extra: frob(foo) resets the value of *foo
[smatch.git] / smatch_flow.c
blob254f4667adb8aa83159e75d9f95401d6ed7dee80
1 /*
2 * sparse/smatch_flow.c
4 * Copyright (C) 2006,2008 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
10 #define _GNU_SOURCE 1
11 #include <unistd.h>
12 #include <stdio.h>
13 #include "token.h"
14 #include "smatch.h"
15 #include "smatch_expression_stacks.h"
16 #include "smatch_extra.h"
17 #include "smatch_slist.h"
19 int final_pass;
21 static int __smatch_lineno = 0;
23 static const char *filename;
24 static char *pathname;
25 static char *full_filename;
26 static char *cur_func;
27 static int line_func_start;
28 static int loop_count;
29 int __expr_stmt_count;
30 static struct expression_list *switch_expr_stack = NULL;
32 struct expression_list *big_expression_stack;
33 struct statement_list *big_statement_stack;
34 int __in_pre_condition = 0;
35 int __bail_on_rest_of_function = 0;
36 char *get_function(void) { return cur_func; }
37 int get_lineno(void) { return __smatch_lineno; }
38 int inside_loop(void) { return !!loop_count; }
39 int in_expression_statement(void) { return !!__expr_stmt_count; }
41 static void split_symlist(struct symbol_list *sym_list);
42 static void split_declaration(struct symbol_list *sym_list);
43 static void split_expr_list(struct expression_list *expr_list);
44 static void add_inline_function(struct symbol *sym);
46 int option_assume_loops = 0;
47 int option_known_conditions = 0;
48 int option_two_passes = 0;
49 struct symbol *cur_func_sym = NULL;
51 const char *get_filename(void)
53 if (option_full_path)
54 return full_filename;
55 return filename;
58 static void set_position(struct position pos)
60 int len;
61 static int prev_stream = -1;
63 __smatch_lineno = pos.line;
65 if (pos.stream == prev_stream)
66 return;
68 filename = stream_name(pos.stream);
70 free(full_filename);
71 pathname = getcwd(NULL, 0);
72 if (pathname) {
73 len = strlen(pathname) + 1 + strlen(filename) + 1;
74 full_filename = malloc(len);
75 snprintf(full_filename, len, "%s/%s", pathname, filename);
76 } else {
77 full_filename = alloc_string(filename);
79 free(pathname);
82 static int is_inline_func(struct expression *expr)
84 if (expr->type != EXPR_SYMBOL || !expr->symbol)
85 return 0;
86 if (expr->symbol->ctype.modifiers & MOD_INLINE)
87 return 1;
88 return 0;
91 void __split_expr(struct expression *expr)
93 if (!expr)
94 return;
96 // sm_msg(" Debug expr_type %d %s", expr->type, show_special(expr->op));
98 push_expression(&big_expression_stack, expr);
99 set_position(expr->pos);
100 __pass_to_client(expr, EXPR_HOOK);
102 switch (expr->type) {
103 case EXPR_PREOP:
104 if (expr->op == '*')
105 __pass_to_client(expr, DEREF_HOOK);
106 case EXPR_POSTOP:
107 __pass_to_client(expr, OP_HOOK);
108 __split_expr(expr->unop);
109 break;
110 case EXPR_STATEMENT:
111 __expr_stmt_count++;
112 __split_stmt(expr->statement);
113 __expr_stmt_count--;
114 break;
115 case EXPR_LOGICAL:
116 case EXPR_COMPARE:
117 __pass_to_client(expr, LOGIC_HOOK);
118 __handle_logic(expr);
119 break;
120 case EXPR_BINOP:
