1//=-- ExprEngineObjC.cpp - ExprEngine support for Objective-C ---*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines ExprEngine's support for Objective-C expressions.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/AST/StmtObjC.h"
14#include "clang/StaticAnalyzer/Core/CheckerManager.h"
15#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17
18using namespace clang;
19using namespace ento;
20
21void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex,
22 ExplodedNode *Pred,
23 ExplodedNodeSet &Dst) {
24 ProgramStateRef state = Pred->getState();
25 const LocationContext *LCtx = Pred->getLocationContext();
26 SVal baseVal = state->getSVal(Ex: Ex->getBase(), LCtx);
27 SVal location = state->getLValue(D: Ex->getDecl(), Base: baseVal);
28
29 ExplodedNodeSet dstIvar;
30 StmtNodeBuilder Bldr(Pred, dstIvar, *currBldrCtx);
31 Bldr.generateNode(S: Ex, Pred, St: state->BindExpr(S: Ex, LCtx, V: location));
32
33 // Perform the post-condition check of the ObjCIvarRefExpr and store
34 // the created nodes in 'Dst'.
35 getCheckerManager().runCheckersForPostStmt(Dst, Src: dstIvar, S: Ex, Eng&: *this);
36}
37
38void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
39 ExplodedNode *Pred,
40 ExplodedNodeSet &Dst) {
41 getCheckerManager().runCheckersForPreStmt(Dst, Src: Pred, S, Eng&: *this);
42}
43
44/// Generate a node in \p Bldr for an iteration statement using ObjC
45/// for-loop iterator.
46static void populateObjCForDestinationSet(
47 ExplodedNodeSet &dstLocation, SValBuilder &svalBuilder,
48 const ObjCForCollectionStmt *S, const Stmt *elem, SVal elementV,
49 SymbolManager &SymMgr, const NodeBuilderContext *currBldrCtx,
50 StmtNodeBuilder &Bldr, bool hasElements) {
51
52 for (ExplodedNode *Pred : dstLocation) {
53 ProgramStateRef state = Pred->getState();
54 const LocationContext *LCtx = Pred->getLocationContext();
55
56 ProgramStateRef nextState =
57 ExprEngine::setWhetherHasMoreIteration(State: state, O: S, LC: LCtx, HasMoreIteraton: hasElements);
58
59 if (auto MV = elementV.getAs<loc::MemRegionVal>())
60 if (const auto *R = dyn_cast<TypedValueRegion>(Val: MV->getRegion())) {
61 // FIXME: The proper thing to do is to really iterate over the
62 // container. We will do this with dispatch logic to the store.
63 // For now, just 'conjure' up a symbolic value.
64 QualType T = R->getValueType();
65 assert(Loc::isLocType(T));
66
67 SVal V;
68 if (hasElements) {
69 SymbolRef Sym = SymMgr.conjureSymbol(E: elem, LCtx, T,
70 VisitCount: currBldrCtx->blockCount());
71 V = svalBuilder.makeLoc(sym: Sym);
72 } else {
73 V = svalBuilder.makeIntVal(integer: 0, type: T);
74 }
75
76 nextState = nextState->bindLoc(LV: elementV, V, LCtx);
77 }
78
79 Bldr.generateNode(S, Pred, St: nextState);
80 }
81}
82
83void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
84 ExplodedNode *Pred,
85 ExplodedNodeSet &Dst) {
86
87 // ObjCForCollectionStmts are processed in two places. This method
88 // handles the case where an ObjCForCollectionStmt* occurs as one of the
89 // statements within a basic block. This transfer function does two things:
90 //
91 // (1) binds the next container value to 'element'. This creates a new
92 // node in the ExplodedGraph.
93 //
94 // (2) note whether the collection has any more elements (or in other words,
95 // whether the loop has more iterations). This will be tested in
96 // processBranch.
97 //
98 // FIXME: Eventually this logic should actually do dispatches to
99 // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration).
100 // This will require simulating a temporary NSFastEnumerationState, either
101 // through an SVal or through the use of MemRegions. This value can
102 // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop
103 // terminates we reclaim the temporary (it goes out of scope) and we
104 // we can test if the SVal is 0 or if the MemRegion is null (depending
105 // on what approach we take).
106 //
107 // For now: simulate (1) by assigning either a symbol or nil if the
108 // container is empty. Thus this transfer function will by default
109 // result in state splitting.
