xref: /llvm-project/clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp (revision c1b4534e4230a3e1545d10ddf3438aa64db9cedd)
1 //== ObjCSelfInitChecker.cpp - Checker for 'self' initialization -*- C++ -*--=//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines ObjCSelfInitChecker, a builtin check that checks for uses of
11 // 'self' before proper initialization.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 // This checks initialization methods to verify that they assign 'self' to the
16 // result of an initialization call (e.g. [super init], or [self initWith..])
17 // before using 'self' or any instance variable.
18 //
19 // To perform the required checking, values are tagged wih flags that indicate
20 // 1) if the object is the one pointed to by 'self', and 2) if the object
21 // is the result of an initializer (e.g. [super init]).
22 //
23 // Uses of an object that is true for 1) but not 2) trigger a diagnostic.
24 // The uses that are currently checked are:
25 //  - Using instance variables.
26 //  - Returning the object.
27 //
28 // Note that we don't check for an invalid 'self' that is the receiver of an
29 // obj-c message expression to cut down false positives where logging functions
30 // get information from self (like its class) or doing "invalidation" on self
31 // when the initialization fails.
32 //
33 // Because the object that 'self' points to gets invalidated when a call
34 // receives a reference to 'self', the checker keeps track and passes the flags
35 // for 1) and 2) to the new object that 'self' points to after the call.
36 //
37 // FIXME (rdar://7937506): In the case of:
38 //   [super init];
39 //   return self;
40 // Have an extra PathDiagnosticPiece in the path that says "called [super init],
41 // but didn't assign the result to self."
42 
43 //===----------------------------------------------------------------------===//
44 
45 // FIXME: Somehow stick the link to Apple's documentation about initializing
46 // objects in the diagnostics.
47 // http://developer.apple.com/library/mac/#documentation/Cocoa/Conceptual/ObjectiveC/Articles/ocAllocInit.html
48 
49 #include "ExprEngineInternalChecks.h"
50 #include "clang/StaticAnalyzer/PathSensitive/CheckerVisitor.h"
51 #include "clang/StaticAnalyzer/PathSensitive/GRStateTrait.h"
52 #include "clang/StaticAnalyzer/BugReporter/BugType.h"
53 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
54 #include "clang/AST/ParentMap.h"
55 
56 using namespace clang;
57 using namespace ento;
58 
59 static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND);
60 static bool isInitializationMethod(const ObjCMethodDecl *MD);
61 static bool isInitMessage(const ObjCMessage &msg);
62 static bool isSelfVar(SVal location, CheckerContext &C);
63 
64 namespace {
65 enum SelfFlagEnum {
66   /// \brief No flag set.
67   SelfFlag_None = 0x0,
68   /// \brief Value came from 'self'.
69   SelfFlag_Self    = 0x1,
70   /// \brief Value came from the result of an initializer (e.g. [super init]).
71   SelfFlag_InitRes = 0x2
72 };
73 }
74 
75 namespace {
76 class ObjCSelfInitChecker : public CheckerVisitor<ObjCSelfInitChecker> {
77   /// \brief A call receiving a reference to 'self' invalidates the object that
78   /// 'self' contains. This field keeps the "self flags" assigned to the 'self'
79   /// object before the call and assign them to the new object that 'self'
80   /// points to after the call.
