1 //===--- JumpDiagnostics.cpp - Protected scope jump analysis ------*- C++ -*-=// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file implements the JumpScopeChecker class, which is used to diagnose 10 // jumps that enter a protected scope in an invalid way. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "clang/Sema/SemaInternal.h" 15 #include "clang/AST/DeclCXX.h" 16 #include "clang/AST/Expr.h" 17 #include "clang/AST/ExprCXX.h" 18 #include "clang/AST/StmtCXX.h" 19 #include "clang/AST/StmtObjC.h" 20 #include "llvm/ADT/BitVector.h" 21 using namespace clang; 22 23 namespace { 24 25 /// JumpScopeChecker - This object is used by Sema to diagnose invalid jumps 26 /// into VLA and other protected scopes. For example, this rejects: 27 /// goto L; 28 /// int a[n]; 29 /// L: 30 /// 31 class JumpScopeChecker { 32 Sema &S; 33 34 /// Permissive - True when recovering from errors, in which case precautions 35 /// are taken to handle incomplete scope information. 36 const bool Permissive; 37 38 /// GotoScope - This is a record that we use to keep track of all of the 39 /// scopes that are introduced by VLAs and other things that scope jumps like 40 /// gotos. This scope tree has nothing to do with the source scope tree, 41 /// because you can have multiple VLA scopes per compound statement, and most 42 /// compound statements don't introduce any scopes. 43 struct GotoScope { 44 /// ParentScope - The index in ScopeMap of the parent scope. This is 0 for 45 /// the parent scope is the function body. 46 unsigned ParentScope; 47 48 /// InDiag - The note to emit if there is a jump into this scope. 49 unsigned InDiag; 50 51 /// OutDiag - The note to emit if there is an indirect jump out 52 /// of this scope. Direct jumps always clean up their current scope 53 /// in an orderly way. 54 unsigned OutDiag; 55 56 /// Loc - Location to emit the diagnostic. 57 SourceLocation Loc; 58 59 GotoScope(unsigned parentScope, unsigned InDiag, unsigned OutDiag, 60 SourceLocation L) 61 : ParentScope(parentScope), InDiag(InDiag), OutDiag(OutDiag), Loc(L) {} 62 }; 63 64 SmallVector<GotoScope, 48> Scopes; 65 llvm::DenseMap<Stmt*, unsigned> LabelAndGotoScopes; 66 SmallVector<Stmt*, 16> Jumps; 67 68 SmallVector<Stmt*, 4> IndirectJumps; 69 SmallVector<Stmt*, 4> AsmJumps; 70 SmallVector<LabelDecl*, 4> IndirectJumpTargets; 71 SmallVector<LabelDecl*, 4> AsmJumpTargets; 72 public: 73 JumpScopeChecker(Stmt *Body, Sema &S); 74 private: 75 void BuildScopeInformation(Decl *D, unsigned &ParentScope); 76 void BuildScopeInformation(VarDecl *D, const BlockDecl *BDecl, 77 unsigned &ParentScope); 78 void BuildScopeInformation(Stmt *S, unsigned &origParentScope); 79 80 void VerifyJumps(); 81 void VerifyIndirectOrAsmJumps(bool IsAsmGoto); 82 void NoteJumpIntoScopes(ArrayRef<unsigned> ToScopes); 83 void DiagnoseIndirectOrAsmJump(Stmt *IG, unsigned IGScope, LabelDecl *Target, 84 unsigned TargetScope); 85 void CheckJump(Stmt *From, Stmt *To, SourceLocation DiagLoc, 86 unsigned JumpDiag, unsigned JumpDiagWarning, 87 unsigned JumpDiagCXX98Compat); 88 void CheckGotoStmt(GotoStmt *GS); 89 90 unsigned GetDeepestCommonScope(unsigned A, unsigned B); 91 }; 92 } // end anonymous namespace 93 94 #define CHECK_PERMISSIVE(x) (assert(Permissive || !(x)), (Permissive && (x))) 95 96 JumpScopeChecker::JumpScopeChecker(Stmt *Body, Sema &s) 97 : S(s), Permissive(s.hasAnyUnrecoverableErrorsInThisFunction()) { 98 // Add a scope entry for function scope. 99 Scopes.push_back(GotoScope(~0U, ~0U, ~0U, SourceLocation())); 100 101 // Build information for the top level compound statement, so that we have a 102 // defined scope record for every "goto" and label. 103 unsigned BodyParentScope = 0; 104 BuildScopeInformation(Body, BodyParentScope); 105 106 // Check that all jumps we saw are kosher. 107 VerifyJumps(); 108 VerifyIndirectOrAsmJumps(false); 109 VerifyIndirectOrAsmJumps(true); 110 } 111 112 /// GetDeepestCommonScope - Finds the innermost scope enclosing the 113 /// two scopes. 114 unsigned JumpScopeChecker::GetDeepestCommonScope(unsigned A, unsigned B) { 115 while (A != B) { 116 // Inner scopes are created after outer scopes and therefore have 117 // higher indices. 118 if (A < B) { 119 assert(Scopes[B].ParentScope < B); 120 B = Scopes[B].ParentScope; 121 } else { 122 assert(Scopes[A].ParentScope < A); 123 A = Scopes[A].ParentScope; 124 } 125 } 126 return A; 127 } 128 129 typedef std::pair<unsigned,unsigned> ScopePair; 130 131 /// GetDiagForGotoScopeDecl - If this decl induces a new goto scope, return a 132 /// diagnostic that should be emitted if control goes over it. If not, return 0. 