clang  3.7.0
SemaChecking.cpp
Go to the documentation of this file.
1 //===--- SemaChecking.cpp - Extra Semantic Checking -----------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file implements extra semantic analysis beyond what is enforced
11 // by the C type system.
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/CharUnits.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/DeclObjC.h"
21 #include "clang/AST/Expr.h"
22 #include "clang/AST/ExprCXX.h"
23 #include "clang/AST/ExprObjC.h"
24 #include "clang/AST/StmtCXX.h"
25 #include "clang/AST/StmtObjC.h"
27 #include "clang/Basic/CharInfo.h"
29 #include "clang/Basic/TargetInfo.h"
30 #include "clang/Lex/Lexer.h" // TODO: Extract static functions to fix layering.
32 #include "clang/Sema/Lookup.h"
33 #include "clang/Sema/ScopeInfo.h"
34 #include "clang/Sema/Sema.h"
35 #include "llvm/ADT/STLExtras.h"
36 #include "llvm/ADT/SmallBitVector.h"
37 #include "llvm/ADT/SmallString.h"
38 #include "llvm/Support/ConvertUTF.h"
39 #include "llvm/Support/raw_ostream.h"
40 #include <limits>
41 using namespace clang;
42 using namespace sema;
43 
45  unsigned ByteNo) const {
46  return SL->getLocationOfByte(ByteNo, getSourceManager(), LangOpts,
48 }
49 
50 /// Checks that a call expression's argument count is the desired number.
51 /// This is useful when doing custom type-checking. Returns true on error.
52 static bool checkArgCount(Sema &S, CallExpr *call, unsigned desiredArgCount) {
53  unsigned argCount = call->getNumArgs();
54  if (argCount == desiredArgCount) return false;
55 
56  if (argCount < desiredArgCount)
57  return S.Diag(call->getLocEnd(), diag::err_typecheck_call_too_few_args)
58  << 0 /*function call*/ << desiredArgCount << argCount
59  << call->getSourceRange();
60 
61  // Highlight all the excess arguments.
62  SourceRange range(call->getArg(desiredArgCount)->getLocStart(),
63  call->getArg(argCount - 1)->getLocEnd());
64 
65  return S.Diag(range.getBegin(), diag::err_typecheck_call_too_many_args)
66  << 0 /*function call*/ << desiredArgCount << argCount
67  << call->getArg(1)->getSourceRange();
68 }
69 
70 /// Check that the first argument to __builtin_annotation is an integer
71 /// and the second argument is a non-wide string literal.
72 static bool SemaBuiltinAnnotation(Sema &S, CallExpr *TheCall) {
73  if (checkArgCount(S, TheCall, 2))
74  return true;
75 
76  // First argument should be an integer.
77  Expr *ValArg = TheCall->getArg(0);
78  QualType Ty = ValArg->getType();
79  if (!Ty->isIntegerType()) {
80  S.Diag(ValArg->getLocStart(), diag::err_builtin_annotation_first_arg)
81  << ValArg->getSourceRange();
82  return true;
83  }
84 
85  // Second argument should be a constant string.
86  Expr *StrArg = TheCall->getArg(1)->IgnoreParenCasts();
87  StringLiteral *Literal = dyn_cast<StringLiteral>(StrArg);
88  if (!Literal || !Literal->isAscii()) {
89  S.Diag(StrArg->getLocStart(), diag::err_builtin_annotation_second_arg)
90  << StrArg->getSourceRange();
91  return true;
92  }
93 
94  TheCall->setType(Ty);
95  return false;
96 }
97 
98 /// Check that the argument to __builtin_addressof is a glvalue, and set the
99 /// result type to the corresponding pointer type.
100 static bool SemaBuiltinAddressof(Sema &S, CallExpr *TheCall) {
101  if (checkArgCount(S, TheCall, 1))
102  return true;
103 
104  ExprResult Arg(TheCall->getArg(0));
105  QualType ResultType = S.CheckAddressOfOperand(Arg, TheCall->getLocStart());
106  if (ResultType.isNull())
107  return true;
108 
109  TheCall->setArg(0, Arg.get());
110  TheCall->setType(ResultType);
111  return false;
112 }
113 
115  CallExpr *TheCall, unsigned SizeIdx,
116  unsigned DstSizeIdx) {
117  if (TheCall->getNumArgs() <= SizeIdx ||
118  TheCall->getNumArgs() <= DstSizeIdx)
119  return;
120 
121  const Expr *SizeArg = TheCall->getArg(SizeIdx);
122  const Expr *DstSizeArg = TheCall->getArg(DstSizeIdx);
123 
124  llvm::APSInt Size, DstSize;
125 
126  // find out if both sizes are known at compile time
127  if (!SizeArg->EvaluateAsInt(Size, S.Context) ||
128  !DstSizeArg->EvaluateAsInt(DstSize, S.Context))
129  return;
130 
131  if (Size.ule(DstSize))
132  return;
133 
134  // confirmed overflow so generate the diagnostic.
135  IdentifierInfo *FnName = FDecl->getIdentifier();
136  SourceLocation SL = TheCall->getLocStart();
137  SourceRange SR = TheCall->getSourceRange();
138 
139  S.Diag(SL, diag::warn_memcpy_chk_overflow) << SR << FnName;
140 }
141 
142 static bool SemaBuiltinCallWithStaticChain(Sema &S, CallExpr *BuiltinCall) {
143  if (checkArgCount(S, BuiltinCall, 2))
144  return true;
145 
146  SourceLocation BuiltinLoc = BuiltinCall->getLocStart();
147  Expr *Builtin = BuiltinCall->getCallee()->IgnoreImpCasts();
148  Expr *Call = BuiltinCall->getArg(0);
149  Expr *Chain = BuiltinCall->getArg(1);
150 
151  if (Call->getStmtClass() != Stmt::CallExprClass) {
152  S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_not_call)
153  << Call->getSourceRange();
154  return true;
155  }
156 
157  auto CE = cast<CallExpr>(Call);
158  if (CE->getCallee()->getType()->isBlockPointerType()) {
159  S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_block_call)
160  << Call->getSourceRange();
161  return true;
162  }
163 
164  const Decl *TargetDecl = CE->getCalleeDecl();
165  if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(TargetDecl))
166  if (FD->getBuiltinID()) {
167  S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_builtin_call)
168  << Call->getSourceRange();
169  return true;
170  }
171 
172  if (isa<CXXPseudoDestructorExpr>(CE->getCallee()->IgnoreParens())) {
173  S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_pdtor_call)
174  << Call->getSourceRange();
175  return true;
176  }
177 
178  ExprResult ChainResult = S.UsualUnaryConversions(Chain);
179  if (ChainResult.isInvalid())
180  return true;
181  if (!ChainResult.get()->getType()->isPointerType()) {
182  S.Diag(BuiltinLoc, diag::err_second_argument_to_cwsc_not_pointer)
183  << Chain->getSourceRange();
184  return true;
185  }
186 
187  QualType ReturnTy = CE->getCallReturnType(S.Context);
188  QualType ArgTys[2] = { ReturnTy, ChainResult.get()->getType() };
189  QualType BuiltinTy = S.Context.getFunctionType(
190  ReturnTy, ArgTys, FunctionProtoType::ExtProtoInfo());
191  QualType BuiltinPtrTy = S.Context.getPointerType(BuiltinTy);
192 
193  Builtin =
194  S.ImpCastExprToType(Builtin, BuiltinPtrTy, CK_BuiltinFnToFnPtr).get();
195 
196  BuiltinCall->setType(CE->getType());
197  BuiltinCall->setValueKind(CE->getValueKind());
198  BuiltinCall->setObjectKind(CE->getObjectKind());
199  BuiltinCall->setCallee(Builtin);
200  BuiltinCall->setArg(1, ChainResult.get());
201 
202  return false;
203 }
204 
205 static bool SemaBuiltinSEHScopeCheck(Sema &SemaRef, CallExpr *TheCall,
206  Scope::ScopeFlags NeededScopeFlags,
207  unsigned DiagID) {
208  // Scopes aren't available during instantiation. Fortunately, builtin
209  // functions cannot be template args so they cannot be formed through template
210  // instantiation. Therefore checking once during the parse is sufficient.
211  if (!SemaRef.ActiveTemplateInstantiations.empty())
212  return false;
213 
214  Scope *S = SemaRef.getCurScope();
215  while (S && !S->isSEHExceptScope())
216  S = S->getParent();
217  if (!S || !(S->getFlags() & NeededScopeFlags)) {
218  auto *DRE = cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
219  SemaRef.Diag(TheCall->getExprLoc(), DiagID)
220  << DRE->getDecl()->getIdentifier();
221  return true;
222  }
223 
224  return false;
225 }
226 
228 Sema::CheckBuiltinFunctionCall(FunctionDecl *FDecl, unsigned BuiltinID,
229  CallExpr *TheCall) {
230  ExprResult TheCallResult(TheCall);
231 
232  // Find out if any arguments are required to be integer constant expressions.
233  unsigned ICEArguments = 0;
235  Context.GetBuiltinType(BuiltinID, Error, &ICEArguments);
236  if (Error != ASTContext::GE_None)
237  ICEArguments = 0; // Don't diagnose previously diagnosed errors.
238 
239  // If any arguments are required to be ICE's, check and diagnose.
240  for (unsigned ArgNo = 0; ICEArguments != 0; ++ArgNo) {
241  // Skip arguments not required to be ICE's.
242  if ((ICEArguments & (1 << ArgNo)) == 0) continue;
243 
244  llvm::APSInt Result;
245  if (SemaBuiltinConstantArg(TheCall, ArgNo, Result))
246  return true;
247  ICEArguments &= ~(1 << ArgNo);
248  }
249 
250  switch (BuiltinID) {
251  case Builtin::BI__builtin___CFStringMakeConstantString:
252  assert(TheCall->getNumArgs() == 1 &&
253  "Wrong # arguments to builtin CFStringMakeConstantString");
254  if (CheckObjCString(TheCall->getArg(0)))
255  return ExprError();
256  break;
257  case Builtin::BI__builtin_stdarg_start:
258  case Builtin::BI__builtin_va_start:
259  if (SemaBuiltinVAStart(TheCall))
260  return ExprError();
261  break;
262  case Builtin::BI__va_start: {
263  switch (Context.getTargetInfo().getTriple().getArch()) {
264  case llvm::Triple::arm:
265  case llvm::Triple::thumb:
266  if (SemaBuiltinVAStartARM(TheCall))
267  return ExprError();
268  break;
269  default:
270  if (SemaBuiltinVAStart(TheCall))
271  return ExprError();
272  break;
273  }
274  break;
275  }
276  case Builtin::BI__builtin_isgreater:
277  case Builtin::BI__builtin_isgreaterequal:
278  case Builtin::BI__builtin_isless:
279  case Builtin::BI__builtin_islessequal:
280  case Builtin::BI__builtin_islessgreater:
281  case Builtin::BI__builtin_isunordered:
282  if (SemaBuiltinUnorderedCompare(TheCall))
283  return ExprError();
284  break;
285  case Builtin::BI__builtin_fpclassify:
286  if (SemaBuiltinFPClassification(TheCall, 6))
287  return ExprError();
288  break;
289  case Builtin::BI__builtin_isfinite:
290  case Builtin::BI__builtin_isinf:
291  case Builtin::BI__builtin_isinf_sign:
292  case Builtin::BI__builtin_isnan:
293  case Builtin::BI__builtin_isnormal:
294  if (SemaBuiltinFPClassification(TheCall, 1))
295  return ExprError();
296  break;
297  case Builtin::BI__builtin_shufflevector:
298  return SemaBuiltinShuffleVector(TheCall);
299  // TheCall will be freed by the smart pointer here, but that's fine, since
300  // SemaBuiltinShuffleVector guts it, but then doesn't release it.
301  case Builtin::BI__builtin_prefetch:
302  if (SemaBuiltinPrefetch(TheCall))
303  return ExprError();
304  break;
305  case Builtin::BI__assume:
306  case Builtin::BI__builtin_assume:
307  if (SemaBuiltinAssume(TheCall))
308  return ExprError();
309  break;
310  case Builtin::BI__builtin_assume_aligned:
311  if (SemaBuiltinAssumeAligned(TheCall))
312  return ExprError();
313  break;
314  case Builtin::BI__builtin_object_size:
315  if (SemaBuiltinConstantArgRange(TheCall, 1, 0, 3))
316  return ExprError();
317  break;
318  case Builtin::BI__builtin_longjmp:
319  if (SemaBuiltinLongjmp(TheCall))
320  return ExprError();
321  break;
322  case Builtin::BI__builtin_setjmp:
323  if (SemaBuiltinSetjmp(TheCall))
324  return ExprError();
325  break;
326  case Builtin::BI_setjmp:
327  case Builtin::BI_setjmpex:
328  if (checkArgCount(*this, TheCall, 1))
329  return true;
330  break;
331 
332  case Builtin::BI__builtin_classify_type:
333  if (checkArgCount(*this, TheCall, 1)) return true;
334  TheCall->setType(Context.IntTy);
335  break;
336  case Builtin::BI__builtin_constant_p:
337  if (checkArgCount(*this, TheCall, 1)) return true;
338  TheCall->setType(Context.IntTy);
339  break;
340  case Builtin::BI__sync_fetch_and_add:
341  case Builtin::BI__sync_fetch_and_add_1:
342  case Builtin::BI__sync_fetch_and_add_2:
343  case Builtin::BI__sync_fetch_and_add_4:
344  case Builtin::BI__sync_fetch_and_add_8:
345  case Builtin::BI__sync_fetch_and_add_16:
346  case Builtin::BI__sync_fetch_and_sub:
347  case Builtin::BI__sync_fetch_and_sub_1:
348  case Builtin::BI__sync_fetch_and_sub_2:
349  case Builtin::BI__sync_fetch_and_sub_4:
350  case Builtin::BI__sync_fetch_and_sub_8:
351  case Builtin::BI__sync_fetch_and_sub_16:
352  case Builtin::BI__sync_fetch_and_or:
353  case Builtin::BI__sync_fetch_and_or_1:
354  case Builtin::BI__sync_fetch_and_or_2:
355  case Builtin::BI__sync_fetch_and_or_4:
356  case Builtin::BI__sync_fetch_and_or_8:
357  case Builtin::BI__sync_fetch_and_or_16:
358  case Builtin::BI__sync_fetch_and_and:
359  case Builtin::BI__sync_fetch_and_and_1:
360  case Builtin::BI__sync_fetch_and_and_2:
361  case Builtin::BI__sync_fetch_and_and_4:
362  case Builtin::BI__sync_fetch_and_and_8:
363  case Builtin::BI__sync_fetch_and_and_16:
364  case Builtin::BI__sync_fetch_and_xor:
365  case Builtin::BI__sync_fetch_and_xor_1:
366  case Builtin::BI__sync_fetch_and_xor_2:
367  case Builtin::BI__sync_fetch_and_xor_4:
368  case Builtin::BI__sync_fetch_and_xor_8:
369  case Builtin::BI__sync_fetch_and_xor_16:
370  case Builtin::BI__sync_fetch_and_nand:
371  case Builtin::BI__sync_fetch_and_nand_1:
372  case Builtin::BI__sync_fetch_and_nand_2:
373  case Builtin::BI__sync_fetch_and_nand_4:
374  case Builtin::BI__sync_fetch_and_nand_8:
375  case Builtin::BI__sync_fetch_and_nand_16:
376  case Builtin::BI__sync_add_and_fetch:
377  case Builtin::BI__sync_add_and_fetch_1:
378  case Builtin::BI__sync_add_and_fetch_2:
379  case Builtin::BI__sync_add_and_fetch_4:
380  case Builtin::BI__sync_add_and_fetch_8:
381  case Builtin::BI__sync_add_and_fetch_16:
382  case Builtin::BI__sync_sub_and_fetch:
383  case Builtin::BI__sync_sub_and_fetch_1:
384  case Builtin::BI__sync_sub_and_fetch_2:
385  case Builtin::BI__sync_sub_and_fetch_4:
386  case Builtin::BI__sync_sub_and_fetch_8:
387  case Builtin::BI__sync_sub_and_fetch_16:
388  case Builtin::BI__sync_and_and_fetch:
389  case Builtin::BI__sync_and_and_fetch_1:
390  case Builtin::BI__sync_and_and_fetch_2:
391  case Builtin::BI__sync_and_and_fetch_4:
392  case Builtin::BI__sync_and_and_fetch_8:
393  case Builtin::BI__sync_and_and_fetch_16:
394  case Builtin::BI__sync_or_and_fetch:
395  case Builtin::BI__sync_or_and_fetch_1:
396  case Builtin::BI__sync_or_and_fetch_2:
397  case Builtin::BI__sync_or_and_fetch_4:
398  case Builtin::BI__sync_or_and_fetch_8:
399  case Builtin::BI__sync_or_and_fetch_16:
400  case Builtin::BI__sync_xor_and_fetch:
401  case Builtin::BI__sync_xor_and_fetch_1:
402  case Builtin::BI__sync_xor_and_fetch_2:
403  case Builtin::BI__sync_xor_and_fetch_4:
404  case Builtin::BI__sync_xor_and_fetch_8:
405  case Builtin::BI__sync_xor_and_fetch_16:
406  case Builtin::BI__sync_nand_and_fetch:
407  case Builtin::BI__sync_nand_and_fetch_1:
408  case Builtin::BI__sync_nand_and_fetch_2:
409  case Builtin::BI__sync_nand_and_fetch_4:
410  case Builtin::BI__sync_nand_and_fetch_8:
411  case Builtin::BI__sync_nand_and_fetch_16:
412  case Builtin::BI__sync_val_compare_and_swap:
413  case Builtin::BI__sync_val_compare_and_swap_1:
414  case Builtin::BI__sync_val_compare_and_swap_2:
415  case Builtin::BI__sync_val_compare_and_swap_4:
416  case Builtin::BI__sync_val_compare_and_swap_8:
417  case Builtin::BI__sync_val_compare_and_swap_16:
418  case Builtin::BI__sync_bool_compare_and_swap:
419  case Builtin::BI__sync_bool_compare_and_swap_1:
420  case Builtin::BI__sync_bool_compare_and_swap_2:
421  case Builtin::BI__sync_bool_compare_and_swap_4:
422  case Builtin::BI__sync_bool_compare_and_swap_8:
423  case Builtin::BI__sync_bool_compare_and_swap_16:
424  case Builtin::BI__sync_lock_test_and_set:
425  case Builtin::BI__sync_lock_test_and_set_1:
426  case Builtin::BI__sync_lock_test_and_set_2:
427  case Builtin::BI__sync_lock_test_and_set_4:
428  case Builtin::BI__sync_lock_test_and_set_8:
429  case Builtin::BI__sync_lock_test_and_set_16:
430  case Builtin::BI__sync_lock_release:
431  case Builtin::BI__sync_lock_release_1:
432  case Builtin::BI__sync_lock_release_2:
433  case Builtin::BI__sync_lock_release_4:
434  case Builtin::BI__sync_lock_release_8:
435  case Builtin::BI__sync_lock_release_16:
436  case Builtin::BI__sync_swap:
437  case Builtin::BI__sync_swap_1:
438  case Builtin::BI__sync_swap_2:
439  case Builtin::BI__sync_swap_4:
440  case Builtin::BI__sync_swap_8:
441  case Builtin::BI__sync_swap_16:
442  return SemaBuiltinAtomicOverloaded(TheCallResult);
443 #define BUILTIN(ID, TYPE, ATTRS)
444 #define ATOMIC_BUILTIN(ID, TYPE, ATTRS) \
445  case Builtin::BI##ID: \
446  return SemaAtomicOpsOverloaded(TheCallResult, AtomicExpr::AO##ID);
447 #include "clang/Basic/Builtins.def"
448  case Builtin::BI__builtin_annotation:
449  if (SemaBuiltinAnnotation(*this, TheCall))
450  return ExprError();
451  break;
452  case Builtin::BI__builtin_addressof:
453  if (SemaBuiltinAddressof(*this, TheCall))
454  return ExprError();
455  break;
456  case Builtin::BI__builtin_operator_new:
457  case Builtin::BI__builtin_operator_delete:
458  if (!getLangOpts().CPlusPlus) {
459  Diag(TheCall->getExprLoc(), diag::err_builtin_requires_language)
460  << (BuiltinID == Builtin::BI__builtin_operator_new
461  ? "__builtin_operator_new"
462  : "__builtin_operator_delete")
463  << "C++";
464  return ExprError();
465  }
466  // CodeGen assumes it can find the global new and delete to call,
467  // so ensure that they are declared.
468  DeclareGlobalNewDelete();
469  break;
470 
471  // check secure string manipulation functions where overflows
472  // are detectable at compile time
473  case Builtin::BI__builtin___memcpy_chk:
474  case Builtin::BI__builtin___memmove_chk:
475  case Builtin::BI__builtin___memset_chk:
476  case Builtin::BI__builtin___strlcat_chk:
477  case Builtin::BI__builtin___strlcpy_chk:
478  case Builtin::BI__builtin___strncat_chk:
479  case Builtin::BI__builtin___strncpy_chk:
480  case Builtin::BI__builtin___stpncpy_chk:
481  SemaBuiltinMemChkCall(*this, FDecl, TheCall, 2, 3);
482  break;
483  case Builtin::BI__builtin___memccpy_chk:
484  SemaBuiltinMemChkCall(*this, FDecl, TheCall, 3, 4);
485  break;
486  case Builtin::BI__builtin___snprintf_chk:
487  case Builtin::BI__builtin___vsnprintf_chk:
488  SemaBuiltinMemChkCall(*this, FDecl, TheCall, 1, 3);
489  break;
490 
491  case Builtin::BI__builtin_call_with_static_chain:
492  if (SemaBuiltinCallWithStaticChain(*this, TheCall))
493  return ExprError();
494  break;
495 
496  case Builtin::BI__exception_code:
497  case Builtin::BI_exception_code: {
499  diag::err_seh___except_block))
500  return ExprError();
501  break;
502  }
503  case Builtin::BI__exception_info:
504  case Builtin::BI_exception_info: {
506  diag::err_seh___except_filter))
507  return ExprError();
508  break;
509  }
510 
511  case Builtin::BI__GetExceptionInfo:
512  if (checkArgCount(*this, TheCall, 1))
513  return ExprError();
514 
515  if (CheckCXXThrowOperand(
516  TheCall->getLocStart(),
518  TheCall))
519  return ExprError();
520 
521  TheCall->setType(Context.VoidPtrTy);
522  break;
523 
524  }
525 
526  // Since the target specific builtins for each arch overlap, only check those
527  // of the arch we are compiling for.
528  if (BuiltinID >= Builtin::FirstTSBuiltin) {
529  switch (Context.getTargetInfo().getTriple().getArch()) {
530  case llvm::Triple::arm:
531  case llvm::Triple::armeb:
532  case llvm::Triple::thumb:
533  case llvm::Triple::thumbeb:
534  if (CheckARMBuiltinFunctionCall(BuiltinID, TheCall))
535  return ExprError();
536  break;
537  case llvm::Triple::aarch64:
538  case llvm::Triple::aarch64_be:
539  if (CheckAArch64BuiltinFunctionCall(BuiltinID, TheCall))
540  return ExprError();
541  break;
542  case llvm::Triple::mips:
543  case llvm::Triple::mipsel:
544  case llvm::Triple::mips64:
545  case llvm::Triple::mips64el:
546  if (CheckMipsBuiltinFunctionCall(BuiltinID, TheCall))
547  return ExprError();
548  break;
549  case llvm::Triple::systemz:
550  if (CheckSystemZBuiltinFunctionCall(BuiltinID, TheCall))
551  return ExprError();
552  break;
553  case llvm::Triple::x86:
554  case llvm::Triple::x86_64:
555  if (CheckX86BuiltinFunctionCall(BuiltinID, TheCall))
556  return ExprError();
557  break;
558  case llvm::Triple::ppc:
559  case llvm::Triple::ppc64:
560  case llvm::Triple::ppc64le:
561  if (CheckPPCBuiltinFunctionCall(BuiltinID, TheCall))
562  return ExprError();
563  break;
564  default:
565  break;
566  }
567  }
568 
569  return TheCallResult;
570 }
571 
572 // Get the valid immediate range for the specified NEON type code.
573 static unsigned RFT(unsigned t, bool shift = false, bool ForceQuad = false) {
574  NeonTypeFlags Type(t);
575  int IsQuad = ForceQuad ? true : Type.isQuad();
576  switch (Type.getEltType()) {
577  case NeonTypeFlags::Int8:
579  return shift ? 7 : (8 << IsQuad) - 1;
582  return shift ? 15 : (4 << IsQuad) - 1;
584  return shift ? 31 : (2 << IsQuad) - 1;
587  return shift ? 63 : (1 << IsQuad) - 1;
589  return shift ? 127 : (1 << IsQuad) - 1;
591  assert(!shift && "cannot shift float types!");
592  return (4 << IsQuad) - 1;
594  assert(!shift && "cannot shift float types!");
595  return (2 << IsQuad) - 1;
597  assert(!shift && "cannot shift float types!");
598  return (1 << IsQuad) - 1;
599  }
600  llvm_unreachable("Invalid NeonTypeFlag!");
601 }
602 
603 /// getNeonEltType - Return the QualType corresponding to the elements of
604 /// the vector type specified by the NeonTypeFlags. This is used to check
605 /// the pointer arguments for Neon load/store intrinsics.
607  bool IsPolyUnsigned, bool IsInt64Long) {
608  switch (Flags.getEltType()) {
609  case NeonTypeFlags::Int8:
610  return Flags.isUnsigned() ? Context.UnsignedCharTy : Context.SignedCharTy;
612  return Flags.isUnsigned() ? Context.UnsignedShortTy : Context.ShortTy;
614  return Flags.isUnsigned() ? Context.UnsignedIntTy : Context.IntTy;
616  if (IsInt64Long)
617  return Flags.isUnsigned() ? Context.UnsignedLongTy : Context.LongTy;
618  else
619  return Flags.isUnsigned() ? Context.UnsignedLongLongTy
620  : Context.LongLongTy;
622  return IsPolyUnsigned ? Context.UnsignedCharTy : Context.SignedCharTy;
624  return IsPolyUnsigned ? Context.UnsignedShortTy : Context.ShortTy;
626  if (IsInt64Long)
627  return Context.UnsignedLongTy;
628  else
629  return Context.UnsignedLongLongTy;
631  break;
633  return Context.HalfTy;
635  return Context.FloatTy;
637  return Context.DoubleTy;
638  }
639  llvm_unreachable("Invalid NeonTypeFlag!");
640 }
641 
642 bool Sema::CheckNeonBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
643  llvm::APSInt Result;
644  uint64_t mask = 0;
645  unsigned TV = 0;
646  int PtrArgNum = -1;
647  bool HasConstPtr = false;
648  switch (BuiltinID) {
649 #define GET_NEON_OVERLOAD_CHECK
650 #include "clang/Basic/arm_neon.inc"
651 #undef GET_NEON_OVERLOAD_CHECK
652  }
653 
654  // For NEON intrinsics which are overloaded on vector element type, validate
655  // the immediate which specifies which variant to emit.
656  unsigned ImmArg = TheCall->getNumArgs()-1;
657  if (mask) {
658  if (SemaBuiltinConstantArg(TheCall, ImmArg, Result))
659  return true;
660 
661  TV = Result.getLimitedValue(64);
662  if ((TV > 63) || (mask & (1ULL << TV)) == 0)
663  return Diag(TheCall->getLocStart(), diag::err_invalid_neon_type_code)
664  << TheCall->getArg(ImmArg)->getSourceRange();
665  }
666 
667  if (PtrArgNum >= 0) {
668  // Check that pointer arguments have the specified type.
669  Expr *Arg = TheCall->getArg(PtrArgNum);
670  if (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg))
671  Arg = ICE->getSubExpr();
672  ExprResult RHS = DefaultFunctionArrayLvalueConversion(Arg);
673  QualType RHSTy = RHS.get()->getType();
674 
675  llvm::Triple::ArchType Arch = Context.getTargetInfo().getTriple().getArch();
676  bool IsPolyUnsigned = Arch == llvm::Triple::aarch64;
677  bool IsInt64Long =
679  QualType EltTy =
680  getNeonEltType(NeonTypeFlags(TV), Context, IsPolyUnsigned, IsInt64Long);
681  if (HasConstPtr)
682  EltTy = EltTy.withConst();
683  QualType LHSTy = Context.getPointerType(EltTy);
684  AssignConvertType ConvTy;
685  ConvTy = CheckSingleAssignmentConstraints(LHSTy, RHS);
686  if (RHS.isInvalid())
687  return true;
688  if (DiagnoseAssignmentResult(ConvTy, Arg->getLocStart(), LHSTy, RHSTy,
689  RHS.get(), AA_Assigning))
690  return true;
691  }
692 
693  // For NEON intrinsics which take an immediate value as part of the
694  // instruction, range check them here.
695  unsigned i = 0, l = 0, u = 0;
696  switch (BuiltinID) {
697  default:
698  return false;
699 #define GET_NEON_IMMEDIATE_CHECK
700 #include "clang/Basic/arm_neon.inc"
701 #undef GET_NEON_IMMEDIATE_CHECK
702  }
703 
704  return SemaBuiltinConstantArgRange(TheCall, i, l, u + l);
705 }
706 
707 bool Sema::CheckARMBuiltinExclusiveCall(unsigned BuiltinID, CallExpr *TheCall,
708  unsigned MaxWidth) {
709  assert((BuiltinID == ARM::BI__builtin_arm_ldrex ||
710  BuiltinID == ARM::BI__builtin_arm_ldaex ||
711  BuiltinID == ARM::BI__builtin_arm_strex ||
712  BuiltinID == ARM::BI__builtin_arm_stlex ||
713  BuiltinID == AArch64::BI__builtin_arm_ldrex ||
714  BuiltinID == AArch64::BI__builtin_arm_ldaex ||
715  BuiltinID == AArch64::BI__builtin_arm_strex ||
716  BuiltinID == AArch64::BI__builtin_arm_stlex) &&
717  "unexpected ARM builtin");
718  bool IsLdrex = BuiltinID == ARM::BI__builtin_arm_ldrex ||
719  BuiltinID == ARM::BI__builtin_arm_ldaex ||
720  BuiltinID == AArch64::BI__builtin_arm_ldrex ||
721  BuiltinID == AArch64::BI__builtin_arm_ldaex;
722 
723  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
724 
725  // Ensure that we have the proper number of arguments.
726  if (checkArgCount(*this, TheCall, IsLdrex ? 1 : 2))
727  return true;
728 
729  // Inspect the pointer argument of the atomic builtin. This should always be
730  // a pointer type, whose element is an integral scalar or pointer type.
731  // Because it is a pointer type, we don't have to worry about any implicit
732  // casts here.
733  Expr *PointerArg = TheCall->getArg(IsLdrex ? 0 : 1);
734  ExprResult PointerArgRes = DefaultFunctionArrayLvalueConversion(PointerArg);
735  if (PointerArgRes.isInvalid())
736  return true;
737  PointerArg = PointerArgRes.get();
738 
739  const PointerType *pointerType = PointerArg->getType()->getAs<PointerType>();
740  if (!pointerType) {
741  Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
742  << PointerArg->getType() << PointerArg->getSourceRange();
743  return true;
744  }
745 
746  // ldrex takes a "const volatile T*" and strex takes a "volatile T*". Our next
747  // task is to insert the appropriate casts into the AST. First work out just
748  // what the appropriate type is.
749  QualType ValType = pointerType->getPointeeType();
750  QualType AddrType = ValType.getUnqualifiedType().withVolatile();
751  if (IsLdrex)
752  AddrType.addConst();
753 
754  // Issue a warning if the cast is dodgy.
755  CastKind CastNeeded = CK_NoOp;
756  if (!AddrType.isAtLeastAsQualifiedAs(ValType)) {
757  CastNeeded = CK_BitCast;
758  Diag(DRE->getLocStart(), diag::ext_typecheck_convert_discards_qualifiers)
759  << PointerArg->getType()
760  << Context.getPointerType(AddrType)
761  << AA_Passing << PointerArg->getSourceRange();
762  }
763 
764  // Finally, do the cast and replace the argument with the corrected version.
