1//=-- ExprEngineObjC.cpp - ExprEngine support for Objective-C ---*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines ExprEngine's support for Objective-C expressions.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/AST/StmtObjC.h"
14#include "clang/StaticAnalyzer/Core/CheckerManager.h"
15#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17
18using namespace clang;
19using namespace ento;
20
21void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex,
22 ExplodedNode *Pred,
23 ExplodedNodeSet &Dst) {
24 ProgramStateRef state = Pred->getState();
25 const StackFrame *SF = Pred->getStackFrame();
26 SVal baseVal = state->getSVal(E: Ex->getBase(), SF);
27 SVal location = state->getLValue(D: Ex->getDecl(), Base: baseVal);
28
29 ExplodedNode *N = Engine.makeNodeWithBinding(Pred, E: Ex, V: location);
30
31 // Perform the post-condition check of the ObjCIvarRefExpr and store
32 // the created nodes in 'Dst'.
33 getCheckerManager().runCheckersForPostStmt(Dst, Src: N, S: Ex, Eng&: *this);
34}
35
36void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
37 ExplodedNode *Pred,
38 ExplodedNodeSet &Dst) {
39 getCheckerManager().runCheckersForPreStmt(Dst, Src: Pred, S, Eng&: *this);
40}
41
42void ExprEngine::populateObjCForDestinationSet(const ObjCForCollectionStmt *S,
43 ExplodedNode *Pred,
44 ExplodedNodeSet &Dst,
45 SVal ElementV,
46 bool HasElements) {
47 ProgramStateRef State = Pred->getState();
48 const StackFrame *SF = Pred->getStackFrame();
49
50 State = ExprEngine::setWhetherHasMoreIteration(State, O: S, SF, HasMoreIteraton: HasElements);
51
52 if (auto MV = ElementV.getAs<loc::MemRegionVal>())
53 if (const auto *R = dyn_cast<TypedValueRegion>(Val: MV->getRegion())) {
54 // FIXME: The proper thing to do is to really iterate over the
55 // container. We will do this with dispatch logic to the store.
56 // For now, just 'conjure' up a symbolic value.
57 QualType T = R->getValueType();
58 assert(Loc::isLocType(T));
59
60 SVal V;
61 if (HasElements) {
62 SymbolRef Sym = SymMgr.conjureSymbol(Elem: getCFGElementRef(), SF, T,
63 VisitCount: getNumVisitedCurrent());
64 V = svalBuilder.makeLoc(sym: Sym);
65 } else {
66 V = svalBuilder.makeIntVal(integer: 0, type: T);
67 }
68
69 State = State->bindLoc(LV: ElementV, V, SF);
70 }
71
72 Dst.insert(N: Engine.makePostStmtNode(S, State, Pred));
73}
74
75void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
76 ExplodedNode *Pred,
77 ExplodedNodeSet &Dst) {
78
79 // ObjCForCollectionStmts are processed in two places. This method
80 // handles the case where an ObjCForCollectionStmt* occurs as one of the
81 // statements within a basic block. This transfer function does two things:
82 //
83 // (1) binds the next container value to 'element'. This creates a new
84 // node in the ExplodedGraph.
85 //
86 // (2) note whether the collection has any more elements (or in other words,
87 // whether the loop has more iterations). This will be tested in
88 // processBranch.
89 //
90 // FIXME: Eventually this logic should actually do dispatches to
91 // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration).
92 // This will require simulating a temporary NSFastEnumerationState, either
93 // through an SVal or through the use of MemRegions. This value can
94 // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop
95 // terminates we reclaim the temporary (it goes out of scope) and we
96 // we can test if the SVal is 0 or if the MemRegion is null (depending
97 // on what approach we take).
98 //
99 // For now: simulate (1) by assigning either a symbol or nil if the
100 // container is empty. Thus this transfer function will by default
101 // result in state splitting.