121 __pass_to_client(expr, BINOP_HOOK);
122 case EXPR_COMMA:
123 __split_expr(expr->left);
124 __split_expr(expr->right);
125 break;
126 case EXPR_ASSIGNMENT: {
127 struct expression *tmp;
129 if (!expr->right)
130 break;
132 __pass_to_client(expr, RAW_ASSIGNMENT_HOOK);
134 /* foo = !bar() */
135 if (__handle_condition_assigns(expr))
136 break;
137 /* foo = (x < 5 ? foo : 5); */
138 if (__handle_select_assigns(expr))
139 break;
140 /* foo = ({frob(); frob(); frob(); 1;}) */
141 if (__handle_expr_statement_assigns(expr))
142 break;
144 __split_expr(expr->right);
145 __pass_to_client(expr, ASSIGNMENT_HOOK);
146 tmp = strip_expr(expr->right);
147 if (tmp->type == EXPR_CALL)
148 __pass_to_client(expr, CALL_ASSIGNMENT_HOOK);
149 if (get_macro_name(tmp->pos))
150 __pass_to_client(expr, MACRO_ASSIGNMENT_HOOK);
151 __split_expr(expr->left);
152 break;
154 case EXPR_DEREF:
155 __pass_to_client(expr, DEREF_HOOK);
156 __split_expr(expr->deref);
157 break;
158 case EXPR_SLICE:
159 __split_expr(expr->base);
160 break;
161 case EXPR_CAST:
162 case EXPR_FORCE_CAST:
163 __pass_to_client(expr, CAST_HOOK);
164 __split_expr(expr->cast_expression);
165 break;
166 case EXPR_SIZEOF:
167 /* there isn't anything to pass a client from inside a sizeof() */
168 break;
169 case EXPR_CONDITIONAL:
170 case EXPR_SELECT:
171 if (known_condition_true(expr->conditional)) {
172 __split_expr(expr->cond_true);
173 break;
175 if (known_condition_false(expr->conditional)) {
176 __split_expr(expr->cond_false);
177 break;
179 __pass_to_client(expr, SELECT_HOOK);
180 __split_whole_condition(expr->conditional);
181 __split_expr(expr->cond_true);
182 __push_true_states();
183 __use_false_states();
184 __split_expr(expr->cond_false);
185 __merge_true_states();
186 break;
187 case EXPR_CALL:
188 if (sym_name_is("__builtin_constant_p", expr->fn))
189 break;
190 split_expr_list(expr->args);
191 __split_expr(expr->fn);
192 if (is_inline_func(expr->fn))
193 add_inline_function(expr->fn->symbol);
194 __pass_to_client(expr, FUNCTION_CALL_HOOK);
195 break;
196 case EXPR_INITIALIZER:
197 split_expr_list(expr->expr_list);
198 break;
199 case EXPR_IDENTIFIER:
200 __split_expr(expr->ident_expression);
201 break;
202 case EXPR_INDEX:
203 __split_expr(expr->idx_expression);
204 break;
205 case EXPR_POS:
206 __split_expr(expr->init_expr);
207 break;
208 case EXPR_SYMBOL:
209 __pass_to_client(expr, SYM_HOOK);
210 break;
211 case EXPR_STRING:
212 __pass_to_client(expr, STRING_HOOK);
213 break;
214 default:
215 break;
217 pop_expression(&big_expression_stack);
220 static int is_forever_loop(struct statement *stmt)
222 struct expression *expr;
224 expr = strip_expr(stmt->iterator_pre_condition);
225 if (!expr)
226 expr = stmt->iterator_post_condition;
227 if (!expr) {
228 /* this is a for(;;) loop... */
229 return 1;
232 if (expr->type == EXPR_VALUE && expr->value == 1)
233 return 1;
235 return 0;
238 static int loop_num;
239 static char *get_loop_name(int num)
241 char buf[256];
243 snprintf(buf, 255, "-loop%d", num);
244 buf[255] = '\0';
245 return alloc_sname(buf);
249 * Pre Loops are while and for loops.
