xref: /openbsd-src/gnu/llvm/clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp (revision 12c855180aad702bbcca06e0398d774beeafb155)
1e5dd7070Spatrick // MoveChecker.cpp - Check use of moved-from objects. - C++ ---------------===//
2e5dd7070Spatrick //
3e5dd7070Spatrick // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4e5dd7070Spatrick // See https://llvm.org/LICENSE.txt for license information.
5e5dd7070Spatrick // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6e5dd7070Spatrick //
7e5dd7070Spatrick //===----------------------------------------------------------------------===//
8e5dd7070Spatrick //
9e5dd7070Spatrick // This defines checker which checks for potential misuses of a moved-from
10e5dd7070Spatrick // object. That means method calls on the object or copying it in moved-from
11e5dd7070Spatrick // state.
12e5dd7070Spatrick //
13e5dd7070Spatrick //===----------------------------------------------------------------------===//
14e5dd7070Spatrick 
15e5dd7070Spatrick #include "clang/AST/Attr.h"
16e5dd7070Spatrick #include "clang/AST/ExprCXX.h"
17e5dd7070Spatrick #include "clang/Driver/DriverDiagnostic.h"
18e5dd7070Spatrick #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
19e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/Checker.h"
21e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/CheckerManager.h"
22e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
23e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24e5dd7070Spatrick #include "llvm/ADT/StringSet.h"
25e5dd7070Spatrick 
26e5dd7070Spatrick using namespace clang;
27e5dd7070Spatrick using namespace ento;
28e5dd7070Spatrick 
29e5dd7070Spatrick namespace {
30e5dd7070Spatrick struct RegionState {
31e5dd7070Spatrick private:
32e5dd7070Spatrick   enum Kind { Moved, Reported } K;
RegionState__anon4e3ee8f10111::RegionState33e5dd7070Spatrick   RegionState(Kind InK) : K(InK) {}
34e5dd7070Spatrick 
35e5dd7070Spatrick public:
isReported__anon4e3ee8f10111::RegionState36e5dd7070Spatrick   bool isReported() const { return K == Reported; }
isMoved__anon4e3ee8f10111::RegionState37e5dd7070Spatrick   bool isMoved() const { return K == Moved; }
38e5dd7070Spatrick 
getReported__anon4e3ee8f10111::RegionState39e5dd7070Spatrick   static RegionState getReported() { return RegionState(Reported); }
getMoved__anon4e3ee8f10111::RegionState40e5dd7070Spatrick   static RegionState getMoved() { return RegionState(Moved); }
41e5dd7070Spatrick 
operator ==__anon4e3ee8f10111::RegionState42e5dd7070Spatrick   bool operator==(const RegionState &X) const { return K == X.K; }
Profile__anon4e3ee8f10111::RegionState43e5dd7070Spatrick   void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(K); }
44e5dd7070Spatrick };
45e5dd7070Spatrick } // end of anonymous namespace
46e5dd7070Spatrick 
47e5dd7070Spatrick namespace {
48e5dd7070Spatrick class MoveChecker
49e5dd7070Spatrick     : public Checker<check::PreCall, check::PostCall,
50e5dd7070Spatrick                      check::DeadSymbols, check::RegionChanges> {
51e5dd7070Spatrick public:
52e5dd7070Spatrick   void checkPreCall(const CallEvent &MC, CheckerContext &C) const;
53e5dd7070Spatrick   void checkPostCall(const CallEvent &MC, CheckerContext &C) const;
54e5dd7070Spatrick   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
55e5dd7070Spatrick   ProgramStateRef
56e5dd7070Spatrick   checkRegionChanges(ProgramStateRef State,
57e5dd7070Spatrick                      const InvalidatedSymbols *Invalidated,
58e5dd7070Spatrick                      ArrayRef<const MemRegion *> RequestedRegions,
59e5dd7070Spatrick                      ArrayRef<const MemRegion *> InvalidatedRegions,
60e5dd7070Spatrick                      const LocationContext *LCtx, const CallEvent *Call) const;
61e5dd7070Spatrick   void printState(raw_ostream &Out, ProgramStateRef State,
62e5dd7070Spatrick                   const char *NL, const char *Sep) const override;
63e5dd7070Spatrick 
64e5dd7070Spatrick private:
65e5dd7070Spatrick   enum MisuseKind { MK_FunCall, MK_Copy, MK_Move, MK_Dereference };
66e5dd7070Spatrick   enum StdObjectKind { SK_NonStd, SK_Unsafe, SK_Safe, SK_SmartPtr };
67e5dd7070Spatrick 
68e5dd7070Spatrick   enum AggressivenessKind { // In any case, don't warn after a reset.
69e5dd7070Spatrick     AK_Invalid = -1,
70e5dd7070Spatrick     AK_KnownsOnly = 0,      // Warn only about known move-unsafe classes.
71e5dd7070Spatrick     AK_KnownsAndLocals = 1, // Also warn about all local objects.
72e5dd7070Spatrick     AK_All = 2,             // Warn on any use-after-move.
73e5dd7070Spatrick     AK_NumKinds = AK_All
74e5dd7070Spatrick   };
75e5dd7070Spatrick 
misuseCausesCrash(MisuseKind MK)76e5dd7070Spatrick   static bool misuseCausesCrash(MisuseKind MK) {
77e5dd7070Spatrick     return MK == MK_Dereference;
78e5dd7070Spatrick   }
79e5dd7070Spatrick 
80e5dd7070Spatrick   struct ObjectKind {
81e5dd7070Spatrick     // Is this a local variable or a local rvalue reference?
82e5dd7070Spatrick     bool IsLocal;
83e5dd7070Spatrick     // Is this an STL object? If so, of what kind?
84e5dd7070Spatrick     StdObjectKind StdKind;
85e5dd7070Spatrick   };
86e5dd7070Spatrick 
87e5dd7070Spatrick   // STL smart pointers are automatically re-initialized to null when moved
88e5dd7070Spatrick   // from. So we can't warn on many methods, but we can warn when it is
89e5dd7070Spatrick   // dereferenced, which is UB even if the resulting lvalue never gets read.
90e5dd7070Spatrick   const llvm::StringSet<> StdSmartPtrClasses = {
91e5dd7070Spatrick       "shared_ptr",
92e5dd7070Spatrick       "unique_ptr",
93e5dd7070Spatrick       "weak_ptr",
94e5dd7070Spatrick   };
95e5dd7070Spatrick 
96e5dd7070Spatrick   // Not all of these are entirely move-safe, but they do provide *some*
97e5dd7070Spatrick   // guarantees, and it means that somebody is using them after move
98e5dd7070Spatrick   // in a valid manner.