133 static ScopePair GetDiagForGotoScopeDecl(Sema &S, const Decl *D) { 134 if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 135 unsigned InDiag = 0; 136 unsigned OutDiag = 0; 137 138 if (VD->getType()->isVariablyModifiedType()) 139 InDiag = diag::note_protected_by_vla; 140 141 if (VD->hasAttr<BlocksAttr>()) 142 return ScopePair(diag::note_protected_by___block, 143 diag::note_exits___block); 144 145 if (VD->hasAttr<CleanupAttr>()) 146 return ScopePair(diag::note_protected_by_cleanup, 147 diag::note_exits_cleanup); 148 149 if (VD->hasLocalStorage()) { 150 switch (VD->getType().isDestructedType()) { 151 case QualType::DK_objc_strong_lifetime: 152 return ScopePair(diag::note_protected_by_objc_strong_init, 153 diag::note_exits_objc_strong); 154 155 case QualType::DK_objc_weak_lifetime: 156 return ScopePair(diag::note_protected_by_objc_weak_init, 157 diag::note_exits_objc_weak); 158 159 case QualType::DK_nontrivial_c_struct: 160 return ScopePair(diag::note_protected_by_non_trivial_c_struct_init, 161 diag::note_exits_dtor); 162 163 case QualType::DK_cxx_destructor: 164 OutDiag = diag::note_exits_dtor; 165 break; 166 167 case QualType::DK_none: 168 break; 169 } 170 } 171 172 const Expr *Init = VD->getInit(); 173 if (S.Context.getLangOpts().CPlusPlus && VD->hasLocalStorage() && Init) { 174 // C++11 [stmt.dcl]p3: 175 // A program that jumps from a point where a variable with automatic 176 // storage duration is not in scope to a point where it is in scope 177 // is ill-formed unless the variable has scalar type, class type with 178 // a trivial default constructor and a trivial destructor, a 179 // cv-qualified version of one of these types, or an array of one of 180 // the preceding types and is declared without an initializer. 181 182 // C++03 [stmt.dcl.p3: 183 // A program that jumps from a point where a local variable 184 // with automatic storage duration is not in scope to a point 185 // where it is in scope is ill-formed unless the variable has 186 // POD type and is declared without an initializer. 187 188 InDiag = diag::note_protected_by_variable_init; 189 190 // For a variable of (array of) class type declared without an 191 // initializer, we will have call-style initialization and the initializer 192 // will be the CXXConstructExpr with no intervening nodes. 193 if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(Init)) { 194 const CXXConstructorDecl *Ctor = CCE->getConstructor(); 195 if (Ctor->isTrivial() && Ctor->isDefaultConstructor() && 196 VD->getInitStyle() == VarDecl::CallInit) { 197 if (OutDiag) 198 InDiag = diag::note_protected_by_variable_nontriv_destructor; 199 else if (!Ctor->getParent()->isPOD()) 200 InDiag = diag::note_protected_by_variable_non_pod; 201 else 202 InDiag = 0; 203 } 204 } 205 } 206 207 return ScopePair(InDiag, OutDiag); 208 } 209 210 if (const TypedefNameDecl *TD = dyn_cast<TypedefNameDecl>(D)) { 211 if (TD->getUnderlyingType()->isVariablyModifiedType()) 212 return ScopePair(isa<TypedefDecl>(TD) 213 ? diag::note_protected_by_vla_typedef 214 : diag::note_protected_by_vla_type_alias, 215 0); 216 } 217 218 return ScopePair(0U, 0U); 219 } 220 221 /// Build scope information for a declaration that is part of a DeclStmt. 222 void JumpScopeChecker::BuildScopeInformation(Decl *D, unsigned &ParentScope) { 223 // If this decl causes a new scope, push and switch to it. 224 std::pair<unsigned,unsigned> Diags = GetDiagForGotoScopeDecl(S, D); 225 if (Diags.first || Diags.second) { 226 Scopes.push_back(GotoScope(ParentScope, Diags.first, Diags.second, 227 D->getLocation())); 228 ParentScope = Scopes.size()-1; 229 } 230 231 // If the decl has an initializer, walk it with the potentially new 232 // scope we just installed. 233 if (VarDecl *VD = dyn_cast<VarDecl>(D)) 234 if (Expr *Init = VD->getInit()) 235 BuildScopeInformation(Init, ParentScope); 236 } 237 238 /// Build scope information for a captured block literal variables. 