81   SelfFlagEnum preCallSelfFlags;
82 
83 public:
84   static void *getTag() { static int tag = 0; return &tag; }
85   void postVisitObjCMessage(CheckerContext &C, ObjCMessage msg);
86   void PostVisitObjCIvarRefExpr(CheckerContext &C, const ObjCIvarRefExpr *E);
87   void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S);
88   void PreVisitGenericCall(CheckerContext &C, const CallExpr *CE);
89   void PostVisitGenericCall(CheckerContext &C, const CallExpr *CE);
90   virtual void visitLocation(CheckerContext &C, const Stmt *S, SVal location,
91                              bool isLoad);
92 };
93 } // end anonymous namespace
94 
95 void ento::registerObjCSelfInitChecker(ExprEngine &Eng) {
96   if (Eng.getContext().getLangOptions().ObjC1)
97     Eng.registerCheck(new ObjCSelfInitChecker());
98 }
99 
100 namespace {
101 
102 class InitSelfBug : public BugType {
103   const std::string desc;
104 public:
105   InitSelfBug() : BugType("missing \"self = [(super or self) init...]\"",
106                           "missing \"self = [(super or self) init...]\"") {}
107 };
108 
109 } // end anonymous namespace
110 
111 typedef llvm::ImmutableMap<SymbolRef, unsigned> SelfFlag;
112 
113 namespace clang {
114 namespace ento {
115   template<>
116   struct GRStateTrait<SelfFlag> : public GRStatePartialTrait<SelfFlag> {
117     static void* GDMIndex() {
118       static int index = 0;
119       return &index;
120     }
121   };
122 }
123 }
124 
125 static SelfFlagEnum getSelfFlags(SVal val, const GRState *state) {
126   if (SymbolRef sym = val.getAsSymbol())
127     if (const unsigned *attachedFlags = state->get<SelfFlag>(sym))
128       return (SelfFlagEnum)*attachedFlags;
129   return SelfFlag_None;
130 }
131 
132 static SelfFlagEnum getSelfFlags(SVal val, CheckerContext &C) {
133   return getSelfFlags(val, C.getState());
134 }
135 
136 static void addSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) {
137   const GRState *state = C.getState();
138   // FIXME: We tag the symbol that the SVal wraps but this is conceptually
139   // wrong, we should tag the SVal; the fact that there is a symbol behind the
140   // SVal is irrelevant.
141   if (SymbolRef sym = val.getAsSymbol())
142     C.addTransition(state->set<SelfFlag>(sym, getSelfFlags(val, C) | flag));
143 }
144 
145 static bool hasSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) {
146   return getSelfFlags(val, C) & flag;
147 }
148 
149 /// \brief Returns true of the value of the expression is the object that 'self'
150 /// points to and is an object that did not come from the result of calling
151 /// an initializer.
152 static bool isInvalidSelf(const Expr *E, CheckerContext &C) {
153   SVal exprVal = C.getState()->getSVal(E);
154   if (!hasSelfFlag(exprVal, SelfFlag_Self, C))
155     return false; // value did not come from 'self'.
156   if (hasSelfFlag(exprVal, SelfFlag_InitRes, C))
157     return false; // 'self' is properly initialized.
158 
159   return true;
160 }
161 
162 static void checkForInvalidSelf(const Expr *E, CheckerContext &C,
163                                 const char *errorStr) {
164   if (!E)
165     return;
166   if (!isInvalidSelf(E, C))
167     return;
168 
169   // Generate an error node.
170   ExplodedNode *N = C.generateSink();
171   if (!N)
172     return;
173 
174   EnhancedBugReport *report =
175     new EnhancedBugReport(*new InitSelfBug(), errorStr, N);
176   C.EmitReport(report);
177 }
178 
179 void ObjCSelfInitChecker::postVisitObjCMessage(CheckerContext &C,
180                                                ObjCMessage msg) {
181   // When encountering a message that does initialization (init rule),
182   // tag the return value so that we know later on that if self has this value
183   // then it is properly initialized.
184 
185   // FIXME: A callback should disable checkers at the start of functions.
186   if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>(
187                                      C.getCurrentAnalysisContext()->getDecl())))
188     return;
189 
190   if (isInitMessage(msg)) {
191     // Tag the return value as the result of an initializer.
192     const GRState *state = C.getState();
193     SVal V = state->getSVal(msg.getOriginExpr());
194     addSelfFlag(V, SelfFlag_InitRes, C);
195     return;
196   }
197 
198   // We don't check for an invalid 'self' in an obj-c message expression to cut
199   // down false positives where logging functions get information from self
200   // (like its class) or doing "invalidation" on self when the initialization
201   // fails.
202 }
203 
204 void ObjCSelfInitChecker::PostVisitObjCIvarRefExpr(CheckerContext &C,
205                                                    const ObjCIvarRefExpr *E) {
206   // FIXME: A callback should disable checkers at the start of functions.
207   if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>(
208                                      C.getCurrentAnalysisContext()->getDecl())))
209     return;
210 
211   checkForInvalidSelf(E->getBase(), C,
212     "Instance variable used while 'self' is not set to the result of "
213                                                  "'[(super or self) init...]'");
214 }
215 
216 void ObjCSelfInitChecker::PreVisitReturnStmt(CheckerContext &C,
217                                              const ReturnStmt *S) {
218   // FIXME: A callback should disable checkers at the start of functions.