99e5dd7070Spatrick   // TODO: We can still try to identify *unsafe* use after move,
100e5dd7070Spatrick   // like we did with smart pointers.
101e5dd7070Spatrick   const llvm::StringSet<> StdSafeClasses = {
102e5dd7070Spatrick       "basic_filebuf",
103e5dd7070Spatrick       "basic_ios",
104e5dd7070Spatrick       "future",
105e5dd7070Spatrick       "optional",
106a9ac8606Spatrick       "packaged_task",
107e5dd7070Spatrick       "promise",
108e5dd7070Spatrick       "shared_future",
109e5dd7070Spatrick       "shared_lock",
110e5dd7070Spatrick       "thread",
111e5dd7070Spatrick       "unique_lock",
112e5dd7070Spatrick   };
113e5dd7070Spatrick 
114e5dd7070Spatrick   // Should we bother tracking the state of the object?
shouldBeTracked(ObjectKind OK) const115e5dd7070Spatrick   bool shouldBeTracked(ObjectKind OK) const {
116e5dd7070Spatrick     // In non-aggressive mode, only warn on use-after-move of local variables
117e5dd7070Spatrick     // (or local rvalue references) and of STL objects. The former is possible
118e5dd7070Spatrick     // because local variables (or local rvalue references) are not tempting
119e5dd7070Spatrick     // their user to re-use the storage. The latter is possible because STL
120e5dd7070Spatrick     // objects are known to end up in a valid but unspecified state after the
121e5dd7070Spatrick     // move and their state-reset methods are also known, which allows us to
122e5dd7070Spatrick     // predict precisely when use-after-move is invalid.
123e5dd7070Spatrick     // Some STL objects are known to conform to additional contracts after move,
124e5dd7070Spatrick     // so they are not tracked. However, smart pointers specifically are tracked
125e5dd7070Spatrick     // because we can perform extra checking over them.
126e5dd7070Spatrick     // In aggressive mode, warn on any use-after-move because the user has
127e5dd7070Spatrick     // intentionally asked us to completely eliminate use-after-move
128e5dd7070Spatrick     // in his code.
129e5dd7070Spatrick     return (Aggressiveness == AK_All) ||
130e5dd7070Spatrick            (Aggressiveness >= AK_KnownsAndLocals && OK.IsLocal) ||
131e5dd7070Spatrick            OK.StdKind == SK_Unsafe || OK.StdKind == SK_SmartPtr;
132e5dd7070Spatrick   }
133e5dd7070Spatrick 
134e5dd7070Spatrick   // Some objects only suffer from some kinds of misuses, but we need to track
135e5dd7070Spatrick   // them anyway because we cannot know in advance what misuse will we find.
shouldWarnAbout(ObjectKind OK,MisuseKind MK) const136e5dd7070Spatrick   bool shouldWarnAbout(ObjectKind OK, MisuseKind MK) const {
137e5dd7070Spatrick     // Additionally, only warn on smart pointers when they are dereferenced (or
138e5dd7070Spatrick     // local or we are aggressive).
139e5dd7070Spatrick     return shouldBeTracked(OK) &&
140e5dd7070Spatrick            ((Aggressiveness == AK_All) ||
141e5dd7070Spatrick             (Aggressiveness >= AK_KnownsAndLocals && OK.IsLocal) ||
142e5dd7070Spatrick             OK.StdKind != SK_SmartPtr || MK == MK_Dereference);
143e5dd7070Spatrick   }
144e5dd7070Spatrick 
145e5dd7070Spatrick   // Obtains ObjectKind of an object. Because class declaration cannot always
146e5dd7070Spatrick   // be easily obtained from the memory region, it is supplied separately.
147e5dd7070Spatrick   ObjectKind classifyObject(const MemRegion *MR, const CXXRecordDecl *RD) const;
148e5dd7070Spatrick 
149e5dd7070Spatrick   // Classifies the object and dumps a user-friendly description string to
150e5dd7070Spatrick   // the stream.
151e5dd7070Spatrick   void explainObject(llvm::raw_ostream &OS, const MemRegion *MR,
152e5dd7070Spatrick                      const CXXRecordDecl *RD, MisuseKind MK) const;
153e5dd7070Spatrick 
154e5dd7070Spatrick   bool belongsTo(const CXXRecordDecl *RD, const llvm::StringSet<> &Set) const;
155e5dd7070Spatrick 
156e5dd7070Spatrick   class MovedBugVisitor : public BugReporterVisitor {
157e5dd7070Spatrick   public:
MovedBugVisitor(const MoveChecker & Chk,const MemRegion * R,const CXXRecordDecl * RD,MisuseKind MK)158e5dd7070Spatrick     MovedBugVisitor(const MoveChecker &Chk, const MemRegion *R,
159e5dd7070Spatrick                     const CXXRecordDecl *RD, MisuseKind MK)
160e5dd7070Spatrick         : Chk(Chk), Region(R), RD(RD), MK(MK), Found(false) {}
161e5dd7070Spatrick 
Profile(llvm::FoldingSetNodeID & ID) const162e5dd7070Spatrick     void Profile(llvm::FoldingSetNodeID &ID) const override {
163e5dd7070Spatrick       static int X = 0;
164e5dd7070Spatrick       ID.AddPointer(&X);
165e5dd7070Spatrick       ID.AddPointer(Region);
166e5dd7070Spatrick       // Don't add RD because it's, in theory, uniquely determined by
167e5dd7070Spatrick       // the region. In practice though, it's not always possible to obtain
168e5dd7070Spatrick       // the declaration directly from the region, that's why we store it
169e5dd7070Spatrick       // in the first place.
170e5dd7070Spatrick     }
171e5dd7070Spatrick 
172e5dd7070Spatrick     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
173e5dd7070Spatrick                                      BugReporterContext &BRC,
174e5dd7070Spatrick                                      PathSensitiveBugReport &BR) override;
175e5dd7070Spatrick 
176e5dd7070Spatrick   private:
177e5dd7070Spatrick     const MoveChecker &Chk;
178e5dd7070Spatrick     // The tracked region.
179e5dd7070Spatrick     const MemRegion *Region;
180e5dd7070Spatrick     // The class of the tracked object.
181e5dd7070Spatrick     const CXXRecordDecl *RD;
182e5dd7070Spatrick     // How exactly the object was misused.
