xref: /freebsd/contrib/llvm-project/clang/lib/Analysis/UninitializedValues.cpp (revision 924226fba12cc9a228c73b956e1b7fa24c60b055)
1 //===- UninitializedValues.cpp - Find Uninitialized Values ----------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements uninitialized values analysis for source-level CFGs.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "clang/Analysis/Analyses/UninitializedValues.h"
14 #include "clang/AST/Attr.h"
15 #include "clang/AST/Decl.h"
16 #include "clang/AST/DeclBase.h"
17 #include "clang/AST/Expr.h"
18 #include "clang/AST/OperationKinds.h"
19 #include "clang/AST/Stmt.h"
20 #include "clang/AST/StmtObjC.h"
21 #include "clang/AST/StmtVisitor.h"
22 #include "clang/AST/Type.h"
23 #include "clang/Analysis/Analyses/PostOrderCFGView.h"
24 #include "clang/Analysis/AnalysisDeclContext.h"
25 #include "clang/Analysis/CFG.h"
26 #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
27 #include "clang/Analysis/FlowSensitive/DataflowWorklist.h"
28 #include "clang/Basic/LLVM.h"
29 #include "llvm/ADT/BitVector.h"
30 #include "llvm/ADT/DenseMap.h"
31 #include "llvm/ADT/None.h"
32 #include "llvm/ADT/Optional.h"
33 #include "llvm/ADT/PackedVector.h"
34 #include "llvm/ADT/SmallBitVector.h"
35 #include "llvm/ADT/SmallVector.h"
36 #include "llvm/Support/Casting.h"
37 #include <algorithm>
38 #include <cassert>
39 
40 using namespace clang;
41 
42 #define DEBUG_LOGGING 0
43 
44 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
45   if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
46       !vd->isExceptionVariable() && !vd->isInitCapture() &&
47       !vd->isImplicit() && vd->getDeclContext() == dc) {
48     QualType ty = vd->getType();
49     return ty->isScalarType() || ty->isVectorType() || ty->isRecordType();
50   }
51   return false;
52 }
53 
54 //------------------------------------------------------------------------====//
55 // DeclToIndex: a mapping from Decls we track to value indices.
56 //====------------------------------------------------------------------------//
57 
58 namespace {
59 
60 class DeclToIndex {
61   llvm::DenseMap<const VarDecl *, unsigned> map;
62 
63 public:
64   DeclToIndex() = default;
65 
66   /// Compute the actual mapping from declarations to bits.
67   void computeMap(const DeclContext &dc);
68 
69   /// Return the number of declarations in the map.
70   unsigned size() const { return map.size(); }
71 
72   /// Returns the bit vector index for a given declaration.
73   Optional<unsigned> getValueIndex(const VarDecl *d) const;
74 };
75 
76 } // namespace
77 
78 void DeclToIndex::computeMap(const DeclContext &dc) {
79   unsigned count = 0;
80   DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
81                                                E(dc.decls_end());
82   for ( ; I != E; ++I) {
83     const VarDecl *vd = *I;
84     if (isTrackedVar(vd, &dc))
85       map[vd] = count++;
86   }
87 }
88 
89 Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
90   llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
91   if (I == map.end())
92     return None;
93   return I->second;
94 }
95 
96 //------------------------------------------------------------------------====//
97 // CFGBlockValues: dataflow values for CFG blocks.
98 //====------------------------------------------------------------------------//
99 
100 // These values are defined in such a way that a merge can be done using
101 // a bitwise OR.
