[analyzer] ObjCContainers: Track index values.

[NoQ]

Summary

This is a checker for CF (well, not really ObjC) arrays that checks array bounds. As such, it's a good place to experiment with array bound checking.

Use trackExpressionValue() (previously known as trackNullOrUndefValue()) to track index value, so that the user knew what Static Analyzer thinks the index is.

Hopefully this will make warnings more understandable. Other ideas for better warnings include adding index and length values to the message and explaining how constraints over index and length evolve along the path.

Additionally, add printState() to help debugging the checker later.

[NoQ]

test/Analysis/CFContainers.mm

178–180

This is a new note.

240

This is a new note.

[NoQ]

These are boring, i guess i just commit.

lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp

public:
   static void *getTag() { static int Tag; return &Tag; }
 
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
+
+  void printState(raw_ostream &OS, ProgramStateRef State,
+                  const char *NL, const char *Sep) const;
 };
 } // end anonymous namespace
 
 // ProgramState trait - a map from array symbol to its state.
 REGISTER_MAP_WITH_PROGRAMSTATE(ArraySizeMap, SymbolRef, DefinedSVal)
 
 void ObjCContainersChecker::addSizeInfo(const Expr *Array, const Expr *Size,
                                         CheckerContext &C) const {
if (Name.equals("CFArrayGetValueAtIndex")) {
     ProgramStateRef StOutBound = State->assumeInBound(Idx, *Size, false, T);
     if (StOutBound && !StInBound) {
       ExplodedNode *N = C.generateErrorNode(StOutBound);
       if (!N)
         return;
       initBugType();
       auto R = llvm::make_unique<BugReport>(*BT, "Index is out of bounds", N);
       R->addRange(IdxExpr->getSourceRange());
+      bugreporter::trackExpressionValue(N, IdxExpr, *R,
+                                        /*EnableNullFPSuppression=*/false);
       C.emitReport(std::move(R));
       return;
     }
   }
 }
 
 ProgramStateRef
 ObjCContainersChecker::checkPointerEscape(ProgramStateRef State,
                                           const InvalidatedSymbols &Escaped,
                                           const CallEvent *Call,
                                           PointerEscapeKind Kind) const {
   for (const auto &Sym : Escaped) {
     // When a symbol for a mutable array escapes, we can't reason precisely
     // about its size any more -- so remove it from the map.
     // Note that we aren't notified here when a CFMutableArrayRef escapes as a
     // CFArrayRef. This is because CFArrayRef is typedef'd as a pointer to a
     // const-qualified type.
     State = State->remove<ArraySizeMap>(Sym);
   }
   return State;
 }
 
+void ObjCContainersChecker::printState(raw_ostream &OS, ProgramStateRef State,
+                                       const char *NL, const char *Sep) const {
+  ArraySizeMapTy Map = State->get<ArraySizeMap>();
+  if (Map.isEmpty())
+    return;
+
+  OS << Sep << "ObjC container sizes :" << NL;
+  for (auto I : Map) {
+    OS << I.first << " : " << I.second << NL;
+  }
+}
+
 /// Register checker.
 void ento::registerObjCContainersChecker(CheckerManager &mgr) {
   mgr.registerChecker<ObjCContainersChecker>();
 }

test/Analysis/CFContainers.mm

-// RUN: %clang_analyze_cc1 -analyzer-checker=osx.coreFoundation.containers.PointerSizedValues,osx.coreFoundation.containers.OutOfBounds -analyzer-store=region -triple x86_64-apple-darwin -verify %s
+// RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin -analyzer-output=text\
+// RUN: -analyzer-checker=osx.coreFoundation.containers.PointerSizedValues\
+// RUN: -analyzer-checker=osx.coreFoundation.containers.OutOfBounds\
+// RUN: -verify %s
 
 typedef const struct __CFAllocator * CFAllocatorRef;
 typedef const struct __CFString * CFStringRef;
 typedef unsigned char Boolean;
 typedef signed long CFIndex;
 extern
 const CFAllocatorRef kCFAllocatorDefault;
 typedef const void * (*CFArrayRetainCallBack)(CFAllocatorRef allocator, const void *value);

 CFDictionaryRef CFDictionaryCreate(CFAllocatorRef allocator, const void **keys, const void **values, CFIndex numValues, const 
 CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks);
 CFNumberRef CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr);
 extern
 CFSetRef CFSetCreate(CFAllocatorRef allocator, const void **values, CFIndex numValues, const CFSetCallBacks *callBacks);
 #define CFSTR(cStr)  ((CFStringRef) __builtin___CFStringMakeConstantString ("" cStr ""))
 #define NULL __null
 