765  AddrType = Context.getPointerType(AddrType);
766  PointerArgRes = ImpCastExprToType(PointerArg, AddrType, CastNeeded);
767  if (PointerArgRes.isInvalid())
768  return true;
769  PointerArg = PointerArgRes.get();
770 
771  TheCall->setArg(IsLdrex ? 0 : 1, PointerArg);
772 
773  // In general, we allow ints, floats and pointers to be loaded and stored.
774  if (!ValType->isIntegerType() && !ValType->isAnyPointerType() &&
775  !ValType->isBlockPointerType() && !ValType->isFloatingType()) {
776  Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intfltptr)
777  << PointerArg->getType() << PointerArg->getSourceRange();
778  return true;
779  }
780 
781  // But ARM doesn't have instructions to deal with 128-bit versions.
782  if (Context.getTypeSize(ValType) > MaxWidth) {
783  assert(MaxWidth == 64 && "Diagnostic unexpectedly inaccurate");
784  Diag(DRE->getLocStart(), diag::err_atomic_exclusive_builtin_pointer_size)
785  << PointerArg->getType() << PointerArg->getSourceRange();
786  return true;
787  }
788 
789  switch (ValType.getObjCLifetime()) {
792  // okay
793  break;
794 
798  Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership)
799  << ValType << PointerArg->getSourceRange();
800  return true;
801  }
802 
803 
804  if (IsLdrex) {
805  TheCall->setType(ValType);
806  return false;
807  }
808 
809  // Initialize the argument to be stored.
810  ExprResult ValArg = TheCall->getArg(0);
812  Context, ValType, /*consume*/ false);
813  ValArg = PerformCopyInitialization(Entity, SourceLocation(), ValArg);
814  if (ValArg.isInvalid())
815  return true;
816  TheCall->setArg(0, ValArg.get());
817 
818  // __builtin_arm_strex always returns an int. It's marked as such in the .def,
819  // but the custom checker bypasses all default analysis.
820  TheCall->setType(Context.IntTy);
821  return false;
822 }
823 
824 bool Sema::CheckARMBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
825  llvm::APSInt Result;
826 
827  if (BuiltinID == ARM::BI__builtin_arm_ldrex ||
828  BuiltinID == ARM::BI__builtin_arm_ldaex ||
829  BuiltinID == ARM::BI__builtin_arm_strex ||
830  BuiltinID == ARM::BI__builtin_arm_stlex) {
831  return CheckARMBuiltinExclusiveCall(BuiltinID, TheCall, 64);
832  }
833 
834  if (BuiltinID == ARM::BI__builtin_arm_prefetch) {
835  return SemaBuiltinConstantArgRange(TheCall, 1, 0, 1) ||
836  SemaBuiltinConstantArgRange(TheCall, 2, 0, 1);
837  }
838 
839  if (BuiltinID == ARM::BI__builtin_arm_rsr64 ||
840  BuiltinID == ARM::BI__builtin_arm_wsr64)
841  return SemaBuiltinARMSpecialReg(BuiltinID, TheCall, 0, 3, false);
842 
843  if (BuiltinID == ARM::BI__builtin_arm_rsr ||
844  BuiltinID == ARM::BI__builtin_arm_rsrp ||
845  BuiltinID == ARM::BI__builtin_arm_wsr ||
846  BuiltinID == ARM::BI__builtin_arm_wsrp)
847  return SemaBuiltinARMSpecialReg(BuiltinID, TheCall, 0, 5, true);
848 
849  if (CheckNeonBuiltinFunctionCall(BuiltinID, TheCall))
850  return true;
851 
852  // For intrinsics which take an immediate value as part of the instruction,
853  // range check them here.
854  unsigned i = 0, l = 0, u = 0;
855  switch (BuiltinID) {
856  default: return false;
857  case ARM::BI__builtin_arm_ssat: i = 1; l = 1; u = 31; break;
858  case ARM::BI__builtin_arm_usat: i = 1; u = 31; break;
859  case ARM::BI__builtin_arm_vcvtr_f:
860  case ARM::BI__builtin_arm_vcvtr_d: i = 1; u = 1; break;
861  case ARM::BI__builtin_arm_dmb:
862  case ARM::BI__builtin_arm_dsb:
863  case ARM::BI__builtin_arm_isb:
864  case ARM::BI__builtin_arm_dbg: l = 0; u = 15; break;
865  }
866 
867  // FIXME: VFP Intrinsics should error if VFP not present.
868  return SemaBuiltinConstantArgRange(TheCall, i, l, u + l);
869 }
870 
871 bool Sema::CheckAArch64BuiltinFunctionCall(unsigned BuiltinID,
872  CallExpr *TheCall) {
873  llvm::APSInt Result;
874 
875  if (BuiltinID == AArch64::BI__builtin_arm_ldrex ||
876  BuiltinID == AArch64::BI__builtin_arm_ldaex ||
877  BuiltinID == AArch64::BI__builtin_arm_strex ||
878  BuiltinID == AArch64::BI__builtin_arm_stlex) {
879  return CheckARMBuiltinExclusiveCall(BuiltinID, TheCall, 128);
880  }
881 
882  if (BuiltinID == AArch64::BI__builtin_arm_prefetch) {
883  return SemaBuiltinConstantArgRange(TheCall, 1, 0, 1) ||
884  SemaBuiltinConstantArgRange(TheCall, 2, 0, 2) ||
885  SemaBuiltinConstantArgRange(TheCall, 3, 0, 1) ||
886  SemaBuiltinConstantArgRange(TheCall, 4, 0, 1);
887  }
888 
889  if (BuiltinID == AArch64::BI__builtin_arm_rsr64 ||
890  BuiltinID == AArch64::BI__builtin_arm_wsr64)
891  return SemaBuiltinARMSpecialReg(BuiltinID, TheCall, 0, 5, false);
892 
893  if (BuiltinID == AArch64::BI__builtin_arm_rsr ||
894  BuiltinID == AArch64::BI__builtin_arm_rsrp ||
895  BuiltinID == AArch64::BI__builtin_arm_wsr ||
896  BuiltinID == AArch64::BI__builtin_arm_wsrp)
897  return SemaBuiltinARMSpecialReg(BuiltinID, TheCall, 0, 5, true);
898 
899  if (CheckNeonBuiltinFunctionCall(BuiltinID, TheCall))
900  return true;
901 
902  // For intrinsics which take an immediate value as part of the instruction,
903  // range check them here.
904  unsigned i = 0, l = 0, u = 0;
905  switch (BuiltinID) {
906  default: return false;
907  case AArch64::BI__builtin_arm_dmb:
908  case AArch64::BI__builtin_arm_dsb:
909  case AArch64::BI__builtin_arm_isb: l = 0; u = 15; break;
910  }
911 
912  return SemaBuiltinConstantArgRange(TheCall, i, l, u + l);
913 }
914 
915 bool Sema::CheckMipsBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
916  unsigned i = 0, l = 0, u = 0;
917  switch (BuiltinID) {
918  default: return false;
919  case Mips::BI__builtin_mips_wrdsp: i = 1; l = 0; u = 63; break;
920  case Mips::BI__builtin_mips_rddsp: i = 0; l = 0; u = 63; break;
921  case Mips::BI__builtin_mips_append: i = 2; l = 0; u = 31; break;
922  case Mips::BI__builtin_mips_balign: i = 2; l = 0; u = 3; break;
923  case Mips::BI__builtin_mips_precr_sra_ph_w: i = 2; l = 0; u = 31; break;
924  case Mips::BI__builtin_mips_precr_sra_r_ph_w: i = 2; l = 0; u = 31; break;
925  case Mips::BI__builtin_mips_prepend: i = 2; l = 0; u = 31; break;
926  }
927 
928  return SemaBuiltinConstantArgRange(TheCall, i, l, u);
929 }
930 
931 bool Sema::CheckPPCBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
932  unsigned i = 0, l = 0, u = 0;
933  bool Is64BitBltin = BuiltinID == PPC::BI__builtin_divde ||
934  BuiltinID == PPC::BI__builtin_divdeu ||
935  BuiltinID == PPC::BI__builtin_bpermd;
936  bool IsTarget64Bit = Context.getTargetInfo()
938  .getTargetInfo()
939  .getIntPtrType()) == 64;
940  bool IsBltinExtDiv = BuiltinID == PPC::BI__builtin_divwe ||
941  BuiltinID == PPC::BI__builtin_divweu ||
942  BuiltinID == PPC::BI__builtin_divde ||
943  BuiltinID == PPC::BI__builtin_divdeu;
944 
945  if (Is64BitBltin && !IsTarget64Bit)
946  return Diag(TheCall->getLocStart(), diag::err_64_bit_builtin_32_bit_tgt)
947  << TheCall->getSourceRange();
948 
949  if ((IsBltinExtDiv && !Context.getTargetInfo().hasFeature("extdiv")) ||
950  (BuiltinID == PPC::BI__builtin_bpermd &&
951  !Context.getTargetInfo().hasFeature("bpermd")))
952  return Diag(TheCall->getLocStart(), diag::err_ppc_builtin_only_on_pwr7)
953  << TheCall->getSourceRange();
954 
955  switch (BuiltinID) {
956  default: return false;
957  case PPC::BI__builtin_altivec_crypto_vshasigmaw:
958  case PPC::BI__builtin_altivec_crypto_vshasigmad:
959  return SemaBuiltinConstantArgRange(TheCall, 1, 0, 1) ||
960  SemaBuiltinConstantArgRange(TheCall, 2, 0, 15);
961  case PPC::BI__builtin_tbegin:
962  case PPC::BI__builtin_tend: i = 0; l = 0; u = 1; break;
963  case PPC::BI__builtin_tsr: i = 0; l = 0; u = 7; break;
964  case PPC::BI__builtin_tabortwc:
965  case PPC::BI__builtin_tabortdc: i = 0; l = 0; u = 31; break;
966  case PPC::BI__builtin_tabortwci:
967  case PPC::BI__builtin_tabortdci:
968  return SemaBuiltinConstantArgRange(TheCall, 0, 0, 31) ||
969  SemaBuiltinConstantArgRange(TheCall, 2, 0, 31);
970  }
971  return SemaBuiltinConstantArgRange(TheCall, i, l, u);
972 }
973 
974 bool Sema::CheckSystemZBuiltinFunctionCall(unsigned BuiltinID,
975  CallExpr *TheCall) {
976  if (BuiltinID == SystemZ::BI__builtin_tabort) {
977  Expr *Arg = TheCall->getArg(0);
978  llvm::APSInt AbortCode(32);
979  if (Arg->isIntegerConstantExpr(AbortCode, Context) &&
980  AbortCode.getSExtValue() >= 0 && AbortCode.getSExtValue() < 256)
981  return Diag(Arg->getLocStart(), diag::err_systemz_invalid_tabort_code)
982  << Arg->getSourceRange();
983  }
984 
985  // For intrinsics which take an immediate value as part of the instruction,
986  // range check them here.
987  unsigned i = 0, l = 0, u = 0;
988  switch (BuiltinID) {
989  default: return false;
990  case SystemZ::BI__builtin_s390_lcbb: i = 1; l = 0; u = 15; break;
991  case SystemZ::BI__builtin_s390_verimb:
992  case SystemZ::BI__builtin_s390_verimh:
993  case SystemZ::BI__builtin_s390_verimf:
994  case SystemZ::BI__builtin_s390_verimg: i = 3; l = 0; u = 255; break;
995  case SystemZ::BI__builtin_s390_vfaeb:
996  case SystemZ::BI__builtin_s390_vfaeh:
997  case SystemZ::BI__builtin_s390_vfaef:
998  case SystemZ::BI__builtin_s390_vfaebs:
999  case SystemZ::BI__builtin_s390_vfaehs:
1000  case SystemZ::BI__builtin_s390_vfaefs:
1001  case SystemZ::BI__builtin_s390_vfaezb:
1002  case SystemZ::BI__builtin_s390_vfaezh:
1003  case SystemZ::BI__builtin_s390_vfaezf:
1004  case SystemZ::BI__builtin_s390_vfaezbs:
1005  case SystemZ::BI__builtin_s390_vfaezhs:
1006  case SystemZ::BI__builtin_s390_vfaezfs: i = 2; l = 0; u = 15; break;
1007  case SystemZ::BI__builtin_s390_vfidb:
1008  return SemaBuiltinConstantArgRange(TheCall, 1, 0, 15) ||
1009  SemaBuiltinConstantArgRange(TheCall, 2, 0, 15);
1010  case SystemZ::BI__builtin_s390_vftcidb: i = 1; l = 0; u = 4095; break;
1011  case SystemZ::BI__builtin_s390_vlbb: i = 1; l = 0; u = 15; break;
1012  case SystemZ::BI__builtin_s390_vpdi: i = 2; l = 0; u = 15; break;
1013  case SystemZ::BI__builtin_s390_vsldb: i = 2; l = 0; u = 15; break;
1014  case SystemZ::BI__builtin_s390_vstrcb:
1015  case SystemZ::BI__builtin_s390_vstrch:
1016  case SystemZ::BI__builtin_s390_vstrcf:
1017  case SystemZ::BI__builtin_s390_vstrczb:
1018  case SystemZ::BI__builtin_s390_vstrczh:
1019  case SystemZ::BI__builtin_s390_vstrczf:
1020  case SystemZ::BI__builtin_s390_vstrcbs:
1021  case SystemZ::BI__builtin_s390_vstrchs:
1022  case SystemZ::BI__builtin_s390_vstrcfs:
1023  case SystemZ::BI__builtin_s390_vstrczbs:
1024  case SystemZ::BI__builtin_s390_vstrczhs:
1025  case SystemZ::BI__builtin_s390_vstrczfs: i = 3; l = 0; u = 15; break;
1026  }
1027  return SemaBuiltinConstantArgRange(TheCall, i, l, u);
1028 }
1029 
1030 bool Sema::CheckX86BuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall) {
1031  unsigned i = 0, l = 0, u = 0;
1032  switch (BuiltinID) {
1033  default: return false;
1034  case X86::BI__builtin_cpu_supports:
1035  return SemaBuiltinCpuSupports(TheCall);
1036  case X86::BI_mm_prefetch: i = 1; l = 0; u = 3; break;
1037  case X86::BI__builtin_ia32_sha1rnds4: i = 2, l = 0; u = 3; break;
1038  case X86::BI__builtin_ia32_vpermil2pd:
1039  case X86::BI__builtin_ia32_vpermil2pd256:
1040  case X86::BI__builtin_ia32_vpermil2ps:
1041  case X86::BI__builtin_ia32_vpermil2ps256: i = 3, l = 0; u = 3; break;
1042  case X86::BI__builtin_ia32_cmpb128_mask:
1043  case X86::BI__builtin_ia32_cmpw128_mask:
1044  case X86::BI__builtin_ia32_cmpd128_mask:
1045  case X86::BI__builtin_ia32_cmpq128_mask:
1046  case X86::BI__builtin_ia32_cmpb256_mask:
1047  case X86::BI__builtin_ia32_cmpw256_mask:
1048  case X86::BI__builtin_ia32_cmpd256_mask:
1049  case X86::BI__builtin_ia32_cmpq256_mask:
1050  case X86::BI__builtin_ia32_cmpb512_mask:
1051  case X86::BI__builtin_ia32_cmpw512_mask:
1052  case X86::BI__builtin_ia32_cmpd512_mask:
1053  case X86::BI__builtin_ia32_cmpq512_mask:
1054  case X86::BI__builtin_ia32_ucmpb128_mask:
1055  case X86::BI__builtin_ia32_ucmpw128_mask:
1056  case X86::BI__builtin_ia32_ucmpd128_mask:
1057  case X86::BI__builtin_ia32_ucmpq128_mask:
1058  case X86::BI__builtin_ia32_ucmpb256_mask:
1059  case X86::BI__builtin_ia32_ucmpw256_mask:
1060  case X86::BI__builtin_ia32_ucmpd256_mask:
1061  case X86::BI__builtin_ia32_ucmpq256_mask:
1062  case X86::BI__builtin_ia32_ucmpb512_mask:
1063  case X86::BI__builtin_ia32_ucmpw512_mask:
1064  case X86::BI__builtin_ia32_ucmpd512_mask:
1065  case X86::BI__builtin_ia32_ucmpq512_mask: i = 2; l = 0; u = 7; break;
1066  case X86::BI__builtin_ia32_roundps:
1067  case X86::BI__builtin_ia32_roundpd:
1068  case X86::BI__builtin_ia32_roundps256:
1069  case X86::BI__builtin_ia32_roundpd256: i = 1, l = 0; u = 15; break;
1070  case X86::BI__builtin_ia32_roundss:
1071  case X86::BI__builtin_ia32_roundsd: i = 2, l = 0; u = 15; break;
1072  case X86::BI__builtin_ia32_cmpps:
1073  case X86::BI__builtin_ia32_cmpss:
1074  case X86::BI__builtin_ia32_cmppd:
1075  case X86::BI__builtin_ia32_cmpsd:
1076  case X86::BI__builtin_ia32_cmpps256:
1077  case X86::BI__builtin_ia32_cmppd256:
1078  case X86::BI__builtin_ia32_cmpps512_mask:
1079  case X86::BI__builtin_ia32_cmppd512_mask: i = 2; l = 0; u = 31; break;
1080  case X86::BI__builtin_ia32_vpcomub:
1081  case X86::BI__builtin_ia32_vpcomuw:
1082  case X86::BI__builtin_ia32_vpcomud:
1083  case X86::BI__builtin_ia32_vpcomuq:
1084  case X86::BI__builtin_ia32_vpcomb:
1085  case X86::BI__builtin_ia32_vpcomw:
1086  case X86::BI__builtin_ia32_vpcomd:
1087  case X86::BI__builtin_ia32_vpcomq: i = 2; l = 0; u = 7; break;
1088  }
1089  return SemaBuiltinConstantArgRange(TheCall, i, l, u);
1090 }
1091 
1092 /// Given a FunctionDecl's FormatAttr, attempts to populate the FomatStringInfo
1093 /// parameter with the FormatAttr's correct format_idx and firstDataArg.
1094 /// Returns true when the format fits the function and the FormatStringInfo has
1095 /// been populated.
1096 bool Sema::getFormatStringInfo(const FormatAttr *Format, bool IsCXXMember,
1097  FormatStringInfo *FSI) {
1098  FSI->HasVAListArg = Format->getFirstArg() == 0;
1099  FSI->FormatIdx = Format->getFormatIdx() - 1;
1100  FSI->FirstDataArg = FSI->HasVAListArg ? 0 : Format->getFirstArg() - 1;
1101 
1102  // The way the format attribute works in GCC, the implicit this argument
1103  // of member functions is counted. However, it doesn't appear in our own
1104  // lists, so decrement format_idx in that case.
1105  if (IsCXXMember) {
1106  if(FSI->FormatIdx == 0)
1107  return false;
1108  --FSI->FormatIdx;
1109  if (FSI->FirstDataArg != 0)
1110  --FSI->FirstDataArg;
1111  }
1112  return true;
1113 }
1114 
1115 /// Checks if a the given expression evaluates to null.
1116 ///
1117 /// \brief Returns true if the value evaluates to null.
1118 static bool CheckNonNullExpr(Sema &S,
1119  const Expr *Expr) {
1120  // If the expression has non-null type, it doesn't evaluate to null.
1121  if (auto nullability
1122  = Expr->IgnoreImplicit()->getType()->getNullability(S.Context)) {
1123  if (*nullability == NullabilityKind::NonNull)
1124  return false;
1125  }
1126 
1127  // As a special case, transparent unions initialized with zero are
1128  // considered null for the purposes of the nonnull attribute.
1129  if (const RecordType *UT = Expr->getType()->getAsUnionType()) {
1130  if (UT->getDecl()->hasAttr<TransparentUnionAttr>())
1131  if (const CompoundLiteralExpr *CLE =
1132  dyn_cast<CompoundLiteralExpr>(Expr))
1133  if (const InitListExpr *ILE =
1134  dyn_cast<InitListExpr>(CLE->getInitializer()))
1135  Expr = ILE->getInit(0);
1136  }
1137 
1138  bool Result;
1139  return (!Expr->isValueDependent() &&
1140  Expr->EvaluateAsBooleanCondition(Result, S.Context) &&
1141  !Result);
1142 }
1143 
1145  const Expr *ArgExpr,
1146  SourceLocation CallSiteLoc) {
1147  if (CheckNonNullExpr(S, ArgExpr))
1148  S.Diag(CallSiteLoc, diag::warn_null_arg) << ArgExpr->getSourceRange();
1149 }
1150 
1151 bool Sema::GetFormatNSStringIdx(const FormatAttr *Format, unsigned &Idx) {
1152  FormatStringInfo FSI;
1153  if ((GetFormatStringType(Format) == FST_NSString) &&
1154  getFormatStringInfo(Format, false, &FSI)) {
1155  Idx = FSI.FormatIdx;
1156  return true;
1157  }
1158  return false;
1159 }
1160 /// \brief Diagnose use of %s directive in an NSString which is being passed
1161 /// as formatting string to formatting method.
1162 static void
1164  const NamedDecl *FDecl,
1165  Expr **Args,
1166  unsigned NumArgs) {
1167  unsigned Idx = 0;
1168  bool Format = false;
1170  if (SFFamily == ObjCStringFormatFamily::SFF_CFString) {
1171  Idx = 2;
1172  Format = true;
1173  }
1174  else
1175  for (const auto *I : FDecl->specific_attrs<FormatAttr>()) {
1176  if (S.GetFormatNSStringIdx(I, Idx)) {
1177  Format = true;
1178  break;
1179  }
1180  }
1181  if (!Format || NumArgs <= Idx)
1182  return;
1183  const Expr *FormatExpr = Args[Idx];
1184  if (const CStyleCastExpr *CSCE = dyn_cast<CStyleCastExpr>(FormatExpr))
1185  FormatExpr = CSCE->getSubExpr();
1186  const StringLiteral *FormatString;
1187  if (const ObjCStringLiteral *OSL =
1188  dyn_cast<ObjCStringLiteral>(FormatExpr->IgnoreParenImpCasts()))
1189  FormatString = OSL->getString();
1190  else
1191  FormatString = dyn_cast<StringLiteral>(FormatExpr->IgnoreParenImpCasts());
1192  if (!FormatString)
1193  return;
1194  if (S.FormatStringHasSArg(FormatString)) {
1195  S.Diag(FormatExpr->getExprLoc(), diag::warn_objc_cdirective_format_string)
1196  << "%s" << 1 << 1;
1197  S.Diag(FDecl->getLocation(), diag::note_entity_declared_at)
1198  << FDecl->getDeclName();
1199  }
1200 }
1201 
1202 /// Determine whether the given type has a non-null nullability annotation.
1204  if (auto nullability = type->getNullability(ctx))
1205  return *nullability == NullabilityKind::NonNull;
1206 
1207  return false;
1208 }
1209 
1211  const NamedDecl *FDecl,
1212  const FunctionProtoType *Proto,
1214  SourceLocation CallSiteLoc) {
1215  assert((FDecl || Proto) && "Need a function declaration or prototype");
1216 
1217  // Check the attributes attached to the method/function itself.
1218  llvm::SmallBitVector NonNullArgs;
1219  if (FDecl) {
1220  // Handle the nonnull attribute on the function/method declaration itself.
1221  for (const auto *NonNull : FDecl->specific_attrs<NonNullAttr>()) {
1222  if (!NonNull->args_size()) {
1223  // Easy case: all pointer arguments are nonnull.
1224  for (const auto *Arg : Args)
1225  if (S.isValidPointerAttrType(Arg->getType()))
1226  CheckNonNullArgument(S, Arg, CallSiteLoc);
1227  return;
1228  }
1229 
1230  for (unsigned Val : NonNull->args()) {
1231  if (Val >= Args.size())
1232  continue;
1233  if (NonNullArgs.empty())
1234  NonNullArgs.resize(Args.size());
1235  NonNullArgs.set(Val);
1236  }
1237  }
1238  }
1239 
1240  if (FDecl && (isa<FunctionDecl>(FDecl) || isa<ObjCMethodDecl>(FDecl))) {
1241  // Handle the nonnull attribute on the parameters of the
1242  // function/method.
1243  ArrayRef<ParmVarDecl*> parms;
1244  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FDecl))
1245  parms = FD->parameters();
1246  else
1247  parms = cast<ObjCMethodDecl>(FDecl)->parameters();
1248 
1249  unsigned ParamIndex = 0;
1250  for (ArrayRef<ParmVarDecl*>::iterator I = parms.begin(), E = parms.end();
1251  I != E; ++I, ++ParamIndex) {
1252  const ParmVarDecl *PVD = *I;
1253  if (PVD->hasAttr<NonNullAttr>() ||
1254  isNonNullType(S.Context, PVD->getType())) {
1255  if (NonNullArgs.empty())
1256  NonNullArgs.resize(Args.size());
1257 
1258  NonNullArgs.set(ParamIndex);
1259  }
1260  }
1261  } else {
1262  // If we have a non-function, non-method declaration but no
1263  // function prototype, try to dig out the function prototype.
1264  if (!Proto) {
1265  if (const ValueDecl *VD = dyn_cast<ValueDecl>(FDecl)) {
1266  QualType type = VD->getType().getNonReferenceType();
1267  if (auto pointerType = type->getAs<PointerType>())
1268  type = pointerType->getPointeeType();
1269  else if (auto blockType = type->getAs<BlockPointerType>())
1270  type = blockType->getPointeeType();
1271  // FIXME: data member pointers?
1272 
1273  // Dig out the function prototype, if there is one.
1274  Proto = type->getAs<FunctionProtoType>();
1275  }
1276  }
1277 
1278  // Fill in non-null argument information from the nullability
1279  // information on the parameter types (if we have them).
1280  if (Proto) {
1281  unsigned Index = 0;
1282  for (auto paramType : Proto->getParamTypes()) {
1283  if (isNonNullType(S.Context, paramType)) {
1284  if (NonNullArgs.empty())
1285  NonNullArgs.resize(Args.size());
1286 
1287  NonNullArgs.set(Index);
1288  }
1289 
1290  ++Index;
1291  }
1292  }
1293  }
1294 
1295  // Check for non-null arguments.
1296  for (unsigned ArgIndex = 0, ArgIndexEnd = NonNullArgs.size();
1297  ArgIndex != ArgIndexEnd; ++ArgIndex) {
1298  if (NonNullArgs[ArgIndex])
1299  CheckNonNullArgument(S, Args[ArgIndex], CallSiteLoc);
1300  }
1301 }
1302 
1303 /// Handles the checks for format strings, non-POD arguments to vararg
1304 /// functions, and NULL arguments passed to non-NULL parameters.
1305 void Sema::checkCall(NamedDecl *FDecl, const FunctionProtoType *Proto,
1306  ArrayRef<const Expr *> Args, bool IsMemberFunction,
1307  SourceLocation Loc, SourceRange Range,
1308  VariadicCallType CallType) {
1309  // FIXME: We should check as much as we can in the template definition.
1310  if (CurContext->isDependentContext())
1311  return;
1312 
1313  // Printf and scanf checking.
1314  llvm::SmallBitVector CheckedVarArgs;
1315  if (FDecl) {
1316  for (const auto *I : FDecl->specific_attrs<FormatAttr>()) {
1317  // Only create vector if there are format attributes.
1318  CheckedVarArgs.resize(Args.size());
1319 
1320  CheckFormatArguments(I, Args, IsMemberFunction, CallType, Loc, Range,
1321  CheckedVarArgs);
1322  }
1323  }
1324 
1325  // Refuse POD arguments that weren't caught by the format string
1326  // checks above.
1327  if (CallType != VariadicDoesNotApply) {
1328  unsigned NumParams = Proto ? Proto->getNumParams()
1329  : FDecl && isa<FunctionDecl>(FDecl)
1330  ? cast<FunctionDecl>(FDecl)->getNumParams()
1331  : FDecl && isa<ObjCMethodDecl>(FDecl)
1332  ? cast<ObjCMethodDecl>(FDecl)->param_size()
1333  : 0;
1334 
1335  for (unsigned ArgIdx = NumParams; ArgIdx < Args.size(); ++ArgIdx) {
1336  // Args[ArgIdx] can be null in malformed code.
1337  if (const Expr *Arg = Args[ArgIdx]) {
1338  if (CheckedVarArgs.empty() || !CheckedVarArgs[ArgIdx])
1339  checkVariadicArgument(Arg, CallType);
1340  }
1341  }
1342  }
1343 
1344  if (FDecl || Proto) {
1345  CheckNonNullArguments(*this, FDecl, Proto, Args, Loc);
1346 
1347  // Type safety checking.
1348  if (FDecl) {
1349  for (const auto *I : FDecl->specific_attrs<ArgumentWithTypeTagAttr>())
1350  CheckArgumentWithTypeTag(I, Args.data());
1351  }
1352  }
1353 }
1354 
1355 /// CheckConstructorCall - Check a constructor call for correctness and safety
1356 /// properties not enforced by the C type system.
1357 void Sema::CheckConstructorCall(FunctionDecl *FDecl,
1359  const FunctionProtoType *Proto,
1360  SourceLocation Loc) {
1361  VariadicCallType CallType =
1362  Proto->isVariadic() ? VariadicConstructor : VariadicDoesNotApply;
1363  checkCall(FDecl, Proto, Args, /*IsMemberFunction=*/true, Loc, SourceRange(),
1364  CallType);
1365 }
1366 
1367 /// CheckFunctionCall - Check a direct function call for various correctness
1368 /// and safety properties not strictly enforced by the C type system.
1369 bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall,
1370  const FunctionProtoType *Proto) {
1371  bool IsMemberOperatorCall = isa<CXXOperatorCallExpr>(TheCall) &&
1372  isa<CXXMethodDecl>(FDecl);
1373  bool IsMemberFunction = isa<CXXMemberCallExpr>(TheCall) ||
1374  IsMemberOperatorCall;
1375  VariadicCallType CallType = getVariadicCallType(FDecl, Proto,
1376  TheCall->getCallee());
1377  Expr** Args = TheCall->getArgs();
1378  unsigned NumArgs = TheCall->getNumArgs();
1379  if (IsMemberOperatorCall) {
1380  // If this is a call to a member operator, hide the first argument
1381  // from checkCall.
1382  // FIXME: Our choice of AST representation here is less than ideal.
1383  ++Args;
1384  --NumArgs;
1385  }
1386  checkCall(FDecl, Proto, llvm::makeArrayRef(Args, NumArgs),
1387  IsMemberFunction, TheCall->getRParenLoc(),
1388  TheCall->getCallee()->getSourceRange(), CallType);
1389 
1390  IdentifierInfo *FnInfo = FDecl->getIdentifier();
1391  // None of the checks below are needed for functions that don't have
1392  // simple names (e.g., C++ conversion functions).
1393  if (!FnInfo)
1394  return false;
1395 
1396  CheckAbsoluteValueFunction(TheCall, FDecl, FnInfo);
1397  if (getLangOpts().ObjC1)
1398  DiagnoseCStringFormatDirectiveInCFAPI(*this, FDecl, Args, NumArgs);
1399 
1400  unsigned CMId = FDecl->getMemoryFunctionKind();
1401  if (CMId == 0)
1402  return false;
1403 
1404  // Handle memory setting and copying functions.