251 static void handle_pre_loop(struct statement *stmt)
253 int once_through; /* we go through the loop at least once */
254 struct sm_state *extra_sm = NULL;
255 int unchanged = 0;
256 char *loop_name;
257 struct state_list *slist = NULL;
258 struct sm_state *sm = NULL;
260 loop_name = get_loop_name(loop_num);
261 loop_num++;
263 __split_stmt(stmt->iterator_pre_statement);
265 once_through = implied_condition_true(stmt->iterator_pre_condition);
267 loop_count++;
268 __push_continues();
269 __push_breaks();
271 __merge_gotos(loop_name);
273 extra_sm = __extra_handle_canonical_loops(stmt, &slist);
274 __in_pre_condition++;
275 __pass_to_client(stmt, PRELOOP_HOOK);
276 __split_whole_condition(stmt->iterator_pre_condition);
277 __in_pre_condition--;
278 FOR_EACH_PTR(slist, sm) {
279 set_state(sm->owner, sm->name, sm->sym, sm->state);
280 } END_FOR_EACH_PTR(sm);
281 free_slist(&slist);
282 if (extra_sm)
283 extra_sm = get_sm_state(extra_sm->owner, extra_sm->name, extra_sm->sym);
285 if (option_assume_loops)
286 once_through = 1;
288 __split_stmt(stmt->iterator_statement);
289 __warn_on_silly_pre_loops();
290 if (is_forever_loop(stmt)) {
291 __save_gotos(loop_name);
292 /* forever loops don't have an iterator_post_statement */
293 __discard_continues();
294 __discard_false_states();
295 __use_breaks();
296 } else {
297 __merge_continues();
298 unchanged = __iterator_unchanged(extra_sm);
299 __split_stmt(stmt->iterator_post_statement);
300 __save_gotos(loop_name);
301 __split_whole_condition(stmt->iterator_pre_condition);
302 nullify_path();
303 __merge_false_states();
304 if (once_through)
305 __discard_false_states();
306 else
307 __merge_false_states();
309 if (extra_sm && unchanged)
310 __extra_pre_loop_hook_after(extra_sm,
311 stmt->iterator_post_statement,
312 stmt->iterator_pre_condition);
313 __merge_breaks();
315 loop_count--;
319 * Post loops are do {} while();
321 static void handle_post_loop(struct statement *stmt)
323 char *loop_name;
325 loop_name = get_loop_name(loop_num);
326 loop_num++;
327 loop_count++;
329 __push_continues();
330 __push_breaks();
331 __merge_gotos(loop_name);
332 __split_stmt(stmt->iterator_statement);
333 __merge_continues();
334 if (!is_zero(stmt->iterator_post_condition))
335 __save_gotos(loop_name);
337 if (is_forever_loop(stmt)) {
338 __use_breaks();
339 } else {
340 __split_whole_condition(stmt->iterator_post_condition);
341 __use_false_states();
342 __merge_breaks();
344 loop_count--;
347 static int empty_statement(struct statement *stmt)
349 if (!stmt)
350 return 0;
351 if (stmt->type == STMT_EXPRESSION && !stmt->expression)
352 return 1;
353 return 0;
356 static int last_stmt_on_same_line()
358 struct statement *stmt;
359 int i = 0;
361 FOR_EACH_PTR_REVERSE(big_statement_stack, stmt) {
362 if (!i++)
363 continue;
364 if (stmt->pos.line == get_lineno())
365 return 1;
366 return 0;
367 } END_FOR_EACH_PTR_REVERSE(stmt);
368 return 0;
371 static struct statement *last_stmt;
372 static int is_last_stmt(struct statement *stmt)
374 if (stmt == last_stmt)
375 return 1;
376 return 0;
379 static void print_unreached_initializers(struct symbol_list *sym_list)
381 struct symbol *sym;
383 FOR_EACH_PTR(sym_list, sym) {
384 if (sym->initializer)
385 sm_msg("info: '%s' is not actually initialized (unreached code).",
386 (sym->ident ? sym->ident->name : "this variable"));
387 } END_FOR_EACH_PTR(sym);
390 static void print_unreached(struct statement *stmt)
392 static int print = 1;
394 if (!__path_is_null()) {
395 print = 1;
396 return;
398 if (!print)
399 return;
401 switch (stmt->type) {
402 case STMT_COMPOUND: /* after a switch before a case stmt */
403 case STMT_RANGE:
404 case STMT_CASE:
405 case STMT_LABEL:
406 return;
407 case STMT_DECLARATION: /* switch (x) { int a; case foo: ... */
408 print_unreached_initializers(stmt->declaration);
409 return;
410 case STMT_RETURN: /* gcc complains if you don't have a return statement */
411 if (is_last_stmt(stmt))
412 return;
413 break;
414 case STMT_GOTO:
415 if (!option_spammy)
416 return;
417 break;
418 default:
419 break;
421 if (!option_spammy && empty_statement(stmt))