102 enum Value { Unknown = 0x0,         /* 00 */
103              Initialized = 0x1,     /* 01 */
104              Uninitialized = 0x2,   /* 10 */
105              MayUninitialized = 0x3 /* 11 */ };
106 
107 static bool isUninitialized(const Value v) {
108   return v >= Uninitialized;
109 }
110 
111 static bool isAlwaysUninit(const Value v) {
112   return v == Uninitialized;
113 }
114 
115 namespace {
116 
117 using ValueVector = llvm::PackedVector<Value, 2, llvm::SmallBitVector>;
118 
119 class CFGBlockValues {
120   const CFG &cfg;
121   SmallVector<ValueVector, 8> vals;
122   ValueVector scratch;
123   DeclToIndex declToIndex;
124 
125 public:
126   CFGBlockValues(const CFG &cfg);
127 
128   unsigned getNumEntries() const { return declToIndex.size(); }
129 
130   void computeSetOfDeclarations(const DeclContext &dc);
131 
132   ValueVector &getValueVector(const CFGBlock *block) {
133     return vals[block->getBlockID()];
134   }
135 
136   void setAllScratchValues(Value V);
137   void mergeIntoScratch(ValueVector const &source, bool isFirst);
138   bool updateValueVectorWithScratch(const CFGBlock *block);
139 
140   bool hasNoDeclarations() const {
141     return declToIndex.size() == 0;
142   }
143 
144   void resetScratch();
145 
146   ValueVector::reference operator[](const VarDecl *vd);
147 
148   Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
149                  const VarDecl *vd) {
150     const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
151     assert(idx.hasValue());
152     return getValueVector(block)[idx.getValue()];
153   }
154 };
155 
156 } // namespace
157 
158 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}
159 
160 void CFGBlockValues::computeSetOfDeclarations(const DeclContext &dc) {
161   declToIndex.computeMap(dc);
162   unsigned decls = declToIndex.size();
163   scratch.resize(decls);
164   unsigned n = cfg.getNumBlockIDs();
165   if (!n)
166     return;
167   vals.resize(n);
168   for (auto &val : vals)
169     val.resize(decls);
170 }
171 
172 #if DEBUG_LOGGING
173 static void printVector(const CFGBlock *block, ValueVector &bv,
174                         unsigned num) {
175   llvm::errs() << block->getBlockID() << " :";
176   for (const auto &i : bv)
177     llvm::errs() << ' ' << i;
178   llvm::errs() << " : " << num << '\n';
179 }
180 #endif
181 
182 void CFGBlockValues::setAllScratchValues(Value V) {
183   for (unsigned I = 0, E = scratch.size(); I != E; ++I)
184     scratch[I] = V;
185 }
186 
187 void CFGBlockValues::mergeIntoScratch(ValueVector const &source,
188                                       bool isFirst) {
189   if (isFirst)
190     scratch = source;
191   else
192     scratch |= source;
193 }
194 
195 bool CFGBlockValues::updateValueVectorWithScratch(const CFGBlock *block) {
196   ValueVector &dst = getValueVector(block);
197   bool changed = (dst != scratch);
198   if (changed)
199     dst = scratch;
200 #if DEBUG_LOGGING
201   printVector(block, scratch, 0);
202 #endif
203   return changed;
204 }
205 
206 void CFGBlockValues::resetScratch() {
207   scratch.reset();
208 }
209 
210 ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
211   const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
212   assert(idx.hasValue());
213   return scratch[idx.getValue()];
214 }
215 
216 //------------------------------------------------------------------------====//
217 // Classification of DeclRefExprs as use or initialization.
218 //====------------------------------------------------------------------------//
219 
220 namespace {
221 
222 class FindVarResult {
223   const VarDecl *vd;
224   const DeclRefExpr *dr;
225 
226 public:
227   FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
228 
229   const DeclRefExpr *getDeclRefExpr() const { return dr; }
230   const VarDecl *getDecl() const { return vd; }
231 };
232 
233 } // namespace
234 
235 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
236   while (Ex) {
237     Ex = Ex->IgnoreParenNoopCasts(C);
238     if (const auto *CE = dyn_cast<CastExpr>(Ex)) {
239       if (CE->getCastKind() == CK_LValueBitCast) {
240         Ex = CE->getSubExpr();
241         continue;
242       }
243     }
244     break;
245   }
246   return Ex;
247 }
248 
249 /// If E is an expression comprising a reference to a single variable, find that
250 /// variable.
251 static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
252   if (const auto *DRE =
253           dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
254     if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl()))
255       if (isTrackedVar(VD, DC))
256         return FindVarResult(VD, DRE);
257   return FindVarResult(nullptr, nullptr);
258 }
259 
260 namespace {
261 
262 /// Classify each DeclRefExpr as an initialization or a use. Any
263 /// DeclRefExpr which isn't explicitly classified will be assumed to have
264 /// escaped the analysis and will be treated as an initialization.
