head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.9 netbsd-11-0-RC3:1.1.1.9 netbsd-11-0-RC2:1.1.1.9 netbsd-11-0-RC1:1.1.1.9 perseant-exfatfs-base-20250801:1.1.1.9 netbsd-11:1.1.1.9.0.10 netbsd-11-base:1.1.1.9 netbsd-10-1-RELEASE:1.1.1.9 perseant-exfatfs-base-20240630:1.1.1.9 perseant-exfatfs:1.1.1.9.0.8 perseant-exfatfs-base:1.1.1.9 netbsd-8-3-RELEASE:1.1.1.7 netbsd-9-4-RELEASE:1.1.1.8 netbsd-10-0-RELEASE:1.1.1.9 netbsd-10-0-RC6:1.1.1.9 netbsd-10-0-RC5:1.1.1.9 netbsd-10-0-RC4:1.1.1.9 netbsd-10-0-RC3:1.1.1.9 netbsd-10-0-RC2:1.1.1.9 netbsd-10-0-RC1:1.1.1.9 netbsd-10:1.1.1.9.0.6 netbsd-10-base:1.1.1.9 netbsd-9-3-RELEASE:1.1.1.8 cjep_sun2x:1.1.1.9.0.4 cjep_sun2x-base:1.1.1.9 cjep_staticlib_x-base1:1.1.1.9 netbsd-9-2-RELEASE:1.1.1.8 cjep_staticlib_x:1.1.1.9.0.2 cjep_staticlib_x-base:1.1.1.9 netbsd-9-1-RELEASE:1.1.1.8 phil-wifi-20200421:1.1.1.9 phil-wifi-20200411:1.1.1.9 phil-wifi-20200406:1.1.1.9 netbsd-8-2-RELEASE:1.1.1.7 netbsd-9-0-RELEASE:1.1.1.8 netbsd-9-0-RC2:1.1.1.8 netbsd-9-0-RC1:1.1.1.8 netbsd-9:1.1.1.8.0.6 netbsd-9-base:1.1.1.8 phil-wifi-20190609:1.1.1.8 netbsd-8-1-RELEASE:1.1.1.7 netbsd-8-1-RC1:1.1.1.7 pgoyette-compat-merge-20190127:1.1.1.8 pgoyette-compat-20190127:1.1.1.8 pgoyette-compat-20190118:1.1.1.8 pgoyette-compat-1226:1.1.1.8 pgoyette-compat-1126:1.1.1.8 pgoyette-compat-1020:1.1.1.8 pgoyette-compat-0930:1.1.1.8 pgoyette-compat-0906:1.1.1.8 netbsd-7-2-RELEASE:1.1.1.5 pgoyette-compat-0728:1.1.1.8 clang-337282:1.1.1.8 netbsd-8-0-RELEASE:1.1.1.7 phil-wifi:1.1.1.8.0.4 phil-wifi-base:1.1.1.8 pgoyette-compat-0625:1.1.1.8 netbsd-8-0-RC2:1.1.1.7 pgoyette-compat-0521:1.1.1.8 pgoyette-compat-0502:1.1.1.8 pgoyette-compat-0422:1.1.1.8 netbsd-8-0-RC1:1.1.1.7 pgoyette-compat-0415:1.1.1.8 pgoyette-compat-0407:1.1.1.8 pgoyette-compat-0330:1.1.1.8 pgoyette-compat-0322:1.1.1.8 pgoyette-compat-0315:1.1.1.8 netbsd-7-1-2-RELEASE:1.1.1.5 pgoyette-compat:1.1.1.8.0.2 pgoyette-compat-base:1.1.1.8 netbsd-7-1-1-RELEASE:1.1.1.5 clang-319952:1.1.1.8 matt-nb8-mediatek:1.1.1.7.0.10 matt-nb8-mediatek-base:1.1.1.7 clang-309604:1.1.1.8 perseant-stdc-iso10646:1.1.1.7.0.8 perseant-stdc-iso10646-base:1.1.1.7 netbsd-8:1.1.1.7.0.6 netbsd-8-base:1.1.1.7 prg-localcount2-base3:1.1.1.7 prg-localcount2-base2:1.1.1.7 prg-localcount2-base1:1.1.1.7 prg-localcount2:1.1.1.7.0.4 prg-localcount2-base:1.1.1.7 pgoyette-localcount-20170426:1.1.1.7 bouyer-socketcan-base1:1.1.1.7 pgoyette-localcount-20170320:1.1.1.7 netbsd-7-1:1.1.1.5.0.10 netbsd-7-1-RELEASE:1.1.1.5 netbsd-7-1-RC2:1.1.1.5 clang-294123:1.1.1.7 netbsd-7-nhusb-base-20170116:1.1.1.5 bouyer-socketcan:1.1.1.7.0.2 bouyer-socketcan-base:1.1.1.7 clang-291444:1.1.1.7 pgoyette-localcount-20170107:1.1.1.6 netbsd-7-1-RC1:1.1.1.5 pgoyette-localcount-20161104:1.1.1.6 netbsd-7-0-2-RELEASE:1.1.1.5 localcount-20160914:1.1.1.6 netbsd-7-nhusb:1.1.1.5.0.8 netbsd-7-nhusb-base:1.1.1.5 clang-280599:1.1.1.6 pgoyette-localcount-20160806:1.1.1.6 pgoyette-localcount-20160726:1.1.1.6 pgoyette-localcount:1.1.1.6.0.2 pgoyette-localcount-base:1.1.1.6 netbsd-7-0-1-RELEASE:1.1.1.5 clang-261930:1.1.1.6 netbsd-7-0:1.1.1.5.0.6 netbsd-7-0-RELEASE:1.1.1.5 netbsd-7-0-RC3:1.1.1.5 netbsd-7-0-RC2:1.1.1.5 netbsd-7-0-RC1:1.1.1.5 clang-237755:1.1.1.5 clang-232565:1.1.1.5 clang-227398:1.1.1.5 tls-maxphys-base:1.1.1.5 tls-maxphys:1.1.1.5.0.4 netbsd-7:1.1.1.5.0.2 netbsd-7-base:1.1.1.5 clang-215315:1.1.1.5 clang-209886:1.1.1.5 yamt-pagecache:1.1.1.4.0.4 yamt-pagecache-base9:1.1.1.4 tls-earlyentropy:1.1.1.4.0.2 tls-earlyentropy-base:1.1.1.5 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.4 riastradh-drm2-base3:1.1.1.4 clang-202566:1.1.1.4 clang-201163:1.1.1.3 clang-199312:1.1.1.3 clang-198450:1.1.1.2 clang-196603:1.1.1.1 clang-195771:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2013.11.28.14.14.52; author joerg; state Exp; branches 1.1.1.1; next ; commitid ow8OybrawrB1f3fx; 1.1.1.1 date 2013.11.28.14.14.52; author joerg; state Exp; branches; next 1.1.1.2; commitid ow8OybrawrB1f3fx; 1.1.1.2 date 2014.01.05.15.39.31; author joerg; state Exp; branches; next 1.1.1.3; commitid wh3aCSIWykURqWjx; 1.1.1.3 date 2014.01.15.21.26.25; author joerg; state Exp; branches; next 1.1.1.4; commitid NQXlzzA0SPkc5glx; 1.1.1.4 date 2014.03.04.19.55.00; author joerg; state Exp; branches 1.1.1.4.2.1 1.1.1.4.4.1; next 1.1.1.5; commitid 29z1hJonZISIXprx; 1.1.1.5 date 2014.05.30.18.14.44; author joerg; state Exp; branches 1.1.1.5.4.1; next 1.1.1.6; commitid 8q0kdlBlCn09GACx; 1.1.1.6 date 2016.02.27.22.12.06; author joerg; state Exp; branches 1.1.1.6.2.1; next 1.1.1.7; commitid tIimz3oDlh1NpBWy; 1.1.1.7 date 2017.01.11.10.35.39; author joerg; state Exp; branches; next 1.1.1.8; commitid CNnUNfII1jgNmxBz; 1.1.1.8 date 2017.08.01.19.35.16; author joerg; state Exp; branches 1.1.1.8.4.1; next 1.1.1.9; commitid pMuDy65V0VicSx1A; 1.1.1.9 date 2019.11.13.22.19.28; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.4.2.1 date 2014.08.10.07.08.10; author tls; state Exp; branches; next ; commitid t01A1TLTYxkpGMLx; 1.1.1.4.4.1 date 2014.03.04.19.55.00; author yamt; state dead; branches; next 1.1.1.4.4.2; commitid WSrDtL5nYAUyiyBx; 1.1.1.4.4.2 date 2014.05.22.16.18.31; author yamt; state Exp; branches; next ; commitid WSrDtL5nYAUyiyBx; 1.1.1.5.4.1 date 2014.05.30.18.14.44; author tls; state dead; branches; next 1.1.1.5.4.2; commitid jTnpym9Qu0o4R1Nx; 1.1.1.5.4.2 date 2014.08.19.23.47.31; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.6.2.1 date 2017.03.20.06.52.42; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.8.4.1 date 2020.04.13.07.46.38; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @//==- DeadStoresChecker.cpp - Check for stores to dead variables -*- C++ -*-==// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a DeadStores, a flow-sensitive checker that looks for // stores to variables that are no longer live. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/AST/ASTContext.h" #include "clang/AST/Attr.h" #include "clang/AST/ParentMap.h" #include "clang/AST/RecursiveASTVisitor.h" #include "clang/Analysis/Analyses/LiveVariables.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "llvm/ADT/BitVector.h" #include "llvm/ADT/SmallString.h" #include "llvm/Support/SaveAndRestore.h" using namespace clang; using namespace ento; namespace { /// A simple visitor to record what VarDecls occur in EH-handling code. class EHCodeVisitor : public RecursiveASTVisitor { public: bool inEH; llvm::DenseSet &S; bool TraverseObjCAtFinallyStmt(ObjCAtFinallyStmt *S) { SaveAndRestore inFinally(inEH, true); return ::RecursiveASTVisitor::TraverseObjCAtFinallyStmt(S); } bool TraverseObjCAtCatchStmt(ObjCAtCatchStmt *S) { SaveAndRestore inCatch(inEH, true); return ::RecursiveASTVisitor::TraverseObjCAtCatchStmt(S); } bool TraverseCXXCatchStmt(CXXCatchStmt *S) { SaveAndRestore inCatch(inEH, true); return TraverseStmt(S->getHandlerBlock()); } bool VisitDeclRefExpr(DeclRefExpr *DR) { if (inEH) if (const VarDecl *D = dyn_cast(DR->getDecl())) S.insert(D); return true; } EHCodeVisitor(llvm::DenseSet &S) : inEH(false), S(S) {} }; // FIXME: Eventually migrate into its own file, and have it managed by // AnalysisManager. class ReachableCode { const CFG &cfg; llvm::BitVector reachable; public: ReachableCode(const CFG &cfg) : cfg(cfg), reachable(cfg.getNumBlockIDs(), false) {} void computeReachableBlocks(); bool isReachable(const CFGBlock *block) const { return reachable[block->getBlockID()]; } }; } void ReachableCode::computeReachableBlocks() { if (!cfg.getNumBlockIDs()) return; SmallVector worklist; worklist.push_back(&cfg.getEntry()); while (!worklist.empty()) { const CFGBlock *block = worklist.pop_back_val(); llvm::BitVector::reference isReachable = reachable[block->getBlockID()]; if (isReachable) continue; isReachable = true; for (CFGBlock::const_succ_iterator i = block->succ_begin(), e = block->succ_end(); i != e; ++i) if (const CFGBlock *succ = *i) worklist.push_back(succ); } } static const Expr * LookThroughTransitiveAssignmentsAndCommaOperators(const Expr *Ex) { while (Ex) { const BinaryOperator *BO = dyn_cast(Ex->IgnoreParenCasts()); if (!BO) break; if (BO->getOpcode() == BO_Assign) { Ex = BO->getRHS(); continue; } if (BO->getOpcode() == BO_Comma) { Ex = BO->getRHS(); continue; } break; } return Ex; } namespace { class DeadStoreObs : public LiveVariables::Observer { const CFG &cfg; ASTContext &Ctx; BugReporter& BR; AnalysisDeclContext* AC; ParentMap& Parents; llvm::SmallPtrSet Escaped; OwningPtr reachableCode; const CFGBlock *currentBlock; OwningPtr > InEH; enum DeadStoreKind { Standard, Enclosing, DeadIncrement, DeadInit }; public: DeadStoreObs(const CFG &cfg, ASTContext &ctx, BugReporter& br, AnalysisDeclContext* ac, ParentMap& parents, llvm::SmallPtrSet &escaped) : cfg(cfg), Ctx(ctx), BR(br), AC(ac), Parents(parents), Escaped(escaped), currentBlock(0) {} virtual ~DeadStoreObs() {} bool isLive(const LiveVariables::LivenessValues &Live, const VarDecl *D) { if (Live.isLive(D)) return true; // Lazily construct the set that records which VarDecls are in // EH code. if (!InEH.get()) { InEH.reset(new llvm::DenseSet()); EHCodeVisitor V(*InEH.get()); V.TraverseStmt(AC->getBody()); } // Treat all VarDecls that occur in EH code as being "always live" // when considering to suppress dead stores. Frequently stores // are followed by reads in EH code, but we don't have the ability // to analyze that yet. return InEH->count(D); } void Report(const VarDecl *V, DeadStoreKind dsk, PathDiagnosticLocation L, SourceRange R) { if (Escaped.count(V)) return; // Compute reachable blocks within the CFG for trivial cases // where a bogus dead store can be reported because itself is unreachable. if (!reachableCode.get()) { reachableCode.reset(new ReachableCode(cfg)); reachableCode->computeReachableBlocks(); } if (!reachableCode->isReachable(currentBlock)) return; SmallString<64> buf; llvm::raw_svector_ostream os(buf); const char *BugType = 0; switch (dsk) { case DeadInit: BugType = "Dead initialization"; os << "Value stored to '" << *V << "' during its initialization is never read"; break; case DeadIncrement: BugType = "Dead increment"; case Standard: if (!BugType) BugType = "Dead assignment"; os << "Value stored to '" << *V << "' is never read"; break; case Enclosing: // Don't report issues in this case, e.g.: "if (x = foo())", // where 'x' is unused later. We have yet to see a case where // this is a real bug. return; } BR.EmitBasicReport(AC->getDecl(), BugType, "Dead store", os.str(), L, R); } void CheckVarDecl(const VarDecl *VD, const Expr *Ex, const Expr *Val, DeadStoreKind dsk, const LiveVariables::LivenessValues &Live) { if (!VD->hasLocalStorage()) return; // Reference types confuse the dead stores checker. Skip them // for now. if (VD->getType()->getAs()) return; if (!isLive(Live, VD) && !