1405  if (CMId == Builtin::BIstrlcpy || CMId == Builtin::BIstrlcat)
1406  CheckStrlcpycatArguments(TheCall, FnInfo);
1407  else if (CMId == Builtin::BIstrncat)
1408  CheckStrncatArguments(TheCall, FnInfo);
1409  else
1410  CheckMemaccessArguments(TheCall, CMId, FnInfo);
1411 
1412  return false;
1413 }
1414 
1415 bool Sema::CheckObjCMethodCall(ObjCMethodDecl *Method, SourceLocation lbrac,
1416  ArrayRef<const Expr *> Args) {
1417  VariadicCallType CallType =
1418  Method->isVariadic() ? VariadicMethod : VariadicDoesNotApply;
1419 
1420  checkCall(Method, nullptr, Args,
1421  /*IsMemberFunction=*/false, lbrac, Method->getSourceRange(),
1422  CallType);
1423 
1424  return false;
1425 }
1426 
1427 bool Sema::CheckPointerCall(NamedDecl *NDecl, CallExpr *TheCall,
1428  const FunctionProtoType *Proto) {
1429  QualType Ty;
1430  if (const auto *V = dyn_cast<VarDecl>(NDecl))
1431  Ty = V->getType().getNonReferenceType();
1432  else if (const auto *F = dyn_cast<FieldDecl>(NDecl))
1433  Ty = F->getType().getNonReferenceType();
1434  else
1435  return false;
1436 
1437  if (!Ty->isBlockPointerType() && !Ty->isFunctionPointerType() &&
1438  !Ty->isFunctionProtoType())
1439  return false;
1440 
1441  VariadicCallType CallType;
1442  if (!Proto || !Proto->isVariadic()) {
1443  CallType = VariadicDoesNotApply;
1444  } else if (Ty->isBlockPointerType()) {
1445  CallType = VariadicBlock;
1446  } else { // Ty->isFunctionPointerType()
1447  CallType = VariadicFunction;
1448  }
1449 
1450  checkCall(NDecl, Proto,
1451  llvm::makeArrayRef(TheCall->getArgs(), TheCall->getNumArgs()),
1452  /*IsMemberFunction=*/false, TheCall->getRParenLoc(),
1453  TheCall->getCallee()->getSourceRange(), CallType);
1454 
1455  return false;
1456 }
1457 
1458 /// Checks function calls when a FunctionDecl or a NamedDecl is not available,
1459 /// such as function pointers returned from functions.
1460 bool Sema::CheckOtherCall(CallExpr *TheCall, const FunctionProtoType *Proto) {
1461  VariadicCallType CallType = getVariadicCallType(/*FDecl=*/nullptr, Proto,
1462  TheCall->getCallee());
1463  checkCall(/*FDecl=*/nullptr, Proto,
1464  llvm::makeArrayRef(TheCall->getArgs(), TheCall->getNumArgs()),
1465  /*IsMemberFunction=*/false, TheCall->getRParenLoc(),
1466  TheCall->getCallee()->getSourceRange(), CallType);
1467 
1468  return false;
1469 }
1470 
1471 static bool isValidOrderingForOp(int64_t Ordering, AtomicExpr::AtomicOp Op) {
1472  if (Ordering < AtomicExpr::AO_ABI_memory_order_relaxed ||
1474  return false;
1475 
1476  switch (Op) {
1477  case AtomicExpr::AO__c11_atomic_init:
1478  llvm_unreachable("There is no ordering argument for an init");
1479 
1480  case AtomicExpr::AO__c11_atomic_load:
1481  case AtomicExpr::AO__atomic_load_n:
1482  case AtomicExpr::AO__atomic_load:
1483  return Ordering != AtomicExpr::AO_ABI_memory_order_release &&
1485 
1486  case AtomicExpr::AO__c11_atomic_store:
1487  case AtomicExpr::AO__atomic_store:
1488  case AtomicExpr::AO__atomic_store_n:
1489  return Ordering != AtomicExpr::AO_ABI_memory_order_consume &&
1492 
1493  default:
1494  return true;
1495  }
1496 }
1497 
1498 ExprResult Sema::SemaAtomicOpsOverloaded(ExprResult TheCallResult,
1499  AtomicExpr::AtomicOp Op) {
1500  CallExpr *TheCall = cast<CallExpr>(TheCallResult.get());
1501  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
1502 
1503  // All these operations take one of the following forms:
1504  enum {
1505  // C __c11_atomic_init(A *, C)
1506  Init,
1507  // C __c11_atomic_load(A *, int)
1508  Load,
1509  // void __atomic_load(A *, CP, int)
1510  Copy,
1511  // C __c11_atomic_add(A *, M, int)
1512  Arithmetic,
1513  // C __atomic_exchange_n(A *, CP, int)
1514  Xchg,
1515  // void __atomic_exchange(A *, C *, CP, int)
1516  GNUXchg,
1517  // bool __c11_atomic_compare_exchange_strong(A *, C *, CP, int, int)
1518  C11CmpXchg,
1519  // bool __atomic_compare_exchange(A *, C *, CP, bool, int, int)
1520  GNUCmpXchg
1521  } Form = Init;
1522  const unsigned NumArgs[] = { 2, 2, 3, 3, 3, 4, 5, 6 };
1523  const unsigned NumVals[] = { 1, 0, 1, 1, 1, 2, 2, 3 };
1524  // where:
1525  // C is an appropriate type,
1526  // A is volatile _Atomic(C) for __c11 builtins and is C for GNU builtins,
1527  // CP is C for __c11 builtins and GNU _n builtins and is C * otherwise,
1528  // M is C if C is an integer, and ptrdiff_t if C is a pointer, and
1529  // the int parameters are for orderings.
1530 
1531  static_assert(AtomicExpr::AO__c11_atomic_init == 0 &&
1532  AtomicExpr::AO__c11_atomic_fetch_xor + 1 ==
1533  AtomicExpr::AO__atomic_load,
1534  "need to update code for modified C11 atomics");
1535  bool IsC11 = Op >= AtomicExpr::AO__c11_atomic_init &&
1536  Op <= AtomicExpr::AO__c11_atomic_fetch_xor;
1537  bool IsN = Op == AtomicExpr::AO__atomic_load_n ||
1538  Op == AtomicExpr::AO__atomic_store_n ||
1539  Op == AtomicExpr::AO__atomic_exchange_n ||
1540  Op == AtomicExpr::AO__atomic_compare_exchange_n;
1541  bool IsAddSub = false;
1542 
1543  switch (Op) {
1544  case AtomicExpr::AO__c11_atomic_init:
1545  Form = Init;
1546  break;
1547 
1548  case AtomicExpr::AO__c11_atomic_load:
1549  case AtomicExpr::AO__atomic_load_n:
1550  Form = Load;
1551  break;
1552 
1553  case AtomicExpr::AO__c11_atomic_store:
1554  case AtomicExpr::AO__atomic_load:
1555  case AtomicExpr::AO__atomic_store:
1556  case AtomicExpr::AO__atomic_store_n:
1557  Form = Copy;
1558  break;
1559 
1560  case AtomicExpr::AO__c11_atomic_fetch_add:
1561  case AtomicExpr::AO__c11_atomic_fetch_sub:
1562  case AtomicExpr::AO__atomic_fetch_add:
1563  case AtomicExpr::AO__atomic_fetch_sub:
1564  case AtomicExpr::AO__atomic_add_fetch:
1565  case AtomicExpr::AO__atomic_sub_fetch:
1566  IsAddSub = true;
1567  // Fall through.
1568  case AtomicExpr::AO__c11_atomic_fetch_and:
1569  case AtomicExpr::AO__c11_atomic_fetch_or:
1570  case AtomicExpr::AO__c11_atomic_fetch_xor:
1571  case AtomicExpr::AO__atomic_fetch_and:
1572  case AtomicExpr::AO__atomic_fetch_or:
1573  case AtomicExpr::AO__atomic_fetch_xor:
1574  case AtomicExpr::AO__atomic_fetch_nand:
1575  case AtomicExpr::AO__atomic_and_fetch:
1576  case AtomicExpr::AO__atomic_or_fetch:
1577  case AtomicExpr::AO__atomic_xor_fetch:
1578  case AtomicExpr::AO__atomic_nand_fetch:
1579  Form = Arithmetic;
1580  break;
1581 
1582  case AtomicExpr::AO__c11_atomic_exchange:
1583  case AtomicExpr::AO__atomic_exchange_n:
1584  Form = Xchg;
1585  break;
1586 
1587  case AtomicExpr::AO__atomic_exchange:
1588  Form = GNUXchg;
1589  break;
1590 
1591  case AtomicExpr::AO__c11_atomic_compare_exchange_strong:
1592  case AtomicExpr::AO__c11_atomic_compare_exchange_weak:
1593  Form = C11CmpXchg;
1594  break;
1595 
1596  case AtomicExpr::AO__atomic_compare_exchange:
1597  case AtomicExpr::AO__atomic_compare_exchange_n:
1598  Form = GNUCmpXchg;
1599  break;
1600  }
1601 
1602  // Check we have the right number of arguments.
1603  if (TheCall->getNumArgs() < NumArgs[Form]) {
1604  Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
1605  << 0 << NumArgs[Form] << TheCall->getNumArgs()
1606  << TheCall->getCallee()->getSourceRange();
1607  return ExprError();
1608  } else if (TheCall->getNumArgs() > NumArgs[Form]) {
1609  Diag(TheCall->getArg(NumArgs[Form])->getLocStart(),
1610  diag::err_typecheck_call_too_many_args)
1611  << 0 << NumArgs[Form] << TheCall->getNumArgs()
1612  << TheCall->getCallee()->getSourceRange();
1613  return ExprError();
1614  }
1615 
1616  // Inspect the first argument of the atomic operation.
1617  Expr *Ptr = TheCall->getArg(0);
1618  Ptr = DefaultFunctionArrayLvalueConversion(Ptr).get();
1619  const PointerType *pointerType = Ptr->getType()->getAs<PointerType>();
1620  if (!pointerType) {
1621  Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
1622  << Ptr->getType() << Ptr->getSourceRange();
1623  return ExprError();
1624  }
1625 
1626  // For a __c11 builtin, this should be a pointer to an _Atomic type.
1627  QualType AtomTy = pointerType->getPointeeType(); // 'A'
1628  QualType ValType = AtomTy; // 'C'
1629  if (IsC11) {
1630  if (!AtomTy->isAtomicType()) {
1631  Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic)
1632  << Ptr->getType() << Ptr->getSourceRange();
1633  return ExprError();
1634  }
1635  if (AtomTy.isConstQualified()) {
1636  Diag(DRE->getLocStart(), diag::err_atomic_op_needs_non_const_atomic)
1637  << Ptr->getType() << Ptr->getSourceRange();
1638  return ExprError();
1639  }
1640  ValType = AtomTy->getAs<AtomicType>()->getValueType();
1641  }
1642 
1643  // For an arithmetic operation, the implied arithmetic must be well-formed.
1644  if (Form == Arithmetic) {
1645  // gcc does not enforce these rules for GNU atomics, but we do so for sanity.
1646  if (IsAddSub && !ValType->isIntegerType() && !ValType->isPointerType()) {
1647  Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic_int_or_ptr)
1648  << IsC11 << Ptr->getType() << Ptr->getSourceRange();
1649  return ExprError();
1650  }
1651  if (!IsAddSub && !ValType->isIntegerType()) {
1652  Diag(DRE->getLocStart(), diag::err_atomic_op_bitwise_needs_atomic_int)
1653  << IsC11 << Ptr->getType() << Ptr->getSourceRange();
1654  return ExprError();
1655  }
1656  if (IsC11 && ValType->isPointerType() &&
1657  RequireCompleteType(Ptr->getLocStart(), ValType->getPointeeType(),
1658  diag::err_incomplete_type)) {
1659  return ExprError();
1660  }
1661  } else if (IsN && !ValType->isIntegerType() && !ValType->isPointerType()) {
1662  // For __atomic_*_n operations, the value type must be a scalar integral or
1663  // pointer type which is 1, 2, 4, 8 or 16 bytes in length.
1664  Diag(DRE->getLocStart(), diag::err_atomic_op_needs_atomic_int_or_ptr)
1665  << IsC11 << Ptr->getType() << Ptr->getSourceRange();
1666  return ExprError();
1667  }
1668 
1669  if (!IsC11 && !AtomTy.isTriviallyCopyableType(Context) &&
1670  !AtomTy->isScalarType()) {
1671  // For GNU atomics, require a trivially-copyable type. This is not part of
1672  // the GNU atomics specification, but we enforce it for sanity.
1673  Diag(DRE->getLocStart(), diag::err_atomic_op_needs_trivial_copy)
1674  << Ptr->getType() << Ptr->getSourceRange();
1675  return ExprError();
1676  }
1677 
1678  // FIXME: For any builtin other than a load, the ValType must not be
1679  // const-qualified.
1680 
1681  switch (ValType.getObjCLifetime()) {
1682  case Qualifiers::OCL_None:
1684  // okay
1685  break;
1686 
1687  case Qualifiers::OCL_Weak:
1690  // FIXME: Can this happen? By this point, ValType should be known
1691  // to be trivially copyable.
1692  Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership)
1693  << ValType << Ptr->getSourceRange();
1694  return ExprError();
1695  }
1696 
1697  // atomic_fetch_or takes a pointer to a volatile 'A'. We shouldn't let the
1698  // volatile-ness of the pointee-type inject itself into the result or the
1699  // other operands.
1700  ValType.removeLocalVolatile();
1701  QualType ResultType = ValType;
1702  if (Form == Copy || Form == GNUXchg || Form == Init)
1703  ResultType = Context.VoidTy;
1704  else if (Form == C11CmpXchg || Form == GNUCmpXchg)
1705  ResultType = Context.BoolTy;
1706 
1707  // The type of a parameter passed 'by value'. In the GNU atomics, such
1708  // arguments are actually passed as pointers.
1709  QualType ByValType = ValType; // 'CP'
1710  if (!IsC11 && !IsN)
1711  ByValType = Ptr->getType();
1712 
1713  // The first argument --- the pointer --- has a fixed type; we
1714  // deduce the types of the rest of the arguments accordingly. Walk
1715  // the remaining arguments, converting them to the deduced value type.
1716  for (unsigned i = 1; i != NumArgs[Form]; ++i) {
1717  QualType Ty;
1718  if (i < NumVals[Form] + 1) {
1719  switch (i) {
1720  case 1:
1721  // The second argument is the non-atomic operand. For arithmetic, this
1722  // is always passed by value, and for a compare_exchange it is always
1723  // passed by address. For the rest, GNU uses by-address and C11 uses
1724  // by-value.
1725  assert(Form != Load);
1726  if (Form == Init || (Form == Arithmetic && ValType->isIntegerType()))
1727  Ty = ValType;
1728  else if (Form == Copy || Form == Xchg)
1729  Ty = ByValType;
1730  else if (Form == Arithmetic)
1731  Ty = Context.getPointerDiffType();
1732  else
1733  Ty = Context.getPointerType(ValType.getUnqualifiedType());
1734  break;
1735  case 2:
1736  // The third argument to compare_exchange / GNU exchange is a
1737  // (pointer to a) desired value.
1738  Ty = ByValType;
1739  break;
1740  case 3:
1741  // The fourth argument to GNU compare_exchange is a 'weak' flag.
1742  Ty = Context.BoolTy;
1743  break;
1744  }
1745  } else {
1746  // The order(s) are always converted to int.
1747  Ty = Context.IntTy;
1748  }
1749 
1750  InitializedEntity Entity =
1752  ExprResult Arg = TheCall->getArg(i);
1753  Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg);
1754  if (Arg.isInvalid())
1755  return true;
1756  TheCall->setArg(i, Arg.get());
1757  }
1758 
1759  // Permute the arguments into a 'consistent' order.
1760  SmallVector<Expr*, 5> SubExprs;
1761  SubExprs.push_back(Ptr);
1762  switch (Form) {
1763  case Init:
1764  // Note, AtomicExpr::getVal1() has a special case for this atomic.
1765  SubExprs.push_back(TheCall->getArg(1)); // Val1
1766  break;
1767  case Load:
1768  SubExprs.push_back(TheCall->getArg(1)); // Order
1769  break;
1770  case Copy:
1771  case Arithmetic:
1772  case Xchg:
1773  SubExprs.push_back(TheCall->getArg(2)); // Order
1774  SubExprs.push_back(TheCall->getArg(1)); // Val1
1775  break;
1776  case GNUXchg:
1777  // Note, AtomicExpr::getVal2() has a special case for this atomic.
1778  SubExprs.push_back(TheCall->getArg(3)); // Order
1779  SubExprs.push_back(TheCall->getArg(1)); // Val1
1780  SubExprs.push_back(TheCall->getArg(2)); // Val2
1781  break;
1782  case C11CmpXchg:
1783  SubExprs.push_back(TheCall->getArg(3)); // Order
1784  SubExprs.push_back(TheCall->getArg(1)); // Val1
1785  SubExprs.push_back(TheCall->getArg(4)); // OrderFail
1786  SubExprs.push_back(TheCall->getArg(2)); // Val2
1787  break;
1788  case GNUCmpXchg:
1789  SubExprs.push_back(TheCall->getArg(4)); // Order
1790  SubExprs.push_back(TheCall->getArg(1)); // Val1
1791  SubExprs.push_back(TheCall->getArg(5)); // OrderFail
1792  SubExprs.push_back(TheCall->getArg(2)); // Val2
1793  SubExprs.push_back(TheCall->getArg(3)); // Weak
1794  break;
1795  }
1796 
1797  if (SubExprs.size() >= 2 && Form != Init) {
1798  llvm::APSInt Result(32);
1799  if (SubExprs[1]->isIntegerConstantExpr(Result, Context) &&
1800  !isValidOrderingForOp(Result.getSExtValue(), Op))
1801  Diag(SubExprs[1]->getLocStart(),
1802  diag::warn_atomic_op_has_invalid_memory_order)
1803  << SubExprs[1]->getSourceRange();
1804  }
1805 
1806  AtomicExpr *AE = new (Context) AtomicExpr(TheCall->getCallee()->getLocStart(),
1807  SubExprs, ResultType, Op,
1808  TheCall->getRParenLoc());
1809 
1810  if ((Op == AtomicExpr::AO__c11_atomic_load ||
1811  (Op == AtomicExpr::AO__c11_atomic_store)) &&
1813  Diag(AE->getLocStart(), diag::err_atomic_load_store_uses_lib) <<
1814  ((Op == AtomicExpr::AO__c11_atomic_load) ? 0 : 1);
1815 
1816  return AE;
1817 }
1818 
1819 
1820 /// checkBuiltinArgument - Given a call to a builtin function, perform
1821 /// normal type-checking on the given argument, updating the call in
1822 /// place. This is useful when a builtin function requires custom
1823 /// type-checking for some of its arguments but not necessarily all of
1824 /// them.
1825 ///
1826 /// Returns true on error.
1827 static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) {
1828  FunctionDecl *Fn = E->getDirectCallee();
1829  assert(Fn && "builtin call without direct callee!");
1830 
1831  ParmVarDecl *Param = Fn->getParamDecl(ArgIndex);
1832  InitializedEntity Entity =
1834 
1835  ExprResult Arg = E->getArg(0);
1836  Arg = S.PerformCopyInitialization(Entity, SourceLocation(), Arg);
1837  if (Arg.isInvalid())
1838  return true;
1839 
1840  E->setArg(ArgIndex, Arg.get());
1841  return false;
1842 }
1843 
1844 /// SemaBuiltinAtomicOverloaded - We have a call to a function like
1845 /// __sync_fetch_and_add, which is an overloaded function based on the pointer
1846 /// type of its first argument. The main ActOnCallExpr routines have already
1847 /// promoted the types of arguments because all of these calls are prototyped as
1848 /// void(...).
1849 ///
1850 /// This function goes through and does final semantic checking for these
1851 /// builtins,
1852 ExprResult
1853 Sema::SemaBuiltinAtomicOverloaded(ExprResult TheCallResult) {
1854  CallExpr *TheCall = (CallExpr *)TheCallResult.get();
1855  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
1856  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
1857 
1858  // Ensure that we have at least one argument to do type inference from.
1859  if (TheCall->getNumArgs() < 1) {
1860  Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least)
1861  << 0 << 1 << TheCall->getNumArgs()
1862  << TheCall->getCallee()->getSourceRange();
1863  return ExprError();
1864  }
1865 
1866  // Inspect the first argument of the atomic builtin. This should always be
1867  // a pointer type, whose element is an integral scalar or pointer type.
1868  // Because it is a pointer type, we don't have to worry about any implicit
1869  // casts here.
1870  // FIXME: We don't allow floating point scalars as input.
1871  Expr *FirstArg = TheCall->getArg(0);
1872  ExprResult FirstArgResult = DefaultFunctionArrayLvalueConversion(FirstArg);
1873  if (FirstArgResult.isInvalid())
1874  return ExprError();
1875  FirstArg = FirstArgResult.get();
1876  TheCall->setArg(0, FirstArg);
1877 
1878  const PointerType *pointerType = FirstArg->getType()->getAs<PointerType>();
1879  if (!pointerType) {
1880  Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer)
1881  << FirstArg->getType() << FirstArg->getSourceRange();
1882  return ExprError();
1883  }
1884 
1885  QualType ValType = pointerType->getPointeeType();
1886  if (!ValType->isIntegerType() && !ValType->isAnyPointerType() &&
1887  !ValType->isBlockPointerType()) {
1888  Diag(DRE->getLocStart(), diag::err_atomic_builtin_must_be_pointer_intptr)
1889  << FirstArg->getType() << FirstArg->getSourceRange();
1890  return ExprError();
1891  }
1892 
1893  switch (ValType.getObjCLifetime()) {
1894  case Qualifiers::OCL_None:
1896  // okay
1897  break;
1898 
1899  case Qualifiers::OCL_Weak:
1902  Diag(DRE->getLocStart(), diag::err_arc_atomic_ownership)
1903  << ValType << FirstArg->getSourceRange();
1904  return ExprError();
1905  }
1906 
1907  // Strip any qualifiers off ValType.
1908  ValType = ValType.getUnqualifiedType();
1909 
1910  // The majority of builtins return a value, but a few have special return
1911  // types, so allow them to override appropriately below.
1912  QualType ResultType = ValType;
1913 
1914  // We need to figure out which concrete builtin this maps onto. For example,
1915  // __sync_fetch_and_add with a 2 byte object turns into
1916  // __sync_fetch_and_add_2.
1917 #define BUILTIN_ROW(x) \
1918  { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
1919  Builtin::BI##x##_8, Builtin::BI##x##_16 }
1920 
1921  static const unsigned BuiltinIndices[][5] = {
1922  BUILTIN_ROW(__sync_fetch_and_add),
1923  BUILTIN_ROW(__sync_fetch_and_sub),
1924  BUILTIN_ROW(__sync_fetch_and_or),
1925  BUILTIN_ROW(__sync_fetch_and_and),
1926  BUILTIN_ROW(__sync_fetch_and_xor),
1927  BUILTIN_ROW(__sync_fetch_and_nand),
1928 
1929  BUILTIN_ROW(__sync_add_and_fetch),
1930  BUILTIN_ROW(__sync_sub_and_fetch),
1931  BUILTIN_ROW(__sync_and_and_fetch),
1932  BUILTIN_ROW(__sync_or_and_fetch),
1933  BUILTIN_ROW(__sync_xor_and_fetch),
1934  BUILTIN_ROW(__sync_nand_and_fetch),
1935 
1936  BUILTIN_ROW(__sync_val_compare_and_swap),
1937  BUILTIN_ROW(__sync_bool_compare_and_swap),
1938  BUILTIN_ROW(__sync_lock_test_and_set),
1939  BUILTIN_ROW(__sync_lock_release),
1940  BUILTIN_ROW(__sync_swap)
1941  };
1942 #undef BUILTIN_ROW
1943 
1944  // Determine the index of the size.
1945  unsigned SizeIndex;
1946  switch (Context.getTypeSizeInChars(ValType).getQuantity()) {
1947  case 1: SizeIndex = 0; break;
1948  case 2: SizeIndex = 1; break;
1949  case 4: SizeIndex = 2; break;
1950  case 8: SizeIndex = 3; break;
1951  case 16: SizeIndex = 4; break;
1952  default:
1953  Diag(DRE->getLocStart(), diag::err_atomic_builtin_pointer_size)
1954  << FirstArg->getType() << FirstArg->getSourceRange();
1955  return ExprError();
1956  }
1957 
1958  // Each of these builtins has one pointer argument, followed by some number of
1959  // values (0, 1 or 2) followed by a potentially empty varags list of stuff
1960  // that we ignore. Find out which row of BuiltinIndices to read from as well
1961  // as the number of fixed args.
1962  unsigned BuiltinID = FDecl->getBuiltinID();
1963  unsigned BuiltinIndex, NumFixed = 1;
1964  bool WarnAboutSemanticsChange = false;
1965  switch (BuiltinID) {
1966  default: llvm_unreachable("Unknown overloaded atomic builtin!");
1967  case Builtin::BI__sync_fetch_and_add:
1968  case Builtin::BI__sync_fetch_and_add_1:
1969  case Builtin::BI__sync_fetch_and_add_2:
1970  case Builtin::BI__sync_fetch_and_add_4:
1971  case Builtin::BI__sync_fetch_and_add_8:
1972  case Builtin::BI__sync_fetch_and_add_16:
1973  BuiltinIndex = 0;
1974  break;
1975 
1976  case Builtin::BI__sync_fetch_and_sub:
1977  case Builtin::BI__sync_fetch_and_sub_1:
1978  case Builtin::BI__sync_fetch_and_sub_2:
1979  case Builtin::BI__sync_fetch_and_sub_4:
1980  case Builtin::BI__sync_fetch_and_sub_8:
1981  case Builtin::BI__sync_fetch_and_sub_16:
1982  BuiltinIndex = 1;
1983  break;
1984 
1985  case Builtin::BI__sync_fetch_and_or:
1986  case Builtin::BI__sync_fetch_and_or_1:
1987  case Builtin::BI__sync_fetch_and_or_2:
1988  case Builtin::BI__sync_fetch_and_or_4:
1989  case Builtin::BI__sync_fetch_and_or_8:
1990  case Builtin::BI__sync_fetch_and_or_16:
1991  BuiltinIndex = 2;
1992  break;
1993 
1994  case Builtin::BI__sync_fetch_and_and:
1995  case Builtin::BI__sync_fetch_and_and_1:
1996  case Builtin::BI__sync_fetch_and_and_2:
1997  case Builtin::BI__sync_fetch_and_and_4:
1998  case Builtin::BI__sync_fetch_and_and_8:
1999  case Builtin::BI__sync_fetch_and_and_16:
2000  BuiltinIndex = 3;
2001  break;
2002 
2003  case Builtin::BI__sync_fetch_and_xor:
2004  case Builtin::BI__sync_fetch_and_xor_1:
2005  case Builtin::BI__sync_fetch_and_xor_2:
2006  case Builtin::BI__sync_fetch_and_xor_4:
2007  case Builtin::BI__sync_fetch_and_xor_8:
2008  case Builtin::BI__sync_fetch_and_xor_16:
2009  BuiltinIndex = 4;
2010  break;
2011 
2012  case Builtin::BI__sync_fetch_and_nand:
2013  case Builtin::BI__sync_fetch_and_nand_1:
2014  case Builtin::BI__sync_fetch_and_nand_2:
2015  case Builtin::BI__sync_fetch_and_nand_4:
2016  case Builtin::BI__sync_fetch_and_nand_8:
2017  case Builtin::BI__sync_fetch_and_nand_16:
2018  BuiltinIndex = 5;
2019  WarnAboutSemanticsChange = true;
2020  break;
2021 
2022  case Builtin::BI__sync_add_and_fetch:
2023  case Builtin::BI__sync_add_and_fetch_1:
2024  case Builtin::BI__sync_add_and_fetch_2:
2025  case Builtin::BI__sync_add_and_fetch_4:
2026  case Builtin::BI__sync_add_and_fetch_8:
2027  case Builtin::BI__sync_add_and_fetch_16:
2028  BuiltinIndex = 6;
2029  break;
2030 
2031  case Builtin::BI__sync_sub_and_fetch:
2032  case Builtin::BI__sync_sub_and_fetch_1:
2033  case Builtin::BI__sync_sub_and_fetch_2:
2034  case Builtin::BI__sync_sub_and_fetch_4:
2035  case Builtin::BI__sync_sub_and_fetch_8:
2036  case Builtin::BI__sync_sub_and_fetch_16:
2037  BuiltinIndex = 7;
2038  break;
2039 
2040  case Builtin::BI__sync_and_and_fetch:
2041  case Builtin::BI__sync_and_and_fetch_1:
2042  case Builtin::BI__sync_and_and_fetch_2:
2043  case Builtin::BI__sync_and_and_fetch_4:
2044  case Builtin::BI__sync_and_and_fetch_8:
2045  case Builtin::BI__sync_and_and_fetch_16:
2046  BuiltinIndex = 8;
2047  break;
2048 
2049  case Builtin::BI__sync_or_and_fetch:
2050  case Builtin::BI__sync_or_and_fetch_1:
2051  case Builtin::BI__sync_or_and_fetch_2:
2052  case Builtin::BI__sync_or_and_fetch_4:
2053  case Builtin::BI__sync_or_and_fetch_8:
2054  case Builtin::BI__sync_or_and_fetch_16:
2055  BuiltinIndex = 9;
2056  break;
2057 
2058  case Builtin::BI__sync_xor_and_fetch:
2059  case Builtin::BI__sync_xor_and_fetch_1:
2060  case Builtin::BI__sync_xor_and_fetch_2:
2061  case Builtin::BI__sync_xor_and_fetch_4:
2062  case Builtin::BI__sync_xor_and_fetch_8:
2063  case Builtin::BI__sync_xor_and_fetch_16:
2064  BuiltinIndex = 10;
2065  break;
2066 
2067  case Builtin::BI__sync_nand_and_fetch:
2068  case Builtin::BI__sync_nand_and_fetch_1:
2069  case Builtin::BI__sync_nand_and_fetch_2:
2070  case Builtin::BI__sync_nand_and_fetch_4:
2071  case Builtin::BI__sync_nand_and_fetch_8:
2072  case Builtin::BI__sync_nand_and_fetch_16:
2073  BuiltinIndex = 11;
2074  WarnAboutSemanticsChange = true;
2075  break;
2076 
2077  case Builtin::BI__sync_val_compare_and_swap:
2078  case Builtin::BI__sync_val_compare_and_swap_1:
2079  case Builtin::BI__sync_val_compare_and_swap_2:
2080  case Builtin::BI__sync_val_compare_and_swap_4:
2081  case Builtin::BI__sync_val_compare_and_swap_8:
2082  case Builtin::BI__sync_val_compare_and_swap_16:
2083  BuiltinIndex = 12;
2084  NumFixed = 2;
2085  break;
2086 
2087  case Builtin::BI__sync_bool_compare_and_swap:
2088  case Builtin::BI__sync_bool_compare_and_swap_1:
2089  case Builtin::BI__sync_bool_compare_and_swap_2:
2090  case Builtin::BI__sync_bool_compare_and_swap_4:
2091  case Builtin::BI__sync_bool_compare_and_swap_8:
2092  case Builtin::BI__sync_bool_compare_and_swap_16:
2093  BuiltinIndex = 13;
2094  NumFixed = 2;
2095  ResultType = Context.BoolTy;
2096  break;
2097 
2098  case Builtin::BI__sync_lock_test_and_set:
2099  case Builtin::BI__sync_lock_test_and_set_1:
2100  case Builtin::BI__sync_lock_test_and_set_2:
2101  case Builtin::BI__sync_lock_test_and_set_4:
2102  case Builtin::BI__sync_lock_test_and_set_8:
2103  case Builtin::BI__sync_lock_test_and_set_16:
2104  BuiltinIndex = 14;
2105  break;
2106 
2107  case Builtin::BI__sync_lock_release:
2108  case Builtin::BI__sync_lock_release_1:
2109  case Builtin::BI__sync_lock_release_2:
2110  case Builtin::BI__sync_lock_release_4:
2111  case Builtin::BI__sync_lock_release_8:
2112  case Builtin::BI__sync_lock_release_16:
2113  BuiltinIndex = 15;
2114  NumFixed = 0;
2115  ResultType = Context.VoidTy;
2116  break;
2117 
2118  case Builtin::BI__sync_swap:
2119  case Builtin::BI__sync_swap_1:
2120  case Builtin::BI__sync_swap_2:
2121  case Builtin::BI__sync_swap_4:
2122  case Builtin::BI__sync_swap_8:
2123  case Builtin::BI__sync_swap_16:
2124  BuiltinIndex = 16;
2125  break;
2126  }
2127 
2128  // Now that we know how many fixed arguments we expect, first check that we
2129  // have at least that many.
2130  if (TheCall->getNumArgs() < 1+NumFixed) {
2131  Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args_at_least)
2132  << 0 << 1+NumFixed << TheCall->getNumArgs()
2133  << TheCall->getCallee()->getSourceRange();
2134  return ExprError();
2135  }
2136 
2137  if (WarnAboutSemanticsChange) {
2138  Diag(TheCall->getLocEnd(), diag::warn_sync_fetch_and_nand_semantics_change)
2139  << TheCall->getCallee()->getSourceRange();
2140  }
2141 
2142  // Get the decl for the concrete builtin from this, we can tell what the
2143  // concrete integer type we should convert to is.
