDiagnosticLevel(diag::warn_unreachable) == Diagnostic::Ignored)
2208 UnreachableCodeHandler UC(this);
2209 reachable_code::FindUnreachableCode(AC, UC);
2212 /// CheckFallThrough - Check that we don't fall off the end of a
2213 /// Statement that should return a value.
2215 /// \returns AlwaysFallThrough iff we always fall off the end of the statement,
2216 /// MaybeFallThrough iff we might or might not fall off the end,
2217 /// NeverFallThroughOrReturn iff we never fall off the end of the statement or
2218 /// return. We assume NeverFallThrough iff we never fall off the end of the
2219 /// statement but we may return. We assume that functions not marked noreturn
2221 Sema::ControlFlowKind Sema::CheckFallThrough(AnalysisContext &AC) {
2222 CFG *cfg = AC.getCFG();
2224 // FIXME: This should be NeverFallThrough
2225 return NeverFallThroughOrReturn;
2227 // The CFG leaves in dead things, and we don't want the dead code paths to
2228 // confuse us, so we mark all live things first.
2229 std::queue<CFGBlock*> workq;
2230 llvm::BitVector live(cfg->getNumBlockIDs());
2231 unsigned count = reachable_code::ScanReachableFromBlock(cfg->getEntry(),
2234 bool AddEHEdges = AC.getAddEHEdges();
2235 if (!AddEHEdges && count != cfg->getNumBlockIDs())
2236 // When there are things remaining dead, and we didn't add EH edges
2237 // from CallExprs to the catch clauses, we have to go back and
2238 // mark them as live.
2239 for (CFG::iterator I = cfg->begin(), E = cfg->end(); I != E; ++I) {
2241 if (!live[b.getBlockID()]) {
2242 if (b.pred_begin() == b.pred_end()) {
2243 if (b.getTerminator() && isa<CXXTryStmt>(b.getTerminator()))
2244 // When not adding EH edges from calls, catch clauses
2245 // can otherwise seem dead. Avoid noting them as dead.
2246 count += reachable_code::ScanReachableFromBlock(b, live);
2252 // Now we know what is live, we check the live precessors of the exit block
2253 // and look for fall through paths, being careful to ignore normal returns,
2254 // and exceptional paths.
2255 bool HasLiveReturn = false;
2256 bool HasFakeEdge = false;
2257 bool HasPlainEdge = false;
2258 bool HasAbnormalEdge = false;
2259 for (CFGBlock::pred_iterator I=cfg->getExit().pred_begin(),
2260 E = cfg->getExit().pred_end();
2264 if (!live[B.getBlockID()])
2266 if (B.size() == 0) {
2267 if (B.getTerminator() && isa<CXXTryStmt>(B.getTerminator())) {
2268 HasAbnormalEdge = true;
2272 // A labeled empty statement, or the entry block...
2273 HasPlainEdge = true;
2276 Stmt *S = B[B.size()-1];
2277 if (isa<ReturnStmt>(S)) {
2278 HasLiveReturn = true;
2281 if (isa<ObjCAtThrowStmt>(S)) {
2285 if (isa<CXXThrowExpr>(S)) {
2289 if (const AsmStmt *AS = dyn_cast<AsmStmt>(S)) {
2290 if (AS->isMSAsm()) {
2292 HasLiveReturn = true;
2296 if (isa<CXXTryStmt>(S)) {
2297 HasAbnormalEdge = true;
2301 bool NoReturnEdge = false;
2302 if (CallExpr *C = dyn_cast<CallExpr>(S)) {
2303 if (B.succ_begin()[0] != &cfg->getExit()) {
2304 HasAbnormalEdge = true;
2307 Expr *CEE = C->getCallee()->IgnoreParenCasts();
2308 if (CEE->getType().getNoReturnAttr()) {
2309 NoReturnEdge = true;
2311 } else if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(CEE)) {
2312 ValueDecl *VD = DRE->getDecl();
2313 if (VD->hasAttr<NoReturnAttr>()) {
2314 NoReturnEdge = true;
2319 // FIXME: Add noreturn message sends.
