1// MoveChecker.cpp - Check use of moved-from objects. - C++ ---------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines checker which checks for potential misuses of a moved-from
10// object. That means method calls on the object or copying it in moved-from
11// state.
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/AST/Attr.h"
16#include "clang/AST/ExprCXX.h"
17#include "clang/Driver/DriverDiagnostic.h"
18#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
19#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20#include "clang/StaticAnalyzer/Core/Checker.h"
21#include "clang/StaticAnalyzer/Core/CheckerManager.h"
22#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
24#include "llvm/ADT/StringSet.h"
25
26using namespace clang;
27using namespace ento;
28
29namespace {
30struct RegionState {
31private:
32 enum Kind { Moved, Reported } K;
33 RegionState(Kind InK) : K(InK) {}
34
35public:
36 bool isReported() const { return K == Reported; }
37 bool isMoved() const { return K == Moved; }
38
39 static RegionState getReported() { return RegionState(Reported); }
40 static RegionState getMoved() { return RegionState(Moved); }
41
42 bool operator==(const RegionState &X) const { return K == X.K; }
43 void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(I: K); }
44};
45} // end of anonymous namespace
46
47namespace {
48class MoveChecker
49 : public Checker<check::PreCall, check::PostCall,
50 check::DeadSymbols, check::RegionChanges> {
51public:
52 void checkPreCall(const CallEvent &MC, CheckerContext &C) const;
53 void checkPostCall(const CallEvent &MC, CheckerContext &C) const;
54 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
55 ProgramStateRef
56 checkRegionChanges(ProgramStateRef State,
57 const InvalidatedSymbols *Invalidated,
58 ArrayRef<const MemRegion *> RequestedRegions,
59 ArrayRef<const MemRegion *> InvalidatedRegions,
60 const LocationContext *LCtx, const CallEvent *Call) const;
61 void printState(raw_ostream &Out, ProgramStateRef State,
62 const char *NL, const char *Sep) const override;
63
64private:
65 enum MisuseKind { MK_FunCall, MK_Copy, MK_Move, MK_Dereference };
66 enum StdObjectKind { SK_NonStd, SK_Unsafe, SK_Safe, SK_SmartPtr };
67
68 enum AggressivenessKind { // In any case, don't warn after a reset.
69 AK_Invalid = -1,
70 AK_KnownsOnly = 0, // Warn only about known move-unsafe classes.
71 AK_KnownsAndLocals = 1, // Also warn about all local objects.
72 AK_All = 2, // Warn on any use-after-move.
73 AK_NumKinds = AK_All
74 };
75
76 static bool misuseCausesCrash(MisuseKind MK) {
77 return MK == MK_Dereference;
78 }
79
80 struct ObjectKind {
81 // Is this a local variable or a local rvalue reference?
82 bool IsLocal;
83 // Is this an STL object? If so, of what kind?
84 StdObjectKind StdKind;
85 };
86
87 // STL smart pointers are automatically re-initialized to null when moved
88 // from. So we can't warn on many methods, but we can warn when it is
89 // dereferenced, which is UB even if the resulting lvalue never gets read.
90 const llvm::StringSet<> StdSmartPtrClasses = {
91 "shared_ptr",
92 "unique_ptr",
93 "weak_ptr",
94 };
95
96 // Not all of these are entirely move-safe, but they do provide *some*
97 // guarantees, and it means that somebody is using them after move
98 // in a valid manner.
99 // TODO: We can still try to identify *unsafe* use after move,
100 // like we did with smart pointers.
101 const llvm::StringSet<> StdSafeClasses = {
102 "basic_filebuf",
103 "basic_ios",
104 "future",
105 "optional",
106 "packaged_task",
107 "promise",
108 "shared_future",
109 "shared_lock",
110 "thread",
111 "unique_lock",
112 };
113
114 // Should we bother tracking the state of the object?