183e5dd7070Spatrick     const MisuseKind MK;
184e5dd7070Spatrick     bool Found;
185e5dd7070Spatrick   };
186e5dd7070Spatrick 
187e5dd7070Spatrick   AggressivenessKind Aggressiveness;
188e5dd7070Spatrick 
189e5dd7070Spatrick public:
setAggressiveness(StringRef Str,CheckerManager & Mgr)190e5dd7070Spatrick   void setAggressiveness(StringRef Str, CheckerManager &Mgr) {
191e5dd7070Spatrick     Aggressiveness =
192e5dd7070Spatrick         llvm::StringSwitch<AggressivenessKind>(Str)
193e5dd7070Spatrick             .Case("KnownsOnly", AK_KnownsOnly)
194e5dd7070Spatrick             .Case("KnownsAndLocals", AK_KnownsAndLocals)
195e5dd7070Spatrick             .Case("All", AK_All)
196e5dd7070Spatrick             .Default(AK_Invalid);
197e5dd7070Spatrick 
198e5dd7070Spatrick     if (Aggressiveness == AK_Invalid)
199e5dd7070Spatrick       Mgr.reportInvalidCheckerOptionValue(this, "WarnOn",
200e5dd7070Spatrick           "either \"KnownsOnly\", \"KnownsAndLocals\" or \"All\" string value");
201e5dd7070Spatrick   };
202e5dd7070Spatrick 
203e5dd7070Spatrick private:
204a9ac8606Spatrick   BugType BT{this, "Use-after-move", categories::CXXMoveSemantics};
205e5dd7070Spatrick 
206e5dd7070Spatrick   // Check if the given form of potential misuse of a given object
207e5dd7070Spatrick   // should be reported. If so, get it reported. The callback from which
208e5dd7070Spatrick   // this function was called should immediately return after the call
209e5dd7070Spatrick   // because this function adds one or two transitions.
210e5dd7070Spatrick   void modelUse(ProgramStateRef State, const MemRegion *Region,
211e5dd7070Spatrick                 const CXXRecordDecl *RD, MisuseKind MK,
212e5dd7070Spatrick                 CheckerContext &C) const;
213e5dd7070Spatrick 
214e5dd7070Spatrick   // Returns the exploded node against which the report was emitted.
215e5dd7070Spatrick   // The caller *must* add any further transitions against this node.
216e5dd7070Spatrick   ExplodedNode *reportBug(const MemRegion *Region, const CXXRecordDecl *RD,
217e5dd7070Spatrick                           CheckerContext &C, MisuseKind MK) const;
218e5dd7070Spatrick 
219e5dd7070Spatrick   bool isInMoveSafeContext(const LocationContext *LC) const;
220e5dd7070Spatrick   bool isStateResetMethod(const CXXMethodDecl *MethodDec) const;
221e5dd7070Spatrick   bool isMoveSafeMethod(const CXXMethodDecl *MethodDec) const;
222e5dd7070Spatrick   const ExplodedNode *getMoveLocation(const ExplodedNode *N,
223e5dd7070Spatrick                                       const MemRegion *Region,
224e5dd7070Spatrick                                       CheckerContext &C) const;
225e5dd7070Spatrick };
226e5dd7070Spatrick } // end anonymous namespace
227e5dd7070Spatrick 
228e5dd7070Spatrick REGISTER_MAP_WITH_PROGRAMSTATE(TrackedRegionMap, const MemRegion *, RegionState)
229e5dd7070Spatrick 
230e5dd7070Spatrick // Define the inter-checker API.
231e5dd7070Spatrick namespace clang {
232e5dd7070Spatrick namespace ento {
233e5dd7070Spatrick namespace move {
isMovedFrom(ProgramStateRef State,const MemRegion * Region)234e5dd7070Spatrick bool isMovedFrom(ProgramStateRef State, const MemRegion *Region) {
235e5dd7070Spatrick   const RegionState *RS = State->get<TrackedRegionMap>(Region);
236e5dd7070Spatrick   return RS && (RS->isMoved() || RS->isReported());
237e5dd7070Spatrick }
238e5dd7070Spatrick } // namespace move
239e5dd7070Spatrick } // namespace ento
240e5dd7070Spatrick } // namespace clang
241e5dd7070Spatrick 
242e5dd7070Spatrick // If a region is removed all of the subregions needs to be removed too.
removeFromState(ProgramStateRef State,const MemRegion * Region)243e5dd7070Spatrick static ProgramStateRef removeFromState(ProgramStateRef State,
244e5dd7070Spatrick                                        const MemRegion *Region) {
245e5dd7070Spatrick   if (!Region)
246e5dd7070Spatrick     return State;
247e5dd7070Spatrick   for (auto &E : State->get<TrackedRegionMap>()) {
248e5dd7070Spatrick     if (E.first->isSubRegionOf(Region))
249e5dd7070Spatrick       State = State->remove<TrackedRegionMap>(E.first);
250e5dd7070Spatrick   }
251e5dd7070Spatrick   return State;
252e5dd7070Spatrick }
253e5dd7070Spatrick 
isAnyBaseRegionReported(ProgramStateRef State,const MemRegion * Region)254e5dd7070Spatrick static bool isAnyBaseRegionReported(ProgramStateRef State,
255e5dd7070Spatrick                                     const MemRegion *Region) {
256e5dd7070Spatrick   for (auto &E : State->get<TrackedRegionMap>()) {
257e5dd7070Spatrick     if (Region->isSubRegionOf(E.first) && E.second.isReported())
258e5dd7070Spatrick       return true;
259e5dd7070Spatrick   }
260e5dd7070Spatrick   return false;
261e5dd7070Spatrick }
262e5dd7070Spatrick 
unwrapRValueReferenceIndirection(const MemRegion * MR)263e5dd7070Spatrick static const MemRegion *unwrapRValueReferenceIndirection(const MemRegion *MR) {
264e5dd7070Spatrick   if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(MR)) {
265e5dd7070Spatrick     SymbolRef Sym = SR->getSymbol();
266e5dd7070Spatrick     if (Sym->getType()->isRValueReferenceType())
267e5dd7070Spatrick       if (const MemRegion *OriginMR = Sym->getOriginRegion())
268e5dd7070Spatrick         return OriginMR;
269e5dd7070Spatrick   }
270e5dd7070Spatrick   return MR;
271e5dd7070Spatrick }
272e5dd7070Spatrick 
273e5dd7070Spatrick PathDiagnosticPieceRef
VisitNode(const ExplodedNode * N,BugReporterContext & BRC,PathSensitiveBugReport & BR)274e5dd7070Spatrick MoveChecker::MovedBugVisitor::VisitNode(const ExplodedNode *N,
275e5dd7070Spatrick                                         BugReporterContext &BRC,
276e5dd7070Spatrick                                         PathSensitiveBugReport &BR) {
277e5dd7070Spatrick   // We need only the last move of the reported object's region.
278e5dd7070Spatrick   // The visitor walks the ExplodedGraph backwards.