265 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
266 public:
267   enum Class {
268     Init,
269     Use,
270     SelfInit,
271     ConstRefUse,
272     Ignore
273   };
274 
275 private:
276   const DeclContext *DC;
277   llvm::DenseMap<const DeclRefExpr *, Class> Classification;
278 
279   bool isTrackedVar(const VarDecl *VD) const {
280     return ::isTrackedVar(VD, DC);
281   }
282 
283   void classify(const Expr *E, Class C);
284 
285 public:
286   ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
287 
288   void VisitDeclStmt(DeclStmt *DS);
289   void VisitUnaryOperator(UnaryOperator *UO);
290   void VisitBinaryOperator(BinaryOperator *BO);
291   void VisitCallExpr(CallExpr *CE);
292   void VisitCastExpr(CastExpr *CE);
293   void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
294 
295   void operator()(Stmt *S) { Visit(S); }
296 
297   Class get(const DeclRefExpr *DRE) const {
298     llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
299         = Classification.find(DRE);
300     if (I != Classification.end())
301       return I->second;
302 
303     const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
304     if (!VD || !isTrackedVar(VD))
305       return Ignore;
306 
307     return Init;
308   }
309 };
310 
311 } // namespace
312 
313 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
314   if (VD->getType()->isRecordType())
315     return nullptr;
316   if (Expr *Init = VD->getInit()) {
317     const auto *DRE =
318         dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
319     if (DRE && DRE->getDecl() == VD)
320       return DRE;
321   }
322   return nullptr;
323 }
324 
325 void ClassifyRefs::classify(const Expr *E, Class C) {
326   // The result of a ?: could also be an lvalue.
327   E = E->IgnoreParens();
328   if (const auto *CO = dyn_cast<ConditionalOperator>(E)) {
329     classify(CO->getTrueExpr(), C);
330     classify(CO->getFalseExpr(), C);
331     return;
332   }
333 
334   if (const auto *BCO = dyn_cast<BinaryConditionalOperator>(E)) {
335     classify(BCO->getFalseExpr(), C);
336     return;
337   }
338 
339   if (const auto *OVE = dyn_cast<OpaqueValueExpr>(E)) {
340     classify(OVE->getSourceExpr(), C);
341     return;
342   }
343 
344   if (const auto *ME = dyn_cast<MemberExpr>(E)) {
345     if (const auto *VD = dyn_cast<VarDecl>(ME->getMemberDecl())) {
346       if (!VD->isStaticDataMember())
347         classify(ME->getBase(), C);
348     }
349     return;
350   }
351 
352   if (const auto *BO = dyn_cast<BinaryOperator>(E)) {
353     switch (BO->getOpcode()) {
354     case BO_PtrMemD:
355     case BO_PtrMemI:
356       classify(BO->getLHS(), C);
357       return;
358     case BO_Comma:
359       classify(BO->getRHS(), C);
360       return;
361     default:
362       return;
363     }
364   }
365 
366   FindVarResult Var = findVar(E, DC);
367   if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
368     Classification[DRE] = std::max(Classification[DRE], C);
369 }
370 
371 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
372   for (auto *DI : DS->decls()) {
373     auto *VD = dyn_cast<VarDecl>(DI);
374     if (VD && isTrackedVar(VD))
375       if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
376         Classification[DRE] = SelfInit;
377   }
378 }
379 
380 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
381   // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
382   // is not a compound-assignment, we will treat it as initializing the variable
383   // when TransferFunctions visits it. A compound-assignment does not affect
384   // whether a variable is uninitialized, and there's no point counting it as a
385   // use.
386   if (BO->isCompoundAssignmentOp())
387     classify(BO->getLHS(), Use);
388   else if (BO->getOpcode() == BO_Assign || BO->getOpcode() == BO_Comma)
389     classify(BO->getLHS(), Ignore);
390 }
391 
392 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
393   // Increment and decrement are uses despite there being no lvalue-to-rvalue
394   // conversion.
395   if (UO->isIncrementDecrementOp())
396     classify(UO->getSubExpr(), Use);
397 }
398 
399 void ClassifyRefs::VisitOMPExecutableDirective(OMPExecutableDirective *ED) {
400   for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses()))
401     classify(cast<Expr>(S), Use);
402 }
403 
404 static bool isPointerToConst(const QualType &QT) {
405   return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
406 }
407 
408 static bool hasTrivialBody(CallExpr *CE) {
409   if (FunctionDecl *FD = CE->getDirectCallee()) {
410     if (FunctionTemplateDecl *FTD = FD->getPrimaryTemplate())
411       return FTD->getTemplatedDecl()->hasTrivialBody();
412     return FD->hasTrivialBody();
413   }
414   return false;
415 }
416 
417 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
418   // Classify arguments to std::move as used.