422 return;
423 sm_msg("info: ignoring unreachable code.");
424 print = 0;
427 static void split_asm_constraints(struct expression_list *expr_list)
429 struct expression *expr;
430 int state = 0;
432 FOR_EACH_PTR(expr_list, expr) {
433 switch (state) {
434 case 0: /* identifier */
435 case 1: /* constraint */
436 state++;
437 continue;
438 case 2: /* expression */
439 state = 0;
440 __split_expr(expr);
441 continue;
443 } END_FOR_EACH_PTR(expr);
446 static int is_case_val(struct statement *stmt, long long val)
448 long long case_val;
450 if (stmt->type != STMT_CASE)
451 return 0;
452 if (!stmt->case_expression) {
453 __set_default();
454 return 1;
456 if (!get_value(stmt->case_expression, &case_val))
457 return 0;
458 if (case_val == val)
459 return 1;
460 return 0;
463 static void split_known_switch(struct statement *stmt, long long val)
465 struct statement *tmp;
467 __split_expr(stmt->switch_expression);
469 push_expression(&switch_expr_stack, stmt->switch_expression);
470 __save_switch_states(top_expression(switch_expr_stack));
471 nullify_path();
472 __push_default();
473 __push_breaks();
475 stmt = stmt->switch_statement;
477 if (!last_stmt)
478 last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
480 __push_scope_hooks();
481 FOR_EACH_PTR(stmt->stmts, tmp) {
482 __smatch_lineno = tmp->pos.line;
483 if (is_case_val(tmp, val)) {
484 __merge_switches(top_expression(switch_expr_stack),
485 stmt->case_expression);
486 __pass_case_to_client(top_expression(switch_expr_stack),
487 stmt->case_expression);
489 if (__path_is_null())
490 continue;
491 __split_stmt(tmp);
492 if (__path_is_null()) {
493 __set_default();
494 goto out;
496 } END_FOR_EACH_PTR(tmp);
497 out:
498 __call_scope_hooks();
499 if (!__pop_default())
500 __merge_switches(top_expression(switch_expr_stack),
501 NULL);
502 __discard_switches();
503 __merge_breaks();
504 pop_expression(&switch_expr_stack);
507 void __split_stmt(struct statement *stmt)
509 long long val;
511 if (!stmt)
512 return;
514 if (out_of_memory() || __bail_on_rest_of_function) {
515 static char *printed = NULL;
517 if (printed != cur_func)
518 sm_msg("Function too hairy. Giving up.");
519 printed = cur_func;
520 return;
523 add_ptr_list(&big_statement_stack, stmt);
524 free_expression_stack(&big_expression_stack);
525 set_position(stmt->pos);
526 print_unreached(stmt);
527 __pass_to_client(stmt, STMT_HOOK);
529 switch (stmt->type) {
530 case STMT_DECLARATION:
531 split_declaration(stmt->declaration);
532 return;
533 case STMT_RETURN:
534 __split_expr(stmt->ret_value);
535 __pass_to_client(stmt->ret_value, RETURN_HOOK);
536 nullify_path();
537 return;
538 case STMT_EXPRESSION:
539 __split_expr(stmt->expression);
540 return;
541 case STMT_COMPOUND: {
542 struct statement *tmp;
544 if (!last_stmt)
545 last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
546 __push_scope_hooks();
547 FOR_EACH_PTR(stmt->stmts, tmp) {
548 __split_stmt(tmp);
549 } END_FOR_EACH_PTR(tmp);
550 __call_scope_hooks();
551 return;
553 case STMT_IF:
554 if (known_condition_true(stmt->if_conditional)) {
555 __split_stmt(stmt->if_true);
556 return;
558 if (known_condition_false(stmt->if_conditional)) {
559 __split_stmt(stmt->if_false);
560 return;
562 if (option_known_conditions &&
563 implied_condition_true(stmt->if_conditional)) {
564 sm_info("this condition is true.");
565 __split_stmt(stmt->if_true);
566 return;
568 if (option_known_conditions &&
569 implied_condition_false(stmt->if_conditional)) {
570 sm_info("this condition is false.");
571 __split_stmt(stmt->if_false);
572 return;
574 __split_whole_condition(stmt->if_conditional);
575 __split_stmt(stmt->if_true);
576 if (empty_statement(stmt->if_true) &&
577 last_stmt_on_same_line() &&
578 !get_macro_name(stmt->if_true->pos))
579 sm_msg("warn: if();");
580 __push_true_states();
581 __use_false_states();
582 __split_stmt(stmt->if_false);
583 __merge_true_states();
584 return;
585 case STMT_ITERATOR:
586 if (stmt->iterator_pre_condition)
587 handle_pre_loop(stmt);
588 else if (stmt->iterator_post_condition)
589 handle_post_loop(stmt);
590 else {
591 // these are for(;;) type loops.