279e5dd7070Spatrick   if (Found)
280e5dd7070Spatrick     return nullptr;
281e5dd7070Spatrick   ProgramStateRef State = N->getState();
282e5dd7070Spatrick   ProgramStateRef StatePrev = N->getFirstPred()->getState();
283e5dd7070Spatrick   const RegionState *TrackedObject = State->get<TrackedRegionMap>(Region);
284e5dd7070Spatrick   const RegionState *TrackedObjectPrev =
285e5dd7070Spatrick       StatePrev->get<TrackedRegionMap>(Region);
286e5dd7070Spatrick   if (!TrackedObject)
287e5dd7070Spatrick     return nullptr;
288e5dd7070Spatrick   if (TrackedObjectPrev && TrackedObject)
289e5dd7070Spatrick     return nullptr;
290e5dd7070Spatrick 
291e5dd7070Spatrick   // Retrieve the associated statement.
292e5dd7070Spatrick   const Stmt *S = N->getStmtForDiagnostics();
293e5dd7070Spatrick   if (!S)
294e5dd7070Spatrick     return nullptr;
295e5dd7070Spatrick   Found = true;
296e5dd7070Spatrick 
297e5dd7070Spatrick   SmallString<128> Str;
298e5dd7070Spatrick   llvm::raw_svector_ostream OS(Str);
299e5dd7070Spatrick 
300e5dd7070Spatrick   ObjectKind OK = Chk.classifyObject(Region, RD);
301e5dd7070Spatrick   switch (OK.StdKind) {
302e5dd7070Spatrick     case SK_SmartPtr:
303e5dd7070Spatrick       if (MK == MK_Dereference) {
304e5dd7070Spatrick         OS << "Smart pointer";
305e5dd7070Spatrick         Chk.explainObject(OS, Region, RD, MK);
306e5dd7070Spatrick         OS << " is reset to null when moved from";
307e5dd7070Spatrick         break;
308e5dd7070Spatrick       }
309e5dd7070Spatrick 
310e5dd7070Spatrick       // If it's not a dereference, we don't care if it was reset to null
311e5dd7070Spatrick       // or that it is even a smart pointer.
312*12c85518Srobert       [[fallthrough]];
313e5dd7070Spatrick     case SK_NonStd:
314e5dd7070Spatrick     case SK_Safe:
315e5dd7070Spatrick       OS << "Object";
316e5dd7070Spatrick       Chk.explainObject(OS, Region, RD, MK);
317e5dd7070Spatrick       OS << " is moved";
318e5dd7070Spatrick       break;
319e5dd7070Spatrick     case SK_Unsafe:
320e5dd7070Spatrick       OS << "Object";
321e5dd7070Spatrick       Chk.explainObject(OS, Region, RD, MK);
322e5dd7070Spatrick       OS << " is left in a valid but unspecified state after move";
323e5dd7070Spatrick       break;
324e5dd7070Spatrick   }
325e5dd7070Spatrick 
326e5dd7070Spatrick   // Generate the extra diagnostic.
327e5dd7070Spatrick   PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
328e5dd7070Spatrick                              N->getLocationContext());
329e5dd7070Spatrick   return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true);
330e5dd7070Spatrick }
331e5dd7070Spatrick 
getMoveLocation(const ExplodedNode * N,const MemRegion * Region,CheckerContext & C) const332e5dd7070Spatrick const ExplodedNode *MoveChecker::getMoveLocation(const ExplodedNode *N,
333e5dd7070Spatrick                                                  const MemRegion *Region,
334e5dd7070Spatrick                                                  CheckerContext &C) const {
335e5dd7070Spatrick   // Walk the ExplodedGraph backwards and find the first node that referred to
336e5dd7070Spatrick   // the tracked region.
337e5dd7070Spatrick   const ExplodedNode *MoveNode = N;
338e5dd7070Spatrick 
339e5dd7070Spatrick   while (N) {
340e5dd7070Spatrick     ProgramStateRef State = N->getState();
341e5dd7070Spatrick     if (!State->get<TrackedRegionMap>(Region))
342e5dd7070Spatrick       break;
343e5dd7070Spatrick     MoveNode = N;
344e5dd7070Spatrick     N = N->pred_empty() ? nullptr : *(N->pred_begin());
345e5dd7070Spatrick   }
346e5dd7070Spatrick   return MoveNode;
347e5dd7070Spatrick }
348e5dd7070Spatrick 
modelUse(ProgramStateRef State,const MemRegion * Region,const CXXRecordDecl * RD,MisuseKind MK,CheckerContext & C) const349e5dd7070Spatrick void MoveChecker::modelUse(ProgramStateRef State, const MemRegion *Region,
350e5dd7070Spatrick                            const CXXRecordDecl *RD, MisuseKind MK,
351e5dd7070Spatrick                            CheckerContext &C) const {
352e5dd7070Spatrick   assert(!C.isDifferent() && "No transitions should have been made by now");
353e5dd7070Spatrick   const RegionState *RS = State->get<TrackedRegionMap>(Region);
354e5dd7070Spatrick   ObjectKind OK = classifyObject(Region, RD);
355e5dd7070Spatrick 
356e5dd7070Spatrick   // Just in case: if it's not a smart pointer but it does have operator *,
357e5dd7070Spatrick   // we shouldn't call the bug a dereference.
358e5dd7070Spatrick   if (MK == MK_Dereference && OK.StdKind != SK_SmartPtr)
359e5dd7070Spatrick     MK = MK_FunCall;
360e5dd7070Spatrick 
361e5dd7070Spatrick   if (!RS || !shouldWarnAbout(OK, MK)
362e5dd7070Spatrick           || isInMoveSafeContext(C.getLocationContext())) {
363e5dd7070Spatrick     // Finalize changes made by the caller.
364e5dd7070Spatrick     C.addTransition(State);
365e5dd7070Spatrick     return;
366e5dd7070Spatrick   }
367e5dd7070Spatrick 
368e5dd7070Spatrick   // Don't report it in case if any base region is already reported.
369e5dd7070Spatrick   // But still generate a sink in case of UB.
370e5dd7070Spatrick   // And still finalize changes made by the caller.
371e5dd7070Spatrick   if (isAnyBaseRegionReported(State, Region)) {
372e5dd7070Spatrick     if (misuseCausesCrash(MK)) {
373e5dd7070Spatrick       C.generateSink(State, C.getPredecessor());
374e5dd7070Spatrick     } else {
375e5dd7070Spatrick       C.addTransition(State);
376e5dd7070Spatrick     }
377e5dd7070Spatrick     return;
378e5dd7070Spatrick   }
379e5dd7070Spatrick 
380e5dd7070Spatrick   ExplodedNode *N = reportBug(Region, RD, C, MK);
381e5dd7070Spatrick 
382e5dd7070Spatrick   // If the program has already crashed on this path, don't bother.
