1 //===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file implements extra semantic analysis beyond what is enforced
11 // by the C type system.
13 //===----------------------------------------------------------------------===//
15 #include "clang/Sema/Sema.h"
16 #include "clang/Sema/SemaInternal.h"
17 #include "clang/Sema/ScopeInfo.h"
18 #include "clang/Analysis/Analyses/FormatString.h"
19 #include "clang/AST/ASTContext.h"
20 #include "clang/AST/CharUnits.h"
21 #include "clang/AST/DeclCXX.h"
22 #include "clang/AST/DeclObjC.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/DeclObjC.h"
26 #include "clang/AST/StmtCXX.h"
27 #include "clang/AST/StmtObjC.h"
28 #include "clang/Lex/LiteralSupport.h"
29 #include "clang/Lex/Preprocessor.h"
30 #include "llvm/ADT/BitVector.h"
31 #include "llvm/ADT/STLExtras.h"
32 #include "llvm/Support/raw_ostream.h"
33 #include "clang/Basic/TargetBuiltins.h"
34 #include "clang/Basic/TargetInfo.h"
35 #include "clang/Basic/ConvertUTF.h"
38 using namespace clang
;
41 /// getLocationOfStringLiteralByte - Return a source location that points to the
42 /// specified byte of the specified string literal.
44 /// Strings are amazingly complex. They can be formed from multiple tokens and
45 /// can have escape sequences in them in addition to the usual trigraph and
46 /// escaped newline business. This routine handles this complexity.
48 SourceLocation
Sema::getLocationOfStringLiteralByte(const StringLiteral
*SL
,
49 unsigned ByteNo
) const {
50 assert(!SL
->isWide() && "This doesn't work for wide strings yet");
52 // Loop over all of the tokens in this string until we find the one that
53 // contains the byte we're looking for.
56 assert(TokNo
< SL
->getNumConcatenated() && "Invalid byte number!");
57 SourceLocation StrTokLoc
= SL
->getStrTokenLoc(TokNo
);
59 // Get the spelling of the string so that we can get the data that makes up
60 // the string literal, not the identifier for the macro it is potentially
62 SourceLocation StrTokSpellingLoc
= SourceMgr
.getSpellingLoc(StrTokLoc
);
64 // Re-lex the token to get its length and original spelling.
65 std::pair
<FileID
, unsigned> LocInfo
=
66 SourceMgr
.getDecomposedLoc(StrTokSpellingLoc
);
68 llvm::StringRef Buffer
= SourceMgr
.getBufferData(LocInfo
.first
, &Invalid
);
70 return StrTokSpellingLoc
;
72 const char *StrData
= Buffer
.data()+LocInfo
.second
;
74 // Create a langops struct and enable trigraphs. This is sufficient for
77 LangOpts
.Trigraphs
= true;
79 // Create a lexer starting at the beginning of this token.
80 Lexer
TheLexer(StrTokSpellingLoc
, LangOpts
, Buffer
.begin(), StrData
,
83 TheLexer
.LexFromRawLexer(TheTok
);
85 // Use the StringLiteralParser to compute the length of the string in bytes.
86 StringLiteralParser
SLP(&TheTok
, 1, PP
, /*Complain=*/false);
87 unsigned TokNumBytes
= SLP
.GetStringLength();
89 // If the byte is in this token, return the location of the byte.
90 if (ByteNo
< TokNumBytes
||
91 (ByteNo
== TokNumBytes
&& TokNo
== SL
->getNumConcatenated())) {
93 StringLiteralParser::getOffsetOfStringByte(TheTok
, ByteNo
, PP
,
96 // Now that we know the offset of the token in the spelling, use the
97 // preprocessor to get the offset in the original source.
98 return PP
.AdvanceToTokenCharacter(StrTokLoc
, Offset
);
101 // Move to the next string token.
103 ByteNo
-= TokNumBytes
;
107 /// CheckablePrintfAttr - does a function call have a "printf" attribute
108 /// and arguments that merit checking?
109 bool Sema::CheckablePrintfAttr(const FormatAttr
*Format
, CallExpr
*TheCall
) {
110 if (Format
->getType() == "printf") return true;
111 if (Format
->getType() == "printf0") {
112 // printf0 allows null "format" string; if so don't check format/args
113 unsigned format_idx
= Format
->getFormatIdx() - 1;
114 // Does the index refer to the implicit object argument?
115 if (isa
<CXXMemberCallExpr
>(TheCall
)) {
120 if (format_idx
< TheCall
->getNumArgs()) {
121 Expr
*Format
= TheCall
->getArg(format_idx
)->IgnoreParenCasts();
122 if (!Format
->isNullPointerConstant(Context
,
123 Expr::NPC_ValueDependentIsNull
))
131 Sema::CheckBuiltinFunctionCall(unsigned BuiltinID
, CallExpr
*TheCall
) {
132 ExprResult
TheCallResult(Owned(TheCall
));
134 // Find out if any arguments are required to be integer constant expressions.
135 unsigned ICEArguments
= 0;
136 ASTContext::GetBuiltinTypeError Error
;
137 Context
.GetBuiltinType(BuiltinID
, Error
, &ICEArguments
);
138 if (Error
!= ASTContext::GE_None
)
139 ICEArguments
= 0; // Don't diagnose previously diagnosed errors.
141 // If any arguments are required to be ICE's, check and diagnose.
142 for (unsigned ArgNo
= 0; ICEArguments
!= 0; ++ArgNo
) {
143 // Skip arguments not required to be ICE's.
144 if ((ICEArguments
& (1 << ArgNo
)) == 0) continue;
147 if (SemaBuiltinConstantArg(TheCall
, ArgNo
, Result
))
149 ICEArguments
&= ~(1 << ArgNo
);
153 case Builtin::BI__builtin___CFStringMakeConstantString
:
154 assert(TheCall
->getNumArgs() == 1 &&
155 "Wrong # arguments to builtin CFStringMakeConstantString");
156 if (CheckObjCString(TheCall
->getArg(0)))
159 case Builtin::BI__builtin_stdarg_start
:
160 case Builtin::BI__builtin_va_start
:
161 if (SemaBuiltinVAStart(TheCall
))
164 case Builtin::BI__builtin_isgreater
:
165 case Builtin::BI__builtin_isgreaterequal
:
166 case Builtin::BI__builtin_isless
:
167 case Builtin::BI__builtin_islessequal
:
168 case Builtin::BI__builtin_islessgreater
:
169 case Builtin::BI__builtin_isunordered
:
170 if (SemaBuiltinUnorderedCompare(TheCall
))
173 case Builtin::BI__builtin_fpclassify
:
174 if (SemaBuiltinFPClassification(TheCall
, 6))
177 case Builtin::BI__builtin_isfinite
:
178 case Builtin::BI__builtin_isinf
:
179 case Builtin::BI__builtin_isinf_sign
:
180 case Builtin::BI__builtin_isnan
:
181 case Builtin::BI__builtin_isnormal
:
182 if (SemaBuiltinFPClassification(TheCall
, 1))
185 case Builtin::BI__builtin_shufflevector
:
186 return SemaBuiltinShuffleVector(TheCall
);
187 // TheCall will be freed by the smart pointer here, but that's fine, since
188 // SemaBuiltinShuffleVector guts it, but then doesn't release it.
189 case Builtin::BI__builtin_prefetch
:
190 if (SemaBuiltinPrefetch(TheCall
))
193 case Builtin::BI__builtin_object_size
:
194 if (SemaBuiltinObjectSize(TheCall
))
197 case Builtin::BI__builtin_longjmp
:
198 if (SemaBuiltinLongjmp(TheCall
))
201 case Builtin::BI__sync_fetch_and_add
:
202 case Builtin::BI__sync_fetch_and_sub
:
203 case Builtin::BI__sync_fetch_and_or
:
204 case Builtin::BI__sync_fetch_and_and
:
205 case Builtin::BI__sync_fetch_and_xor
:
206 case Builtin::BI__sync_add_and_fetch
:
207 case Builtin::BI__sync_sub_and_fetch
:
208 case Builtin::BI__sync_and_and_fetch
:
209 case Builtin::BI__sync_or_and_fetch
:
210 case Builtin::BI__sync_xor_and_fetch
:
211 case Builtin::BI__sync_val_compare_and_swap
:
212 case Builtin::BI__sync_bool_compare_and_swap
:
213 case Builtin::BI__sync_lock_test_and_set
:
214 case Builtin::BI__sync_lock_release
:
215 return SemaBuiltinAtomicOverloaded(move(TheCallResult
));
218 // Since the target specific builtins for each arch overlap, only check those
219 // of the arch we are compiling for.
220 if (BuiltinID
>= Builtin::FirstTSBuiltin
) {
221 switch (Context
.Target
.getTriple().getArch()) {
222 case llvm::Triple::arm
:
223 case llvm::Triple::thumb
:
224 if (CheckARMBuiltinFunctionCall(BuiltinID
, TheCall
))
232 return move(TheCallResult
);
235 // Get the valid immediate range for the specified NEON type code.
236 static unsigned RFT(unsigned t
, bool shift
= false) {
237 bool quad
= t
& 0x10;
241 return shift
? 7 : (8 << (int)quad
) - 1;
243 return shift
? 15 : (4 << (int)quad
) - 1;
245 return shift
? 31 : (2 << (int)quad
) - 1;
247 return shift
? 63 : (1 << (int)quad
) - 1;
249 assert(!shift
&& "cannot shift float types!");
250 return (2 << (int)quad
) - 1;
252 assert(!shift
&& "cannot shift polynomial types!");
253 return (8 << (int)quad
) - 1;
255 assert(!shift
&& "cannot shift polynomial types!");
256 return (4 << (int)quad
) - 1;
258 assert(!shift
&& "cannot shift float types!");
259 return (4 << (int)quad
) - 1;
264 bool Sema::CheckARMBuiltinFunctionCall(unsigned BuiltinID
, CallExpr
*TheCall
) {
270 #define GET_NEON_OVERLOAD_CHECK
271 #include "clang/Basic/arm_neon.inc"
272 #undef GET_NEON_OVERLOAD_CHECK
275 // For NEON intrinsics which are overloaded on vector element type, validate
276 // the immediate which specifies which variant to emit.
278 unsigned ArgNo
= TheCall
->getNumArgs()-1;
279 if (SemaBuiltinConstantArg(TheCall
, ArgNo
, Result
))
282 TV
= Result
.getLimitedValue(32);
283 if ((TV
> 31) || (mask
& (1 << TV
)) == 0)
284 return Diag(TheCall
->getLocStart(), diag::err_invalid_neon_type_code
)
285 << TheCall
->getArg(ArgNo
)->getSourceRange();
288 // For NEON intrinsics which take an immediate value as part of the
289 // instruction, range check them here.
290 unsigned i
= 0, l
= 0, u
= 0;
292 default: return false;
293 case ARM::BI__builtin_arm_ssat
: i
= 1; l
= 1; u
= 31; break;
294 case ARM::BI__builtin_arm_usat
: i
= 1; u
= 31; break;
295 case ARM::BI__builtin_arm_vcvtr_f
:
296 case ARM::BI__builtin_arm_vcvtr_d
: i
= 1; u
= 1; break;
297 #define GET_NEON_IMMEDIATE_CHECK
298 #include "clang/Basic/arm_neon.inc"
299 #undef GET_NEON_IMMEDIATE_CHECK
302 // Check that the immediate argument is actually a constant.
303 if (SemaBuiltinConstantArg(TheCall
, i
, Result
))
306 // Range check against the upper/lower values for this isntruction.
307 unsigned Val
= Result
.getZExtValue();
308 if (Val
< l
|| Val
> (u
+ l
))
309 return Diag(TheCall
->getLocStart(), diag::err_argument_invalid_range
)
310 << l
<< u
+l
<< TheCall
->getArg(i
)->getSourceRange();
312 // FIXME: VFP Intrinsics should error if VFP not present.
316 /// CheckFunctionCall - Check a direct function call for various correctness
317 /// and safety properties not strictly enforced by the C type system.
318 bool Sema::CheckFunctionCall(FunctionDecl
*FDecl
, CallExpr
*TheCall
) {
319 // Get the IdentifierInfo* for the called function.
320 IdentifierInfo
*FnInfo
= FDecl
->getIdentifier();
322 // None of the checks below are needed for functions that don't have
323 // simple names (e.g., C++ conversion functions).
327 // FIXME: This mechanism should be abstracted to be less fragile and
328 // more efficient. For example, just map function ids to custom
331 // Printf and scanf checking.
332 for (specific_attr_iterator
<FormatAttr
>
333 i
= FDecl
->specific_attr_begin
<FormatAttr
>(),
334 e
= FDecl
->specific_attr_end
<FormatAttr
>(); i
!= e
; ++i
) {
336 const FormatAttr
*Format
= *i
;
337 const bool b
= Format
->getType() == "scanf";
338 if (b
|| CheckablePrintfAttr(Format
, TheCall
)) {
339 bool HasVAListArg
= Format
->getFirstArg() == 0;
340 CheckPrintfScanfArguments(TheCall
, HasVAListArg
,
341 Format
->getFormatIdx() - 1,
342 HasVAListArg
? 0 : Format
->getFirstArg() - 1,
347 for (specific_attr_iterator
<NonNullAttr
>
348 i
= FDecl
->specific_attr_begin
<NonNullAttr
>(),
349 e
= FDecl
->specific_attr_end
<NonNullAttr
>(); i
!= e
; ++i
) {
350 CheckNonNullArguments(*i
, TheCall
);
356 bool Sema::CheckBlockCall(NamedDecl
*NDecl
, CallExpr
*TheCall
) {
358 const FormatAttr
*Format
= NDecl
->getAttr
<FormatAttr
>();
362 const VarDecl
*V
= dyn_cast
<VarDecl
>(NDecl
);
366 QualType Ty
= V
->getType();
367 if (!Ty
->isBlockPointerType())
370 const bool b
= Format
->getType() == "scanf";
371 if (!b
&& !CheckablePrintfAttr(Format
, TheCall
))
374 bool HasVAListArg
= Format
->getFirstArg() == 0;
375 CheckPrintfScanfArguments(TheCall
, HasVAListArg
, Format
->getFormatIdx() - 1,
376 HasVAListArg
? 0 : Format
->getFirstArg() - 1, !b
);
381 /// SemaBuiltinAtomicOverloaded - We have a call to a function like
382 /// __sync_fetch_and_add, which is an overloaded function based on the pointer
383 /// type of its first argument. The main ActOnCallExpr routines have already
384 /// promoted the types of arguments because all of these calls are prototyped as
387 /// This function goes through and does final semantic checking for these
390 Sema::SemaBuiltinAtomicOverloaded(ExprResult TheCallResult
) {
391 CallExpr
*TheCall
= (CallExpr
*)TheCallResult
.get();
392 DeclRefExpr
*DRE
=cast
<DeclRefExpr
>(TheCall
->getCallee()->IgnoreParenCasts());
393 FunctionDecl
*FDecl
= cast
<FunctionDecl
>(DRE
->getDecl());
395 // Ensure that we have at least one argument to do type inference from.
