Fix nullability checking of top-level functions

[chrisbazley]

Summary

The existing nullability checker is so limited
when applied to top-level functions that a casual
observer might assume it doesn't work at all:

void test1(int *_Nullable x)
{

*x = 5; // no warning!

}

Added a NullabilityChecker::checkBeginFunction method
to honour any _Nullable annotation of parameters in
a top-level call.

[chrisbazley]

Please refer to https://discourse.llvm.org/t/rfc-optional-a-type-qualifier-to-indicate-pointer-nullability/ and https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3089.pdf for the wider context of this commit.

clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

 // to suppress warnings would be to add asserts or guarding if statements to the
 // code. In addition to the nullability propagation this checker also uses some
 // heuristics to suppress potential false positives.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 
+#include "clang/Analysis/AnyCall.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Support/Path.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
enum class ErrorKind : int {
   NilReturnedToNonnull,
   NullableAssignedToNonnull,
   NullableReturnedToNonnull,
   NullableDereferenced,
   NullablePassedToNonnull
 };
 
 class NullabilityChecker
-    : public Checker<check::Bind, check::PreCall, check::PreStmt<ReturnStmt>,
-                     check::PostCall, check::PostStmt<ExplicitCastExpr>,
-                     check::PostObjCMessage, check::DeadSymbols, eval::Assume,
-                     check::Location, check::Event<ImplicitNullDerefEvent>> {
+    : public Checker<check::Bind, check::BeginFunction, check::PreCall,
+                     check::PreStmt<ReturnStmt>, check::PostCall,
+                     check::PostStmt<ExplicitCastExpr>, check::PostObjCMessage,
+                     check::DeadSymbols, eval::Assume, check::Location,
+                     check::Event<ImplicitNullDerefEvent>> {
 
 public:
   // If true, the checker will not diagnose nullabilility issues for calls
   // to system headers. This option is motivated by the observation that large
   // projects may have many nullability warnings. These projects may
   // find warnings about nullability annotations that they have explicitly
   // added themselves higher priority to fix than warnings on calls to system
   // libraries.
   bool NoDiagnoseCallsToSystemHeaders = false;
 
   void checkBind(SVal L, SVal V, const Stmt *S, CheckerContext &C) const;
   void checkPostStmt(const ExplicitCastExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
   void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
   void checkEvent(ImplicitNullDerefEvent Event) const;
   void checkLocation(SVal Location, bool IsLoad, const Stmt *S,
                      CheckerContext &C) const;
   ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond,
                              bool Assumption) const;
+  void checkBeginFunction(CheckerContext &C) const;
 
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
                   const char *Sep) const override;
 
   enum CheckKind {
     CK_NullPassedToNonnull,
     CK_NullReturnedFromNonnull,
     CK_NullableDereferenced,
void NullabilityChecker::printState(raw_ostream &Out, ProgramStateRef State,
 
   for (NullabilityMapTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
     Out << I->first << " : ";
     I->second.print(Out);
     Out << NL;
   }
 }
 
+/// We want to trust developer annotations and consider all 'nullable'
+/// parameters as potentially null. Each marked parameter will get a
+/// corresponding constraint.
+///
+/// \code
+///   void foo(int *_Nullable x) {
+///     // . . .
+///     *x = 42;    // we want to consider this as an error...
+///     // . . .
+///   }
+/// \endcode
+void NullabilityChecker::checkBeginFunction(CheckerContext &Context) const {
+  // Planned assumption makes sense only for top-level functions.
+  if (!Context.inTopFrame())
+    return;
+
+  const LocationContext *LocContext = Context.getLocationContext();
+
+  const Decl *FD = LocContext->getDecl();
+  // AnyCall helps us here to avoid checking for FunctionDecl and ObjCMethodDecl
+  // separately and aggregates interfaces of these classes.
+  auto AbstractCall = AnyCall::forDecl(FD);
+  if (!AbstractCall)
+    return;
+
+  ProgramStateRef State = Context.getState();
+
+  for (const ParmVarDecl *Parameter : AbstractCall->parameters()) {
+    Nullability RequiredNullability =
+        getNullabilityAnnotation(Parameter->getType());
+
+    if (RequiredNullability != Nullability::Nullable)
+      continue;
+
+    Loc ParameterLoc = State->getLValue(Parameter, LocContext);
+    // We never consider top-level function parameters undefined.
+    auto StoredVal =
+        State->getSVal(ParameterLoc).castAs<DefinedOrUnknownSVal>();
+
+    const MemRegion *Region = getTrackRegion(StoredVal);
+    if (!Region)
+      continue;
+
+    const Stmt *NullabilitySource = Parameter->getBody();
+    if (ProgramStateRef NewState = State->set<NullabilityMap>(
+            Region, NullabilityState(RequiredNullability, NullabilitySource))) {
+      State = NewState;
+    }
+  }
+
+  Context.addTransition(State);
+}
+
 void ento::registerNullabilityBase(CheckerManager &mgr) {
   mgr.registerChecker<NullabilityChecker>();
 }
 
 bool ento::shouldRegisterNullabilityBase(const CheckerManager &mgr) {
   return true;
 }