102
103 const Stmt *elem = S->getElement();
104 const Expr *collection = S->getCollection();
105 ProgramStateRef state = Pred->getState();
106
107 SVal collectionV = state->getSVal(E: collection, SF: Pred->getStackFrame());
108
109 SVal elementV = UnknownVal();
110 if (const auto *DS = dyn_cast<DeclStmt>(Val: elem)) {
111 const VarDecl *elemD = cast<VarDecl>(Val: DS->getSingleDecl());
112 assert(elemD->getInit() == nullptr);
113 elementV = state->getLValue(VD: elemD, SF: Pred->getStackFrame());
114 } else if (const auto *Ex = dyn_cast<Expr>(Val: elem)) {
115 elementV = state->getSVal(E: Ex, SF: Pred->getStackFrame());
116 }
117
118 bool isContainerNull = state->isNull(V: collectionV).isConstrainedTrue();
119
120 ExplodedNodeSet DstLocation; // states in `DstLocation` may differ from `Pred`
121 evalLocation(Dst&: DstLocation, NodeEx: S, BoundEx: elem, Pred, St: state, location: elementV, isLoad: false);
122
123 for (ExplodedNode *N : DstLocation) {
124 ExplodedNodeSet Tmp;
125
126 if (!isContainerNull)
127 populateObjCForDestinationSet(S, Pred: N, Dst&: Tmp, ElementV: elementV, /*hasElements=*/HasElements: true);
128
129 populateObjCForDestinationSet(S, Pred: N, Dst&: Tmp, ElementV: elementV, /*hasElements=*/HasElements: false);
130
131 // Finally, run any custom checkers.
132 // FIXME: Eventually all pre- and post-checks should live in VisitStmt.
133 getCheckerManager().runCheckersForPostStmt(Dst, Src: Tmp, S, Eng&: *this);
134 }
135}
136
137void ExprEngine::VisitObjCMessage(const ObjCMessageExpr *ME,
138 ExplodedNode *Pred,
139 ExplodedNodeSet &Dst) {
140 CallEventManager &CEMgr = getStateManager().getCallEventManager();
141 CallEventRef<ObjCMethodCall> Msg = CEMgr.getObjCMethodCall(
142 E: ME, State: Pred->getState(), SF: Pred->getStackFrame(), ElemRef: getCFGElementRef());
143
144 // There are three cases for the receiver:
145 // (1) it is definitely nil,
146 // (2) it is definitely non-nil, and
147 // (3) we don't know.
148 //
149 // If the receiver is definitely nil, we skip the pre/post callbacks and
150 // instead call the ObjCMessageNil callbacks and return.
151 //
152 // If the receiver is definitely non-nil, we call the pre- callbacks,
153 // evaluate the call, and call the post- callbacks.
154 //
155 // If we don't know, we drop the potential nil flow and instead
156 // continue from the assumed non-nil state as in (2). This approach
157 // intentionally drops coverage in order to prevent false alarms
158 // in the following scenario:
159 //
160 // id result = [o someMethod]
161 // if (result) {
162 // if (!o) {
163 // // <-- This program point should be unreachable because if o is nil
164 // // it must the case that result is nil as well.
165 // }
166 // }
167 //
168 // However, it also loses coverage of the nil path prematurely,
169 // leading to missed reports.
170 //
171 // It's possible to handle this by performing a state split on every call:
172 // explore the state where the receiver is non-nil, and independently
173 // explore the state where it's nil. But this is not only slow, but
174 // completely unwarranted. The mere presence of the message syntax in the code
175 // isn't sufficient evidence that nil is a realistic possibility.
176 //
177 // An ideal solution would be to add the following constraint that captures
178 // both possibilities without splitting the state:
179 //
180 // ($x == 0) => ($y == 0) (1)
181 //
182 // where in our case '$x' is the receiver symbol, '$y' is the returned symbol,
183 // and '=>' is logical implication. But RangeConstraintManager can't handle
184 // such constraints yet, so for now we go with a simpler, more restrictive
185 // constraint: $x != 0, from which (1) follows as a vacuous truth.