592 handle_pre_loop(stmt);
594 return;
595 case STMT_SWITCH:
596 if (get_value(stmt->switch_expression, &val)) {
597 split_known_switch(stmt, val);
598 return;
600 __split_expr(stmt->switch_expression);
601 push_expression(&switch_expr_stack, stmt->switch_expression);
602 __save_switch_states(top_expression(switch_expr_stack));
603 nullify_path();
604 __push_default();
605 __push_breaks();
606 __split_stmt(stmt->switch_statement);
607 if (!__pop_default())
608 __merge_switches(top_expression(switch_expr_stack),
609 NULL);
610 __discard_switches();
611 __merge_breaks();
612 pop_expression(&switch_expr_stack);
613 return;
614 case STMT_CASE:
615 __merge_switches(top_expression(switch_expr_stack),
616 stmt->case_expression);
617 __pass_case_to_client(top_expression(switch_expr_stack),
618 stmt->case_expression);
619 if (!stmt->case_expression)
620 __set_default();
621 __split_expr(stmt->case_expression);
622 __split_expr(stmt->case_to);
623 __split_stmt(stmt->case_statement);
624 return;
625 case STMT_LABEL:
626 if (stmt->label_identifier &&
627 stmt->label_identifier->type == SYM_LABEL &&
628 stmt->label_identifier->ident) {
629 loop_count = 1000000;
630 __merge_gotos(stmt->label_identifier->ident->name);
632 __split_stmt(stmt->label_statement);
633 return;
634 case STMT_GOTO:
635 __split_expr(stmt->goto_expression);
636 if (stmt->goto_label && stmt->goto_label->type == SYM_NODE) {
637 if (!strcmp(stmt->goto_label->ident->name, "break")) {
638 __process_breaks();
639 } else if (!strcmp(stmt->goto_label->ident->name,
640 "continue")) {
641 __process_continues();
643 } else if (stmt->goto_label &&
644 stmt->goto_label->type == SYM_LABEL &&
645 stmt->goto_label->ident) {
646 __save_gotos(stmt->goto_label->ident->name);
648 nullify_path();
649 return;
650 case STMT_NONE:
651 return;
652 case STMT_ASM:
653 __pass_to_client(stmt, ASM_HOOK);
654 __split_expr(stmt->asm_string);
655 split_asm_constraints(stmt->asm_outputs);
656 split_asm_constraints(stmt->asm_inputs);
657 split_asm_constraints(stmt->asm_clobbers);
658 return;
659 case STMT_CONTEXT:
660 return;
661 case STMT_RANGE:
662 __split_expr(stmt->range_expression);
663 __split_expr(stmt->range_low);
664 __split_expr(stmt->range_high);
665 return;
669 static void split_expr_list(struct expression_list *expr_list)
671 struct expression *expr;
673 FOR_EACH_PTR(expr_list, expr) {
674 __split_expr(expr);
675 } END_FOR_EACH_PTR(expr);
678 static void split_sym(struct symbol *sym)
680 if (!sym)
681 return;
682 if (!(sym->namespace & NS_SYMBOL))
683 return;
685 __split_stmt(sym->stmt);
686 __split_expr(sym->array_size);
687 split_symlist(sym->arguments);
688 split_symlist(sym->symbol_list);
689 __split_stmt(sym->inline_stmt);
690 split_symlist(sym->inline_symbol_list);
693 static void split_symlist(struct symbol_list *sym_list)
695 struct symbol *sym;
697 FOR_EACH_PTR(sym_list, sym) {
698 split_sym(sym);
699 } END_FOR_EACH_PTR(sym);
702 static struct expression *fake_assign_expr(struct symbol *sym)
704 struct expression *e_assign, *e_symbol;
706 e_assign = alloc_expression(sym->initializer->pos, EXPR_ASSIGNMENT);
707 e_symbol = alloc_expression(sym->pos, EXPR_SYMBOL);
708 e_assign->op = (int)'=';
709 e_symbol->symbol = sym;