419   if (CE->isCallToStdMove()) {
420     // RecordTypes are handled in SemaDeclCXX.cpp.
421     if (!CE->getArg(0)->getType()->isRecordType())
422       classify(CE->getArg(0), Use);
423     return;
424   }
425   bool isTrivialBody = hasTrivialBody(CE);
426   // If a value is passed by const pointer to a function,
427   // we should not assume that it is initialized by the call, and we
428   // conservatively do not assume that it is used.
429   // If a value is passed by const reference to a function,
430   // it should already be initialized.
431   for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
432        I != E; ++I) {
433     if ((*I)->isGLValue()) {
434       if ((*I)->getType().isConstQualified())
435         classify((*I), isTrivialBody ? Ignore : ConstRefUse);
436     } else if (isPointerToConst((*I)->getType())) {
437       const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
438       const auto *UO = dyn_cast<UnaryOperator>(Ex);
439       if (UO && UO->getOpcode() == UO_AddrOf)
440         Ex = UO->getSubExpr();
441       classify(Ex, Ignore);
442     }
443   }
444 }
445 
446 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
447   if (CE->getCastKind() == CK_LValueToRValue)
448     classify(CE->getSubExpr(), Use);
449   else if (const auto *CSE = dyn_cast<CStyleCastExpr>(CE)) {
450     if (CSE->getType()->isVoidType()) {
451       // Squelch any detected load of an uninitialized value if
452       // we cast it to void.
453       // e.g. (void) x;
454       classify(CSE->getSubExpr(), Ignore);
455     }
456   }
457 }
458 
459 //------------------------------------------------------------------------====//
460 // Transfer function for uninitialized values analysis.
461 //====------------------------------------------------------------------------//
462 
463 namespace {
464 
465 class TransferFunctions : public StmtVisitor<TransferFunctions> {
466   CFGBlockValues &vals;
467   const CFG &cfg;
468   const CFGBlock *block;
469   AnalysisDeclContext &ac;
470   const ClassifyRefs &classification;
471   ObjCNoReturn objCNoRet;
472   UninitVariablesHandler &handler;
473 
474 public:
475   TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
476                     const CFGBlock *block, AnalysisDeclContext &ac,
477                     const ClassifyRefs &classification,
478                     UninitVariablesHandler &handler)
479       : vals(vals), cfg(cfg), block(block), ac(ac),
480         classification(classification), objCNoRet(ac.getASTContext()),
481         handler(handler) {}
482 
483   void reportUse(const Expr *ex, const VarDecl *vd);
484   void reportConstRefUse(const Expr *ex, const VarDecl *vd);
485 
486   void VisitBinaryOperator(BinaryOperator *bo);
487   void VisitBlockExpr(BlockExpr *be);
488   void VisitCallExpr(CallExpr *ce);
489   void VisitDeclRefExpr(DeclRefExpr *dr);
490   void VisitDeclStmt(DeclStmt *ds);
491   void VisitGCCAsmStmt(GCCAsmStmt *as);
492   void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
493   void VisitObjCMessageExpr(ObjCMessageExpr *ME);
494   void VisitOMPExecutableDirective(OMPExecutableDirective *ED);
495 
496   bool isTrackedVar(const VarDecl *vd) {
497     return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
498   }
499 
500   FindVarResult findVar(const Expr *ex) {
501     return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
502   }
503 
504   UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
505     UninitUse Use(ex, isAlwaysUninit(v));
506 
507     assert(isUninitialized(v));
508     if (Use.getKind() == UninitUse::Always)
509       return Use;
510 
511     // If an edge which leads unconditionally to this use did not initialize
512     // the variable, we can say something stronger than 'may be uninitialized':
513     // we can say 'either it's used uninitialized or you have dead code'.
514     //
515     // We track the number of successors of a node which have been visited, and
516     // visit a node once we have visited all of its successors. Only edges where
517     // the variable might still be uninitialized are followed. Since a variable
518     // can't transfer from being initialized to being uninitialized, this will
519     // trace out the subgraph which inevitably leads to the use and does not
520     // initialize the variable. We do not want to skip past loops, since their
521     // non-termination might be correlated with the initialization condition.