186 if (Msg->isInstanceMessage()) {
187 SVal recVal = Msg->getReceiverSVal();
188 if (!recVal.isUndef()) {
189 // Bifurcate the state into nil and non-nil ones.
190 DefinedOrUnknownSVal receiverVal =
191 recVal.castAs<DefinedOrUnknownSVal>();
192 ProgramStateRef State = Pred->getState();
193
194 ProgramStateRef notNilState, nilState;
195 std::tie(args&: notNilState, args&: nilState) = State->assume(Cond: receiverVal);
196
197 // Receiver is definitely nil, so run ObjCMessageNil callbacks and return.
198 if (nilState && !notNilState) {
199 PreStmt PS(ME, Pred->getStackFrame(), nullptr);
200 Pred = Engine.makeNode(Loc: PS, State: nilState, Pred);
201 if (!Pred)
202 return;
203
204 ExplodedNodeSet dstPostCheckers;
205 getCheckerManager().runCheckersForObjCMessageNil(Dst&: dstPostCheckers, Src: Pred,
206 msg: *Msg, Eng&: *this);
207 for (auto *I : dstPostCheckers)
208 finishArgumentConstruction(Dst, Pred: I, Call: *Msg);
209 return;
210 }
211
212 // Generate a transition to the non-nil state, dropping any potential
213 // nil flow.
214 if (notNilState != State) {
215 Pred = Engine.makePostStmtNode(S: ME, State: notNilState, Pred);
216 if (!Pred)
217 return;
218 }
219 }
220 }
221
222 // Handle the previsits checks.
223 ExplodedNodeSet dstPrevisit;
224 getCheckerManager().runCheckersForPreObjCMessage(Dst&: dstPrevisit, Src: Pred,
225 msg: *Msg, Eng&: *this);
226 ExplodedNodeSet dstGenericPrevisit;
227 getCheckerManager().runCheckersForPreCall(Dst&: dstGenericPrevisit, Src: dstPrevisit,
228 Call: *Msg, Eng&: *this);
229
230 // Proceed with evaluate the message expression.
231 ExplodedNodeSet dstEval;
232
233 for (ExplodedNode *Pred : dstGenericPrevisit) {
234 ProgramStateRef State = Pred->getState();
235 CallEventRef<ObjCMethodCall> UpdatedMsg = Msg.cloneWithState(State);
236
237 if (ObjCNoRet.isImplicitNoReturn(ME) &&
238 !(UpdatedMsg->isInstanceMessage() &&
239 UpdatedMsg->getReceiverSVal().isUndef())) {
240 // If we raise an exception, for now treat it as a sink.
241 // Eventually we will want to handle exceptions properly.
242 Engine.makePostStmtNode(S: ME, State, Pred, /*MarkAsSink=*/true);
243 continue;
244 }
245
246 defaultEvalCall(Dst&: dstEval, Pred, Call: *UpdatedMsg);
247 }
248
249 // If there were constructors called for object-type arguments, clean them up.
250 ExplodedNodeSet dstArgCleanup;
251 for (auto *I : dstEval)
252 finishArgumentConstruction(Dst&: dstArgCleanup, Pred: I, Call: *Msg);
253
254 ExplodedNodeSet dstPostvisit;
255 getCheckerManager().runCheckersForPostCall(Dst&: dstPostvisit, Src: dstArgCleanup,
256 Call: *Msg, Eng&: *this);
257
258 // Finally, perform the post-condition check of the ObjCMessageExpr and store
259 // the created nodes in 'Dst'.
260 getCheckerManager().runCheckersForPostObjCMessage(Dst, Src: dstPostvisit,
261 msg: *Msg, Eng&: *this);
262}
263