383e5dd7070Spatrick   if (N->isSink())
384e5dd7070Spatrick     return;
385e5dd7070Spatrick 
386e5dd7070Spatrick   State = State->set<TrackedRegionMap>(Region, RegionState::getReported());
387e5dd7070Spatrick   C.addTransition(State, N);
388e5dd7070Spatrick }
389e5dd7070Spatrick 
reportBug(const MemRegion * Region,const CXXRecordDecl * RD,CheckerContext & C,MisuseKind MK) const390e5dd7070Spatrick ExplodedNode *MoveChecker::reportBug(const MemRegion *Region,
391e5dd7070Spatrick                                      const CXXRecordDecl *RD, CheckerContext &C,
392e5dd7070Spatrick                                      MisuseKind MK) const {
393e5dd7070Spatrick   if (ExplodedNode *N = misuseCausesCrash(MK) ? C.generateErrorNode()
394e5dd7070Spatrick                                               : C.generateNonFatalErrorNode()) {
395e5dd7070Spatrick     // Uniqueing report to the same object.
396e5dd7070Spatrick     PathDiagnosticLocation LocUsedForUniqueing;
397e5dd7070Spatrick     const ExplodedNode *MoveNode = getMoveLocation(N, Region, C);
398e5dd7070Spatrick 
399e5dd7070Spatrick     if (const Stmt *MoveStmt = MoveNode->getStmtForDiagnostics())
400e5dd7070Spatrick       LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
401e5dd7070Spatrick           MoveStmt, C.getSourceManager(), MoveNode->getLocationContext());
402e5dd7070Spatrick 
403e5dd7070Spatrick     // Creating the error message.
404e5dd7070Spatrick     llvm::SmallString<128> Str;
405e5dd7070Spatrick     llvm::raw_svector_ostream OS(Str);
406e5dd7070Spatrick     switch(MK) {
407e5dd7070Spatrick       case MK_FunCall:
408e5dd7070Spatrick         OS << "Method called on moved-from object";
409e5dd7070Spatrick         explainObject(OS, Region, RD, MK);
410e5dd7070Spatrick         break;
411e5dd7070Spatrick       case MK_Copy:
412e5dd7070Spatrick         OS << "Moved-from object";
413e5dd7070Spatrick         explainObject(OS, Region, RD, MK);
414e5dd7070Spatrick         OS << " is copied";
415e5dd7070Spatrick         break;
416e5dd7070Spatrick       case MK_Move:
417e5dd7070Spatrick         OS << "Moved-from object";
418e5dd7070Spatrick         explainObject(OS, Region, RD, MK);
419e5dd7070Spatrick         OS << " is moved";
420e5dd7070Spatrick         break;
421e5dd7070Spatrick       case MK_Dereference:
422e5dd7070Spatrick         OS << "Dereference of null smart pointer";
423e5dd7070Spatrick         explainObject(OS, Region, RD, MK);
424e5dd7070Spatrick         break;
425e5dd7070Spatrick     }
426e5dd7070Spatrick 
427e5dd7070Spatrick     auto R = std::make_unique<PathSensitiveBugReport>(
428a9ac8606Spatrick         BT, OS.str(), N, LocUsedForUniqueing,
429e5dd7070Spatrick         MoveNode->getLocationContext()->getDecl());
430e5dd7070Spatrick     R->addVisitor(std::make_unique<MovedBugVisitor>(*this, Region, RD, MK));
431e5dd7070Spatrick     C.emitReport(std::move(R));
432e5dd7070Spatrick     return N;
433e5dd7070Spatrick   }
434e5dd7070Spatrick   return nullptr;
435e5dd7070Spatrick }
436e5dd7070Spatrick 
checkPostCall(const CallEvent & Call,CheckerContext & C) const437e5dd7070Spatrick void MoveChecker::checkPostCall(const CallEvent &Call,
438e5dd7070Spatrick                                 CheckerContext &C) const {
439e5dd7070Spatrick   const auto *AFC = dyn_cast<AnyFunctionCall>(&Call);
440e5dd7070Spatrick   if (!AFC)
441e5dd7070Spatrick     return;
442e5dd7070Spatrick 
443e5dd7070Spatrick   ProgramStateRef State = C.getState();
444e5dd7070Spatrick   const auto MethodDecl = dyn_cast_or_null<CXXMethodDecl>(AFC->getDecl());
445e5dd7070Spatrick   if (!MethodDecl)
446e5dd7070Spatrick     return;
447e5dd7070Spatrick 
448e5dd7070Spatrick   // Check if an object became moved-from.
449e5dd7070Spatrick   // Object can become moved from after a call to move assignment operator or
450e5dd7070Spatrick   // move constructor .
451e5dd7070Spatrick   const auto *ConstructorDecl = dyn_cast<CXXConstructorDecl>(MethodDecl);
452e5dd7070Spatrick   if (ConstructorDecl && !ConstructorDecl->isMoveConstructor())
453e5dd7070Spatrick     return;
454e5dd7070Spatrick 
455e5dd7070Spatrick   if (!ConstructorDecl && !MethodDecl->isMoveAssignmentOperator())
456e5dd7070Spatrick     return;
457e5dd7070Spatrick 
458e5dd7070Spatrick   const auto ArgRegion = AFC->getArgSVal(0).getAsRegion();
459e5dd7070Spatrick   if (!ArgRegion)
460e5dd7070Spatrick     return;
461e5dd7070Spatrick 
462e5dd7070Spatrick   // Skip moving the object to itself.
463e5dd7070Spatrick   const auto *CC = dyn_cast_or_null<CXXConstructorCall>(&Call);
464e5dd7070Spatrick   if (CC && CC->getCXXThisVal().getAsRegion() == ArgRegion)
465e5dd7070Spatrick     return;
466e5dd7070Spatrick 
467e5dd7070Spatrick   if (const auto *IC = dyn_cast<CXXInstanceCall>(AFC))
468e5dd7070Spatrick     if (IC->getCXXThisVal().getAsRegion() == ArgRegion)
469e5dd7070Spatrick       return;
470e5dd7070Spatrick 
471e5dd7070Spatrick   const MemRegion *BaseRegion = ArgRegion->getBaseRegion();
472e5dd7070Spatrick   // Skip temp objects because of their short lifetime.
473e5dd7070Spatrick   if (BaseRegion->getAs<CXXTempObjectRegion>() ||
474a9ac8606Spatrick       AFC->getArgExpr(0)->isPRValue())
475e5dd7070Spatrick     return;
476e5dd7070Spatrick   // If it has already been reported do not need to modify the state.
