1 //== ObjCSelfInitChecker.cpp - Checker for 'self' initialization -*- C++ -*--=// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This defines ObjCSelfInitChecker, a builtin check that checks for uses of 11 // 'self' before proper initialization. 12 // 13 //===----------------------------------------------------------------------===// 14 15 // This checks initialization methods to verify that they assign 'self' to the 16 // result of an initialization call (e.g. [super init], or [self initWith..]) 17 // before using 'self' or any instance variable. 18 // 19 // To perform the required checking, values are tagged with flags that indicate 20 // 1) if the object is the one pointed to by 'self', and 2) if the object 21 // is the result of an initializer (e.g. [super init]). 22 // 23 // Uses of an object that is true for 1) but not 2) trigger a diagnostic. 24 // The uses that are currently checked are: 25 // - Using instance variables. 26 // - Returning the object. 27 // 28 // Note that we don't check for an invalid 'self' that is the receiver of an 29 // obj-c message expression to cut down false positives where logging functions 30 // get information from self (like its class) or doing "invalidation" on self 31 // when the initialization fails. 32 // 33 // Because the object that 'self' points to gets invalidated when a call 34 // receives a reference to 'self', the checker keeps track and passes the flags 35 // for 1) and 2) to the new object that 'self' points to after the call. 36 // 37 //===----------------------------------------------------------------------===// 38 39 #include "ClangSACheckers.h" 40 #include "clang/StaticAnalyzer/Core/Checker.h" 41 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 42 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 43 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 44 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 45 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 46 #include "clang/AST/ParentMap.h" 47 48 using namespace clang; 49 using namespace ento; 50 51 static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND); 52 static bool isInitializationMethod(const ObjCMethodDecl *MD); 53 static bool isInitMessage(const ObjCMethodCall &Msg); 54 static bool isSelfVar(SVal location, CheckerContext &C); 55 56 namespace { 57 class ObjCSelfInitChecker : public Checker< check::PostObjCMessage, 58 check::PostStmt<ObjCIvarRefExpr>, 59 check::PreStmt<ReturnStmt>, 60 check::PreCall, 61 check::PostCall, 62 check::Location, 63 check::Bind > { 64 public: 65 void checkPostObjCMessage(const ObjCMethodCall &Msg, CheckerContext &C) const; 66 void checkPostStmt(const ObjCIvarRefExpr *E, CheckerContext &C) const; 67 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; 68 void checkLocation(SVal location, bool isLoad, const Stmt *S, 69 CheckerContext &C) const; 70 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; 71 72 void checkPreCall(const CallEvent &CE, CheckerContext &C) const; 73 void checkPostCall(const CallEvent &CE, CheckerContext &C) const; 74 75 void printState(raw_ostream &Out, ProgramStateRef State, 76 const char *NL, const char *Sep) const; 77 }; 78 } // end anonymous namespace 79 80 namespace { 81 82 class InitSelfBug : public BugType { 83 const std::string desc; 84 public: 85 InitSelfBug() : BugType("Missing \"self = [(super or self) init...]\"", 86 categories::CoreFoundationObjectiveC) {} 87 }; 88 89 } // end anonymous namespace 90 91 namespace { 92 enum SelfFlagEnum { 93 /// \brief No flag set. 94 SelfFlag_None = 0x0, 95 /// \brief Value came from 'self'. 96 SelfFlag_Self = 0x1, 97 /// \brief Value came from the result of an initializer (e.g. [super init]). 