2144  unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
2145  const char *NewBuiltinName = Context.BuiltinInfo.GetName(NewBuiltinID);
2146  FunctionDecl *NewBuiltinDecl;
2147  if (NewBuiltinID == BuiltinID)
2148  NewBuiltinDecl = FDecl;
2149  else {
2150  // Perform builtin lookup to avoid redeclaring it.
2151  DeclarationName DN(&Context.Idents.get(NewBuiltinName));
2152  LookupResult Res(*this, DN, DRE->getLocStart(), LookupOrdinaryName);
2153  LookupName(Res, TUScope, /*AllowBuiltinCreation=*/true);
2154  assert(Res.getFoundDecl());
2155  NewBuiltinDecl = dyn_cast<FunctionDecl>(Res.getFoundDecl());
2156  if (!NewBuiltinDecl)
2157  return ExprError();
2158  }
2159 
2160  // The first argument --- the pointer --- has a fixed type; we
2161  // deduce the types of the rest of the arguments accordingly. Walk
2162  // the remaining arguments, converting them to the deduced value type.
2163  for (unsigned i = 0; i != NumFixed; ++i) {
2164  ExprResult Arg = TheCall->getArg(i+1);
2165 
2166  // GCC does an implicit conversion to the pointer or integer ValType. This
2167  // can fail in some cases (1i -> int**), check for this error case now.
2168  // Initialize the argument.
2170  ValType, /*consume*/ false);
2171  Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg);
2172  if (Arg.isInvalid())
2173  return ExprError();
2174 
2175  // Okay, we have something that *can* be converted to the right type. Check
2176  // to see if there is a potentially weird extension going on here. This can
2177  // happen when you do an atomic operation on something like an char* and
2178  // pass in 42. The 42 gets converted to char. This is even more strange
2179  // for things like 45.123 -> char, etc.
2180  // FIXME: Do this check.
2181  TheCall->setArg(i+1, Arg.get());
2182  }
2183 
2184  ASTContext& Context = this->getASTContext();
2185 
2186  // Create a new DeclRefExpr to refer to the new decl.
2187  DeclRefExpr* NewDRE = DeclRefExpr::Create(
2188  Context,
2189  DRE->getQualifierLoc(),
2190  SourceLocation(),
2191  NewBuiltinDecl,
2192  /*enclosing*/ false,
2193  DRE->getLocation(),
2194  Context.BuiltinFnTy,
2195  DRE->getValueKind());
2196 
2197  // Set the callee in the CallExpr.
2198  // FIXME: This loses syntactic information.
2199  QualType CalleePtrTy = Context.getPointerType(NewBuiltinDecl->getType());
2200  ExprResult PromotedCall = ImpCastExprToType(NewDRE, CalleePtrTy,
2202  TheCall->setCallee(PromotedCall.get());
2203 
2204  // Change the result type of the call to match the original value type. This
2205  // is arbitrary, but the codegen for these builtins ins design to handle it
2206  // gracefully.
2207  TheCall->setType(ResultType);
2208 
2209  return TheCallResult;
2210 }
2211 
2212 /// CheckObjCString - Checks that the argument to the builtin
2213 /// CFString constructor is correct
2214 /// Note: It might also make sense to do the UTF-16 conversion here (would
2215 /// simplify the backend).
2216 bool Sema::CheckObjCString(Expr *Arg) {
2217  Arg = Arg->IgnoreParenCasts();
2218  StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
2219 
2220  if (!Literal || !Literal->isAscii()) {
2221  Diag(Arg->getLocStart(), diag::err_cfstring_literal_not_string_constant)
2222  << Arg->getSourceRange();
2223  return true;
2224  }
2225 
2226  if (Literal->containsNonAsciiOrNull()) {
2227  StringRef String = Literal->getString();
2228  unsigned NumBytes = String.size();
2229  SmallVector<UTF16, 128> ToBuf(NumBytes);
2230  const UTF8 *FromPtr = (const UTF8 *)String.data();
2231  UTF16 *ToPtr = &ToBuf[0];
2232 
2233  ConversionResult Result = ConvertUTF8toUTF16(&FromPtr, FromPtr + NumBytes,
2234  &ToPtr, ToPtr + NumBytes,
2235  strictConversion);
2236  // Check for conversion failure.
2237  if (Result != conversionOK)
2238  Diag(Arg->getLocStart(),
2239  diag::warn_cfstring_truncated) << Arg->getSourceRange();
2240  }
2241  return false;
2242 }
2243 
2244 /// SemaBuiltinVAStart - Check the arguments to __builtin_va_start for validity.
2245 /// Emit an error and return true on failure, return false on success.
2246 bool Sema::SemaBuiltinVAStart(CallExpr *TheCall) {
2247  Expr *Fn = TheCall->getCallee();
2248  if (TheCall->getNumArgs() > 2) {
2249  Diag(TheCall->getArg(2)->getLocStart(),
2250  diag::err_typecheck_call_too_many_args)
2251  << 0 /*function call*/ << 2 << TheCall->getNumArgs()
2252  << Fn->getSourceRange()
2253  << SourceRange(TheCall->getArg(2)->getLocStart(),
2254  (*(TheCall->arg_end()-1))->getLocEnd());
2255  return true;
2256  }
2257 
2258  if (TheCall->getNumArgs() < 2) {
2259  return Diag(TheCall->getLocEnd(),
2260  diag::err_typecheck_call_too_few_args_at_least)
2261  << 0 /*function call*/ << 2 << TheCall->getNumArgs();
2262  }
2263 
2264  // Type-check the first argument normally.
2265  if (checkBuiltinArgument(*this, TheCall, 0))
2266  return true;
2267 
2268  // Determine whether the current function is variadic or not.
2269  BlockScopeInfo *CurBlock = getCurBlock();
2270  bool isVariadic;
2271  if (CurBlock)
2272  isVariadic = CurBlock->TheDecl->isVariadic();
2273  else if (FunctionDecl *FD = getCurFunctionDecl())
2274  isVariadic = FD->isVariadic();
2275  else
2276  isVariadic = getCurMethodDecl()->isVariadic();
2277 
2278  if (!isVariadic) {
2279  Diag(Fn->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
2280  return true;
2281  }
2282 
2283  // Verify that the second argument to the builtin is the last argument of the
2284  // current function or method.
2285  bool SecondArgIsLastNamedArgument = false;
2286  const Expr *Arg = TheCall->getArg(1)->IgnoreParenCasts();
2287 
2288  // These are valid if SecondArgIsLastNamedArgument is false after the next
2289  // block.
2290  QualType Type;
2291  SourceLocation ParamLoc;
2292 
2293  if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Arg)) {
2294  if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(DR->getDecl())) {
2295  // FIXME: This isn't correct for methods (results in bogus warning).
2296  // Get the last formal in the current function.
2297  const ParmVarDecl *LastArg;
2298  if (CurBlock)
2299  LastArg = *(CurBlock->TheDecl->param_end()-1);
2300  else if (FunctionDecl *FD = getCurFunctionDecl())
2301  LastArg = *(FD->param_end()-1);
2302  else
2303  LastArg = *(getCurMethodDecl()->param_end()-1);
2304  SecondArgIsLastNamedArgument = PV == LastArg;
2305 
2306  Type = PV->getType();
2307  ParamLoc = PV->getLocation();
2308  }
2309  }
2310 
2311  if (!SecondArgIsLastNamedArgument)
2312  Diag(TheCall->getArg(1)->getLocStart(),
2313  diag::warn_second_parameter_of_va_start_not_last_named_argument);
2314  else if (Type->isReferenceType()) {
2315  Diag(Arg->getLocStart(),
2316  diag::warn_va_start_of_reference_type_is_undefined);
2317  Diag(ParamLoc, diag::note_parameter_type) << Type;
2318  }
2319 
2320  TheCall->setType(Context.VoidTy);
2321  return false;
2322 }
2323 
2324 bool Sema::SemaBuiltinVAStartARM(CallExpr *Call) {
2325  // void __va_start(va_list *ap, const char *named_addr, size_t slot_size,
2326  // const char *named_addr);
2327 
2328  Expr *Func = Call->getCallee();
2329 
2330  if (Call->getNumArgs() < 3)
2331  return Diag(Call->getLocEnd(),
2332  diag::err_typecheck_call_too_few_args_at_least)
2333  << 0 /*function call*/ << 3 << Call->getNumArgs();
2334 
2335  // Determine whether the current function is variadic or not.
2336  bool IsVariadic;
2337  if (BlockScopeInfo *CurBlock = getCurBlock())
2338  IsVariadic = CurBlock->TheDecl->isVariadic();
2339  else if (FunctionDecl *FD = getCurFunctionDecl())
2340  IsVariadic = FD->isVariadic();
2341  else if (ObjCMethodDecl *MD = getCurMethodDecl())
2342  IsVariadic = MD->isVariadic();
2343  else
2344  llvm_unreachable("unexpected statement type");
2345 
2346  if (!IsVariadic) {
2347  Diag(Func->getLocStart(), diag::err_va_start_used_in_non_variadic_function);
2348  return true;
2349  }
2350 
2351  // Type-check the first argument normally.
2352  if (checkBuiltinArgument(*this, Call, 0))
2353  return true;
2354 
2355  const struct {
2356  unsigned ArgNo;
2357  QualType Type;
2358  } ArgumentTypes[] = {
2359  { 1, Context.getPointerType(Context.CharTy.withConst()) },
2360  { 2, Context.getSizeType() },
2361  };
2362 
2363  for (const auto &AT : ArgumentTypes) {
2364  const Expr *Arg = Call->getArg(AT.ArgNo)->IgnoreParens();
2365  if (Arg->getType().getCanonicalType() == AT.Type.getCanonicalType())
2366  continue;
2367  Diag(Arg->getLocStart(), diag::err_typecheck_convert_incompatible)
2368  << Arg->getType() << AT.Type << 1 /* different class */
2369  << 0 /* qualifier difference */ << 3 /* parameter mismatch */
2370  << AT.ArgNo + 1 << Arg->getType() << AT.Type;
2371  }
2372 
2373  return false;
2374 }
2375 
2376 /// SemaBuiltinUnorderedCompare - Handle functions like __builtin_isgreater and
2377 /// friends. This is declared to take (...), so we have to check everything.
2378 bool Sema::SemaBuiltinUnorderedCompare(CallExpr *TheCall) {
2379  if (TheCall->getNumArgs() < 2)
2380  return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
2381  << 0 << 2 << TheCall->getNumArgs()/*function call*/;
2382  if (TheCall->getNumArgs() > 2)
2383  return Diag(TheCall->getArg(2)->getLocStart(),
2384  diag::err_typecheck_call_too_many_args)
2385  << 0 /*function call*/ << 2 << TheCall->getNumArgs()
2386  << SourceRange(TheCall->getArg(2)->getLocStart(),
2387  (*(TheCall->arg_end()-1))->getLocEnd());
2388 
2389  ExprResult OrigArg0 = TheCall->getArg(0);
2390  ExprResult OrigArg1 = TheCall->getArg(1);
2391 
2392  // Do standard promotions between the two arguments, returning their common
2393  // type.
2394  QualType Res = UsualArithmeticConversions(OrigArg0, OrigArg1, false);
2395  if (OrigArg0.isInvalid() || OrigArg1.isInvalid())
2396  return true;
2397 
2398  // Make sure any conversions are pushed back into the call; this is
2399  // type safe since unordered compare builtins are declared as "_Bool
2400  // foo(...)".
2401  TheCall->setArg(0, OrigArg0.get());
2402  TheCall->setArg(1, OrigArg1.get());
2403 
2404  if (OrigArg0.get()->isTypeDependent() || OrigArg1.get()->isTypeDependent())
2405  return false;
2406 
2407  // If the common type isn't a real floating type, then the arguments were
2408  // invalid for this operation.
2409  if (Res.isNull() || !Res->isRealFloatingType())
2410  return Diag(OrigArg0.get()->getLocStart(),
2411  diag::err_typecheck_call_invalid_ordered_compare)
2412  << OrigArg0.get()->getType() << OrigArg1.get()->getType()
2413  << SourceRange(OrigArg0.get()->getLocStart(), OrigArg1.get()->getLocEnd());
2414 
2415  return false;
2416 }
2417 
2418 /// SemaBuiltinSemaBuiltinFPClassification - Handle functions like
2419 /// __builtin_isnan and friends. This is declared to take (...), so we have
2420 /// to check everything. We expect the last argument to be a floating point
2421 /// value.
2422 bool Sema::SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs) {
2423  if (TheCall->getNumArgs() < NumArgs)
2424  return Diag(TheCall->getLocEnd(), diag::err_typecheck_call_too_few_args)
2425  << 0 << NumArgs << TheCall->getNumArgs()/*function call*/;
2426  if (TheCall->getNumArgs() > NumArgs)
2427  return Diag(TheCall->getArg(NumArgs)->getLocStart(),
2428  diag::err_typecheck_call_too_many_args)
2429  << 0 /*function call*/ << NumArgs << TheCall->getNumArgs()
2430  << SourceRange(TheCall->getArg(NumArgs)->getLocStart(),
2431  (*(TheCall->arg_end()-1))->getLocEnd());
2432 
2433  Expr *OrigArg = TheCall->getArg(NumArgs-1);
2434 
2435  if (OrigArg->isTypeDependent())
2436  return false;
2437 
2438  // This operation requires a non-_Complex floating-point number.
2439  if (!OrigArg->getType()->isRealFloatingType())
2440  return Diag(OrigArg->getLocStart(),
2441  diag::err_typecheck_call_invalid_unary_fp)
2442  << OrigArg->getType() << OrigArg->getSourceRange();
2443 
2444  // If this is an implicit conversion from float -> double, remove it.
2445  if (ImplicitCastExpr *Cast = dyn_cast<ImplicitCastExpr>(OrigArg)) {
2446  Expr *CastArg = Cast->getSubExpr();
2447  if (CastArg->getType()->isSpecificBuiltinType(BuiltinType::Float)) {
2448  assert(Cast->getType()->isSpecificBuiltinType(BuiltinType::Double) &&
2449  "promotion from float to double is the only expected cast here");
2450  Cast->setSubExpr(nullptr);
2451  TheCall->setArg(NumArgs-1, CastArg);
2452  }
2453  }
2454 
2455  return false;
2456 }
2457 
2458 /// SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
2459 // This is declared to take (...), so we have to check everything.
2461  if (TheCall->getNumArgs() < 2)
2462  return ExprError(Diag(TheCall->getLocEnd(),
2463  diag::err_typecheck_call_too_few_args_at_least)
2464  << 0 /*function call*/ << 2 << TheCall->getNumArgs()
2465  << TheCall->getSourceRange());
2466 
2467  // Determine which of the following types of shufflevector we're checking:
2468  // 1) unary, vector mask: (lhs, mask)
2469  // 2) binary, vector mask: (lhs, rhs, mask)
2470  // 3) binary, scalar mask: (lhs, rhs, index, ..., index)
2471  QualType resType = TheCall->getArg(0)->getType();
2472  unsigned numElements = 0;
2473 
2474  if (!TheCall->getArg(0)->isTypeDependent() &&
2475  !TheCall->getArg(1)->isTypeDependent()) {
2476  QualType LHSType = TheCall->getArg(0)->getType();
2477  QualType RHSType = TheCall->getArg(1)->getType();
2478 
2479  if (!LHSType->isVectorType() || !RHSType->isVectorType())
2480  return ExprError(Diag(TheCall->getLocStart(),
2481  diag::err_shufflevector_non_vector)
2482  << SourceRange(TheCall->getArg(0)->getLocStart(),
2483  TheCall->getArg(1)->getLocEnd()));
2484 
2485  numElements = LHSType->getAs<VectorType>()->getNumElements();
2486  unsigned numResElements = TheCall->getNumArgs() - 2;
2487 
2488  // Check to see if we have a call with 2 vector arguments, the unary shuffle
2489  // with mask. If so, verify that RHS is an integer vector type with the
2490  // same number of elts as lhs.
2491  if (TheCall->getNumArgs() == 2) {
2492  if (!RHSType->hasIntegerRepresentation() ||
2493  RHSType->getAs<VectorType>()->getNumElements() != numElements)
2494  return ExprError(Diag(TheCall->getLocStart(),
2495  diag::err_shufflevector_incompatible_vector)
2496  << SourceRange(TheCall->getArg(1)->getLocStart(),
2497  TheCall->getArg(1)->getLocEnd()));
2498  } else if (!Context.hasSameUnqualifiedType(LHSType, RHSType)) {
2499  return ExprError(Diag(TheCall->getLocStart(),
2500  diag::err_shufflevector_incompatible_vector)
2501  << SourceRange(TheCall->getArg(0)->getLocStart(),
2502  TheCall->getArg(1)->getLocEnd()));
2503  } else if (numElements != numResElements) {
2504  QualType eltType = LHSType->getAs<VectorType>()->getElementType();
2505  resType = Context.getVectorType(eltType, numResElements,
2507  }
2508  }
2509 
2510  for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
2511  if (TheCall->getArg(i)->isTypeDependent() ||
2512  TheCall->getArg(i)->isValueDependent())
2513  continue;
2514 
2515  llvm::APSInt Result(32);
2516  if (!TheCall->getArg(i)->isIntegerConstantExpr(Result, Context))
2517  return ExprError(Diag(TheCall->getLocStart(),
2518  diag::err_shufflevector_nonconstant_argument)
2519  << TheCall->getArg(i)->getSourceRange());
2520 
2521  // Allow -1 which will be translated to undef in the IR.
2522  if (Result.isSigned() && Result.isAllOnesValue())
2523  continue;
2524 
2525  if (Result.getActiveBits() > 64 || Result.getZExtValue() >= numElements*2)
2526  return ExprError(Diag(TheCall->getLocStart(),
2527  diag::err_shufflevector_argument_too_large)
2528  << TheCall->getArg(i)->getSourceRange());
2529  }
2530 
2531  SmallVector<Expr*, 32> exprs;
2532 
2533  for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
2534  exprs.push_back(TheCall->getArg(i));
2535  TheCall->setArg(i, nullptr);
2536  }
2537 
2538  return new (Context) ShuffleVectorExpr(Context, exprs, resType,
2539  TheCall->getCallee()->getLocStart(),
2540  TheCall->getRParenLoc());
2541 }
2542 
2543 /// SemaConvertVectorExpr - Handle __builtin_convertvector
2545  SourceLocation BuiltinLoc,
2546  SourceLocation RParenLoc) {
2547  ExprValueKind VK = VK_RValue;
2549  QualType DstTy = TInfo->getType();
2550  QualType SrcTy = E->getType();
2551 
2552  if (!SrcTy->isVectorType() && !SrcTy->isDependentType())
2553  return ExprError(Diag(BuiltinLoc,
2554  diag::err_convertvector_non_vector)
2555  << E->getSourceRange());
2556  if (!DstTy->isVectorType() && !DstTy->isDependentType())
2557  return ExprError(Diag(BuiltinLoc,
2558  diag::err_convertvector_non_vector_type));
2559 
2560  if (!SrcTy->isDependentType() && !DstTy->isDependentType()) {
2561  unsigned SrcElts = SrcTy->getAs<VectorType>()->getNumElements();
2562  unsigned DstElts = DstTy->getAs<VectorType>()->getNumElements();
2563  if (SrcElts != DstElts)
2564  return ExprError(Diag(BuiltinLoc,
2565  diag::err_convertvector_incompatible_vector)
2566  << E->getSourceRange());
2567  }
2568 
2569  return new (Context)
2570  ConvertVectorExpr(E, TInfo, DstTy, VK, OK, BuiltinLoc, RParenLoc);
2571 }
2572 
2573 /// SemaBuiltinPrefetch - Handle __builtin_prefetch.
2574 // This is declared to take (const void*, ...) and can take two
2575 // optional constant int args.
2576 bool Sema::SemaBuiltinPrefetch(CallExpr *TheCall) {
2577  unsigned NumArgs = TheCall->getNumArgs();
2578 
2579  if (NumArgs > 3)
2580  return Diag(TheCall->getLocEnd(),
2581  diag::err_typecheck_call_too_many_args_at_most)
2582  << 0 /*function call*/ << 3 << NumArgs
2583  << TheCall->getSourceRange();
2584 
2585  // Argument 0 is checked for us and the remaining arguments must be
2586  // constant integers.
2587  for (unsigned i = 1; i != NumArgs; ++i)
2588  if (SemaBuiltinConstantArgRange(TheCall, i, 0, i == 1 ? 1 : 3))
2589  return true;
2590 
2591  return false;
2592 }
2593 
2594 /// SemaBuiltinAssume - Handle __assume (MS Extension).
2595 // __assume does not evaluate its arguments, and should warn if its argument
2596 // has side effects.
2597 bool Sema::SemaBuiltinAssume(CallExpr *TheCall) {
2598  Expr *Arg = TheCall->getArg(0);
2599  if (Arg->isInstantiationDependent()) return false;
2600 
2601  if (Arg->HasSideEffects(Context))
2602  Diag(Arg->getLocStart(), diag::warn_assume_side_effects)
2603  << Arg->getSourceRange()
2604  << cast<FunctionDecl>(TheCall->getCalleeDecl())->getIdentifier();
2605 
2606  return false;
2607 }
2608 
2609 /// Handle __builtin_assume_aligned. This is declared
2610 /// as (const void*, size_t, ...) and can take one optional constant int arg.
2611 bool Sema::SemaBuiltinAssumeAligned(CallExpr *TheCall) {
2612  unsigned NumArgs = TheCall->getNumArgs();
2613 
2614  if (NumArgs > 3)
2615  return Diag(TheCall->getLocEnd(),
2616  diag::err_typecheck_call_too_many_args_at_most)
2617  << 0 /*function call*/ << 3 << NumArgs
2618  << TheCall->getSourceRange();
2619 
2620  // The alignment must be a constant integer.
2621  Expr *Arg = TheCall->getArg(1);
2622 
2623  // We can't check the value of a dependent argument.
2624  if (!Arg->isTypeDependent() && !Arg->isValueDependent()) {
2625  llvm::APSInt Result;
2626  if (SemaBuiltinConstantArg(TheCall, 1, Result))
2627  return true;
2628 
2629  if (!Result.isPowerOf2())
2630  return Diag(TheCall->getLocStart(),
2631  diag::err_alignment_not_power_of_two)
2632  << Arg->getSourceRange();
2633  }
2634 
2635  if (NumArgs > 2) {
2636  ExprResult Arg(TheCall->getArg(2));
2638  Context.getSizeType(), false);
2639  Arg = PerformCopyInitialization(Entity, SourceLocation(), Arg);
2640  if (Arg.isInvalid()) return true;
2641  TheCall->setArg(2, Arg.get());
2642  }
2643 
2644  return false;
2645 }
2646 
2647 /// SemaBuiltinConstantArg - Handle a check if argument ArgNum of CallExpr
2648 /// TheCall is a constant expression.
2649 bool Sema::SemaBuiltinConstantArg(CallExpr *TheCall, int ArgNum,
2650  llvm::APSInt &Result) {
2651  Expr *Arg = TheCall->getArg(ArgNum);
2652  DeclRefExpr *DRE =cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
2653  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
2654 
2655  if (Arg->isTypeDependent() || Arg->isValueDependent()) return false;
2656 
2657  if (!Arg->isIntegerConstantExpr(Result, Context))
2658  return Diag(TheCall->getLocStart(), diag::err_constant_integer_arg_type)
2659  << FDecl->getDeclName() << Arg->getSourceRange();
2660 
2661  return false;
2662 }
2663 
2664 /// SemaBuiltinConstantArgRange - Handle a check if argument ArgNum of CallExpr
2665 /// TheCall is a constant expression in the range [Low, High].
2666 bool Sema::SemaBuiltinConstantArgRange(CallExpr *TheCall, int ArgNum,
2667  int Low, int High) {
2668  llvm::APSInt Result;
2669 
2670  // We can't check the value of a dependent argument.
2671  Expr *Arg = TheCall->getArg(ArgNum);
2672  if (Arg->isTypeDependent() || Arg->isValueDependent())
2673  return false;
2674 
2675  // Check constant-ness first.
2676  if (SemaBuiltinConstantArg(TheCall, ArgNum, Result))
2677  return true;
2678 
2679  if (Result.getSExtValue() < Low || Result.getSExtValue() > High)
2680  return Diag(TheCall->getLocStart(), diag::err_argument_invalid_range)
2681  << Low << High << Arg->getSourceRange();
2682 
2683  return false;
2684 }
2685 
2686 /// SemaBuiltinARMSpecialReg - Handle a check if argument ArgNum of CallExpr
2687 /// TheCall is an ARM/AArch64 special register string literal.
2688 bool Sema::SemaBuiltinARMSpecialReg(unsigned BuiltinID, CallExpr *TheCall,
2689  int ArgNum, unsigned ExpectedFieldNum,
2690  bool AllowName) {
2691  bool IsARMBuiltin = BuiltinID == ARM::BI__builtin_arm_rsr64 ||
2692  BuiltinID == ARM::BI__builtin_arm_wsr64 ||
2693  BuiltinID == ARM::BI__builtin_arm_rsr ||
2694  BuiltinID == ARM::BI__builtin_arm_rsrp ||
2695  BuiltinID == ARM::BI__builtin_arm_wsr ||
2696  BuiltinID == ARM::BI__builtin_arm_wsrp;
2697  bool IsAArch64Builtin = BuiltinID == AArch64::BI__builtin_arm_rsr64 ||
2698  BuiltinID == AArch64::BI__builtin_arm_wsr64 ||
2699  BuiltinID == AArch64::BI__builtin_arm_rsr ||
2700  BuiltinID == AArch64::BI__builtin_arm_rsrp ||
2701  BuiltinID == AArch64::BI__builtin_arm_wsr ||
2702  BuiltinID == AArch64::BI__builtin_arm_wsrp;
2703  assert((IsARMBuiltin || IsAArch64Builtin) && "Unexpected ARM builtin.");
2704 
2705  // We can't check the value of a dependent argument.
2706  Expr *Arg = TheCall->getArg(ArgNum);
2707  if (Arg->isTypeDependent() || Arg->isValueDependent())
2708  return false;
2709 
2710  // Check if the argument is a string literal.
2711  if (!isa<StringLiteral>(Arg->IgnoreParenImpCasts()))
2712  return Diag(TheCall->getLocStart(), diag::err_expr_not_string_literal)
2713  << Arg->getSourceRange();
2714 
2715  // Check the type of special register given.
2716  StringRef Reg = cast<StringLiteral>(Arg->IgnoreParenImpCasts())->getString();
2718  Reg.split(Fields, ":");
2719 
2720  if (Fields.size() != ExpectedFieldNum && !(AllowName && Fields.size() == 1))
2721  return Diag(TheCall->getLocStart(), diag::err_arm_invalid_specialreg)
2722  << Arg->getSourceRange();
2723 
2724  // If the string is the name of a register then we cannot check that it is
2725  // valid here but if the string is of one the forms described in ACLE then we
2726  // can check that the supplied fields are integers and within the valid
2727  // ranges.
2728  if (Fields.size() > 1) {
2729  bool FiveFields = Fields.size() == 5;
2730 
2731  bool ValidString = true;
2732  if (IsARMBuiltin) {
2733  ValidString &= Fields[0].startswith_lower("cp") ||
2734  Fields[0].startswith_lower("p");
2735  if (ValidString)
2736  Fields[0] =
2737  Fields[0].drop_front(Fields[0].startswith_lower("cp") ? 2 : 1);
2738 
2739  ValidString &= Fields[2].startswith_lower("c");
2740  if (ValidString)
2741  Fields[2] = Fields[2].drop_front(1);
2742 
2743  if (FiveFields) {
2744  ValidString &= Fields[3].startswith_lower("c");
2745  if (ValidString)
2746  Fields[3] = Fields[3].drop_front(1);
2747  }
2748  }
2749 
2751  if (FiveFields)
2752  Ranges.append({IsAArch64Builtin ? 1 : 15, 7, 7, 15, 15});
2753  else
2754  Ranges.append({15, 7, 15});
2755 
2756  for (unsigned i=0; i<Fields.size(); ++i) {
2757  int IntField;
2758  ValidString &= !Fields[i].getAsInteger(10, IntField);
2759  ValidString &= (IntField >= 0 && IntField <= Ranges[i]);
2760  }
2761 
2762  if (!ValidString)
2763  return Diag(TheCall->getLocStart(), diag::err_arm_invalid_specialreg)
2764  << Arg->getSourceRange();
2765 
2766  } else if (IsAArch64Builtin && Fields.size() == 1) {
2767  // If the register name is one of those that appear in the condition below
2768  // and the special register builtin being used is one of the write builtins,
2769  // then we require that the argument provided for writing to the register
2770  // is an integer constant expression. This is because it will be lowered to
2771  // an MSR (immediate) instruction, so we need to know the immediate at
2772  // compile time.
2773  if (TheCall->getNumArgs() != 2)
2774  return false;
2775 
2776  std::string RegLower = Reg.lower();
2777  if (RegLower != "spsel" && RegLower != "daifset" && RegLower != "daifclr" &&
2778  RegLower != "pan" && RegLower != "uao")
2779  return false;
2780 
2781  return SemaBuiltinConstantArgRange(TheCall, 1, 0, 15);
2782  }
2783 
2784  return false;
2785 }
2786 
2787 /// SemaBuiltinCpuSupports - Handle __builtin_cpu_supports(char *).
2788 /// This checks that the target supports __builtin_cpu_supports and
2789 /// that the string argument is constant and valid.
2790 bool Sema::SemaBuiltinCpuSupports(CallExpr *TheCall) {
2791  Expr *Arg = TheCall->getArg(0);
2792 
2793  // Check if the argument is a string literal.
2794  if (!isa<StringLiteral>(Arg->IgnoreParenImpCasts()))
2795  return Diag(TheCall->getLocStart(), diag::err_expr_not_string_literal)
2796  << Arg->getSourceRange();
2797 
2798  // Check the contents of the string.
2799  StringRef Feature =
2800  cast<StringLiteral>(Arg->IgnoreParenImpCasts())->getString();
2801  if (!Context.getTargetInfo().validateCpuSupports(Feature))
2802  return Diag(TheCall->getLocStart(), diag::err_invalid_cpu_supports)
2803  << Arg->getSourceRange();
2804  return false;
2805 }
2806 
2807 /// SemaBuiltinLongjmp - Handle __builtin_longjmp(void *env[5], int val).
2808 /// This checks that the target supports __builtin_longjmp and
2809 /// that val is a constant 1.
2810 bool Sema::SemaBuiltinLongjmp(CallExpr *TheCall) {
2811  if (!Context.getTargetInfo().hasSjLjLowering())
2812  return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_unsupported)
2813  << SourceRange(TheCall->getLocStart(), TheCall->getLocEnd());
2814 
2815  Expr *Arg = TheCall->getArg(1);
2816  llvm::APSInt Result;
2817 
2818  // TODO: This is less than ideal. Overload this to take a value.
2819  if (SemaBuiltinConstantArg(TheCall, 1, Result))
2820  return true;
2821 
2822  if (Result != 1)
2823  return Diag(TheCall->getLocStart(), diag::err_builtin_longjmp_invalid_val)
2824  << SourceRange(Arg->getLocStart(), Arg->getLocEnd());
2825 
2826  return false;
2827 }
2828 
2829 
2830 /// SemaBuiltinSetjmp - Handle __builtin_setjmp(void *env[5]).
2831 /// This checks that the target supports __builtin_setjmp.
2832 bool Sema::SemaBuiltinSetjmp(CallExpr *TheCall) {
2833  if (!Context.getTargetInfo().hasSjLjLowering())
2834  return Diag(TheCall->getLocStart(), diag::err_builtin_setjmp_unsupported)
2835  << SourceRange(TheCall->getLocStart(), TheCall->getLocEnd());
2836  return false;
2837 }
2838 
2839 namespace {
2841  SLCT_NotALiteral,
2842  SLCT_UncheckedLiteral,
2843  SLCT_CheckedLiteral
2844 };
2845 }
2846 
2847 // Determine if an expression is a string literal or constant string.
2848 // If this function returns false on the arguments to a function expecting a
2849 // format string, we will usually need to emit a warning.
2850 // True string literals are then checked by CheckFormatString.