239 void JumpScopeChecker::BuildScopeInformation(VarDecl *D, 240 const BlockDecl *BDecl, 241 unsigned &ParentScope) { 242 // exclude captured __block variables; there's no destructor 243 // associated with the block literal for them. 244 if (D->hasAttr<BlocksAttr>()) 245 return; 246 QualType T = D->getType(); 247 QualType::DestructionKind destructKind = T.isDestructedType(); 248 if (destructKind != QualType::DK_none) { 249 std::pair<unsigned,unsigned> Diags; 250 switch (destructKind) { 251 case QualType::DK_cxx_destructor: 252 Diags = ScopePair(diag::note_enters_block_captures_cxx_obj, 253 diag::note_exits_block_captures_cxx_obj); 254 break; 255 case QualType::DK_objc_strong_lifetime: 256 Diags = ScopePair(diag::note_enters_block_captures_strong, 257 diag::note_exits_block_captures_strong); 258 break; 259 case QualType::DK_objc_weak_lifetime: 260 Diags = ScopePair(diag::note_enters_block_captures_weak, 261 diag::note_exits_block_captures_weak); 262 break; 263 case QualType::DK_nontrivial_c_struct: 264 Diags = ScopePair(diag::note_enters_block_captures_non_trivial_c_struct, 265 diag::note_exits_block_captures_non_trivial_c_struct); 266 break; 267 case QualType::DK_none: 268 llvm_unreachable("non-lifetime captured variable"); 269 } 270 SourceLocation Loc = D->getLocation(); 271 if (Loc.isInvalid()) 272 Loc = BDecl->getLocation(); 273 Scopes.push_back(GotoScope(ParentScope, 274 Diags.first, Diags.second, Loc)); 275 ParentScope = Scopes.size()-1; 276 } 277 } 278 279 /// BuildScopeInformation - The statements from CI to CE are known to form a 280 /// coherent VLA scope with a specified parent node. Walk through the 281 /// statements, adding any labels or gotos to LabelAndGotoScopes and recursively 282 /// walking the AST as needed. 283 void JumpScopeChecker::BuildScopeInformation(Stmt *S, 284 unsigned &origParentScope) { 285 // If this is a statement, rather than an expression, scopes within it don't 286 // propagate out into the enclosing scope. Otherwise we have to worry 287 // about block literals, which have the lifetime of their enclosing statement. 288 unsigned independentParentScope = origParentScope; 289 unsigned &ParentScope = ((isa<Expr>(S) && !isa<StmtExpr>(S)) 290 ? origParentScope : independentParentScope); 291 292 unsigned StmtsToSkip = 0u; 293 294 // If we found a label, remember that it is in ParentScope scope. 295 switch (S->getStmtClass()) { 296 case Stmt::AddrLabelExprClass: 297 IndirectJumpTargets.push_back(cast<AddrLabelExpr>(S)->getLabel()); 298 break; 299 300 case Stmt::ObjCForCollectionStmtClass: { 301 auto *CS = cast<ObjCForCollectionStmt>(S); 302 unsigned Diag = diag::note_protected_by_objc_fast_enumeration; 303 unsigned NewParentScope = Scopes.size(); 304 Scopes.push_back(GotoScope(ParentScope, Diag, 0, S->getBeginLoc())); 305 BuildScopeInformation(CS->getBody(), NewParentScope); 306 return; 307 } 308 309 case Stmt::IndirectGotoStmtClass: 310 // "goto *&&lbl;" is a special case which we treat as equivalent 311 // to a normal goto. In addition, we don't calculate scope in the 312 // operand (to avoid recording the address-of-label use), which 313 // works only because of the restricted set of expressions which 314 // we detect as constant targets. 315 if (cast<IndirectGotoStmt>(S)->getConstantTarget()) { 316 LabelAndGotoScopes[S] = ParentScope; 317 Jumps.push_back(S); 318 return; 319 } 320 321 LabelAndGotoScopes[S] = ParentScope; 322 IndirectJumps.push_back(S); 323 break; 324 325 case Stmt::SwitchStmtClass: 326 // Evaluate the C++17 init stmt and condition variable 327 // before entering the scope of the switch statement. 328 if (Stmt *Init = cast<SwitchStmt>(S)->getInit()) { 329 BuildScopeInformation(Init, ParentScope); 330 ++StmtsToSkip; 331 } 332 if (VarDecl *Var = cast<SwitchStmt>(S)->getConditionVariable()) { 333 BuildScopeInformation(Var, ParentScope); 334 ++StmtsToSkip; 335 } 336 LLVM_FALLTHROUGH; 337 338 case Stmt::GotoStmtClass: 339 // Remember both what scope a goto is in as well as the fact that we have 340 // it. This makes the second scan not have to walk the AST again. 341 LabelAndGotoScopes[S] = ParentScope; 342 Jumps.push_back(S); 343 break; 344 345 case Stmt::GCCAsmStmtClass: 346 if (auto *GS = dyn_cast<GCCAsmStmt>(S)) 347 if (GS->isAsmGoto()) { 348 // Remember both what scope a goto is in as well as the fact that we 349 // have it. This makes the second scan not have to walk the AST again. 350 LabelAndGotoScopes[S] = ParentScope; 351 AsmJumps.push_back(GS); 352 for (auto *E : GS->labels()) 353 AsmJumpTargets.push_back(E->getLabel()); 354 } 355 break; 356 357 case Stmt::IfStmtClass: { 358 IfStmt *IS = cast<IfStmt>(S); 359 if (!