477e5dd7070Spatrick 
478e5dd7070Spatrick   if (State->get<TrackedRegionMap>(ArgRegion))
479e5dd7070Spatrick     return;
480e5dd7070Spatrick 
481e5dd7070Spatrick   const CXXRecordDecl *RD = MethodDecl->getParent();
482e5dd7070Spatrick   ObjectKind OK = classifyObject(ArgRegion, RD);
483e5dd7070Spatrick   if (shouldBeTracked(OK)) {
484e5dd7070Spatrick     // Mark object as moved-from.
485e5dd7070Spatrick     State = State->set<TrackedRegionMap>(ArgRegion, RegionState::getMoved());
486e5dd7070Spatrick     C.addTransition(State);
487e5dd7070Spatrick     return;
488e5dd7070Spatrick   }
489e5dd7070Spatrick   assert(!C.isDifferent() && "Should not have made transitions on this path!");
490e5dd7070Spatrick }
491e5dd7070Spatrick 
isMoveSafeMethod(const CXXMethodDecl * MethodDec) const492e5dd7070Spatrick bool MoveChecker::isMoveSafeMethod(const CXXMethodDecl *MethodDec) const {
493e5dd7070Spatrick   // We abandon the cases where bool/void/void* conversion happens.
494e5dd7070Spatrick   if (const auto *ConversionDec =
495e5dd7070Spatrick           dyn_cast_or_null<CXXConversionDecl>(MethodDec)) {
496e5dd7070Spatrick     const Type *Tp = ConversionDec->getConversionType().getTypePtrOrNull();
497e5dd7070Spatrick     if (!Tp)
498e5dd7070Spatrick       return false;
499e5dd7070Spatrick     if (Tp->isBooleanType() || Tp->isVoidType() || Tp->isVoidPointerType())
500e5dd7070Spatrick       return true;
501e5dd7070Spatrick   }
502e5dd7070Spatrick   // Function call `empty` can be skipped.
503e5dd7070Spatrick   return (MethodDec && MethodDec->getDeclName().isIdentifier() &&
504e5dd7070Spatrick       (MethodDec->getName().lower() == "empty" ||
505e5dd7070Spatrick        MethodDec->getName().lower() == "isempty"));
506e5dd7070Spatrick }
507e5dd7070Spatrick 
isStateResetMethod(const CXXMethodDecl * MethodDec) const508e5dd7070Spatrick bool MoveChecker::isStateResetMethod(const CXXMethodDecl *MethodDec) const {
509e5dd7070Spatrick   if (!MethodDec)
510e5dd7070Spatrick       return false;
511e5dd7070Spatrick   if (MethodDec->hasAttr<ReinitializesAttr>())
512e5dd7070Spatrick       return true;
513e5dd7070Spatrick   if (MethodDec->getDeclName().isIdentifier()) {
514e5dd7070Spatrick     std::string MethodName = MethodDec->getName().lower();
515e5dd7070Spatrick     // TODO: Some of these methods (eg., resize) are not always resetting
516e5dd7070Spatrick     // the state, so we should consider looking at the arguments.
517e5dd7070Spatrick     if (MethodName == "assign" || MethodName == "clear" ||
518e5dd7070Spatrick         MethodName == "destroy" || MethodName == "reset" ||
519e5dd7070Spatrick         MethodName == "resize" || MethodName == "shrink")
520e5dd7070Spatrick       return true;
521e5dd7070Spatrick   }
522e5dd7070Spatrick   return false;
523e5dd7070Spatrick }
524e5dd7070Spatrick 
525e5dd7070Spatrick // Don't report an error inside a move related operation.
526e5dd7070Spatrick // We assume that the programmer knows what she does.
isInMoveSafeContext(const LocationContext * LC) const527e5dd7070Spatrick bool MoveChecker::isInMoveSafeContext(const LocationContext *LC) const {
528e5dd7070Spatrick   do {
529e5dd7070Spatrick     const auto *CtxDec = LC->getDecl();
530e5dd7070Spatrick     auto *CtorDec = dyn_cast_or_null<CXXConstructorDecl>(CtxDec);
531e5dd7070Spatrick     auto *DtorDec = dyn_cast_or_null<CXXDestructorDecl>(CtxDec);
532e5dd7070Spatrick     auto *MethodDec = dyn_cast_or_null<CXXMethodDecl>(CtxDec);
533e5dd7070Spatrick     if (DtorDec || (CtorDec && CtorDec->isCopyOrMoveConstructor()) ||
534e5dd7070Spatrick         (MethodDec && MethodDec->isOverloadedOperator() &&
535e5dd7070Spatrick          MethodDec->getOverloadedOperator() == OO_Equal) ||
536e5dd7070Spatrick         isStateResetMethod(MethodDec) || isMoveSafeMethod(MethodDec))
537e5dd7070Spatrick       return true;
538e5dd7070Spatrick   } while ((LC = LC->getParent()));
539e5dd7070Spatrick   return false;
540e5dd7070Spatrick }
541e5dd7070Spatrick 
belongsTo(const CXXRecordDecl * RD,const llvm::StringSet<> & Set) const542e5dd7070Spatrick bool MoveChecker::belongsTo(const CXXRecordDecl *RD,
543e5dd7070Spatrick                             const llvm::StringSet<> &Set) const {
544e5dd7070Spatrick   const IdentifierInfo *II = RD->getIdentifier();
545e5dd7070Spatrick   return II && Set.count(II->getName());
546e5dd7070Spatrick }
547e5dd7070Spatrick 
548e5dd7070Spatrick MoveChecker::ObjectKind
classifyObject(const MemRegion * MR,const CXXRecordDecl * RD) const549e5dd7070Spatrick MoveChecker::classifyObject(const MemRegion *MR,
550e5dd7070Spatrick                             const CXXRecordDecl *RD) const {
551e5dd7070Spatrick   // Local variables and local rvalue references are classified as "Local".
552e5dd7070Spatrick   // For the purposes of this checker, we classify move-safe STL types
553e5dd7070Spatrick   // as not-"STL" types, because that's how the checker treats them.
554e5dd7070Spatrick   MR = unwrapRValueReferenceIndirection(MR);
555*12c85518Srobert   bool IsLocal = isa_and_nonnull<VarRegion>(MR) &&
556*12c85518Srobert                  isa<StackSpaceRegion>(MR->getMemorySpace());
557e5dd7070Spatrick 
558e5dd7070Spatrick   if (!RD || !RD->getDeclContext()->isStdNamespace())
559e5dd7070Spatrick     return { IsLocal, SK_NonStd };
560e5dd7070Spatrick 
561e5dd7070Spatrick   if (belongsTo(RD, StdSmartPtrClasses))
562e5dd7070Spatrick     return { IsLocal, SK_SmartPtr };
563e5dd7070Spatrick 
564e5dd7070Spatrick   if (belongsTo(RD, StdSafeClasses))
565e5dd7070Spatrick     return { IsLocal, SK_Safe };
566e5dd7070Spatrick 
567e5dd7070Spatrick   return { IsLocal, SK_Unsafe };
568e5dd7070Spatrick }
569e5dd7070Spatrick 
explainObject(llvm::raw_ostream & OS,const MemRegion * MR,const CXXRecordDecl * RD,MisuseKind MK) const570e5dd7070Spatrick void MoveChecker::explainObject(llvm::raw_ostream &OS, const MemRegion *MR,
571e5dd7070Spatrick                                 const CXXRecordDecl *RD, MisuseKind MK) const {
572e5dd7070Spatrick   // We may need a leading space every time we actually explain anything,
573e5dd7070Spatrick   // and we never know if we are to explain anything until we try.