115 bool shouldBeTracked(ObjectKind OK) const {
116 // In non-aggressive mode, only warn on use-after-move of local variables
117 // (or local rvalue references) and of STL objects. The former is possible
118 // because local variables (or local rvalue references) are not tempting
119 // their user to re-use the storage. The latter is possible because STL
120 // objects are known to end up in a valid but unspecified state after the
121 // move and their state-reset methods are also known, which allows us to
122 // predict precisely when use-after-move is invalid.
123 // Some STL objects are known to conform to additional contracts after move,
124 // so they are not tracked. However, smart pointers specifically are tracked
125 // because we can perform extra checking over them.
126 // In aggressive mode, warn on any use-after-move because the user has
127 // intentionally asked us to completely eliminate use-after-move
128 // in his code.
129 return (Aggressiveness == AK_All) ||
130 (Aggressiveness >= AK_KnownsAndLocals && OK.IsLocal) ||
131 OK.StdKind == SK_Unsafe || OK.StdKind == SK_SmartPtr;
132 }
133
134 // Some objects only suffer from some kinds of misuses, but we need to track
135 // them anyway because we cannot know in advance what misuse will we find.
136 bool shouldWarnAbout(ObjectKind OK, MisuseKind MK) const {
137 // Additionally, only warn on smart pointers when they are dereferenced (or
138 // local or we are aggressive).
139 return shouldBeTracked(OK) &&
140 ((Aggressiveness == AK_All) ||
141 (Aggressiveness >= AK_KnownsAndLocals && OK.IsLocal) ||
142 OK.StdKind != SK_SmartPtr || MK == MK_Dereference);
143 }
144
145 // Obtains ObjectKind of an object. Because class declaration cannot always
146 // be easily obtained from the memory region, it is supplied separately.
147 ObjectKind classifyObject(const MemRegion *MR, const CXXRecordDecl *RD) const;
148
149 // Classifies the object and dumps a user-friendly description string to
150 // the stream.
151 void explainObject(llvm::raw_ostream &OS, const MemRegion *MR,
152 const CXXRecordDecl *RD, MisuseKind MK) const;
153
154 bool belongsTo(const CXXRecordDecl *RD, const llvm::StringSet<> &Set) const;
155
156 class MovedBugVisitor : public BugReporterVisitor {
157 public:
158 MovedBugVisitor(const MoveChecker &Chk, const MemRegion *R,
159 const CXXRecordDecl *RD, MisuseKind MK)
160 : Chk(Chk), Region(R), RD(RD), MK(MK), Found(false) {}
161
162 void Profile(llvm::FoldingSetNodeID &ID) const override {
163 static int X = 0;
164 ID.AddPointer(Ptr: &X);
165 ID.AddPointer(Ptr: Region);
166 // Don't add RD because it's, in theory, uniquely determined by
167 // the region. In practice though, it's not always possible to obtain
168 // the declaration directly from the region, that's why we store it
169 // in the first place.
170 }
171
172 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
173 BugReporterContext &BRC,
174 PathSensitiveBugReport &BR) override;
175
176 private:
177 const MoveChecker &Chk;
178 // The tracked region.
179 const MemRegion *Region;
180 // The class of the tracked object.
181 const CXXRecordDecl *RD;
182 // How exactly the object was misused.
183 const MisuseKind MK;
184 bool Found;
185 };
186
187 AggressivenessKind Aggressiveness = AK_KnownsAndLocals;
188
189public:
190 void setAggressiveness(StringRef Str, CheckerManager &Mgr) {
191 Aggressiveness =
192 llvm::StringSwitch<AggressivenessKind>(Str)
193 .Case(S: "KnownsOnly", Value: AK_KnownsOnly)
194 .Case(S: "KnownsAndLocals", Value: AK_KnownsAndLocals)
195 .Case(S: "All", Value: AK_All)
196 .Default(Value: AK_Invalid);
197
198 if (Aggressiveness == AK_Invalid)
199 Mgr.reportInvalidCheckerOptionValue(C: this, OptionName: "WarnOn",
200 ExpectedValueDesc: "either \"KnownsOnly\", \"KnownsAndLocals\" or \"All\" string value");
201 };
202
203private:
204 BugType BT{this, "Use-after-move", categories::CXXMoveSemantics};
205
206 // Check if the given form of potential misuse of a given object
207 // should be reported. If so, get it reported. The callback from which
208 // this function was called should immediately return after the call
209 // because this function adds one or two transitions.