396 if (TheCall
->getNumArgs() < 1) {
397 Diag(TheCall
->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least
)
398 << 0 << 1 << TheCall
->getNumArgs()
399 << TheCall
->getCallee()->getSourceRange();
403 // Inspect the first argument of the atomic builtin. This should always be
404 // a pointer type, whose element is an integral scalar or pointer type.
405 // Because it is a pointer type, we don't have to worry about any implicit
407 // FIXME: We don't allow floating point scalars as input.
408 Expr
*FirstArg
= TheCall
->getArg(0);
409 if (!FirstArg
->getType()->isPointerType()) {
410 Diag(DRE
->getLocStart(), diag::err_atomic_builtin_must_be_pointer
)
411 << FirstArg
->getType() << FirstArg
->getSourceRange();
416 FirstArg
->getType()->getAs
<PointerType
>()->getPointeeType();
417 if (!ValType
->isIntegerType() && !ValType
->isAnyPointerType() &&
418 !ValType
->isBlockPointerType()) {
419 Diag(DRE
->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intptr
)
420 << FirstArg
->getType() << FirstArg
->getSourceRange();
424 // The majority of builtins return a value, but a few have special return
425 // types, so allow them to override appropriately below.
426 QualType ResultType
= ValType
;
428 // We need to figure out which concrete builtin this maps onto. For example,
429 // __sync_fetch_and_add with a 2 byte object turns into
430 // __sync_fetch_and_add_2.
431 #define BUILTIN_ROW(x) \
432 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
433 Builtin::BI##x##_8, Builtin::BI##x##_16 }
435 static const unsigned BuiltinIndices
[][5] = {
436 BUILTIN_ROW(__sync_fetch_and_add
),
437 BUILTIN_ROW(__sync_fetch_and_sub
),
438 BUILTIN_ROW(__sync_fetch_and_or
),
439 BUILTIN_ROW(__sync_fetch_and_and
),
440 BUILTIN_ROW(__sync_fetch_and_xor
),
442 BUILTIN_ROW(__sync_add_and_fetch
),
443 BUILTIN_ROW(__sync_sub_and_fetch
),
444 BUILTIN_ROW(__sync_and_and_fetch
),
445 BUILTIN_ROW(__sync_or_and_fetch
),
446 BUILTIN_ROW(__sync_xor_and_fetch
),
448 BUILTIN_ROW(__sync_val_compare_and_swap
),
449 BUILTIN_ROW(__sync_bool_compare_and_swap
),
450 BUILTIN_ROW(__sync_lock_test_and_set
),
451 BUILTIN_ROW(__sync_lock_release
)
455 // Determine the index of the size.
457 switch (Context
.getTypeSizeInChars(ValType
).getQuantity()) {
458 case 1: SizeIndex
= 0; break;
459 case 2: SizeIndex
= 1; break;
460 case 4: SizeIndex
= 2; break;
461 case 8: SizeIndex
= 3; break;
462 case 16: SizeIndex
= 4; break;
464 Diag(DRE
->getLocStart(), diag::err_atomic_builtin_pointer_size
)
465 << FirstArg
->getType() << FirstArg
->getSourceRange();
469 // Each of these builtins has one pointer argument, followed by some number of
470 // values (0, 1 or 2) followed by a potentially empty varags list of stuff
471 // that we ignore. Find out which row of BuiltinIndices to read from as well
472 // as the number of fixed args.
473 unsigned BuiltinID
= FDecl
->getBuiltinID();
474 unsigned BuiltinIndex
, NumFixed
= 1;
476 default: assert(0 && "Unknown overloaded atomic builtin!");
477 case Builtin::BI__sync_fetch_and_add
: BuiltinIndex
= 0; break;
478 case Builtin::BI__sync_fetch_and_sub
: BuiltinIndex
= 1; break;
479 case Builtin::BI__sync_fetch_and_or
: BuiltinIndex
= 2; break;
480 case Builtin::BI__sync_fetch_and_and
: BuiltinIndex
= 3; break;
481 case Builtin::BI__sync_fetch_and_xor
: BuiltinIndex
= 4; break;
483 case Builtin::BI__sync_add_and_fetch
: BuiltinIndex
= 5; break;
484 case Builtin::BI__sync_sub_and_fetch
: BuiltinIndex
= 6; break;
485 case Builtin::BI__sync_and_and_fetch
: BuiltinIndex
= 7; break;
486 case Builtin::BI__sync_or_and_fetch
: BuiltinIndex
= 8; break;
487 case Builtin::BI__sync_xor_and_fetch
: BuiltinIndex
= 9; break;
489 case Builtin::BI__sync_val_compare_and_swap
:
493 case Builtin::BI__sync_bool_compare_and_swap
:
496 ResultType
= Context
.BoolTy
;
498 case Builtin::BI__sync_lock_test_and_set
: BuiltinIndex
= 12; break;
499 case Builtin::BI__sync_lock_release
:
502 ResultType
= Context
.VoidTy
;
506 // Now that we know how many fixed arguments we expect, first check that we
507 // have at least that many.
508 if (TheCall
->getNumArgs() < 1+NumFixed
) {
509 Diag(TheCall
->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least
)
510 << 0 << 1+NumFixed
<< TheCall
->getNumArgs()
511 << TheCall
->getCallee()->getSourceRange();
515 // Get the decl for the concrete builtin from this, we can tell what the
516 // concrete integer type we should convert to is.
517 unsigned NewBuiltinID
= BuiltinIndices
[BuiltinIndex
][SizeIndex
];
518 const char *NewBuiltinName
= Context
.BuiltinInfo
.GetName(NewBuiltinID
);
519 IdentifierInfo
*NewBuiltinII
= PP
.getIdentifierInfo(NewBuiltinName
);
520 FunctionDecl
*NewBuiltinDecl
=
521 cast
<FunctionDecl
>(LazilyCreateBuiltin(NewBuiltinII
, NewBuiltinID
,
522 TUScope
, false, DRE
->getLocStart()));
524 // The first argument --- the pointer --- has a fixed type; we
525 // deduce the types of the rest of the arguments accordingly. Walk
526 // the remaining arguments, converting them to the deduced value type.
527 for (unsigned i
= 0; i
!= NumFixed
; ++i
) {
528 Expr
*Arg
= TheCall
->getArg(i
+1);
530 // If the argument is an implicit cast, then there was a promotion due to
531 // "...", just remove it now.
532 if (ImplicitCastExpr
*ICE
= dyn_cast
<ImplicitCastExpr
>(Arg
)) {
533 Arg
= ICE
->getSubExpr();
535 TheCall
->setArg(i
+1, Arg
);
538 // GCC does an implicit conversion to the pointer or integer ValType. This
539 // can fail in some cases (1i -> int**), check for this error case now.
540 CastKind Kind
= CK_Unknown
;
541 CXXCastPath BasePath
;
542 if (CheckCastTypes(Arg
->getSourceRange(), ValType
, Arg
, Kind
, BasePath
))
545 // Okay, we have something that *can* be converted to the right type. Check
546 // to see if there is a potentially weird extension going on here. This can
547 // happen when you do an atomic operation on something like an char* and
548 // pass in 42. The 42 gets converted to char. This is even more strange
549 // for things like 45.123 -> char, etc.
550 // FIXME: Do this check.
551 ImpCastExprToType(Arg
, ValType
, Kind
, VK_RValue
, &BasePath
);
552 TheCall
->setArg(i
+1, Arg
);
555 // Switch the DeclRefExpr to refer to the new decl.
556 DRE
->setDecl(NewBuiltinDecl
);
557 DRE
->setType(NewBuiltinDecl
->getType());
559 // Set the callee in the CallExpr.
560 // FIXME: This leaks the original parens and implicit casts.
561 Expr
*PromotedCall
= DRE
;
562 UsualUnaryConversions(PromotedCall
);
563 TheCall
->setCallee(PromotedCall
);
565 // Change the result type of the call to match the original value type. This
566 // is arbitrary, but the codegen for these builtins ins design to handle it
568 TheCall
->setType(ResultType
);
570 return move(TheCallResult
);
574 /// CheckObjCString - Checks that the argument to the builtin
575 /// CFString constructor is correct
576 /// Note: It might also make sense to do the UTF-16 conversion here (would
577 /// simplify the backend).
578 bool Sema::CheckObjCString(Expr
*Arg
) {
579 Arg
= Arg
->IgnoreParenCasts();
580 StringLiteral
*Literal
= dyn_cast
<StringLiteral
>(Arg
);
582 if (!Literal
|| Literal
->isWide()) {
583 Diag(Arg
->getLocStart(), diag::err_cfstring_literal_not_string_constant
)
584 << Arg
->getSourceRange();
588 size_t NulPos
= Literal
->getString().find('\0');
589 if (NulPos
!= llvm::StringRef::npos
) {
590 Diag(getLocationOfStringLiteralByte(Literal
, NulPos
),
591 diag::warn_cfstring_literal_contains_nul_character
)
592 << Arg
->getSourceRange();
594 if (Literal
->containsNonAsciiOrNull()) {
595 llvm::StringRef String
= Literal
->getString();
596 unsigned NumBytes
= String
.size();
597 llvm::SmallVector
<UTF16
, 128> ToBuf(NumBytes
);
598 const UTF8
*FromPtr
= (UTF8
*)String
.data();
599 UTF16
*ToPtr
= &ToBuf
[0];
601 ConversionResult Result
= ConvertUTF8toUTF16(&FromPtr
, FromPtr
+ NumBytes
,
602 &ToPtr
, ToPtr
+ NumBytes
,
604 // Check for conversion failure.
605 if (Result
!= conversionOK
)
606 Diag(Arg
->getLocStart(),
607 diag::warn_cfstring_truncated
) << Arg
->getSourceRange();
612 /// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
613 /// Emit an error and return true on failure, return false on success.
614 bool Sema::SemaBuiltinVAStart(CallExpr
*TheCall
) {
615 Expr
*Fn
= TheCall
->getCallee();
616 if (TheCall
->getNumArgs() > 2) {
617 Diag(TheCall
->getArg(2)->getLocStart(),
618 diag::err_typecheck_call_too_many_args
)
619 << 0 /*function call*/ << 2 << TheCall
->getNumArgs()
620 << Fn
->getSourceRange()
621 << SourceRange(TheCall
->getArg(2)->getLocStart(),
622 (*(TheCall
->arg_end()-1))->getLocEnd());
626 if (TheCall
->getNumArgs() < 2) {
627 return Diag(TheCall
->getLocEnd(),
628 diag::err_typecheck_call_too_few_args_at_least
)
629 << 0 /*function call*/ << 2 << TheCall
->getNumArgs();
632 // Determine whether the current function is variadic or not.
633 BlockScopeInfo
*CurBlock
= getCurBlock();
636 isVariadic
= CurBlock
->TheDecl
->isVariadic();
637 else if (FunctionDecl
*FD
= getCurFunctionDecl())
638 isVariadic
= FD
->isVariadic();
640 isVariadic
= getCurMethodDecl()->isVariadic();
643 Diag(Fn
->getLocStart(), diag::err_va_start_used_in_non_variadic_function
);
647 // Verify that the second argument to the builtin is the last argument of the
648 // current function or method.
649 bool SecondArgIsLastNamedArgument
= false;
650 const Expr
*Arg
= TheCall
->getArg(1)->IgnoreParenCasts();
652 if (const DeclRefExpr
*DR
= dyn_cast
<DeclRefExpr
>(Arg
)) {
653 if (const ParmVarDecl
*PV
= dyn_cast
<ParmVarDecl
>(DR
->getDecl())) {
654 // FIXME: This isn't correct for methods (results in bogus warning).
655 // Get the last formal in the current function.
656 const ParmVarDecl
*LastArg
;
658 LastArg
= *(CurBlock
->TheDecl
->param_end()-1);
659 else if (FunctionDecl
*FD
= getCurFunctionDecl())
660 LastArg
= *(FD
->param_end()-1);
662 LastArg
= *(getCurMethodDecl()->param_end()-1);
663 SecondArgIsLastNamedArgument
= PV
== LastArg
;
667 if (!SecondArgIsLastNamedArgument
)
668 Diag(TheCall
->getArg(1)->getLocStart(),
669 diag::warn_second_parameter_of_va_start_not_last_named_argument
);
673 /// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
674 /// friends. This is declared to take (...), so we have to check everything.
675 bool Sema::SemaBuiltinUnorderedCompare(CallExpr
*TheCall
) {
676 if (TheCall
->getNumArgs() < 2)
677 return Diag(TheCall
->getLocEnd(), diag::err_typecheck_call_too_few_args
)
678 << 0 << 2 << TheCall
->getNumArgs()/*function call*/;
679 if (TheCall
->getNumArgs() > 2)
680 return Diag(TheCall
->getArg(2)->getLocStart(),
681 diag::err_typecheck_call_too_many_args
)
682 << 0 /*function call*/ << 2 << TheCall
->getNumArgs()
683 << SourceRange(TheCall
->getArg(2)->getLocStart(),
684 (*(TheCall
->arg_end()-1))->getLocEnd());
686 Expr
*OrigArg0
= TheCall
->getArg(0);
687 Expr
*OrigArg1
= TheCall
->getArg(1);
689 // Do standard promotions between the two arguments, returning their common
691 QualType Res
= UsualArithmeticConversions(OrigArg0
, OrigArg1
, false);
693 // Make sure any conversions are pushed back into the call; this is
694 // type safe since unordered compare builtins are declared as "_Bool
696 TheCall
->setArg(0, OrigArg0
);
697 TheCall
->setArg(1, OrigArg1
);
699 if (OrigArg0
->isTypeDependent() || OrigArg1
->isTypeDependent())
702 // If the common type isn't a real floating type, then the arguments were
703 // invalid for this operation.
704 if (!Res
->isRealFloatingType())
705 return Diag(OrigArg0
->getLocStart(),
706 diag::err_typecheck_call_invalid_ordered_compare
)
707 << OrigArg0
->getType() << OrigArg1
->getType()
708 << SourceRange(OrigArg0
->getLocStart(), OrigArg1
->getLocEnd());
713 /// SemaBuiltinSemaBuiltinFPClassification - Handle functions like
714 /// __builtin_isnan and friends. This is declared to take (...), so we have
715 /// to check everything. We expect the last argument to be a floating point
717 bool Sema::SemaBuiltinFPClassification(CallExpr
*TheCall
, unsigned NumArgs
) {
718 if (TheCall
->getNumArgs() < NumArgs
)
719 return Diag(TheCall
->getLocEnd(), diag::err_typecheck_call_too_few_args
)
720 << 0 << NumArgs
<< TheCall
->getNumArgs()/*function call*/;
721 if (TheCall
->getNumArgs() > NumArgs
)
722 return Diag(TheCall
->getArg(NumArgs
)->getLocStart(),
723 diag::err_typecheck_call_too_many_args
)
724 << 0 /*function call*/ << NumArgs
<< TheCall
->getNumArgs()
725 << SourceRange(TheCall
->getArg(NumArgs
)->getLocStart(),
726 (*(TheCall
->arg_end()-1))->getLocEnd());
728 Expr
*OrigArg
= TheCall
->getArg(NumArgs
-1);
730 if (OrigArg
->isTypeDependent())
733 // This operation requires a non-_Complex floating-point number.
