[clang][dataflow] Add transfer functions for initializers

[sgatev]

Summary

This is part of the implementation of the dataflow analysis framework.
See "[RFC] A dataflow analysis framework for Clang AST" on cfe-dev.

[ymandel]

clang/lib/Analysis/FlowSensitive/Transfer.cpp

171

why None? Is the idea that if the expression generates a reference, we want to get the pointer value, not the pointee?
So, in the example below, the value set for field y will (correctly) be the same pointer stored in field x?

struct A {
  int &x;
  int &y = x;
};

[sgatev]

clang/lib/Analysis/FlowSensitive/Transfer.cpp

171

Right, y gets assigned the same ReferenceValue as x in this case.

clang/lib/Analysis/FlowSensitive/ControlFlowContext.cpp

 
 llvm::Expected<ControlFlowContext>
 ControlFlowContext::build(const Decl *D, Stmt *S, ASTContext *C) {
   CFG::BuildOptions Options;
   Options.PruneTriviallyFalseEdges = false;
   Options.AddImplicitDtors = true;
   Options.AddTemporaryDtors = true;
   Options.AddInitializers = true;
+  Options.AddCXXDefaultInitExprInCtors = true;
 
   // Ensure that all sub-expressions in basic blocks are evaluated.
   Options.setAllAlwaysAdd();
 
   auto Cfg = CFG::buildCFG(D, S, C, Options);
   if (Cfg == nullptr)
     return llvm::createStringError(
         std::make_error_code(std::errc::invalid_argument),

clang/lib/Analysis/FlowSensitive/Transfer.cpp

void VisitMemberExpr(const MemberExpr *S) {
     } else {
       auto &Loc = Env.createStorageLocation(*S);
       Env.setStorageLocation(*S, Loc);
       Env.setValue(
           Loc, Env.takeOwnership(std::make_unique<ReferenceValue>(MemberLoc)));
     }
   }
 
+  void VisitCXXDefaultInitExpr(const CXXDefaultInitExpr *S) {
+    const Expr *InitExpr = S->getExpr();
+    assert(InitExpr != nullptr);
+
+    Value *InitExprVal = Env.getValue(*InitExpr, SkipPast::None);
+    if (InitExprVal == nullptr)
+      return;
+
+    const FieldDecl *Field = S->getField();
+    assert(Field != nullptr);
+
+    auto &ThisLoc =
+        *cast<AggregateStorageLocation>(Env.getThisPointeeStorageLocation());
+    auto &FieldLoc = ThisLoc.getChild(*Field);
+    Env.setValue(FieldLoc, *InitExprVal);
+  }
+
   // FIXME: Add support for:
   // - CallExpr
   // - CXXBindTemporaryExpr
   // - CXXBoolLiteralExpr
   // - CXXConstructExpr
   // - CXXFunctionalCastExpr
   // - CXXOperatorCallExpr
   // - CXXStaticCastExpr

clang/lib/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.cpp

 //===- TypeErasedDataflowAnalysis.cpp -------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines type-erased base types and functions for building dataflow
 //  analyses that run over Control-Flow Graphs (CFGs).
 //
 //===----------------------------------------------------------------------===//
 
+#include <memory>
 #include <utility>
 #include <vector>
 
+#include "clang/AST/DeclCXX.h"
 #include "clang/Analysis/Analyses/PostOrderCFGView.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/DataflowWorklist.h"
 #include "clang/Analysis/FlowSensitive/Transfer.h"
 #include "clang/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.h"
+#include "clang/Analysis/FlowSensitive/Value.h"
 #include "llvm/ADT/None.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/Support/raw_ostream.h"
 
 namespace clang {
 namespace dataflow {
 
 /// Computes the input state for a given basic block by joining the output
if (!MaybeState.hasValue()) {
     // FIXME: Consider passing `Block` to `Analysis.typeErasedInitialElement()`
     // to enable building analyses like computation of dominators that
     // initialize the state of each basic block differently.
     MaybeState.emplace(Analysis.typeErasedInitialElement(), InitEnv);
   }
   return *MaybeState;
 }
 