210 void modelUse(ProgramStateRef State, const MemRegion *Region,
211 const CXXRecordDecl *RD, MisuseKind MK,
212 CheckerContext &C) const;
213
214 // Returns the exploded node against which the report was emitted.
215 // The caller *must* add any further transitions against this node.
216 // Returns nullptr and does not report if such node already exists.
217 ExplodedNode *tryToReportBug(const MemRegion *Region, const CXXRecordDecl *RD,
218 CheckerContext &C, MisuseKind MK) const;
219
220 bool isInMoveSafeContext(const LocationContext *LC) const;
221 bool isStateResetMethod(const CXXMethodDecl *MethodDec) const;
222 bool isMoveSafeMethod(const CXXMethodDecl *MethodDec) const;
223 const ExplodedNode *getMoveLocation(const ExplodedNode *N,
224 const MemRegion *Region,
225 CheckerContext &C) const;
226};
227} // end anonymous namespace
228
229REGISTER_MAP_WITH_PROGRAMSTATE(TrackedRegionMap, const MemRegion *, RegionState)
230
231// Define the inter-checker API.
232namespace clang {
233namespace ento {
234namespace move {
235bool isMovedFrom(ProgramStateRef State, const MemRegion *Region) {
236 const RegionState *RS = State->get<TrackedRegionMap>(key: Region);
237 return RS && (RS->isMoved() || RS->isReported());
238}
239} // namespace move
240} // namespace ento
241} // namespace clang
242
243// If a region is removed all of the subregions needs to be removed too.
244static ProgramStateRef removeFromState(ProgramStateRef State,
245 const MemRegion *Region) {
246 if (!Region)
247 return State;
248 for (auto &E : State->get<TrackedRegionMap>()) {
249 if (E.first->isSubRegionOf(R: Region))
250 State = State->remove<TrackedRegionMap>(K: E.first);
251 }
252 return State;
253}
254
255static bool isAnyBaseRegionReported(ProgramStateRef State,
256 const MemRegion *Region) {
257 for (auto &E : State->get<TrackedRegionMap>()) {
258 if (Region->isSubRegionOf(R: E.first) && E.second.isReported())
259 return true;
260 }
261 return false;
262}
263
264static const MemRegion *unwrapRValueReferenceIndirection(const MemRegion *MR) {
265 if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(Val: MR)) {
266 SymbolRef Sym = SR->getSymbol();
267 if (Sym->getType()->isRValueReferenceType())
268 if (const MemRegion *OriginMR = Sym->getOriginRegion())
269 return OriginMR;
270 }
271 return MR;
272}
273
274PathDiagnosticPieceRef
275MoveChecker::MovedBugVisitor::VisitNode(const ExplodedNode *N,
276 BugReporterContext &BRC,
277 PathSensitiveBugReport &BR) {
278 // We need only the last move of the reported object's region.
279 // The visitor walks the ExplodedGraph backwards.
280 if (Found)
281 return nullptr;
282 ProgramStateRef State = N->getState();
283 ProgramStateRef StatePrev = N->getFirstPred()->getState();
284 const RegionState *TrackedObject = State->get<TrackedRegionMap>(key: Region);
285 const RegionState *TrackedObjectPrev =
286 StatePrev->get<TrackedRegionMap>(key: Region);
287 if (!TrackedObject)
288 return nullptr;
289 if (TrackedObjectPrev && TrackedObject)
290 return nullptr;
291
292 // Retrieve the associated statement.