574e5dd7070Spatrick   if (const auto DR =
575e5dd7070Spatrick           dyn_cast_or_null<DeclRegion>(unwrapRValueReferenceIndirection(MR))) {
576e5dd7070Spatrick     const auto *RegionDecl = cast<NamedDecl>(DR->getDecl());
577a9ac8606Spatrick     OS << " '" << RegionDecl->getDeclName() << "'";
578e5dd7070Spatrick   }
579e5dd7070Spatrick 
580e5dd7070Spatrick   ObjectKind OK = classifyObject(MR, RD);
581e5dd7070Spatrick   switch (OK.StdKind) {
582e5dd7070Spatrick     case SK_NonStd:
583e5dd7070Spatrick     case SK_Safe:
584e5dd7070Spatrick       break;
585e5dd7070Spatrick     case SK_SmartPtr:
586e5dd7070Spatrick       if (MK != MK_Dereference)
587e5dd7070Spatrick         break;
588e5dd7070Spatrick 
589e5dd7070Spatrick       // We only care about the type if it's a dereference.
590*12c85518Srobert       [[fallthrough]];
591e5dd7070Spatrick     case SK_Unsafe:
592e5dd7070Spatrick       OS << " of type '" << RD->getQualifiedNameAsString() << "'";
593e5dd7070Spatrick       break;
594e5dd7070Spatrick   };
595e5dd7070Spatrick }
596e5dd7070Spatrick 
checkPreCall(const CallEvent & Call,CheckerContext & C) const597e5dd7070Spatrick void MoveChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const {
598e5dd7070Spatrick   ProgramStateRef State = C.getState();
599e5dd7070Spatrick 
600e5dd7070Spatrick   // Remove the MemRegions from the map on which a ctor/dtor call or assignment
601e5dd7070Spatrick   // happened.
602e5dd7070Spatrick 
603e5dd7070Spatrick   // Checking constructor calls.
604e5dd7070Spatrick   if (const auto *CC = dyn_cast<CXXConstructorCall>(&Call)) {
605e5dd7070Spatrick     State = removeFromState(State, CC->getCXXThisVal().getAsRegion());
606e5dd7070Spatrick     auto CtorDec = CC->getDecl();
607e5dd7070Spatrick     // Check for copying a moved-from object and report the bug.
608e5dd7070Spatrick     if (CtorDec && CtorDec->isCopyOrMoveConstructor()) {
609e5dd7070Spatrick       const MemRegion *ArgRegion = CC->getArgSVal(0).getAsRegion();
610e5dd7070Spatrick       const CXXRecordDecl *RD = CtorDec->getParent();
611e5dd7070Spatrick       MisuseKind MK = CtorDec->isMoveConstructor() ? MK_Move : MK_Copy;
612e5dd7070Spatrick       modelUse(State, ArgRegion, RD, MK, C);
613e5dd7070Spatrick       return;
614e5dd7070Spatrick     }
615e5dd7070Spatrick   }
616e5dd7070Spatrick 
617e5dd7070Spatrick   const auto IC = dyn_cast<CXXInstanceCall>(&Call);
618e5dd7070Spatrick   if (!IC)
619e5dd7070Spatrick     return;
620e5dd7070Spatrick 
621e5dd7070Spatrick   const MemRegion *ThisRegion = IC->getCXXThisVal().getAsRegion();
622e5dd7070Spatrick   if (!ThisRegion)
623e5dd7070Spatrick     return;
624e5dd7070Spatrick 
625e5dd7070Spatrick   // The remaining part is check only for method call on a moved-from object.
626e5dd7070Spatrick   const auto MethodDecl = dyn_cast_or_null<CXXMethodDecl>(IC->getDecl());
627e5dd7070Spatrick   if (!MethodDecl)
628e5dd7070Spatrick     return;
629e5dd7070Spatrick 
630*12c85518Srobert   // Calling a destructor on a moved object is fine.
631*12c85518Srobert   if (isa<CXXDestructorDecl>(MethodDecl))
632*12c85518Srobert     return;
633*12c85518Srobert 
634e5dd7070Spatrick   // We want to investigate the whole object, not only sub-object of a parent
635e5dd7070Spatrick   // class in which the encountered method defined.
636e5dd7070Spatrick   ThisRegion = ThisRegion->getMostDerivedObjectRegion();
637e5dd7070Spatrick 
638e5dd7070Spatrick   if (isStateResetMethod(MethodDecl)) {
639e5dd7070Spatrick     State = removeFromState(State, ThisRegion);
640e5dd7070Spatrick     C.addTransition(State);
641e5dd7070Spatrick     return;
642e5dd7070Spatrick   }
643e5dd7070Spatrick 
644e5dd7070Spatrick   if (isMoveSafeMethod(MethodDecl))
645e5dd7070Spatrick     return;
646e5dd7070Spatrick 
647e5dd7070Spatrick   // Store class declaration as well, for bug reporting purposes.
648e5dd7070Spatrick   const CXXRecordDecl *RD = MethodDecl->getParent();
649e5dd7070Spatrick 
650e5dd7070Spatrick   if (MethodDecl->isOverloadedOperator()) {
651e5dd7070Spatrick     OverloadedOperatorKind OOK = MethodDecl->getOverloadedOperator();
652e5dd7070Spatrick 
653e5dd7070Spatrick     if (OOK == OO_Equal) {
654e5dd7070Spatrick       // Remove the tracked object for every assignment operator, but report bug
655e5dd7070Spatrick       // only for move or copy assignment's argument.