(VD->getAttr() || VD->getAttr())) { PathDiagnosticLocation ExLoc = PathDiagnosticLocation::createBegin(Ex, BR.getSourceManager(), AC); Report(VD, dsk, ExLoc, Val->getSourceRange()); } } void CheckDeclRef(const DeclRefExpr *DR, const Expr *Val, DeadStoreKind dsk, const LiveVariables::LivenessValues& Live) { if (const VarDecl *VD = dyn_cast(DR->getDecl())) CheckVarDecl(VD, DR, Val, dsk, Live); } bool isIncrement(VarDecl *VD, const BinaryOperator* B) { if (B->isCompoundAssignmentOp()) return true; const Expr *RHS = B->getRHS()->IgnoreParenCasts(); const BinaryOperator* BRHS = dyn_cast(RHS); if (!BRHS) return false; const DeclRefExpr *DR; if ((DR = dyn_cast(BRHS->getLHS()->IgnoreParenCasts()))) if (DR->getDecl() == VD) return true; if ((DR = dyn_cast(BRHS->getRHS()->IgnoreParenCasts()))) if (DR->getDecl() == VD) return true; return false; } virtual void observeStmt(const Stmt *S, const CFGBlock *block, const LiveVariables::LivenessValues &Live) { currentBlock = block; // Skip statements in macros. if (S->getLocStart().isMacroID()) return; // Only cover dead stores from regular assignments. ++/-- dead stores // have never flagged a real bug. if (const BinaryOperator* B = dyn_cast(S)) { if (!B->isAssignmentOp()) return; // Skip non-assignments. if (DeclRefExpr *DR = dyn_cast(B->getLHS())) if (VarDecl *VD = dyn_cast(DR->getDecl())) { // Special case: check for assigning null to a pointer. // This is a common form of defensive programming. const Expr *RHS = LookThroughTransitiveAssignmentsAndCommaOperators(B->getRHS()); RHS = RHS->IgnoreParenCasts(); QualType T = VD->getType(); if (T->isPointerType() || T->isObjCObjectPointerType()) { if (RHS->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) return; } // Special case: self-assignments. These are often used to shut up // "unused variable" compiler warnings. if (const DeclRefExpr *RhsDR = dyn_cast(RHS)) if (VD == dyn_cast(RhsDR->getDecl())) return; // Otherwise, issue a warning. DeadStoreKind dsk = Parents.isConsumedExpr(B) ? Enclosing : (isIncrement(VD,B) ? DeadIncrement : Standard); CheckVarDecl(VD, DR, B->getRHS(), dsk, Live); } } else if (const UnaryOperator* U = dyn_cast(S)) { if (!U->isIncrementOp() || U->isPrefix()) return; const Stmt *parent = Parents.getParentIgnoreParenCasts(U); if (!parent || !isa(parent)) return; const Expr *Ex = U->getSubExpr()->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast(Ex)) CheckDeclRef(DR, U, DeadIncrement, Live); } else if (const DeclStmt *DS = dyn_cast(S)) // Iterate through the decls. Warn if any initializers are complex // expressions that are not live (never used). for (DeclStmt::const_decl_iterator DI=DS->decl_begin(), DE=DS->decl_end(); DI != DE; ++DI) { VarDecl *V = dyn_cast(*DI); if (!V) continue; if (V->hasLocalStorage()) { // Reference types confuse the dead stores checker. Skip them // for now. if (V->getType()->getAs()) return; if (const Expr *E = V->getInit()) { while (const ExprWithCleanups *exprClean = dyn_cast(E)) E = exprClean->getSubExpr(); // Look through transitive assignments, e.g.: // int x = y = 0; E = LookThroughTransitiveAssignmentsAndCommaOperators(E); // Don't warn on C++ objects (yet) until we can show that their // constructors/destructors don't have side effects. if (isa(E)) return; // A dead initialization is a variable that is dead after it // is initialized. We don't flag warnings for those variables // marked 'unused'. if (!isLive(Live, V) && V->getAttr() == 0) { // Special case: check for initializations with constants. // // e.g. : int x = 0; // // If x is EVER assigned a new value later, don't issue // a warning. This is because such initialization can be // due to defensive programming. if (E->isEvaluatable(Ctx)) return; if (const DeclRefExpr *DRE = dyn_cast(E->IgnoreParenCasts())) if (const VarDecl *VD = dyn_cast(DRE->getDecl())) { // Special case: check for initialization from constant // variables. // // e.g. extern const int MyConstant; // int x = MyConstant; // if (VD->hasGlobalStorage() && VD->getType().isConstQualified()) return; // Special case: check for initialization from scalar // parameters. This is often a form of defensive // programming. Non-scalars are still an error since // because it more likely represents an actual algorithmic // bug. if (isa(VD) && VD->getType()->isScalarType()) return; } PathDiagnosticLocation Loc = PathDiagnosticLocation::create(V, BR.getSourceManager()); Report(V, DeadInit, Loc, E->getSourceRange()); } } } } } }; } // end anonymous namespace //===----------------------------------------------------------------------===// // Driver function to invoke the Dead-Stores checker on a CFG. //===----------------------------------------------------------------------===// namespace { class FindEscaped { public: llvm::SmallPtrSet Escaped; void operator()(const Stmt *S) { // Check for '&'. Any VarDecl whose address has been taken we treat as // escaped. // FIXME: What about references? const UnaryOperator *U = dyn_cast(S); if (!U) return; if (U->getOpcode() != UO_AddrOf) return; const Expr *E = U->getSubExpr()->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast(E)) if (const VarDecl *VD = dyn_cast(DR->getDecl())) Escaped.insert(VD); } }; } // end anonymous namespace //===----------------------------------------------------------------------===// // DeadStoresChecker //===----------------------------------------------------------------------===// namespace { class DeadStoresChecker : public Checker { public: void checkASTCodeBody(const Decl *D, AnalysisManager& mgr, BugReporter &BR) const { // Don't do anything for template instantiations. // Proving that code in a template instantiation is "dead" // means proving that it is dead in all instantiations. // This same problem exists with -Wunreachable-code. if (const FunctionDecl *FD = dyn_cast(D)) if (FD->isTemplateInstantiation()) return; if (LiveVariables *L = mgr.getAnalysis(D)) { CFG &cfg = *mgr.getCFG(D); AnalysisDeclContext *AC = mgr.getAnalysisDeclContext(D); ParentMap &pmap = mgr.getParentMap(D); FindEscaped FS; cfg.VisitBlockStmts(FS); DeadStoreObs A(cfg, BR.getContext(), BR, AC, pmap, FS.Escaped); L->runOnAllBlocks(A); } } }; } void ento::registerDeadStoresChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.1 log @Import Clang 3.4rc1 r195771. @ text @@ 1.1.1.2 log @Import clang 3.5svn r198450. @ text @d217 1 a217 1 !