| 1 | //=-- ExprEngineObjC.cpp - ExprEngine support for Objective-C ---*- C++ -*-===// |
| 2 | // |
| 3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| 4 | // See https://llvm.org/LICENSE.txt for license information. |
| 5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| 6 | // |
| 7 | //===----------------------------------------------------------------------===// |
| 8 | // |
| 9 | // This file defines ExprEngine's support for Objective-C expressions. |
| 10 | // |
| 11 | //===----------------------------------------------------------------------===// |
| 12 | |
| 13 | #include "clang/AST/StmtObjC.h" |
| 14 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 15 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
| 16 | #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" |
| 17 | |
| 18 | using namespace clang; |
| 19 | using namespace ento; |
| 20 | |
| 21 | void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex, |
| 22 | ExplodedNode *Pred, |
| 23 | ExplodedNodeSet &Dst) { |
| 24 | ProgramStateRef state = Pred->getState(); |
| 25 | const StackFrame *SF = Pred->getStackFrame(); |
| 26 | SVal baseVal = state->getSVal(E: Ex->getBase(), SF); |
| 27 | SVal location = state->getLValue(D: Ex->getDecl(), Base: baseVal); |
| 28 | |
| 29 | ExplodedNode *N = Engine.makeNodeWithBinding(Pred, E: Ex, V: location); |
| 30 | |
| 31 | // Perform the post-condition check of the ObjCIvarRefExpr and store |
| 32 | // the created nodes in 'Dst'. |
| 33 | getCheckerManager().runCheckersForPostStmt(Dst, Src: N, S: Ex, Eng&: *this); |
| 34 | } |
| 35 | |
| 36 | void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, |
| 37 | ExplodedNode *Pred, |
| 38 | ExplodedNodeSet &Dst) { |
| 39 | getCheckerManager().runCheckersForPreStmt(Dst, Src: Pred, S, Eng&: *this); |
| 40 | } |
| 41 | |
| 42 | void ExprEngine::populateObjCForDestinationSet(const ObjCForCollectionStmt *S, |
| 43 | ExplodedNode *Pred, |
| 44 | ExplodedNodeSet &Dst, |
| 45 | SVal ElementV, |
| 46 | bool HasElements) { |
| 47 | ProgramStateRef State = Pred->getState(); |
| 48 | const StackFrame *SF = Pred->getStackFrame(); |
| 49 | |
| 50 | State = ExprEngine::setWhetherHasMoreIteration(State, O: S, SF, HasMoreIteraton: HasElements); |
| 51 | |
| 52 | if (auto MV = ElementV.getAs<loc::MemRegionVal>()) |
| 53 | if (const auto *R = dyn_cast<TypedValueRegion>(Val: MV->getRegion())) { |
| 54 | // FIXME: The proper thing to do is to really iterate over the |
| 55 | // container. We will do this with dispatch logic to the store. |
| 56 | // For now, just 'conjure' up a symbolic value. |
| 57 | QualType T = R->getValueType(); |
| 58 | assert(Loc::isLocType(T)); |
| 59 | |
| 60 | SVal V; |
| 61 | if (HasElements) { |
| 62 | SymbolRef Sym = SymMgr.conjureSymbol(Elem: getCFGElementRef(), SF, T, |
| 63 | VisitCount: getNumVisitedCurrent()); |
| 64 | V = svalBuilder.makeLoc(sym: Sym); |
| 65 | } else { |
| 66 | V = svalBuilder.makeIntVal(integer: 0, type: T); |
| 67 | } |
| 68 | |
| 69 | State = State->bindLoc(LV: ElementV, V, SF); |
| 70 | } |
| 71 | |
| 72 | Dst.insert(N: Engine.makePostStmtNode(S, State, Pred)); |
| 73 | } |
| 74 | |
| 75 | void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, |
| 76 | ExplodedNode *Pred, |
| 77 | ExplodedNodeSet &Dst) { |
| 78 | |
| 79 | // ObjCForCollectionStmts are processed in two places. This method |
| 80 | // handles the case where an ObjCForCollectionStmt* occurs as one of the |
| 81 | // statements within a basic block. This transfer function does two things: |
| 82 | // |
| 83 | // (1) binds the next container value to 'element'. This creates a new |
| 84 | // node in the ExplodedGraph. |
| 85 | // |
| 86 | // (2) note whether the collection has any more elements (or in other words, |
| 87 | // whether the loop has more iterations). This will be tested in |
| 88 | // processBranch. |
| 89 | // |
| 90 | // FIXME: Eventually this logic should actually do dispatches to |
| 91 | // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration). |