2320 if (NoReturnEdge == false)
2321 HasPlainEdge = true;
2323 if (!HasPlainEdge) {
2325 return NeverFallThrough;
2326 return NeverFallThroughOrReturn;
2328 if (HasAbnormalEdge || HasFakeEdge || HasLiveReturn)
2329 return MaybeFallThrough;
2330 // This says AlwaysFallThrough for calls to functions that are not marked
2331 // noreturn, that don't return. If people would like this warning to be more
2332 // accurate, such functions should be marked as noreturn.
2333 return AlwaysFallThrough;
2336 /// CheckFallThroughForFunctionDef - Check that we don't fall off the end of a
2337 /// function that should return a value. Check that we don't fall off the end
2338 /// of a noreturn function. We assume that functions and blocks not marked
2339 /// noreturn will return.
2340 void Sema::CheckFallThroughForFunctionDef(Decl *D, Stmt *Body,
2341 AnalysisContext &AC) {
2342 // FIXME: Would be nice if we had a better way to control cascading errors,
2343 // but for now, avoid them. The problem is that when Parse sees:
2344 // int foo() { return a; }
2345 // The return is eaten and the Sema code sees just:
2347 // which this code would then warn about.
2348 if (getDiagnostics().hasErrorOccurred())
2351 bool ReturnsVoid = false;
2352 bool HasNoReturn = false;
2354 if (FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
2355 // For function templates, class templates and member function templates
2356 // we'll do the analysis at instantiation time.
2357 if (FD->isDependentContext())
2360 ReturnsVoid = FD->getResultType()->isVoidType();
2361 HasNoReturn = FD->hasAttr<NoReturnAttr>() ||
2362 FD->getType()->getAs<FunctionType>()->getNoReturnAttr();
2364 } else if (ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2365 ReturnsVoid = MD->getResultType()->isVoidType();
2366 HasNoReturn = MD->hasAttr<NoReturnAttr>();
2369 // Short circuit for compilation speed.
2370 if ((Diags.getDiagnosticLevel(diag::warn_maybe_falloff_nonvoid_function)
2371 == Diagnostic::Ignored || ReturnsVoid)
2372 && (Diags.getDiagnosticLevel(diag::warn_noreturn_function_has_return_expr)
2373 == Diagnostic::Ignored || !HasNoReturn)
2374 && (Diags.getDiagnosticLevel(diag::warn_suggest_noreturn_block)
2375 == Diagnostic::Ignored || !ReturnsVoid))
2377 // FIXME: Function try block
2378 if (CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) {
2379 switch (CheckFallThrough(AC)) {
2380 case MaybeFallThrough:
2382 Diag(Compound->getRBracLoc(), diag::warn_falloff_noreturn_function);
2383 else if (!ReturnsVoid)
2384 Diag(Compound->getRBracLoc(),diag::warn_maybe_falloff_nonvoid_function);
2386 case AlwaysFallThrough:
2388 Diag(Compound->getRBracLoc(), diag::warn_falloff_noreturn_function);
2389 else if (!ReturnsVoid)
2390 Diag(Compound->getRBracLoc(), diag::warn_falloff_nonvoid_function);
2392 case NeverFallThroughOrReturn:
2393 if (ReturnsVoid && !HasNoReturn)
2394 Diag(Compound->getLBracLoc(), diag::warn_suggest_noreturn_function);
2396 case NeverFallThrough:
2402 /// CheckFallThroughForBlock - Check that we don't fall off the end of a block
2403 /// that should return a value. Check that we don't fall off the end of a
2404 /// noreturn block. We assume that functions and blocks not marked noreturn
2406 void Sema::CheckFallThroughForBlock(QualType BlockTy, Stmt *Body,
2407 AnalysisContext &AC) {
2408 // FIXME: Would be nice if we had a better way to control cascading errors,
2409 // but for now, avoid them. The problem is that when Parse sees:
2410 // int foo() { return a; }
2411 // The return is eaten and the Sema code sees just:
2413 // which this code would then warn about.