2853  bool HasVAListArg, unsigned format_idx,
2854  unsigned firstDataArg, Sema::FormatStringType Type,
2855  Sema::VariadicCallType CallType, bool InFunctionCall,
2856  llvm::SmallBitVector &CheckedVarArgs) {
2857  tryAgain:
2858  if (E->isTypeDependent() || E->isValueDependent())
2859  return SLCT_NotALiteral;
2860 
2861  E = E->IgnoreParenCasts();
2862 
2864  // Technically -Wformat-nonliteral does not warn about this case.
2865  // The behavior of printf and friends in this case is implementation
2866  // dependent. Ideally if the format string cannot be null then
2867  // it should have a 'nonnull' attribute in the function prototype.
2868  return SLCT_UncheckedLiteral;
2869 
2870  switch (E->getStmtClass()) {
2871  case Stmt::BinaryConditionalOperatorClass:
2872  case Stmt::ConditionalOperatorClass: {
2873  // The expression is a literal if both sub-expressions were, and it was
2874  // completely checked only if both sub-expressions were checked.
2876  cast<AbstractConditionalOperator>(E);
2877  StringLiteralCheckType Left =
2878  checkFormatStringExpr(S, C->getTrueExpr(), Args,
2879  HasVAListArg, format_idx, firstDataArg,
2880  Type, CallType, InFunctionCall, CheckedVarArgs);
2881  if (Left == SLCT_NotALiteral)
2882  return SLCT_NotALiteral;
2883  StringLiteralCheckType Right =
2884  checkFormatStringExpr(S, C->getFalseExpr(), Args,
2885  HasVAListArg, format_idx, firstDataArg,
2886  Type, CallType, InFunctionCall, CheckedVarArgs);
2887  return Left < Right ? Left : Right;
2888  }
2889 
2890  case Stmt::ImplicitCastExprClass: {
2891  E = cast<ImplicitCastExpr>(E)->getSubExpr();
2892  goto tryAgain;
2893  }
2894 
2895  case Stmt::OpaqueValueExprClass:
2896  if (const Expr *src = cast<OpaqueValueExpr>(E)->getSourceExpr()) {
2897  E = src;
2898  goto tryAgain;
2899  }
2900  return SLCT_NotALiteral;
2901 
2902  case Stmt::PredefinedExprClass:
2903  // While __func__, etc., are technically not string literals, they
2904  // cannot contain format specifiers and thus are not a security
2905  // liability.
2906  return SLCT_UncheckedLiteral;
2907 
2908  case Stmt::DeclRefExprClass: {
2909  const DeclRefExpr *DR = cast<DeclRefExpr>(E);
2910 
2911  // As an exception, do not flag errors for variables binding to
2912  // const string literals.
2913  if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
2914  bool isConstant = false;
2915  QualType T = DR->getType();
2916 
2917  if (const ArrayType *AT = S.Context.getAsArrayType(T)) {
2918  isConstant = AT->getElementType().isConstant(S.Context);
2919  } else if (const PointerType *PT = T->getAs<PointerType>()) {
2920  isConstant = T.isConstant(S.Context) &&
2921  PT->getPointeeType().isConstant(S.Context);
2922  } else if (T->isObjCObjectPointerType()) {
2923  // In ObjC, there is usually no "const ObjectPointer" type,
2924  // so don't check if the pointee type is constant.
2925  isConstant = T.isConstant(S.Context);
2926  }
2927 
2928  if (isConstant) {
2929  if (const Expr *Init = VD->getAnyInitializer()) {
2930  // Look through initializers like const char c[] = { "foo" }
2931  if (const InitListExpr *InitList = dyn_cast<InitListExpr>(Init)) {
2932  if (InitList->isStringLiteralInit())
2933  Init = InitList->getInit(0)->IgnoreParenImpCasts();
2934  }
2935  return checkFormatStringExpr(S, Init, Args,
2936  HasVAListArg, format_idx,
2937  firstDataArg, Type, CallType,
2938  /*InFunctionCall*/false, CheckedVarArgs);
2939  }
2940  }
2941 
2942  // For vprintf* functions (i.e., HasVAListArg==true), we add a
2943  // special check to see if the format string is a function parameter
2944  // of the function calling the printf function. If the function
2945  // has an attribute indicating it is a printf-like function, then we
2946  // should suppress warnings concerning non-literals being used in a call
2947  // to a vprintf function. For example:
2948  //
2949  // void
2950  // logmessage(char const *fmt __attribute__ (format (printf, 1, 2)), ...){
2951  // va_list ap;
2952  // va_start(ap, fmt);
2953  // vprintf(fmt, ap); // Do NOT emit a warning about "fmt".
2954  // ...
2955  // }
2956  if (HasVAListArg) {
2957  if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(VD)) {
2958  if (const NamedDecl *ND = dyn_cast<NamedDecl>(PV->getDeclContext())) {
2959  int PVIndex = PV->getFunctionScopeIndex() + 1;
2960  for (const auto *PVFormat : ND->specific_attrs<FormatAttr>()) {
2961  // adjust for implicit parameter
2962  if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(ND))
2963  if (MD->isInstance())
2964  ++PVIndex;
2965  // We also check if the formats are compatible.
2966  // We can't pass a 'scanf' string to a 'printf' function.
2967  if (PVIndex == PVFormat->getFormatIdx() &&
2968  Type == S.GetFormatStringType(PVFormat))
2969  return SLCT_UncheckedLiteral;
2970  }
2971  }
2972  }
2973  }
2974  }
2975 
2976  return SLCT_NotALiteral;
2977  }
2978 
2979  case Stmt::CallExprClass:
2980  case Stmt::CXXMemberCallExprClass: {
2981  const CallExpr *CE = cast<CallExpr>(E);
2982  if (const NamedDecl *ND = dyn_cast_or_null<NamedDecl>(CE->getCalleeDecl())) {
2983  if (const FormatArgAttr *FA = ND->getAttr<FormatArgAttr>()) {
2984  unsigned ArgIndex = FA->getFormatIdx();
2985  if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(ND))
2986  if (MD->isInstance())
2987  --ArgIndex;
2988  const Expr *Arg = CE->getArg(ArgIndex - 1);
2989 
2990  return checkFormatStringExpr(S, Arg, Args,
2991  HasVAListArg, format_idx, firstDataArg,
2992  Type, CallType, InFunctionCall,
2993  CheckedVarArgs);
2994  } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(ND)) {
2995  unsigned BuiltinID = FD->getBuiltinID();
2996  if (BuiltinID == Builtin::BI__builtin___CFStringMakeConstantString ||
2997  BuiltinID == Builtin::BI__builtin___NSStringMakeConstantString) {
2998  const Expr *Arg = CE->getArg(0);
2999  return checkFormatStringExpr(S, Arg, Args,
3000  HasVAListArg, format_idx,
3001  firstDataArg, Type, CallType,
3002  InFunctionCall, CheckedVarArgs);
3003  }
3004  }
3005  }
3006 
3007  return SLCT_NotALiteral;
3008  }
3009  case Stmt::ObjCStringLiteralClass:
3010  case Stmt::StringLiteralClass: {
3011  const StringLiteral *StrE = nullptr;
3012 
3013  if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(E))
3014  StrE = ObjCFExpr->getString();
3015  else
3016  StrE = cast<StringLiteral>(E);
3017 
3018  if (StrE) {
3019  S.CheckFormatString(StrE, E, Args, HasVAListArg, format_idx, firstDataArg,
3020  Type, InFunctionCall, CallType, CheckedVarArgs);
3021  return SLCT_CheckedLiteral;
3022  }
3023 
3024  return SLCT_NotALiteral;
3025  }
3026 
3027  default:
3028  return SLCT_NotALiteral;
3029  }
3030 }
3031 
3033  return llvm::StringSwitch<FormatStringType>(Format->getType()->getName())
3034  .Case("scanf", FST_Scanf)
3035  .Cases("printf", "printf0", FST_Printf)
3036  .Cases("NSString", "CFString", FST_NSString)
3037  .Case("strftime", FST_Strftime)
3038  .Case("strfmon", FST_Strfmon)
3039  .Cases("kprintf", "cmn_err", "vcmn_err", "zcmn_err", FST_Kprintf)
3040  .Case("freebsd_kprintf", FST_FreeBSDKPrintf)
3041  .Case("os_trace", FST_OSTrace)
3042  .Default(FST_Unknown);
3043 }
3044 
3045 /// CheckFormatArguments - Check calls to printf and scanf (and similar
3046 /// functions) for correct use of format strings.
3047 /// Returns true if a format string has been fully checked.
3048 bool Sema::CheckFormatArguments(const FormatAttr *Format,
3050  bool IsCXXMember,
3051  VariadicCallType CallType,
3052  SourceLocation Loc, SourceRange Range,
3053  llvm::SmallBitVector &CheckedVarArgs) {
3054  FormatStringInfo FSI;
3055  if (getFormatStringInfo(Format, IsCXXMember, &FSI))
3056  return CheckFormatArguments(Args, FSI.HasVAListArg, FSI.FormatIdx,
3057  FSI.FirstDataArg, GetFormatStringType(Format),
3058  CallType, Loc, Range, CheckedVarArgs);
3059  return false;
3060 }
3061 
3062 bool Sema::CheckFormatArguments(ArrayRef<const Expr *> Args,
3063  bool HasVAListArg, unsigned format_idx,
3064  unsigned firstDataArg, FormatStringType Type,
3065  VariadicCallType CallType,
3066  SourceLocation Loc, SourceRange Range,
3067  llvm::SmallBitVector &CheckedVarArgs) {
3068  // CHECK: printf/scanf-like function is called with no format string.
3069  if (format_idx >= Args.size()) {
3070  Diag(Loc, diag::warn_missing_format_string) << Range;
3071  return false;
3072  }
3073 
3074  const Expr *OrigFormatExpr = Args[format_idx]->IgnoreParenCasts();
3075 
3076  // CHECK: format string is not a string literal.
3077  //
3078  // Dynamically generated format strings are difficult to
3079  // automatically vet at compile time. Requiring that format strings
3080  // are string literals: (1) permits the checking of format strings by
3081  // the compiler and thereby (2) can practically remove the source of
3082  // many format string exploits.
3083 
3084  // Format string can be either ObjC string (e.g. @"%d") or
3085  // C string (e.g. "%d")
3086  // ObjC string uses the same format specifiers as C string, so we can use
3087  // the same format string checking logic for both ObjC and C strings.
3089  checkFormatStringExpr(*this, OrigFormatExpr, Args, HasVAListArg,
3090  format_idx, firstDataArg, Type, CallType,
3091  /*IsFunctionCall*/true, CheckedVarArgs);
3092  if (CT != SLCT_NotALiteral)
3093  // Literal format string found, check done!
3094  return CT == SLCT_CheckedLiteral;
3095 
3096  // Strftime is particular as it always uses a single 'time' argument,
3097  // so it is safe to pass a non-literal string.
3098  if (Type == FST_Strftime)
3099  return false;
3100 
3101  // Do not emit diag when the string param is a macro expansion and the
3102  // format is either NSString or CFString. This is a hack to prevent
3103  // diag when using the NSLocalizedString and CFCopyLocalizedString macros
3104  // which are usually used in place of NS and CF string literals.
3105  if (Type == FST_NSString &&
3106  SourceMgr.isInSystemMacro(Args[format_idx]->getLocStart()))
3107  return false;
3108 
3109  // If there are no arguments specified, warn with -Wformat-security, otherwise
3110  // warn only with -Wformat-nonliteral.
3111  if (Args.size() == firstDataArg)
3112  Diag(Args[format_idx]->getLocStart(),
3113  diag::warn_format_nonliteral_noargs)
3114  << OrigFormatExpr->getSourceRange();
3115  else
3116  Diag(Args[format_idx]->getLocStart(),
3117  diag::warn_format_nonliteral)
3118  << OrigFormatExpr->getSourceRange();
3119  return false;
3120 }
3121 
3122 namespace {
3123 class CheckFormatHandler : public analyze_format_string::FormatStringHandler {
3124 protected:
3125  Sema &S;
3126  const StringLiteral *FExpr;
3127  const Expr *OrigFormatExpr;
3128  const unsigned FirstDataArg;
3129  const unsigned NumDataArgs;
3130  const char *Beg; // Start of format string.
3131  const bool HasVAListArg;
3133  unsigned FormatIdx;
3134  llvm::SmallBitVector CoveredArgs;
3135  bool usesPositionalArgs;
3136  bool atFirstArg;
3137  bool inFunctionCall;
3138  Sema::VariadicCallType CallType;
3139  llvm::SmallBitVector &CheckedVarArgs;
3140 public:
3141  CheckFormatHandler(Sema &s, const StringLiteral *fexpr,
3142  const Expr *origFormatExpr, unsigned firstDataArg,
3143  unsigned numDataArgs, const char *beg, bool hasVAListArg,
3145  unsigned formatIdx, bool inFunctionCall,
3146  Sema::VariadicCallType callType,
3147  llvm::SmallBitVector &CheckedVarArgs)
3148  : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr),
3149  FirstDataArg(firstDataArg), NumDataArgs(numDataArgs),
3150  Beg(beg), HasVAListArg(hasVAListArg),
3151  Args(Args), FormatIdx(formatIdx),
3152  usesPositionalArgs(false), atFirstArg(true),
3153  inFunctionCall(inFunctionCall), CallType(callType),
3154  CheckedVarArgs(CheckedVarArgs) {
3155  CoveredArgs.resize(numDataArgs);
3156  CoveredArgs.reset();
3157  }
3158 
3159  void DoneProcessing();
3160 
3161  void HandleIncompleteSpecifier(const char *startSpecifier,
3162  unsigned specifierLen) override;
3163 
3164  void HandleInvalidLengthModifier(
3167  const char *startSpecifier, unsigned specifierLen,
3168  unsigned DiagID);
3169 
3170  void HandleNonStandardLengthModifier(
3172  const char *startSpecifier, unsigned specifierLen);
3173 
3174  void HandleNonStandardConversionSpecifier(
3176  const char *startSpecifier, unsigned specifierLen);
3177 
3178  void HandlePosition(const char *startPos, unsigned posLen) override;
3179 
3180  void HandleInvalidPosition(const char *startSpecifier,
3181  unsigned specifierLen,
3183 
3184  void HandleZeroPosition(const char *startPos, unsigned posLen) override;
3185 
3186  void HandleNullChar(const char *nullCharacter) override;
3187 
3188  template <typename Range>
3189  static void EmitFormatDiagnostic(Sema &S, bool inFunctionCall,
3190  const Expr *ArgumentExpr,
3191  PartialDiagnostic PDiag,
3192  SourceLocation StringLoc,
3193  bool IsStringLocation, Range StringRange,
3194  ArrayRef<FixItHint> Fixit = None);
3195 
3196 protected:
3197  bool HandleInvalidConversionSpecifier(unsigned argIndex, SourceLocation Loc,
3198  const char *startSpec,
3199  unsigned specifierLen,
3200  const char *csStart, unsigned csLen);
3201 
3202  void HandlePositionalNonpositionalArgs(SourceLocation Loc,
3203  const char *startSpec,
3204  unsigned specifierLen);
3205 
3206  SourceRange getFormatStringRange();
3207  CharSourceRange getSpecifierRange(const char *startSpecifier,
3208  unsigned specifierLen);
3209  SourceLocation getLocationOfByte(const char *x);
3210 
3211  const Expr *getDataArg(unsigned i) const;
3212 
3213  bool CheckNumArgs(const analyze_format_string::FormatSpecifier &FS,
3215  const char *startSpecifier, unsigned specifierLen,
3216  unsigned argIndex);
3217 
3218  template <typename Range>
3219  void EmitFormatDiagnostic(PartialDiagnostic PDiag, SourceLocation StringLoc,
3220  bool IsStringLocation, Range StringRange,
3221  ArrayRef<FixItHint> Fixit = None);
3222 };
3223 }
3224 
3225 SourceRange CheckFormatHandler::getFormatStringRange() {
3226  return OrigFormatExpr->getSourceRange();
3227 }
3228 
3229 CharSourceRange CheckFormatHandler::
3230 getSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
3231  SourceLocation Start = getLocationOfByte(startSpecifier);
3232  SourceLocation End = getLocationOfByte(startSpecifier + specifierLen - 1);
3233 
3234  // Advance the end SourceLocation by one due to half-open ranges.
3235  End = End.getLocWithOffset(1);
3236 
3237  return CharSourceRange::getCharRange(Start, End);
3238 }
3239 
3240 SourceLocation CheckFormatHandler::getLocationOfByte(const char *x) {
3241  return S.getLocationOfStringLiteralByte(FExpr, x - Beg);
3242 }
3243 
3244 void CheckFormatHandler::HandleIncompleteSpecifier(const char *startSpecifier,
3245  unsigned specifierLen){
3246  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_incomplete_specifier),
3247  getLocationOfByte(startSpecifier),
3248  /*IsStringLocation*/true,
3249  getSpecifierRange(startSpecifier, specifierLen));
3250 }
3251 
3252 void CheckFormatHandler::HandleInvalidLengthModifier(
3255  const char *startSpecifier, unsigned specifierLen, unsigned DiagID) {
3256  using namespace analyze_format_string;
3257 
3258  const LengthModifier &LM = FS.getLengthModifier();
3259  CharSourceRange LMRange = getSpecifierRange(LM.getStart(), LM.getLength());
3260 
3261  // See if we know how to fix this length modifier.
3263  if (FixedLM) {
3264  EmitFormatDiagnostic(S.PDiag(DiagID) << LM.toString() << CS.toString(),
3265  getLocationOfByte(LM.getStart()),
3266  /*IsStringLocation*/true,
3267  getSpecifierRange(startSpecifier, specifierLen));
3268 
3269  S.Diag(getLocationOfByte(LM.getStart()), diag::note_format_fix_specifier)
3270  << FixedLM->toString()
3271  << FixItHint::CreateReplacement(LMRange, FixedLM->toString());
3272 
3273  } else {
3274  FixItHint Hint;
3275  if (DiagID == diag::warn_format_nonsensical_length)
3276  Hint = FixItHint::CreateRemoval(LMRange);
3277 
3278  EmitFormatDiagnostic(S.PDiag(DiagID) << LM.toString() << CS.toString(),
3279  getLocationOfByte(LM.getStart()),
3280  /*IsStringLocation*/true,
3281  getSpecifierRange(startSpecifier, specifierLen),
3282  Hint);
3283  }
3284 }
3285 
3286 void CheckFormatHandler::HandleNonStandardLengthModifier(
3288  const char *startSpecifier, unsigned specifierLen) {
3289  using namespace analyze_format_string;
3290 
3291  const LengthModifier &LM = FS.getLengthModifier();
3292  CharSourceRange LMRange = getSpecifierRange(LM.getStart(), LM.getLength());
3293 
3294  // See if we know how to fix this length modifier.
3296  if (FixedLM) {
3297  EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
3298  << LM.toString() << 0,
3299  getLocationOfByte(LM.getStart()),
3300  /*IsStringLocation*/true,
3301  getSpecifierRange(startSpecifier, specifierLen));
3302 
3303  S.Diag(getLocationOfByte(LM.getStart()), diag::note_format_fix_specifier)
3304  << FixedLM->toString()
3305  << FixItHint::CreateReplacement(LMRange, FixedLM->toString());
3306 
3307  } else {
3308  EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
3309  << LM.toString() << 0,
3310  getLocationOfByte(LM.getStart()),
3311  /*IsStringLocation*/true,
3312  getSpecifierRange(startSpecifier, specifierLen));
3313  }
3314 }
3315 
3316 void CheckFormatHandler::HandleNonStandardConversionSpecifier(
3318  const char *startSpecifier, unsigned specifierLen) {
3319  using namespace analyze_format_string;
3320 
3321  // See if we know how to fix this conversion specifier.
3323  if (FixedCS) {
3324  EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
3325  << CS.toString() << /*conversion specifier*/1,
3326  getLocationOfByte(CS.getStart()),
3327  /*IsStringLocation*/true,
3328  getSpecifierRange(startSpecifier, specifierLen));
3329 
3330  CharSourceRange CSRange = getSpecifierRange(CS.getStart(), CS.getLength());
3331  S.Diag(getLocationOfByte(CS.getStart()), diag::note_format_fix_specifier)
3332  << FixedCS->toString()
3333  << FixItHint::CreateReplacement(CSRange, FixedCS->toString());
3334  } else {
3335  EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
3336  << CS.toString() << /*conversion specifier*/1,
3337  getLocationOfByte(CS.getStart()),
3338  /*IsStringLocation*/true,
3339  getSpecifierRange(startSpecifier, specifierLen));
3340  }
3341 }
3342 
3343 void CheckFormatHandler::HandlePosition(const char *startPos,
3344  unsigned posLen) {
3345  EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard_positional_arg),
3346  getLocationOfByte(startPos),
3347  /*IsStringLocation*/true,
3348  getSpecifierRange(startPos, posLen));
3349 }
3350 
3351 void
3352 CheckFormatHandler::HandleInvalidPosition(const char *startPos, unsigned posLen,
3354  EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_positional_specifier)
3355  << (unsigned) p,
3356  getLocationOfByte(startPos), /*IsStringLocation*/true,
3357  getSpecifierRange(startPos, posLen));
3358 }
3359 
3360 void CheckFormatHandler::HandleZeroPosition(const char *startPos,
3361  unsigned posLen) {
3362  EmitFormatDiagnostic(S.PDiag(diag::warn_format_zero_positional_specifier),
3363  getLocationOfByte(startPos),
3364  /*IsStringLocation*/true,
3365  getSpecifierRange(startPos, posLen));
3366 }
3367 
3368 void CheckFormatHandler::HandleNullChar(const char *nullCharacter) {
3369  if (!isa<ObjCStringLiteral>(OrigFormatExpr)) {
3370  // The presence of a null character is likely an error.
3371  EmitFormatDiagnostic(
3372  S.PDiag(diag::warn_printf_format_string_contains_null_char),
3373  getLocationOfByte(nullCharacter), /*IsStringLocation*/true,
3374  getFormatStringRange());
3375  }
3376 }
3377 
3378 // Note that this may return NULL if there was an error parsing or building
3379 // one of the argument expressions.
3380 const Expr *CheckFormatHandler::getDataArg(unsigned i) const {
3381  return Args[FirstDataArg + i];
3382 }
3383 
3384 void CheckFormatHandler::DoneProcessing() {
3385  // Does the number of data arguments exceed the number of
3386  // format conversions in the format string?
3387  if (!HasVAListArg) {
3388  // Find any arguments that weren't covered.
3389  CoveredArgs.flip();
3390  signed notCoveredArg = CoveredArgs.find_first();
3391  if (notCoveredArg >= 0) {
3392  assert((unsigned)notCoveredArg < NumDataArgs);
3393  if (const Expr *E = getDataArg((unsigned) notCoveredArg)) {
3394  SourceLocation Loc = E->getLocStart();
3395  if (!S.getSourceManager().isInSystemMacro(Loc)) {
3396  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_data_arg_not_used),
3397  Loc, /*IsStringLocation*/false,
3398  getFormatStringRange());
3399  }
3400  }
3401  }
3402  }
3403 }
3404 
3405 bool
3406 CheckFormatHandler::HandleInvalidConversionSpecifier(unsigned argIndex,
3407  SourceLocation Loc,
3408  const char *startSpec,
3409  unsigned specifierLen,
3410  const char *csStart,
3411  unsigned csLen) {
3412 
3413  bool keepGoing = true;
3414  if (argIndex < NumDataArgs) {
3415  // Consider the argument coverered, even though the specifier doesn't
3416  // make sense.
3417  CoveredArgs.set(argIndex);
3418  }
3419  else {
3420  // If argIndex exceeds the number of data arguments we
3421  // don't issue a warning because that is just a cascade of warnings (and
3422  // they may have intended '%%' anyway). We don't want to continue processing
3423  // the format string after this point, however, as we will like just get
3424  // gibberish when trying to match arguments.
3425  keepGoing = false;
3426  }
3427 
3428  EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_conversion)
3429  << StringRef(csStart, csLen),
3430  Loc, /*IsStringLocation*/true,
3431  getSpecifierRange(startSpec, specifierLen));
3432 
3433  return keepGoing;
3434 }
3435 
3436 void
3437 CheckFormatHandler::HandlePositionalNonpositionalArgs(SourceLocation Loc,
3438  const char *startSpec,
3439  unsigned specifierLen) {
3440  EmitFormatDiagnostic(
3441  S.PDiag(diag::warn_format_mix_positional_nonpositional_args),
3442  Loc, /*isStringLoc*/true, getSpecifierRange(startSpec, specifierLen));
3443 }
3444 
3445 bool
3446 CheckFormatHandler::CheckNumArgs(
3449  const char *startSpecifier, unsigned specifierLen, unsigned argIndex) {
3450 
3451  if (argIndex >= NumDataArgs) {
3453  ? (S.PDiag(diag::warn_printf_positional_arg_exceeds_data_args)
3454  << (argIndex+1) << NumDataArgs)
3455  : S.PDiag(diag::warn_printf_insufficient_data_args);
3456  EmitFormatDiagnostic(
3457  PDiag, getLocationOfByte(CS.getStart()), /*IsStringLocation*/true,
3458  getSpecifierRange(startSpecifier, specifierLen));
3459  return false;
3460  }
3461  return true;
3462 }
3463 
3464 template<typename Range>
3465 void CheckFormatHandler::EmitFormatDiagnostic(PartialDiagnostic PDiag,
3466  SourceLocation Loc,
3467  bool IsStringLocation,
3468  Range StringRange,
3470  EmitFormatDiagnostic(S, inFunctionCall, Args[FormatIdx], PDiag,
3471  Loc, IsStringLocation, StringRange, FixIt);
3472 }
3473 
3474 /// \brief If the format string is not within the funcion call, emit a note
3475 /// so that the function call and string are in diagnostic messages.
3476 ///
3477 /// \param InFunctionCall if true, the format string is within the function
3478 /// call and only one diagnostic message will be produced. Otherwise, an
3479 /// extra note will be emitted pointing to location of the format string.
3480 ///
3481 /// \param ArgumentExpr the expression that is passed as the format string
3482 /// argument in the function call. Used for getting locations when two
3483 /// diagnostics are emitted.
3484 ///
3485 /// \param PDiag the callee should already have provided any strings for the
3486 /// diagnostic message. This function only adds locations and fixits
3487 /// to diagnostics.
3488 ///
3489 /// \param Loc primary location for diagnostic. If two diagnostics are
3490 /// required, one will be at Loc and a new SourceLocation will be created for
3491 /// the other one.
3492 ///
3493 /// \param IsStringLocation if true, Loc points to the format string should be
3494 /// used for the note. Otherwise, Loc points to the argument list and will
3495 /// be used with PDiag.
3496 ///
3497 /// \param StringRange some or all of the string to highlight. This is
3498 /// templated so it can accept either a CharSourceRange or a SourceRange.
3499 ///
3500 /// \param FixIt optional fix it hint for the format string.
3501 template<typename Range>
3502 void CheckFormatHandler::EmitFormatDiagnostic(Sema &S, bool InFunctionCall,
3503  const Expr *ArgumentExpr,
3504  PartialDiagnostic PDiag,
3505  SourceLocation Loc,
3506  bool IsStringLocation,
3507  Range StringRange,
3509  if (InFunctionCall) {
3510  const Sema::SemaDiagnosticBuilder &D = S.Diag(Loc, PDiag);
3511  D << StringRange;
3512  D << FixIt;
3513  } else {
3514  S.Diag(IsStringLocation ? ArgumentExpr->getExprLoc() : Loc, PDiag)
3515  << ArgumentExpr->getSourceRange();
3516 
3518  S.Diag(IsStringLocation ? Loc : StringRange.getBegin(),
3519  diag::note_format_string_defined);
3520 
3521  Note << StringRange;
3522  Note << FixIt;
3523  }
3524 }
3525 
3526 //===--- CHECK: Printf format string checking ------------------------------===//
3527 
3528 namespace {
3529 class CheckPrintfHandler : public CheckFormatHandler {
3530  bool ObjCContext;
3531 public:
3532  CheckPrintfHandler(Sema &s, const StringLiteral *fexpr,
3533  const Expr *origFormatExpr, unsigned firstDataArg,
3534  unsigned numDataArgs, bool isObjC,
3535  const char *beg, bool hasVAListArg,
3537  unsigned formatIdx, bool inFunctionCall,
3538  Sema::VariadicCallType CallType,
3539  llvm::SmallBitVector &CheckedVarArgs)
3540  : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg,
3541  numDataArgs, beg, hasVAListArg, Args,
3542  formatIdx, inFunctionCall, CallType, CheckedVarArgs),
3543  ObjCContext(isObjC)
3544  {}
3545 
3546 
3547  bool HandleInvalidPrintfConversionSpecifier(
3549  const char *startSpecifier,
3550  unsigned specifierLen) override;
3551 
3552  bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
3553  const char *startSpecifier,
3554  unsigned specifierLen) override;
3555  bool checkFormatExpr(const analyze_printf::PrintfSpecifier &FS,
3556  const char *StartSpecifier,
3557  unsigned SpecifierLen,
3558  const Expr *E);
3559 
3560  bool HandleAmount(const analyze_format_string::OptionalAmount &Amt, unsigned k,
3561  const char *startSpecifier, unsigned specifierLen);
3562  void HandleInvalidAmount(const analyze_printf::PrintfSpecifier &FS,
3563  const analyze_printf::OptionalAmount &Amt,
3564  unsigned type,
3565  const char *startSpecifier, unsigned specifierLen);
3566  void HandleFlag(const analyze_printf::PrintfSpecifier &FS,
3567  const analyze_printf::OptionalFlag &flag,
3568  const char *startSpecifier, unsigned specifierLen);
3569  void HandleIgnoredFlag(const analyze_printf::PrintfSpecifier &FS,
3570  const analyze_printf::OptionalFlag &ignoredFlag,
3571  const analyze_printf::OptionalFlag &flag,
3572  const char *startSpecifier, unsigned specifierLen);
3573  bool checkForCStrMembers(const analyze_printf::ArgType &AT,
3574  const Expr *E);
3575 
3576  void HandleEmptyObjCModifierFlag(const char *startFlag,
3577  unsigned flagLen) override;
3578 
3579  void HandleInvalidObjCModifierFlag(const char *startFlag,
3580  unsigned flagLen) override;
3581 
3582  void HandleObjCFlagsWithNonObjCConversion(const char *flagsStart,
3583  const char *flagsEnd,
3584  const char *conversionPosition)
3585  override;
3586 };
3587 }
3588 
3589 bool CheckPrintfHandler::HandleInvalidPrintfConversionSpecifier(
3591  const char *startSpecifier,
3592  unsigned specifierLen) {
3595 
3596  return HandleInvalidConversionSpecifier(FS.getArgIndex(),
3597  getLocationOfByte(CS.getStart()),
3598  startSpecifier, specifierLen,
3599  CS.getStart(), CS.getLength());
3600 }
3601 
3602 bool CheckPrintfHandler::HandleAmount(
3604  unsigned k, const char *startSpecifier,
3605  unsigned specifierLen) {
3606 
3607  if (Amt.hasDataArgument()) {
3608  if (!HasVAListArg) {
3609  unsigned argIndex = Amt.getArgIndex();
3610  if (argIndex >= NumDataArgs) {
3611  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_missing_arg)
3612  << k,
3613  getLocationOfByte(Amt.getStart()),
3614  /*IsStringLocation*/true,
3615  getSpecifierRange(startSpecifier, specifierLen));
3616  // Don't do any more checking. We will just emit
3617  // spurious errors.
3618  return false;
3619  }
3620 
3621  // Type check the data argument. It should be an 'int'.
3622  // Although not in conformance with C99, we also allow the argument to be
3623  // an 'unsigned int' as that is a reasonably safe case. GCC also
3624  // doesn't emit a warning for that case.
3625  CoveredArgs.set(argIndex);
3626  const Expr *Arg = getDataArg(argIndex);
3627  if (!Arg)
3628  return false;
3629 
3630  QualType T = Arg->getType();
3631 
3632  const analyze_printf::ArgType &AT = Amt.getArgType(S.Context);
3633  assert(AT.isValid());
3634 
3635  if (!AT.matchesType(S.Context, T)) {
3636  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_wrong_type)
3637  << k << AT.getRepresentativeTypeName(S.Context)
3638  << T << Arg->getSourceRange(),
3639  getLocationOfByte(Amt.getStart()),
3640  /*IsStringLocation*/true,
3641  getSpecifierRange(startSpecifier, specifierLen));
3642  // Don't do any more checking. We will just emit
3643  // spurious errors.
