[analyze] Add better support for leaks (and similar diagnostics)

[vsavchenko]

Summary

In addition to the actual bug location, we can check if the uniqueing
location has user-provided suppressions.

[vsavchenko]

This change was squashed into https://reviews.llvm.org/D93110

[steakhal]

For the record, please rename this revision to have the analyzer tag.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugSuppression.h

 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/SmallVector.h"
 
 namespace clang {
 class Decl;
 
 namespace ento {
 class BugReport;
+class PathDiagnosticLocation;
 
 class BugSuppression {
 public:
   /// Return true if the given bug report was explicitly suppressed by the user.
   bool isSuppressed(const BugReport &);
+  /// Return true if the bug reported at the given location was explicitly
+  /// suppressed by the user.
+  bool isSuppressed(const PathDiagnosticLocation &Location,
+                    const Decl *DeclWithIssue);
 
 private:
   // Overly pessimistic number, to be honest.
   static constexpr unsigned EXPECTED_NUMBER_OF_SUPPRESSIONS = 8;
   using CachedRanges =
       llvm::SmallVector<SourceRange, EXPECTED_NUMBER_OF_SUPPRESSIONS>;
 
   llvm::DenseMap<const Decl *, CachedRanges> CachedSuppressionLocations;
 };
 
 } // end namespace ento
 } // end namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_SUPPTRESSION_H

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

PathSensitiveBugReport::getRanges() const {
   // If no custom ranges, add the range of the statement corresponding to
   // the error node.
   if (Ranges.empty() && isa_and_nonnull<Expr>(getStmt()))
       return ErrorNodeRange;
 
   return Ranges;
 }
 
-PathDiagnosticLocation
-PathSensitiveBugReport::getLocation() const {
+PathDiagnosticLocation PathSensitiveBugReport::getLocation() const {
   assert(ErrorNode && "Cannot create a location with a null node.");
   const Stmt *S = ErrorNode->getStmtForDiagnostics();
-    ProgramPoint P = ErrorNode->getLocation();
   const LocationContext *LC = P.getLocationContext();
   SourceManager &SM =
       ErrorNode->getState()->getStateManager().getContext().getSourceManager();
 
   if (!S) {
     // If this is an implicit call, return the implicit call point location.
     if (Optional<PreImplicitCall> PIE = P.getAs<PreImplicitCall>())
       return PathDiagnosticLocation(PIE->getLocation(), SM);
     if (auto FE = P.getAs<FunctionExitPoint>()) {
       if (const ReturnStmt *RS = FE->getStmt())
         return PathDiagnosticLocation::createBegin(RS, SM, LC);
     }
     S = ErrorNode->getNextStmtForDiagnostics();
   }
 
   if (S) {
+    // Attributed statements usually have corrupted begin locations,
+    // it's OK to ignore attributes for our purposes and deal with
+    // the actual annotated statement.
+    if (const auto *AS = dyn_cast<AttributedStmt>(S))
+      S = AS->getSubStmt();
+
     // For member expressions, return the location of the '.' or '->'.
     if (const auto *ME = dyn_cast<MemberExpr>(S))
       return PathDiagnosticLocation::createMemberLoc(ME, SM);
 
     // For binary operators, return the location of the operator.
     if (const auto *B = dyn_cast<BinaryOperator>(S))
       return PathDiagnosticLocation::createOperatorLoc(B, SM);
 

clang/lib/StaticAnalyzer/Core/BugSuppression.cpp

 
 // TODO: Introduce stable IDs for checkers and check for those here
 //       to be more specific.  Attribute without arguments should still
 //       be considered as "suppress all".
 //       It is already much finer granularity than what we have now
 //       (i.e. removing the whole function from the analysis).
 bool BugSuppression::isSuppressed(const BugReport &R) {
   PathDiagnosticLocation Location = R.getLocation();
+  PathDiagnosticLocation UniqueingLocation = R.getUniqueingLocation();
   const Decl *DeclWithIssue = R.getDeclWithIssue();
 
+  return isSuppressed(Location, DeclWithIssue) ||
+         isSuppressed(UniqueingLocation, DeclWithIssue);
+}
+
+bool BugSuppression::isSuppressed(const PathDiagnosticLocation &Location,
+                                  const Decl *DeclWithIssue) {
   if (!Location.isValid() || DeclWithIssue == nullptr)
     return false;
 
   // There are two scenarios for suppressions:
   //
   //    1. warning is in the declaration's body
   //    2. warning is somewhere else
   //

clang/test/Analysis/suppression-attr.m

 // RUN: %clang_analyze_cc1 -fblocks \
 // RUN:   -analyzer-checker=core \
 // RUN:   -analyzer-checker=osx.cocoa.MissingSuperCall \
 // RUN:   -analyzer-checker=osx.cocoa.NSError \
 // RUN:   -analyzer-checker=osx.ObjCProperty \
 // RUN:   -analyzer-checker=osx.cocoa.RetainCount \
+// RUN:   -analyzer-checker=unix.Malloc \
 // RUN:   -analyzer-checker=alpha.core.CastToStruct \
 // RUN:   -Wno-unused-value -Wno-objc-root-class -verify %s
 
 #define SUPPRESS __attribute__((suppress))
 
 @protocol NSObject
 - (id)retain;
 - (oneway void)release;

 @interface NSError : NSObject <NSCopying, NSCoding> {
 }
 + (id)errorWithDomain:(NSString *)domain code:(NSInteger)code userInfo:(NSDictionary *)dict;
 @end
 
 @interface NSMutableString : NSObject
 @end
 
+typedef unsigned long size_t;
+void *malloc(size_t);
+void free(void *);
+
 void dereference_1() {
   int *x = 0;
   *x; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
 }
 
 void dereference_suppression_1() {
   int *x = 0;
   SUPPRESS { *x; } // no-warning
void dereference_4() {
   int y = *x; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
 }
 
 void dereference_suppression_4() {
   int *x = 0;
   SUPPRESS int y = *x; // no-warning
 }
 
+int malloc_leak_1() {
+  int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+  return *x; // expected-warning{{Potential leak of memory pointed to by 'x'}}
+}
+
+int malloc_leak_suppression_1_1() {
+  SUPPRESS int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+  return *x;
+}
+
+int malloc_leak_suppression_1_2() {
+  int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+  SUPPRESS return *x;
+}
+
+void malloc_leak_2() {
+  int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+} // expected-warning{{Potential leak of memory pointed to by 'x'}}
+
+void malloc_leak_suppression_2_1() {
+  SUPPRESS int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+}
+
+void malloc_leak_suppression_2_2() SUPPRESS {
+  int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+}
+
+SUPPRESS void malloc_leak_suppression_2_3() {
+  int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+}
+
+void malloc_leak_suppression_2_4(int cond) {
+  int *x = (int *)malloc(sizeof(int));
+  *x = 42;
+  SUPPRESS;
+}
+
 void retain_release_leak_1() {
   [[NSMutableString alloc] init]; // expected-warning{{Potential leak of an object of type 'NSMutableString *'}}
 }
 
 void retain_release_leak_suppression_1() {
   SUPPRESS { [[NSMutableString alloc] init]; }
 }