734 if (!OrigArg
->getType()->isRealFloatingType())
735 return Diag(OrigArg
->getLocStart(),
736 diag::err_typecheck_call_invalid_unary_fp
)
737 << OrigArg
->getType() << OrigArg
->getSourceRange();
739 // If this is an implicit conversion from float -> double, remove it.
740 if (ImplicitCastExpr
*Cast
= dyn_cast
<ImplicitCastExpr
>(OrigArg
)) {
741 Expr
*CastArg
= Cast
->getSubExpr();
742 if (CastArg
->getType()->isSpecificBuiltinType(BuiltinType::Float
)) {
743 assert(Cast
->getType()->isSpecificBuiltinType(BuiltinType::Double
) &&
744 "promotion from float to double is the only expected cast here");
746 TheCall
->setArg(NumArgs
-1, CastArg
);
754 /// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
755 // This is declared to take (...), so we have to check everything.
756 ExprResult
Sema::SemaBuiltinShuffleVector(CallExpr
*TheCall
) {
757 if (TheCall
->getNumArgs() < 2)
758 return ExprError(Diag(TheCall
->getLocEnd(),
759 diag::err_typecheck_call_too_few_args_at_least
)
760 << 0 /*function call*/ << 2 << TheCall
->getNumArgs()
761 << TheCall
->getSourceRange());
763 // Determine which of the following types of shufflevector we're checking:
764 // 1) unary, vector mask: (lhs, mask)
765 // 2) binary, vector mask: (lhs, rhs, mask)
766 // 3) binary, scalar mask: (lhs, rhs, index, ..., index)
767 QualType resType
= TheCall
->getArg(0)->getType();
768 unsigned numElements
= 0;
770 if (!TheCall
->getArg(0)->isTypeDependent() &&
771 !TheCall
->getArg(1)->isTypeDependent()) {
772 QualType LHSType
= TheCall
->getArg(0)->getType();
773 QualType RHSType
= TheCall
->getArg(1)->getType();
775 if (!LHSType
->isVectorType() || !RHSType
->isVectorType()) {
776 Diag(TheCall
->getLocStart(), diag::err_shufflevector_non_vector
)
777 << SourceRange(TheCall
->getArg(0)->getLocStart(),
778 TheCall
->getArg(1)->getLocEnd());
782 numElements
= LHSType
->getAs
<VectorType
>()->getNumElements();
783 unsigned numResElements
= TheCall
->getNumArgs() - 2;
785 // Check to see if we have a call with 2 vector arguments, the unary shuffle
786 // with mask. If so, verify that RHS is an integer vector type with the
787 // same number of elts as lhs.
788 if (TheCall
->getNumArgs() == 2) {
789 if (!RHSType
->hasIntegerRepresentation() ||
790 RHSType
->getAs
<VectorType
>()->getNumElements() != numElements
)
791 Diag(TheCall
->getLocStart(), diag::err_shufflevector_incompatible_vector
)
792 << SourceRange(TheCall
->getArg(1)->getLocStart(),
793 TheCall
->getArg(1)->getLocEnd());
794 numResElements
= numElements
;
796 else if (!Context
.hasSameUnqualifiedType(LHSType
, RHSType
)) {
797 Diag(TheCall
->getLocStart(), diag::err_shufflevector_incompatible_vector
)
798 << SourceRange(TheCall
->getArg(0)->getLocStart(),
799 TheCall
->getArg(1)->getLocEnd());
801 } else if (numElements
!= numResElements
) {
802 QualType eltType
= LHSType
->getAs
<VectorType
>()->getElementType();
803 resType
= Context
.getVectorType(eltType
, numResElements
,
804 VectorType::NotAltiVec
);
808 for (unsigned i
= 2; i
< TheCall
->getNumArgs(); i
++) {
809 if (TheCall
->getArg(i
)->isTypeDependent() ||
810 TheCall
->getArg(i
)->isValueDependent())
813 llvm::APSInt
Result(32);
814 if (!TheCall
->getArg(i
)->isIntegerConstantExpr(Result
, Context
))
815 return ExprError(Diag(TheCall
->getLocStart(),
816 diag::err_shufflevector_nonconstant_argument
)
817 << TheCall
->getArg(i
)->getSourceRange());
819 if (Result
.getActiveBits() > 64 || Result
.getZExtValue() >= numElements
*2)
820 return ExprError(Diag(TheCall
->getLocStart(),
821 diag::err_shufflevector_argument_too_large
)
822 << TheCall
->getArg(i
)->getSourceRange());
825 llvm::SmallVector
<Expr
*, 32> exprs
;
827 for (unsigned i
= 0, e
= TheCall
->getNumArgs(); i
!= e
; i
++) {
828 exprs
.push_back(TheCall
->getArg(i
));
829 TheCall
->setArg(i
, 0);
832 return Owned(new (Context
) ShuffleVectorExpr(Context
, exprs
.begin(),
833 exprs
.size(), resType
,
834 TheCall
->getCallee()->getLocStart(),
835 TheCall
->getRParenLoc()));
838 /// SemaBuiltinPrefetch - Handle __builtin_prefetch.
839 // This is declared to take (const void*, ...) and can take two
840 // optional constant int args.
841 bool Sema::SemaBuiltinPrefetch(CallExpr
*TheCall
) {
842 unsigned NumArgs
= TheCall
->getNumArgs();
845 return Diag(TheCall
->getLocEnd(),
846 diag::err_typecheck_call_too_many_args_at_most
)
847 << 0 /*function call*/ << 3 << NumArgs
848 << TheCall
->getSourceRange();
850 // Argument 0 is checked for us and the remaining arguments must be
851 // constant integers.
852 for (unsigned i
= 1; i
!= NumArgs
; ++i
) {
853 Expr
*Arg
= TheCall
->getArg(i
);
856 if (SemaBuiltinConstantArg(TheCall
, i
, Result
))
859 // FIXME: gcc issues a warning and rewrites these to 0. These
860 // seems especially odd for the third argument since the default
863 if (Result
.getLimitedValue() > 1)
864 return Diag(TheCall
->getLocStart(), diag::err_argument_invalid_range
)
865 << "0" << "1" << Arg
->getSourceRange();
867 if (Result
.getLimitedValue() > 3)
868 return Diag(TheCall
->getLocStart(), diag::err_argument_invalid_range
)
869 << "0" << "3" << Arg
->getSourceRange();
876 /// SemaBuiltinConstantArg - Handle a check if argument ArgNum of CallExpr
877 /// TheCall is a constant expression.
878 bool Sema::SemaBuiltinConstantArg(CallExpr
*TheCall
, int ArgNum
,
879 llvm::APSInt
&Result
) {
880 Expr
*Arg
= TheCall
->getArg(ArgNum
);
881 DeclRefExpr
*DRE
=cast
<DeclRefExpr
>(TheCall
->getCallee()->IgnoreParenCasts());
882 FunctionDecl
*FDecl
= cast
<FunctionDecl
>(DRE
->getDecl());
884 if (Arg
->isTypeDependent() || Arg
->isValueDependent()) return false;
886 if (!Arg
->isIntegerConstantExpr(Result
, Context
))
887 return Diag(TheCall
->getLocStart(), diag::err_constant_integer_arg_type
)
888 << FDecl
->getDeclName() << Arg
->getSourceRange();
893 /// SemaBuiltinObjectSize - Handle __builtin_object_size(void *ptr,
894 /// int type). This simply type checks that type is one of the defined
896 // For compatability check 0-3, llvm only handles 0 and 2.
897 bool Sema::SemaBuiltinObjectSize(CallExpr
*TheCall
) {
900 // Check constant-ness first.
901 if (SemaBuiltinConstantArg(TheCall
, 1, Result
))
904 Expr
*Arg
= TheCall
->getArg(1);
905 if (Result
.getSExtValue() < 0 || Result
.getSExtValue() > 3) {
906 return Diag(TheCall
->getLocStart(), diag::err_argument_invalid_range
)
907 << "0" << "3" << SourceRange(Arg
->getLocStart(), Arg
->getLocEnd());
913 /// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
914 /// This checks that val is a constant 1.
915 bool Sema::SemaBuiltinLongjmp(CallExpr
*TheCall
) {
916 Expr
*Arg
= TheCall
->getArg(1);
919 // TODO: This is less than ideal. Overload this to take a value.
920 if (SemaBuiltinConstantArg(TheCall
, 1, Result
))
924 return Diag(TheCall
->getLocStart(), diag::err_builtin_longjmp_invalid_val
)
925 << SourceRange(Arg
->getLocStart(), Arg
->getLocEnd());
930 // Handle i > 1 ? "x" : "y", recursivelly
931 bool Sema::SemaCheckStringLiteral(const Expr
*E
, const CallExpr
*TheCall
,
933 unsigned format_idx
, unsigned firstDataArg
,
936 if (E
->isTypeDependent() || E
->isValueDependent())
939 switch (E
->getStmtClass()) {
940 case Stmt::ConditionalOperatorClass
: {
941 const ConditionalOperator
*C
= cast
<ConditionalOperator
>(E
);
942 return SemaCheckStringLiteral(C
->getTrueExpr(), TheCall
, HasVAListArg
,
943 format_idx
, firstDataArg
, isPrintf
)
944 && SemaCheckStringLiteral(C
->getRHS(), TheCall
, HasVAListArg
,
945 format_idx
, firstDataArg
, isPrintf
);
948 case Stmt::IntegerLiteralClass
:
949 // Technically -Wformat-nonliteral does not warn about this case.
950 // The behavior of printf and friends in this case is implementation
951 // dependent. Ideally if the format string cannot be null then
952 // it should have a 'nonnull' attribute in the function prototype.
955 case Stmt::ImplicitCastExprClass
: {
956 E
= cast
<ImplicitCastExpr
>(E
)->getSubExpr();
960 case Stmt::ParenExprClass
: {
961 E
= cast
<ParenExpr
>(E
)->getSubExpr();
965 case Stmt::DeclRefExprClass
: {
966 const DeclRefExpr
*DR
= cast
<DeclRefExpr
>(E
);
968 // As an exception, do not flag errors for variables binding to
969 // const string literals.
970 if (const VarDecl
*VD
= dyn_cast
<VarDecl
>(DR
->getDecl())) {
971 bool isConstant
= false;
972 QualType T
= DR
->getType();
974 if (const ArrayType
*AT
= Context
.getAsArrayType(T
)) {
975 isConstant
= AT
->getElementType().isConstant(Context
);
976 } else if (const PointerType
*PT
= T
->getAs
<PointerType
>()) {
977 isConstant
= T
.isConstant(Context
) &&
978 PT
->getPointeeType().isConstant(Context
);
982 if (const Expr
*Init
= VD
->getAnyInitializer())
983 return SemaCheckStringLiteral(Init
, TheCall
,
984 HasVAListArg
, format_idx
, firstDataArg
,
988 // For vprintf* functions (i.e., HasVAListArg==true), we add a
989 // special check to see if the format string is a function parameter
990 // of the function calling the printf function. If the function
991 // has an attribute indicating it is a printf-like function, then we
992 // should suppress warnings concerning non-literals being used in a call
993 // to a vprintf function. For example:
996 // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
998 // va_start(ap, fmt);
999 // vprintf(fmt, ap); // Do NOT emit a warning about "fmt".
1003 // FIXME: We don't have full attribute support yet, so just check to see
1004 // if the argument is a DeclRefExpr that references a parameter. We'll
1005 // add proper support for checking the attribute later.
1007 if (isa
<ParmVarDecl
>(VD
))
1014 case Stmt::CallExprClass
: {
1015 const CallExpr
*CE
= cast
<CallExpr
>(E
);
1016 if (const ImplicitCastExpr
*ICE
1017 = dyn_cast
<ImplicitCastExpr
>(CE
->getCallee())) {
1018 if (const DeclRefExpr
*DRE
= dyn_cast
<DeclRefExpr
>(ICE
->getSubExpr())) {
1019 if (const FunctionDecl
*FD
= dyn_cast
<FunctionDecl
>(DRE
->getDecl())) {
1020 if (const FormatArgAttr
*FA
= FD
->getAttr
<FormatArgAttr
>()) {
1021 unsigned ArgIndex
= FA
->getFormatIdx();
1022 const Expr
*Arg
= CE
->getArg(ArgIndex
- 1);
1024 return SemaCheckStringLiteral(Arg
, TheCall
, HasVAListArg
,
1025 format_idx
, firstDataArg
, isPrintf
);
1033 case Stmt::ObjCStringLiteralClass
:
1034 case Stmt::StringLiteralClass
: {
1035 const StringLiteral
*StrE
= NULL
;
1037 if (const ObjCStringLiteral
*ObjCFExpr
= dyn_cast
<ObjCStringLiteral
>(E
))
1038 StrE
= ObjCFExpr
->getString();
1040 StrE
= cast
<StringLiteral
>(E
);
1043 CheckFormatString(StrE
, E
, TheCall
, HasVAListArg
, format_idx
,
1044 firstDataArg
, isPrintf
);
1057 Sema::CheckNonNullArguments(const NonNullAttr
*NonNull
,
1058 const CallExpr
*TheCall
) {
1059 for (NonNullAttr::args_iterator i
= NonNull
->args_begin(),
1060 e
= NonNull
->args_end();
1062 const Expr
*ArgExpr
= TheCall
->getArg(*i
);
1063 if (ArgExpr
->isNullPointerConstant(Context
,
1064 Expr::NPC_ValueDependentIsNotNull
))
1065 Diag(TheCall
->getCallee()->getLocStart(), diag::warn_null_arg
)
1066 << ArgExpr
->getSourceRange();
1070 /// CheckPrintfScanfArguments - Check calls to printf and scanf (and similar
1071 /// functions) for correct use of format strings.
1073 Sema::CheckPrintfScanfArguments(const CallExpr
*TheCall
, bool HasVAListArg
,
1074 unsigned format_idx
, unsigned firstDataArg
,
1077 const Expr
*Fn
= TheCall
->getCallee();
1079 // The way the format attribute works in GCC, the implicit this argument
1080 // of member functions is counted. However, it doesn't appear in our own
1081 // lists, so decrement format_idx in that case.
