This is an archive of the discontinued LLVM Phabricator instance.

Differential D38867

[Analyzer] Assume that CFBooleanRef const globals are non-null
ClosedPublic

Authored by george.karpenkov on Oct 12 2017, 5:18 PM.

Details

Reviewers
dcoughlin
zaks.anna
NoQ
Commits
rG9a542f7553f1: [Analyzer] Assume that CFBooleanRef const globals are non-null
rC315655: [Analyzer] Assume that CFBooleanRef const globals are non-null
rL315655: [Analyzer] Assume that CFBooleanRef const globals are non-null
Summary

Fixes rdar://33851032

Diff Detail

Repository
rL LLVM

Event Timeline

george.karpenkov created this revision.Oct 12 2017, 5:18 PM
Herald added subscribers: szepet, xazax.hun, mgorny. · View Herald TranscriptOct 12 2017, 5:18 PM
dcoughlin accepted this revision.Oct 12 2017, 5:30 PM

This looks good to me. I do have a naming suggestion. The multiple plurals in "NonnullGlobalsConstantsChecker" sounds odd to my ears. What do you think about "NonnullGlobalConstantsChecker" instead?

This revision is now accepted and ready to land.Oct 12 2017, 5:30 PM
george.karpenkov updated this revision to Diff 118870.Oct 12 2017, 5:46 PM

Adhered to naming suggestion.

Closed by commit rL315655: [Analyzer] Assume that CFBooleanRef const globals are non-null (authored by george.karpenkov). · Explain WhyOct 12 2017, 5:52 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents

PathSize
cfe/
trunk/
include/
clang/
StaticAnalyzer/
Checkers/
2 lines
lib/
StaticAnalyzer/
Checkers/
2 lines
140 lines
135 lines
test/
Analysis/
103 lines
90 lines

Diff 118872

cfe/trunk/include/clang/StaticAnalyzer/Checkers/Checkers.td

Show First 20 Lines • Show All 126 Lines • ▼ Show 20 Lines
def StackAddrEscapeChecker : Checker<"StackAddressEscape">, def StackAddrEscapeChecker : Checker<"StackAddressEscape">,
HelpText<"Check that addresses to stack memory do not escape the function">, HelpText<"Check that addresses to stack memory do not escape the function">,
DescFile<"StackAddrEscapeChecker.cpp">; DescFile<"StackAddrEscapeChecker.cpp">;
def DynamicTypePropagation : Checker<"DynamicTypePropagation">, def DynamicTypePropagation : Checker<"DynamicTypePropagation">,
HelpText<"Generate dynamic type information">, HelpText<"Generate dynamic type information">,
DescFile<"DynamicTypePropagation.cpp">; DescFile<"DynamicTypePropagation.cpp">;
def NonnullStringConstantsChecker: Checker<"NonnilStringConstants">, def NonnullGlobalConstantsChecker: Checker<"NonnilStringConstants">,
HelpText<"Assume that const string-like globals are non-null">, HelpText<"Assume that const string-like globals are non-null">,
DescFile<"NonilStringConstantsChecker.cpp">; DescFile<"NonilStringConstantsChecker.cpp">;
} // end "core" } // end "core"
let ParentPackage = CoreAlpha in { let ParentPackage = CoreAlpha in {
def BoolAssignmentChecker : Checker<"BoolAssignment">, def BoolAssignmentChecker : Checker<"BoolAssignment">,
▲ Show 20 Lines • Show All 638 Lines • Show Last 20 Lines