2414 if (getDiagnostics().hasErrorOccurred())
2416 bool ReturnsVoid = false;
2417 bool HasNoReturn = false;
2418 if (const FunctionType *FT =BlockTy->getPointeeType()->getAs<FunctionType>()){
2419 if (FT->getResultType()->isVoidType())
2421 if (FT->getNoReturnAttr())
2425 // Short circuit for compilation speed.
2428 && (Diags.getDiagnosticLevel(diag::warn_suggest_noreturn_block)
2429 == Diagnostic::Ignored || !ReturnsVoid))
2431 // FIXME: Funtion try block
2432 if (CompoundStmt *Compound = dyn_cast<CompoundStmt>(Body)) {
2433 switch (CheckFallThrough(AC)) {
2434 case MaybeFallThrough:
2436 Diag(Compound->getRBracLoc(), diag::err_noreturn_block_has_return_expr);
2437 else if (!ReturnsVoid)
2438 Diag(Compound->getRBracLoc(), diag::err_maybe_falloff_nonvoid_block);
2440 case AlwaysFallThrough:
2442 Diag(Compound->getRBracLoc(), diag::err_noreturn_block_has_return_expr);
2443 else if (!ReturnsVoid)
2444 Diag(Compound->getRBracLoc(), diag::err_falloff_nonvoid_block);
2446 case NeverFallThroughOrReturn:
2448 Diag(Compound->getLBracLoc(), diag::warn_suggest_noreturn_block);
2450 case NeverFallThrough:
2456 /// CheckParmsForFunctionDef - Check that the parameters of the given
2457 /// function are appropriate for the definition of a function. This
2458 /// takes care of any checks that cannot be performed on the
2459 /// declaration itself, e.g., that the types of each of the function
2460 /// parameters are complete.
2461 bool Sema::CheckParmsForFunctionDef(FunctionDecl *FD) {
2462 bool HasInvalidParm = false;
2463 for (unsigned p = 0, NumParams = FD->getNumParams(); p < NumParams; ++p) {
2464 ParmVarDecl *Param = FD->getParamDecl(p);
2466 // C99 6.7.5.3p4: the parameters in a parameter type list in a
2467 // function declarator that is part of a function definition of
2468 // that function shall not have incomplete type.
2470 // This is also C++ [dcl.fct]p6.
2471 if (!Param->isInvalidDecl() &&
2472 RequireCompleteType(Param->getLocation(), Param->getType(),
2473 diag::err_typecheck_decl_incomplete_type)) {
2474 Param->setInvalidDecl();
2475 HasInvalidParm = true;
2478 // C99 6.9.1p5: If the declarator includes a parameter type list, the
2479 // declaration of each parameter shall include an identifier.
2480 if (Param->getIdentifier() == 0 &&
2481 !Param->isImplicit() &&
2482 !getLangOptions().CPlusPlus)
2483 Diag(Param->getLocation(), diag::err_parameter_name_omitted);
2486 // If the function declarator is not part of a definition of that
2487 // function, parameters may have incomplete type and may use the [*]
2488 // notation in their sequences of declarator specifiers to specify
2489 // variable length array types.
2490 QualType PType = Param->getOriginalType();
2491 if (const ArrayType *AT = Context.getAsArrayType(PType)) {
2492 if (AT->getSizeModifier() == ArrayType::Star) {
2493 // FIXME: This diagnosic should point the the '[*]' if source-location
2494 // information is added for it.
2495 Diag(Param->getLocation(), diag::err_array_star_in_function_definition);
2499 if (getLangOptions().CPlusPlus)
2500 if (const RecordType *RT = Param->getType()->getAs<RecordType>())
2501 FinalizeVarWithDestructor(Param, RT);
2504 return HasInvalidParm;