+/// Transfers `State` by evaluating `CfgStmt` in the context of `Analysis`.
+/// `HandleTransferredStmt` (if provided) will be applied to `CfgStmt`, after it
+/// is evaluated.
+static void
+transferCFGStmt(const CFGStmt &CfgStmt, TypeErasedDataflowAnalysis &Analysis,
+                TypeErasedDataflowAnalysisState &State,
+                std::function<void(const CFGStmt &,
+                                   const TypeErasedDataflowAnalysisState &)>
+                    HandleTransferredStmt) {
+  const Stmt *S = CfgStmt.getStmt();
+  assert(S != nullptr);
+
+  transfer(*S, State.Env);
+  Analysis.transferTypeErased(S, State.Lattice, State.Env);
+
+  if (HandleTransferredStmt != nullptr)
+    HandleTransferredStmt(CfgStmt, State);
+}
+
+/// Transfers `State` by evaluating `CfgInit`.
+static void transferCFGInitializer(const CFGInitializer &CfgInit,
+                                   TypeErasedDataflowAnalysisState &State) {
+  const auto &ThisLoc = *cast<AggregateStorageLocation>(
+      State.Env.getThisPointeeStorageLocation());
+
+  const CXXCtorInitializer *Initializer = CfgInit.getInitializer();
+  assert(Initializer != nullptr);
+
+  auto *InitStmt = Initializer->getInit();
+  assert(InitStmt != nullptr);
+
+  auto *InitStmtLoc =
+      State.Env.getStorageLocation(*InitStmt, SkipPast::Reference);
+  if (InitStmtLoc == nullptr)
+    return;
+
+  auto *InitStmtVal = State.Env.getValue(*InitStmtLoc);
+  if (InitStmtVal == nullptr)
+    return;
+
+  const FieldDecl *Member = Initializer->getMember();
+  assert(Member != nullptr);
+
+  if (Member->getType()->isReferenceType()) {
+    auto &MemberLoc = ThisLoc.getChild(*Member);
+    State.Env.setValue(MemberLoc,
+                       State.Env.takeOwnership(
+                           std::make_unique<ReferenceValue>(*InitStmtLoc)));
+  } else {
+    auto &MemberLoc = ThisLoc.getChild(*Member);
+    State.Env.setValue(MemberLoc, *InitStmtVal);
+  }
+}
+
 TypeErasedDataflowAnalysisState transferBlock(
     const ControlFlowContext &CFCtx,
     std::vector<llvm::Optional<TypeErasedDataflowAnalysisState>> &BlockStates,
     const CFGBlock &Block, const Environment &InitEnv,
     TypeErasedDataflowAnalysis &Analysis,
     std::function<void(const CFGStmt &,
                        const TypeErasedDataflowAnalysisState &)>
         HandleTransferredStmt) {
   TypeErasedDataflowAnalysisState State =
       computeBlockInputState(CFCtx, BlockStates, Block, InitEnv, Analysis);
   for (const CFGElement &Element : Block) {
+    switch (Element.getKind()) {
+    case CFGElement::Statement:
+      transferCFGStmt(*Element.getAs<CFGStmt>(), Analysis, State,
+                      HandleTransferredStmt);
+      break;
+    case CFGElement::Initializer:
+      transferCFGInitializer(*Element.getAs<CFGInitializer>(), State);
+      break;
+    default:
       // FIXME: Evaluate other kinds of `CFGElement`.
-    const llvm::Optional<CFGStmt> CfgStmt = Element.getAs<CFGStmt>();
-    if (!CfgStmt.hasValue())
-      continue;
-
-    const Stmt *S = CfgStmt.getValue().getStmt();
-    assert(S != nullptr);
-
-    transfer(*S, State.Env);
-    Analysis.transferTypeErased(S, State.Lattice, State.Env);
-
-    if (HandleTransferredStmt != nullptr)
-      HandleTransferredStmt(CfgStmt.getValue(), State);
+      break;
+    }
   }
   return State;
 }
 
 std::vector<llvm::Optional<TypeErasedDataflowAnalysisState>>
 runTypeErasedDataflowAnalysis(const ControlFlowContext &CFCtx,
                               TypeErasedDataflowAnalysis &Analysis,
                               const Environment &InitEnv) {