cfe/trunk/lib/StaticAnalyzer/Checkers/CMakeLists.txt

Show First 20 Lines • Show All 51 Lines • ▼ Show 20 Linesadd_clang_library(clangStaticAnalyzerCheckers
MisusedMovedObjectChecker.cpp MisusedMovedObjectChecker.cpp
MPI-Checker/MPIBugReporter.cpp MPI-Checker/MPIBugReporter.cpp
MPI-Checker/MPIChecker.cpp MPI-Checker/MPIChecker.cpp
MPI-Checker/MPIFunctionClassifier.cpp MPI-Checker/MPIFunctionClassifier.cpp
NSAutoreleasePoolChecker.cpp NSAutoreleasePoolChecker.cpp
NSErrorChecker.cpp NSErrorChecker.cpp
NoReturnFunctionChecker.cpp NoReturnFunctionChecker.cpp
NonNullParamChecker.cpp NonNullParamChecker.cpp
NonnullStringConstantsChecker.cpp NonnullGlobalConstantsChecker.cpp
NullabilityChecker.cpp NullabilityChecker.cpp
NumberObjectConversionChecker.cpp NumberObjectConversionChecker.cpp
ObjCAtSyncChecker.cpp ObjCAtSyncChecker.cpp
ObjCContainersASTChecker.cpp ObjCContainersASTChecker.cpp
ObjCContainersChecker.cpp ObjCContainersChecker.cpp
ObjCMissingSuperCallChecker.cpp ObjCMissingSuperCallChecker.cpp
ObjCPropertyChecker.cpp ObjCPropertyChecker.cpp
ObjCSelfInitChecker.cpp ObjCSelfInitChecker.cpp
Show All 39 Lines

cfe/trunk/lib/StaticAnalyzer/Checkers/NonnullGlobalConstantsChecker.cpp

//==- NonnullGlobalConstantsChecker.cpp ---------------------------*- C++ -*--//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This checker adds an assumption that constant globals of certain types* are
// non-null, as otherwise they generally do not convey any useful information.
// The assumption is useful, as many framework use e. g. global const strings,
// and the analyzer might not be able to infer the global value if the
// definition is in a separate translation unit.
// The following types (and their typedef aliases) are considered to be
// non-null:
// - `char* const`
// - `const CFStringRef` from CoreFoundation
// - `NSString* const` from Foundation
// - `CFBooleanRef` from Foundation
//
//===----------------------------------------------------------------------===//
#include "ClangSACheckers.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
using namespace clang;
using namespace ento;
namespace {
class NonnullGlobalConstantsChecker : public Checker<check::Location> {
mutable IdentifierInfo *NSStringII = nullptr;
mutable IdentifierInfo *CFStringRefII = nullptr;
mutable IdentifierInfo *CFBooleanRefII = nullptr;
public:
NonnullGlobalConstantsChecker() {}
void checkLocation(SVal l, bool isLoad, const Stmt *S,
CheckerContext &C) const;
private:
void initIdentifierInfo(ASTContext &Ctx) const;
bool isGlobalConstString(SVal V) const;
bool isNonnullType(QualType Ty) const;
};
} // namespace
/// Lazily initialize cache for required identifier informations.
void NonnullGlobalConstantsChecker::initIdentifierInfo(ASTContext &Ctx) const {
if (NSStringII)
return;
NSStringII = &Ctx.Idents.get("NSString");
CFStringRefII = &Ctx.Idents.get("CFStringRef");
CFBooleanRefII = &Ctx.Idents.get("CFBooleanRef");
}
/// Add an assumption that const string-like globals are non-null.
void NonnullGlobalConstantsChecker::checkLocation(SVal location, bool isLoad,
const Stmt *S,
CheckerContext &C) const {
initIdentifierInfo(C.getASTContext());
if (!isLoad || !location.isValid())
return;
ProgramStateRef State = C.getState();
SVal V = State->getSVal(location.castAs<Loc>());
if (isGlobalConstString(location)) {
Optional<DefinedOrUnknownSVal> Constr = V.getAs<DefinedOrUnknownSVal>();
if (Constr) {
// Assume that the variable is non-null.
ProgramStateRef OutputState = State->assume(*Constr, true);
C.addTransition(OutputState);
}
}
}
/// \param V loaded lvalue.
/// \return whether {@code val} is a string-like const global.
bool NonnullGlobalConstantsChecker::isGlobalConstString(SVal V) const {
Optional<loc::MemRegionVal> RegionVal = V.getAs<loc::MemRegionVal>();
if (!RegionVal)
return false;
auto *Region = dyn_cast<VarRegion>(RegionVal->getAsRegion());
if (!Region)
return false;
const VarDecl *Decl = Region->getDecl();
if (!Decl->hasGlobalStorage())
return false;
QualType Ty = Decl->getType();
bool HasConst = Ty.isConstQualified();
if (isNonnullType(Ty) && HasConst)
return true;
// Look through the typedefs.
while (auto *T = dyn_cast<TypedefType>(Ty)) {
Ty = T->getDecl()->getUnderlyingType();
// It is sufficient for any intermediate typedef
// to be classified const.
HasConst = HasConst || Ty.isConstQualified();
if (isNonnullType(Ty) && HasConst)
return true;
}
return false;
}
/// \return whether {@code type} is extremely unlikely to be null
bool NonnullGlobalConstantsChecker::isNonnullType(QualType Ty) const {
if (Ty->isPointerType() && Ty->getPointeeType()->isCharType())
return true;
if (auto *T = dyn_cast<ObjCObjectPointerType>(Ty)) {
return T->getInterfaceDecl() &&
T->getInterfaceDecl()->getIdentifier() == NSStringII;
} else if (auto *T = dyn_cast<TypedefType>(Ty)) {
IdentifierInfo* II = T->getDecl()->getIdentifier();
return II == CFStringRefII || II == CFBooleanRefII;
}
return false;
}
void ento::registerNonnullGlobalConstantsChecker(CheckerManager &Mgr) {
Mgr.registerChecker<NonnullGlobalConstantsChecker>();
}