219   if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>(
220                                      C.getCurrentAnalysisContext()->getDecl())))
221     return;
222 
223   checkForInvalidSelf(S->getRetValue(), C,
224     "Returning 'self' while it is not set to the result of "
225                                                  "'[(super or self) init...]'");
226 }
227 
228 // When a call receives a reference to 'self', [Pre/Post]VisitGenericCall pass
229 // the SelfFlags from the object 'self' point to before the call, to the new
230 // object after the call.
231 
232 void ObjCSelfInitChecker::PreVisitGenericCall(CheckerContext &C,
233                                               const CallExpr *CE) {
234   const GRState *state = C.getState();
235   for (CallExpr::const_arg_iterator
236          I = CE->arg_begin(), E = CE->arg_end(); I != E; ++I) {
237     SVal argV = state->getSVal(*I);
238     if (isSelfVar(argV, C)) {
239       preCallSelfFlags = getSelfFlags(state->getSVal(cast<Loc>(argV)), C);
240       return;
241     }
242   }
243 }
244 
245 void ObjCSelfInitChecker::PostVisitGenericCall(CheckerContext &C,
246                                                const CallExpr *CE) {
247   const GRState *state = C.getState();
248   for (CallExpr::const_arg_iterator
249          I = CE->arg_begin(), E = CE->arg_end(); I != E; ++I) {
250     SVal argV = state->getSVal(*I);
251     if (isSelfVar(argV, C)) {
252       addSelfFlag(state->getSVal(cast<Loc>(argV)), preCallSelfFlags, C);
253       return;
254     }
255   }
256 }
257 
258 void ObjCSelfInitChecker::visitLocation(CheckerContext &C, const Stmt *S,
259                                         SVal location, bool isLoad) {
260   // Tag the result of a load from 'self' so that we can easily know that the
261   // value is the object that 'self' points to.
262   const GRState *state = C.getState();
263   if (isSelfVar(location, C))
264     addSelfFlag(state->getSVal(cast<Loc>(location)), SelfFlag_Self, C);
265 }
266 
267 // FIXME: A callback should disable checkers at the start of functions.
268 static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND) {
269   if (!ND)
270     return false;
271 
272   const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(ND);
273   if (!MD)
274     return false;
275   if (!isInitializationMethod(MD))
276     return false;
277 
278   // self = [super init] applies only to NSObject subclasses.
279   // For instance, NSProxy doesn't implement -init.
280   ASTContext& Ctx = MD->getASTContext();
281   IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject");
282   ObjCInterfaceDecl* ID = MD->getClassInterface()->getSuperClass();
283   for ( ; ID ; ID = ID->getSuperClass()) {
284     IdentifierInfo *II = ID->getIdentifier();
285 
286     if (II == NSObjectII)
287       break;
288   }
289   if (!ID)
290     return false;
291 
292   return true;
293 }
294 
295 /// \brief Returns true if the location is 'self'.
296 static bool isSelfVar(SVal location, CheckerContext &C) {
297   AnalysisContext *analCtx = C.getCurrentAnalysisContext();
298   if (!analCtx->getSelfDecl())
299     return false;
300   if (!isa<loc::MemRegionVal>(location))
301     return false;
302 
303   loc::MemRegionVal MRV = cast<loc::MemRegionVal>(location);
304   if (const DeclRegion *DR = dyn_cast<DeclRegion>(MRV.getRegion()))
305     return (DR->getDecl() == analCtx->getSelfDecl());
306 
307   return false;
308 }
309 
310 static bool isInitializationMethod(const ObjCMethodDecl *MD) {
311   // Init methods with prefix like '-(id)_init' are private and the requirements
312   // are less strict so we don't check those.
313   return MD->isInstanceMethod() &&
314       cocoa::deriveNamingConvention(MD->getSelector(),
315                                     /*ignorePrefix=*/false) == cocoa::InitRule;
316 }
317 
318 static bool isInitMessage(const ObjCMessage &msg) {
319   return cocoa::deriveNamingConvention(msg.getSelector()) == cocoa::InitRule;
320 }
321