293 const Stmt *S = N->getStmtForDiagnostics();
294 if (!S)
295 return nullptr;
296 Found = true;
297
298 SmallString<128> Str;
299 llvm::raw_svector_ostream OS(Str);
300
301 ObjectKind OK = Chk.classifyObject(MR: Region, RD);
302 switch (OK.StdKind) {
303 case SK_SmartPtr:
304 if (MK == MK_Dereference) {
305 OS << "Smart pointer";
306 Chk.explainObject(OS, MR: Region, RD, MK);
307 OS << " is reset to null when moved from";
308 break;
309 }
310
311 // If it's not a dereference, we don't care if it was reset to null
312 // or that it is even a smart pointer.
313 [[fallthrough]];
314 case SK_NonStd:
315 case SK_Safe:
316 OS << "Object";
317 Chk.explainObject(OS, MR: Region, RD, MK);
318 OS << " is moved";
319 break;
320 case SK_Unsafe:
321 OS << "Object";
322 Chk.explainObject(OS, MR: Region, RD, MK);
323 OS << " is left in a valid but unspecified state after move";
324 break;
325 }
326
327 // Generate the extra diagnostic.
328 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
329 N->getLocationContext());
330 return std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args: OS.str(), args: true);
331}
332
333const ExplodedNode *MoveChecker::getMoveLocation(const ExplodedNode *N,
334 const MemRegion *Region,
335 CheckerContext &C) const {
336 // Walk the ExplodedGraph backwards and find the first node that referred to
337 // the tracked region.
338 const ExplodedNode *MoveNode = N;
339
340 while (N) {
341 ProgramStateRef State = N->getState();
342 if (!State->get<TrackedRegionMap>(key: Region))
343 break;
344 MoveNode = N;
345 N = N->pred_empty() ? nullptr : *(N->pred_begin());
346 }
347 return MoveNode;
348}
349
350void MoveChecker::modelUse(ProgramStateRef State, const MemRegion *Region,
351 const CXXRecordDecl *RD, MisuseKind MK,
352 CheckerContext &C) const {
353 assert(!C.isDifferent() && "No transitions should have been made by now");
354 const RegionState *RS = State->get<TrackedRegionMap>(key: Region);
355 ObjectKind OK = classifyObject(MR: Region, RD);
356
357 // Just in case: if it's not a smart pointer but it does have operator *,
358 // we shouldn't call the bug a dereference.
359 if (MK == MK_Dereference && OK.StdKind != SK_SmartPtr)
360 MK = MK_FunCall;
361
362 if (!RS || !shouldWarnAbout(OK, MK)
363 || isInMoveSafeContext(LC: C.getLocationContext())) {
364 // Finalize changes made by the caller.
365 C.addTransition(State);
366 return;
367 }
368
369 // Don't report it in case if any base region is already reported.
370 // But still generate a sink in case of UB.
371 // And still finalize changes made by the caller.
372 if (isAnyBaseRegionReported(State, Region)) {
373 if (misuseCausesCrash(MK)) {
374 C.generateSink(State, Pred: C.getPredecessor());
375 } else {
376 C.addTransition(State);
377 }
378 return;
379 }
380
381 ExplodedNode *N = tryToReportBug(Region, RD, C, MK);
382
383 // If the program has already crashed on this path, don't bother.
384 if (!N || N->isSink())
385 return;
386
387 State = State->set<TrackedRegionMap>(K: Region, E: RegionState::getReported());
388 C.addTransition(State, Pred: N);
389}
390
391ExplodedNode *MoveChecker::tryToReportBug(const MemRegion *Region,
392 const CXXRecordDecl *RD,
393 CheckerContext &C,
394 MisuseKind MK) const {
395 if (ExplodedNode *N = misuseCausesCrash(MK) ? C.generateErrorNode()
396 : C.generateNonFatalErrorNode()) {
397 // Uniqueing report to the same object.