3644  return false;
3645  }
3646  }
3647  }
3648  return true;
3649 }
3650 
3651 void CheckPrintfHandler::HandleInvalidAmount(
3653  const analyze_printf::OptionalAmount &Amt,
3654  unsigned type,
3655  const char *startSpecifier,
3656  unsigned specifierLen) {
3659 
3660  FixItHint fixit =
3661  Amt.getHowSpecified() == analyze_printf::OptionalAmount::Constant
3662  ? FixItHint::CreateRemoval(getSpecifierRange(Amt.getStart(),
3663  Amt.getConstantLength()))
3664  : FixItHint();
3665 
3666  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_optional_amount)
3667  << type << CS.toString(),
3668  getLocationOfByte(Amt.getStart()),
3669  /*IsStringLocation*/true,
3670  getSpecifierRange(startSpecifier, specifierLen),
3671  fixit);
3672 }
3673 
3674 void CheckPrintfHandler::HandleFlag(const analyze_printf::PrintfSpecifier &FS,
3675  const analyze_printf::OptionalFlag &flag,
3676  const char *startSpecifier,
3677  unsigned specifierLen) {
3678  // Warn about pointless flag with a fixit removal.
3681  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_flag)
3682  << flag.toString() << CS.toString(),
3683  getLocationOfByte(flag.getPosition()),
3684  /*IsStringLocation*/true,
3685  getSpecifierRange(startSpecifier, specifierLen),
3687  getSpecifierRange(flag.getPosition(), 1)));
3688 }
3689 
3690 void CheckPrintfHandler::HandleIgnoredFlag(
3692  const analyze_printf::OptionalFlag &ignoredFlag,
3693  const analyze_printf::OptionalFlag &flag,
3694  const char *startSpecifier,
3695  unsigned specifierLen) {
3696  // Warn about ignored flag with a fixit removal.
3697  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_ignored_flag)
3698  << ignoredFlag.toString() << flag.toString(),
3699  getLocationOfByte(ignoredFlag.getPosition()),
3700  /*IsStringLocation*/true,
3701  getSpecifierRange(startSpecifier, specifierLen),
3703  getSpecifierRange(ignoredFlag.getPosition(), 1)));
3704 }
3705 
3706 // void EmitFormatDiagnostic(PartialDiagnostic PDiag, SourceLocation StringLoc,
3707 // bool IsStringLocation, Range StringRange,
3708 // ArrayRef<FixItHint> Fixit = None);
3709 
3710 void CheckPrintfHandler::HandleEmptyObjCModifierFlag(const char *startFlag,
3711  unsigned flagLen) {
3712  // Warn about an empty flag.
3713  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_empty_objc_flag),
3714  getLocationOfByte(startFlag),
3715  /*IsStringLocation*/true,
3716  getSpecifierRange(startFlag, flagLen));
3717 }
3718 
3719 void CheckPrintfHandler::HandleInvalidObjCModifierFlag(const char *startFlag,
3720  unsigned flagLen) {
3721  // Warn about an invalid flag.
3722  auto Range = getSpecifierRange(startFlag, flagLen);
3723  StringRef flag(startFlag, flagLen);
3724  EmitFormatDiagnostic(S.PDiag(diag::warn_printf_invalid_objc_flag) << flag,
3725  getLocationOfByte(startFlag),
3726  /*IsStringLocation*/true,
3727  Range, FixItHint::CreateRemoval(Range));
3728 }
3729 
3730 void CheckPrintfHandler::HandleObjCFlagsWithNonObjCConversion(
3731  const char *flagsStart, const char *flagsEnd, const char *conversionPosition) {
3732  // Warn about using '[...]' without a '@' conversion.
3733  auto Range = getSpecifierRange(flagsStart, flagsEnd - flagsStart + 1);
3734  auto diag = diag::warn_printf_ObjCflags_without_ObjCConversion;
3735  EmitFormatDiagnostic(S.PDiag(diag) << StringRef(conversionPosition, 1),
3736  getLocationOfByte(conversionPosition),
3737  /*IsStringLocation*/true,
3738  Range, FixItHint::CreateRemoval(Range));
3739 }
3740 
3741 // Determines if the specified is a C++ class or struct containing
3742 // a member with the specified name and kind (e.g. a CXXMethodDecl named
3743 // "c_str()").
3744 template<typename MemberKind>
3745 static llvm::SmallPtrSet<MemberKind*, 1>
3746 CXXRecordMembersNamed(StringRef Name, Sema &S, QualType Ty) {
3747  const RecordType *RT = Ty->getAs<RecordType>();
3748  llvm::SmallPtrSet<MemberKind*, 1> Results;
3749 
3750  if (!RT)
3751  return Results;
3752  const CXXRecordDecl *RD = dyn_cast<CXXRecordDecl>(RT->getDecl());
3753  if (!RD || !RD->getDefinition())
3754  return Results;
3755 
3756  LookupResult R(S, &S.Context.Idents.get(Name), SourceLocation(),
3758  R.suppressDiagnostics();
3759 
3760  // We just need to include all members of the right kind turned up by the
3761  // filter, at this point.
3762  if (S.LookupQualifiedName(R, RT->getDecl()))
3763  for (LookupResult::iterator I = R.begin(), E = R.end(); I != E; ++I) {
3764  NamedDecl *decl = (*I)->getUnderlyingDecl();
3765  if (MemberKind *FK = dyn_cast<MemberKind>(decl))
3766  Results.insert(FK);
3767  }
3768  return Results;
3769 }
3770 
3771 /// Check if we could call '.c_str()' on an object.
3772 ///
3773 /// FIXME: This returns the wrong results in some cases (if cv-qualifiers don't
3774 /// allow the call, or if it would be ambiguous).
3775 bool Sema::hasCStrMethod(const Expr *E) {
3776  typedef llvm::SmallPtrSet<CXXMethodDecl*, 1> MethodSet;
3777  MethodSet Results =
3778  CXXRecordMembersNamed<CXXMethodDecl>("c_str", *this, E->getType());
3779  for (MethodSet::iterator MI = Results.begin(), ME = Results.end();
3780  MI != ME; ++MI)
3781  if ((*MI)->getMinRequiredArguments() == 0)
3782  return true;
3783  return false;
3784 }
3785 
3786 // Check if a (w)string was passed when a (w)char* was needed, and offer a
3787 // better diagnostic if so. AT is assumed to be valid.
3788 // Returns true when a c_str() conversion method is found.
3789 bool CheckPrintfHandler::checkForCStrMembers(
3790  const analyze_printf::ArgType &AT, const Expr *E) {
3791  typedef llvm::SmallPtrSet<CXXMethodDecl*, 1> MethodSet;
3792 
3793  MethodSet Results =
3794  CXXRecordMembersNamed<CXXMethodDecl>("c_str", S, E->getType());
3795 
3796  for (MethodSet::iterator MI = Results.begin(), ME = Results.end();
3797  MI != ME; ++MI) {
3798  const CXXMethodDecl *Method = *MI;
3799  if (Method->getMinRequiredArguments() == 0 &&
3800  AT.matchesType(S.Context, Method->getReturnType())) {
3801  // FIXME: Suggest parens if the expression needs them.
3802  SourceLocation EndLoc = S.getLocForEndOfToken(E->getLocEnd());
3803  S.Diag(E->getLocStart(), diag::note_printf_c_str)
3804  << "c_str()"
3805  << FixItHint::CreateInsertion(EndLoc, ".c_str()");
3806  return true;
3807  }
3808  }
3809 
3810  return false;
3811 }
3812 
3813 bool
3814 CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
3815  &FS,
3816  const char *startSpecifier,
3817  unsigned specifierLen) {
3818 
3819  using namespace analyze_format_string;
3820  using namespace analyze_printf;
3821  const PrintfConversionSpecifier &CS = FS.getConversionSpecifier();
3822 
3823  if (FS.consumesDataArgument()) {
3824  if (atFirstArg) {
3825  atFirstArg = false;
3826  usesPositionalArgs = FS.usesPositionalArg();
3827  }
3828  else if (usesPositionalArgs != FS.usesPositionalArg()) {
3829  HandlePositionalNonpositionalArgs(getLocationOfByte(CS.getStart()),
3830  startSpecifier, specifierLen);
3831  return false;
3832  }
3833  }
3834 
3835  // First check if the field width, precision, and conversion specifier
3836  // have matching data arguments.
3837  if (!HandleAmount(FS.getFieldWidth(), /* field width */ 0,
3838  startSpecifier, specifierLen)) {
3839  return false;
3840  }
3841 
3842  if (!HandleAmount(FS.getPrecision(), /* precision */ 1,
3843  startSpecifier, specifierLen)) {
3844  return false;
3845  }
3846 
3847  if (!CS.consumesDataArgument()) {
3848  // FIXME: Technically specifying a precision or field width here
3849  // makes no sense. Worth issuing a warning at some point.
3850  return true;
3851  }
3852 
3853  // Consume the argument.
3854  unsigned argIndex = FS.getArgIndex();
3855  if (argIndex < NumDataArgs) {
3856  // The check to see if the argIndex is valid will come later.
3857  // We set the bit here because we may exit early from this
3858  // function if we encounter some other error.
3859  CoveredArgs.set(argIndex);
3860  }
3861 
3862  // FreeBSD kernel extensions.
3863  if (CS.getKind() == ConversionSpecifier::FreeBSDbArg ||
3864  CS.getKind() == ConversionSpecifier::FreeBSDDArg) {
3865  // We need at least two arguments.
3866  if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex + 1))
3867  return false;
3868 
3869  // Claim the second argument.
3870  CoveredArgs.set(argIndex + 1);
3871 
3872  // Type check the first argument (int for %b, pointer for %D)
3873  const Expr *Ex = getDataArg(argIndex);
3874  const analyze_printf::ArgType &AT =
3875  (CS.getKind() == ConversionSpecifier::FreeBSDbArg) ?
3876  ArgType(S.Context.IntTy) : ArgType::CPointerTy;
3877  if (AT.isValid() && !AT.matchesType(S.Context, Ex->getType()))
3878  EmitFormatDiagnostic(
3879  S.PDiag(diag::warn_format_conversion_argument_type_mismatch)
3880  << AT.getRepresentativeTypeName(S.Context) << Ex->getType()
3881  << false << Ex->getSourceRange(),
3882  Ex->getLocStart(), /*IsStringLocation*/false,
3883  getSpecifierRange(startSpecifier, specifierLen));
3884 
3885  // Type check the second argument (char * for both %b and %D)
3886  Ex = getDataArg(argIndex + 1);
3887  const analyze_printf::ArgType &AT2 = ArgType::CStrTy;
3888  if (AT2.isValid() && !AT2.matchesType(S.Context, Ex->getType()))
3889  EmitFormatDiagnostic(
3890  S.PDiag(diag::warn_format_conversion_argument_type_mismatch)
3891  << AT2.getRepresentativeTypeName(S.Context) << Ex->getType()
3892  << false << Ex->getSourceRange(),
3893  Ex->getLocStart(), /*IsStringLocation*/false,
3894  getSpecifierRange(startSpecifier, specifierLen));
3895 
3896  return true;
3897  }
3898 
3899  // Check for using an Objective-C specific conversion specifier
3900  // in a non-ObjC literal.
3901  if (!ObjCContext && CS.isObjCArg()) {
3902  return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier,
3903  specifierLen);
3904  }
3905 
3906  // Check for invalid use of field width
3907  if (!FS.hasValidFieldWidth()) {
3908  HandleInvalidAmount(FS, FS.getFieldWidth(), /* field width */ 0,
3909  startSpecifier, specifierLen);
3910  }
3911 
3912  // Check for invalid use of precision
3913  if (!FS.hasValidPrecision()) {
3914  HandleInvalidAmount(FS, FS.getPrecision(), /* precision */ 1,
3915  startSpecifier, specifierLen);
3916  }
3917 
3918  // Check each flag does not conflict with any other component.
3920  HandleFlag(FS, FS.hasThousandsGrouping(), startSpecifier, specifierLen);
3921  if (!FS.hasValidLeadingZeros())
3922  HandleFlag(FS, FS.hasLeadingZeros(), startSpecifier, specifierLen);
3923  if (!FS.hasValidPlusPrefix())
3924  HandleFlag(FS, FS.hasPlusPrefix(), startSpecifier, specifierLen);
3925  if (!FS.hasValidSpacePrefix())
3926  HandleFlag(FS, FS.hasSpacePrefix(), startSpecifier, specifierLen);
3927  if (!FS.hasValidAlternativeForm())
3928  HandleFlag(FS, FS.hasAlternativeForm(), startSpecifier, specifierLen);
3929  if (!FS.hasValidLeftJustified())
3930  HandleFlag(FS, FS.isLeftJustified(), startSpecifier, specifierLen);
3931 
3932  // Check that flags are not ignored by another flag
3933  if (FS.hasSpacePrefix() && FS.hasPlusPrefix()) // ' ' ignored by '+'
3934  HandleIgnoredFlag(FS, FS.hasSpacePrefix(), FS.hasPlusPrefix(),
3935  startSpecifier, specifierLen);
3936  if (FS.hasLeadingZeros() && FS.isLeftJustified()) // '0' ignored by '-'
3937  HandleIgnoredFlag(FS, FS.hasLeadingZeros(), FS.isLeftJustified(),
3938  startSpecifier, specifierLen);
3939 
3940  // Check the length modifier is valid with the given conversion specifier.
3941  if (!FS.hasValidLengthModifier(S.getASTContext().getTargetInfo()))
3942  HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
3943  diag::warn_format_nonsensical_length);
3944  else if (!FS.hasStandardLengthModifier())
3945  HandleNonStandardLengthModifier(FS, startSpecifier, specifierLen);
3947  HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
3948  diag::warn_format_non_standard_conversion_spec);
3949 
3950  if (!FS.hasStandardConversionSpecifier(S.getLangOpts()))
3951  HandleNonStandardConversionSpecifier(CS, startSpecifier, specifierLen);
3952 
3953  // The remaining checks depend on the data arguments.
3954  if (HasVAListArg)
3955  return true;
3956 
3957  if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
3958  return false;
3959 
3960  const Expr *Arg = getDataArg(argIndex);
3961  if (!Arg)
3962  return true;
3963 
3964  return checkFormatExpr(FS, startSpecifier, specifierLen, Arg);
3965 }
3966 
3967 static bool requiresParensToAddCast(const Expr *E) {
3968  // FIXME: We should have a general way to reason about operator
3969  // precedence and whether parens are actually needed here.
3970  // Take care of a few common cases where they aren't.
3971  const Expr *Inside = E->IgnoreImpCasts();
3972  if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(Inside))
3973  Inside = POE->getSyntacticForm()->IgnoreImpCasts();
3974 
3975  switch (Inside->getStmtClass()) {
3976  case Stmt::ArraySubscriptExprClass:
3977  case Stmt::CallExprClass:
3978  case Stmt::CharacterLiteralClass:
3979  case Stmt::CXXBoolLiteralExprClass:
3980  case Stmt::DeclRefExprClass:
3981  case Stmt::FloatingLiteralClass:
3982  case Stmt::IntegerLiteralClass:
3983  case Stmt::MemberExprClass:
3984  case Stmt::ObjCArrayLiteralClass:
3985  case Stmt::ObjCBoolLiteralExprClass:
3986  case Stmt::ObjCBoxedExprClass:
3987  case Stmt::ObjCDictionaryLiteralClass:
3988  case Stmt::ObjCEncodeExprClass:
3989  case Stmt::ObjCIvarRefExprClass:
3990  case Stmt::ObjCMessageExprClass:
3991  case Stmt::ObjCPropertyRefExprClass:
3992  case Stmt::ObjCStringLiteralClass:
3993  case Stmt::ObjCSubscriptRefExprClass:
3994  case Stmt::ParenExprClass:
3995  case Stmt::StringLiteralClass:
3996  case Stmt::UnaryOperatorClass:
3997  return false;
3998  default:
3999  return true;
4000  }
4001 }
4002 
4003 static std::pair<QualType, StringRef>
4005  QualType IntendedTy,
4006  const Expr *E) {
4007  // Use a 'while' to peel off layers of typedefs.
4008  QualType TyTy = IntendedTy;
4009  while (const TypedefType *UserTy = TyTy->getAs<TypedefType>()) {
4010  StringRef Name = UserTy->getDecl()->getName();
4011  QualType CastTy = llvm::StringSwitch<QualType>(Name)
4012  .Case("NSInteger", Context.LongTy)
4013  .Case("NSUInteger", Context.UnsignedLongTy)
4014  .Case("SInt32", Context.IntTy)
4015  .Case("UInt32", Context.UnsignedIntTy)
4016  .Default(QualType());
4017 
4018  if (!CastTy.isNull())
4019  return std::make_pair(CastTy, Name);
4020 
4021  TyTy = UserTy->desugar();
4022  }
4023 
4024  // Strip parens if necessary.
4025  if (const ParenExpr *PE = dyn_cast<ParenExpr>(E))
4026  return shouldNotPrintDirectly(Context,
4027  PE->getSubExpr()->getType(),
4028  PE->getSubExpr());
4029 
4030  // If this is a conditional expression, then its result type is constructed
4031  // via usual arithmetic conversions and thus there might be no necessary
4032  // typedef sugar there. Recurse to operands to check for NSInteger &
4033  // Co. usage condition.
4034  if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
4035  QualType TrueTy, FalseTy;
4036  StringRef TrueName, FalseName;
4037 
4038  std::tie(TrueTy, TrueName) =
4039  shouldNotPrintDirectly(Context,
4040  CO->getTrueExpr()->getType(),
4041  CO->getTrueExpr());
4042  std::tie(FalseTy, FalseName) =
4043  shouldNotPrintDirectly(Context,
4044  CO->getFalseExpr()->getType(),
4045  CO->getFalseExpr());
4046 
4047  if (TrueTy == FalseTy)
4048  return std::make_pair(TrueTy, TrueName);
4049  else if (TrueTy.isNull())
4050  return std::make_pair(FalseTy, FalseName);
4051  else if (FalseTy.isNull())
4052  return std::make_pair(TrueTy, TrueName);
4053  }
4054 
4055  return std::make_pair(QualType(), StringRef());
4056 }
4057 
4058 bool
4059 CheckPrintfHandler::checkFormatExpr(const analyze_printf::PrintfSpecifier &FS,
4060  const char *StartSpecifier,
4061  unsigned SpecifierLen,
4062  const Expr *E) {
4063  using namespace analyze_format_string;
4064  using namespace analyze_printf;
4065  // Now type check the data expression that matches the
4066  // format specifier.
4067  const analyze_printf::ArgType &AT = FS.getArgType(S.Context,
4068  ObjCContext);
4069  if (!AT.isValid())
4070  return true;
4071 
4072  QualType ExprTy = E->getType();
4073  while (const TypeOfExprType *TET = dyn_cast<TypeOfExprType>(ExprTy)) {
4074  ExprTy = TET->getUnderlyingExpr()->getType();
4075  }
4076 
4077  analyze_printf::ArgType::MatchKind match = AT.matchesType(S.Context, ExprTy);
4078 
4079  if (match == analyze_printf::ArgType::Match) {
4080  return true;
4081  }
4082 
4083  // Look through argument promotions for our error message's reported type.
4084  // This includes the integral and floating promotions, but excludes array
4085  // and function pointer decay; seeing that an argument intended to be a
4086  // string has type 'char [6]' is probably more confusing than 'char *'.
4087  if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(E)) {
4088  if (ICE->getCastKind() == CK_IntegralCast ||
4089  ICE->getCastKind() == CK_FloatingCast) {
4090  E = ICE->getSubExpr();
4091  ExprTy = E->getType();
4092 
4093  // Check if we didn't match because of an implicit cast from a 'char'
4094  // or 'short' to an 'int'. This is done because printf is a varargs
4095  // function.
4096  if (ICE->getType() == S.Context.IntTy ||
4097  ICE->getType() == S.Context.UnsignedIntTy) {
4098  // All further checking is done on the subexpression.
4099  if (AT.matchesType(S.Context, ExprTy))
4100  return true;
4101  }
4102  }
4103  } else if (const CharacterLiteral *CL = dyn_cast<CharacterLiteral>(E)) {
4104  // Special case for 'a', which has type 'int' in C.
4105  // Note, however, that we do /not/ want to treat multibyte constants like
4106  // 'MooV' as characters! This form is deprecated but still exists.
4107  if (ExprTy == S.Context.IntTy)
4108  if (llvm::isUIntN(S.Context.getCharWidth(), CL->getValue()))
4109  ExprTy = S.Context.CharTy;
4110  }
4111 
4112  // Look through enums to their underlying type.
4113  bool IsEnum = false;
4114  if (auto EnumTy = ExprTy->getAs<EnumType>()) {
4115  ExprTy = EnumTy->getDecl()->getIntegerType();
4116  IsEnum = true;
4117  }
4118 
4119  // %C in an Objective-C context prints a unichar, not a wchar_t.
4120  // If the argument is an integer of some kind, believe the %C and suggest
4121  // a cast instead of changing the conversion specifier.
4122  QualType IntendedTy = ExprTy;
4123  if (ObjCContext &&
4124  FS.getConversionSpecifier().getKind() == ConversionSpecifier::CArg) {
4125  if (ExprTy->isIntegralOrUnscopedEnumerationType() &&
4126  !ExprTy->isCharType()) {
4127  // 'unichar' is defined as a typedef of unsigned short, but we should
4128  // prefer using the typedef if it is visible.
4129  IntendedTy = S.Context.UnsignedShortTy;
4130 
4131  // While we are here, check if the value is an IntegerLiteral that happens
4132  // to be within the valid range.
4133  if (const IntegerLiteral *IL = dyn_cast<IntegerLiteral>(E)) {
4134  const llvm::APInt &V = IL->getValue();
4135  if (V.getActiveBits() <= S.Context.getTypeSize(IntendedTy))
4136  return true;
4137  }
4138 
4139  LookupResult Result(S, &S.Context.Idents.get("unichar"), E->getLocStart(),
4141  if (S.LookupName(Result, S.getCurScope())) {
4142  NamedDecl *ND = Result.getFoundDecl();
4143  if (TypedefNameDecl *TD = dyn_cast<TypedefNameDecl>(ND))
4144  if (TD->getUnderlyingType() == IntendedTy)
4145  IntendedTy = S.Context.getTypedefType(TD);
4146  }
4147  }
4148  }
4149 
4150  // Special-case some of Darwin's platform-independence types by suggesting
4151  // casts to primitive types that are known to be large enough.
4152  bool ShouldNotPrintDirectly = false; StringRef CastTyName;
4153  if (S.Context.getTargetInfo().getTriple().isOSDarwin()) {
4154  QualType CastTy;
4155  std::tie(CastTy, CastTyName) = shouldNotPrintDirectly(S.Context, IntendedTy, E);
4156  if (!CastTy.isNull()) {
4157  IntendedTy = CastTy;
4158  ShouldNotPrintDirectly = true;
4159  }
4160  }
4161 
4162  // We may be able to offer a FixItHint if it is a supported type.
4163  PrintfSpecifier fixedFS = FS;
4164  bool success = fixedFS.fixType(IntendedTy, S.getLangOpts(),
4165  S.Context, ObjCContext);
4166 
4167  if (success) {
4168  // Get the fix string from the fixed format specifier
4169  SmallString<16> buf;
4170  llvm::raw_svector_ostream os(buf);
4171  fixedFS.toString(os);
4172 
4173  CharSourceRange SpecRange = getSpecifierRange(StartSpecifier, SpecifierLen);
4174 
4175  if (IntendedTy == ExprTy && !ShouldNotPrintDirectly) {
4176  unsigned diag = diag::warn_format_conversion_argument_type_mismatch;
4178  diag = diag::warn_format_conversion_argument_type_mismatch_pedantic;
4179  }
4180  // In this case, the specifier is wrong and should be changed to match
4181  // the argument.
4182  EmitFormatDiagnostic(S.PDiag(diag)
4183  << AT.getRepresentativeTypeName(S.Context)
4184  << IntendedTy << IsEnum << E->getSourceRange(),
4185  E->getLocStart(),
4186  /*IsStringLocation*/ false, SpecRange,
4187  FixItHint::CreateReplacement(SpecRange, os.str()));
4188 
4189  } else {
4190  // The canonical type for formatting this value is different from the
4191  // actual type of the expression. (This occurs, for example, with Darwin's
4192  // NSInteger on 32-bit platforms, where it is typedef'd as 'int', but
4193  // should be printed as 'long' for 64-bit compatibility.)
4194  // Rather than emitting a normal format/argument mismatch, we want to
4195  // add a cast to the recommended type (and correct the format string
4196  // if necessary).
4197  SmallString<16> CastBuf;
4198  llvm::raw_svector_ostream CastFix(CastBuf);
4199  CastFix << "(";
4200  IntendedTy.print(CastFix, S.Context.getPrintingPolicy());
4201  CastFix << ")";
4202 
4204  if (!AT.matchesType(S.Context, IntendedTy))
4205  Hints.push_back(FixItHint::CreateReplacement(SpecRange, os.str()));
4206 
4207  if (const CStyleCastExpr *CCast = dyn_cast<CStyleCastExpr>(E)) {
4208  // If there's already a cast present, just replace it.
4209  SourceRange CastRange(CCast->getLParenLoc(), CCast->getRParenLoc());
4210  Hints.push_back(FixItHint::CreateReplacement(CastRange, CastFix.str()));
4211 
4212  } else if (!requiresParensToAddCast(E)) {
4213  // If the expression has high enough precedence,
4214  // just write the C-style cast.
4215  Hints.push_back(FixItHint::CreateInsertion(E->getLocStart(),
4216  CastFix.str()));
4217  } else {
4218  // Otherwise, add parens around the expression as well as the cast.
4219  CastFix << "(";
4220  Hints.push_back(FixItHint::CreateInsertion(E->getLocStart(),
4221  CastFix.str()));
4222 
4223  SourceLocation After = S.getLocForEndOfToken(E->getLocEnd());
4224  Hints.push_back(FixItHint::CreateInsertion(After, ")"));
4225  }
4226 
4227  if (ShouldNotPrintDirectly) {
4228  // The expression has a type that should not be printed directly.
4229  // We extract the name from the typedef because we don't want to show
4230  // the underlying type in the diagnostic.
4231  StringRef Name;
4232  if (const TypedefType *TypedefTy = dyn_cast<TypedefType>(ExprTy))
4233  Name = TypedefTy->getDecl()->getName();
4234  else
4235  Name = CastTyName;
4236  EmitFormatDiagnostic(S.PDiag(diag::warn_format_argument_needs_cast)
4237  << Name << IntendedTy << IsEnum
4238  << E->getSourceRange(),
4239  E->getLocStart(), /*IsStringLocation=*/false,
4240  SpecRange, Hints);
4241  } else {
4242  // In this case, the expression could be printed using a different
4243  // specifier, but we've decided that the specifier is probably correct
4244  // and we should cast instead. Just use the normal warning message.
4245  EmitFormatDiagnostic(
4246  S.PDiag(diag::warn_format_conversion_argument_type_mismatch)
4247  << AT.getRepresentativeTypeName(S.Context) << ExprTy << IsEnum
4248  << E->getSourceRange(),
4249  E->getLocStart(), /*IsStringLocation*/false,
4250  SpecRange, Hints);
4251  }
4252  }
4253  } else {
4254  const CharSourceRange &CSR = getSpecifierRange(StartSpecifier,
4255  SpecifierLen);
4256  // Since the warning for passing non-POD types to variadic functions
4257  // was deferred until now, we emit a warning for non-POD
4258  // arguments here.
4259  switch (S.isValidVarArgType(ExprTy)) {
4260  case Sema::VAK_Valid:
4261  case Sema::VAK_ValidInCXX11: {
4262  unsigned diag = diag::warn_format_conversion_argument_type_mismatch;
4263  if (match == analyze_printf::ArgType::NoMatchPedantic) {
4264  diag = diag::warn_format_conversion_argument_type_mismatch_pedantic;
4265  }
4266 
4267  EmitFormatDiagnostic(
4268  S.PDiag(diag) << AT.getRepresentativeTypeName(S.Context) << ExprTy
4269  << IsEnum << CSR << E->getSourceRange(),
4270  E->getLocStart(), /*IsStringLocation*/ false, CSR);
4271  break;
4272  }
4273  case Sema::VAK_Undefined:
4275  EmitFormatDiagnostic(
4276  S.PDiag(diag::warn_non_pod_vararg_with_format_string)
4277  << S.getLangOpts().CPlusPlus11
4278  << ExprTy
4279  << CallType
4280  << AT.getRepresentativeTypeName(S.Context)
4281  << CSR
4282  << E->getSourceRange(),
4283  E->getLocStart(), /*IsStringLocation*/false, CSR);
4284  checkForCStrMembers(AT, E);
4285  break;
4286 
4287  case Sema::VAK_Invalid:
4288  if (ExprTy->isObjCObjectType())
4289  EmitFormatDiagnostic(
4290  S.PDiag(diag::err_cannot_pass_objc_interface_to_vararg_format)
4291  << S.getLangOpts().CPlusPlus11
4292  << ExprTy
4293  << CallType
4294  << AT.getRepresentativeTypeName(S.Context)
4295  << CSR
4296  << E->getSourceRange(),
4297  E->getLocStart(), /*IsStringLocation*/false, CSR);
4298  else
4299  // FIXME: If this is an initializer list, suggest removing the braces
4300  // or inserting a cast to the target type.
4301  S.Diag(E->getLocStart(), diag::err_cannot_pass_to_vararg_format)
4302  << isa<InitListExpr>(E) << ExprTy << CallType
4303  << AT.getRepresentativeTypeName(S.Context)
4304  << E->getSourceRange();
4305  break;
4306  }
4307 
4308  assert(FirstDataArg + FS.getArgIndex() < CheckedVarArgs.size() &&
4309  "format string specifier index out of range");
4310  CheckedVarArgs[FirstDataArg + FS.getArgIndex()] = true;
4311  }
4312 
4313  return true;
4314 }
4315 
4316 //===--- CHECK: Scanf format string checking ------------------------------===//
4317 
4318 namespace {
4319 class CheckScanfHandler : public CheckFormatHandler {
4320 public:
4321  CheckScanfHandler(Sema &s, const StringLiteral *fexpr,
4322  const Expr *origFormatExpr, unsigned firstDataArg,
4323  unsigned numDataArgs, const char *beg, bool hasVAListArg,
4325  unsigned formatIdx, bool inFunctionCall,
4326  Sema::VariadicCallType CallType,
4327  llvm::SmallBitVector &CheckedVarArgs)
4328  : CheckFormatHandler(s, fexpr, origFormatExpr, firstDataArg,
4329  numDataArgs, beg, hasVAListArg,
4330  Args, formatIdx, inFunctionCall, CallType,
4331  CheckedVarArgs)
4332  {}
4333 
4334  bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,
4335  const char *startSpecifier,
4336  unsigned specifierLen) override;
4337 
4338  bool HandleInvalidScanfConversionSpecifier(
4340  const char *startSpecifier,
4341  unsigned specifierLen) override;
4342 
4343  void HandleIncompleteScanList(const char *start, const char *end) override;
4344 };
4345 }
4346 
4347 void CheckScanfHandler::HandleIncompleteScanList(const char *start,
4348  const char *end) {
4349  EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_scanlist_incomplete),
4350  getLocationOfByte(end), /*IsStringLocation*/true,
4351  getSpecifierRange(start, end - start));
4352 }
4353 
4354 bool CheckScanfHandler::HandleInvalidScanfConversionSpecifier(
4356  const char *startSpecifier,
4357  unsigned specifierLen) {
4358 
4361 
4362  return HandleInvalidConversionSpecifier(FS.getArgIndex(),
4363  getLocationOfByte(CS.getStart()),
4364  startSpecifier, specifierLen,
4365  CS.getStart(), CS.getLength());
4366 }
4367 
4368 bool CheckScanfHandler::HandleScanfSpecifier(
4370  const char *startSpecifier,
4371  unsigned specifierLen) {
4372 
4373  using namespace analyze_scanf;
4374  using namespace analyze_format_string;
4375 
4376  const ScanfConversionSpecifier &CS = FS.getConversionSpecifier();
4377 
4378  // Handle case where '%' and '*' don't consume an argument. These shouldn't
4379  // be used to decide if we are using positional arguments consistently.
