f7887d41cb
__builtin_constant_p(x) is a compiler builtin that evaluates to 1 when its argument x is a compile-time constant and to 0 otherwise. In CodeGen it is simply lowered to the respective LLVM intrinsic. In the Analyzer we've been trying to delegate modeling to Expr::EvaluateAsInt, which is allowed to sometimes fail for no apparent reason. When it fails, let's conservatively return false. Modeling it as false is pretty much never wrong, and it is only required to return true on a best-effort basis, which every user should expect. Fixes VLAChecker false positives on code that tries to emulate static asserts in C by constructing a VLA of dynamic size -1 under the assumption that this dynamic size is actually a constant in the sense of __builtin_constant_p. Differential Revision: https://reviews.llvm.org/D60110 llvm-svn: 357557
135 lines
4.7 KiB
C++
135 lines
4.7 KiB
C++
//=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This checker evaluates clang builtin functions.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
|
|
#include "clang/Basic/Builtins.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
|
|
class BuiltinFunctionChecker : public Checker<eval::Call> {
|
|
public:
|
|
bool evalCall(const CallExpr *CE, CheckerContext &C) const;
|
|
};
|
|
|
|
}
|
|
|
|
bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
|
|
CheckerContext &C) const {
|
|
ProgramStateRef state = C.getState();
|
|
const FunctionDecl *FD = C.getCalleeDecl(CE);
|
|
const LocationContext *LCtx = C.getLocationContext();
|
|
if (!FD)
|
|
return false;
|
|
|
|
switch (FD->getBuiltinID()) {
|
|
default:
|
|
return false;
|
|
|
|
case Builtin::BI__builtin_assume: {
|
|
assert (CE->arg_begin() != CE->arg_end());
|
|
SVal ArgSVal = C.getSVal(CE->getArg(0));
|
|
if (ArgSVal.isUndef())
|
|
return true; // Return true to model purity.
|
|
|
|
state = state->assume(ArgSVal.castAs<DefinedOrUnknownSVal>(), true);
|
|
// FIXME: do we want to warn here? Not right now. The most reports might
|
|
// come from infeasible paths, thus being false positives.
|
|
if (!state) {
|
|
C.generateSink(C.getState(), C.getPredecessor());
|
|
return true;
|
|
}
|
|
|
|
C.addTransition(state);
|
|
return true;
|
|
}
|
|
|
|
case Builtin::BI__builtin_unpredictable:
|
|
case Builtin::BI__builtin_expect:
|
|
case Builtin::BI__builtin_assume_aligned:
|
|
case Builtin::BI__builtin_addressof: {
|
|
// For __builtin_unpredictable, __builtin_expect, and
|
|
// __builtin_assume_aligned, just return the value of the subexpression.
|
|
// __builtin_addressof is going from a reference to a pointer, but those
|
|
// are represented the same way in the analyzer.
|
|
assert (CE->arg_begin() != CE->arg_end());
|
|
SVal X = C.getSVal(*(CE->arg_begin()));
|
|
C.addTransition(state->BindExpr(CE, LCtx, X));
|
|
return true;
|
|
}
|
|
|
|
case Builtin::BI__builtin_alloca_with_align:
|
|
case Builtin::BI__builtin_alloca: {
|
|
// FIXME: Refactor into StoreManager itself?
|
|
MemRegionManager& RM = C.getStoreManager().getRegionManager();
|
|
const AllocaRegion* R =
|
|
RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
|
|
|
|
// Set the extent of the region in bytes. This enables us to use the
|
|
// SVal of the argument directly. If we save the extent in bits, we
|
|
// cannot represent values like symbol*8.
|
|
auto Size = C.getSVal(*(CE->arg_begin())).castAs<DefinedOrUnknownSVal>();
|
|
|
|
SValBuilder& svalBuilder = C.getSValBuilder();
|
|
DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
|
|
DefinedOrUnknownSVal extentMatchesSizeArg =
|
|
svalBuilder.evalEQ(state, Extent, Size);
|
|
state = state->assume(extentMatchesSizeArg, true);
|
|
assert(state && "The region should not have any previous constraints");
|
|
|
|
C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
|
|
return true;
|
|
}
|
|
|
|
case Builtin::BI__builtin_dynamic_object_size:
|
|
case Builtin::BI__builtin_object_size:
|
|
case Builtin::BI__builtin_constant_p: {
|
|
// This must be resolvable at compile time, so we defer to the constant
|
|
// evaluator for a value.
|
|
SValBuilder &SVB = C.getSValBuilder();
|
|
SVal V = UnknownVal();
|
|
Expr::EvalResult EVResult;
|
|
if (CE->EvaluateAsInt(EVResult, C.getASTContext(), Expr::SE_NoSideEffects)) {
|
|
// Make sure the result has the correct type.
|
|
llvm::APSInt Result = EVResult.Val.getInt();
|
|
BasicValueFactory &BVF = SVB.getBasicValueFactory();
|
|
BVF.getAPSIntType(CE->getType()).apply(Result);
|
|
V = SVB.makeIntVal(Result);
|
|
}
|
|
|
|
if (FD->getBuiltinID() == Builtin::BI__builtin_constant_p) {
|
|
// If we didn't manage to figure out if the value is constant or not,
|
|
// it is safe to assume that it's not constant and unsafe to assume
|
|
// that it's constant.
|
|
if (V.isUnknown())
|
|
V = SVB.makeIntVal(0, CE->getType());
|
|
}
|
|
|
|
C.addTransition(state->BindExpr(CE, LCtx, V));
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
|
|
void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<BuiltinFunctionChecker>();
|
|
}
|
|
|
|
bool ento::shouldRegisterBuiltinFunctionChecker(const LangOptions &LO) {
|
|
return true;
|
|
}
|