1082 if (isa
<CXXMemberCallExpr
>(TheCall
)) {
1083 // Catch a format attribute mistakenly referring to the object argument.
1084 if (format_idx
== 0)
1087 if(firstDataArg
!= 0)
1091 // CHECK: printf/scanf-like function is called with no format string.
1092 if (format_idx
>= TheCall
->getNumArgs()) {
1093 Diag(TheCall
->getRParenLoc(), diag::warn_missing_format_string
)
1094 << Fn
->getSourceRange();
1098 const Expr
*OrigFormatExpr
= TheCall
->getArg(format_idx
)->IgnoreParenCasts();
1100 // CHECK: format string is not a string literal.
1102 // Dynamically generated format strings are difficult to
1103 // automatically vet at compile time. Requiring that format strings
1104 // are string literals: (1) permits the checking of format strings by
1105 // the compiler and thereby (2) can practically remove the source of
1106 // many format string exploits.
1108 // Format string can be either ObjC string (e.g. @"%d") or
1109 // C string (e.g. "%d")
1110 // ObjC string uses the same format specifiers as C string, so we can use
1111 // the same format string checking logic for both ObjC and C strings.
1112 if (SemaCheckStringLiteral(OrigFormatExpr
, TheCall
, HasVAListArg
, format_idx
,
1113 firstDataArg
, isPrintf
))
1114 return; // Literal format string found, check done!
1116 // If there are no arguments specified, warn with -Wformat-security, otherwise
1117 // warn only with -Wformat-nonliteral.
1118 if (TheCall
->getNumArgs() == format_idx
+1)
1119 Diag(TheCall
->getArg(format_idx
)->getLocStart(),
1120 diag::warn_format_nonliteral_noargs
)
1121 << OrigFormatExpr
->getSourceRange();
1123 Diag(TheCall
->getArg(format_idx
)->getLocStart(),
1124 diag::warn_format_nonliteral
)
1125 << OrigFormatExpr
->getSourceRange();
1129 class CheckFormatHandler
: public analyze_format_string::FormatStringHandler
{
1132 const StringLiteral
*FExpr
;
1133 const Expr
*OrigFormatExpr
;
1134 const unsigned FirstDataArg
;
1135 const unsigned NumDataArgs
;
1136 const bool IsObjCLiteral
;
1137 const char *Beg
; // Start of format string.
1138 const bool HasVAListArg
;
1139 const CallExpr
*TheCall
;
1141 llvm::BitVector CoveredArgs
;
1142 bool usesPositionalArgs
;
1145 CheckFormatHandler(Sema
&s
, const StringLiteral
*fexpr
,
1146 const Expr
*origFormatExpr
, unsigned firstDataArg
,
1147 unsigned numDataArgs
, bool isObjCLiteral
,
1148 const char *beg
, bool hasVAListArg
,
1149 const CallExpr
*theCall
, unsigned formatIdx
)
1150 : S(s
), FExpr(fexpr
), OrigFormatExpr(origFormatExpr
),
1151 FirstDataArg(firstDataArg
),
1152 NumDataArgs(numDataArgs
),
1153 IsObjCLiteral(isObjCLiteral
), Beg(beg
),
1154 HasVAListArg(hasVAListArg
),
1155 TheCall(theCall
), FormatIdx(formatIdx
),
1156 usesPositionalArgs(false), atFirstArg(true) {
1157 CoveredArgs
.resize(numDataArgs
);
1158 CoveredArgs
.reset();
1161 void DoneProcessing();
1163 void HandleIncompleteSpecifier(const char *startSpecifier
,
1164 unsigned specifierLen
);
1166 virtual void HandleInvalidPosition(const char *startSpecifier
,
1167 unsigned specifierLen
,
1168 analyze_format_string::PositionContext p
);
1170 virtual void HandleZeroPosition(const char *startPos
, unsigned posLen
);
1172 void HandleNullChar(const char *nullCharacter
);
1175 bool HandleInvalidConversionSpecifier(unsigned argIndex
, SourceLocation Loc
,
1176 const char *startSpec
,
1177 unsigned specifierLen
,
1178 const char *csStart
, unsigned csLen
);
1180 SourceRange
getFormatStringRange();
1181 CharSourceRange
getSpecifierRange(const char *startSpecifier
,
1182 unsigned specifierLen
);
1183 SourceLocation
getLocationOfByte(const char *x
);
1185 const Expr
*getDataArg(unsigned i
) const;
1187 bool CheckNumArgs(const analyze_format_string::FormatSpecifier
&FS
,
1188 const analyze_format_string::ConversionSpecifier
&CS
,
1189 const char *startSpecifier
, unsigned specifierLen
,
1194 SourceRange
CheckFormatHandler::getFormatStringRange() {
1195 return OrigFormatExpr
->getSourceRange();
1198 CharSourceRange
CheckFormatHandler::
1199 getSpecifierRange(const char *startSpecifier
, unsigned specifierLen
) {
1200 SourceLocation Start
= getLocationOfByte(startSpecifier
);
1201 SourceLocation End
= getLocationOfByte(startSpecifier
+ specifierLen
- 1);
1203 // Advance the end SourceLocation by one due to half-open ranges.
1204 End
= End
.getFileLocWithOffset(1);
1206 return CharSourceRange::getCharRange(Start
, End
);
1209 SourceLocation
CheckFormatHandler::getLocationOfByte(const char *x
) {
1210 return S
.getLocationOfStringLiteralByte(FExpr
, x
- Beg
);
1213 void CheckFormatHandler::HandleIncompleteSpecifier(const char *startSpecifier
,
1214 unsigned specifierLen
){
1215 SourceLocation Loc
= getLocationOfByte(startSpecifier
);
1216 S
.Diag(Loc
, diag::warn_printf_incomplete_specifier
)
1217 << getSpecifierRange(startSpecifier
, specifierLen
);
1221 CheckFormatHandler::HandleInvalidPosition(const char *startPos
, unsigned posLen
,
1222 analyze_format_string::PositionContext p
) {
1223 SourceLocation Loc
= getLocationOfByte(startPos
);
1224 S
.Diag(Loc
, diag::warn_format_invalid_positional_specifier
)
1225 << (unsigned) p
<< getSpecifierRange(startPos
, posLen
);
1228 void CheckFormatHandler::HandleZeroPosition(const char *startPos
,
1230 SourceLocation Loc
= getLocationOfByte(startPos
);
1231 S
.Diag(Loc
, diag::warn_format_zero_positional_specifier
)
1232 << getSpecifierRange(startPos
, posLen
);
1235 void CheckFormatHandler::HandleNullChar(const char *nullCharacter
) {
1236 // The presence of a null character is likely an error.
1237 S
.Diag(getLocationOfByte(nullCharacter
),
1238 diag::warn_printf_format_string_contains_null_char
)
1239 << getFormatStringRange();
1242 const Expr
*CheckFormatHandler::getDataArg(unsigned i
) const {
1243 return TheCall
->getArg(FirstDataArg
+ i
);
1246 void CheckFormatHandler::DoneProcessing() {
1247 // Does the number of data arguments exceed the number of
1248 // format conversions in the format string?
1249 if (!HasVAListArg
) {
1250 // Find any arguments that weren't covered.
1252 signed notCoveredArg
= CoveredArgs
.find_first();
1253 if (notCoveredArg
>= 0) {
1254 assert((unsigned)notCoveredArg
< NumDataArgs
);
1255 S
.Diag(getDataArg((unsigned) notCoveredArg
)->getLocStart(),
1256 diag::warn_printf_data_arg_not_used
)
1257 << getFormatStringRange();
1263 CheckFormatHandler::HandleInvalidConversionSpecifier(unsigned argIndex
,
1265 const char *startSpec
,
1266 unsigned specifierLen
,
1267 const char *csStart
,
1270 bool keepGoing
= true;
1271 if (argIndex
< NumDataArgs
) {
1272 // Consider the argument coverered, even though the specifier doesn't
1274 CoveredArgs
.set(argIndex
);
1277 // If argIndex exceeds the number of data arguments we
1278 // don't issue a warning because that is just a cascade of warnings (and
1279 // they may have intended '%%' anyway). We don't want to continue processing
1280 // the format string after this point, however, as we will like just get
1281 // gibberish when trying to match arguments.
1285 S
.Diag(Loc
, diag::warn_format_invalid_conversion
)
1286 << llvm::StringRef(csStart
, csLen
)
1287 << getSpecifierRange(startSpec
, specifierLen
);
1293 CheckFormatHandler::CheckNumArgs(
1294 const analyze_format_string::FormatSpecifier
&FS
,
1295 const analyze_format_string::ConversionSpecifier
&CS
,
1296 const char *startSpecifier
, unsigned specifierLen
, unsigned argIndex
) {
1298 if (argIndex
>= NumDataArgs
) {
1299 if (FS
.usesPositionalArg()) {
1300 S
.Diag(getLocationOfByte(CS
.getStart()),
1301 diag::warn_printf_positional_arg_exceeds_data_args
)
1302 << (argIndex
+1) << NumDataArgs
1303 << getSpecifierRange(startSpecifier
, specifierLen
);
1306 S
.Diag(getLocationOfByte(CS
.getStart()),
1307 diag::warn_printf_insufficient_data_args
)
1308 << getSpecifierRange(startSpecifier
, specifierLen
);
1316 //===--- CHECK: Printf format string checking ------------------------------===//
1319 class CheckPrintfHandler
: public CheckFormatHandler
{
1321 CheckPrintfHandler(Sema
&s
, const StringLiteral
*fexpr
,
1322 const Expr
*origFormatExpr
, unsigned firstDataArg
,
1323 unsigned numDataArgs
, bool isObjCLiteral
,
1324 const char *beg
, bool hasVAListArg
,
1325 const CallExpr
*theCall
, unsigned formatIdx
)
1326 : CheckFormatHandler(s
, fexpr
, origFormatExpr
, firstDataArg
,
1327 numDataArgs
, isObjCLiteral
, beg
, hasVAListArg
,
1328 theCall
, formatIdx
) {}
1331 bool HandleInvalidPrintfConversionSpecifier(
1332 const analyze_printf::PrintfSpecifier
&FS
,
1333 const char *startSpecifier
,
1334 unsigned specifierLen
);
1336 bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
&FS
,
1337 const char *startSpecifier
,
1338 unsigned specifierLen
);
1340 bool HandleAmount(const analyze_format_string::OptionalAmount
&Amt
, unsigned k
,
1341 const char *startSpecifier
, unsigned specifierLen
);
1342 void HandleInvalidAmount(const analyze_printf::PrintfSpecifier
&FS
,
1343 const analyze_printf::OptionalAmount
&Amt
,
1345 const char *startSpecifier
, unsigned specifierLen
);
1346 void HandleFlag(const analyze_printf::PrintfSpecifier
&FS
,
1347 const analyze_printf::OptionalFlag
&flag
,
1348 const char *startSpecifier
, unsigned specifierLen
);
1349 void HandleIgnoredFlag(const analyze_printf::PrintfSpecifier
&FS
,
1350 const analyze_printf::OptionalFlag
&ignoredFlag
,
1351 const analyze_printf::OptionalFlag
&flag
,
1352 const char *startSpecifier
, unsigned specifierLen
);
1356 bool CheckPrintfHandler::HandleInvalidPrintfConversionSpecifier(
1357 const analyze_printf::PrintfSpecifier
&FS
,
1358 const char *startSpecifier
,
1359 unsigned specifierLen
) {
1360 const analyze_printf::PrintfConversionSpecifier
&CS
=
1361 FS
.getConversionSpecifier();
1363 return HandleInvalidConversionSpecifier(FS
.getArgIndex(),
1364 getLocationOfByte(CS
.getStart()),
1365 startSpecifier
, specifierLen
,
1366 CS
.getStart(), CS
.getLength());
1369 bool CheckPrintfHandler::HandleAmount(
1370 const analyze_format_string::OptionalAmount
&Amt
,
1371 unsigned k
, const char *startSpecifier
,
1372 unsigned specifierLen
) {
1374 if (Amt
.hasDataArgument()) {
1375 if (!HasVAListArg
) {
1376 unsigned argIndex
= Amt
.getArgIndex();
1377 if (argIndex
>= NumDataArgs
) {
1378 S
.Diag(getLocationOfByte(Amt
.getStart()),
1379 diag::warn_printf_asterisk_missing_arg
)
1380 << k
<< getSpecifierRange(startSpecifier
, specifierLen
);
1381 // Don't do any more checking. We will just emit
1386 // Type check the data argument. It should be an 'int'.
1387 // Although not in conformance with C99, we also allow the argument to be
1388 // an 'unsigned int' as that is a reasonably safe case. GCC also
1389 // doesn't emit a warning for that case.
1390 CoveredArgs
.set(argIndex
);
1391 const Expr
*Arg
= getDataArg(argIndex
);
1392 QualType T
= Arg
->getType();
1394 const analyze_printf::ArgTypeResult
&ATR
= Amt
.getArgType(S
.Context
);
1395 assert(ATR
.isValid());
1397 if (!ATR
.matchesType(S
.Context
, T
)) {
1398 S
.Diag(getLocationOfByte(Amt
.getStart()),
1399 diag::warn_printf_asterisk_wrong_type
)
1401 << ATR
.getRepresentativeType(S
.Context
) << T
1402 << getSpecifierRange(startSpecifier
, specifierLen
)
1403 << Arg
->getSourceRange();
1404 // Don't do any more checking. We will just emit
1413 void CheckPrintfHandler::HandleInvalidAmount(
1414 const analyze_printf::PrintfSpecifier
&FS
,
1415 const analyze_printf::OptionalAmount
&Amt
,
1417 const char *startSpecifier
,
1418 unsigned specifierLen
) {
1419 const analyze_printf::PrintfConversionSpecifier
&CS
=
1420 FS
.getConversionSpecifier();
1421 switch (Amt
.getHowSpecified()) {
1422 case analyze_printf::OptionalAmount::Constant
:
1423 S
.Diag(getLocationOfByte(Amt
.getStart()),
1424 diag::warn_printf_nonsensical_optional_amount
)
1427 << getSpecifierRange(startSpecifier
, specifierLen
)
1428 << FixItHint::CreateRemoval(getSpecifierRange(Amt
.getStart(),
1429 Amt
.getConstantLength()));
1433 S
.Diag(getLocationOfByte(Amt
.getStart()),
1434 diag::warn_printf_nonsensical_optional_amount
)
1437 << getSpecifierRange(startSpecifier
, specifierLen
);
1442 void CheckPrintfHandler::HandleFlag(const analyze_printf::PrintfSpecifier
&FS
,
1443 const analyze_printf::OptionalFlag
&flag
,
1444 const char *startSpecifier
,
1445 unsigned specifierLen
) {
1446 // Warn about pointless flag with a fixit removal.
