[analyzer][UninitializedObjectChecker] New flag to ignore records based on it's fields

[Szelethus]

Summary

Based on a suggestion from @george.karpenkov.

In some cases, structs are used as unions with a help of a tag/kind field. This patch adds a new string flag (a pattern), that is matched against the fields of a record, and should a match be found, the entire record is ignored.

For more info refer to http://lists.llvm.org/pipermail/cfe-dev/2018-August/058906.html and to the responses to that, especially http://lists.llvm.org/pipermail/cfe-dev/2018-August/059215.html.

[Szelethus]

Added doc to www/analyzer/alpha_checks.html.

[george.karpenkov]

lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp

468

1. Since you are using match, you would reject an extra prefix - but what about an extra suffix?
2. Would it make sense to expose the entire regexp as a flag? Then you could remove the boolean flag (if you can change the regexp to match if only the entire field name matches, then an empty regexp would correspond to "no matches")

[Szelethus]

Generalized the patch so that the user can supply the pattern that is matched against the fields of the records.

[Szelethus]

lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp

468

1. Added a new test case, seems to be fine ^-^
2. Sounds cool, so I made it happen.

[NoQ]

I hope we'll be able to come up with a reasonable default regex.

test/Analysis/cxx-uninitialized-object-unionlike-constructs.cpp

2–5

If you like, you can make a directory for your tests, instead of a filename prefix.

Btw, thanks for pointing out that we can use \ in run-lines, i never noticed it before you started using it.

[Szelethus]

test/Analysis/cxx-uninitialized-object-unionlike-constructs.cpp

2–5

Cheers! I actually saw this trick in D45050.

lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObject.h

 //
 //   - "CheckPointeeInitialization" (boolean). If set to false, the checker will
 //     not analyze the pointee of pointer/reference fields, and will only check
 //     whether the object itself is initialized. Defaults to false.
 //
 //     `-analyzer-config \
 //         alpha.cplusplus.UninitializedObject:CheckPointeeInitialization=true`.
 //
+//   - "IgnoreUnionlikeConstructs" (boolean). If set to false, the checker will
+//     not analyze structures that have a field a name or type name that
+//     contains "[Tt]ag" or "[Kk]ind". Defaults to false.
+//
+//     `-analyzer-config \
+//         alpha.cplusplus.UninitializedObject:IgnoreUnionlikeConstructs=true`.
+//
 //     TODO: With some clever heuristics, some pointers should be dereferenced
 //     by default. For example, if the pointee is constructed within the
 //     constructor call, it's reasonable to say that no external object
 //     references it, and we wouldn't generate multiple report on the same
 //     pointee.
 //
 // Most of the following methods as well as the checker itself is defined in
 // UninitializedObjectChecker.cpp.

 
 namespace clang {
 namespace ento {
 
 struct UninitObjCheckerOptions {
   bool IsPedantic;
   bool ShouldConvertNotesToWarnings;
   bool CheckPointeeInitialization;
+  bool IgnoreUnionlikeConstructs;
 };
 
 /// Represent a single field. This is only an interface to abstract away special
 /// cases like pointers/references.
 class FieldNode {
 protected:
   const FieldRegion *FR;
 

lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp

 getObjectVal(const CXXConstructorDecl *CtorDecl, CheckerContext &Context);
 
 /// Checks whether the object constructed by \p Ctor will be analyzed later
 /// (e.g. if the object is a field of another object, in which case we'd check
 /// it multiple times).
 static bool willObjectBeAnalyzedLater(const CXXConstructorDecl *Ctor,
                                       CheckerContext &Context);
 
+/// Checks whether RD is a union-like construct. We'll consider a RecordDecl
+/// union-like, if it has a field that has [Kk]ind or [Tt]ag in it's identifier
+/// or type name.
+static bool isUnionLike(const RecordDecl *RD);
+
 //===----------------------------------------------------------------------===//
 //                  Methods for UninitializedObjectChecker.
 //===----------------------------------------------------------------------===//
 
 void UninitializedObjectChecker::checkEndFunction(
     const ReturnStmt *RS, CheckerContext &Context) const {
 
   const auto *CtorDecl = dyn_cast_or_null<CXXConstructorDecl>(
bool FindUninitializedFields::isNonUnionUninit(const TypedValueRegion *R,
   assert(R->getValueType()->isRecordType() &&
          !R->getValueType()->isUnionType() &&
          "This method only checks non-union record objects!");
 
   const RecordDecl *RD =
       R->getValueType()->getAs<RecordType>()->getDecl()->getDefinition();
   assert(RD && "Referred record has no definition");
 
+  if (Opts.IgnoreUnionlikeConstructs && isUnionLike(RD)) {
+    IsAnyFieldInitialized = true;
+    return false;
+  }
+
   bool ContainsUninitField = false;
 