710 e_symbol->symbol_name = sym->ident;
711 e_assign->left = e_symbol;
712 e_assign->right = sym->initializer;
713 return e_assign;
716 static void do_initializer_stuff(struct symbol *sym)
718 struct expression *assign;
720 if (!sym->initializer)
721 return;
722 assign = fake_assign_expr(sym);
723 __split_expr(assign);
726 static void split_declaration(struct symbol_list *sym_list)
728 struct symbol *sym;
730 FOR_EACH_PTR(sym_list, sym) {
731 __pass_to_client(sym, DECLARATION_HOOK);
732 do_initializer_stuff(sym);
733 split_sym(sym);
734 } END_FOR_EACH_PTR(sym);
737 static void split_function(struct symbol *sym)
739 struct symbol *base_type = get_base_type(sym);
741 cur_func_sym = sym;
742 if (base_type->stmt)
743 line_func_start = base_type->stmt->pos.line;
744 if (sym->ident)
745 cur_func = sym->ident->name;
746 __smatch_lineno = sym->pos.line;
747 last_stmt = NULL;
748 loop_count = 0;
749 sm_debug("new function: %s\n", cur_func);
750 if (option_two_passes) {
751 __unnullify_path();
752 loop_num = 0;
753 final_pass = 0;
754 __pass_to_client(sym, FUNC_DEF_HOOK);
755 __split_stmt(base_type->stmt);
756 __split_stmt(base_type->inline_stmt);
757 nullify_path();
759 __unnullify_path();
760 loop_num = 0;
761 final_pass = 1;
762 __pass_to_client(sym, FUNC_DEF_HOOK);
763 __split_stmt(base_type->stmt);
764 __split_stmt(base_type->inline_stmt);
765 __pass_to_client(sym, END_FUNC_HOOK);
766 cur_func = NULL;
767 line_func_start = 0;
768 clear_all_states();
769 free_data_info_allocs();
770 free_expression_stack(&switch_expr_stack);
771 __free_ptr_list((struct ptr_list **)&big_statement_stack);
772 __bail_on_rest_of_function = 0;
775 static struct symbol_list *inlines_called;
776 static void add_inline_function(struct symbol *sym)
778 static struct symbol_list *already_added;
779 struct symbol *tmp;
781 FOR_EACH_PTR(already_added, tmp) {
782 if (tmp == sym)
783 return;
784 } END_FOR_EACH_PTR(tmp);
786 add_ptr_list(&already_added, sym);
787 add_ptr_list(&inlines_called, sym);
790 static void process_inlines()
792 struct symbol *tmp;
794 FOR_EACH_PTR(inlines_called, tmp) {
795 split_function(tmp);
796 } END_FOR_EACH_PTR(tmp);
797 free_ptr_list(&inlines_called);
800 static void split_functions(struct symbol_list *sym_list)
802 struct symbol *sym;
804 FOR_EACH_PTR(sym_list, sym) {
805 set_position(sym->pos);
806 if (sym->type == SYM_NODE && get_base_type(sym)->type == SYM_FN) {
807 split_function(sym);
808 process_inlines();
809 } else {
810 __pass_to_client(sym, BASE_HOOK);
812 } END_FOR_EACH_PTR(sym);
813 __pass_to_client_no_data(END_FILE_HOOK);
816 void smatch(int argc, char **argv)
819 struct string_list *filelist = NULL;
820 struct symbol_list *sym_list;
821 char *file;
823 if (argc < 2) {
824 printf("Usage: smatch [--debug] <filename.c>\n");
825 exit(1);
827 sparse_initialize(argc, argv, &filelist);
828 FOR_EACH_PTR_NOTAG(filelist, file) {
829 if (option_file_output) {
830 char buf[256];
832 snprintf(buf, sizeof(buf), "%s.smatch", file);
833 sm_outfd = fopen(buf, "w");
834 if (!sm_outfd) {
835 printf("Error: Cannot open %s\n", file);
836 exit(1);
839 sym_list = sparse_keep_tokens(file);
840 split_functions(sym_list);
841 } END_FOR_EACH_PTR_NOTAG(file);