4380  if (FS.consumesDataArgument()) {
4381  if (atFirstArg) {
4382  atFirstArg = false;
4383  usesPositionalArgs = FS.usesPositionalArg();
4384  }
4385  else if (usesPositionalArgs != FS.usesPositionalArg()) {
4386  HandlePositionalNonpositionalArgs(getLocationOfByte(CS.getStart()),
4387  startSpecifier, specifierLen);
4388  return false;
4389  }
4390  }
4391 
4392  // Check if the field with is non-zero.
4393  const OptionalAmount &Amt = FS.getFieldWidth();
4394  if (Amt.getHowSpecified() == OptionalAmount::Constant) {
4395  if (Amt.getConstantAmount() == 0) {
4396  const CharSourceRange &R = getSpecifierRange(Amt.getStart(),
4397  Amt.getConstantLength());
4398  EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_nonzero_width),
4399  getLocationOfByte(Amt.getStart()),
4400  /*IsStringLocation*/true, R,
4401  FixItHint::CreateRemoval(R));
4402  }
4403  }
4404 
4405  if (!FS.consumesDataArgument()) {
4406  // FIXME: Technically specifying a precision or field width here
4407  // makes no sense. Worth issuing a warning at some point.
4408  return true;
4409  }
4410 
4411  // Consume the argument.
4412  unsigned argIndex = FS.getArgIndex();
4413  if (argIndex < NumDataArgs) {
4414  // The check to see if the argIndex is valid will come later.
4415  // We set the bit here because we may exit early from this
4416  // function if we encounter some other error.
4417  CoveredArgs.set(argIndex);
4418  }
4419 
4420  // Check the length modifier is valid with the given conversion specifier.
4421  if (!FS.hasValidLengthModifier(S.getASTContext().getTargetInfo()))
4422  HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
4423  diag::warn_format_nonsensical_length);
4424  else if (!FS.hasStandardLengthModifier())
4425  HandleNonStandardLengthModifier(FS, startSpecifier, specifierLen);
4427  HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
4428  diag::warn_format_non_standard_conversion_spec);
4429 
4430  if (!FS.hasStandardConversionSpecifier(S.getLangOpts()))
4431  HandleNonStandardConversionSpecifier(CS, startSpecifier, specifierLen);
4432 
4433  // The remaining checks depend on the data arguments.
4434  if (HasVAListArg)
4435  return true;
4436 
4437  if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
4438  return false;
4439 
4440  // Check that the argument type matches the format specifier.
4441  const Expr *Ex = getDataArg(argIndex);
4442  if (!Ex)
4443  return true;
4444 
4445  const analyze_format_string::ArgType &AT = FS.getArgType(S.Context);
4446 
4447  if (!AT.isValid()) {
4448  return true;
4449  }
4450 
4452  AT.matchesType(S.Context, Ex->getType());
4454  return true;
4455  }
4456 
4457  ScanfSpecifier fixedFS = FS;
4458  bool success = fixedFS.fixType(Ex->getType(), Ex->IgnoreImpCasts()->getType(),
4459  S.getLangOpts(), S.Context);
4460 
4461  unsigned diag = diag::warn_format_conversion_argument_type_mismatch;
4463  diag = diag::warn_format_conversion_argument_type_mismatch_pedantic;
4464  }
4465 
4466  if (success) {
4467  // Get the fix string from the fixed format specifier.
4468  SmallString<128> buf;
4469  llvm::raw_svector_ostream os(buf);
4470  fixedFS.toString(os);
4471 
4472  EmitFormatDiagnostic(
4473  S.PDiag(diag) << AT.getRepresentativeTypeName(S.Context)
4474  << Ex->getType() << false << Ex->getSourceRange(),
4475  Ex->getLocStart(),
4476  /*IsStringLocation*/ false,
4477  getSpecifierRange(startSpecifier, specifierLen),
4479  getSpecifierRange(startSpecifier, specifierLen), os.str()));
4480  } else {
4481  EmitFormatDiagnostic(S.PDiag(diag)
4482  << AT.getRepresentativeTypeName(S.Context)
4483  << Ex->getType() << false << Ex->getSourceRange(),
4484  Ex->getLocStart(),
4485  /*IsStringLocation*/ false,
4486  getSpecifierRange(startSpecifier, specifierLen));
4487  }
4488 
4489  return true;
4490 }
4491 
4493  const Expr *OrigFormatExpr,
4495  bool HasVAListArg, unsigned format_idx,
4496  unsigned firstDataArg, FormatStringType Type,
4497  bool inFunctionCall, VariadicCallType CallType,
4498  llvm::SmallBitVector &CheckedVarArgs) {
4499 
4500  // CHECK: is the format string a wide literal?
4501  if (!FExpr->isAscii() && !FExpr->isUTF8()) {
4502  CheckFormatHandler::EmitFormatDiagnostic(
4503  *this, inFunctionCall, Args[format_idx],
4504  PDiag(diag::warn_format_string_is_wide_literal), FExpr->getLocStart(),
4505  /*IsStringLocation*/true, OrigFormatExpr->getSourceRange());
4506  return;
4507  }
4508 
4509  // Str - The format string. NOTE: this is NOT null-terminated!
4510  StringRef StrRef = FExpr->getString();
4511  const char *Str = StrRef.data();
4512  // Account for cases where the string literal is truncated in a declaration.
4513  const ConstantArrayType *T = Context.getAsConstantArrayType(FExpr->getType());
4514  assert(T && "String literal not of constant array type!");
4515  size_t TypeSize = T->getSize().getZExtValue();
4516  size_t StrLen = std::min(std::max(TypeSize, size_t(1)) - 1, StrRef.size());
4517  const unsigned numDataArgs = Args.size() - firstDataArg;
4518 
4519  // Emit a warning if the string literal is truncated and does not contain an
4520  // embedded null character.
4521  if (TypeSize <= StrRef.size() &&
4522  StrRef.substr(0, TypeSize).find('\0') == StringRef::npos) {
4523  CheckFormatHandler::EmitFormatDiagnostic(
4524  *this, inFunctionCall, Args[format_idx],
4525  PDiag(diag::warn_printf_format_string_not_null_terminated),
4526  FExpr->getLocStart(),
4527  /*IsStringLocation=*/true, OrigFormatExpr->getSourceRange());
4528  return;
4529  }
4530 
4531  // CHECK: empty format string?
4532  if (StrLen == 0 && numDataArgs > 0) {
4533  CheckFormatHandler::EmitFormatDiagnostic(
4534  *this, inFunctionCall, Args[format_idx],
4535  PDiag(diag::warn_empty_format_string), FExpr->getLocStart(),
4536  /*IsStringLocation*/true, OrigFormatExpr->getSourceRange());
4537  return;
4538  }
4539 
4540  if (Type == FST_Printf || Type == FST_NSString ||
4541  Type == FST_FreeBSDKPrintf || Type == FST_OSTrace) {
4542  CheckPrintfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg,
4543  numDataArgs, (Type == FST_NSString || Type == FST_OSTrace),
4544  Str, HasVAListArg, Args, format_idx,
4545  inFunctionCall, CallType, CheckedVarArgs);
4546 
4547  if (!analyze_format_string::ParsePrintfString(H, Str, Str + StrLen,
4548  getLangOpts(),
4549  Context.getTargetInfo(),
4550  Type == FST_FreeBSDKPrintf))
4551  H.DoneProcessing();
4552  } else if (Type == FST_Scanf) {
4553  CheckScanfHandler H(*this, FExpr, OrigFormatExpr, firstDataArg, numDataArgs,
4554  Str, HasVAListArg, Args, format_idx,
4555  inFunctionCall, CallType, CheckedVarArgs);
4556 
4557  if (!analyze_format_string::ParseScanfString(H, Str, Str + StrLen,
4558  getLangOpts(),
4559  Context.getTargetInfo()))
4560  H.DoneProcessing();
4561  } // TODO: handle other formats
4562 }
4563 
4565  // Str - The format string. NOTE: this is NOT null-terminated!
4566  StringRef StrRef = FExpr->getString();
4567  const char *Str = StrRef.data();
4568  // Account for cases where the string literal is truncated in a declaration.
4569  const ConstantArrayType *T = Context.getAsConstantArrayType(FExpr->getType());
4570  assert(T && "String literal not of constant array type!");
4571  size_t TypeSize = T->getSize().getZExtValue();
4572  size_t StrLen = std::min(std::max(TypeSize, size_t(1)) - 1, StrRef.size());
4573  return analyze_format_string::ParseFormatStringHasSArg(Str, Str + StrLen,
4574  getLangOpts(),
4575  Context.getTargetInfo());
4576 }
4577 
4578 //===--- CHECK: Warn on use of wrong absolute value function. -------------===//
4579 
4580 // Returns the related absolute value function that is larger, of 0 if one
4581 // does not exist.
4582 static unsigned getLargerAbsoluteValueFunction(unsigned AbsFunction) {
4583  switch (AbsFunction) {
4584  default:
4585  return 0;
4586 
4587  case Builtin::BI__builtin_abs:
4588  return Builtin::BI__builtin_labs;
4589  case Builtin::BI__builtin_labs:
4590  return Builtin::BI__builtin_llabs;
4591  case Builtin::BI__builtin_llabs:
4592  return 0;
4593 
4594  case Builtin::BI__builtin_fabsf:
4595  return Builtin::BI__builtin_fabs;
4596  case Builtin::BI__builtin_fabs:
4597  return Builtin::BI__builtin_fabsl;
4598  case Builtin::BI__builtin_fabsl:
4599  return 0;
4600 
4601  case Builtin::BI__builtin_cabsf:
4602  return Builtin::BI__builtin_cabs;
4603  case Builtin::BI__builtin_cabs:
4604  return Builtin::BI__builtin_cabsl;
4605  case Builtin::BI__builtin_cabsl:
4606  return 0;
4607 
4608  case Builtin::BIabs:
4609  return Builtin::BIlabs;
4610  case Builtin::BIlabs:
4611  return Builtin::BIllabs;
4612  case Builtin::BIllabs:
4613  return 0;
4614 
4615  case Builtin::BIfabsf:
4616  return Builtin::BIfabs;
4617  case Builtin::BIfabs:
4618  return Builtin::BIfabsl;
4619  case Builtin::BIfabsl:
4620  return 0;
4621 
4622  case Builtin::BIcabsf:
4623  return Builtin::BIcabs;
4624  case Builtin::BIcabs:
4625  return Builtin::BIcabsl;
4626  case Builtin::BIcabsl:
4627  return 0;
4628  }
4629 }
4630 
4631 // Returns the argument type of the absolute value function.
4633  unsigned AbsType) {
4634  if (AbsType == 0)
4635  return QualType();
4636 
4638  QualType BuiltinType = Context.GetBuiltinType(AbsType, Error);
4639  if (Error != ASTContext::GE_None)
4640  return QualType();
4641 
4642  const FunctionProtoType *FT = BuiltinType->getAs<FunctionProtoType>();
4643  if (!FT)
4644  return QualType();
4645 
4646  if (FT->getNumParams() != 1)
4647  return QualType();
4648 
4649  return FT->getParamType(0);
4650 }
4651 
4652 // Returns the best absolute value function, or zero, based on type and
4653 // current absolute value function.
4654 static unsigned getBestAbsFunction(ASTContext &Context, QualType ArgType,
4655  unsigned AbsFunctionKind) {
4656  unsigned BestKind = 0;
4657  uint64_t ArgSize = Context.getTypeSize(ArgType);
4658  for (unsigned Kind = AbsFunctionKind; Kind != 0;
4660  QualType ParamType = getAbsoluteValueArgumentType(Context, Kind);
4661  if (Context.getTypeSize(ParamType) >= ArgSize) {
4662  if (BestKind == 0)
4663  BestKind = Kind;
4664  else if (Context.hasSameType(ParamType, ArgType)) {
4665  BestKind = Kind;
4666  break;
4667  }
4668  }
4669  }
4670  return BestKind;
4671 }
4672 
4677 };
4678 
4680  if (T->isIntegralOrEnumerationType())
4681  return AVK_Integer;
4682  if (T->isRealFloatingType())
4683  return AVK_Floating;
4684  if (T->isAnyComplexType())
4685  return AVK_Complex;
4686 
4687  llvm_unreachable("Type not integer, floating, or complex");
4688 }
4689 
4690 // Changes the absolute value function to a different type. Preserves whether
4691 // the function is a builtin.
4692 static unsigned changeAbsFunction(unsigned AbsKind,
4693  AbsoluteValueKind ValueKind) {
4694  switch (ValueKind) {
4695  case AVK_Integer:
4696  switch (AbsKind) {
4697  default:
4698  return 0;
4699  case Builtin::BI__builtin_fabsf:
4700  case Builtin::BI__builtin_fabs:
4701  case Builtin::BI__builtin_fabsl:
4702  case Builtin::BI__builtin_cabsf:
4703  case Builtin::BI__builtin_cabs:
4704  case Builtin::BI__builtin_cabsl:
4705  return Builtin::BI__builtin_abs;
4706  case Builtin::BIfabsf:
4707  case Builtin::BIfabs:
4708  case Builtin::BIfabsl:
4709  case Builtin::BIcabsf:
4710  case Builtin::BIcabs:
4711  case Builtin::BIcabsl:
4712  return Builtin::BIabs;
4713  }
4714  case AVK_Floating:
4715  switch (AbsKind) {
4716  default:
4717  return 0;
4718  case Builtin::BI__builtin_abs:
4719  case Builtin::BI__builtin_labs:
4720  case Builtin::BI__builtin_llabs:
4721  case Builtin::BI__builtin_cabsf:
4722  case Builtin::BI__builtin_cabs:
4723  case Builtin::BI__builtin_cabsl:
4724  return Builtin::BI__builtin_fabsf;
4725  case Builtin::BIabs:
4726  case Builtin::BIlabs:
4727  case Builtin::BIllabs:
4728  case Builtin::BIcabsf:
4729  case Builtin::BIcabs:
4730  case Builtin::BIcabsl:
4731  return Builtin::BIfabsf;
4732  }
4733  case AVK_Complex:
4734  switch (AbsKind) {
4735  default:
4736  return 0;
4737  case Builtin::BI__builtin_abs:
4738  case Builtin::BI__builtin_labs:
4739  case Builtin::BI__builtin_llabs:
4740  case Builtin::BI__builtin_fabsf:
4741  case Builtin::BI__builtin_fabs:
4742  case Builtin::BI__builtin_fabsl:
4743  return Builtin::BI__builtin_cabsf;
4744  case Builtin::BIabs:
4745  case Builtin::BIlabs:
4746  case Builtin::BIllabs:
4747  case Builtin::BIfabsf:
4748  case Builtin::BIfabs:
4749  case Builtin::BIfabsl:
4750  return Builtin::BIcabsf;
4751  }
4752  }
4753  llvm_unreachable("Unable to convert function");
4754 }
4755 
4756 static unsigned getAbsoluteValueFunctionKind(const FunctionDecl *FDecl) {
4757  const IdentifierInfo *FnInfo = FDecl->getIdentifier();
4758  if (!FnInfo)
4759  return 0;
4760 
4761  switch (FDecl->getBuiltinID()) {
4762  default:
4763  return 0;
4764  case Builtin::BI__builtin_abs:
4765  case Builtin::BI__builtin_fabs:
4766  case Builtin::BI__builtin_fabsf:
4767  case Builtin::BI__builtin_fabsl:
4768  case Builtin::BI__builtin_labs:
4769  case Builtin::BI__builtin_llabs:
4770  case Builtin::BI__builtin_cabs:
4771  case Builtin::BI__builtin_cabsf:
4772  case Builtin::BI__builtin_cabsl:
4773  case Builtin::BIabs:
4774  case Builtin::BIlabs:
4775  case Builtin::BIllabs:
4776  case Builtin::BIfabs:
4777  case Builtin::BIfabsf:
4778  case Builtin::BIfabsl:
4779  case Builtin::BIcabs:
4780  case Builtin::BIcabsf:
4781  case Builtin::BIcabsl:
4782  return FDecl->getBuiltinID();
4783  }
4784  llvm_unreachable("Unknown Builtin type");
4785 }
4786 
4787 // If the replacement is valid, emit a note with replacement function.
4788 // Additionally, suggest including the proper header if not already included.
4789 static void emitReplacement(Sema &S, SourceLocation Loc, SourceRange Range,
4790  unsigned AbsKind, QualType ArgType) {
4791  bool EmitHeaderHint = true;
4792  const char *HeaderName = nullptr;
4793  const char *FunctionName = nullptr;
4794  if (S.getLangOpts().CPlusPlus && !ArgType->isAnyComplexType()) {
4795  FunctionName = "std::abs";
4796  if (ArgType->isIntegralOrEnumerationType()) {
4797  HeaderName = "cstdlib";
4798  } else if (ArgType->isRealFloatingType()) {
4799  HeaderName = "cmath";
4800  } else {
4801  llvm_unreachable("Invalid Type");
4802  }
4803 
4804  // Lookup all std::abs
4805  if (NamespaceDecl *Std = S.getStdNamespace()) {
4806  LookupResult R(S, &S.Context.Idents.get("abs"), Loc, Sema::LookupAnyName);
4807  R.suppressDiagnostics();
4808  S.LookupQualifiedName(R, Std);
4809 
4810  for (const auto *I : R) {
4811  const FunctionDecl *FDecl = nullptr;
4812  if (const UsingShadowDecl *UsingD = dyn_cast<UsingShadowDecl>(I)) {
4813  FDecl = dyn_cast<FunctionDecl>(UsingD->getTargetDecl());
4814  } else {
4815  FDecl = dyn_cast<FunctionDecl>(I);
4816  }
4817  if (!FDecl)
4818  continue;
4819 
4820  // Found std::abs(), check that they are the right ones.
4821  if (FDecl->getNumParams() != 1)
4822  continue;
4823 
4824  // Check that the parameter type can handle the argument.
4825  QualType ParamType = FDecl->getParamDecl(0)->getType();
4826  if (getAbsoluteValueKind(ArgType) == getAbsoluteValueKind(ParamType) &&
4827  S.Context.getTypeSize(ArgType) <=
4828  S.Context.getTypeSize(ParamType)) {
4829  // Found a function, don't need the header hint.
4830  EmitHeaderHint = false;
4831  break;
4832  }
4833  }
4834  }
4835  } else {
4836  FunctionName = S.Context.BuiltinInfo.GetName(AbsKind);
4837  HeaderName = S.Context.BuiltinInfo.getHeaderName(AbsKind);
4838 
4839  if (HeaderName) {
4840  DeclarationName DN(&S.Context.Idents.get(FunctionName));
4841  LookupResult R(S, DN, Loc, Sema::LookupAnyName);
4842  R.suppressDiagnostics();
4843  S.LookupName(R, S.getCurScope());
4844 
4845  if (R.isSingleResult()) {
4846  FunctionDecl *FD = dyn_cast<FunctionDecl>(R.getFoundDecl());
4847  if (FD && FD->getBuiltinID() == AbsKind) {
4848  EmitHeaderHint = false;
4849  } else {
4850  return;
4851  }
4852  } else if (!R.empty()) {
4853  return;
4854  }
4855  }
4856  }
4857 
4858  S.Diag(Loc, diag::note_replace_abs_function)
4859  << FunctionName << FixItHint::CreateReplacement(Range, FunctionName);
4860 
4861  if (!HeaderName)
4862  return;
4863 
4864  if (!EmitHeaderHint)
4865  return;
4866 
4867  S.Diag(Loc, diag::note_include_header_or_declare) << HeaderName
4868  << FunctionName;
4869 }
4870 
4871 static bool IsFunctionStdAbs(const FunctionDecl *FDecl) {
4872  if (!FDecl)
4873  return false;
4874 
4875  if (!FDecl->getIdentifier() || !FDecl->getIdentifier()->isStr("abs"))
4876  return false;
4877 
4878  const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(FDecl->getDeclContext());
4879 
4880  while (ND && ND->isInlineNamespace()) {
4881  ND = dyn_cast<NamespaceDecl>(ND->getDeclContext());
4882  }
4883 
4884  if (!ND || !ND->getIdentifier() || !ND->getIdentifier()->isStr("std"))
4885  return false;
4886 
4887  if (!isa<TranslationUnitDecl>(ND->getDeclContext()))
4888  return false;
4889 
4890  return true;
4891 }
4892 
4893 // Warn when using the wrong abs() function.
4894 void Sema::CheckAbsoluteValueFunction(const CallExpr *Call,
4895  const FunctionDecl *FDecl,
4896  IdentifierInfo *FnInfo) {
4897  if (Call->getNumArgs() != 1)
4898  return;
4899 
4900  unsigned AbsKind = getAbsoluteValueFunctionKind(FDecl);
4901  bool IsStdAbs = IsFunctionStdAbs(FDecl);
4902  if (AbsKind == 0 && !IsStdAbs)
4903  return;
4904 
4905  QualType ArgType = Call->getArg(0)->IgnoreParenImpCasts()->getType();
4906  QualType ParamType = Call->getArg(0)->getType();
4907 
4908  // Unsigned types cannot be negative. Suggest removing the absolute value
4909  // function call.
4910  if (ArgType->isUnsignedIntegerType()) {
4911  const char *FunctionName =
4912  IsStdAbs ? "std::abs" : Context.BuiltinInfo.GetName(AbsKind);
4913  Diag(Call->getExprLoc(), diag::warn_unsigned_abs) << ArgType << ParamType;
4914  Diag(Call->getExprLoc(), diag::note_remove_abs)
4915  << FunctionName
4916  << FixItHint::CreateRemoval(Call->getCallee()->getSourceRange());
4917  return;
4918  }
4919 
4920  // std::abs has overloads which prevent most of the absolute value problems
4921  // from occurring.
4922  if (IsStdAbs)
4923  return;
4924 
4925  AbsoluteValueKind ArgValueKind = getAbsoluteValueKind(ArgType);
4926  AbsoluteValueKind ParamValueKind = getAbsoluteValueKind(ParamType);
4927 
4928  // The argument and parameter are the same kind. Check if they are the right
4929  // size.
4930  if (ArgValueKind == ParamValueKind) {
4931  if (Context.getTypeSize(ArgType) <= Context.getTypeSize(ParamType))
4932  return;
4933 
4934  unsigned NewAbsKind = getBestAbsFunction(Context, ArgType, AbsKind);
4935  Diag(Call->getExprLoc(), diag::warn_abs_too_small)
4936  << FDecl << ArgType << ParamType;
4937 
4938  if (NewAbsKind == 0)
4939  return;
4940 
4941  emitReplacement(*this, Call->getExprLoc(),
4942  Call->getCallee()->getSourceRange(), NewAbsKind, ArgType);
4943  return;
4944  }
4945 
4946  // ArgValueKind != ParamValueKind
4947  // The wrong type of absolute value function was used. Attempt to find the
4948  // proper one.
4949  unsigned NewAbsKind = changeAbsFunction(AbsKind, ArgValueKind);
4950  NewAbsKind = getBestAbsFunction(Context, ArgType, NewAbsKind);
4951  if (NewAbsKind == 0)
4952  return;
4953 
4954  Diag(Call->getExprLoc(), diag::warn_wrong_absolute_value_type)
4955  << FDecl << ParamValueKind << ArgValueKind;
4956 
4957  emitReplacement(*this, Call->getExprLoc(),
4958  Call->getCallee()->getSourceRange(), NewAbsKind, ArgType);
4959  return;
4960 }
4961 
4962 //===--- CHECK: Standard memory functions ---------------------------------===//
4963 
4964 /// \brief Takes the expression passed to the size_t parameter of functions
4965 /// such as memcmp, strncat, etc and warns if it's a comparison.
4966 ///
4967 /// This is to catch typos like `if (memcmp(&a, &b, sizeof(a) > 0))`.
4968 static bool CheckMemorySizeofForComparison(Sema &S, const Expr *E,
4969  IdentifierInfo *FnName,
4970  SourceLocation FnLoc,
4971  SourceLocation RParenLoc) {
4972  const BinaryOperator *Size = dyn_cast<BinaryOperator>(E);
4973  if (!Size)
4974  return false;
4975 
4976  // if E is binop and op is >, <, >=, <=, ==, &&, ||:
4977  if (!Size->isComparisonOp() && !Size->isEqualityOp() && !Size->isLogicalOp())
4978  return false;
4979 
4980  SourceRange SizeRange = Size->getSourceRange();
4981  S.Diag(Size->getOperatorLoc(), diag::warn_memsize_comparison)
4982  << SizeRange << FnName;
4983  S.Diag(FnLoc, diag::note_memsize_comparison_paren)
4984  << FnName << FixItHint::CreateInsertion(
4985  S.getLocForEndOfToken(Size->getLHS()->getLocEnd()), ")")
4986  << FixItHint::CreateRemoval(RParenLoc);
4987  S.Diag(SizeRange.getBegin(), diag::note_memsize_comparison_cast_silence)
4988  << FixItHint::CreateInsertion(SizeRange.getBegin(), "(size_t)(")
4990  ")");
4991 
4992  return true;
4993 }
4994 
4995 /// \brief Determine whether the given type is or contains a dynamic class type
4996 /// (e.g., whether it has a vtable).
4998  bool &IsContained) {
4999  // Look through array types while ignoring qualifiers.
5000  const Type *Ty = T->getBaseElementTypeUnsafe();
5001  IsContained = false;
5002 
5003  const CXXRecordDecl *RD = Ty->getAsCXXRecordDecl();
5004  RD = RD ? RD->getDefinition() : nullptr;
5005  if (!RD)
5006  return nullptr;
5007 
5008  if (RD->isDynamicClass())
5009  return RD;
5010 
5011  // Check all the fields. If any bases were dynamic, the class is dynamic.
5012  // It's impossible for a class to transitively contain itself by value, so
5013  // infinite recursion is impossible.
5014  for (auto *FD : RD->fields()) {
5015  bool SubContained;
5016  if (const CXXRecordDecl *ContainedRD =
5017  getContainedDynamicClass(FD->getType(), SubContained)) {
5018  IsContained = true;
5019  return ContainedRD;
5020  }
5021  }
5022 
5023  return nullptr;
5024 }
5025 
5026 /// \brief If E is a sizeof expression, returns its argument expression,
5027 /// otherwise returns NULL.
5028 static const Expr *getSizeOfExprArg(const Expr *E) {
5029  if (const UnaryExprOrTypeTraitExpr *SizeOf =
5030  dyn_cast<UnaryExprOrTypeTraitExpr>(E))
5031  if (SizeOf->getKind() == clang::UETT_SizeOf && !SizeOf->isArgumentType())
5032  return SizeOf->getArgumentExpr()->IgnoreParenImpCasts();
5033 
5034  return nullptr;
5035 }
5036 
5037 /// \brief If E is a sizeof expression, returns its argument type.
5038 static QualType getSizeOfArgType(const Expr *E) {
5039  if (const UnaryExprOrTypeTraitExpr *SizeOf =
5040  dyn_cast<UnaryExprOrTypeTraitExpr>(E))
5041  if (SizeOf->getKind() == clang::UETT_SizeOf)
5042  return SizeOf->getTypeOfArgument();
5043 
5044  return QualType();
5045 }
5046 
5047 /// \brief Check for dangerous or invalid arguments to memset().
5048 ///
5049 /// This issues warnings on known problematic, dangerous or unspecified
5050 /// arguments to the standard 'memset', 'memcpy', 'memmove', and 'memcmp'
5051 /// function calls.
5052 ///
5053 /// \param Call The call expression to diagnose.
5054 void Sema::CheckMemaccessArguments(const CallExpr *Call,
5055  unsigned BId,
5056  IdentifierInfo *FnName) {
5057  assert(BId != 0);
5058 
5059  // It is possible to have a non-standard definition of memset. Validate
5060  // we have enough arguments, and if not, abort further checking.
5061  unsigned ExpectedNumArgs = (BId == Builtin::BIstrndup ? 2 : 3);
5062  if (Call->getNumArgs() < ExpectedNumArgs)
5063  return;
5064 
5065  unsigned LastArg = (BId == Builtin::BImemset ||
5066  BId == Builtin::BIstrndup ? 1 : 2);
5067  unsigned LenArg = (BId == Builtin::BIstrndup ? 1 : 2);
5068  const Expr *LenExpr = Call->getArg(LenArg)->IgnoreParenImpCasts();
5069 
5070  if (CheckMemorySizeofForComparison(*this, LenExpr, FnName,
5071  Call->getLocStart(), Call->getRParenLoc()))
5072  return;
5073 
5074  // We have special checking when the length is a sizeof expression.
5075  QualType SizeOfArgTy = getSizeOfArgType(LenExpr);
5076  const Expr *SizeOfArg = getSizeOfExprArg(LenExpr);
5077  llvm::FoldingSetNodeID SizeOfArgID;
5078 
5079  for (unsigned ArgIdx = 0; ArgIdx != LastArg; ++ArgIdx) {
5080  const Expr *Dest = Call->getArg(ArgIdx)->IgnoreParenImpCasts();
5081  SourceRange ArgRange = Call->getArg(ArgIdx)->getSourceRange();
5082 
5083  QualType DestTy = Dest->getType();
5084  QualType PointeeTy;
5085  if (const PointerType *DestPtrTy = DestTy->getAs<PointerType>()) {
5086  PointeeTy = DestPtrTy->getPointeeType();
5087 
5088  // Never warn about void type pointers. This can be used to suppress
5089  // false positives.
5090  if (PointeeTy->isVoidType())
5091  continue;
5092 
5093  // Catch "memset(p, 0, sizeof(p))" -- needs to be sizeof(*p). Do this by
5094  // actually comparing the expressions for equality. Because computing the
5095  // expression IDs can be expensive, we only do this if the diagnostic is
5096  // enabled.
5097  if (SizeOfArg &&
5098  !Diags.isIgnored(diag::warn_sizeof_pointer_expr_memaccess,
5099  SizeOfArg->getExprLoc())) {
5100  // We only compute IDs for expressions if the warning is enabled, and
5101  // cache the sizeof arg's ID.
5102  if (SizeOfArgID == llvm::FoldingSetNodeID())
5103  SizeOfArg->Profile(SizeOfArgID, Context, true);
5104  llvm::FoldingSetNodeID DestID;
5105  Dest->Profile(DestID, Context, true);
5106  if (DestID == SizeOfArgID) {
5107  // TODO: For strncpy() and friends, this could suggest sizeof(dst)
5108  // over sizeof(src) as well.
5109  unsigned ActionIdx = 0; // Default is to suggest dereferencing.
5110  StringRef ReadableName = FnName->getName();
5111 
5112  if (const UnaryOperator *UnaryOp = dyn_cast<UnaryOperator>(Dest))
5113  if (UnaryOp->getOpcode() == UO_AddrOf)
5114  ActionIdx = 1; // If its an address-of operator, just remove it.
5115  if (!PointeeTy->isIncompleteType() &&
5116  (Context.getTypeSize(PointeeTy) == Context.getCharWidth()))
5117  ActionIdx = 2; // If the pointee's size is sizeof(char),
5118  // suggest an explicit length.
5119 
5120  // If the function is defined as a builtin macro, do not show macro
5121  // expansion.
5122  SourceLocation SL = SizeOfArg->getExprLoc();
5123  SourceRange DSR = Dest->getSourceRange();
5124  SourceRange SSR = SizeOfArg->getSourceRange();
5125  SourceManager &SM = getSourceManager();
5126 
5127  if (SM.isMacroArgExpansion(SL)) {
5128  ReadableName = Lexer::getImmediateMacroName(SL, SM, LangOpts);
5129  SL = SM.getSpellingLoc(SL);
5130  DSR = SourceRange(SM.getSpellingLoc(DSR.getBegin()),
5131  SM.getSpellingLoc(DSR.getEnd()));
5132  SSR = SourceRange(SM.getSpellingLoc(SSR.getBegin()),
5133  SM.getSpellingLoc(SSR.getEnd()));
5134  }
5135 
5136  DiagRuntimeBehavior(SL, SizeOfArg,
5137  PDiag(diag::warn_sizeof_pointer_expr_memaccess)
5138  << ReadableName
5139  << PointeeTy
5140  << DestTy
5141  << DSR
5142  << SSR);
5143  DiagRuntimeBehavior(SL, SizeOfArg,
5144  PDiag(diag::warn_sizeof_pointer_expr_memaccess_note)
5145  << ActionIdx
5146  << SSR);
5147 
5148  break;
5149  }
5150  }
5151 
5152  // Also check for cases where the sizeof argument is the exact same
5153  // type as the memory argument, and where it points to a user-defined
5154  // record type.