(IS->isConstexpr() || IS->isObjCAvailabilityCheck())) 360 break; 361 362 unsigned Diag = IS->isConstexpr() ? diag::note_protected_by_constexpr_if 363 : diag::note_protected_by_if_available; 364 365 if (VarDecl *Var = IS->getConditionVariable()) 366 BuildScopeInformation(Var, ParentScope); 367 368 // Cannot jump into the middle of the condition. 369 unsigned NewParentScope = Scopes.size(); 370 Scopes.push_back(GotoScope(ParentScope, Diag, 0, IS->getBeginLoc())); 371 BuildScopeInformation(IS->getCond(), NewParentScope); 372 373 // Jumps into either arm of an 'if constexpr' are not allowed. 374 NewParentScope = Scopes.size(); 375 Scopes.push_back(GotoScope(ParentScope, Diag, 0, IS->getBeginLoc())); 376 BuildScopeInformation(IS->getThen(), NewParentScope); 377 if (Stmt *Else = IS->getElse()) { 378 NewParentScope = Scopes.size(); 379 Scopes.push_back(GotoScope(ParentScope, Diag, 0, IS->getBeginLoc())); 380 BuildScopeInformation(Else, NewParentScope); 381 } 382 return; 383 } 384 385 case Stmt::CXXTryStmtClass: { 386 CXXTryStmt *TS = cast<CXXTryStmt>(S); 387 { 388 unsigned NewParentScope = Scopes.size(); 389 Scopes.push_back(GotoScope(ParentScope, 390 diag::note_protected_by_cxx_try, 391 diag::note_exits_cxx_try, 392 TS->getSourceRange().getBegin())); 393 if (Stmt *TryBlock = TS->getTryBlock()) 394 BuildScopeInformation(TryBlock, NewParentScope); 395 } 396 397 // Jump from the catch into the try is not allowed either. 398 for (unsigned I = 0, E = TS->getNumHandlers(); I != E; ++I) { 399 CXXCatchStmt *CS = TS->getHandler(I); 400 unsigned NewParentScope = Scopes.size(); 401 Scopes.push_back(GotoScope(ParentScope, 402 diag::note_protected_by_cxx_catch, 403 diag::note_exits_cxx_catch, 404 CS->getSourceRange().getBegin())); 405 BuildScopeInformation(CS->getHandlerBlock(), NewParentScope); 406 } 407 return; 408 } 409 410 case Stmt::SEHTryStmtClass: { 411 SEHTryStmt *TS = cast<SEHTryStmt>(S); 412 { 413 unsigned NewParentScope = Scopes.size(); 414 Scopes.push_back(GotoScope(ParentScope, 415 diag::note_protected_by_seh_try, 416 diag::note_exits_seh_try, 417 TS->getSourceRange().getBegin())); 418 if (Stmt *TryBlock = TS->getTryBlock()) 419 BuildScopeInformation(TryBlock, NewParentScope); 420 } 421 422 // Jump from __except or __finally into the __try are not allowed either. 423 if (SEHExceptStmt *Except = TS->getExceptHandler()) { 424 unsigned NewParentScope = Scopes.size(); 425 Scopes.push_back(GotoScope(ParentScope, 426 diag::note_protected_by_seh_except, 427 diag::note_exits_seh_except, 428 Except->getSourceRange().getBegin())); 429 BuildScopeInformation(Except->getBlock(), NewParentScope); 430 } else if (SEHFinallyStmt *Finally = TS->getFinallyHandler()) { 431 unsigned NewParentScope = Scopes.size(); 432 Scopes.push_back(GotoScope(ParentScope, 433 diag::note_protected_by_seh_finally, 434 diag::note_exits_seh_finally, 435 Finally->getSourceRange().getBegin())); 436 BuildScopeInformation(Finally->getBlock(), NewParentScope); 437 } 438 439 return; 440 } 441 442 case Stmt::DeclStmtClass: { 443 // If this is a declstmt with a VLA definition, it defines a scope from here 444 // to the end of the containing context. 445 DeclStmt *DS = cast<DeclStmt>(S); 446 // The decl statement creates a scope if any of the decls in it are VLAs 447 // or have the cleanup attribute. 448 for (auto *I : DS->decls()) 449 BuildScopeInformation(I, origParentScope); 450 return; 451 } 452 453 case Stmt::ObjCAtTryStmtClass: { 454 // Disallow jumps into any part of an @try statement by pushing a scope and 455 // walking all sub-stmts in that scope. 456 ObjCAtTryStmt *AT = cast<ObjCAtTryStmt>(S); 457 // Recursively walk the AST for the @try part. 458 { 459 unsigned NewParentScope = Scopes.size(); 460 Scopes.push_back(GotoScope(ParentScope, 461 diag::note_protected_by_objc_try, 462 diag::note_exits_objc_try, 463 AT->getAtTryLoc())); 464 if (Stmt *TryPart = AT->getTryBody()) 465 BuildScopeInformation(TryPart, NewParentScope); 466 } 467 468 // Jump from the catch to the finally or try is not valid. 469 for (unsigned I = 0, N = AT->getNumCatchStmts(); I != N; ++I) { 470 ObjCAtCatchStmt *AC = AT->getCatchStmt(I); 471 unsigned NewParentScope = Scopes.size(); 472 Scopes.push_back(GotoScope(ParentScope, 473 diag::note_protected_by_objc_catch, 474 diag::note_exits_objc_catch, 475 AC->getAtCatchLoc())); 476 // @catches are nested and it isn't 477 BuildScopeInformation(AC->getCatchBody(), NewParentScope); 478 } 479 480 // Jump from the finally to the try or catch is not valid. 