| 92 | // This will require simulating a temporary NSFastEnumerationState, either |
| 93 | // through an SVal or through the use of MemRegions. This value can |
| 94 | // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop |
| 95 | // terminates we reclaim the temporary (it goes out of scope) and we |
| 96 | // we can test if the SVal is 0 or if the MemRegion is null (depending |
| 97 | // on what approach we take). |
| 98 | // |
| 99 | // For now: simulate (1) by assigning either a symbol or nil if the |
| 100 | // container is empty. Thus this transfer function will by default |
| 101 | // result in state splitting. |
| 102 | |
| 103 | const Stmt *elem = S->getElement(); |
| 104 | const Expr *collection = S->getCollection(); |
| 105 | ProgramStateRef state = Pred->getState(); |
| 106 | |
| 107 | SVal collectionV = state->getSVal(E: collection, SF: Pred->getStackFrame()); |
| 108 | |
| 109 | SVal elementV = UnknownVal(); |
| 110 | if (const auto *DS = dyn_cast<DeclStmt>(Val: elem)) { |
| 111 | const VarDecl *elemD = cast<VarDecl>(Val: DS->getSingleDecl()); |
| 112 | assert(elemD->getInit() == nullptr); |
| 113 | elementV = state->getLValue(VD: elemD, SF: Pred->getStackFrame()); |
| 114 | } else if (const auto *Ex = dyn_cast<Expr>(Val: elem)) { |
| 115 | elementV = state->getSVal(E: Ex, SF: Pred->getStackFrame()); |
| 116 | } |
| 117 | |
| 118 | bool isContainerNull = state->isNull(V: collectionV).isConstrainedTrue(); |
| 119 | |
| 120 | ExplodedNodeSet DstLocation; // states in `DstLocation` may differ from `Pred` |
| 121 | evalLocation(Dst&: DstLocation, NodeEx: S, BoundEx: elem, Pred, St: state, location: elementV, isLoad: false); |
| 122 | |
| 123 | for (ExplodedNode *N : DstLocation) { |
| 124 | ExplodedNodeSet Tmp; |
| 125 | |
| 126 | if (!isContainerNull) |
| 127 | populateObjCForDestinationSet(S, Pred: N, Dst&: Tmp, ElementV: elementV, /*hasElements=*/HasElements: true); |
| 128 | |
| 129 | populateObjCForDestinationSet(S, Pred: N, Dst&: Tmp, ElementV: elementV, /*hasElements=*/HasElements: false); |
| 130 | |
| 131 | // Finally, run any custom checkers. |
| 132 | // FIXME: Eventually all pre- and post-checks should live in VisitStmt. |
| 133 | getCheckerManager().runCheckersForPostStmt(Dst, Src: Tmp, S, Eng&: *this); |
| 134 | } |
| 135 | } |
| 136 | |
| 137 | void ExprEngine::VisitObjCMessage(const ObjCMessageExpr *ME, |
| 138 | ExplodedNode *Pred, |
| 139 | ExplodedNodeSet &Dst) { |
| 140 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 141 | CallEventRef<ObjCMethodCall> Msg = CEMgr.getObjCMethodCall( |
| 142 | E: ME, State: Pred->getState(), SF: Pred->getStackFrame(), ElemRef: getCFGElementRef()); |
| 143 | |
| 144 | // There are three cases for the receiver: |
| 145 | // (1) it is definitely nil, |
| 146 | // (2) it is definitely non-nil, and |
| 147 | // (3) we don't know. |
| 148 | // |
| 149 | // If the receiver is definitely nil, we skip the pre/post callbacks and |
| 150 | // instead call the ObjCMessageNil callbacks and return. |
| 151 | // |
| 152 | // If the receiver is definitely non-nil, we call the pre- callbacks, |
| 153 | // evaluate the call, and call the post- callbacks. |
| 154 | // |
| 155 | // If we don't know, we drop the potential nil flow and instead |
| 156 | // continue from the assumed non-nil state as in (2). This approach |
| 157 | // intentionally drops coverage in order to prevent false alarms |
| 158 | // in the following scenario: |
| 159 | // |
| 160 | // id result = [o someMethod] |
| 161 | // if (result) { |
| 162 | // if (!o) { |
| 163 | // // <-- This program point should be unreachable because if o is nil |
| 164 | // // it must the case that result is nil as well. |
| 165 | // } |
| 166 | // } |
| 167 | // |
| 168 | // However, it also loses coverage of the nil path prematurely, |
| 169 | // leading to missed reports. |
| 170 | // |
| 171 | // It's possible to handle this by performing a state split on every call: |
| 172 | // explore the state where the receiver is non-nil, and independently |
| 173 | // explore the state where it's nil. But this is not only slow, but |