1447 const analyze_printf::PrintfConversionSpecifier
&CS
=
1448 FS
.getConversionSpecifier();
1449 S
.Diag(getLocationOfByte(flag
.getPosition()),
1450 diag::warn_printf_nonsensical_flag
)
1451 << flag
.toString() << CS
.toString()
1452 << getSpecifierRange(startSpecifier
, specifierLen
)
1453 << FixItHint::CreateRemoval(getSpecifierRange(flag
.getPosition(), 1));
1456 void CheckPrintfHandler::HandleIgnoredFlag(
1457 const analyze_printf::PrintfSpecifier
&FS
,
1458 const analyze_printf::OptionalFlag
&ignoredFlag
,
1459 const analyze_printf::OptionalFlag
&flag
,
1460 const char *startSpecifier
,
1461 unsigned specifierLen
) {
1462 // Warn about ignored flag with a fixit removal.
1463 S
.Diag(getLocationOfByte(ignoredFlag
.getPosition()),
1464 diag::warn_printf_ignored_flag
)
1465 << ignoredFlag
.toString() << flag
.toString()
1466 << getSpecifierRange(startSpecifier
, specifierLen
)
1467 << FixItHint::CreateRemoval(getSpecifierRange(
1468 ignoredFlag
.getPosition(), 1));
1472 CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
1474 const char *startSpecifier
,
1475 unsigned specifierLen
) {
1477 using namespace analyze_format_string
;
1478 using namespace analyze_printf
;
1479 const PrintfConversionSpecifier
&CS
= FS
.getConversionSpecifier();
1481 if (FS
.consumesDataArgument()) {
1484 usesPositionalArgs
= FS
.usesPositionalArg();
1486 else if (usesPositionalArgs
!= FS
.usesPositionalArg()) {
1487 // Cannot mix-and-match positional and non-positional arguments.
1488 S
.Diag(getLocationOfByte(CS
.getStart()),
1489 diag::warn_format_mix_positional_nonpositional_args
)
1490 << getSpecifierRange(startSpecifier
, specifierLen
);
1495 // First check if the field width, precision, and conversion specifier
1496 // have matching data arguments.
1497 if (!HandleAmount(FS
.getFieldWidth(), /* field width */ 0,
1498 startSpecifier
, specifierLen
)) {
1502 if (!HandleAmount(FS
.getPrecision(), /* precision */ 1,
1503 startSpecifier
, specifierLen
)) {
1507 if (!CS
.consumesDataArgument()) {
1508 // FIXME: Technically specifying a precision or field width here
1509 // makes no sense. Worth issuing a warning at some point.
1513 // Consume the argument.
1514 unsigned argIndex
= FS
.getArgIndex();
1515 if (argIndex
< NumDataArgs
) {
1516 // The check to see if the argIndex is valid will come later.
1517 // We set the bit here because we may exit early from this
1518 // function if we encounter some other error.
1519 CoveredArgs
.set(argIndex
);
1522 // Check for using an Objective-C specific conversion specifier
1523 // in a non-ObjC literal.
1524 if (!IsObjCLiteral
&& CS
.isObjCArg()) {
1525 return HandleInvalidPrintfConversionSpecifier(FS
, startSpecifier
,
1529 // Check for invalid use of field width
1530 if (!FS
.hasValidFieldWidth()) {
1531 HandleInvalidAmount(FS
, FS
.getFieldWidth(), /* field width */ 0,
1532 startSpecifier
, specifierLen
);
1535 // Check for invalid use of precision
1536 if (!FS
.hasValidPrecision()) {
1537 HandleInvalidAmount(FS
, FS
.getPrecision(), /* precision */ 1,
1538 startSpecifier
, specifierLen
);
1541 // Check each flag does not conflict with any other component.
1542 if (!FS
.hasValidLeadingZeros())
1543 HandleFlag(FS
, FS
.hasLeadingZeros(), startSpecifier
, specifierLen
);
1544 if (!FS
.hasValidPlusPrefix())
1545 HandleFlag(FS
, FS
.hasPlusPrefix(), startSpecifier
, specifierLen
);
1546 if (!FS
.hasValidSpacePrefix())
1547 HandleFlag(FS
, FS
.hasSpacePrefix(), startSpecifier
, specifierLen
);
1548 if (!FS
.hasValidAlternativeForm())
1549 HandleFlag(FS
, FS
.hasAlternativeForm(), startSpecifier
, specifierLen
);
1550 if (!FS
.hasValidLeftJustified())
1551 HandleFlag(FS
, FS
.isLeftJustified(), startSpecifier
, specifierLen
);
1553 // Check that flags are not ignored by another flag
1554 if (FS
.hasSpacePrefix() && FS
.hasPlusPrefix()) // ' ' ignored by '+'
1555 HandleIgnoredFlag(FS
, FS
.hasSpacePrefix(), FS
.hasPlusPrefix(),
1556 startSpecifier
, specifierLen
);
1557 if (FS
.hasLeadingZeros() && FS
.isLeftJustified()) // '0' ignored by '-'
1558 HandleIgnoredFlag(FS
, FS
.hasLeadingZeros(), FS
.isLeftJustified(),
1559 startSpecifier
, specifierLen
);
1561 // Check the length modifier is valid with the given conversion specifier.
1562 const LengthModifier
&LM
= FS
.getLengthModifier();
1563 if (!FS
.hasValidLengthModifier())
1564 S
.Diag(getLocationOfByte(LM
.getStart()),
1565 diag::warn_format_nonsensical_length
)
1566 << LM
.toString() << CS
.toString()
1567 << getSpecifierRange(startSpecifier
, specifierLen
)
1568 << FixItHint::CreateRemoval(getSpecifierRange(LM
.getStart(),
1571 // Are we using '%n'?
1572 if (CS
.getKind() == ConversionSpecifier::nArg
) {
1573 // Issue a warning about this being a possible security issue.
1574 S
.Diag(getLocationOfByte(CS
.getStart()), diag::warn_printf_write_back
)
1575 << getSpecifierRange(startSpecifier
, specifierLen
);
1576 // Continue checking the other format specifiers.
1580 // The remaining checks depend on the data arguments.
1584 if (!CheckNumArgs(FS
, CS
, startSpecifier
, specifierLen
, argIndex
))
1587 // Now type check the data expression that matches the
1588 // format specifier.
1589 const Expr
*Ex
= getDataArg(argIndex
);
1590 const analyze_printf::ArgTypeResult
&ATR
= FS
.getArgType(S
.Context
);
1591 if (ATR
.isValid() && !ATR
.matchesType(S
.Context
, Ex
->getType())) {
1592 // Check if we didn't match because of an implicit cast from a 'char'
1593 // or 'short' to an 'int'. This is done because printf is a varargs
1595 if (const ImplicitCastExpr
*ICE
= dyn_cast
<ImplicitCastExpr
>(Ex
))
1596 if (ICE
->getType() == S
.Context
.IntTy
)
1597 if (ATR
.matchesType(S
.Context
, ICE
->getSubExpr()->getType()))
1600 // We may be able to offer a FixItHint if it is a supported type.
1601 PrintfSpecifier fixedFS
= FS
;
1602 bool success
= fixedFS
.fixType(Ex
->getType());
1605 // Get the fix string from the fixed format specifier
1606 llvm::SmallString
<128> buf
;
1607 llvm::raw_svector_ostream
os(buf
);
1608 fixedFS
.toString(os
);
1610 // FIXME: getRepresentativeType() perhaps should return a string
1611 // instead of a QualType to better handle when the representative
1612 // type is 'wint_t' (which is defined in the system headers).
1613 S
.Diag(getLocationOfByte(CS
.getStart()),
1614 diag::warn_printf_conversion_argument_type_mismatch
)
1615 << ATR
.getRepresentativeType(S
.Context
) << Ex
->getType()
1616 << getSpecifierRange(startSpecifier
, specifierLen
)
1617 << Ex
->getSourceRange()
1618 << FixItHint::CreateReplacement(
1619 getSpecifierRange(startSpecifier
, specifierLen
),
1623 S
.Diag(getLocationOfByte(CS
.getStart()),
1624 diag::warn_printf_conversion_argument_type_mismatch
)
1625 << ATR
.getRepresentativeType(S
.Context
) << Ex
->getType()
1626 << getSpecifierRange(startSpecifier
, specifierLen
)
1627 << Ex
->getSourceRange();
1634 //===--- CHECK: Scanf format string checking ------------------------------===//
1637 class CheckScanfHandler
: public CheckFormatHandler
{
1639 CheckScanfHandler(Sema
&s
, const StringLiteral
*fexpr
,
1640 const Expr
*origFormatExpr
, unsigned firstDataArg
,
1641 unsigned numDataArgs
, bool isObjCLiteral
,
1642 const char *beg
, bool hasVAListArg
,
1643 const CallExpr
*theCall
, unsigned formatIdx
)
1644 : CheckFormatHandler(s
, fexpr
, origFormatExpr
, firstDataArg
,
1645 numDataArgs
, isObjCLiteral
, beg
, hasVAListArg
,
1646 theCall
, formatIdx
) {}
1648 bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier
&FS
,
1649 const char *startSpecifier
,
1650 unsigned specifierLen
);
1652 bool HandleInvalidScanfConversionSpecifier(
1653 const analyze_scanf::ScanfSpecifier
&FS
,
1654 const char *startSpecifier
,
1655 unsigned specifierLen
);
1657 void HandleIncompleteScanList(const char *start
, const char *end
);
1661 void CheckScanfHandler::HandleIncompleteScanList(const char *start
,
1663 S
.Diag(getLocationOfByte(end
), diag::warn_scanf_scanlist_incomplete
)
1664 << getSpecifierRange(start
, end
- start
);
1667 bool CheckScanfHandler::HandleInvalidScanfConversionSpecifier(
1668 const analyze_scanf::ScanfSpecifier
&FS
,
1669 const char *startSpecifier
,
1670 unsigned specifierLen
) {
1672 const analyze_scanf::ScanfConversionSpecifier
&CS
=
1673 FS
.getConversionSpecifier();
1675 return HandleInvalidConversionSpecifier(FS
.getArgIndex(),
1676 getLocationOfByte(CS
.getStart()),
1677 startSpecifier
, specifierLen
,
1678 CS
.getStart(), CS
.getLength());
1681 bool CheckScanfHandler::HandleScanfSpecifier(
1682 const analyze_scanf::ScanfSpecifier
&FS
,
1683 const char *startSpecifier
,
1684 unsigned specifierLen
) {
1686 using namespace analyze_scanf
;
1687 using namespace analyze_format_string
;
1689 const ScanfConversionSpecifier
&CS
= FS
.getConversionSpecifier();
1691 // Handle case where '%' and '*' don't consume an argument. These shouldn't
1692 // be used to decide if we are using positional arguments consistently.
1693 if (FS
.consumesDataArgument()) {
1696 usesPositionalArgs
= FS
.usesPositionalArg();
1698 else if (usesPositionalArgs
!= FS
.usesPositionalArg()) {
1699 // Cannot mix-and-match positional and non-positional arguments.
1700 S
.Diag(getLocationOfByte(CS
.getStart()),
1701 diag::warn_format_mix_positional_nonpositional_args
)
1702 << getSpecifierRange(startSpecifier
, specifierLen
);
1707 // Check if the field with is non-zero.
1708 const OptionalAmount
&Amt
= FS
.getFieldWidth();
1709 if (Amt
.getHowSpecified() == OptionalAmount::Constant
) {
1710 if (Amt
.getConstantAmount() == 0) {
1711 const CharSourceRange
&R
= getSpecifierRange(Amt
.getStart(),
1712 Amt
.getConstantLength());
1713 S
.Diag(getLocationOfByte(Amt
.getStart()),
1714 diag::warn_scanf_nonzero_width
)
1715 << R
<< FixItHint::CreateRemoval(R
);
1719 if (!FS
.consumesDataArgument()) {
1720 // FIXME: Technically specifying a precision or field width here
1721 // makes no sense. Worth issuing a warning at some point.
1725 // Consume the argument.
1726 unsigned argIndex
= FS
.getArgIndex();
1727 if (argIndex
< NumDataArgs
) {
1728 // The check to see if the argIndex is valid will come later.
1729 // We set the bit here because we may exit early from this
1730 // function if we encounter some other error.
1731 CoveredArgs
.set(argIndex
);
1734 // Check the length modifier is valid with the given conversion specifier.
1735 const LengthModifier
&LM
= FS
.getLengthModifier();
1736 if (!FS
.hasValidLengthModifier()) {
1737 S
.Diag(getLocationOfByte(LM
.getStart()),
1738 diag::warn_format_nonsensical_length
)
1739 << LM
.toString() << CS
.toString()
1740 << getSpecifierRange(startSpecifier
, specifierLen
)
1741 << FixItHint::CreateRemoval(getSpecifierRange(LM
.getStart(),
1745 // The remaining checks depend on the data arguments.
1749 if (!CheckNumArgs(FS
, CS
, startSpecifier
, specifierLen
, argIndex
))
1752 // FIXME: Check that the argument type matches the format specifier.
1757 void Sema::CheckFormatString(const StringLiteral
*FExpr
,
1758 const Expr
*OrigFormatExpr
,
1759 const CallExpr
*TheCall
, bool HasVAListArg
,
1760 unsigned format_idx
, unsigned firstDataArg
,
1763 // CHECK: is the format string a wide literal?
1764 if (FExpr
->isWide()) {
1765 Diag(FExpr
->getLocStart(),
1766 diag::warn_format_string_is_wide_literal
)
1767 << OrigFormatExpr
->getSourceRange();
1771 // Str - The format string. NOTE: this is NOT null-terminated!
1772 llvm::StringRef StrRef
= FExpr
->getString();
1773 const char *Str
= StrRef
.data();
1774 unsigned StrLen
= StrRef
.size();
1776 // CHECK: empty format string?
1778 Diag(FExpr
->getLocStart(), diag::warn_empty_format_string
)
1779 << OrigFormatExpr
->getSourceRange();
1784 CheckPrintfHandler
H(*this, FExpr
, OrigFormatExpr
, firstDataArg
,
1785 TheCall
->getNumArgs() - firstDataArg
,
1786 isa
<ObjCStringLiteral
>(OrigFormatExpr
), Str
,
1787 HasVAListArg
, TheCall
, format_idx
);
1789 if (!analyze_format_string::ParsePrintfString(H
, Str
, Str
+ StrLen
))
1793 CheckScanfHandler
H(*this, FExpr
, OrigFormatExpr
, firstDataArg
,
1794 TheCall
->getNumArgs() - firstDataArg
,
1795 isa
<ObjCStringLiteral
>(OrigFormatExpr
), Str
,
1796 HasVAListArg
, TheCall
, format_idx
);
1798 if (!analyze_format_string::ParseScanfString(H
, Str
, Str
+ StrLen
))
1803 //===--- CHECK: Return Address of Stack Variable --------------------------===//
1805 static DeclRefExpr
* EvalVal(Expr
*E
);
1806 static DeclRefExpr
* EvalAddr(Expr
* E
);
1808 /// CheckReturnStackAddr - Check if a return statement returns the address
1809 /// of a stack variable.