522     //
523     // For example:
524     //
525     //         void f(bool a, bool b) {
526     // block1:   int n;
527     //           if (a) {
528     // block2:     if (b)
529     // block3:       n = 1;
530     // block4:   } else if (b) {
531     // block5:     while (!a) {
532     // block6:       do_work(&a);
533     //               n = 2;
534     //             }
535     //           }
536     // block7:   if (a)
537     // block8:     g();
538     // block9:   return n;
539     //         }
540     //
541     // Starting from the maybe-uninitialized use in block 9:
542     //  * Block 7 is not visited because we have only visited one of its two
543     //    successors.
544     //  * Block 8 is visited because we've visited its only successor.
545     // From block 8:
546     //  * Block 7 is visited because we've now visited both of its successors.
547     // From block 7:
548     //  * Blocks 1, 2, 4, 5, and 6 are not visited because we didn't visit all
549     //    of their successors (we didn't visit 4, 3, 5, 6, and 5, respectively).
550     //  * Block 3 is not visited because it initializes 'n'.
551     // Now the algorithm terminates, having visited blocks 7 and 8, and having
552     // found the frontier is blocks 2, 4, and 5.
553     //
554     // 'n' is definitely uninitialized for two edges into block 7 (from blocks 2
555     // and 4), so we report that any time either of those edges is taken (in
556     // each case when 'b == false'), 'n' is used uninitialized.
557     SmallVector<const CFGBlock*, 32> Queue;
558     SmallVector<unsigned, 32> SuccsVisited(cfg.getNumBlockIDs(), 0);
559     Queue.push_back(block);
560     // Specify that we've already visited all successors of the starting block.
561     // This has the dual purpose of ensuring we never add it to the queue, and
562     // of marking it as not being a candidate element of the frontier.
563     SuccsVisited[block->getBlockID()] = block->succ_size();
564     while (!Queue.empty()) {
565       const CFGBlock *B = Queue.pop_back_val();
566 
567       // If the use is always reached from the entry block, make a note of that.
568       if (B == &cfg.getEntry())
569         Use.setUninitAfterCall();
570 
571       for (CFGBlock::const_pred_iterator I = B->pred_begin(), E = B->pred_end();
572            I != E; ++I) {
573         const CFGBlock *Pred = *I;
574         if (!Pred)
575           continue;
576 
577         Value AtPredExit = vals.getValue(Pred, B, vd);
578         if (AtPredExit == Initialized)
579           // This block initializes the variable.
580           continue;
581         if (AtPredExit == MayUninitialized &&
582             vals.getValue(B, nullptr, vd) == Uninitialized) {
583           // This block declares the variable (uninitialized), and is reachable
584           // from a block that initializes the variable. We can't guarantee to
585           // give an earlier location for the diagnostic (and it appears that
586           // this code is intended to be reachable) so give a diagnostic here
587           // and go no further down this path.
588           Use.setUninitAfterDecl();
589           continue;
590         }
591 
592         if (AtPredExit == MayUninitialized) {
593           // If the predecessor's terminator is an "asm goto" that initializes
594           // the variable, then don't count it as "initialized" on the indirect
595           // paths.
596           CFGTerminator term = Pred->getTerminator();
597           if (const auto *as = dyn_cast_or_null<GCCAsmStmt>(term.getStmt())) {
598             const CFGBlock *fallthrough = *Pred->succ_begin();
599             if (as->isAsmGoto() &&
600                 llvm::any_of(as->outputs(), [&](const Expr *output) {
601                     return vd == findVar(output).getDecl() &&
602                         llvm::any_of(as->labels(),
603                                      [&](const AddrLabelExpr *label) {
604                           return label->getLabel()->getStmt() == B->Label &&
605                               B != fallthrough;
606                         });
607                 })) {
608               Use.setUninitAfterDecl();
609               continue;
610             }
611           }
612         }
613 
614         unsigned &SV = SuccsVisited[Pred->getBlockID()];
615         if (!SV) {
616           // When visiting the first successor of a block, mark all NULL
617           // successors as having been visited.
618           for (CFGBlock::const_succ_iterator SI = Pred->succ_begin(),
619                                              SE = Pred->succ_end();
620                SI != SE; ++SI)
621             if (!*SI)
622               ++SV;
623         }
624 
625         if (++SV == Pred->succ_size())
626           // All paths from this block lead to the use and don't initialize the
627           // variable.