481 if (ObjCAtFinallyStmt *AF = AT->getFinallyStmt()) { 482 unsigned NewParentScope = Scopes.size(); 483 Scopes.push_back(GotoScope(ParentScope, 484 diag::note_protected_by_objc_finally, 485 diag::note_exits_objc_finally, 486 AF->getAtFinallyLoc())); 487 BuildScopeInformation(AF, NewParentScope); 488 } 489 490 return; 491 } 492 493 case Stmt::ObjCAtSynchronizedStmtClass: { 494 // Disallow jumps into the protected statement of an @synchronized, but 495 // allow jumps into the object expression it protects. 496 ObjCAtSynchronizedStmt *AS = cast<ObjCAtSynchronizedStmt>(S); 497 // Recursively walk the AST for the @synchronized object expr, it is 498 // evaluated in the normal scope. 499 BuildScopeInformation(AS->getSynchExpr(), ParentScope); 500 501 // Recursively walk the AST for the @synchronized part, protected by a new 502 // scope. 503 unsigned NewParentScope = Scopes.size(); 504 Scopes.push_back(GotoScope(ParentScope, 505 diag::note_protected_by_objc_synchronized, 506 diag::note_exits_objc_synchronized, 507 AS->getAtSynchronizedLoc())); 508 BuildScopeInformation(AS->getSynchBody(), NewParentScope); 509 return; 510 } 511 512 case Stmt::ObjCAutoreleasePoolStmtClass: { 513 // Disallow jumps into the protected statement of an @autoreleasepool. 514 ObjCAutoreleasePoolStmt *AS = cast<ObjCAutoreleasePoolStmt>(S); 515 // Recursively walk the AST for the @autoreleasepool part, protected by a 516 // new scope. 517 unsigned NewParentScope = Scopes.size(); 518 Scopes.push_back(GotoScope(ParentScope, 519 diag::note_protected_by_objc_autoreleasepool, 520 diag::note_exits_objc_autoreleasepool, 521 AS->getAtLoc())); 522 BuildScopeInformation(AS->getSubStmt(), NewParentScope); 523 return; 524 } 525 526 case Stmt::ExprWithCleanupsClass: { 527 // Disallow jumps past full-expressions that use blocks with 528 // non-trivial cleanups of their captures. This is theoretically 529 // implementable but a lot of work which we haven't felt up to doing. 530 ExprWithCleanups *EWC = cast<ExprWithCleanups>(S); 531 for (unsigned i = 0, e = EWC->getNumObjects(); i != e; ++i) { 532 const BlockDecl *BDecl = EWC->getObject(i); 533 for (const auto &CI : BDecl->captures()) { 534 VarDecl *variable = CI.getVariable(); 535 BuildScopeInformation(variable, BDecl, origParentScope); 536 } 537 } 538 break; 539 } 540 541 case Stmt::MaterializeTemporaryExprClass: { 542 // Disallow jumps out of scopes containing temporaries lifetime-extended to 543 // automatic storage duration. 544 MaterializeTemporaryExpr *MTE = cast<MaterializeTemporaryExpr>(S); 545 if (MTE->getStorageDuration() == SD_Automatic) { 546 SmallVector<const Expr *, 4> CommaLHS; 547 SmallVector<SubobjectAdjustment, 4> Adjustments; 548 const Expr *ExtendedObject = 549 MTE->getSubExpr()->skipRValueSubobjectAdjustments(CommaLHS, 550 Adjustments); 551 if (ExtendedObject->getType().isDestructedType()) { 552 Scopes.push_back(GotoScope(ParentScope, 0, 553 diag::note_exits_temporary_dtor, 554 ExtendedObject->getExprLoc())); 555 origParentScope = Scopes.size()-1; 556 } 557 } 558 break; 559 } 560 561 case Stmt::CaseStmtClass: 562 case Stmt::DefaultStmtClass: 563 case Stmt::LabelStmtClass: 564 LabelAndGotoScopes[S] = ParentScope; 565 break; 566 567 default: 568 break; 569 } 570 571 for (Stmt *SubStmt : S->children()) { 572 if (!SubStmt) 573 continue; 574 if (StmtsToSkip) { 575 --StmtsToSkip; 576 continue; 577 } 578 579 // Cases, labels, and defaults aren't "scope parents". It's also 580 // important to handle these iteratively instead of recursively in 581 // order to avoid blowing out the stack. 582 while (true) { 583 Stmt *Next; 584 if (SwitchCase *SC = dyn_cast<SwitchCase>(SubStmt)) 585 Next = SC->getSubStmt(); 586 else if (LabelStmt *LS = dyn_cast<LabelStmt>(SubStmt)) 587 Next = LS->getSubStmt(); 588 else 589 break; 590 591 LabelAndGotoScopes[SubStmt] = ParentScope; 592 SubStmt = Next; 593 } 594 595 // Recursively walk the AST. 596 BuildScopeInformation(SubStmt, ParentScope); 597 } 598 } 599 600 /// VerifyJumps - Verify each element of the Jumps array to see if they are 601 /// valid, emitting diagnostics if not. 602 void JumpScopeChecker::VerifyJumps() { 603 while (!Jumps.empty()) { 604 Stmt *Jump = Jumps.pop_back_val(); 605 606 // With a goto, 607 if (GotoStmt *GS = dyn_cast<GotoStmt>(Jump)) { 608 // The label may not have a statement if it's coming from inline MS ASM. 609 if (GS->getLabel()->getStmt()) { 610 CheckJump(GS, GS->getLabel()->getStmt(), GS->getGotoLoc(), 611 diag::err_goto_into_protected_scope, 612 diag::ext_goto_into_protected_scope, 613 diag::warn_cxx98_compat_goto_into_protected_scope); 614 } 615 CheckGotoStmt(GS); 616 continue; 617 } 618 619 // We only get indirect gotos here when they have a constant target. 