   // Are all of this non-union's fields initialized?
   for (const FieldDecl *I : RD->fields()) {
 
     const auto FieldVal =
         State->getLValue(I, loc::MemRegionVal(R)).castAs<loc::MemRegionVal>();
     const auto *FR = FieldVal.getRegionAs<FieldRegion>();
while ((LC = LC->getParent())) {
     // during the analysis of OtherObject.
     if (CurrentObject->getRegion()->isSubRegionOf(OtherObject->getRegion()))
       return true;
   }
 
   return false;
 }
 
+static bool isUnionLike(const RecordDecl *RD) {
+  llvm::Regex ContainsKindOrTag("[kK]ind|[tT]ag");
+
+  for (const FieldDecl *FD : RD->fields()) {
+    if (ContainsKindOrTag.match(FD->getType().getAsString()))
+      return true;
+    if (ContainsKindOrTag.match(FD->getName()))
+      return true;
+  }
+
+  return false;
+}
+
 StringRef clang::ento::getVariableName(const FieldDecl *Field) {
   // If Field is a captured lambda variable, Field->getName() will return with
   // an empty string. We can however acquire it's name from the lambda's
   // captures.
   const auto *CXXParent = dyn_cast<CXXRecordDecl>(Field->getParent());
 
   if (CXXParent && CXXParent->isLambda()) {
     assert(CXXParent->captures_begin());
void ento::registerUninitializedObjectChecker(CheckerManager &Mgr) {
   UninitObjCheckerOptions &Opts = Chk->Opts;
 
   Opts.IsPedantic = Mgr.getAnalyzerOptions().getBooleanOption(
       "Pedantic", /*DefaultVal*/ false, Chk);
   Opts.ShouldConvertNotesToWarnings = Mgr.getAnalyzerOptions().getBooleanOption(
       "NotesAsWarnings", /*DefaultVal*/ false, Chk);
   Opts.CheckPointeeInitialization = Mgr.getAnalyzerOptions().getBooleanOption(
       "CheckPointeeInitialization", /*DefaultVal*/ false, Chk);
+  Opts.IgnoreUnionlikeConstructs = Mgr.getAnalyzerOptions().getBooleanOption(
+      "IgnoreUnionlikeConstructs", /*DefaultVal*/ false, Chk);
 }

test/Analysis/cxx-uninitialized-object-unionlike-constructs.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.UninitializedObject \
+// RUN:   -analyzer-config alpha.cplusplus.UninitializedObject:Pedantic=true -DPEDANTIC \
+// RUN:   -analyzer-config alpha.cplusplus.UninitializedObject:IgnoreUnionlikeConstructs=true \
+// RUN:   -std=c++11 -verify  %s
+
+// expected-no-diagnostics
+
+// Both type and name contains "kind".
+struct UnionLikeStruct1 {
+  enum Kind {
+    volume,
+    area
+  } kind;
+
+  int Volume;
+  int Area;
+
+  UnionLikeStruct1(Kind kind, int Val) : kind(kind) {
+    switch (kind) {
+    case volume:
+      Volume = Val;
+      break;
+    case area:
+      Area = Val;
+      break;
+    }
+  }
+};
+
+void fUnionLikeStruct1() {
+  UnionLikeStruct1 t(UnionLikeStruct1::volume, 10);
+}
+
+// Only name contains "kind".
+struct UnionLikeStruct2 {
+  enum Type {
+    volume,
+    area
+  } kind;
+
+  int Volume;
+  int Area;
+
+  UnionLikeStruct2(Type kind, int Val) : kind(kind) {
+    switch (kind) {
+    case volume:
+      Volume = Val;
+      break;
+    case area:
+      Area = Val;
+      break;
+    }
+  }
+};
+
+void fUnionLikeStruct2() {
+  UnionLikeStruct2 t(UnionLikeStruct2::volume, 10);
+}
+
+// Only type contains "kind".
+struct UnionLikeStruct3 {
+  enum Kind {
+    volume,
+    area
+  } type;
+
+  int Volume;
+  int Area;
+
+  UnionLikeStruct3(Kind type, int Val) : type(type) {
+    switch (type) {
+    case volume:
+      Volume = Val;
+      break;
+    case area:
+      Area = Val;
+      break;
+    }
+  }
+};
+
+void fUnionLikeStruct3() {
+  UnionLikeStruct3 t(UnionLikeStruct3::volume, 10);
+}
+
+// Only type contains "tag".
+struct UnionLikeStruct4 {
+  enum Tag {
+    volume,
+    area
+  } type;
+
+  int Volume;
+  int Area;
+
+  UnionLikeStruct4(Tag type, int Val) : type(type) {
+    switch (type) {
+    case volume:
+      Volume = Val;
+      break;
+    case area:
+      Area = Val;
+      break;
+    }
+  }
+};
+
+void fUnionLikeStruct4() {
+  UnionLikeStruct4 t(UnionLikeStruct4::volume, 10);
+}

www/analyzer/alpha_checks.html

<li>
     <code>-analyzer-config alpha.cplusplus.UninitializedObject:NotesAsWarnings=true</code>.
   </li>
   <li>
     "<code>CheckPointeeInitialization</code>" (boolean). If set to false, the checker will
     not analyze the pointee of pointer/reference fields, and will only check
     whether the object itself is initialized. Defaults to false. <br>
     <code>-analyzer-config alpha.cplusplus.UninitializedObject:CheckPointeeInitialization=true</code>.
   </li>
+  <li>"<code>IgnoreUnionlikeConstructs</code>" (boolean). If set to false, the checker will
+     not analyze structures that have a field a name or type name that
+     contains <code>[Tt]ag</code> or <code>[Kk]ind</code>. Defaults to false. <br>
+     <code>-analyzer-config alpha.cplusplus.UninitializedObject:IgnoreUnionlikeConstructs=true</code>.
+  </li>
 </ul></div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 // With Pedantic and CheckPointeeInitialization set to true
 
 struct A {
   struct B {
     int x; // note: uninitialized field 'this->b.x'