98 SelfFlag_InitRes = 0x2 99 }; 100 } 101 102 typedef llvm::ImmutableMap<SymbolRef, unsigned> SelfFlag; 103 namespace { struct CalledInit {}; } 104 namespace { struct PreCallSelfFlags {}; } 105 106 namespace clang { 107 namespace ento { 108 template<> 109 struct ProgramStateTrait<SelfFlag> : public ProgramStatePartialTrait<SelfFlag> { 110 static void *GDMIndex() { static int index = 0; return &index; } 111 }; 112 template <> 113 struct ProgramStateTrait<CalledInit> : public ProgramStatePartialTrait<bool> { 114 static void *GDMIndex() { static int index = 0; return &index; } 115 }; 116 117 /// \brief A call receiving a reference to 'self' invalidates the object that 118 /// 'self' contains. This keeps the "self flags" assigned to the 'self' 119 /// object before the call so we can assign them to the new object that 'self' 120 /// points to after the call. 121 template <> 122 struct ProgramStateTrait<PreCallSelfFlags> : public ProgramStatePartialTrait<unsigned> { 123 static void *GDMIndex() { static int index = 0; return &index; } 124 }; 125 } 126 } 127 128 static SelfFlagEnum getSelfFlags(SVal val, ProgramStateRef state) { 129 if (SymbolRef sym = val.getAsSymbol()) 130 if (const unsigned *attachedFlags = state->get<SelfFlag>(sym)) 131 return (SelfFlagEnum)*attachedFlags; 132 return SelfFlag_None; 133 } 134 135 static SelfFlagEnum getSelfFlags(SVal val, CheckerContext &C) { 136 return getSelfFlags(val, C.getState()); 137 } 138 139 static void addSelfFlag(ProgramStateRef state, SVal val, 140 SelfFlagEnum flag, CheckerContext &C) { 141 // We tag the symbol that the SVal wraps. 142 if (SymbolRef sym = val.getAsSymbol()) 143 state = state->set<SelfFlag>(sym, getSelfFlags(val, state) | flag); 144 C.addTransition(state); 145 } 146 147 static bool hasSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) { 148 return getSelfFlags(val, C) & flag; 149 } 150 151 /// \brief Returns true of the value of the expression is the object that 'self' 152 /// points to and is an object that did not come from the result of calling 153 /// an initializer. 154 static bool isInvalidSelf(const Expr *E, CheckerContext &C) { 155 SVal exprVal = C.getState()->getSVal(E, C.getLocationContext()); 156 if (!hasSelfFlag(exprVal, SelfFlag_Self, C)) 157 return false; // value did not come from 'self'. 158 if (hasSelfFlag(exprVal, SelfFlag_InitRes, C)) 159 return false; // 'self' is properly initialized. 160 161 return true; 162 } 163 164 static void checkForInvalidSelf(const Expr *E, CheckerContext &C, 165 const char *errorStr) { 166 if (!E) 167 return; 168 169 if (!C.getState()->get<CalledInit>()) 170 return; 171 172 if (!isInvalidSelf(E, C)) 173 return; 174 175 // Generate an error node. 176 ExplodedNode *N = C.generateSink(); 177 if (!N) 178 return; 179 180 BugReport *report = 181 new BugReport(*new InitSelfBug(), errorStr, N); 182 C.EmitReport(report); 183 } 184 185 void ObjCSelfInitChecker::checkPostObjCMessage(const ObjCMethodCall &Msg, 186 CheckerContext &C) const { 187 // When encountering a message that does initialization (init rule), 188 // tag the return value so that we know later on that if self has this value 189 // then it is properly initialized. 190 191 // FIXME: A callback should disable checkers at the start of functions. 192 if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( 193 C.getCurrentAnalysisDeclContext()->getDecl()))) 194 return; 195 196 if (isInitMessage(Msg)) { 197 // Tag the return value as the result of an initializer. 198 ProgramStateRef state = C.getState(); 199 200 // FIXME this really should be context sensitive, where we record 201 // the current stack frame (for IPA). Also, we need to clean this 202 // value out when we return from this method. 203 state = state->set<CalledInit>(true); 204 205 SVal V = state->getSVal(Msg.getOriginExpr(), C.getLocationContext()); 206 addSelfFlag(state, V, SelfFlag_InitRes, C); 207 return; 208 } 209 210 // We don't check for an invalid 'self' in an obj-c message expression to cut 211 // down false positives where logging functions get information from self 212 // (like its class) or doing "invalidation" on self when the initialization 213 // fails. 214 } 215 216 void ObjCSelfInitChecker::checkPostStmt(const ObjCIvarRefExpr *E, 217 CheckerContext &C) const { 218 // FIXME: A callback should disable checkers at the start of functions. 