628           Queue.push_back(Pred);
629       }
630     }
631 
632     // Scan the frontier, looking for blocks where the variable was
633     // uninitialized.
634     for (const auto *Block : cfg) {
635       unsigned BlockID = Block->getBlockID();
636       const Stmt *Term = Block->getTerminatorStmt();
637       if (SuccsVisited[BlockID] && SuccsVisited[BlockID] < Block->succ_size() &&
638           Term) {
639         // This block inevitably leads to the use. If we have an edge from here
640         // to a post-dominator block, and the variable is uninitialized on that
641         // edge, we have found a bug.
642         for (CFGBlock::const_succ_iterator I = Block->succ_begin(),
643              E = Block->succ_end(); I != E; ++I) {
644           const CFGBlock *Succ = *I;
645           if (Succ && SuccsVisited[Succ->getBlockID()] >= Succ->succ_size() &&
646               vals.getValue(Block, Succ, vd) == Uninitialized) {
647             // Switch cases are a special case: report the label to the caller
648             // as the 'terminator', not the switch statement itself. Suppress
649             // situations where no label matched: we can't be sure that's
650             // possible.
651             if (isa<SwitchStmt>(Term)) {
652               const Stmt *Label = Succ->getLabel();
653               if (!Label || !isa<SwitchCase>(Label))
654                 // Might not be possible.
655                 continue;
656               UninitUse::Branch Branch;
657               Branch.Terminator = Label;
658               Branch.Output = 0; // Ignored.
659               Use.addUninitBranch(Branch);
660             } else {
661               UninitUse::Branch Branch;
662               Branch.Terminator = Term;
663               Branch.Output = I - Block->succ_begin();
664               Use.addUninitBranch(Branch);
665             }
666           }
667         }
668       }
669     }
670 
671     return Use;
672   }
673 };
674 
675 } // namespace
676 
677 void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
678   Value v = vals[vd];
679   if (isUninitialized(v))
680     handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
681 }
682 
683 void TransferFunctions::reportConstRefUse(const Expr *ex, const VarDecl *vd) {
684   Value v = vals[vd];
685   if (isAlwaysUninit(v))
686     handler.handleConstRefUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
687 }
688 
689 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
690   // This represents an initialization of the 'element' value.
691   if (const auto *DS = dyn_cast<DeclStmt>(FS->getElement())) {
692     const auto *VD = cast<VarDecl>(DS->getSingleDecl());
693     if (isTrackedVar(VD))
694       vals[VD] = Initialized;
695   }
696 }
697 
698 void TransferFunctions::VisitOMPExecutableDirective(
699     OMPExecutableDirective *ED) {
700   for (Stmt *S : OMPExecutableDirective::used_clauses_children(ED->clauses())) {
701     assert(S && "Expected non-null used-in-clause child.");
702     Visit(S);
703   }
704   if (!ED->isStandaloneDirective())
705     Visit(ED->getStructuredBlock());
706 }
707 
708 void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
709   const BlockDecl *bd = be->getBlockDecl();
710   for (const auto &I : bd->captures()) {
711     const VarDecl *vd = I.getVariable();
712     if (!isTrackedVar(vd))
713       continue;
714     if (I.isByRef()) {
715       vals[vd] = Initialized;
716       continue;
717     }
718     reportUse(be, vd);
719   }
720 }
721 
722 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
723   if (Decl *Callee = ce->getCalleeDecl()) {
724     if (Callee->hasAttr<ReturnsTwiceAttr>()) {
725       // After a call to a function like setjmp or vfork, any variable which is
726       // initialized anywhere within this function may now be initialized. For
727       // now, just assume such a call initializes all variables.  FIXME: Only
728       // mark variables as initialized if they have an initializer which is
729       // reachable from here.
730       vals.setAllScratchValues(Initialized);
731     }
732     else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
733       // Functions labeled like "analyzer_noreturn" are often used to denote
734       // "panic" functions that in special debug situations can still return,
735       // but for the most part should not be treated as returning.  This is a
736       // useful annotation borrowed from the static analyzer that is useful for
737       // suppressing branch-specific false positives when we call one of these
738       // functions but keep pretending the path continues (when in reality the
739       // user doesn't care).