cfe/trunk/lib/StaticAnalyzer/Checkers/NonnullStringConstantsChecker.cpp

//==- NonnullStringConstantsChecker.cpp ---------------------------*- C++ -*--//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This checker adds an assumption that constant string-like globals are
// non-null, as otherwise they generally do not convey any useful information.
// The assumption is useful, as many framework use such global const strings,
// and the analyzer might not be able to infer the global value if the
// definition is in a separate translation unit.
// The following types (and their typedef aliases) are considered string-like:
// - `char* const`
// - `const CFStringRef` from CoreFoundation
// - `NSString* const` from Foundation
//
//===----------------------------------------------------------------------===//
#include "ClangSACheckers.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
using namespace clang;
using namespace ento;
namespace {
class NonnullStringConstantsChecker : public Checker<check::Location> {
mutable IdentifierInfo *NSStringII = nullptr;
mutable IdentifierInfo *CFStringRefII = nullptr;
public:
NonnullStringConstantsChecker() {}
void checkLocation(SVal l, bool isLoad, const Stmt *S,
CheckerContext &C) const;
private:
void initIdentifierInfo(ASTContext &Ctx) const;
bool isGlobalConstString(SVal V) const;
bool isStringlike(QualType Ty) const;
};
} // namespace
/// Lazily initialize cache for required identifier informations.
void NonnullStringConstantsChecker::initIdentifierInfo(ASTContext &Ctx) const {
if (NSStringII)
return;
NSStringII = &Ctx.Idents.get("NSString");
CFStringRefII = &Ctx.Idents.get("CFStringRef");
}
/// Add an assumption that const string-like globals are non-null.
void NonnullStringConstantsChecker::checkLocation(SVal location, bool isLoad,
const Stmt *S,
CheckerContext &C) const {
initIdentifierInfo(C.getASTContext());
if (!isLoad || !location.isValid())
return;
ProgramStateRef State = C.getState();
SVal V = State->getSVal(location.castAs<Loc>());
if (isGlobalConstString(location)) {
Optional<DefinedOrUnknownSVal> Constr = V.getAs<DefinedOrUnknownSVal>();
if (Constr) {
// Assume that the variable is non-null.
ProgramStateRef OutputState = State->assume(*Constr, true);
C.addTransition(OutputState);
}
}
}
/// \param V loaded lvalue.
/// \return whether {@code val} is a string-like const global.
bool NonnullStringConstantsChecker::isGlobalConstString(SVal V) const {
Optional<loc::MemRegionVal> RegionVal = V.getAs<loc::MemRegionVal>();
if (!RegionVal)
return false;
auto *Region = dyn_cast<VarRegion>(RegionVal->getAsRegion());
if (!Region)
return false;
const VarDecl *Decl = Region->getDecl();
if (!Decl->hasGlobalStorage())
return false;
QualType Ty = Decl->getType();
bool HasConst = Ty.isConstQualified();
if (isStringlike(Ty) && HasConst)
return true;
// Look through the typedefs.
while (auto *T = dyn_cast<TypedefType>(Ty)) {
Ty = T->getDecl()->getUnderlyingType();
// It is sufficient for any intermediate typedef
// to be classified const.
HasConst = HasConst || Ty.isConstQualified();
if (isStringlike(Ty) && HasConst)
return true;
}
return false;
}
/// \return whether {@code type} is a string-like type.
bool NonnullStringConstantsChecker::isStringlike(QualType Ty) const {
if (Ty->isPointerType() && Ty->getPointeeType()->isCharType())
return true;
if (auto *T = dyn_cast<ObjCObjectPointerType>(Ty)) {
return T->getInterfaceDecl() &&
T->getInterfaceDecl()->getIdentifier() == NSStringII;
} else if (auto *T = dyn_cast<TypedefType>(Ty)) {
return T->getDecl()->getIdentifier() == CFStringRefII;
}
return false;
}
void ento::registerNonnullStringConstantsChecker(CheckerManager &Mgr) {
Mgr.registerChecker<NonnullStringConstantsChecker>();
}