(VD->hasAttr() || VD->hasAttr())) { d343 1 a343 1 if (!isLive(Live, V) && !V->hasAttr()) { @ 1.1.1.3 log @Import Clang 3.5svn r199312 @ text @d217 1 a217 2 !(VD->hasAttr() || VD->hasAttr() || VD->hasAttr())) { d342 2 a343 4 // marked 'unused' or 'objc_precise_lifetime'. if (!isLive(Live, V) && !V->hasAttr() && !V->hasAttr()) { @ 1.1.1.4 log @Import Clang 3.5svn r202566. @ text @a126 1 const CheckerBase *Checker; d137 5 a141 6 DeadStoreObs(const CFG &cfg, ASTContext &ctx, BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac, ParentMap &parents, llvm::SmallPtrSet &escaped) : cfg(cfg), Ctx(ctx), BR(br), Checker(checker), AC(ac), Parents(parents), Escaped(escaped), currentBlock(0) {} d202 1 a202 2 BR.EmitBasicReport(AC->getDecl(), Checker, BugType, "Dead store", os.str(), L, R); d442 1 a442 1 DeadStoreObs A(cfg, BR.getContext(), BR, this, AC, pmap, FS.Escaped); @ 1.1.1.4.2.1 log @Rebase. @ text @d131 1 a131 1 std::unique_ptr reachableCode; d133 1 a133 1 std::unique_ptr> InEH; d143 1 a143 1 Escaped(escaped), currentBlock(nullptr) {} d181 1 a181 1 const char *BugType = nullptr; d258 2 a259 2 void observeStmt(const Stmt *S, const CFGBlock *block, const LiveVariables::LivenessValues &Live) override { d316 4 a319 2 for (const auto *DI : DS->decls()) { const auto *V = dyn_cast(DI); @ 1.1.1.5 log @Import Clang 3.5svn r209886. @ text @d131 1 a131 1 std::unique_ptr reachableCode; d133 1 a133 1 std::unique_ptr> InEH; d143 1 a143 1 Escaped(escaped), currentBlock(nullptr) {} d181 1 a181 1 const char *BugType = nullptr; d258 2 a259 2 void observeStmt(const Stmt *S, const CFGBlock *block, const LiveVariables::LivenessValues &Live) override { d316 4 a319 2 for (const auto *DI : DS->decls()) { const auto *V = dyn_cast(DI); @ 1.1.1.6 log @Import Clang 3.8.0rc3 r261930. @ text @d31 2 a32 2 namespace { d38 1 a38 1 d43 1 a43 1 d48 1 a48 1 d53 1 a53 1 d60 1 a60 1 d73 1 a73 1 d75 1 a75 1 d85 1 a85 1 d145 1 a145 1 ~DeadStoreObs() override {} d163 1 a163 1 d168 1 a168 1 d175 1 a175 1 d199 1 a199 1 // where 'x' is unused later. We have yet to see a case where d262 1 a262 1 d279 1 a279 1 d321 2 a322 2 if (V->hasLocalStorage()) { d327 1 a327 1 d332 1 a332 1 d336 1 a336 1 d341 1 a341 1 a403 5 if (auto *LE = dyn_cast(S)) { findLambdaReferenceCaptures(LE); return; } a414 22 // Treat local variables captured by reference in C++ lambdas as escaped. void findLambdaReferenceCaptures(const LambdaExpr *LE) { const CXXRecordDecl *LambdaClass = LE->getLambdaClass(); llvm::DenseMap CaptureFields; FieldDecl *ThisCaptureField; LambdaClass->getCaptureFields(CaptureFields, ThisCaptureField); for (const LambdaCapture &C : LE->captures()) { if (!C.capturesVariable()) continue; VarDecl *VD = C.getCapturedVar(); const FieldDecl *FD = CaptureFields[VD]; if (!FD) continue; // If the capture field is a reference type, it is capture-by-reference. if (FD->getType()->isReferenceType()) Escaped.insert(VD); } } @ 1.1.1.6.2.1 log @Sync with HEAD @ text @a280 2 if (T.isVolatileQualified()) return; @ 1.1.1.7 log @Import Clang pre-4.0.0 r291444. @ text @a280 2 if (T.isVolatileQualified()) return; @ 1.1.1.8 log @Import clang r309604 from branches/release_50 @ text @a191 1 LLVM_FALLTHROUGH; @ 1.1.1.8.4.1 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.9 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.5.4.1 log @file DeadStoresChecker.cpp was added on branch tls-maxphys on 2014-08-19 23:47:31 +0000 @ text @d1 452 @ 1.1.1.5.4.2 log @Rebase to HEAD as of a few days ago. @ text @a0 452 //==- DeadStoresChecker.cpp - Check for stores to dead variables -*- C++ -*-==// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a DeadStores, a flow-sensitive checker that looks for // stores to variables that are no longer live. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/AST/ASTContext.h" #include "clang/AST/Attr.h" #include "clang/AST/ParentMap.h" #include "clang/AST/RecursiveASTVisitor.h" #include "clang/Analysis/Analyses/LiveVariables.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "llvm/ADT/BitVector.h" #include "llvm/ADT/SmallString.h" #include "llvm/Support/SaveAndRestore.h" using namespace clang; using namespace ento; namespace { /// A simple visitor to record what VarDecls occur in EH-handling code. class EHCodeVisitor : public RecursiveASTVisitor { public: bool inEH; llvm::DenseSet &S; bool TraverseObjCAtFinallyStmt(ObjCAtFinallyStmt *S) { SaveAndRestore inFinally(inEH, true); return ::RecursiveASTVisitor::TraverseObjCAtFinallyStmt(S); } bool TraverseObjCAtCatchStmt(ObjCAtCatchStmt *S) { SaveAndRestore inCatch(inEH, true); return ::RecursiveASTVisitor::TraverseObjCAtCatchStmt(S); } bool TraverseCXXCatchStmt(CXXCatchStmt *S) { SaveAndRestore inCatch(inEH, true); return TraverseStmt(S->getHandlerBlock()); } bool VisitDeclRefExpr(DeclRefExpr *DR) { if (inEH) if (const VarDecl *D = dyn_cast(DR->getDecl())) S.insert(D); return true; } EHCodeVisitor(llvm::DenseSet &S) : inEH(false), S(S) {} }; // FIXME: Eventually migrate into its own file, and have it managed by // AnalysisManager. class ReachableCode { const CFG &cfg; llvm::BitVector reachable; public: ReachableCode(const CFG &cfg) : cfg(cfg), reachable(cfg.getNumBlockIDs(), false) {} void computeReachableBlocks(); bool isReachable(const CFGBlock *block) const { return reachable[block->getBlockID()]; } }; } void ReachableCode::computeReachableBlocks() { if (!cfg.getNumBlockIDs()) return; SmallVector worklist; worklist.push_back(&cfg.getEntry()); while (!worklist.empty()) { const CFGBlock *block = worklist.pop_back_val(); llvm::BitVector::reference isReachable = reachable[block->getBlockID()]; if (isReachable) continue; isReachable = true; for (CFGBlock::const_succ_iterator i = block->succ_begin(), e = block->succ_end(); i != e; ++i) if (const CFGBlock *succ = *i) worklist.push_back(succ); } } static const Expr * LookThroughTransitiveAssignmentsAndCommaOperators(const Expr *Ex) { while (Ex) { const BinaryOperator *BO = dyn_cast(Ex->IgnoreParenCasts()); if (!BO) break; if (BO->getOpcode() == BO_Assign) { Ex = BO->getRHS(); continue; } if (BO->getOpcode() == BO_Comma) { Ex = BO->getRHS(); continue; } break; } return Ex; } namespace { class DeadStoreObs : public LiveVariables::Observer { const CFG &cfg; ASTContext &Ctx; BugReporter& BR; const CheckerBase *Checker; AnalysisDeclContext* AC; ParentMap& Parents; llvm::SmallPtrSet Escaped; std::unique_ptr reachableCode; const CFGBlock *currentBlock; std::unique_ptr> InEH; enum DeadStoreKind { Standard, Enclosing, DeadIncrement, DeadInit }; public: DeadStoreObs(const CFG &cfg, ASTContext &ctx, BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac, ParentMap &parents, llvm::SmallPtrSet &escaped) : cfg(cfg), Ctx(ctx), BR(br), Checker(checker), AC(ac), Parents(parents), Escaped(escaped), currentBlock(nullptr) {} virtual ~DeadStoreObs() {} bool isLive(const LiveVariables::LivenessValues &Live, const VarDecl *D) { if (Live.isLive(D)) return true; // Lazily construct the set that records which VarDecls are in // EH code. if (!InEH.get()) { InEH.reset(new llvm::DenseSet()); EHCodeVisitor V(*InEH.get()); V.TraverseStmt(AC->getBody()); } // Treat all VarDecls that occur in EH code as being "always live" // when considering to suppress dead stores. Frequently stores // are followed by reads in EH code, but we don't have the ability // to analyze that yet. return InEH->count(D); } void Report(const VarDecl *V, DeadStoreKind dsk, PathDiagnosticLocation L, SourceRange R) { if (Escaped.count(V)) return; // Compute reachable blocks within the CFG for trivial cases // where a bogus dead store can be reported because itself is unreachable. if (!reachableCode.get()) { reachableCode.reset(new ReachableCode(cfg)); reachableCode->computeReachableBlocks(); } if (!reachableCode->isReachable(currentBlock)) return; SmallString<64> buf; llvm::raw_svector_ostream os(buf); const char *BugType = nullptr; switch (dsk) { case DeadInit: BugType = "Dead initialization"; os << "Value stored to '" << *V << "' during its initialization is never read"; break; case DeadIncrement: BugType = "Dead increment"; case Standard: if (!BugType) BugType = "Dead assignment"; os << "Value stored to '" << *V << "' is never read"; break; case Enclosing: // Don't report issues in this case, e.g.: "if (x = foo())", // where 'x' is unused later. We have yet to see a case where // this is a real bug. return; } BR.EmitBasicReport(AC->getDecl(), Checker, BugType, "Dead store", os.str(), L, R); } void CheckVarDecl(const VarDecl *VD, const Expr *Ex, const Expr *Val, DeadStoreKind dsk, const LiveVariables::LivenessValues &Live) { if (!VD->hasLocalStorage()) return; // Reference types confuse the dead stores checker. Skip them // for now. if (VD->getType()->getAs()) return; if (!isLive(Live, VD) && !(VD->hasAttr() || VD->hasAttr() || VD->hasAttr())) { PathDiagnosticLocation ExLoc = PathDiagnosticLocation::createBegin(Ex, BR.getSourceManager(), AC); Report(VD, dsk, ExLoc, Val->getSourceRange()); } } void CheckDeclRef(const DeclRefExpr *DR, const Expr *Val, DeadStoreKind dsk, const LiveVariables::LivenessValues& Live) { if (const VarDecl *VD = dyn_cast(DR->getDecl())) CheckVarDecl(VD, DR, Val, dsk, Live); } bool isIncrement(VarDecl *VD, const BinaryOperator* B) { if (B->isCompoundAssignmentOp()) return true; const Expr *RHS = B->getRHS()->IgnoreParenCasts(); const BinaryOperator* BRHS = dyn_cast(RHS); if (!BRHS) return false; const DeclRefExpr *DR; if ((DR = dyn_cast(BRHS->getLHS()->IgnoreParenCasts()))) if (DR->getDecl() == VD) return true; if ((DR = dyn_cast(BRHS->getRHS()->IgnoreParenCasts()))) if (DR->getDecl() == VD) return true; return false; } void observeStmt(const Stmt *S, const CFGBlock *block, const LiveVariables::LivenessValues &Live) override { currentBlock = block; // Skip statements in macros. if (S->getLocStart().isMacroID()) return; // Only cover dead stores from regular assignments. ++/-- dead stores // have never flagged a real bug. if (const BinaryOperator* B = dyn_cast(S)) { if (!B->isAssignmentOp()) return; // Skip non-assignments. if (DeclRefExpr *DR = dyn_cast(B->getLHS())) if (VarDecl *VD = dyn_cast(DR->getDecl())) { // Special case: check for assigning null to a pointer. // This is a common form of defensive programming. const Expr *RHS = LookThroughTransitiveAssignmentsAndCommaOperators(B->getRHS()); RHS = RHS->IgnoreParenCasts(); QualType T = VD->getType(); if (T->isPointerType() || T->isObjCObjectPointerType()) { if (RHS->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) return; } // Special case: self-assignments. These are often used to shut up // "unused variable" compiler warnings. if (const DeclRefExpr *RhsDR = dyn_cast(RHS)) if (VD == dyn_cast(RhsDR->getDecl())) return; // Otherwise, issue a warning. DeadStoreKind dsk = Parents.isConsumedExpr(B) ? Enclosing : (isIncrement(VD,B) ? DeadIncrement : Standard); CheckVarDecl(VD, DR, B->getRHS(), dsk, Live); } } else if (const UnaryOperator* U = dyn_cast(S)) { if (!U->isIncrementOp() || U->isPrefix()) return; const Stmt *parent = Parents.getParentIgnoreParenCasts(U); if (!parent || !isa(parent)) return; const Expr *Ex = U->getSubExpr()->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast(Ex)) CheckDeclRef(DR, U, DeadIncrement, Live); } else if (const DeclStmt *DS = dyn_cast(S)) // Iterate through the decls. Warn if any initializers are complex // expressions that are not live (never used). for (const auto *DI : DS->decls()) { const auto *V = dyn_cast(DI); if (!V) continue; if (V->hasLocalStorage()) { // Reference types confuse the dead stores checker. Skip them // for now. if (V->getType()->getAs()) return; if (const Expr *E = V->getInit()) { while (const ExprWithCleanups *exprClean = dyn_cast(E)) E = exprClean->getSubExpr(); // Look through transitive assignments, e.g.: // int x = y = 0; E = LookThroughTransitiveAssignmentsAndCommaOperators(E); // Don't warn on C++ objects (yet) until we can show that their // constructors/destructors don't have side effects. if (isa(E)) return; // A dead initialization is a variable that is dead after it // is initialized. We don't flag warnings for those variables // marked 'unused' or 'objc_precise_lifetime'. if (!isLive(Live, V) && !V->hasAttr() && !V->hasAttr()) { // Special case: check for initializations with constants. // // e.g. : int x = 0; // // If x is EVER assigned a new value later, don't issue // a warning. This is because such initialization can be // due to defensive programming. if (E->isEvaluatable(Ctx)) return; if (const DeclRefExpr *DRE = dyn_cast(E->IgnoreParenCasts())) if (const VarDecl *VD = dyn_cast(DRE->getDecl())) { // Special case: check for initialization from constant // variables. // // e.g. extern const int MyConstant; // int x = MyConstant; // if (VD->hasGlobalStorage() && VD->getType().isConstQualified()) return; // Special case: check for initialization from scalar // parameters. This is often a form of defensive // programming. Non-scalars are still an error since // because it more likely represents an actual algorithmic // bug. if (isa(VD) && VD->getType()->isScalarType()) return; } PathDiagnosticLocation Loc = PathDiagnosticLocation::create(V, BR.getSourceManager()); Report(V, DeadInit, Loc, E->getSourceRange()); } } } } } }; } // end anonymous namespace //===----------------------------------------------------------------------===// // Driver function to invoke the Dead-Stores checker on a CFG. //===----------------------------------------------------------------------===// namespace { class FindEscaped { public: llvm::SmallPtrSet Escaped; void operator()(const Stmt *S) { // Check for '&'. Any VarDecl whose address has been taken we treat as // escaped. // FIXME: What about references? const UnaryOperator *U = dyn_cast(S); if (!U) return; if (U->getOpcode() != UO_AddrOf) return; const Expr *E = U->getSubExpr()->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast(E)) if (const VarDecl *VD = dyn_cast(DR->getDecl())) Escaped.insert(VD); } }; } // end anonymous namespace //===----------------------------------------------------------------------===// // DeadStoresChecker //===----------------------------------------------------------------------===// namespace { class DeadStoresChecker : public Checker { public: void checkASTCodeBody(const Decl *D, AnalysisManager& mgr, BugReporter &BR) const { // Don't do anything for template instantiations. // Proving that code in a template instantiation is "dead" // means proving that it is dead in all instantiations. // This same problem exists with -Wunreachable-code. if (const FunctionDecl *FD = dyn_cast(D)) if (FD->isTemplateInstantiation()) return; if (LiveVariables *L = mgr.getAnalysis(D)) { CFG &cfg = *mgr.getCFG(D); AnalysisDeclContext *AC = mgr.getAnalysisDeclContext(D); ParentMap &pmap = mgr.getParentMap(D); FindEscaped FS; cfg.VisitBlockStmts(FS); DeadStoreObs A(cfg, BR.getContext(), BR, this, AC, pmap, FS.Escaped); L->runOnAllBlocks(A); } } }; } void ento::registerDeadStoresChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.4.4.1 log @file DeadStoresChecker.cpp was added on branch yamt-pagecache on 2014-05-22 16:18:31 +0000 @ text @d1 454 @ 1.1.1.4.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @a0 454 //==- DeadStoresChecker.cpp - Check for stores to dead variables -*- C++ -*-==// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a DeadStores, a flow-sensitive checker that looks for // stores to variables that are no longer live. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/AST/ASTContext.h" #include "clang/AST/Attr.h" #include "clang/AST/ParentMap.h" #include "clang/AST/RecursiveASTVisitor.h" #include "clang/Analysis/Analyses/LiveVariables.