398 PathDiagnosticLocation LocUsedForUniqueing;
399 const ExplodedNode *MoveNode = getMoveLocation(N, Region, C);
400
401 if (const Stmt *MoveStmt = MoveNode->getStmtForDiagnostics())
402 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
403 S: MoveStmt, SM: C.getSourceManager(), LAC: MoveNode->getLocationContext());
404
405 // Creating the error message.
406 llvm::SmallString<128> Str;
407 llvm::raw_svector_ostream OS(Str);
408 switch(MK) {
409 case MK_FunCall:
410 OS << "Method called on moved-from object";
411 explainObject(OS, MR: Region, RD, MK);
412 break;
413 case MK_Copy:
414 OS << "Moved-from object";
415 explainObject(OS, MR: Region, RD, MK);
416 OS << " is copied";
417 break;
418 case MK_Move:
419 OS << "Moved-from object";
420 explainObject(OS, MR: Region, RD, MK);
421 OS << " is moved";
422 break;
423 case MK_Dereference:
424 OS << "Dereference of null smart pointer";
425 explainObject(OS, MR: Region, RD, MK);
426 break;
427 }
428
429 auto R = std::make_unique<PathSensitiveBugReport>(
430 args: BT, args: OS.str(), args&: N, args&: LocUsedForUniqueing,
431 args: MoveNode->getLocationContext()->getDecl());
432 R->addVisitor(visitor: std::make_unique<MovedBugVisitor>(args: *this, args&: Region, args&: RD, args&: MK));
433 C.emitReport(R: std::move(R));
434 return N;
435 }
436 return nullptr;
437}
438
439void MoveChecker::checkPostCall(const CallEvent &Call,
440 CheckerContext &C) const {
441 const auto *AFC = dyn_cast<AnyFunctionCall>(Val: &Call);
442 if (!AFC)
443 return;
444
445 ProgramStateRef State = C.getState();
446 const auto MethodDecl = dyn_cast_or_null<CXXMethodDecl>(Val: AFC->getDecl());
447 if (!MethodDecl)
448 return;
449
450 // Check if an object became moved-from.
451 // Object can become moved from after a call to move assignment operator or
452 // move constructor .
453 const auto *ConstructorDecl = dyn_cast<CXXConstructorDecl>(Val: MethodDecl);
454 if (ConstructorDecl && !ConstructorDecl->isMoveConstructor())
455 return;
456
457 if (!ConstructorDecl && !MethodDecl->isMoveAssignmentOperator())
458 return;
459
460 const auto ArgRegion = AFC->getArgSVal(Index: 0).getAsRegion();
461 if (!ArgRegion)
462 return;
463
464 // Skip moving the object to itself.
465 const auto *CC = dyn_cast_or_null<CXXConstructorCall>(Val: &Call);
466 if (CC && CC->getCXXThisVal().getAsRegion() == ArgRegion)
467 return;
468
469 if (const auto *IC = dyn_cast<CXXInstanceCall>(Val: AFC))
470 if (IC->getCXXThisVal().getAsRegion() == ArgRegion)
471 return;
472
473 const MemRegion *BaseRegion = ArgRegion->getBaseRegion();
474 // Skip temp objects because of their short lifetime.
475 if (BaseRegion->getAs<CXXTempObjectRegion>() ||
476 AFC->getArgExpr(Index: 0)->isPRValue())
477 return;
478 // If it has already been reported do not need to modify the state.
479
480 if (State->get<TrackedRegionMap>(key: ArgRegion))
481 return;
482
483 const CXXRecordDecl *RD = MethodDecl->getParent();
484 ObjectKind OK = classifyObject(MR: ArgRegion, RD);
485 if (shouldBeTracked(OK)) {
486 // Mark object as moved-from.