219 if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( 220 C.getCurrentAnalysisDeclContext()->getDecl()))) 221 return; 222 223 checkForInvalidSelf(E->getBase(), C, 224 "Instance variable used while 'self' is not set to the result of " 225 "'[(super or self) init...]'"); 226 } 227 228 void ObjCSelfInitChecker::checkPreStmt(const ReturnStmt *S, 229 CheckerContext &C) const { 230 // FIXME: A callback should disable checkers at the start of functions. 231 if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( 232 C.getCurrentAnalysisDeclContext()->getDecl()))) 233 return; 234 235 checkForInvalidSelf(S->getRetValue(), C, 236 "Returning 'self' while it is not set to the result of " 237 "'[(super or self) init...]'"); 238 } 239 240 // When a call receives a reference to 'self', [Pre/Post]Call pass 241 // the SelfFlags from the object 'self' points to before the call to the new 242 // object after the call. This is to avoid invalidation of 'self' by logging 243 // functions. 244 // Another common pattern in classes with multiple initializers is to put the 245 // subclass's common initialization bits into a static function that receives 246 // the value of 'self', e.g: 247 // @code 248 // if (!(self = [super init])) 249 // return nil; 250 // if (!(self = _commonInit(self))) 251 // return nil; 252 // @endcode 253 // Until we can use inter-procedural analysis, in such a call, transfer the 254 // SelfFlags to the result of the call. 255 256 void ObjCSelfInitChecker::checkPreCall(const CallEvent &CE, 257 CheckerContext &C) const { 258 // FIXME: A callback should disable checkers at the start of functions. 259 if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( 260 C.getCurrentAnalysisDeclContext()->getDecl()))) 261 return; 262 263 ProgramStateRef state = C.getState(); 264 unsigned NumArgs = CE.getNumArgs(); 265 // If we passed 'self' as and argument to the call, record it in the state 266 // to be propagated after the call. 267 // Note, we could have just given up, but try to be more optimistic here and 268 // assume that the functions are going to continue initialization or will not 269 // modify self. 270 for (unsigned i = 0; i < NumArgs; ++i) { 271 SVal argV = CE.getArgSVal(i); 272 if (isSelfVar(argV, C)) { 273 unsigned selfFlags = getSelfFlags(state->getSVal(cast<Loc>(argV)), C); 274 C.addTransition(state->set<PreCallSelfFlags>(selfFlags)); 275 return; 276 } else if (hasSelfFlag(argV, SelfFlag_Self, C)) { 277 unsigned selfFlags = getSelfFlags(argV, C); 278 C.addTransition(state->set<PreCallSelfFlags>(selfFlags)); 279 return; 280 } 281 } 282 } 283 284 void ObjCSelfInitChecker::checkPostCall(const CallEvent &CE, 285 CheckerContext &C) const { 286 // FIXME: A callback should disable checkers at the start of functions. 287 if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>( 288 C.getCurrentAnalysisDeclContext()->getDecl()))) 289 return; 290 291 ProgramStateRef state = C.getState(); 292 SelfFlagEnum prevFlags = (SelfFlagEnum)state->get<PreCallSelfFlags>(); 293 if (!prevFlags) 294 return; 295 state = state->remove<PreCallSelfFlags>(); 296 297 unsigned NumArgs = CE.getNumArgs(); 298 for (unsigned i = 0; i < NumArgs; ++i) { 299 SVal argV = CE.getArgSVal(i); 300 if (isSelfVar(argV, C)) { 301 // If the address of 'self' is being passed to the call, assume that the 302 // 'self' after the call will have the same flags. 303 // EX: log(&self) 304 addSelfFlag(state, state->getSVal(cast<Loc>(argV)), prevFlags, C); 305 return; 306 } else if (hasSelfFlag(argV, SelfFlag_Self, C)) { 307 // If 'self' is passed to the call by value, assume that the function 308 // returns 'self'. So assign the flags, which were set on 'self' to the 309 // return value. 310 // EX: self = performMoreInitialization(self) 311 const Expr *CallExpr = CE.getOriginExpr(); 312 if (CallExpr) 313 addSelfFlag(state, state->getSVal(CallExpr, C.getLocationContext()), 314 prevFlags, C); 315 return; 316 } 317 } 318 } 319 320 void ObjCSelfInitChecker::checkLocation(SVal location, bool isLoad, 321 const Stmt *S, 322 CheckerContext &C) const { 323 // Tag the result of a load from 'self' so that we can easily know that the 324 // value is the object that 'self' points to. 325 ProgramStateRef state = C.getState(); 326 if (isSelfVar(location, C)) 327 addSelfFlag(state, state->getSVal(cast<Loc>(location)), SelfFlag_Self, C); 328 } 329 330 331 void ObjCSelfInitChecker::checkBind(SVal loc, SVal val, const Stmt *S, 332 CheckerContext &C) const { 333 // Allow assignment of anything to self. Self is a local variable in the 334 // initializer, so it is legal to assign anything to it, like results of 335 // static functions/method calls. After self is assigned something we cannot 336 // reason about, stop enforcing the rules. 