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "llvm/ADT/BitVector.h" #include "llvm/ADT/SmallString.h" #include "llvm/Support/SaveAndRestore.h" using namespace clang; using namespace ento; namespace { /// A simple visitor to record what VarDecls occur in EH-handling code. class EHCodeVisitor : public RecursiveASTVisitor { public: bool inEH; llvm::DenseSet &S; bool TraverseObjCAtFinallyStmt(ObjCAtFinallyStmt *S) { SaveAndRestore inFinally(inEH, true); return ::RecursiveASTVisitor::TraverseObjCAtFinallyStmt(S); } bool TraverseObjCAtCatchStmt(ObjCAtCatchStmt *S) { SaveAndRestore inCatch(inEH, true); return ::RecursiveASTVisitor::TraverseObjCAtCatchStmt(S); } bool TraverseCXXCatchStmt(CXXCatchStmt *S) { SaveAndRestore inCatch(inEH, true); return TraverseStmt(S->getHandlerBlock()); } bool VisitDeclRefExpr(DeclRefExpr *DR) { if (inEH) if (const VarDecl *D = dyn_cast(DR->getDecl())) S.insert(D); return true; } EHCodeVisitor(llvm::DenseSet &S) : inEH(false), S(S) {} }; // FIXME: Eventually migrate into its own file, and have it managed by // AnalysisManager. class ReachableCode { const CFG &cfg; llvm::BitVector reachable; public: ReachableCode(const CFG &cfg) : cfg(cfg), reachable(cfg.getNumBlockIDs(), false) {} void computeReachableBlocks(); bool isReachable(const CFGBlock *block) const { return reachable[block->getBlockID()]; } }; } void ReachableCode::computeReachableBlocks() { if (!cfg.getNumBlockIDs()) return; SmallVector worklist; worklist.push_back(&cfg.getEntry()); while (!worklist.empty()) { const CFGBlock *block = worklist.pop_back_val(); llvm::BitVector::reference isReachable = reachable[block->getBlockID()]; if (isReachable) continue; isReachable = true; for (CFGBlock::const_succ_iterator i = block->succ_begin(), e = block->succ_end(); i != e; ++i) if (const CFGBlock *succ = *i) worklist.push_back(succ); } } static const Expr * LookThroughTransitiveAssignmentsAndCommaOperators(const Expr *Ex) { while (Ex) { const BinaryOperator *BO = dyn_cast(Ex->IgnoreParenCasts()); if (!BO) break; if (BO->getOpcode() == BO_Assign) { Ex = BO->getRHS(); continue; } if (BO->getOpcode() == BO_Comma) { Ex = BO->getRHS(); continue; } break; } return Ex; } namespace { class DeadStoreObs : public LiveVariables::Observer { const CFG &cfg; ASTContext &Ctx; BugReporter& BR; const CheckerBase *Checker; AnalysisDeclContext* AC; ParentMap& Parents; llvm::SmallPtrSet Escaped; OwningPtr reachableCode; const CFGBlock *currentBlock; OwningPtr > InEH; enum DeadStoreKind { Standard, Enclosing, DeadIncrement, DeadInit }; public: DeadStoreObs(const CFG &cfg, ASTContext &ctx, BugReporter &br, const CheckerBase *checker, AnalysisDeclContext *ac, ParentMap &parents, llvm::SmallPtrSet &escaped) : cfg(cfg), Ctx(ctx), BR(br), Checker(checker), AC(ac), Parents(parents), Escaped(escaped), currentBlock(0) {} virtual ~DeadStoreObs() {} bool isLive(const LiveVariables::LivenessValues &Live, const VarDecl *D) { if (Live.isLive(D)) return true; // Lazily construct the set that records which VarDecls are in // EH code. if (!InEH.get()) { InEH.reset(new llvm::DenseSet()); EHCodeVisitor V(*InEH.get()); V.TraverseStmt(AC->getBody()); } // Treat all VarDecls that occur in EH code as being "always live" // when considering to suppress dead stores. Frequently stores // are followed by reads in EH code, but we don't have the ability // to analyze that yet. return InEH->count(D); } void Report(const VarDecl *V, DeadStoreKind dsk, PathDiagnosticLocation L, SourceRange R) { if (Escaped.count(V)) return; // Compute reachable blocks within the CFG for trivial cases // where a bogus dead store can be reported because itself is unreachable. if (!reachableCode.get()) { reachableCode.reset(new ReachableCode(cfg)); reachableCode->computeReachableBlocks(); } if (!reachableCode->isReachable(currentBlock)) return; SmallString<64> buf; llvm::raw_svector_ostream os(buf); const char *BugType = 0; switch (dsk) { case DeadInit: BugType = "Dead initialization"; os << "Value stored to '" << *V << "' during its initialization is never read"; break; case DeadIncrement: BugType = "Dead increment"; case Standard: if (!BugType) BugType = "Dead assignment"; os << "Value stored to '" << *V << "' is never read"; break; case Enclosing: // Don't report issues in this case, e.g.: "if (x = foo())", // where 'x' is unused later. We have yet to see a case where // this is a real bug. return; } BR.EmitBasicReport(AC->getDecl(), Checker, BugType, "Dead store", os.str(), L, R); } void CheckVarDecl(const VarDecl *VD, const Expr *Ex, const Expr *Val, DeadStoreKind dsk, const LiveVariables::LivenessValues &Live) { if (!VD->hasLocalStorage()) return; // Reference types confuse the dead stores checker. Skip them // for now. if (VD->getType()->getAs()) return; if (!isLive(Live, VD) && !(VD->hasAttr() || VD->hasAttr() || VD->hasAttr())) { PathDiagnosticLocation ExLoc = PathDiagnosticLocation::createBegin(Ex, BR.getSourceManager(), AC); Report(VD, dsk, ExLoc, Val->getSourceRange()); } } void CheckDeclRef(const DeclRefExpr *DR, const Expr *Val, DeadStoreKind dsk, const LiveVariables::LivenessValues& Live) { if (const VarDecl *VD = dyn_cast(DR->getDecl())) CheckVarDecl(VD, DR, Val, dsk, Live); } bool isIncrement(VarDecl *VD, const BinaryOperator* B) { if (B->isCompoundAssignmentOp()) return true; const Expr *RHS = B->getRHS()->IgnoreParenCasts(); const BinaryOperator* BRHS = dyn_cast(RHS); if (!BRHS) return false; const DeclRefExpr *DR; if ((DR = dyn_cast(BRHS->getLHS()->IgnoreParenCasts()))) if (DR->getDecl() == VD) return true; if ((DR = dyn_cast(BRHS->getRHS()->IgnoreParenCasts()))) if (DR->getDecl() == VD) return