110
111 const Stmt *elem = S->getElement();
112 const Stmt *collection = S->getCollection();
113 ProgramStateRef state = Pred->getState();
114 SVal collectionV = state->getSVal(Ex: collection, LCtx: Pred->getLocationContext());
115
116 SVal elementV;
117 if (const auto *DS = dyn_cast<DeclStmt>(Val: elem)) {
118 const VarDecl *elemD = cast<VarDecl>(Val: DS->getSingleDecl());
119 assert(elemD->getInit() == nullptr);
120 elementV = state->getLValue(VD: elemD, LC: Pred->getLocationContext());
121 } else {
122 elementV = state->getSVal(Ex: elem, LCtx: Pred->getLocationContext());
123 }
124
125 bool isContainerNull = state->isNull(V: collectionV).isConstrainedTrue();
126
127 ExplodedNodeSet dstLocation;
128 evalLocation(Dst&: dstLocation, NodeEx: S, BoundEx: elem, Pred, St: state, location: elementV, isLoad: false);
129
130 ExplodedNodeSet Tmp;
131 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
132
133 if (!isContainerNull)
134 populateObjCForDestinationSet(dstLocation, svalBuilder, S, elem, elementV,
135 SymMgr, currBldrCtx, Bldr,
136 /*hasElements=*/true);
137
138 populateObjCForDestinationSet(dstLocation, svalBuilder, S, elem, elementV,
139 SymMgr, currBldrCtx, Bldr,
140 /*hasElements=*/false);
141
142 // Finally, run any custom checkers.
143 // FIXME: Eventually all pre- and post-checks should live in VisitStmt.
144 getCheckerManager().runCheckersForPostStmt(Dst, Src: Tmp, S, Eng&: *this);
145}
146
147void ExprEngine::VisitObjCMessage(const ObjCMessageExpr *ME,
148 ExplodedNode *Pred,
149 ExplodedNodeSet &Dst) {
150 CallEventManager &CEMgr = getStateManager().getCallEventManager();
151 CallEventRef<ObjCMethodCall> Msg = CEMgr.getObjCMethodCall(
152 E: ME, State: Pred->getState(), LCtx: Pred->getLocationContext(), ElemRef: getCFGElementRef());
153
154 // There are three cases for the receiver:
155 // (1) it is definitely nil,
156 // (2) it is definitely non-nil, and
157 // (3) we don't know.
158 //
159 // If the receiver is definitely nil, we skip the pre/post callbacks and
160 // instead call the ObjCMessageNil callbacks and return.
161 //
162 // If the receiver is definitely non-nil, we call the pre- callbacks,
163 // evaluate the call, and call the post- callbacks.
164 //
165 // If we don't know, we drop the potential nil flow and instead
166 // continue from the assumed non-nil state as in (2). This approach
167 // intentionally drops coverage in order to prevent false alarms
168 // in the following scenario:
169 //
170 // id result = [o someMethod]
171 // if (result) {
172 // if (!o) {
173 // // <-- This program point should be unreachable because if o is nil
174 // // it must the case that result is nil as well.
175 // }
176 // }
177 //
178 // However, it also loses coverage of the nil path prematurely,
179 // leading to missed reports.
180 //
181 // It's possible to handle this by performing a state split on every call:
182 // explore the state where the receiver is non-nil, and independently
183 // explore the state where it's nil. But this is not only slow, but
184 // completely unwarranted. The mere presence of the message syntax in the code
185 // isn't sufficient evidence that nil is a realistic possibility.
186 //
187 // An ideal solution would be to add the following constraint that captures
188 // both possibilities without splitting the state:
189 //
190 // ($x == 0) => ($y == 0) (1)
191 //
192 // where in our case '$x' is the receiver symbol, '$y' is the returned symbol,
193 // and '=>' is logical implication. But RangeConstraintManager can't handle
194 // such constraints yet, so for now we go with a simpler, more restrictive
195 // constraint: $x != 0, from which (1) follows as a vacuous truth.
196 if (Msg->isInstanceMessage()) {
197 SVal recVal = Msg->getReceiverSVal();
198 if (!recVal.isUndef()) {
199 // Bifurcate the state into nil and non-nil ones.
200 DefinedOrUnknownSVal receiverVal =
201 recVal.castAs<DefinedOrUnknownSVal>();
202 ProgramStateRef State = Pred->getState();
203
204 ProgramStateRef notNilState, nilState;
205 std::tie(args&: notNilState, args&: nilState) = State->assume(Cond: receiverVal);
206
207 // Receiver is definitely nil, so run ObjCMessageNil callbacks and return.