cfe/trunk/test/Analysis/nonnull-global-constants.mm

// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify %s
// Nullability of const string-like globals, testing
// NonnullGlobalConstantsChecker.
void clang_analyzer_eval(bool);
@class NSString;
typedef const struct __CFString *CFStringRef;
typedef const struct __CFBoolean * CFBooleanRef;
// Global NSString* is non-null.
extern NSString *const StringConstGlobal;
void stringConstGlobal() {
clang_analyzer_eval(StringConstGlobal); // expected-warning{{TRUE}}
}
// The logic does not apply to local variables though.
extern NSString *stringGetter();
void stringConstLocal() {
NSString *const local = stringGetter();
clang_analyzer_eval(local); // expected-warning{{UNKNOWN}}
}
// Global const CFStringRef's are also assumed to be non-null.
extern const CFStringRef CFStringConstGlobal;
void cfStringCheckGlobal() {
clang_analyzer_eval(CFStringConstGlobal); // expected-warning{{TRUE}}
}
// But only "const" ones.
extern CFStringRef CFStringNonConstGlobal;
void cfStringCheckMutableGlobal() {
clang_analyzer_eval(CFStringNonConstGlobal); // expected-warning{{UNKNOWN}}
}
// char* const is also assumed to be non-null.
extern const char *const ConstCharStarConst;
void constCharStarCheckGlobal() {
clang_analyzer_eval(ConstCharStarConst); // expected-warning{{TRUE}}
}
// Pointer value can be mutable.
extern char *const CharStarConst;
void charStarCheckGlobal() {
clang_analyzer_eval(CharStarConst); // expected-warning{{TRUE}}
}
// But the pointer itself should be immutable.
extern char *CharStar;
void charStartCheckMutableGlobal() {
clang_analyzer_eval(CharStar); // expected-warning{{UNKNOWN}}
}
// Type definitions should also work across typedefs, for pointers:
typedef char *const str;
extern str globalStr;
void charStarCheckTypedef() {
clang_analyzer_eval(globalStr); // expected-warning{{TRUE}}
}
// And for types.
typedef NSString *const NStr;
extern NStr globalNSString;
void NSStringCheckTypedef() {
clang_analyzer_eval(globalNSString); // expected-warning{{TRUE}}
}
// Note that constness could be either inside
// the var declaration, or in a typedef.
typedef NSString *NStr2;
extern const NStr2 globalNSString2;
void NSStringCheckConstTypedef() {
clang_analyzer_eval(globalNSString2); // expected-warning{{TRUE}}
}
// Nested typedefs should work as well.
typedef const CFStringRef str1;
typedef str1 str2;
extern str2 globalStr2;
void testNestedTypedefs() {
clang_analyzer_eval(globalStr2); // expected-warning{{TRUE}}
}
// And for NSString *.
typedef NSString *const nstr1;
typedef nstr1 nstr2;
extern nstr2 nglobalStr2;
void testNestedTypedefsForNSString() {
clang_analyzer_eval(nglobalStr2); // expected-warning{{TRUE}}
}
// And for CFBooleanRefs.
extern const CFBooleanRef kBool;
void testNonnullBool() {
clang_analyzer_eval(kBool); // expected-warning{{TRUE}}
}
// And again, only for const one.
extern CFBooleanRef kBoolMutable;
void testNonnullNonconstBool() {
clang_analyzer_eval(kBoolMutable); // expected-warning{{UNKNOWN}}
}