-// Done with the headers. 
+// Done with the headers.
 // Test alpha.osx.cocoa.ContainerAPI checker.
 void testContainers(int **xNoWarn, CFIndex count) {
   int x[] = { 1, 2, 3 };
-  CFArrayRef foo = CFArrayCreate(kCFAllocatorDefault, (const void **) x, sizeof(x) / sizeof(x[0]), 0);// expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
+  CFArrayRef foo = CFArrayCreate(kCFAllocatorDefault, (const void **) x, sizeof(x) / sizeof(x[0]), 0);
+  // expected-warning@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
+  // expected-note@-2    {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
 
   CFArrayRef fooNoWarn = CFArrayCreate(kCFAllocatorDefault, (const void **) xNoWarn, sizeof(xNoWarn) / sizeof(xNoWarn[0]), 0); // no warning
   CFArrayRef fooNoWarn2 = CFArrayCreate(kCFAllocatorDefault, 0, sizeof(xNoWarn) / sizeof(xNoWarn[0]), 0);// no warning, passing in 0
   CFArrayRef fooNoWarn3 = CFArrayCreate(kCFAllocatorDefault, NULL, sizeof(xNoWarn) / sizeof(xNoWarn[0]), 0);// no warning, passing in NULL
 
-  CFSetRef set = CFSetCreate(NULL, (const void **)x, 3, &kCFTypeSetCallBacks); // expected-warning {{The second argument to 'CFSetCreate' must be a C array of pointer-sized values}}
+  CFSetRef set = CFSetCreate(NULL, (const void **)x, 3, &kCFTypeSetCallBacks);
+  // expected-warning@-1 {{The second argument to 'CFSetCreate' must be a C array of pointer-sized values}}
+  // expected-note@-2    {{The second argument to 'CFSetCreate' must be a C array of pointer-sized values}}
   CFArrayRef* pairs = new CFArrayRef[count];
   CFSetRef fSet = CFSetCreate(kCFAllocatorDefault, (const void**) pairs, count - 1, &kCFTypeSetCallBacks);// no warning
 }
 
 void CreateDict(int *elems) {
   const short days28 = 28;
   const short days30 = 30;
   const short days31 = 31;
   CFIndex numValues = 6;  
   CFStringRef keys[6];
   CFNumberRef values[6];
   keys[0] = CFSTR("January");  values[0] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days31);
   keys[1] = CFSTR("February"); values[1] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days28);
   keys[2] = CFSTR("March"); values[2] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days31);
   keys[3] = CFSTR("April"); values[3] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days30);
   keys[4] = CFSTR("May"); values[4] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days31);
   keys[5] = CFSTR("June"); values[5] = CFNumberCreate(kCFAllocatorDefault, kCFNumberShortType, &days30);
 
   const CFDictionaryKeyCallBacks keyCB = kCFCopyStringDictionaryKeyCallBacks;
   const CFDictionaryValueCallBacks valCB = kCFTypeDictionaryValueCallBacks;
   CFDictionaryRef dict1 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)keys, (const void**)values, numValues, &keyCB, &valCB); // no warning
-  CFDictionaryRef dict2 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)elems[0], (const void**)values, numValues, &keyCB, &valCB); //expected-warning {{The second argument to 'CFDictionaryCreate' must be a C array of}} expected-warning {{cast to 'const void **' from smaller integer type 'int'}}
-  CFDictionaryRef dict3 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)keys, (const void**)elems, numValues, &keyCB, &valCB); // expected-warning {{The third argument to 'CFDictionaryCreate' must be a C array of pointer-sized values}}
+  CFDictionaryRef dict2 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)elems[0], (const void**)values, numValues, &keyCB, &valCB);
+  // expected-warning@-1 {{The second argument to 'CFDictionaryCreate' must be a C array of}}
+  // expected-note@-2    {{The second argument to 'CFDictionaryCreate' must be a C array of}}
+  // expected-warning@-3{{cast to 'const void **' from smaller integer type 'int'}}
+  CFDictionaryRef dict3 = CFDictionaryCreate(kCFAllocatorDefault, (const void**)keys, (const void**)elems, numValues, &keyCB, &valCB);
+  // expected-warning@-1 {{The third argument to 'CFDictionaryCreate' must be a C array of pointer-sized values}}
+  // expected-note@-2    {{The third argument to 'CFDictionaryCreate' must be a C array of pointer-sized values}}
 }
 
 void OutOfBoundsSymbolicOffByOne(const void ** input, CFIndex S) {
   CFArrayRef array;
   array = CFArrayCreate(kCFAllocatorDefault, input, S, 0);
   const void *s1 = CFArrayGetValueAtIndex(array, 0);   // no warning
   const void *s2 = CFArrayGetValueAtIndex(array, S-1); // no warning
   const void *s3 = CFArrayGetValueAtIndex(array, S);   // expected-warning {{Index is out of bounds}}
+                                                       // expected-note@-1 {{Index is out of bounds}}
 }
 
 void OutOfBoundsConst(const void ** input, CFIndex S) {
   CFArrayRef array;
   array = CFArrayCreate(kCFAllocatorDefault, input, 3, 0);
   const void *s1 = CFArrayGetValueAtIndex(array, 0); // no warning
   const void *s2 = CFArrayGetValueAtIndex(array, 2); // no warning
   const void *s3 = CFArrayGetValueAtIndex(array, 5); // expected-warning {{Index is out of bounds}}
+                                                     // expected-note@-1 {{Index is out of bounds}}
   
   // TODO: The solver is probably not strong enough here.
   CFIndex sIndex;
   for (sIndex = 0 ; sIndex <= 5 ; sIndex += 3 ) {
     const void *s = CFArrayGetValueAtIndex(array, sIndex); 
   }  
 }
 
 void OutOfBoundsZiro(const void ** input, CFIndex S) {
   CFArrayRef array;
   // The API allows to set the size to 0. Check that we don't undeflow when the size is 0.
   array = CFArrayCreate(kCFAllocatorDefault, 0, 0, 0);
   const void *s1 = CFArrayGetValueAtIndex(array, 0); // expected-warning {{Index is out of bounds}}
+                                                     // expected-note@-1 {{Index is out of bounds}}
 }
 
 void TestGetCount(CFArrayRef A, CFIndex sIndex) {
-  CFIndex sCount = CFArrayGetCount(A);
-  if (sCount > sIndex)
+  CFIndex sCount = CFArrayGetCount(A); // expected-note{{'sCount' initialized here}}
+  if (sCount > sIndex) // expected-note{{Assuming 'sCount' is <= 'sIndex'}}
+                       // expected-note@-1{{Taking false branch}}
     const void *s1 = CFArrayGetValueAtIndex(A, sIndex);
   const void *s2 = CFArrayGetValueAtIndex(A, sCount);// expected-warning {{Index is out of bounds}}
+                                                     // expected-note@-1 {{Index is out of bounds}}
 }
 
 typedef void* XX[3];
 void TestPointerToArray(int *elems, void *p1, void *p2, void *p3, unsigned count, void* fn[], char cp[]) {
   void* x[] = { p1, p2, p3 };
   CFArrayCreate(0, (const void **) &x, count, 0); // no warning
 
   void* y[] = { p1, p2, p3 };
   CFArrayCreate(0, (const void **) y, count, 0); // no warning
   XX *z = &x;
   CFArrayCreate(0, (const void **) z, count, 0); // no warning
 
   CFArrayCreate(0, (const void **) &fn, count, 0); // false negative
   CFArrayCreate(0, (const void **) fn, count, 0); // no warning
   CFArrayCreate(0, (const void **) cp, count, 0); // expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
+                                                  // expected-note@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
 
   char cc[] = { 0, 2, 3 };
   CFArrayCreate(0, (const void **) &cc, count, 0); // expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
+                                                   // expected-note@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
   CFArrayCreate(0, (const void **) cc, count, 0); // expected-warning {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
+                                                  // expected-note@-1 {{The second argument to 'CFArrayCreate' must be a C array of pointer-sized}}
 }
 
 void TestUndef(CFArrayRef A, CFIndex sIndex, void* x[]) {
   unsigned undefVal;
   const void *s1 = CFArrayGetValueAtIndex(A, undefVal);
 
   unsigned undefVal2;
   CFArrayRef B = CFArrayCreate(0, (const void **) &x, undefVal2, 0); 
void TestCFMutableArrayRefEscapeViaMutableArgument(CFMutableArrayRef a) {
   ArrayRefMutableEscape(a);
 
   // ArrayRefMutableEscape could mutate a to make it have
   // at least aLen + 1 elements, so do not report an error here.
   CFArrayGetValueAtIndex(a, aLen);
 }
 
 void TestCFMutableArrayRefEscapeViaImmutableArgument(CFMutableArrayRef a) {
-  CFIndex aLen = CFArrayGetCount(a);
+  CFIndex aLen = CFArrayGetCount(a); // expected-note{{'aLen' initialized here}}
   ArrayRefEscape(a);
 
   // ArrayRefEscape is declared to take a CFArrayRef (i.e, an immutable array)
   // so we assume it does not change the length of a.
   CFArrayGetValueAtIndex(a, aLen); // expected-warning {{Index is out of bounds}}
+                                   // expected-note@-1 {{Index is out of bounds}}
 }