620 if (IndirectGotoStmt *IGS = dyn_cast<IndirectGotoStmt>(Jump)) { 621 LabelDecl *Target = IGS->getConstantTarget(); 622 CheckJump(IGS, Target->getStmt(), IGS->getGotoLoc(), 623 diag::err_goto_into_protected_scope, 624 diag::ext_goto_into_protected_scope, 625 diag::warn_cxx98_compat_goto_into_protected_scope); 626 continue; 627 } 628 629 SwitchStmt *SS = cast<SwitchStmt>(Jump); 630 for (SwitchCase *SC = SS->getSwitchCaseList(); SC; 631 SC = SC->getNextSwitchCase()) { 632 if (CHECK_PERMISSIVE(!LabelAndGotoScopes.count(SC))) 633 continue; 634 SourceLocation Loc; 635 if (CaseStmt *CS = dyn_cast<CaseStmt>(SC)) 636 Loc = CS->getBeginLoc(); 637 else if (DefaultStmt *DS = dyn_cast<DefaultStmt>(SC)) 638 Loc = DS->getBeginLoc(); 639 else 640 Loc = SC->getBeginLoc(); 641 CheckJump(SS, SC, Loc, diag::err_switch_into_protected_scope, 0, 642 diag::warn_cxx98_compat_switch_into_protected_scope); 643 } 644 } 645 } 646 647 /// VerifyIndirectOrAsmJumps - Verify whether any possible indirect goto or 648 /// asm goto jump might cross a protection boundary. Unlike direct jumps, 649 /// indirect or asm goto jumps count cleanups as protection boundaries: 650 /// since there's no way to know where the jump is going, we can't implicitly 651 /// run the right cleanups the way we can with direct jumps. 652 /// Thus, an indirect/asm jump is "trivial" if it bypasses no 653 /// initializations and no teardowns. More formally, an indirect/asm jump 654 /// from A to B is trivial if the path out from A to DCA(A,B) is 655 /// trivial and the path in from DCA(A,B) to B is trivial, where 656 /// DCA(A,B) is the deepest common ancestor of A and B. 657 /// Jump-triviality is transitive but asymmetric. 658 /// 659 /// A path in is trivial if none of the entered scopes have an InDiag. 660 /// A path out is trivial is none of the exited scopes have an OutDiag. 661 /// 662 /// Under these definitions, this function checks that the indirect 663 /// jump between A and B is trivial for every indirect goto statement A 664 /// and every label B whose address was taken in the function. 665 void JumpScopeChecker::VerifyIndirectOrAsmJumps(bool IsAsmGoto) { 666 SmallVector<Stmt*, 4> GotoJumps = IsAsmGoto ? AsmJumps : IndirectJumps; 667 if (GotoJumps.empty()) 668 return; 669 SmallVector<LabelDecl *, 4> JumpTargets = 670 IsAsmGoto ? AsmJumpTargets : IndirectJumpTargets; 671 // If there aren't any address-of-label expressions in this function, 672 // complain about the first indirect goto. 673 if (JumpTargets.empty()) { 674 assert(!IsAsmGoto &&"only indirect goto can get here"); 675 S.Diag(GotoJumps[0]->getBeginLoc(), 676 diag::err_indirect_goto_without_addrlabel); 677 return; 678 } 679 // Collect a single representative of every scope containing an 680 // indirect or asm goto. For most code bases, this substantially cuts 681 // down on the number of jump sites we'll have to consider later. 682 typedef std::pair<unsigned, Stmt*> JumpScope; 683 SmallVector<JumpScope, 32> JumpScopes; 684 { 685 llvm::DenseMap<unsigned, Stmt*> JumpScopesMap; 686 for (SmallVectorImpl<Stmt *>::iterator I = GotoJumps.begin(), 687 E = GotoJumps.end(); 688 I != E; ++I) { 689 Stmt *IG = *I; 690 if (CHECK_PERMISSIVE(!LabelAndGotoScopes.count(IG))) 691 continue; 692 unsigned IGScope = LabelAndGotoScopes[IG]; 693 Stmt *&Entry = JumpScopesMap[IGScope]; 694 if (!Entry) Entry = IG; 695 } 696 JumpScopes.reserve(JumpScopesMap.size()); 697 for (llvm::DenseMap<unsigned, Stmt *>::iterator I = JumpScopesMap.begin(), 698 E = JumpScopesMap.end(); 699 I != E; ++I) 700 JumpScopes.push_back(*I); 701 } 702 703 // Collect a single representative of every scope containing a 704 // label whose address was taken somewhere in the function. 705 // For most code bases, there will be only one such scope. 