740       vals.setAllScratchValues(Unknown);
741     }
742   }
743 }
744 
745 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
746   switch (classification.get(dr)) {
747   case ClassifyRefs::Ignore:
748     break;
749   case ClassifyRefs::Use:
750     reportUse(dr, cast<VarDecl>(dr->getDecl()));
751     break;
752   case ClassifyRefs::Init:
753     vals[cast<VarDecl>(dr->getDecl())] = Initialized;
754     break;
755   case ClassifyRefs::SelfInit:
756     handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
757     break;
758   case ClassifyRefs::ConstRefUse:
759     reportConstRefUse(dr, cast<VarDecl>(dr->getDecl()));
760     break;
761   }
762 }
763 
764 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
765   if (BO->getOpcode() == BO_Assign) {
766     FindVarResult Var = findVar(BO->getLHS());
767     if (const VarDecl *VD = Var.getDecl())
768       vals[VD] = Initialized;
769   }
770 }
771 
772 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
773   for (auto *DI : DS->decls()) {
774     auto *VD = dyn_cast<VarDecl>(DI);
775     if (VD && isTrackedVar(VD)) {
776       if (getSelfInitExpr(VD)) {
777         // If the initializer consists solely of a reference to itself, we
778         // explicitly mark the variable as uninitialized. This allows code
779         // like the following:
780         //
781         //   int x = x;
782         //
783         // to deliberately leave a variable uninitialized. Different analysis
784         // clients can detect this pattern and adjust their reporting
785         // appropriately, but we need to continue to analyze subsequent uses
786         // of the variable.
787         vals[VD] = Uninitialized;
788       } else if (VD->getInit()) {
789         // Treat the new variable as initialized.
790         vals[VD] = Initialized;
791       } else {
792         // No initializer: the variable is now uninitialized. This matters
793         // for cases like:
794         //   while (...) {
795         //     int n;
796         //     use(n);
797         //     n = 0;
798         //   }
799         // FIXME: Mark the variable as uninitialized whenever its scope is
800         // left, since its scope could be re-entered by a jump over the
801         // declaration.
802         vals[VD] = Uninitialized;
803       }
804     }
805   }
806 }
807 
808 void TransferFunctions::VisitGCCAsmStmt(GCCAsmStmt *as) {
809   // An "asm goto" statement is a terminator that may initialize some variables.
810   if (!as->isAsmGoto())
811     return;
812 
813   ASTContext &C = ac.getASTContext();
814   for (const Expr *O : as->outputs()) {
815     const Expr *Ex = stripCasts(C, O);
816 
817     // Strip away any unary operators. Invalid l-values are reported by other
818     // semantic analysis passes.
819     while (const auto *UO = dyn_cast<UnaryOperator>(Ex))
820       Ex = stripCasts(C, UO->getSubExpr());
821 
822     // Mark the variable as potentially uninitialized for those cases where
823     // it's used on an indirect path, where it's not guaranteed to be
824     // defined.
825     if (const VarDecl *VD = findVar(Ex).getDecl())
826       vals[VD] = MayUninitialized;
827   }
828 }
829 
830 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
831   // If the Objective-C message expression is an implicit no-return that
832   // is not modeled in the CFG, set the tracked dataflow values to Unknown.
833   if (objCNoRet.isImplicitNoReturn(ME)) {
834     vals.setAllScratchValues(Unknown);
835   }
836 }
837 
838 //------------------------------------------------------------------------====//
839 // High-level "driver" logic for uninitialized values analysis.
840 //====------------------------------------------------------------------------//
841 
842 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
843                        AnalysisDeclContext &ac, CFGBlockValues &vals,
844                        const ClassifyRefs &classification,
845                        llvm::BitVector &wasAnalyzed,
846                        UninitVariablesHandler &handler) {
847   wasAnalyzed[block->getBlockID()] = true;
848   vals.resetScratch();
849   // Merge in values of predecessor blocks.
850   bool isFirst = true;
851   for (CFGBlock::const_pred_iterator I = block->pred_begin(),
852        E = block->pred_end(); I != E; ++I) {
853     const CFGBlock *pred = *I;
854     if (!pred)
855       continue;
856     if (wasAnalyzed[pred->getBlockID()]) {
857       vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
858       isFirst = false;
859     }
860   }
861   // Apply the transfer function.