5155  if (SizeOfArgTy != QualType()) {
5156  if (PointeeTy->isRecordType() &&
5157  Context.typesAreCompatible(SizeOfArgTy, DestTy)) {
5158  DiagRuntimeBehavior(LenExpr->getExprLoc(), Dest,
5159  PDiag(diag::warn_sizeof_pointer_type_memaccess)
5160  << FnName << SizeOfArgTy << ArgIdx
5161  << PointeeTy << Dest->getSourceRange()
5162  << LenExpr->getSourceRange());
5163  break;
5164  }
5165  }
5166  } else if (DestTy->isArrayType()) {
5167  PointeeTy = DestTy;
5168  }
5169 
5170  if (PointeeTy == QualType())
5171  continue;
5172 
5173  // Always complain about dynamic classes.
5174  bool IsContained;
5175  if (const CXXRecordDecl *ContainedRD =
5176  getContainedDynamicClass(PointeeTy, IsContained)) {
5177 
5178  unsigned OperationType = 0;
5179  // "overwritten" if we're warning about the destination for any call
5180  // but memcmp; otherwise a verb appropriate to the call.
5181  if (ArgIdx != 0 || BId == Builtin::BImemcmp) {
5182  if (BId == Builtin::BImemcpy)
5183  OperationType = 1;
5184  else if(BId == Builtin::BImemmove)
5185  OperationType = 2;
5186  else if (BId == Builtin::BImemcmp)
5187  OperationType = 3;
5188  }
5189 
5190  DiagRuntimeBehavior(
5191  Dest->getExprLoc(), Dest,
5192  PDiag(diag::warn_dyn_class_memaccess)
5193  << (BId == Builtin::BImemcmp ? ArgIdx + 2 : ArgIdx)
5194  << FnName << IsContained << ContainedRD << OperationType
5195  << Call->getCallee()->getSourceRange());
5196  } else if (PointeeTy.hasNonTrivialObjCLifetime() &&
5197  BId != Builtin::BImemset)
5198  DiagRuntimeBehavior(
5199  Dest->getExprLoc(), Dest,
5200  PDiag(diag::warn_arc_object_memaccess)
5201  << ArgIdx << FnName << PointeeTy
5202  << Call->getCallee()->getSourceRange());
5203  else
5204  continue;
5205 
5206  DiagRuntimeBehavior(
5207  Dest->getExprLoc(), Dest,
5208  PDiag(diag::note_bad_memaccess_silence)
5209  << FixItHint::CreateInsertion(ArgRange.getBegin(), "(void*)"));
5210  break;
5211  }
5212 
5213 }
5214 
5215 // A little helper routine: ignore addition and subtraction of integer literals.
5216 // This intentionally does not ignore all integer constant expressions because
5217 // we don't want to remove sizeof().
5218 static const Expr *ignoreLiteralAdditions(const Expr *Ex, ASTContext &Ctx) {
5219  Ex = Ex->IgnoreParenCasts();
5220 
5221  for (;;) {
5222  const BinaryOperator * BO = dyn_cast<BinaryOperator>(Ex);
5223  if (!BO || !BO->isAdditiveOp())
5224  break;
5225 
5226  const Expr *RHS = BO->getRHS()->IgnoreParenCasts();
5227  const Expr *LHS = BO->getLHS()->IgnoreParenCasts();
5228 
5229  if (isa<IntegerLiteral>(RHS))
5230  Ex = LHS;
5231  else if (isa<IntegerLiteral>(LHS))
5232  Ex = RHS;
5233  else
5234  break;
5235  }
5236 
5237  return Ex;
5238 }
5239 
5241  ASTContext &Context) {
5242  // Only handle constant-sized or VLAs, but not flexible members.
5243  if (const ConstantArrayType *CAT = Context.getAsConstantArrayType(Ty)) {
5244  // Only issue the FIXIT for arrays of size > 1.
5245  if (CAT->getSize().getSExtValue() <= 1)
5246  return false;
5247  } else if (!Ty->isVariableArrayType()) {
5248  return false;
5249  }
5250  return true;
5251 }
5252 
5253 // Warn if the user has made the 'size' argument to strlcpy or strlcat
5254 // be the size of the source, instead of the destination.
5255 void Sema::CheckStrlcpycatArguments(const CallExpr *Call,
5256  IdentifierInfo *FnName) {
5257 
5258  // Don't crash if the user has the wrong number of arguments
5259  unsigned NumArgs = Call->getNumArgs();
5260  if ((NumArgs != 3) && (NumArgs != 4))
5261  return;
5262 
5263  const Expr *SrcArg = ignoreLiteralAdditions(Call->getArg(1), Context);
5264  const Expr *SizeArg = ignoreLiteralAdditions(Call->getArg(2), Context);
5265  const Expr *CompareWithSrc = nullptr;
5266 
5267  if (CheckMemorySizeofForComparison(*this, SizeArg, FnName,
5268  Call->getLocStart(), Call->getRParenLoc()))
5269  return;
5270 
5271  // Look for 'strlcpy(dst, x, sizeof(x))'
5272  if (const Expr *Ex = getSizeOfExprArg(SizeArg))
5273  CompareWithSrc = Ex;
5274  else {
5275  // Look for 'strlcpy(dst, x, strlen(x))'
5276  if (const CallExpr *SizeCall = dyn_cast<CallExpr>(SizeArg)) {
5277  if (SizeCall->getBuiltinCallee() == Builtin::BIstrlen &&
5278  SizeCall->getNumArgs() == 1)
5279  CompareWithSrc = ignoreLiteralAdditions(SizeCall->getArg(0), Context);
5280  }
5281  }
5282 
5283  if (!CompareWithSrc)
5284  return;
5285 
5286  // Determine if the argument to sizeof/strlen is equal to the source
5287  // argument. In principle there's all kinds of things you could do
5288  // here, for instance creating an == expression and evaluating it with
5289  // EvaluateAsBooleanCondition, but this uses a more direct technique:
5290  const DeclRefExpr *SrcArgDRE = dyn_cast<DeclRefExpr>(SrcArg);
5291  if (!SrcArgDRE)
5292  return;
5293 
5294  const DeclRefExpr *CompareWithSrcDRE = dyn_cast<DeclRefExpr>(CompareWithSrc);
5295  if (!CompareWithSrcDRE ||
5296  SrcArgDRE->getDecl() != CompareWithSrcDRE->getDecl())
5297  return;
5298 
5299  const Expr *OriginalSizeArg = Call->getArg(2);
5300  Diag(CompareWithSrcDRE->getLocStart(), diag::warn_strlcpycat_wrong_size)
5301  << OriginalSizeArg->getSourceRange() << FnName;
5302 
5303  // Output a FIXIT hint if the destination is an array (rather than a
5304  // pointer to an array). This could be enhanced to handle some
5305  // pointers if we know the actual size, like if DstArg is 'array+2'
5306  // we could say 'sizeof(array)-2'.
5307  const Expr *DstArg = Call->getArg(0)->IgnoreParenImpCasts();
5309  return;
5310 
5311  SmallString<128> sizeString;
5312  llvm::raw_svector_ostream OS(sizeString);
5313  OS << "sizeof(";
5314  DstArg->printPretty(OS, nullptr, getPrintingPolicy());
5315  OS << ")";
5316 
5317  Diag(OriginalSizeArg->getLocStart(), diag::note_strlcpycat_wrong_size)
5318  << FixItHint::CreateReplacement(OriginalSizeArg->getSourceRange(),
5319  OS.str());
5320 }
5321 
5322 /// Check if two expressions refer to the same declaration.
5323 static bool referToTheSameDecl(const Expr *E1, const Expr *E2) {
5324  if (const DeclRefExpr *D1 = dyn_cast_or_null<DeclRefExpr>(E1))
5325  if (const DeclRefExpr *D2 = dyn_cast_or_null<DeclRefExpr>(E2))
5326  return D1->getDecl() == D2->getDecl();
5327  return false;
5328 }
5329 
5330 static const Expr *getStrlenExprArg(const Expr *E) {
5331  if (const CallExpr *CE = dyn_cast<CallExpr>(E)) {
5332  const FunctionDecl *FD = CE->getDirectCallee();
5333  if (!FD || FD->getMemoryFunctionKind() != Builtin::BIstrlen)
5334  return nullptr;
5335  return CE->getArg(0)->IgnoreParenCasts();
5336  }
5337  return nullptr;
5338 }
5339 
5340 // Warn on anti-patterns as the 'size' argument to strncat.
5341 // The correct size argument should look like following:
5342 // strncat(dst, src, sizeof(dst) - strlen(dest) - 1);
5343 void Sema::CheckStrncatArguments(const CallExpr *CE,
5344  IdentifierInfo *FnName) {
5345  // Don't crash if the user has the wrong number of arguments.
5346  if (CE->getNumArgs() < 3)
5347  return;
5348  const Expr *DstArg = CE->getArg(0)->IgnoreParenCasts();
5349  const Expr *SrcArg = CE->getArg(1)->IgnoreParenCasts();
5350  const Expr *LenArg = CE->getArg(2)->IgnoreParenCasts();
5351 
5352  if (CheckMemorySizeofForComparison(*this, LenArg, FnName, CE->getLocStart(),
5353  CE->getRParenLoc()))
5354  return;
5355 
5356  // Identify common expressions, which are wrongly used as the size argument
5357  // to strncat and may lead to buffer overflows.
5358  unsigned PatternType = 0;
5359  if (const Expr *SizeOfArg = getSizeOfExprArg(LenArg)) {
5360  // - sizeof(dst)
5361  if (referToTheSameDecl(SizeOfArg, DstArg))
5362  PatternType = 1;
5363  // - sizeof(src)
5364  else if (referToTheSameDecl(SizeOfArg, SrcArg))
5365  PatternType = 2;
5366  } else if (const BinaryOperator *BE = dyn_cast<BinaryOperator>(LenArg)) {
5367  if (BE->getOpcode() == BO_Sub) {
5368  const Expr *L = BE->getLHS()->IgnoreParenCasts();
5369  const Expr *R = BE->getRHS()->IgnoreParenCasts();
5370  // - sizeof(dst) - strlen(dst)
5371  if (referToTheSameDecl(DstArg, getSizeOfExprArg(L)) &&
5373  PatternType = 1;
5374  // - sizeof(src) - (anything)
5375  else if (referToTheSameDecl(SrcArg, getSizeOfExprArg(L)))
5376  PatternType = 2;
5377  }
5378  }
5379 
5380  if (PatternType == 0)
5381  return;
5382 
5383  // Generate the diagnostic.
5384  SourceLocation SL = LenArg->getLocStart();
5385  SourceRange SR = LenArg->getSourceRange();
5386  SourceManager &SM = getSourceManager();
5387 
5388  // If the function is defined as a builtin macro, do not show macro expansion.
5389  if (SM.isMacroArgExpansion(SL)) {
5390  SL = SM.getSpellingLoc(SL);
5391  SR = SourceRange(SM.getSpellingLoc(SR.getBegin()),
5392  SM.getSpellingLoc(SR.getEnd()));
5393  }
5394 
5395  // Check if the destination is an array (rather than a pointer to an array).
5396  QualType DstTy = DstArg->getType();
5397  bool isKnownSizeArray = isConstantSizeArrayWithMoreThanOneElement(DstTy,
5398  Context);
5399  if (!isKnownSizeArray) {
5400  if (PatternType == 1)
5401  Diag(SL, diag::warn_strncat_wrong_size) << SR;
5402  else
5403  Diag(SL, diag::warn_strncat_src_size) << SR;
5404  return;
5405  }
5406 
5407  if (PatternType == 1)
5408  Diag(SL, diag::warn_strncat_large_size) << SR;
5409  else
5410  Diag(SL, diag::warn_strncat_src_size) << SR;
5411 
5412  SmallString<128> sizeString;
5413  llvm::raw_svector_ostream OS(sizeString);
5414  OS << "sizeof(";
5415  DstArg->printPretty(OS, nullptr, getPrintingPolicy());
5416  OS << ") - ";
5417  OS << "strlen(";
5418  DstArg->printPretty(OS, nullptr, getPrintingPolicy());
5419  OS << ") - 1";
5420 
5421  Diag(SL, diag::note_strncat_wrong_size)
5422  << FixItHint::CreateReplacement(SR, OS.str());
5423 }
5424 
5425 //===--- CHECK: Return Address of Stack Variable --------------------------===//
5426 
5427 static Expr *EvalVal(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars,
5428  Decl *ParentDecl);
5429 static Expr *EvalAddr(Expr* E, SmallVectorImpl<DeclRefExpr *> &refVars,
5430  Decl *ParentDecl);
5431 
5432 /// CheckReturnStackAddr - Check if a return statement returns the address
5433 /// of a stack variable.
5434 static void
5435 CheckReturnStackAddr(Sema &S, Expr *RetValExp, QualType lhsType,
5436  SourceLocation ReturnLoc) {
5437 
5438  Expr *stackE = nullptr;
5440 
5441  // Perform checking for returned stack addresses, local blocks,
5442  // label addresses or references to temporaries.
5443  if (lhsType->isPointerType() ||
5444  (!S.getLangOpts().ObjCAutoRefCount && lhsType->isBlockPointerType())) {
5445  stackE = EvalAddr(RetValExp, refVars, /*ParentDecl=*/nullptr);
5446  } else if (lhsType->isReferenceType()) {
5447  stackE = EvalVal(RetValExp, refVars, /*ParentDecl=*/nullptr);
5448  }
5449 
5450  if (!stackE)
5451  return; // Nothing suspicious was found.
5452 
5453  SourceLocation diagLoc;
5454  SourceRange diagRange;
5455  if (refVars.empty()) {
5456  diagLoc = stackE->getLocStart();
5457  diagRange = stackE->getSourceRange();
5458  } else {
5459  // We followed through a reference variable. 'stackE' contains the
5460  // problematic expression but we will warn at the return statement pointing
5461  // at the reference variable. We will later display the "trail" of
5462  // reference variables using notes.
5463  diagLoc = refVars[0]->getLocStart();
5464  diagRange = refVars[0]->getSourceRange();
5465  }
5466 
5467  if (DeclRefExpr *DR = dyn_cast<DeclRefExpr>(stackE)) { //address of local var.
5468  S.Diag(diagLoc, lhsType->isReferenceType() ? diag::warn_ret_stack_ref
5469  : diag::warn_ret_stack_addr)
5470  << DR->getDecl()->getDeclName() << diagRange;
5471  } else if (isa<BlockExpr>(stackE)) { // local block.
5472  S.Diag(diagLoc, diag::err_ret_local_block) << diagRange;
5473  } else if (isa<AddrLabelExpr>(stackE)) { // address of label.
5474  S.Diag(diagLoc, diag::warn_ret_addr_label) << diagRange;
5475  } else { // local temporary.
5476  S.Diag(diagLoc, lhsType->isReferenceType() ? diag::warn_ret_local_temp_ref
5477  : diag::warn_ret_local_temp_addr)
5478  << diagRange;
5479  }
5480 
5481  // Display the "trail" of reference variables that we followed until we
5482  // found the problematic expression using notes.
5483  for (unsigned i = 0, e = refVars.size(); i != e; ++i) {
5484  VarDecl *VD = cast<VarDecl>(refVars[i]->getDecl());
5485  // If this var binds to another reference var, show the range of the next
5486  // var, otherwise the var binds to the problematic expression, in which case
5487  // show the range of the expression.
5488  SourceRange range = (i < e-1) ? refVars[i+1]->getSourceRange()
5489  : stackE->getSourceRange();
5490  S.Diag(VD->getLocation(), diag::note_ref_var_local_bind)
5491  << VD->getDeclName() << range;
5492  }
5493 }
5494 
5495 /// EvalAddr - EvalAddr and EvalVal are mutually recursive functions that
5496 /// check if the expression in a return statement evaluates to an address
5497 /// to a location on the stack, a local block, an address of a label, or a
5498 /// reference to local temporary. The recursion is used to traverse the
5499 /// AST of the return expression, with recursion backtracking when we
5500 /// encounter a subexpression that (1) clearly does not lead to one of the
5501 /// above problematic expressions (2) is something we cannot determine leads to
5502 /// a problematic expression based on such local checking.
5503 ///
5504 /// Both EvalAddr and EvalVal follow through reference variables to evaluate
5505 /// the expression that they point to. Such variables are added to the
5506 /// 'refVars' vector so that we know what the reference variable "trail" was.
5507 ///
5508 /// EvalAddr processes expressions that are pointers that are used as
5509 /// references (and not L-values). EvalVal handles all other values.
5510 /// At the base case of the recursion is a check for the above problematic
5511 /// expressions.
5512 ///
5513 /// This implementation handles:
5514 ///
5515 /// * pointer-to-pointer casts
5516 /// * implicit conversions from array references to pointers
5517 /// * taking the address of fields
5518 /// * arbitrary interplay between "&" and "*" operators
5519 /// * pointer arithmetic from an address of a stack variable
5520 /// * taking the address of an array element where the array is on the stack
5521 static Expr *EvalAddr(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars,
5522  Decl *ParentDecl) {
5523  if (E->isTypeDependent())
5524  return nullptr;
5525 
5526  // We should only be called for evaluating pointer expressions.
5527  assert((E->getType()->isAnyPointerType() ||
5528  E->getType()->isBlockPointerType() ||
5529  E->getType()->isObjCQualifiedIdType()) &&
5530  "EvalAddr only works on pointers");
5531 
5532  E = E->IgnoreParens();
5533 
5534  // Our "symbolic interpreter" is just a dispatch off the currently
5535  // viewed AST node. We then recursively traverse the AST by calling
5536  // EvalAddr and EvalVal appropriately.
5537  switch (E->getStmtClass()) {
5538  case Stmt::DeclRefExprClass: {
5539  DeclRefExpr *DR = cast<DeclRefExpr>(E);
5540 
5541  // If we leave the immediate function, the lifetime isn't about to end.
5543  return nullptr;
5544 
5545  if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl()))
5546  // If this is a reference variable, follow through to the expression that
5547  // it points to.
5548  if (V->hasLocalStorage() &&
5549  V->getType()->isReferenceType() && V->hasInit()) {
5550  // Add the reference variable to the "trail".
5551  refVars.push_back(DR);
5552  return EvalAddr(V->getInit(), refVars, ParentDecl);
5553  }
5554 
5555  return nullptr;
5556  }
5557 
5558  case Stmt::UnaryOperatorClass: {
5559  // The only unary operator that make sense to handle here
5560  // is AddrOf. All others don't make sense as pointers.
5561  UnaryOperator *U = cast<UnaryOperator>(E);
5562 
5563  if (U->getOpcode() == UO_AddrOf)
5564  return EvalVal(U->getSubExpr(), refVars, ParentDecl);
5565  else
5566  return nullptr;
5567  }
5568 
5569  case Stmt::BinaryOperatorClass: {
5570  // Handle pointer arithmetic. All other binary operators are not valid
5571  // in this context.
5572  BinaryOperator *B = cast<BinaryOperator>(E);
5573  BinaryOperatorKind op = B->getOpcode();
5574 
5575  if (op != BO_Add && op != BO_Sub)
5576  return nullptr;
5577 
5578  Expr *Base = B->getLHS();
5579 
5580  // Determine which argument is the real pointer base. It could be
5581  // the RHS argument instead of the LHS.
5582  if (!Base->getType()->isPointerType()) Base = B->getRHS();
5583 
5584  assert (Base->getType()->isPointerType());
5585  return EvalAddr(Base, refVars, ParentDecl);
5586  }
5587 
5588  // For conditional operators we need to see if either the LHS or RHS are
5589  // valid DeclRefExpr*s. If one of them is valid, we return it.
5590  case Stmt::ConditionalOperatorClass: {
5591  ConditionalOperator *C = cast<ConditionalOperator>(E);
5592 
5593  // Handle the GNU extension for missing LHS.
5594  // FIXME: That isn't a ConditionalOperator, so doesn't get here.
5595  if (Expr *LHSExpr = C->getLHS()) {
5596  // In C++, we can have a throw-expression, which has 'void' type.
5597  if (!LHSExpr->getType()->isVoidType())
5598  if (Expr *LHS = EvalAddr(LHSExpr, refVars, ParentDecl))
5599  return LHS;
5600  }
5601 
5602  // In C++, we can have a throw-expression, which has 'void' type.
5603  if (C->getRHS()->getType()->isVoidType())
5604  return nullptr;
5605 
5606  return EvalAddr(C->getRHS(), refVars, ParentDecl);
5607  }
5608 
5609  case Stmt::BlockExprClass:
5610  if (cast<BlockExpr>(E)->getBlockDecl()->hasCaptures())
5611  return E; // local block.
5612  return nullptr;
5613 
5614  case Stmt::AddrLabelExprClass:
5615  return E; // address of label.
5616 
5617  case Stmt::ExprWithCleanupsClass:
5618  return EvalAddr(cast<ExprWithCleanups>(E)->getSubExpr(), refVars,
5619  ParentDecl);
5620 
5621  // For casts, we need to handle conversions from arrays to
5622  // pointer values, and pointer-to-pointer conversions.
5623  case Stmt::ImplicitCastExprClass:
5624  case Stmt::CStyleCastExprClass:
5625  case Stmt::CXXFunctionalCastExprClass:
5626  case Stmt::ObjCBridgedCastExprClass:
5627  case Stmt::CXXStaticCastExprClass:
5628  case Stmt::CXXDynamicCastExprClass:
5629  case Stmt::CXXConstCastExprClass:
5630  case Stmt::CXXReinterpretCastExprClass: {
5631  Expr* SubExpr = cast<CastExpr>(E)->getSubExpr();
5632  switch (cast<CastExpr>(E)->getCastKind()) {
5633  case CK_LValueToRValue:
5634  case CK_NoOp:
5635  case CK_BaseToDerived:
5636  case CK_DerivedToBase:
5638  case CK_Dynamic:
5642  return EvalAddr(SubExpr, refVars, ParentDecl);
5643 
5645  return EvalVal(SubExpr, refVars, ParentDecl);
5646 
5647  case CK_BitCast:
5648  if (SubExpr->getType()->isAnyPointerType() ||
5649  SubExpr->getType()->isBlockPointerType() ||
5650  SubExpr->getType()->isObjCQualifiedIdType())
5651  return EvalAddr(SubExpr, refVars, ParentDecl);
5652  else
5653  return nullptr;
5654 
5655  default:
5656  return nullptr;
5657  }
5658  }
5659 
5660  case Stmt::MaterializeTemporaryExprClass:
5661  if (Expr *Result = EvalAddr(
5662  cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr(),
5663  refVars, ParentDecl))
5664  return Result;
5665 
5666  return E;
5667 
5668  // Everything else: we simply don't reason about them.
5669  default:
5670  return nullptr;
5671  }
5672 }
5673 
5674 
5675 /// EvalVal - This function is complements EvalAddr in the mutual recursion.
5676 /// See the comments for EvalAddr for more details.
5677 static Expr *EvalVal(Expr *E, SmallVectorImpl<DeclRefExpr *> &refVars,
5678  Decl *ParentDecl) {
5679 do {
5680  // We should only be called for evaluating non-pointer expressions, or
5681  // expressions with a pointer type that are not used as references but instead
5682  // are l-values (e.g., DeclRefExpr with a pointer type).
5683 
5684  // Our "symbolic interpreter" is just a dispatch off the currently
5685  // viewed AST node. We then recursively traverse the AST by calling
5686  // EvalAddr and EvalVal appropriately.
5687 
5688  E = E->IgnoreParens();
5689  switch (E->getStmtClass()) {
5690  case Stmt::ImplicitCastExprClass: {
5691  ImplicitCastExpr *IE = cast<ImplicitCastExpr>(E);
5692  if (IE->getValueKind() == VK_LValue) {
5693  E = IE->getSubExpr();
5694  continue;
5695  }
5696  return nullptr;
5697  }
5698 
5699  case Stmt::ExprWithCleanupsClass:
5700  return EvalVal(cast<ExprWithCleanups>(E)->getSubExpr(), refVars,ParentDecl);
5701 
5702  case Stmt::DeclRefExprClass: {
5703  // When we hit a DeclRefExpr we are looking at code that refers to a
5704  // variable's name. If it's not a reference variable we check if it has
5705  // local storage within the function, and if so, return the expression.
5706  DeclRefExpr *DR = cast<DeclRefExpr>(E);
5707 
5708  // If we leave the immediate function, the lifetime isn't about to end.
5710  return nullptr;
5711 
5712  if (VarDecl *V = dyn_cast<VarDecl>(DR->getDecl())) {
5713  // Check if it refers to itself, e.g. "int& i = i;".
5714  if (V == ParentDecl)
5715  return DR;
5716 
5717  if (V->hasLocalStorage()) {
5718  if (!V->getType()->isReferenceType())
5719  return DR;
5720 
5721  // Reference variable, follow through to the expression that
5722  // it points to.
5723  if (V->hasInit()) {
5724  // Add the reference variable to the "trail".
5725  refVars.push_back(DR);
5726  return EvalVal(V->getInit(), refVars, V);
5727  }
5728  }
5729  }
5730 
5731  return nullptr;
5732  }
5733 
5734  case Stmt::UnaryOperatorClass: {
5735  // The only unary operator that make sense to handle here
5736  // is Deref. All others don't resolve to a "name." This includes
5737  // handling all sorts of rvalues passed to a unary operator.
5738  UnaryOperator *U = cast<UnaryOperator>(E);
5739 
5740  if (U->getOpcode() == UO_Deref)
5741  return EvalAddr(U->getSubExpr(), refVars, ParentDecl);
5742 
5743  return nullptr;
5744  }
5745 
5746  case Stmt::ArraySubscriptExprClass: {
5747  // Array subscripts are potential references to data on the stack. We
5748  // retrieve the DeclRefExpr* for the array variable if it indeed
5749  // has local storage.
5750  return EvalAddr(cast<ArraySubscriptExpr>(E)->getBase(), refVars,ParentDecl);
5751  }
5752 
5753  case Stmt::ConditionalOperatorClass: {
5754  // For conditional operators we need to see if either the LHS or RHS are
5755  // non-NULL Expr's. If one is non-NULL, we return it.
5756  ConditionalOperator *C = cast<ConditionalOperator>(E);
5757 
5758  // Handle the GNU extension for missing LHS.
5759  if (Expr *LHSExpr = C->getLHS()) {
5760  // In C++, we can have a throw-expression, which has 'void' type.
5761  if (!LHSExpr->getType()->isVoidType())
5762  if (Expr *LHS = EvalVal(LHSExpr, refVars, ParentDecl))
5763  return LHS;
5764  }
5765 
5766  // In C++, we can have a throw-expression, which has 'void' type.
5767  if (C->getRHS()->getType()->isVoidType())
5768  return nullptr;
5769 
5770  return EvalVal(C->getRHS(), refVars, ParentDecl);
5771  }
5772 
5773  // Accesses to members are potential references to data on the stack.
5774  case Stmt::MemberExprClass: {
5775  MemberExpr *M = cast<MemberExpr>(E);
5776 
5777  // Check for indirect access. We only want direct field accesses.
5778  if (M->isArrow())
5779  return nullptr;
5780 
5781  // Check whether the member type is itself a reference, in which case
5782  // we're not going to refer to the member, but to what the member refers to.
5783  if (M->getMemberDecl()->getType()->isReferenceType())
5784  return nullptr;
5785 
5786  return EvalVal(M->getBase(), refVars, ParentDecl);
5787  }
5788 
5789  case Stmt::MaterializeTemporaryExprClass:
5790  if (Expr *Result = EvalVal(
5791  cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr(),
5792  refVars, ParentDecl))
5793  return Result;
5794 
5795  return E;
5796 
5797  default:
5798  // Check that we don't return or take the address of a reference to a
5799  // temporary. This is only useful in C++.
5800  if (!E->isTypeDependent() && E->isRValue())
5801  return E;
5802 
5803  // Everything else: we simply don't reason about them.
5804  return nullptr;
5805  }
5806 } while (true);
5807 }
5808 
5809 void
5810 Sema::CheckReturnValExpr(Expr *RetValExp, QualType lhsType,
5811  SourceLocation ReturnLoc,
5812  bool isObjCMethod,
5813  const AttrVec *Attrs,
5814  const FunctionDecl *FD) {
5815  CheckReturnStackAddr(*this, RetValExp, lhsType, ReturnLoc);
5816 
5817  // Check if the return value is null but should not be.
5818  if (((Attrs && hasSpecificAttr<ReturnsNonNullAttr>(*Attrs)) ||
5819  (!isObjCMethod && isNonNullType(Context, lhsType))) &&
5820  CheckNonNullExpr(*this, RetValExp))
5821  Diag(ReturnLoc, diag::warn_null_ret)
5822  << (isObjCMethod ? 1 : 0) << RetValExp->getSourceRange();
5823 
5824  // C++11 [basic.stc.dynamic.allocation]p4:
5825  // If an allocation function declared with a non-throwing
5826  // exception-specification fails to allocate storage, it shall return
5827  // a null pointer. Any other allocation function that fails to allocate
5828  // storage shall indicate failure only by throwing an exception [...]
5829  if (FD) {
5831  if (Op == OO_New || Op == OO_Array_New) {
5832  const FunctionProtoType *Proto
5833  = FD->getType()->castAs<FunctionProtoType>();
5834  if (!Proto->isNothrow(Context, /*ResultIfDependent*/true) &&
5835  CheckNonNullExpr(*this, RetValExp))
5836  Diag(ReturnLoc, diag::warn_operator_new_returns_null)
5837  << FD << getLangOpts().CPlusPlus11;
5838  }
5839  }
5840 }
5841 
5842 //===--- CHECK: Floating-Point comparisons (-Wfloat-equal) ---------------===//
5843 
5844 /// Check for comparisons of floating point operands using != and ==.
5845 /// Issue a warning if these are no self-comparisons, as they are not likely
5846 /// to do what the programmer intended.
5847 void Sema::CheckFloatComparison(SourceLocation Loc, Expr* LHS, Expr *RHS) {
5848  Expr* LeftExprSansParen = LHS->IgnoreParenImpCasts();
5849  Expr* RightExprSansParen = RHS->IgnoreParenImpCasts();
5850 
5851  // Special case: check for x == x (which is OK).
5852  // Do not emit warnings for such cases.
5853  if (DeclRefExpr* DRL = dyn_cast<DeclRefExpr>(LeftExprSansParen))
5854  if (DeclRefExpr* DRR = dyn_cast<DeclRefExpr>(RightExprSansParen))
5855  if (DRL->getDecl() == DRR->getDecl())
5856  return;
5857 
5858 
5859  // Special case: check for comparisons against literals that can be exactly
5860  // represented by APFloat. In such cases, do not emit a warning. This
5861  // is a heuristic: often comparison against such literals are used to
5862  // detect if a value in a variable has not changed. This clearly can
5863  // lead to false negatives.
5864  if (FloatingLiteral* FLL = dyn_cast<FloatingLiteral>(LeftExprSansParen)) {
5865  if (FLL->isExact())
5866  return;
5867  } else
5868  if (FloatingLiteral* FLR = dyn_cast<FloatingLiteral>(RightExprSansParen))
5869  if (FLR->isExact())
5870  return;
5871 
5872  // Check for comparisons with builtin types.
5873  if (CallExpr* CL = dyn_cast<CallExpr>(LeftExprSansParen))
5874  if (CL->getBuiltinCallee())
5875  return;
5876 
5877  if (CallExpr* CR = dyn_cast<CallExpr>(RightExprSansParen))
5878  if (CR->getBuiltinCallee())
5879  return;
5880 
5881  // Emit the diagnostic.
5882  Diag(Loc, diag::warn_floatingpoint_eq)
5883  << LHS->getSourceRange() << RHS->getSourceRange();
5884 }
5885 
5886 //===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
5887 //===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
5888 
5889 namespace {
5890 
5891 /// