[analyzer] CastValueChecker: Model isa(), isa_and_nonnull()

[Charusso]

Summary

-

[Szelethus]

Whoa, the test cases look AMAZING! I admit that I haven't read much of the other code just yet, but I like the results in any case.

clang/test/Analysis/cast-value-notes.cpp

5–27

Hmm, we may want to move these eventually to clang/test/Inputs/, since this isn't the only LLVM checker. Thought that said, I want to see the other LLVM checker gone, like, purged from the codebase for being the abomination that it is.

Feel free to leave these here for know, just thinking aloud :)

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

183

A body of a function is always either a CompoundStmt or (shockingly) a CXXTryStmt. This cast will always fail.

188

I suspect that DRE may still be null (eg., when calling isa through function pointer).

I think you should just lookup Call.getDecl()'s template arguments instead. It's going to be the declaration of the specific instantiation, so it'll have all the arguments.

216

Can you use the overload without the bug report parameter? Cause you don't seem to be using it anyway.

clang/test/Analysis/cast-value-notes.cpp

5–27

I agree, extracting common definitions into a system header simulator usually ends up being worth it pretty quickly.

89

I suggest: 'C' is a 'Circle', not a 'Triangle'.

95

Just 'C' is a 'Circle'.

111

This test looks incorrect. We shouldn't be assuming this, we already know that it's not a triangle because we know that it's a circle.

[Charusso]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

216

I think you have forgotten to implement that scenario, but now we have that as well since D66325.

clang/test/Analysis/cast-value-notes.cpp

5–27

Thanks for the idea! Moved in D66325.

111

Let us discuss in D66325.

[Charusso]

• Simplify the template argument obtaining.
• Added a tiny new test case.

[Charusso]

Thanks for the reviews so far! I had a contradiction in my mind about regions, but now everything is okay and the notes are not misleading.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

183

I do not remember what I did here, but that was a working solution.

188

That was the plan, just I did not realized I am a FunctionDecl away to achieve that. Thanks!

[NoQ]

LGTM with one minor nit!

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

203–205

Mmm, this will need to be de-duplicated out.

[Charusso]

• Fix.

[Charusso]

Thanks for the review!

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

 //===- CastValueChecker - Model implementation of custom RTTIs --*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This defines CastValueChecker which models casts of custom RTTIs.
 //
 //===----------------------------------------------------------------------===//
 
+#include "clang/AST/DeclTemplate.h"
+#include "clang/Lex/Lexer.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h"
 #include "llvm/ADT/Optional.h"
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class CastValueChecker : public Checker<eval::Call> {
-  enum class CallKind { Function, Method };
+  enum class CallKind { Function, Method, InstanceOf };
 
   using CastCheck =
       std::function<void(const CastValueChecker *, const CallEvent &Call,
                          DefinedOrUnknownSVal, CheckerContext &)>;
 
 public:
   // We have five cases to evaluate a cast:
   // 1) The parameter is non-null, the return value is non-null.
   // 2) The parameter is non-null, the return value is null.
   // 3) The parameter is null, the return value is null.
   // cast: 1;  dyn_cast: 1, 2;  cast_or_null: 1, 3;  dyn_cast_or_null: 1, 2, 3.
   //
   // 4) castAs: Has no parameter, the return value is non-null.
   // 5) getAs:  Has no parameter, the return value is null or non-null.
+  //
+  // We have two cases to check the parameter is an instance of the given type.
+  // 1) isa:             The parameter is non-null, returns boolean.
+  // 2) isa_and_nonnull: The parameter is null or non-null, returns boolean.
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
 
 private:
   // These are known in the LLVM project. The pairs are in the following form:
   // {{{namespace, call}, argument-count}, {callback, kind}}
   const CallDescriptionMap<std::pair<CastCheck, CallKind>> CDM = {
       {{{"llvm", "cast"}, 1},
        {&CastValueChecker::evalCast, CallKind::Function}},
       {{{"llvm", "dyn_cast"}, 1},
        {&CastValueChecker::evalDynCast, CallKind::Function}},
       {{{"llvm", "cast_or_null"}, 1},
        {&CastValueChecker::evalCastOrNull, CallKind::Function}},
       {{{"llvm", "dyn_cast_or_null"}, 1},
        {&CastValueChecker::evalDynCastOrNull, CallKind::Function}},
       {{{"clang", "castAs"}, 0},
        {&CastValueChecker::evalCastAs, CallKind::Method}},
       {{{"clang", "getAs"}, 0},
-       {&CastValueChecker::evalGetAs, CallKind::Method}}};
+       {&CastValueChecker::evalGetAs, CallKind::Method}},
+      {{{"llvm", "isa"}, 1},
+       {&CastValueChecker::evalIsa, CallKind::InstanceOf}},
+      {{{"llvm", "isa_and_nonnull"}, 1},
+       {&CastValueChecker::evalIsaAndNonNull, CallKind::InstanceOf}}};
 
   void evalCast(const CallEvent &Call, DefinedOrUnknownSVal DV,
                 CheckerContext &C) const;
   void evalDynCast(const CallEvent &Call, DefinedOrUnknownSVal DV,
                    CheckerContext &C) const;
   void evalCastOrNull(const CallEvent &Call, DefinedOrUnknownSVal DV,
                       CheckerContext &C) const;
   void evalDynCastOrNull(const CallEvent &Call, DefinedOrUnknownSVal DV,
                          CheckerContext &C) const;
   void evalCastAs(const CallEvent &Call, DefinedOrUnknownSVal DV,
                   CheckerContext &C) const;
   void evalGetAs(const CallEvent &Call, DefinedOrUnknownSVal DV,
                  CheckerContext &C) const;
+  void evalIsa(const CallEvent &Call, DefinedOrUnknownSVal DV,
+               CheckerContext &C) const;
+  void evalIsaAndNonNull(const CallEvent &Call, DefinedOrUnknownSVal DV,
+                         CheckerContext &C) const;
 };
 } // namespace
 
 static QualType getRecordType(QualType Ty) {
   Ty = Ty.getCanonicalType();
 
   if (Ty->isPointerType())
     return getRecordType(Ty->getPointeeType());
 
   if (Ty->isReferenceType())
     return getRecordType(Ty.getNonReferenceType());
 
   return Ty.getUnqualifiedType();
 }
 
+static bool isInfeasibleCast(const DynamicCastInfo *Cast, bool IsCastSucceeds) {
+  if (!Cast)
+    return false;
+
+  return IsCastSucceeds ? Cast->isFails() : Cast->isSucceeds();
+}
+
 //===----------------------------------------------------------------------===//
 // Main logic to evaluate a cast.
 //===----------------------------------------------------------------------===//
 
 static void addCastTransition(const CallEvent &Call, DefinedOrUnknownSVal DV,
                               CheckerContext &C, bool IsNonNullParam,
                               bool IsNonNullReturn,
                               bool IsCheckedCast = false) {
static void addCastTransition(const CallEvent &Call, DefinedOrUnknownSVal DV,
 
   // We assume that every checked cast succeeds.
   bool IsCastSucceeds;
   if (Cast)
     IsCastSucceeds = IsCheckedCast || (IsNonNullReturn && Cast->isSucceeds());
   else
     IsCastSucceeds = IsCheckedCast || IsNonNullReturn || CastFromTy == CastToTy;
 
-  // Check for infeasible casts.
-  if (!IsCheckedCast && Cast) {
-    if ((IsCastSucceeds && Cast->isFails()) ||
-        (!IsCastSucceeds && Cast->isSucceeds())) {
-      C.generateSink(State, C.getPredecessor());
-      return;
-    }
-  }
+  if (!IsCheckedCast && isInfeasibleCast(Cast, IsCastSucceeds)) {
 
   // Store the type and the cast information.
   const MemRegion *MR = DV.getAsRegion();
   bool IsKnownCast = Cast || CastFromTy == CastToTy;
   if (!IsKnownCast)
     State = setDynamicTypeAndCastInfo(State, MR, CastFromTy, CastToTy,
                                       Call.getResultType(), IsCastSucceeds);
 
const NoteTag *Tag = C.getNoteTag(
       /*IsPrunable=*/true);
 
   SVal V = IsCastSucceeds ? DV : C.getSValBuilder().makeNull();
   C.addTransition(
       State->BindExpr(Call.getOriginExpr(), C.getLocationContext(), V, false),
       Tag);
 }
 
+static void addInstanceOfTransition(const CallEvent &Call,
+                                    DefinedOrUnknownSVal DV,
+                                    ProgramStateRef State, CheckerContext &C,
+                                    bool IsInstanceOf) {
+  const auto *CE = cast<CallExpr>(Call.getOriginExpr());
+
+  const DeclRefExpr *DRE = nullptr;
+  const Stmt *Body = CE->getCalleeDecl()->getBody();
+  if (Body)
+    DRE = dyn_cast<DeclRefExpr>(Body);
+
+  if (!Body || !DRE)
+    DRE = dyn_cast<DeclRefExpr>(CE->getCallee()->IgnoreParenImpCasts());
+
+  QualType CastToTy = DRE->getTemplateArgs()->getArgument().getAsType();
+  QualType CastFromTy = getRecordType(Call.parameters()[0]->getType());
+
+  const DynamicCastInfo *Cast = getDynamicCastInfo(State, CastFromTy, CastToTy);
+
+  bool IsCastSucceeds;
+  if (Cast)
+    IsCastSucceeds = IsInstanceOf && Cast->isSucceeds();
+  else
+    IsCastSucceeds = IsInstanceOf || CastFromTy == CastToTy;
+
+  if (isInfeasibleCast(Cast, IsCastSucceeds)) {
+    C.generateSink(State, C.getPredecessor());
+    return;
+  }
+
+  // Store the type and the cast information.
+  const MemRegion *MR = DV.getAsRegion();
+  bool IsKnownCast = Cast || CastFromTy == CastToTy;
+  if (!IsKnownCast)
+    State = setDynamicTypeAndCastInfo(State, MR, CastFromTy, CastToTy,
+                                      Call.getResultType(), IsInstanceOf);
+
+  std::string ObjectName = Lexer::getSourceText(
+      CharSourceRange::getTokenRange(CE->getArg(0)->getSourceRange()),
+      C.getSourceManager(), C.getASTContext().getLangOpts());
+
+  const NoteTag *Tag = C.getNoteTag(
+      [=](BugReport &) -> std::string {
+        SmallString<128> Msg;
+        llvm::raw_svector_ostream Out(Msg);
+
+        Out << (IsKnownCast ? "'" : "Assuming '") << ObjectName
+            << "' with type '"
+            << CastFromTy->getAsCXXRecordDecl()->getNameAsString() << "' ";
+
+        if (CastFromTy != CastToTy) {
+          Out << (IsInstanceOf ? "is also an" : "is not the") << " instance of";
+        } else {
+          Out << "is a";
+        };
+
+        Out << " '" << CastToTy->getAsCXXRecordDecl()->getNameAsString()
+            << '\'';
+
+        return Out.str();
+      },
+      /*IsPrunable=*/true);
+
+  C.addTransition(
+      State->BindExpr(CE, C.getLocationContext(),
+                      C.getSValBuilder().makeTruthVal(IsInstanceOf)),
+      Tag);
+}
+
 //===----------------------------------------------------------------------===//
 // Evaluating cast, dyn_cast, cast_or_null, dyn_cast_or_null.
 //===----------------------------------------------------------------------===//
 
 static void evalNonNullParamNonNullReturn(const CallEvent &Call,
                                           DefinedOrUnknownSVal DV,
                                           CheckerContext &C,
                                           bool IsCheckedCast = false) {

 
 void CastValueChecker::evalGetAs(const CallEvent &Call, DefinedOrUnknownSVal DV,
                                  CheckerContext &C) const {
   evalZeroParamNonNullReturn(Call, DV, C);
   evalZeroParamNullReturn(Call, DV, C);
 }
 
 //===----------------------------------------------------------------------===//
+// Evaluating isa, isa_and_nonnull.
+//===----------------------------------------------------------------------===//
+
+void CastValueChecker::evalIsa(const CallEvent &Call, DefinedOrUnknownSVal DV,
+                               CheckerContext &C) const {
+  ProgramStateRef NonNullState, NullState;
+  std::tie(NonNullState, NullState) = C.getState()->assume(DV);
+
+  if (NonNullState) {
+    addInstanceOfTransition(Call, DV, NonNullState, C, /*IsInstanceOf=*/true);
+    addInstanceOfTransition(Call, DV, NonNullState, C, /*IsInstanceOf=*/false);
+  }
+
+  if (NullState) {
+    C.generateSink(NullState, C.getPredecessor());
+  }
+}
+
+void CastValueChecker::evalIsaAndNonNull(const CallEvent &Call,
+                                         DefinedOrUnknownSVal DV,
+                                         CheckerContext &C) const {
+  ProgramStateRef NonNullState, NullState;
+  std::tie(NonNullState, NullState) = C.getState()->assume(DV);
+
+  if (NonNullState) {
+    addInstanceOfTransition(Call, DV, NonNullState, C, /*IsInstanceOf=*/true);
+    addInstanceOfTransition(Call, DV, NonNullState, C, /*IsInstanceOf=*/false);
+  }
+
+  if (NullState) {
+    addInstanceOfTransition(Call, DV, NullState, C, /*IsInstanceOf=*/false);
+  }
+}
+
+//===----------------------------------------------------------------------===//
 // Main logic to evaluate a call.
 //===----------------------------------------------------------------------===//
 
 bool CastValueChecker::evalCall(const CallEvent &Call,
                                 CheckerContext &C) const {
   const auto *Lookup = CDM.lookup(Call);
   if (!Lookup)
     return false;
 
+  const CastCheck &Check = Lookup->first;
+  CallKind Kind = Lookup->second;
+
   // We need to obtain the record type of the call's result to model it.
-  if (!Call.getResultType()->getPointeeCXXRecordDecl())
+  QualType ResultTy = Call.getResultType();
+  if (Kind != CallKind::InstanceOf && !ResultTy->getPointeeCXXRecordDecl())
     return false;
 
-  const CastCheck &Check = Lookup->first;
-  CallKind Kind = Lookup->second;
+  const auto *CE = cast<CallExpr>(Call.getOriginExpr());
   Optional<DefinedOrUnknownSVal> DV;
 
   switch (Kind) {
   case CallKind::Function: {
     // We need to obtain the record type of the call's parameter to model it.
     QualType ArgTy = Call.parameters()[0]->getType();
     if (!ArgTy->getAsCXXRecordDecl() && !ArgTy->getPointeeCXXRecordDecl())
       return false;
 
     DV = Call.getArgSVal(0).getAs<DefinedOrUnknownSVal>();
     break;
   }
+  case CallKind::InstanceOf: {
+    // If we cannot obtain the call's 'DRE' we cannot be sure how to model it.
+    const DeclRefExpr *DRE = nullptr;
+    const Stmt *Body = CE->getCalleeDecl()->getBody();
+    if (Body)
+      DRE = dyn_cast<DeclRefExpr>(Body);
+
+    if (!Body || !DRE)
+      DRE = dyn_cast<DeclRefExpr>(CE->getCallee()->IgnoreParenImpCasts());
+
+    // We have to obtain the only template argument to determinte the type.
+    if (!DRE || !DRE->getTemplateArgs())
+      return false;
+
+    DV = Call.getArgSVal(0).getAs<DefinedOrUnknownSVal>();
+    break;
+  }
   case CallKind::Method:
     const auto *InstanceCall = dyn_cast<CXXInstanceCall>(&Call);
     if (!InstanceCall)
       return false;
 
     DV = InstanceCall->getCXXThisVal().getAs<DefinedOrUnknownSVal>();
     break;
   }

clang/test/Analysis/cast-value-notes.cpp

 // RUN: %clang_analyze_cc1 \
-// RUN:  -analyzer-checker=core,apiModeling.llvm.CastValue \
+// RUN:  -analyzer-checker=core,apiModeling.llvm.CastValue,debug.ExprInspection\
 // RUN:  -analyzer-output=text -verify %s
 
 namespace llvm {
 template <class X, class Y>
 const X *cast(Y Value);
 
 template <class X, class Y>
 const X *dyn_cast(Y *Value);
 template <class X, class Y>
 const X &dyn_cast(Y &Value);
 
 template <class X, class Y>
 const X *cast_or_null(Y Value);
 
 template <class X, class Y>
 const X *dyn_cast_or_null(Y *Value);
 template <class X, class Y>
 const X *dyn_cast_or_null(Y &Value);
+
+template <class X, class Y>
+bool isa(Y Value);
+
+template <class X, class Y>
+bool isa_and_nonnull(Y Value);
 } // namespace llvm
 
 namespace clang {
 struct Shape {
   template <typename T>
   const T *castAs() const;
 
   template <typename T>
   const T *getAs() const;
void evalNonNullParamNonNullReturnReference(const Shape &S) {
   }
 
   if (dyn_cast_or_null<Triangle>(C)) {
     // expected-note@-1 {{Dynamic cast from 'Circle' to 'Triangle' fails}}
     // expected-note@-2 {{Taking false branch}}
     return;
   }
 
+  if (isa<Triangle>(C)) {
+    // expected-note@-1 {{'C' with type 'Circle' is not the instance of 'Triangle'}}
+    // expected-note@-2 {{Taking false branch}}
+    return;
+  }
+
+  if (isa<Circle>(C)) {
+    // expected-note@-1 {{'C' with type 'Circle' is a 'Circle'}}
+    // expected-note@-2 {{Taking true branch}}
+
     (void)(1 / !C);
     // expected-note@-1 {{'C' is non-null}}
     // expected-note@-2 {{Division by zero}}
     // expected-warning@-3 {{Division by zero}}
   }
+}
 
 void evalNonNullParamNonNullReturn(const Shape *S) {
   const auto *C = cast<Circle>(S);
   // expected-note@-1 {{Checked cast from 'Shape' to 'Circle' succeeds}}
   // expected-note@-2 {{'C' initialized here}}
 
-  if (!cast<Triangle>(C)) {
-    // expected-note@-1 {{Checked cast from 'Circle' to 'Triangle' succeeds}}
+  if (isa<Triangle>(C)) {
+    // expected-note@-1 {{Assuming 'C' with type 'Circle' is not the instance of 'Triangle'}}
+    // expected-note@-2 {{Taking false branch}}
+    return;
+  }
+
+  if (isa<Triangle>(C)) {
+    // expected-note@-1 {{'C' with type 'Circle' is not the instance of 'Triangle'}}
     // expected-note@-2 {{Taking false branch}}
     return;
   }
 
   (void)(1 / !C);
   // expected-note@-1 {{'C' is non-null}}
   // expected-note@-2 {{Division by zero}}
   // expected-warning@-3 {{Division by zero}}