| 174 | // completely unwarranted. The mere presence of the message syntax in the code |
| 175 | // isn't sufficient evidence that nil is a realistic possibility. |
| 176 | // |
| 177 | // An ideal solution would be to add the following constraint that captures |
| 178 | // both possibilities without splitting the state: |
| 179 | // |
| 180 | // ($x == 0) => ($y == 0) (1) |
| 181 | // |
| 182 | // where in our case '$x' is the receiver symbol, '$y' is the returned symbol, |
| 183 | // and '=>' is logical implication. But RangeConstraintManager can't handle |
| 184 | // such constraints yet, so for now we go with a simpler, more restrictive |
| 185 | // constraint: $x != 0, from which (1) follows as a vacuous truth. |
| 186 | if (Msg->isInstanceMessage()) { |
| 187 | SVal recVal = Msg->getReceiverSVal(); |
| 188 | if (!recVal.isUndef()) { |
| 189 | // Bifurcate the state into nil and non-nil ones. |
| 190 | DefinedOrUnknownSVal receiverVal = |
| 191 | recVal.castAs<DefinedOrUnknownSVal>(); |
| 192 | ProgramStateRef State = Pred->getState(); |
| 193 | |
| 194 | ProgramStateRef notNilState, nilState; |
| 195 | std::tie(args&: notNilState, args&: nilState) = State->assume(Cond: receiverVal); |
| 196 | |
| 197 | // Receiver is definitely nil, so run ObjCMessageNil callbacks and return. |
| 198 | if (nilState && !notNilState) { |
| 199 | PreStmt PS(ME, Pred->getStackFrame(), nullptr); |
| 200 | Pred = Engine.makeNode(Loc: PS, State: nilState, Pred); |
| 201 | if (!Pred) |
| 202 | return; |
| 203 | |
| 204 | ExplodedNodeSet dstPostCheckers; |
| 205 | getCheckerManager().runCheckersForObjCMessageNil(Dst&: dstPostCheckers, Src: Pred, |
| 206 | msg: *Msg, Eng&: *this); |
| 207 | for (auto *I : dstPostCheckers) |
| 208 | finishArgumentConstruction(Dst, Pred: I, Call: *Msg); |
| 209 | return; |
| 210 | } |
| 211 | |
| 212 | // Generate a transition to the non-nil state, dropping any potential |
| 213 | // nil flow. |
| 214 | if (notNilState != State) { |
| 215 | Pred = Engine.makePostStmtNode(S: ME, State: notNilState, Pred); |
| 216 | if (!Pred) |
| 217 | return; |
| 218 | } |
| 219 | } |
| 220 | } |
| 221 | |
| 222 | // Handle the previsits checks. |
| 223 | ExplodedNodeSet dstPrevisit; |
| 224 | getCheckerManager().runCheckersForPreObjCMessage(Dst&: dstPrevisit, Src: Pred, |
| 225 | msg: *Msg, Eng&: *this); |
| 226 | ExplodedNodeSet dstGenericPrevisit; |
| 227 | getCheckerManager().runCheckersForPreCall(Dst&: dstGenericPrevisit, Src: dstPrevisit, |
| 228 | Call: *Msg, Eng&: *this); |
| 229 | |
| 230 | // Proceed with evaluate the message expression. |
| 231 | ExplodedNodeSet dstEval; |
| 232 | |
| 233 | for (ExplodedNode *Pred : dstGenericPrevisit) { |
| 234 | ProgramStateRef State = Pred->getState(); |
| 235 | CallEventRef<ObjCMethodCall> UpdatedMsg = Msg.cloneWithState(State); |
| 236 | |
| 237 | if (ObjCNoRet.isImplicitNoReturn(ME) && |
| 238 | !(UpdatedMsg->isInstanceMessage() && |
| 239 | UpdatedMsg->getReceiverSVal().isUndef())) { |
| 240 | // If we raise an exception, for now treat it as a sink. |
| 241 | // Eventually we will want to handle exceptions properly. |
| 242 | Engine.makePostStmtNode(S: ME, State, Pred, /*MarkAsSink=*/true); |
| 243 | continue; |
| 244 | } |
| 245 | |
| 246 | defaultEvalCall(Dst&: dstEval, Pred, Call: *UpdatedMsg); |
| 247 | } |
| 248 | |
| 249 | // If there were constructors called for object-type arguments, clean them up. |
| 250 | ExplodedNodeSet dstArgCleanup; |
| 251 | for (auto *I : dstEval) |
| 252 | finishArgumentConstruction(Dst&: dstArgCleanup, Pred: I, Call: *Msg); |
| 253 | |
| 254 | ExplodedNodeSet dstPostvisit; |
| 255 | getCheckerManager().runCheckersForPostCall(Dst&: dstPostvisit, Src: dstArgCleanup, |
| 256 | Call: *Msg, Eng&: *this); |
| 257 | |
| 258 | // Finally, perform the post-condition check of the ObjCMessageExpr and store |
| 259 | // the created nodes in 'Dst'. |
| 260 | getCheckerManager().runCheckersForPostObjCMessage(Dst, Src: dstPostvisit, |
| 261 | msg: *Msg, Eng&: *this); |
| 262 | } |
| 263 | |