1811 Sema::CheckReturnStackAddr(Expr
*RetValExp
, QualType lhsType
,
1812 SourceLocation ReturnLoc
) {
1814 // Perform checking for returned stack addresses.
1815 if (lhsType
->isPointerType() || lhsType
->isBlockPointerType()) {
1816 if (DeclRefExpr
*DR
= EvalAddr(RetValExp
))
1817 Diag(DR
->getLocStart(), diag::warn_ret_stack_addr
)
1818 << DR
->getDecl()->getDeclName() << RetValExp
->getSourceRange();
1820 // Skip over implicit cast expressions when checking for block expressions.
1821 RetValExp
= RetValExp
->IgnoreParenCasts();
1823 if (BlockExpr
*C
= dyn_cast
<BlockExpr
>(RetValExp
))
1824 if (C
->hasBlockDeclRefExprs())
1825 Diag(C
->getLocStart(), diag::err_ret_local_block
)
1826 << C
->getSourceRange();
1828 if (AddrLabelExpr
*ALE
= dyn_cast
<AddrLabelExpr
>(RetValExp
))
1829 Diag(ALE
->getLocStart(), diag::warn_ret_addr_label
)
1830 << ALE
->getSourceRange();
1832 } else if (lhsType
->isReferenceType()) {
1833 // Perform checking for stack values returned by reference.
1834 // Check for a reference to the stack
1835 if (DeclRefExpr
*DR
= EvalVal(RetValExp
))
1836 Diag(DR
->getLocStart(), diag::warn_ret_stack_ref
)
1837 << DR
->getDecl()->getDeclName() << RetValExp
->getSourceRange();
1841 /// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
1842 /// check if the expression in a return statement evaluates to an address
1843 /// to a location on the stack. The recursion is used to traverse the
1844 /// AST of the return expression, with recursion backtracking when we
1845 /// encounter a subexpression that (1) clearly does not lead to the address
1846 /// of a stack variable or (2) is something we cannot determine leads to
1847 /// the address of a stack variable based on such local checking.
1849 /// EvalAddr processes expressions that are pointers that are used as
1850 /// references (and not L-values). EvalVal handles all other values.
1851 /// At the base case of the recursion is a check for a DeclRefExpr* in
1852 /// the refers to a stack variable.
1854 /// This implementation handles:
1856 /// * pointer-to-pointer casts
1857 /// * implicit conversions from array references to pointers
1858 /// * taking the address of fields
1859 /// * arbitrary interplay between "&" and "*" operators
1860 /// * pointer arithmetic from an address of a stack variable
1861 /// * taking the address of an array element where the array is on the stack
1862 static DeclRefExpr
* EvalAddr(Expr
*E
) {
1863 // We should only be called for evaluating pointer expressions.
1864 assert((E
->getType()->isAnyPointerType() ||
1865 E
->getType()->isBlockPointerType() ||
1866 E
->getType()->isObjCQualifiedIdType()) &&
1867 "EvalAddr only works on pointers");
1869 // Our "symbolic interpreter" is just a dispatch off the currently
1870 // viewed AST node. We then recursively traverse the AST by calling
1871 // EvalAddr and EvalVal appropriately.
1872 switch (E
->getStmtClass()) {
1873 case Stmt::ParenExprClass
:
1874 // Ignore parentheses.
1875 return EvalAddr(cast
<ParenExpr
>(E
)->getSubExpr());
1877 case Stmt::UnaryOperatorClass
: {
1878 // The only unary operator that make sense to handle here
1879 // is AddrOf. All others don't make sense as pointers.
1880 UnaryOperator
*U
= cast
<UnaryOperator
>(E
);
1882 if (U
->getOpcode() == UO_AddrOf
)
1883 return EvalVal(U
->getSubExpr());
1888 case Stmt::BinaryOperatorClass
: {
1889 // Handle pointer arithmetic. All other binary operators are not valid
1891 BinaryOperator
*B
= cast
<BinaryOperator
>(E
);
1892 BinaryOperatorKind op
= B
->getOpcode();
1894 if (op
!= BO_Add
&& op
!= BO_Sub
)
1897 Expr
*Base
= B
->getLHS();
1899 // Determine which argument is the real pointer base. It could be
1900 // the RHS argument instead of the LHS.
1901 if (!Base
->getType()->isPointerType()) Base
= B
->getRHS();
1903 assert (Base
->getType()->isPointerType());
1904 return EvalAddr(Base
);
1907 // For conditional operators we need to see if either the LHS or RHS are
1908 // valid DeclRefExpr*s. If one of them is valid, we return it.
1909 case Stmt::ConditionalOperatorClass
: {
1910 ConditionalOperator
*C
= cast
<ConditionalOperator
>(E
);
1912 // Handle the GNU extension for missing LHS.
1913 if (Expr
*lhsExpr
= C
->getLHS())
1914 if (DeclRefExpr
* LHS
= EvalAddr(lhsExpr
))
1917 return EvalAddr(C
->getRHS());
1920 // For casts, we need to handle conversions from arrays to
1921 // pointer values, and pointer-to-pointer conversions.
1922 case Stmt::ImplicitCastExprClass
:
1923 case Stmt::CStyleCastExprClass
:
1924 case Stmt::CXXFunctionalCastExprClass
: {
1925 Expr
* SubExpr
= cast
<CastExpr
>(E
)->getSubExpr();
1926 QualType T
= SubExpr
->getType();
1928 if (SubExpr
->getType()->isPointerType() ||
1929 SubExpr
->getType()->isBlockPointerType() ||
1930 SubExpr
->getType()->isObjCQualifiedIdType())
1931 return EvalAddr(SubExpr
);
1932 else if (T
->isArrayType())
1933 return EvalVal(SubExpr
);
1938 // C++ casts. For dynamic casts, static casts, and const casts, we
1939 // are always converting from a pointer-to-pointer, so we just blow
1940 // through the cast. In the case the dynamic cast doesn't fail (and
1941 // return NULL), we take the conservative route and report cases
1942 // where we return the address of a stack variable. For Reinterpre
1943 // FIXME: The comment about is wrong; we're not always converting
1944 // from pointer to pointer. I'm guessing that this code should also
1945 // handle references to objects.
1946 case Stmt::CXXStaticCastExprClass
:
1947 case Stmt::CXXDynamicCastExprClass
:
1948 case Stmt::CXXConstCastExprClass
:
1949 case Stmt::CXXReinterpretCastExprClass
: {
1950 Expr
*S
= cast
<CXXNamedCastExpr
>(E
)->getSubExpr();
1951 if (S
->getType()->isPointerType() || S
->getType()->isBlockPointerType())
1957 // Everything else: we simply don't reason about them.
1964 /// EvalVal - This function is complements EvalAddr in the mutual recursion.
1965 /// See the comments for EvalAddr for more details.
1966 static DeclRefExpr
* EvalVal(Expr
*E
) {
1968 // We should only be called for evaluating non-pointer expressions, or
1969 // expressions with a pointer type that are not used as references but instead
1970 // are l-values (e.g., DeclRefExpr with a pointer type).
1972 // Our "symbolic interpreter" is just a dispatch off the currently
1973 // viewed AST node. We then recursively traverse the AST by calling
1974 // EvalAddr and EvalVal appropriately.
1975 switch (E
->getStmtClass()) {
1976 case Stmt::ImplicitCastExprClass
: {
1977 ImplicitCastExpr
*IE
= cast
<ImplicitCastExpr
>(E
);
1978 if (IE
->getValueKind() == VK_LValue
) {
1979 E
= IE
->getSubExpr();
1985 case Stmt::DeclRefExprClass
: {
1986 // DeclRefExpr: the base case. When we hit a DeclRefExpr we are looking
1987 // at code that refers to a variable's name. We check if it has local
1988 // storage within the function, and if so, return the expression.
1989 DeclRefExpr
*DR
= cast
<DeclRefExpr
>(E
);
1991 if (VarDecl
*V
= dyn_cast
<VarDecl
>(DR
->getDecl()))
1992 if (V
->hasLocalStorage() && !V
->getType()->isReferenceType()) return DR
;
1997 case Stmt::ParenExprClass
: {
1998 // Ignore parentheses.
1999 E
= cast
<ParenExpr
>(E
)->getSubExpr();
2003 case Stmt::UnaryOperatorClass
: {
2004 // The only unary operator that make sense to handle here
2005 // is Deref. All others don't resolve to a "name." This includes
2006 // handling all sorts of rvalues passed to a unary operator.
2007 UnaryOperator
*U
= cast
<UnaryOperator
>(E
);
2009 if (U
->getOpcode() == UO_Deref
)
2010 return EvalAddr(U
->getSubExpr());
2015 case Stmt::ArraySubscriptExprClass
: {
2016 // Array subscripts are potential references to data on the stack. We
2017 // retrieve the DeclRefExpr* for the array variable if it indeed
2018 // has local storage.
2019 return EvalAddr(cast
<ArraySubscriptExpr
>(E
)->getBase());
2022 case Stmt::ConditionalOperatorClass
: {
2023 // For conditional operators we need to see if either the LHS or RHS are
2024 // non-NULL DeclRefExpr's. If one is non-NULL, we return it.
2025 ConditionalOperator
*C
= cast
<ConditionalOperator
>(E
);
2027 // Handle the GNU extension for missing LHS.
2028 if (Expr
*lhsExpr
= C
->getLHS())
2029 if (DeclRefExpr
*LHS
= EvalVal(lhsExpr
))
2032 return EvalVal(C
->getRHS());
2035 // Accesses to members are potential references to data on the stack.
2036 case Stmt::MemberExprClass
: {
2037 MemberExpr
*M
= cast
<MemberExpr
>(E
);
2039 // Check for indirect access. We only want direct field accesses.
2043 // Check whether the member type is itself a reference, in which case
2044 // we're not going to refer to the member, but to what the member refers to.
2045 if (M
->getMemberDecl()->getType()->isReferenceType())
2048 return EvalVal(M
->getBase());
2051 // Everything else: we simply don't reason about them.
2058 //===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
2060 /// Check for comparisons of floating point operands using != and ==.
2061 /// Issue a warning if these are no self-comparisons, as they are not likely
2062 /// to do what the programmer intended.
2063 void Sema::CheckFloatComparison(SourceLocation loc
, Expr
* lex
, Expr
*rex
) {
2064 bool EmitWarning
= true;
2066 Expr
* LeftExprSansParen
= lex
->IgnoreParens();
2067 Expr
* RightExprSansParen
= rex
->IgnoreParens();
2069 // Special case: check for x == x (which is OK).
2070 // Do not emit warnings for such cases.
2071 if (DeclRefExpr
* DRL
= dyn_cast
<DeclRefExpr
>(LeftExprSansParen
))
2072 if (DeclRefExpr
* DRR
= dyn_cast
<DeclRefExpr
>(RightExprSansParen
))
2073 if (DRL
->getDecl() == DRR
->getDecl())
2074 EmitWarning
= false;
2077 // Special case: check for comparisons against literals that can be exactly
2078 // represented by APFloat. In such cases, do not emit a warning. This
2079 // is a heuristic: often comparison against such literals are used to
2080 // detect if a value in a variable has not changed. This clearly can
2081 // lead to false negatives.
2083 if (FloatingLiteral
* FLL
= dyn_cast
<FloatingLiteral
>(LeftExprSansParen
)) {
2085 EmitWarning
= false;
2087 if (FloatingLiteral
* FLR
= dyn_cast
<FloatingLiteral
>(RightExprSansParen
)){
2089 EmitWarning
= false;
2093 // Check for comparisons with builtin types.
2095 if (CallExpr
* CL
= dyn_cast
<CallExpr
>(LeftExprSansParen
))
2096 if (CL
->isBuiltinCall(Context
))
2097 EmitWarning
= false;
2100 if (CallExpr
* CR
= dyn_cast
<CallExpr
>(RightExprSansParen
))
2101 if (CR
->isBuiltinCall(Context
))
2102 EmitWarning
= false;
2104 // Emit the diagnostic.
2106 Diag(loc
, diag::warn_floatingpoint_eq
)
2107 << lex
->getSourceRange() << rex
->getSourceRange();
2110 //===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
2111 //===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
2115 /// Structure recording the 'active' range of an integer-valued
2118 /// The number of bits active in the int.
2121 /// True if the int is known not to have negative values.
2124 IntRange(unsigned Width
, bool NonNegative
)
2125 : Width(Width
), NonNegative(NonNegative
)
2128 // Returns the range of the bool type.
2129 static IntRange
forBoolType() {
2130 return IntRange(1, true);
2133 // Returns the range of an integral type.
2134 static IntRange
forType(ASTContext
&C
, QualType T
) {
2135 return forCanonicalType(C
, T
->getCanonicalTypeInternal().getTypePtr());
2138 // Returns the range of an integeral type based on its canonical
2140 static IntRange
forCanonicalType(ASTContext
&C
, const Type
*T
) {
2141 assert(T
->isCanonicalUnqualified());
2143 if (const VectorType
*VT
= dyn_cast
<VectorType
>(T
))
2144 T
= VT
->getElementType().getTypePtr();
2145 if (const ComplexType
*CT
= dyn_cast
<ComplexType
>(T
))
2146 T
= CT
->getElementType().getTypePtr();
2148 if (const EnumType
*ET
= dyn_cast
<EnumType
>(T
)) {
2149 EnumDecl
*Enum
= ET
->getDecl();
2150 unsigned NumPositive
= Enum
->getNumPositiveBits();
2151 unsigned NumNegative
= Enum
->getNumNegativeBits();
2153 return IntRange(std::max(NumPositive
, NumNegative
), NumNegative
== 0);
2156 const BuiltinType
*BT
= cast
<BuiltinType
>(T
);
2157 assert(BT
->isInteger());
2159 return IntRange(C
.getIntWidth(QualType(T
, 0)), BT
->isUnsignedInteger());
2162 // Returns the supremum of two ranges: i.e. their conservative merge.
2163 static IntRange
join(IntRange L
, IntRange R
) {
2164 return IntRange(std::max(L
.Width
, R
.Width
),
2165 L
.NonNegative
&& R
.NonNegative
);
2168 // Returns the infinum of two ranges: i.e. their aggressive merge.