487 State = State->set<TrackedRegionMap>(K: ArgRegion, E: RegionState::getMoved());
488 C.addTransition(State);
489 return;
490 }
491 assert(!C.isDifferent() && "Should not have made transitions on this path!");
492}
493
494bool MoveChecker::isMoveSafeMethod(const CXXMethodDecl *MethodDec) const {
495 // We abandon the cases where bool/void/void* conversion happens.
496 if (const auto *ConversionDec =
497 dyn_cast_or_null<CXXConversionDecl>(Val: MethodDec)) {
498 const Type *Tp = ConversionDec->getConversionType().getTypePtrOrNull();
499 if (!Tp)
500 return false;
501 if (Tp->isBooleanType() || Tp->isVoidType() || Tp->isVoidPointerType())
502 return true;
503 }
504 // Function call `empty` can be skipped.
505 return (MethodDec && MethodDec->getDeclName().isIdentifier() &&
506 (MethodDec->getName().lower() == "empty" ||
507 MethodDec->getName().lower() == "isempty"));
508}
509
510bool MoveChecker::isStateResetMethod(const CXXMethodDecl *MethodDec) const {
511 if (!MethodDec)
512 return false;
513 if (MethodDec->hasAttr<ReinitializesAttr>())
514 return true;
515 if (MethodDec->getDeclName().isIdentifier()) {
516 std::string MethodName = MethodDec->getName().lower();
517 // TODO: Some of these methods (eg., resize) are not always resetting
518 // the state, so we should consider looking at the arguments.
519 if (MethodName == "assign" || MethodName == "clear" ||
520 MethodName == "destroy" || MethodName == "reset" ||
521 MethodName == "resize" || MethodName == "shrink")
522 return true;
523 }
524 return false;
525}
526
527// Don't report an error inside a move related operation.
528// We assume that the programmer knows what she does.
529bool MoveChecker::isInMoveSafeContext(const LocationContext *LC) const {
530 do {
531 const auto *CtxDec = LC->getDecl();
532 auto *CtorDec = dyn_cast_or_null<CXXConstructorDecl>(Val: CtxDec);
533 auto *DtorDec = dyn_cast_or_null<CXXDestructorDecl>(Val: CtxDec);
534 auto *MethodDec = dyn_cast_or_null<CXXMethodDecl>(Val: CtxDec);
535 if (DtorDec || (CtorDec && CtorDec->isCopyOrMoveConstructor()) ||
536 (MethodDec && MethodDec->isOverloadedOperator() &&
537 MethodDec->getOverloadedOperator() == OO_Equal) ||
538 isStateResetMethod(MethodDec) || isMoveSafeMethod(MethodDec))
539 return true;
540 } while ((LC = LC->getParent()));
541 return false;
542}
543
544bool MoveChecker::belongsTo(const CXXRecordDecl *RD,
545 const llvm::StringSet<> &Set) const {
546 const IdentifierInfo *II = RD->getIdentifier();
547 return II && Set.count(Key: II->getName());
548}
549
550MoveChecker::ObjectKind
551MoveChecker::classifyObject(const MemRegion *MR,
552 const CXXRecordDecl *RD) const {
553 // Local variables and local rvalue references are classified as "Local".
554 // For the purposes of this checker, we classify move-safe STL types
555 // as not-"STL" types, because that's how the checker treats them.
556 MR = unwrapRValueReferenceIndirection(MR);
557 bool IsLocal =
558 isa_and_nonnull<VarRegion, CXXLifetimeExtendedObjectRegion>(Val: MR) &&
559 isa<StackSpaceRegion>(Val: MR->getMemorySpace());
560
561 if (!RD || !RD->getDeclContext()->isStdNamespace())
562 return { .IsLocal: IsLocal, .StdKind: SK_NonStd };
563
564 if (belongsTo(RD, Set: StdSmartPtrClasses))
565 return { .IsLocal: IsLocal, .StdKind: SK_SmartPtr };
566
567 if (belongsTo(RD, Set: StdSafeClasses))
568 return { .IsLocal: IsLocal, .StdKind: SK_Safe };
569
570 return { .IsLocal: IsLocal, .StdKind: SK_Unsafe };
571}
572
573void MoveChecker::explainObject(llvm::raw_ostream &OS, const MemRegion *MR,
574 const CXXRecordDecl *RD, MisuseKind MK) const {
575 // We may need a leading space every time we actually explain anything,
576 // and we never know if we are to explain anything until we try.