208 if (nilState && !notNilState) {
209 ExplodedNodeSet dstNil;
210 StmtNodeBuilder Bldr(Pred, dstNil, *currBldrCtx);
211 bool HasTag = Pred->getLocation().getTag();
212 Pred = Bldr.generateNode(S: ME, Pred, St: nilState, tag: nullptr,
213 K: ProgramPoint::PreStmtKind);
214 assert((Pred || HasTag) && "Should have cached out already!");
215 (void)HasTag;
216 if (!Pred)
217 return;
218
219 ExplodedNodeSet dstPostCheckers;
220 getCheckerManager().runCheckersForObjCMessageNil(Dst&: dstPostCheckers, Src: Pred,
221 msg: *Msg, Eng&: *this);
222 for (auto *I : dstPostCheckers)
223 finishArgumentConstruction(Dst, Pred: I, Call: *Msg);
224 return;
225 }
226
227 ExplodedNodeSet dstNonNil;
228 StmtNodeBuilder Bldr(Pred, dstNonNil, *currBldrCtx);
229 // Generate a transition to the non-nil state, dropping any potential
230 // nil flow.
231 if (notNilState != State) {
232 bool HasTag = Pred->getLocation().getTag();
233 Pred = Bldr.generateNode(S: ME, Pred, St: notNilState);
234 assert((Pred || HasTag) && "Should have cached out already!");
235 (void)HasTag;
236 if (!Pred)
237 return;
238 }
239 }
240 }
241
242 // Handle the previsits checks.
243 ExplodedNodeSet dstPrevisit;
244 getCheckerManager().runCheckersForPreObjCMessage(Dst&: dstPrevisit, Src: Pred,
245 msg: *Msg, Eng&: *this);
246 ExplodedNodeSet dstGenericPrevisit;
247 getCheckerManager().runCheckersForPreCall(Dst&: dstGenericPrevisit, Src: dstPrevisit,
248 Call: *Msg, Eng&: *this);
249
250 // Proceed with evaluate the message expression.
251 ExplodedNodeSet dstEval;
252 StmtNodeBuilder Bldr(dstGenericPrevisit, dstEval, *currBldrCtx);
253
254 for (ExplodedNodeSet::iterator DI = dstGenericPrevisit.begin(),
255 DE = dstGenericPrevisit.end(); DI != DE; ++DI) {
256 ExplodedNode *Pred = *DI;
257 ProgramStateRef State = Pred->getState();
258 CallEventRef<ObjCMethodCall> UpdatedMsg = Msg.cloneWithState(State);
259
260 if (UpdatedMsg->isInstanceMessage()) {
261 SVal recVal = UpdatedMsg->getReceiverSVal();
262 if (!recVal.isUndef()) {
263 if (ObjCNoRet.isImplicitNoReturn(ME)) {
264 // If we raise an exception, for now treat it as a sink.
265 // Eventually we will want to handle exceptions properly.
266 Bldr.generateSink(S: ME, Pred, St: State);
267 continue;
268 }
269 }
270 } else {
271 // Check for special class methods that are known to not return
272 // and that we should treat as a sink.
273 if (ObjCNoRet.isImplicitNoReturn(ME)) {
274 // If we raise an exception, for now treat it as a sink.
275 // Eventually we will want to handle exceptions properly.
276 Bldr.generateSink(S: ME, Pred, St: Pred->getState());
277 continue;
278 }
279 }
280
281 defaultEvalCall(B&: Bldr, Pred, Call: *UpdatedMsg);
282 }
283
284 // If there were constructors called for object-type arguments, clean them up.
285 ExplodedNodeSet dstArgCleanup;
286 for (auto *I : dstEval)
287 finishArgumentConstruction(Dst&: dstArgCleanup, Pred: I, Call: *Msg);
288
289 ExplodedNodeSet dstPostvisit;
290 getCheckerManager().runCheckersForPostCall(Dst&: dstPostvisit, Src: dstArgCleanup,
291 Call: *Msg, Eng&: *this);
292
293 // Finally, perform the post-condition check of the ObjCMessageExpr and store
294 // the created nodes in 'Dst'.
295 getCheckerManager().runCheckersForPostObjCMessage(Dst, Src: dstPostvisit,
296 msg: *Msg, Eng&: *this);
297}
298