cfe/trunk/test/Analysis/nonnull-string-constants.mm

// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify %s
// Nullability of const string-like globals, testing
// NonnullStringConstantsChecker.
void clang_analyzer_eval(bool);
@class NSString;
typedef const struct __CFString *CFStringRef;
// Global NSString* is non-null.
extern NSString *const StringConstGlobal;
void stringConstGlobal() {
clang_analyzer_eval(StringConstGlobal); // expected-warning{{TRUE}}
}
// The logic does not apply to local variables though.
extern NSString *stringGetter();
void stringConstLocal() {
NSString *const local = stringGetter();
clang_analyzer_eval(local); // expected-warning{{UNKNOWN}}
}
// Global const CFStringRef's are also assumed to be non-null.
extern const CFStringRef CFStringConstGlobal;
void cfStringCheckGlobal() {
clang_analyzer_eval(CFStringConstGlobal); // expected-warning{{TRUE}}
}
// But only "const" ones.
extern CFStringRef CFStringNonConstGlobal;
void cfStringCheckMutableGlobal() {
clang_analyzer_eval(CFStringNonConstGlobal); // expected-warning{{UNKNOWN}}
}
// char* const is also assumed to be non-null.
extern const char *const ConstCharStarConst;
void constCharStarCheckGlobal() {
clang_analyzer_eval(ConstCharStarConst); // expected-warning{{TRUE}}
}
// Pointer value can be mutable.
extern char *const CharStarConst;
void charStarCheckGlobal() {
clang_analyzer_eval(CharStarConst); // expected-warning{{TRUE}}
}
// But the pointer itself should be immutable.
extern char *CharStar;
void charStartCheckMutableGlobal() {
clang_analyzer_eval(CharStar); // expected-warning{{UNKNOWN}}
}
// Type definitions should also work across typedefs, for pointers:
typedef char *const str;
extern str globalStr;
void charStarCheckTypedef() {
clang_analyzer_eval(globalStr); // expected-warning{{TRUE}}
}
// And for types.
typedef NSString *const NStr;
extern NStr globalNSString;
void NSStringCheckTypedef() {
clang_analyzer_eval(globalNSString); // expected-warning{{TRUE}}
}
// Note that constness could be either inside
// the var declaration, or in a typedef.
typedef NSString *NStr2;
extern const NStr2 globalNSString2;
void NSStringCheckConstTypedef() {
clang_analyzer_eval(globalNSString2); // expected-warning{{TRUE}}
}
// Nested typedefs should work as well.
typedef const CFStringRef str1;
typedef str1 str2;
extern str2 globalStr2;
void testNestedTypedefs() {
clang_analyzer_eval(globalStr2); // expected-warning{{TRUE}}
}
// And for NSString *.
typedef NSString *const nstr1;
typedef nstr1 nstr2;
extern nstr2 nglobalStr2;
void testNestedTypedefsForNSString() {
clang_analyzer_eval(nglobalStr2); // expected-warning{{TRUE}}
}
cfe/trunk/test/Analysis/nonnull-global-constants.mm