337 // (Only continue checking if the assigned value should be treated as self.) 338 if ((isSelfVar(loc, C)) && 339 !hasSelfFlag(val, SelfFlag_InitRes, C) && 340 !hasSelfFlag(val, SelfFlag_Self, C) && 341 !isSelfVar(val, C)) { 342 343 // Stop tracking the checker-specific state in the state. 344 ProgramStateRef State = C.getState(); 345 State = State->remove<CalledInit>(); 346 if (SymbolRef sym = loc.getAsSymbol()) 347 State = State->remove<SelfFlag>(sym); 348 C.addTransition(State); 349 } 350 } 351 352 void ObjCSelfInitChecker::printState(raw_ostream &Out, ProgramStateRef State, 353 const char *NL, const char *Sep) const { 354 SelfFlag FlagMap = State->get<SelfFlag>(); 355 bool DidCallInit = State->get<CalledInit>(); 356 SelfFlagEnum PreCallFlags = (SelfFlagEnum)State->get<PreCallSelfFlags>(); 357 358 if (FlagMap.isEmpty() && !DidCallInit && !PreCallFlags) 359 return; 360 361 Out << Sep << NL << "ObjCSelfInitChecker:" << NL; 362 363 if (DidCallInit) 364 Out << " An init method has been called." << NL; 365 366 if (PreCallFlags != SelfFlag_None) { 367 if (PreCallFlags & SelfFlag_Self) { 368 Out << " An argument of the current call came from the 'self' variable." 369 << NL; 370 } 371 if (PreCallFlags & SelfFlag_InitRes) { 372 Out << " An argument of the current call came from an init method." 373 << NL; 374 } 375 } 376 377 Out << NL; 378 for (SelfFlag::iterator I = FlagMap.begin(), E = FlagMap.end(); I != E; ++I) { 379 Out << I->first << " : "; 380 381 if (I->second == SelfFlag_None) 382 Out << "none"; 383 384 if (I->second & SelfFlag_Self) 385 Out << "self variable"; 386 387 if (I->second & SelfFlag_InitRes) { 388 if (I->second != SelfFlag_InitRes) 389 Out << " | "; 390 Out << "result of init method"; 391 } 392 393 Out << NL; 394 } 395 } 396 397 398 // FIXME: A callback should disable checkers at the start of functions. 399 static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND) { 400 if (!ND) 401 return false; 402 403 const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(ND); 404 if (!MD) 405 return false; 406 if (!isInitializationMethod(MD)) 407 return false; 408 409 // self = [super init] applies only to NSObject subclasses. 410 // For instance, NSProxy doesn't implement -init. 411 ASTContext &Ctx = MD->getASTContext(); 412 IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); 413 ObjCInterfaceDecl *ID = MD->getClassInterface()->getSuperClass(); 414 for ( ; ID ; ID = ID->getSuperClass()) { 415 IdentifierInfo *II = ID->getIdentifier(); 416 417 if (II == NSObjectII) 418 break; 419 } 420 if (!ID) 421 return false; 422 423 return true; 424 } 425 426 /// \brief Returns true if the location is 'self'. 427 static bool isSelfVar(SVal location, CheckerContext &C) { 428 AnalysisDeclContext *analCtx = C.getCurrentAnalysisDeclContext(); 429 if (!analCtx->getSelfDecl()) 430 return false; 431 if (!isa<loc::MemRegionVal>(location)) 432 return false; 433 434 loc::MemRegionVal MRV = cast<loc::MemRegionVal>(location); 435 if (const DeclRegion *DR = dyn_cast<DeclRegion>(MRV.stripCasts())) 436 return (DR->getDecl() == analCtx->getSelfDecl()); 437 438 return false; 439 } 440 441 static bool isInitializationMethod(const ObjCMethodDecl *MD) { 442 return MD->getMethodFamily() == OMF_init; 443 } 444 445 static bool isInitMessage(const ObjCMethodCall &Call) { 446 return Call.getMethodFamily() == OMF_init; 447 } 448 449 //===----------------------------------------------------------------------===// 450 // Registration. 451 //===----------------------------------------------------------------------===// 452 453 void ento::registerObjCSelfInitChecker(CheckerManager &mgr) { 454 mgr.registerChecker<ObjCSelfInitChecker>(); 455 } 456