862   TransferFunctions tf(vals, cfg, block, ac, classification, handler);
863   for (const auto &I : *block) {
864     if (Optional<CFGStmt> cs = I.getAs<CFGStmt>())
865       tf.Visit(const_cast<Stmt *>(cs->getStmt()));
866   }
867   CFGTerminator terminator = block->getTerminator();
868   if (auto *as = dyn_cast_or_null<GCCAsmStmt>(terminator.getStmt()))
869     if (as->isAsmGoto())
870       tf.Visit(as);
871   return vals.updateValueVectorWithScratch(block);
872 }
873 
874 namespace {
875 
876 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
877 /// to detect when a CFGBlock has any *potential* use of an uninitialized
878 /// variable.  It is mainly used to prune out work during the final
879 /// reporting pass.
880 struct PruneBlocksHandler : public UninitVariablesHandler {
881   /// Records if a CFGBlock had a potential use of an uninitialized variable.
882   llvm::BitVector hadUse;
883 
884   /// Records if any CFGBlock had a potential use of an uninitialized variable.
885   bool hadAnyUse = false;
886 
887   /// The current block to scribble use information.
888   unsigned currentBlock = 0;
889 
890   PruneBlocksHandler(unsigned numBlocks) : hadUse(numBlocks, false) {}
891 
892   ~PruneBlocksHandler() override = default;
893 
894   void handleUseOfUninitVariable(const VarDecl *vd,
895                                  const UninitUse &use) override {
896     hadUse[currentBlock] = true;
897     hadAnyUse = true;
898   }
899 
900   void handleConstRefUseOfUninitVariable(const VarDecl *vd,
901                                          const UninitUse &use) override {
902     hadUse[currentBlock] = true;
903     hadAnyUse = true;
904   }
905 
906   /// Called when the uninitialized variable analysis detects the
907   /// idiom 'int x = x'.  All other uses of 'x' within the initializer
908   /// are handled by handleUseOfUninitVariable.
909   void handleSelfInit(const VarDecl *vd) override {
910     hadUse[currentBlock] = true;
911     hadAnyUse = true;
912   }
913 };
914 
915 } // namespace
916 
917 void clang::runUninitializedVariablesAnalysis(
918     const DeclContext &dc,
919     const CFG &cfg,
920     AnalysisDeclContext &ac,
921     UninitVariablesHandler &handler,
922     UninitVariablesAnalysisStats &stats) {
923   CFGBlockValues vals(cfg);
924   vals.computeSetOfDeclarations(dc);
925   if (vals.hasNoDeclarations())
926     return;
927 
928   stats.NumVariablesAnalyzed = vals.getNumEntries();
929 
930   // Precompute which expressions are uses and which are initializations.
931   ClassifyRefs classification(ac);
932   cfg.VisitBlockStmts(classification);
933 
934   // Mark all variables uninitialized at the entry.
935   const CFGBlock &entry = cfg.getEntry();
936   ValueVector &vec = vals.getValueVector(&entry);
937   const unsigned n = vals.getNumEntries();
938   for (unsigned j = 0; j < n; ++j) {
939     vec[j] = Uninitialized;
940   }
941 
942   // Proceed with the workist.
943   ForwardDataflowWorklist worklist(cfg, ac);
944   llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
945   worklist.enqueueSuccessors(&cfg.getEntry());
946   llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
947   wasAnalyzed[cfg.getEntry().getBlockID()] = true;
948   PruneBlocksHandler PBH(cfg.getNumBlockIDs());
949 
950   while (const CFGBlock *block = worklist.dequeue()) {
951     PBH.currentBlock = block->getBlockID();
952 
953     // Did the block change?
954     bool changed = runOnBlock(block, cfg, ac, vals,
955                               classification, wasAnalyzed, PBH);
956     ++stats.NumBlockVisits;
957     if (changed || !previouslyVisited[block->getBlockID()])
958       worklist.enqueueSuccessors(block);
959     previouslyVisited[block->getBlockID()] = true;
960   }
961 
962   if (!PBH.hadAnyUse)
963     return;
964 
965   // Run through the blocks one more time, and report uninitialized variables.
966   for (const auto *block : cfg)
967     if (PBH.hadUse[block->getBlockID()]) {
968       runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
969       ++stats.NumBlockVisits;
970     }
971 }
972 
973 UninitVariablesHandler::~UninitVariablesHandler() = default;
974