577 if (const auto DR =
578 dyn_cast_or_null<DeclRegion>(Val: unwrapRValueReferenceIndirection(MR))) {
579 const auto *RegionDecl = cast<NamedDecl>(Val: DR->getDecl());
580 OS << " '" << RegionDecl->getDeclName() << "'";
581 }
582
583 ObjectKind OK = classifyObject(MR, RD);
584 switch (OK.StdKind) {
585 case SK_NonStd:
586 case SK_Safe:
587 break;
588 case SK_SmartPtr:
589 if (MK != MK_Dereference)
590 break;
591
592 // We only care about the type if it's a dereference.
593 [[fallthrough]];
594 case SK_Unsafe:
595 OS << " of type '" << RD->getQualifiedNameAsString() << "'";
596 break;
597 };
598}
599
600void MoveChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const {
601 ProgramStateRef State = C.getState();
602
603 // Remove the MemRegions from the map on which a ctor/dtor call or assignment
604 // happened.
605
606 // Checking constructor calls.
607 if (const auto *CC = dyn_cast<CXXConstructorCall>(Val: &Call)) {
608 State = removeFromState(State, Region: CC->getCXXThisVal().getAsRegion());
609 auto CtorDec = CC->getDecl();
610 // Check for copying a moved-from object and report the bug.
611 if (CtorDec && CtorDec->isCopyOrMoveConstructor()) {
612 const MemRegion *ArgRegion = CC->getArgSVal(Index: 0).getAsRegion();
613 const CXXRecordDecl *RD = CtorDec->getParent();
614 MisuseKind MK = CtorDec->isMoveConstructor() ? MK_Move : MK_Copy;
615 modelUse(State, Region: ArgRegion, RD, MK, C);
616 return;
617 }
618 }
619
620 const auto IC = dyn_cast<CXXInstanceCall>(Val: &Call);
621 if (!IC)
622 return;
623
624 const MemRegion *ThisRegion = IC->getCXXThisVal().getAsRegion();
625 if (!ThisRegion)
626 return;
627
628 // The remaining part is check only for method call on a moved-from object.
629 const auto MethodDecl = dyn_cast_or_null<CXXMethodDecl>(Val: IC->getDecl());
630 if (!MethodDecl)
631 return;
632
633 // Calling a destructor on a moved object is fine.
634 if (isa<CXXDestructorDecl>(Val: MethodDecl))
635 return;
636
637 // We want to investigate the whole object, not only sub-object of a parent
638 // class in which the encountered method defined.
639 ThisRegion = ThisRegion->getMostDerivedObjectRegion();
640
641 if (isStateResetMethod(MethodDec: MethodDecl)) {
642 State = removeFromState(State, Region: ThisRegion);
643 C.addTransition(State);
644 return;
645 }
646
647 if (isMoveSafeMethod(MethodDec: MethodDecl))
648 return;
649
650 // Store class declaration as well, for bug reporting purposes.
651 const CXXRecordDecl *RD = MethodDecl->getParent();
652
653 if (MethodDecl->isOverloadedOperator()) {
654 OverloadedOperatorKind OOK = MethodDecl->getOverloadedOperator();
655
656 if (OOK == OO_Equal) {
657 // Remove the tracked object for every assignment operator, but report bug
658 // only for move or copy assignment's argument.