2169 static IntRange
meet(IntRange L
, IntRange R
) {
2170 return IntRange(std::min(L
.Width
, R
.Width
),
2171 L
.NonNegative
|| R
.NonNegative
);
2175 IntRange
GetValueRange(ASTContext
&C
, llvm::APSInt
&value
, unsigned MaxWidth
) {
2176 if (value
.isSigned() && value
.isNegative())
2177 return IntRange(value
.getMinSignedBits(), false);
2179 if (value
.getBitWidth() > MaxWidth
)
2180 value
.trunc(MaxWidth
);
2182 // isNonNegative() just checks the sign bit without considering
2184 return IntRange(value
.getActiveBits(), true);
2187 IntRange
GetValueRange(ASTContext
&C
, APValue
&result
, QualType Ty
,
2188 unsigned MaxWidth
) {
2190 return GetValueRange(C
, result
.getInt(), MaxWidth
);
2192 if (result
.isVector()) {
2193 IntRange R
= GetValueRange(C
, result
.getVectorElt(0), Ty
, MaxWidth
);
2194 for (unsigned i
= 1, e
= result
.getVectorLength(); i
!= e
; ++i
) {
2195 IntRange El
= GetValueRange(C
, result
.getVectorElt(i
), Ty
, MaxWidth
);
2196 R
= IntRange::join(R
, El
);
2201 if (result
.isComplexInt()) {
2202 IntRange R
= GetValueRange(C
, result
.getComplexIntReal(), MaxWidth
);
2203 IntRange I
= GetValueRange(C
, result
.getComplexIntImag(), MaxWidth
);
2204 return IntRange::join(R
, I
);
2207 // This can happen with lossless casts to intptr_t of "based" lvalues.
2208 // Assume it might use arbitrary bits.
2209 // FIXME: The only reason we need to pass the type in here is to get
2210 // the sign right on this one case. It would be nice if APValue
2212 assert(result
.isLValue());
2213 return IntRange(MaxWidth
, Ty
->isUnsignedIntegerType());
2216 /// Pseudo-evaluate the given integer expression, estimating the
2217 /// range of values it might take.
2219 /// \param MaxWidth - the width to which the value will be truncated
2220 IntRange
GetExprRange(ASTContext
&C
, Expr
*E
, unsigned MaxWidth
) {
2221 E
= E
->IgnoreParens();
2223 // Try a full evaluation first.
2224 Expr::EvalResult result
;
2225 if (E
->Evaluate(result
, C
))
2226 return GetValueRange(C
, result
.Val
, E
->getType(), MaxWidth
);
2228 // I think we only want to look through implicit casts here; if the
2229 // user has an explicit widening cast, we should treat the value as
2230 // being of the new, wider type.
2231 if (ImplicitCastExpr
*CE
= dyn_cast
<ImplicitCastExpr
>(E
)) {
2232 if (CE
->getCastKind() == CK_NoOp
)
2233 return GetExprRange(C
, CE
->getSubExpr(), MaxWidth
);
2235 IntRange OutputTypeRange
= IntRange::forType(C
, CE
->getType());
2237 bool isIntegerCast
= (CE
->getCastKind() == CK_IntegralCast
);
2238 if (!isIntegerCast
&& CE
->getCastKind() == CK_Unknown
)
2239 isIntegerCast
= CE
->getSubExpr()->getType()->isIntegerType();
2241 // Assume that non-integer casts can span the full range of the type.
2243 return OutputTypeRange
;
2246 = GetExprRange(C
, CE
->getSubExpr(),
2247 std::min(MaxWidth
, OutputTypeRange
.Width
));
2249 // Bail out if the subexpr's range is as wide as the cast type.
2250 if (SubRange
.Width
>= OutputTypeRange
.Width
)
2251 return OutputTypeRange
;
2253 // Otherwise, we take the smaller width, and we're non-negative if
2254 // either the output type or the subexpr is.
2255 return IntRange(SubRange
.Width
,
2256 SubRange
.NonNegative
|| OutputTypeRange
.NonNegative
);
2259 if (ConditionalOperator
*CO
= dyn_cast
<ConditionalOperator
>(E
)) {
2260 // If we can fold the condition, just take that operand.
2262 if (CO
->getCond()->EvaluateAsBooleanCondition(CondResult
, C
))
2263 return GetExprRange(C
, CondResult
? CO
->getTrueExpr()
2264 : CO
->getFalseExpr(),
2267 // Otherwise, conservatively merge.
2268 IntRange L
= GetExprRange(C
, CO
->getTrueExpr(), MaxWidth
);
2269 IntRange R
= GetExprRange(C
, CO
->getFalseExpr(), MaxWidth
);
2270 return IntRange::join(L
, R
);
2273 if (BinaryOperator
*BO
= dyn_cast
<BinaryOperator
>(E
)) {
2274 switch (BO
->getOpcode()) {
2276 // Boolean-valued operations are single-bit and positive.
2285 return IntRange::forBoolType();
2287 // The type of these compound assignments is the type of the LHS,
2288 // so the RHS is not necessarily an integer.
2294 return IntRange::forType(C
, E
->getType());
2296 // Operations with opaque sources are black-listed.
2299 return IntRange::forType(C
, E
->getType());
2301 // Bitwise-and uses the *infinum* of the two source ranges.
2304 return IntRange::meet(GetExprRange(C
, BO
->getLHS(), MaxWidth
),
2305 GetExprRange(C
, BO
->getRHS(), MaxWidth
));
2307 // Left shift gets black-listed based on a judgement call.
2309 // ...except that we want to treat '1 << (blah)' as logically
2310 // positive. It's an important idiom.
2311 if (IntegerLiteral
*I
2312 = dyn_cast
<IntegerLiteral
>(BO
->getLHS()->IgnoreParenCasts())) {
2313 if (I
->getValue() == 1) {
2314 IntRange R
= IntRange::forType(C
, E
->getType());
2315 return IntRange(R
.Width
, /*NonNegative*/ true);
2321 return IntRange::forType(C
, E
->getType());
2323 // Right shift by a constant can narrow its left argument.
2325 case BO_ShrAssign
: {
2326 IntRange L
= GetExprRange(C
, BO
->getLHS(), MaxWidth
);
2328 // If the shift amount is a positive constant, drop the width by
2331 if (BO
->getRHS()->isIntegerConstantExpr(shift
, C
) &&
2332 shift
.isNonNegative()) {
2333 unsigned zext
= shift
.getZExtValue();
2334 if (zext
>= L
.Width
)
2335 L
.Width
= (L
.NonNegative
? 0 : 1);
2343 // Comma acts as its right operand.
2345 return GetExprRange(C
, BO
->getRHS(), MaxWidth
);
2347 // Black-list pointer subtractions.
2349 if (BO
->getLHS()->getType()->isPointerType())
2350 return IntRange::forType(C
, E
->getType());
2357 // Treat every other operator as if it were closed on the
2358 // narrowest type that encompasses both operands.
2359 IntRange L
= GetExprRange(C
, BO
->getLHS(), MaxWidth
);
2360 IntRange R
= GetExprRange(C
, BO
->getRHS(), MaxWidth
);
2361 return IntRange::join(L
, R
);
2364 if (UnaryOperator
*UO
= dyn_cast
<UnaryOperator
>(E
)) {
2365 switch (UO
->getOpcode()) {
2366 // Boolean-valued operations are white-listed.
2368 return IntRange::forBoolType();
2370 // Operations with opaque sources are black-listed.
2372 case UO_AddrOf
: // should be impossible
2373 return IntRange::forType(C
, E
->getType());
2376 return GetExprRange(C
, UO
->getSubExpr(), MaxWidth
);
2380 if (dyn_cast
<OffsetOfExpr
>(E
)) {
2381 IntRange::forType(C
, E
->getType());
2384 FieldDecl
*BitField
= E
->getBitField();
2386 llvm::APSInt BitWidthAP
= BitField
->getBitWidth()->EvaluateAsInt(C
);
2387 unsigned BitWidth
= BitWidthAP
.getZExtValue();
2389 return IntRange(BitWidth
, BitField
->getType()->isUnsignedIntegerType());
2392 return IntRange::forType(C
, E
->getType());
2395 IntRange
GetExprRange(ASTContext
&C
, Expr
*E
) {
2396 return GetExprRange(C
, E
, C
.getIntWidth(E
->getType()));
2399 /// Checks whether the given value, which currently has the given
2400 /// source semantics, has the same value when coerced through the
2401 /// target semantics.
2402 bool IsSameFloatAfterCast(const llvm::APFloat
&value
,
2403 const llvm::fltSemantics
&Src
,
2404 const llvm::fltSemantics
&Tgt
) {
2405 llvm::APFloat truncated
= value
;
2408 truncated
.convert(Src
, llvm::APFloat::rmNearestTiesToEven
, &ignored
);
2409 truncated
.convert(Tgt
, llvm::APFloat::rmNearestTiesToEven
, &ignored
);
2411 return truncated
.bitwiseIsEqual(value
);
2414 /// Checks whether the given value, which currently has the given
2415 /// source semantics, has the same value when coerced through the
2416 /// target semantics.
2418 /// The value might be a vector of floats (or a complex number).
2419 bool IsSameFloatAfterCast(const APValue
&value
,
2420 const llvm::fltSemantics
&Src
,
2421 const llvm::fltSemantics
&Tgt
) {
2422 if (value
.isFloat())
2423 return IsSameFloatAfterCast(value
.getFloat(), Src
, Tgt
);
2425 if (value
.isVector()) {
2426 for (unsigned i
= 0, e
= value
.getVectorLength(); i
!= e
; ++i
)
2427 if (!IsSameFloatAfterCast(value
.getVectorElt(i
), Src
, Tgt
))
2432 assert(value
.isComplexFloat());
2433 return (IsSameFloatAfterCast(value
.getComplexFloatReal(), Src
, Tgt
) &&
2434 IsSameFloatAfterCast(value
.getComplexFloatImag(), Src
, Tgt
));
2437 void AnalyzeImplicitConversions(Sema
&S
, Expr
*E
);
2439 static bool IsZero(Sema
&S
, Expr
*E
) {
2440 // Suppress cases where we are comparing against an enum constant.
2441 if (const DeclRefExpr
*DR
=
2442 dyn_cast
<DeclRefExpr
>(E
->IgnoreParenImpCasts()))
2443 if (isa
<EnumConstantDecl
>(DR
->getDecl()))
2446 // Suppress cases where the '0' value is expanded from a macro.
2447 if (E
->getLocStart().isMacroID())
2451 return E
->isIntegerConstantExpr(Value
, S
.Context
) && Value
== 0;
2454 static bool HasEnumType(Expr
*E
) {
2455 // Strip off implicit integral promotions.
2456 while (ImplicitCastExpr
*ICE
= dyn_cast
<ImplicitCastExpr
>(E
)) {
2457 if (ICE
->getCastKind() != CK_IntegralCast
&&
2458 ICE
->getCastKind() != CK_NoOp
)
2460 E
= ICE
->getSubExpr();
2463 return E
->getType()->isEnumeralType();
2466 void CheckTrivialUnsignedComparison(Sema
&S
, BinaryOperator
*E
) {
2467 BinaryOperatorKind op
= E
->getOpcode();
2468 if (op
== BO_LT
&& IsZero(S
, E
->getRHS())) {
2469 S
.Diag(E
->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison
)
2470 << "< 0" << "false" << HasEnumType(E
->getLHS())
2471 << E
->getLHS()->getSourceRange() << E
->getRHS()->getSourceRange();
2472 } else if (op
== BO_GE
&& IsZero(S
, E
->getRHS())) {
2473 S
.Diag(E
->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison
)
2474 << ">= 0" << "true" << HasEnumType(E
->getLHS())
2475 << E
->getLHS()->getSourceRange() << E
->getRHS()->getSourceRange();
2476 } else if (op
== BO_GT
&& IsZero(S
, E
->getLHS())) {
2477 S
.Diag(E
->getOperatorLoc(), diag::warn_runsigned_always_true_comparison
)
2478 << "0 >" << "false" << HasEnumType(E
->getRHS())
2479 << E
->getLHS()->getSourceRange() << E
->getRHS()->getSourceRange();
2480 } else if (op
== BO_LE
&& IsZero(S
, E
->getLHS())) {
2481 S
.Diag(E
->getOperatorLoc(), diag::warn_runsigned_always_true_comparison
)
2482 << "0 <=" << "true" << HasEnumType(E
->getRHS())
2483 << E
->getLHS()->getSourceRange() << E
->getRHS()->getSourceRange();
2487 /// Analyze the operands of the given comparison. Implements the
2488 /// fallback case from AnalyzeComparison.
2489 void AnalyzeImpConvsInComparison(Sema
&S
, BinaryOperator
*E
) {
2490 AnalyzeImplicitConversions(S
, E
->getLHS());
2491 AnalyzeImplicitConversions(S
, E
->getRHS());
2494 /// \brief Implements -Wsign-compare.
2496 /// \param lex the left-hand expression
2497 /// \param rex the right-hand expression
2498 /// \param OpLoc the location of the joining operator
2499 /// \param BinOpc binary opcode or 0
2500 void AnalyzeComparison(Sema
&S
, BinaryOperator
*E
) {
2501 // The type the comparison is being performed in.
2502 QualType T
= E
->getLHS()->getType();
2503 assert(S
.Context
.hasSameUnqualifiedType(T
, E
->getRHS()->getType())
2504 && "comparison with mismatched types");
2506 // We don't do anything special if this isn't an unsigned integral
2507 // comparison: we're only interested in integral comparisons, and
2508 // signed comparisons only happen in cases we don't care to warn about.
2509 if (!T
->hasUnsignedIntegerRepresentation())
2510 return AnalyzeImpConvsInComparison(S
, E
);
2512 Expr
*lex
= E
->getLHS()->IgnoreParenImpCasts();
2513 Expr
*rex
= E
->getRHS()->IgnoreParenImpCasts();
2515 // Check to see if one of the (unmodified) operands is of different
2517 Expr
*signedOperand
, *unsignedOperand
;
2518 if (lex
->getType()->hasSignedIntegerRepresentation()) {
2519 assert(!rex
->getType()->hasSignedIntegerRepresentation() &&
2520 "unsigned comparison between two signed integer expressions?");
2521 signedOperand
= lex
;
2522 unsignedOperand
= rex
;
2523 } else if (rex
->getType()->hasSignedIntegerRepresentation()) {
2524 signedOperand
= rex
;
2525 unsignedOperand
= lex
;
2527 CheckTrivialUnsignedComparison(S
, E
);
2528 return AnalyzeImpConvsInComparison(S
, E
);
2531 // Otherwise, calculate the effective range of the signed operand.
2532 IntRange signedRange
= GetExprRange(S
.Context
, signedOperand
);
2534 // Go ahead and analyze implicit conversions in the operands. Note
2535 // that we skip the implicit conversions on both sides.
2536 AnalyzeImplicitConversions(S
, lex
);
2537 AnalyzeImplicitConversions(S
, rex
);
2539 // If the signed range is non-negative, -Wsign-compare won't fire,
2540 // but we should still check for comparisons which are always true
2542 if (signedRange
.NonNegative
)
2543 return CheckTrivialUnsignedComparison(S
, E
);
2545 // For (in)equality comparisons, if the unsigned operand is a
2546 // constant which cannot collide with a overflowed signed operand,
2547 // then reinterpreting the signed operand as unsigned will not
2548 // change the result of the comparison.