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

runDataflow(
         EXPECT_EQ(Env.getValue(*BazLoc), BazVal);
 
         const ValueDecl *QuuxDecl = findValueDecl(ASTCtx, "Quux");
         ASSERT_THAT(QuuxDecl, NotNull());
         EXPECT_EQ(Env.getValue(*QuuxDecl, SkipPast::None), BazVal);
       });
 }
 
+TEST_F(TransferTest, ConstructorInitializer) {
+  std::string Code = R"(
+    struct target {
+      int Bar;
+
+      target(int Foo) : Bar(Foo) {
+        int Qux = Bar;
+        // [[p]]
+      }
+    };
+  )";
+  runDataflow(Code,
+              [](llvm::ArrayRef<
+                     std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                     Results,
+                 ASTContext &ASTCtx) {
+                ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+                const Environment &Env = Results[0].second.Env;
+
+                const auto *ThisLoc = dyn_cast<AggregateStorageLocation>(
+                    Env.getThisPointeeStorageLocation());
+                ASSERT_THAT(ThisLoc, NotNull());
+
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+                ASSERT_THAT(FooDecl, NotNull());
+
+                const auto *FooVal =
+                    cast<IntegerValue>(Env.getValue(*FooDecl, SkipPast::None));
+
+                const ValueDecl *QuxDecl = findValueDecl(ASTCtx, "Qux");
+                ASSERT_THAT(QuxDecl, NotNull());
+                EXPECT_EQ(Env.getValue(*QuxDecl, SkipPast::None), FooVal);
+              });
+}
+
+TEST_F(TransferTest, DefaultInitializer) {
+  std::string Code = R"(
+    struct target {
+      int Bar;
+      int Baz = Bar;
+
+      target(int Foo) : Bar(Foo) {
+        int Qux = Baz;
+        // [[p]]
+      }
+    };
+  )";
+  runDataflow(Code,
+              [](llvm::ArrayRef<
+                     std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                     Results,
+                 ASTContext &ASTCtx) {
+                ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+                const Environment &Env = Results[0].second.Env;
+
+                const auto *ThisLoc = dyn_cast<AggregateStorageLocation>(
+                    Env.getThisPointeeStorageLocation());
+                ASSERT_THAT(ThisLoc, NotNull());
+
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+                ASSERT_THAT(FooDecl, NotNull());
+
+                const auto *FooVal =
+                    cast<IntegerValue>(Env.getValue(*FooDecl, SkipPast::None));
+
+                const ValueDecl *QuxDecl = findValueDecl(ASTCtx, "Qux");
+                ASSERT_THAT(QuxDecl, NotNull());
+                EXPECT_EQ(Env.getValue(*QuxDecl, SkipPast::None), FooVal);
+              });
+}
+
+TEST_F(TransferTest, DefaultInitializerReference) {
+  std::string Code = R"(
+    struct target {
+      int &Bar;
+      int &Baz = Bar;
+
+      target(int &Foo) : Bar(Foo) {
+        int &Qux = Baz;
+        // [[p]]
+      }
+    };
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const auto *ThisLoc = dyn_cast<AggregateStorageLocation>(
+            Env.getThisPointeeStorageLocation());
+        ASSERT_THAT(ThisLoc, NotNull());
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const auto *FooVal =
+            cast<ReferenceValue>(Env.getValue(*FooDecl, SkipPast::None));
+
+        const ValueDecl *QuxDecl = findValueDecl(ASTCtx, "Qux");
+        ASSERT_THAT(QuxDecl, NotNull());
+
+        const auto *QuxVal =
+            cast<ReferenceValue>(Env.getValue(*QuxDecl, SkipPast::None));
+        EXPECT_EQ(&QuxVal->getPointeeLoc(), &FooVal->getPointeeLoc());
+      });
+}
+
 } // namespace