true; return false; } virtual void observeStmt(const Stmt *S, const CFGBlock *block, const LiveVariables::LivenessValues &Live) { currentBlock = block; // Skip statements in macros. if (S->getLocStart().isMacroID()) return; // Only cover dead stores from regular assignments. ++/-- dead stores // have never flagged a real bug. if (const BinaryOperator* B = dyn_cast(S)) { if (!B->isAssignmentOp()) return; // Skip non-assignments. if (DeclRefExpr *DR = dyn_cast(B->getLHS())) if (VarDecl *VD = dyn_cast(DR->getDecl())) { // Special case: check for assigning null to a pointer. // This is a common form of defensive programming. const Expr *RHS = LookThroughTransitiveAssignmentsAndCommaOperators(B->getRHS()); RHS = RHS->IgnoreParenCasts(); QualType T = VD->getType(); if (T->isPointerType() || T->isObjCObjectPointerType()) { if (RHS->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) return; } // Special case: self-assignments. These are often used to shut up // "unused variable" compiler warnings. if (const DeclRefExpr *RhsDR = dyn_cast(RHS)) if (VD == dyn_cast(RhsDR->getDecl())) return; // Otherwise, issue a warning. DeadStoreKind dsk = Parents.isConsumedExpr(B) ? Enclosing : (isIncrement(VD,B) ? DeadIncrement : Standard); CheckVarDecl(VD, DR, B->getRHS(), dsk, Live); } } else if (const UnaryOperator* U = dyn_cast(S)) { if (!U->isIncrementOp() || U->isPrefix()) return; const Stmt *parent = Parents.getParentIgnoreParenCasts(U); if (!parent || !isa(parent)) return; const Expr *Ex = U->getSubExpr()->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast(Ex)) CheckDeclRef(DR, U, DeadIncrement, Live); } else if (const DeclStmt *DS = dyn_cast(S)) // Iterate through the decls. Warn if any initializers are complex // expressions that are not live (never used). for (DeclStmt::const_decl_iterator DI=DS->decl_begin(), DE=DS->decl_end(); DI != DE; ++DI) { VarDecl *V = dyn_cast(*DI); if (!V) continue; if (V->hasLocalStorage()) { // Reference types confuse the dead stores checker. Skip them // for now. if (V->getType()->getAs()) return; if (const Expr *E = V->getInit()) { while (const ExprWithCleanups *exprClean = dyn_cast(E)) E = exprClean->getSubExpr(); // Look through transitive assignments, e.g.: // int x = y = 0; E = LookThroughTransitiveAssignmentsAndCommaOperators(E); // Don't warn on C++ objects (yet) until we can show that their // constructors/destructors don't have side effects. if (isa(E)) return; // A dead initialization is a variable that is dead after it // is initialized. We don't flag warnings for those variables // marked 'unused' or 'objc_precise_lifetime'. if (!isLive(Live, V) && !V->hasAttr() && !V->hasAttr()) { // Special case: check for initializations with constants. // // e.g. : int x = 0; // // If x is EVER assigned a new value later, don't issue // a warning. This is because such initialization can be // due to defensive programming. if (E->isEvaluatable(Ctx)) return; if (const DeclRefExpr *DRE = dyn_cast(E->IgnoreParenCasts())) if (const VarDecl *VD = dyn_cast(DRE->getDecl())) { // Special case: check for initialization from constant // variables. // // e.g. extern const int MyConstant; // int x = MyConstant; // if (VD->hasGlobalStorage() && VD->getType().isConstQualified()) return; // Special case: check for initialization from scalar // parameters. This is often a form of defensive // programming. Non-scalars are still an error since // because it more likely represents an actual algorithmic // bug. if (isa(VD) && VD->getType()->isScalarType()) return; } PathDiagnosticLocation Loc = PathDiagnosticLocation::create(V, BR.getSourceManager()); Report(V, DeadInit, Loc, E->getSourceRange()); } } } } } }; } // end anonymous namespace //===----------------------------------------------------------------------===// // Driver function to invoke the Dead-Stores checker on a CFG. //===----------------------------------------------------------------------===// namespace { class FindEscaped { public: llvm::SmallPtrSet Escaped; void operator()(const Stmt *S) { // Check for '&'. Any VarDecl whose address has been taken we treat as // escaped. // FIXME: What about references? const UnaryOperator *U = dyn_cast(S); if (!U) return; if (U->getOpcode() != UO_AddrOf) return; const Expr *E = U->getSubExpr()->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast(E)) if (const VarDecl *VD = dyn_cast(DR->getDecl())) Escaped.insert(VD); } }; } // end anonymous namespace //===----------------------------------------------------------------------===// // DeadStoresChecker //===----------------------------------------------------------------------===// namespace { class DeadStoresChecker : public Checker { public: void checkASTCodeBody(const Decl *D, AnalysisManager& mgr, BugReporter &BR) const { // Don't do anything for template instantiations. // Proving that code in a template instantiation is "dead" // means proving that it is dead in all instantiations. // This same problem exists with -Wunreachable-code. if (const FunctionDecl *FD = dyn_cast(D)) if (FD->isTemplateInstantiation()) return; if (LiveVariables *L = mgr.getAnalysis(D)) { CFG &cfg = *mgr.getCFG(D); AnalysisDeclContext *AC = mgr.getAnalysisDeclContext(D); ParentMap &pmap = mgr.getParentMap(D); FindEscaped FS; cfg.VisitBlockStmts(FS); DeadStoreObs A(cfg, BR.getContext(), BR, this, AC, pmap, FS.Escaped); L->runOnAllBlocks(A); } } }; } void ento::registerDeadStoresChecker(CheckerManager &mgr) { mgr.registerChecker(); } @