659 State = removeFromState(State, Region: ThisRegion);
660
661 if (MethodDecl->isCopyAssignmentOperator() ||
662 MethodDecl->isMoveAssignmentOperator()) {
663 const MemRegion *ArgRegion = IC->getArgSVal(Index: 0).getAsRegion();
664 MisuseKind MK =
665 MethodDecl->isMoveAssignmentOperator() ? MK_Move : MK_Copy;
666 modelUse(State, Region: ArgRegion, RD, MK, C);
667 return;
668 }
669 C.addTransition(State);
670 return;
671 }
672
673 if (OOK == OO_Star || OOK == OO_Arrow) {
674 modelUse(State, Region: ThisRegion, RD, MK: MK_Dereference, C);
675 return;
676 }
677 }
678
679 modelUse(State, Region: ThisRegion, RD, MK: MK_FunCall, C);
680}
681
682void MoveChecker::checkDeadSymbols(SymbolReaper &SymReaper,
683 CheckerContext &C) const {
684 ProgramStateRef State = C.getState();
685 TrackedRegionMapTy TrackedRegions = State->get<TrackedRegionMap>();
686 for (auto E : TrackedRegions) {
687 const MemRegion *Region = E.first;
688 bool IsRegDead = !SymReaper.isLiveRegion(region: Region);
689
690 // Remove the dead regions from the region map.
691 if (IsRegDead) {
692 State = State->remove<TrackedRegionMap>(K: Region);
693 }
694 }
695 C.addTransition(State);
696}
697
698ProgramStateRef MoveChecker::checkRegionChanges(
699 ProgramStateRef State, const InvalidatedSymbols *Invalidated,
700 ArrayRef<const MemRegion *> RequestedRegions,
701 ArrayRef<const MemRegion *> InvalidatedRegions,
702 const LocationContext *LCtx, const CallEvent *Call) const {
703 if (Call) {
704 // Relax invalidation upon function calls: only invalidate parameters
705 // that are passed directly via non-const pointers or non-const references
706 // or rvalue references.
707 // In case of an InstanceCall don't invalidate the this-region since
708 // it is fully handled in checkPreCall and checkPostCall.
709 const MemRegion *ThisRegion = nullptr;
710 if (const auto *IC = dyn_cast<CXXInstanceCall>(Val: Call))
711 ThisRegion = IC->getCXXThisVal().getAsRegion();
712
713 // Requested ("explicit") regions are the regions passed into the call
714 // directly, but not all of them end up being invalidated.
715 // But when they do, they appear in the InvalidatedRegions array as well.
716 for (const auto *Region : RequestedRegions) {
717 if (ThisRegion != Region &&
718 llvm::is_contained(Range&: InvalidatedRegions, Element: Region))
719 State = removeFromState(State, Region);
720 }
721 } else {
722 // For invalidations that aren't caused by calls, assume nothing. In
723 // particular, direct write into an object's field invalidates the status.
724 for (const auto *Region : InvalidatedRegions)
725 State = removeFromState(State, Region: Region->getBaseRegion());
726 }
727
728 return State;
729}
730
731void MoveChecker::printState(raw_ostream &Out, ProgramStateRef State,
732 const char *NL, const char *Sep) const {
733
734 TrackedRegionMapTy RS = State->get<TrackedRegionMap>();
735
736 if (!RS.isEmpty()) {
737 Out << Sep << "Moved-from objects :" << NL;
738 for (auto I: RS) {
739 I.first->dumpToStream(os&: Out);
740 if (I.second.isMoved())
741 Out << ": moved";
742 else
743 Out << ": moved and reported";
744 Out << NL;
745 }
746 }
747}
748void ento::registerMoveChecker(CheckerManager &mgr) {
749 MoveChecker *chk = mgr.registerChecker<MoveChecker>();
750 chk->setAggressiveness(
751 Str: mgr.getAnalyzerOptions().getCheckerStringOption(C: chk, OptionName: "WarnOn"), Mgr&: mgr);
752}
753
754bool ento::shouldRegisterMoveChecker(const CheckerManager &mgr) {
755 return true;
756}
757