2549 if (E
->isEqualityOp()) {
2550 unsigned comparisonWidth
= S
.Context
.getIntWidth(T
);
2551 IntRange unsignedRange
= GetExprRange(S
.Context
, unsignedOperand
);
2553 // We should never be unable to prove that the unsigned operand is
2555 assert(unsignedRange
.NonNegative
&& "unsigned range includes negative?");
2557 if (unsignedRange
.Width
< comparisonWidth
)
2561 S
.Diag(E
->getOperatorLoc(), diag::warn_mixed_sign_comparison
)
2562 << lex
->getType() << rex
->getType()
2563 << lex
->getSourceRange() << rex
->getSourceRange();
2566 /// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
2567 void DiagnoseImpCast(Sema
&S
, Expr
*E
, QualType T
, unsigned diag
) {
2568 S
.Diag(E
->getExprLoc(), diag
) << E
->getType() << T
<< E
->getSourceRange();
2571 void CheckImplicitConversion(Sema
&S
, Expr
*E
, QualType T
,
2572 bool *ICContext
= 0) {
2573 if (E
->isTypeDependent() || E
->isValueDependent()) return;
2575 const Type
*Source
= S
.Context
.getCanonicalType(E
->getType()).getTypePtr();
2576 const Type
*Target
= S
.Context
.getCanonicalType(T
).getTypePtr();
2577 if (Source
== Target
) return;
2578 if (Target
->isDependentType()) return;
2580 // Never diagnose implicit casts to bool.
2581 if (Target
->isSpecificBuiltinType(BuiltinType::Bool
))
2584 // Strip vector types.
2585 if (isa
<VectorType
>(Source
)) {
2586 if (!isa
<VectorType
>(Target
))
2587 return DiagnoseImpCast(S
, E
, T
, diag::warn_impcast_vector_scalar
);
2589 Source
= cast
<VectorType
>(Source
)->getElementType().getTypePtr();
2590 Target
= cast
<VectorType
>(Target
)->getElementType().getTypePtr();
2593 // Strip complex types.
2594 if (isa
<ComplexType
>(Source
)) {
2595 if (!isa
<ComplexType
>(Target
))
2596 return DiagnoseImpCast(S
, E
, T
, diag::warn_impcast_complex_scalar
);
2598 Source
= cast
<ComplexType
>(Source
)->getElementType().getTypePtr();
2599 Target
= cast
<ComplexType
>(Target
)->getElementType().getTypePtr();
2602 const BuiltinType
*SourceBT
= dyn_cast
<BuiltinType
>(Source
);
2603 const BuiltinType
*TargetBT
= dyn_cast
<BuiltinType
>(Target
);
2605 // If the source is floating point...
2606 if (SourceBT
&& SourceBT
->isFloatingPoint()) {
2607 // ...and the target is floating point...
2608 if (TargetBT
&& TargetBT
->isFloatingPoint()) {
2609 // ...then warn if we're dropping FP rank.
2611 // Builtin FP kinds are ordered by increasing FP rank.
2612 if (SourceBT
->getKind() > TargetBT
->getKind()) {
2613 // Don't warn about float constants that are precisely
2614 // representable in the target type.
2615 Expr::EvalResult result
;
2616 if (E
->Evaluate(result
, S
.Context
)) {
2617 // Value might be a float, a float vector, or a float complex.
2618 if (IsSameFloatAfterCast(result
.Val
,
2619 S
.Context
.getFloatTypeSemantics(QualType(TargetBT
, 0)),
2620 S
.Context
.getFloatTypeSemantics(QualType(SourceBT
, 0))))
2624 DiagnoseImpCast(S
, E
, T
, diag::warn_impcast_float_precision
);
2629 // If the target is integral, always warn.
2630 if ((TargetBT
&& TargetBT
->isInteger()))
2631 // TODO: don't warn for integer values?
2632 DiagnoseImpCast(S
, E
, T
, diag::warn_impcast_float_integer
);
2637 if (!Source
->isIntegerType() || !Target
->isIntegerType())
2640 IntRange SourceRange
= GetExprRange(S
.Context
, E
);
2641 IntRange TargetRange
= IntRange::forCanonicalType(S
.Context
, Target
);
2643 if (SourceRange
.Width
> TargetRange
.Width
) {
2644 // People want to build with -Wshorten-64-to-32 and not -Wconversion
2645 // and by god we'll let them.
2646 if (SourceRange
.Width
== 64 && TargetRange
.Width
== 32)
2647 return DiagnoseImpCast(S
, E
, T
, diag::warn_impcast_integer_64_32
);
2648 return DiagnoseImpCast(S
, E
, T
, diag::warn_impcast_integer_precision
);
2651 if ((TargetRange
.NonNegative
&& !SourceRange
.NonNegative
) ||
2652 (!TargetRange
.NonNegative
&& SourceRange
.NonNegative
&&
2653 SourceRange
.Width
== TargetRange
.Width
)) {
2654 unsigned DiagID
= diag::warn_impcast_integer_sign
;
2656 // Traditionally, gcc has warned about this under -Wsign-compare.
2657 // We also want to warn about it in -Wconversion.
2658 // So if -Wconversion is off, use a completely identical diagnostic
2659 // in the sign-compare group.
2660 // The conditional-checking code will
2662 DiagID
= diag::warn_impcast_integer_sign_conditional
;
2666 return DiagnoseImpCast(S
, E
, T
, DiagID
);
2672 void CheckConditionalOperator(Sema
&S
, ConditionalOperator
*E
, QualType T
);
2674 void CheckConditionalOperand(Sema
&S
, Expr
*E
, QualType T
,
2676 E
= E
->IgnoreParenImpCasts();
2678 if (isa
<ConditionalOperator
>(E
))
2679 return CheckConditionalOperator(S
, cast
<ConditionalOperator
>(E
), T
);
2681 AnalyzeImplicitConversions(S
, E
);
2682 if (E
->getType() != T
)
2683 return CheckImplicitConversion(S
, E
, T
, &ICContext
);
2687 void CheckConditionalOperator(Sema
&S
, ConditionalOperator
*E
, QualType T
) {
2688 AnalyzeImplicitConversions(S
, E
->getCond());
2690 bool Suspicious
= false;
2691 CheckConditionalOperand(S
, E
->getTrueExpr(), T
, Suspicious
);
2692 CheckConditionalOperand(S
, E
->getFalseExpr(), T
, Suspicious
);
2694 // If -Wconversion would have warned about either of the candidates
2695 // for a signedness conversion to the context type...
2696 if (!Suspicious
) return;
2698 // ...but it's currently ignored...
2699 if (S
.Diags
.getDiagnosticLevel(diag::warn_impcast_integer_sign_conditional
))
2702 // ...and -Wsign-compare isn't...
2703 if (!S
.Diags
.getDiagnosticLevel(diag::warn_mixed_sign_conditional
))
2706 // ...then check whether it would have warned about either of the
2707 // candidates for a signedness conversion to the condition type.
2708 if (E
->getType() != T
) {
2710 CheckImplicitConversion(S
, E
->getTrueExpr()->IgnoreParenImpCasts(),
2711 E
->getType(), &Suspicious
);
2713 CheckImplicitConversion(S
, E
->getFalseExpr()->IgnoreParenImpCasts(),
2714 E
->getType(), &Suspicious
);
2719 // If so, emit a diagnostic under -Wsign-compare.
2720 Expr
*lex
= E
->getTrueExpr()->IgnoreParenImpCasts();
2721 Expr
*rex
= E
->getFalseExpr()->IgnoreParenImpCasts();
2722 S
.Diag(E
->getQuestionLoc(), diag::warn_mixed_sign_conditional
)
2723 << lex
->getType() << rex
->getType()
2724 << lex
->getSourceRange() << rex
->getSourceRange();
2727 /// AnalyzeImplicitConversions - Find and report any interesting
2728 /// implicit conversions in the given expression. There are a couple
2729 /// of competing diagnostics here, -Wconversion and -Wsign-compare.
2730 void AnalyzeImplicitConversions(Sema
&S
, Expr
*OrigE
) {
2731 QualType T
= OrigE
->getType();
2732 Expr
*E
= OrigE
->IgnoreParenImpCasts();
2734 // For conditional operators, we analyze the arguments as if they
2735 // were being fed directly into the output.
2736 if (isa
<ConditionalOperator
>(E
)) {
2737 ConditionalOperator
*CO
= cast
<ConditionalOperator
>(E
);
2738 CheckConditionalOperator(S
, CO
, T
);
2742 // Go ahead and check any implicit conversions we might have skipped.
2743 // The non-canonical typecheck is just an optimization;
2744 // CheckImplicitConversion will filter out dead implicit conversions.
2745 if (E
->getType() != T
)
2746 CheckImplicitConversion(S
, E
, T
);
2748 // Now continue drilling into this expression.
2750 // Skip past explicit casts.
2751 if (isa
<ExplicitCastExpr
>(E
)) {
2752 E
= cast
<ExplicitCastExpr
>(E
)->getSubExpr()->IgnoreParenImpCasts();
2753 return AnalyzeImplicitConversions(S
, E
);
2756 // Do a somewhat different check with comparison operators.
2757 if (isa
<BinaryOperator
>(E
) && cast
<BinaryOperator
>(E
)->isComparisonOp())
2758 return AnalyzeComparison(S
, cast
<BinaryOperator
>(E
));
2760 // These break the otherwise-useful invariant below. Fortunately,
2761 // we don't really need to recurse into them, because any internal
2762 // expressions should have been analyzed already when they were
2763 // built into statements.
2764 if (isa
<StmtExpr
>(E
)) return;
2766 // Don't descend into unevaluated contexts.
2767 if (isa
<SizeOfAlignOfExpr
>(E
)) return;
2769 // Now just recurse over the expression's children.
2770 for (Stmt::child_iterator I
= E
->child_begin(), IE
= E
->child_end();
2772 AnalyzeImplicitConversions(S
, cast
<Expr
>(*I
));
2775 } // end anonymous namespace
2777 /// Diagnoses "dangerous" implicit conversions within the given
2778 /// expression (which is a full expression). Implements -Wconversion
2779 /// and -Wsign-compare.
2780 void Sema::CheckImplicitConversions(Expr
*E
) {
2781 // Don't diagnose in unevaluated contexts.
2782 if (ExprEvalContexts
.back().Context
== Sema::Unevaluated
)
2785 // Don't diagnose for value- or type-dependent expressions.
2786 if (E
->isTypeDependent() || E
->isValueDependent())
2789 AnalyzeImplicitConversions(*this, E
);
2792 /// CheckParmsForFunctionDef - Check that the parameters of the given
2793 /// function are appropriate for the definition of a function. This
2794 /// takes care of any checks that cannot be performed on the
2795 /// declaration itself, e.g., that the types of each of the function
2796 /// parameters are complete.
2797 bool Sema::CheckParmsForFunctionDef(FunctionDecl
*FD
) {
2798 bool HasInvalidParm
= false;
2799 for (unsigned p
= 0, NumParams
= FD
->getNumParams(); p
< NumParams
; ++p
) {
2800 ParmVarDecl
*Param
= FD
->getParamDecl(p
);
2802 // C99 6.7.5.3p4: the parameters in a parameter type list in a
2803 // function declarator that is part of a function definition of
2804 // that function shall not have incomplete type.
2806 // This is also C++ [dcl.fct]p6.
2807 if (!Param
->isInvalidDecl() &&
2808 RequireCompleteType(Param
->getLocation(), Param
->getType(),
2809 diag::err_typecheck_decl_incomplete_type
)) {
2810 Param
->setInvalidDecl();
2811 HasInvalidParm
= true;
2814 // C99 6.9.1p5: If the declarator includes a parameter type list, the
2815 // declaration of each parameter shall include an identifier.
2816 if (Param
->getIdentifier() == 0 &&
2817 !Param
->isImplicit() &&
2818 !getLangOptions().CPlusPlus
)
2819 Diag(Param
->getLocation(), diag::err_parameter_name_omitted
);
2822 // If the function declarator is not part of a definition of that
2823 // function, parameters may have incomplete type and may use the [*]
2824 // notation in their sequences of declarator specifiers to specify
2825 // variable length array types.
2826 QualType PType
= Param
->getOriginalType();
2827 if (const ArrayType
*AT
= Context
.getAsArrayType(PType
)) {
2828 if (AT
->getSizeModifier() == ArrayType::Star
) {
2829 // FIXME: This diagnosic should point the the '[*]' if source-location
2830 // information is added for it.
2831 Diag(Param
->getLocation(), diag::err_array_star_in_function_definition
);
2836 return HasInvalidParm
;
2839 /// CheckCastAlign - Implements -Wcast-align, which warns when a
2840 /// pointer cast increases the alignment requirements.
2841 void Sema::CheckCastAlign(Expr
*Op
, QualType T
, SourceRange TRange
) {
2842 // This is actually a lot of work to potentially be doing on every
2843 // cast; don't do it if we're ignoring -Wcast_align (as is the default).
2844 if (getDiagnostics().getDiagnosticLevel(diag::warn_cast_align
)
2845 == Diagnostic::Ignored
)
2848 // Ignore dependent types.
2849 if (T
->isDependentType() || Op
->getType()->isDependentType())
2852 // Require that the destination be a pointer type.
2853 const PointerType
*DestPtr
= T
->getAs
<PointerType
>();
2854 if (!DestPtr
) return;
2856 // If the destination has alignment 1, we're done.
2857 QualType DestPointee
= DestPtr
->getPointeeType();
2858 if (DestPointee
->isIncompleteType()) return;
2859 CharUnits DestAlign
= Context
.getTypeAlignInChars(DestPointee
);
2860 if (DestAlign
.isOne()) return;
2862 // Require that the source be a pointer type.
2863 const PointerType
*SrcPtr
= Op
->getType()->getAs
<PointerType
>();
2864 if (!SrcPtr
) return;
2865 QualType SrcPointee
= SrcPtr
->getPointeeType();
2867 // Whitelist casts from cv void*. We already implicitly
2868 // whitelisted casts to cv void*, since they have alignment 1.
2869 // Also whitelist casts involving incomplete types, which implicitly
2871 if (SrcPointee
->isIncompleteType()) return;
2873 CharUnits SrcAlign
= Context
.getTypeAlignInChars(SrcPointee
);
2874 if (SrcAlign
>= DestAlign
) return;
2876 Diag(TRange
.getBegin(), diag::warn_cast_align
)
2877 << Op
->getType() << T
2878 << static_cast<unsigned>(SrcAlign
.getQuantity())
2879 << static_cast<unsigned>(DestAlign
.getQuantity())
2880 << TRange
<< Op
->getSourceRange();