656e5dd7070Spatrick       State = removeFromState(State, ThisRegion);
657e5dd7070Spatrick 
658e5dd7070Spatrick       if (MethodDecl->isCopyAssignmentOperator() ||
659e5dd7070Spatrick           MethodDecl->isMoveAssignmentOperator()) {
660e5dd7070Spatrick         const MemRegion *ArgRegion = IC->getArgSVal(0).getAsRegion();
661e5dd7070Spatrick         MisuseKind MK =
662e5dd7070Spatrick             MethodDecl->isMoveAssignmentOperator() ? MK_Move : MK_Copy;
663e5dd7070Spatrick         modelUse(State, ArgRegion, RD, MK, C);
664e5dd7070Spatrick         return;
665e5dd7070Spatrick       }
666e5dd7070Spatrick       C.addTransition(State);
667e5dd7070Spatrick       return;
668e5dd7070Spatrick     }
669e5dd7070Spatrick 
670e5dd7070Spatrick     if (OOK == OO_Star || OOK == OO_Arrow) {
671e5dd7070Spatrick       modelUse(State, ThisRegion, RD, MK_Dereference, C);
672e5dd7070Spatrick       return;
673e5dd7070Spatrick     }
674e5dd7070Spatrick   }
675e5dd7070Spatrick 
676e5dd7070Spatrick   modelUse(State, ThisRegion, RD, MK_FunCall, C);
677e5dd7070Spatrick }
678e5dd7070Spatrick 
checkDeadSymbols(SymbolReaper & SymReaper,CheckerContext & C) const679e5dd7070Spatrick void MoveChecker::checkDeadSymbols(SymbolReaper &SymReaper,
680e5dd7070Spatrick                                    CheckerContext &C) const {
681e5dd7070Spatrick   ProgramStateRef State = C.getState();
682e5dd7070Spatrick   TrackedRegionMapTy TrackedRegions = State->get<TrackedRegionMap>();
683e5dd7070Spatrick   for (auto E : TrackedRegions) {
684e5dd7070Spatrick     const MemRegion *Region = E.first;
685e5dd7070Spatrick     bool IsRegDead = !SymReaper.isLiveRegion(Region);
686e5dd7070Spatrick 
687e5dd7070Spatrick     // Remove the dead regions from the region map.
688e5dd7070Spatrick     if (IsRegDead) {
689e5dd7070Spatrick       State = State->remove<TrackedRegionMap>(Region);
690e5dd7070Spatrick     }
691e5dd7070Spatrick   }
692e5dd7070Spatrick   C.addTransition(State);
693e5dd7070Spatrick }
694e5dd7070Spatrick 
checkRegionChanges(ProgramStateRef State,const InvalidatedSymbols * Invalidated,ArrayRef<const MemRegion * > RequestedRegions,ArrayRef<const MemRegion * > InvalidatedRegions,const LocationContext * LCtx,const CallEvent * Call) const695e5dd7070Spatrick ProgramStateRef MoveChecker::checkRegionChanges(
696e5dd7070Spatrick     ProgramStateRef State, const InvalidatedSymbols *Invalidated,
697e5dd7070Spatrick     ArrayRef<const MemRegion *> RequestedRegions,
698e5dd7070Spatrick     ArrayRef<const MemRegion *> InvalidatedRegions,
699e5dd7070Spatrick     const LocationContext *LCtx, const CallEvent *Call) const {
700e5dd7070Spatrick   if (Call) {
701e5dd7070Spatrick     // Relax invalidation upon function calls: only invalidate parameters
702e5dd7070Spatrick     // that are passed directly via non-const pointers or non-const references
703e5dd7070Spatrick     // or rvalue references.
704e5dd7070Spatrick     // In case of an InstanceCall don't invalidate the this-region since
705e5dd7070Spatrick     // it is fully handled in checkPreCall and checkPostCall.
706e5dd7070Spatrick     const MemRegion *ThisRegion = nullptr;
707e5dd7070Spatrick     if (const auto *IC = dyn_cast<CXXInstanceCall>(Call))
708e5dd7070Spatrick       ThisRegion = IC->getCXXThisVal().getAsRegion();
709e5dd7070Spatrick 
710e5dd7070Spatrick     // Requested ("explicit") regions are the regions passed into the call
711e5dd7070Spatrick     // directly, but not all of them end up being invalidated.
712e5dd7070Spatrick     // But when they do, they appear in the InvalidatedRegions array as well.
713e5dd7070Spatrick     for (const auto *Region : RequestedRegions) {
714*12c85518Srobert       if (ThisRegion != Region &&
715*12c85518Srobert           llvm::is_contained(InvalidatedRegions, Region))
716e5dd7070Spatrick         State = removeFromState(State, Region);
717e5dd7070Spatrick     }
718e5dd7070Spatrick   } else {
719e5dd7070Spatrick     // For invalidations that aren't caused by calls, assume nothing. In
720e5dd7070Spatrick     // particular, direct write into an object's field invalidates the status.
721e5dd7070Spatrick     for (const auto *Region : InvalidatedRegions)
722e5dd7070Spatrick       State = removeFromState(State, Region->getBaseRegion());
723e5dd7070Spatrick   }
724e5dd7070Spatrick 
725e5dd7070Spatrick   return State;
726e5dd7070Spatrick }
727e5dd7070Spatrick 
printState(raw_ostream & Out,ProgramStateRef State,const char * NL,const char * Sep) const728e5dd7070Spatrick void MoveChecker::printState(raw_ostream &Out, ProgramStateRef State,
729e5dd7070Spatrick                              const char *NL, const char *Sep) const {
730e5dd7070Spatrick 
731e5dd7070Spatrick   TrackedRegionMapTy RS = State->get<TrackedRegionMap>();
732e5dd7070Spatrick 
733e5dd7070Spatrick   if (!RS.isEmpty()) {
734e5dd7070Spatrick     Out << Sep << "Moved-from objects :" << NL;
735e5dd7070Spatrick     for (auto I: RS) {
736e5dd7070Spatrick       I.first->dumpToStream(Out);
737e5dd7070Spatrick       if (I.second.isMoved())
738e5dd7070Spatrick         Out << ": moved";
739e5dd7070Spatrick       else
740e5dd7070Spatrick         Out << ": moved and reported";
741e5dd7070Spatrick       Out << NL;
742e5dd7070Spatrick     }
743e5dd7070Spatrick   }
744e5dd7070Spatrick }
registerMoveChecker(CheckerManager & mgr)745e5dd7070Spatrick void ento::registerMoveChecker(CheckerManager &mgr) {
746e5dd7070Spatrick   MoveChecker *chk = mgr.registerChecker<MoveChecker>();
747e5dd7070Spatrick   chk->setAggressiveness(
748e5dd7070Spatrick       mgr.getAnalyzerOptions().getCheckerStringOption(chk, "WarnOn"), mgr);
749e5dd7070Spatrick }
750e5dd7070Spatrick 
shouldRegisterMoveChecker(const CheckerManager & mgr)751ec727ea7Spatrick bool ento::shouldRegisterMoveChecker(const CheckerManager &mgr) {
752e5dd7070Spatrick   return true;
753e5dd7070Spatrick }
754