706 llvm::DenseMap<unsigned, LabelDecl*> TargetScopes; 707 for (SmallVectorImpl<LabelDecl *>::iterator I = JumpTargets.begin(), 708 E = JumpTargets.end(); 709 I != E; ++I) { 710 LabelDecl *TheLabel = *I; 711 if (CHECK_PERMISSIVE(!LabelAndGotoScopes.count(TheLabel->getStmt()))) 712 continue; 713 unsigned LabelScope = LabelAndGotoScopes[TheLabel->getStmt()]; 714 LabelDecl *&Target = TargetScopes[LabelScope]; 715 if (!Target) Target = TheLabel; 716 } 717 718 // For each target scope, make sure it's trivially reachable from 719 // every scope containing a jump site. 720 // 721 // A path between scopes always consists of exitting zero or more 722 // scopes, then entering zero or more scopes. We build a set of 723 // of scopes S from which the target scope can be trivially 724 // entered, then verify that every jump scope can be trivially 725 // exitted to reach a scope in S. 726 llvm::BitVector Reachable(Scopes.size(), false); 727 for (llvm::DenseMap<unsigned,LabelDecl*>::iterator 728 TI = TargetScopes.begin(), TE = TargetScopes.end(); TI != TE; ++TI) { 729 unsigned TargetScope = TI->first; 730 LabelDecl *TargetLabel = TI->second; 731 732 Reachable.reset(); 733 734 // Mark all the enclosing scopes from which you can safely jump 735 // into the target scope. 'Min' will end up being the index of 736 // the shallowest such scope. 737 unsigned Min = TargetScope; 738 while (true) { 739 Reachable.set(Min); 740 741 // Don't go beyond the outermost scope. 742 if (Min == 0) break; 743 744 // Stop if we can't trivially enter the current scope. 745 if (Scopes[Min].InDiag) break; 746 747 Min = Scopes[Min].ParentScope; 748 } 749 750 // Walk through all the jump sites, checking that they can trivially 751 // reach this label scope. 752 for (SmallVectorImpl<JumpScope>::iterator 753 I = JumpScopes.begin(), E = JumpScopes.end(); I != E; ++I) { 754 unsigned Scope = I->first; 755 756 // Walk out the "scope chain" for this scope, looking for a scope 757 // we've marked reachable. For well-formed code this amortizes 758 // to O(JumpScopes.size() / Scopes.size()): we only iterate 759 // when we see something unmarked, and in well-formed code we 760 // mark everything we iterate past. 761 bool IsReachable = false; 762 while (true) { 763 if (Reachable.test(Scope)) { 764 // If we find something reachable, mark all the scopes we just 765 // walked through as reachable. 766 for (unsigned S = I->first; S != Scope; S = Scopes[S].ParentScope) 767 Reachable.set(S); 768 IsReachable = true; 769 break; 770 } 771 772 // Don't walk out if we've reached the top-level scope or we've 773 // gotten shallower than the shallowest reachable scope. 774 if (Scope == 0 || Scope < Min) break; 775 776 // Don't walk out through an out-diagnostic. 777 if (Scopes[Scope].OutDiag) break; 778 779 Scope = Scopes[Scope].ParentScope; 780 } 781 782 // Only diagnose if we didn't find something. 783 if (IsReachable) continue; 784 785 DiagnoseIndirectOrAsmJump(I->second, I->first, TargetLabel, TargetScope); 786 } 787 } 788 } 789 790 /// Return true if a particular error+note combination must be downgraded to a 791 /// warning in Microsoft mode. 792 static bool IsMicrosoftJumpWarning(unsigned JumpDiag, unsigned InDiagNote) { 793 return (JumpDiag == diag::err_goto_into_protected_scope && 794 (InDiagNote == diag::note_protected_by_variable_init || 795 InDiagNote == diag::note_protected_by_variable_nontriv_destructor)); 796 } 797 798 /// Return true if a particular note should be downgraded to a compatibility 799 /// warning in C++11 mode. 800 static bool IsCXX98CompatWarning(Sema &S, unsigned InDiagNote) { 801 return S.getLangOpts().CPlusPlus11 && 802 InDiagNote == diag::note_protected_by_variable_non_pod; 803 } 804 805 /// Produce primary diagnostic for an indirect jump statement. 806 static void DiagnoseIndirectOrAsmJumpStmt(Sema &S, Stmt *Jump, 807 LabelDecl *Target, bool &Diagnosed) { 808 if (Diagnosed) 809 return; 810 bool IsAsmGoto = isa<GCCAsmStmt>(Jump); 811 S.Diag(Jump->getBeginLoc(), diag::err_indirect_goto_in_protected_scope) 812 << IsAsmGoto; 813 S.Diag(Target->getStmt()->getIdentLoc(), diag::note_indirect_goto_target) 814 << IsAsmGoto; 815 Diagnosed = true; 816 } 817 818 /// Produce note diagnostics for a jump into a protected scope. 819 void JumpScopeChecker::NoteJumpIntoScopes(ArrayRef<unsigned> ToScopes) { 820 if (CHECK_PERMISSIVE(ToScopes.empty())) 821 return; 822 for (unsigned I = 0, E = ToScopes.size(); I != E; ++I) 823 if (Scopes[ToScopes[I]].InDiag) 824 S.Diag(Scopes[ToScopes[I]].Loc, Scopes[ToScopes[I]].InDiag); 825 } 826 827 /// Diagnose an indirect jump which is known to cross scopes. 828 void JumpScopeChecker::DiagnoseIndirectOrAsmJump(Stmt *Jump, unsigned JumpScope, 829 LabelDecl *Target, 830 unsigned TargetScope) { 831 if (CHECK_PERMISSIVE(JumpScope == TargetScope)) 832 return; 833 834 unsigned Common = GetDeepestCommonScope(JumpScope, TargetScope); 835 bool Diagnosed = false; 836 837 // Walk out the scope chain until we reach the common ancestor. 838 for (unsigned I = JumpScope; I != Common; I = Scopes[I].ParentScope) 839 if (Scopes[I].OutDiag) { 840 DiagnoseIndirectOrAsmJumpStmt(S, Jump, Target, Diagnosed); 841 S.Diag(Scopes[I].Loc, Scopes[I].OutDiag); 842 } 843 844 SmallVector<unsigned, 10> ToScopesCXX98Compat; 845 846 // Now walk into the scopes containing the label whose address was taken. 847 for (unsigned I = TargetScope; I != Common; I = Scopes[I].ParentScope) 848 if (IsCXX98CompatWarning(S, Scopes[I].InDiag)) 849 ToScopesCXX98Compat.push_back(I); 850 else if (Scopes[I].InDiag) { 851 DiagnoseIndirectOrAsmJumpStmt(S, Jump, Target, Diagnosed); 852 S.Diag(Scopes[I].Loc, Scopes[I].InDiag); 853 } 854 855 // Diagnose this jump if it would be ill-formed in C++98. 856 if (!Diagnosed && !ToScopesCXX98Compat.empty()) { 857 bool IsAsmGoto = isa<GCCAsmStmt>(Jump); 858 S.Diag(Jump->getBeginLoc(), 859 diag::warn_cxx98_compat_indirect_goto_in_protected_scope) 860 << IsAsmGoto; 861 S.Diag(Target->getStmt()->getIdentLoc(), diag::note_indirect_goto_target) 862 << IsAsmGoto; 863 NoteJumpIntoScopes(ToScopesCXX98Compat); 864 } 865 } 866 867 /// CheckJump - Validate that the specified jump statement is valid: that it is 868 /// jumping within or out of its current scope, not into a deeper one. 869 void JumpScopeChecker::CheckJump(Stmt *From, Stmt *To, SourceLocation DiagLoc, 870 unsigned JumpDiagError, unsigned JumpDiagWarning, 871 unsigned JumpDiagCXX98Compat) { 872 if (CHECK_PERMISSIVE(!LabelAndGotoScopes.count(From))) 873 return; 874 if (CHECK_PERMISSIVE(!LabelAndGotoScopes.count(To))) 875 return; 876 877 unsigned FromScope = LabelAndGotoScopes[From]; 878 unsigned ToScope = LabelAndGotoScopes[To]; 879 880 // Common case: exactly the same scope, which is fine. 881 if (FromScope == ToScope) return; 882 883 // Warn on gotos out of __finally blocks. 884 if (isa<GotoStmt>(From) || isa<IndirectGotoStmt>(From)) { 885 // If FromScope > ToScope, FromScope is more nested and the jump goes to a 886 // less nested scope. Check if it crosses a __finally along the way. 887 for (unsigned I = FromScope; I > ToScope; I = Scopes[I].ParentScope) { 888 if (Scopes[I].InDiag == diag::note_protected_by_seh_finally) { 889 S.Diag(From->getBeginLoc(), diag::warn_jump_out_of_seh_finally); 890 break; 891 } 892 } 893 } 894 895 unsigned CommonScope = GetDeepestCommonScope(FromScope, ToScope); 896 897 // It's okay to jump out from a nested scope. 898 if (CommonScope == ToScope) return; 899 900 // Pull out (and reverse) any scopes we might need to diagnose skipping. 901 SmallVector<unsigned, 10> ToScopesCXX98Compat; 902 SmallVector<unsigned, 10> ToScopesError; 903 SmallVector<unsigned, 10> ToScopesWarning; 904 for (unsigned I = ToScope; I != CommonScope; I = Scopes[I].ParentScope) { 905 if (S.getLangOpts().MSVCCompat && JumpDiagWarning != 0 && 906 IsMicrosoftJumpWarning(JumpDiagError, Scopes[I].InDiag)) 907 ToScopesWarning.push_back(I); 908 else if (IsCXX98CompatWarning(S, Scopes[I].InDiag)) 909 ToScopesCXX98Compat.push_back(I); 910 else if (Scopes[I].InDiag) 911 ToScopesError.push_back(I); 912 } 913 914 // Handle warnings. 915 if (!ToScopesWarning.empty()) { 916 S.Diag(DiagLoc, JumpDiagWarning); 917 NoteJumpIntoScopes(ToScopesWarning); 918 } 919 920 // Handle errors. 921 if (!ToScopesError.empty()) { 922 S.Diag(DiagLoc, JumpDiagError); 923 NoteJumpIntoScopes(ToScopesError); 924 } 925 926 // Handle -Wc++98-compat warnings if the jump is well-formed. 927 if (ToScopesError.empty() && !ToScopesCXX98Compat.empty()) { 928 S.Diag(DiagLoc, JumpDiagCXX98Compat); 929 NoteJumpIntoScopes(ToScopesCXX98Compat); 930 } 931 } 932 933 void JumpScopeChecker::CheckGotoStmt(GotoStmt *GS) { 934 if (GS->getLabel()->isMSAsmLabel()) { 935 S.Diag(GS->getGotoLoc(), diag::err_goto_ms_asm_label) 936 << GS->getLabel()->getIdentifier(); 937 S.Diag(GS->getLabel()->getLocation(), diag::note_goto_ms_asm_label) 938 << GS->getLabel()->getIdentifier(); 939 } 940 } 941 942 void Sema::DiagnoseInvalidJumps(Stmt *Body) { 943 (void)JumpScopeChecker(Body, *this); 944 } 945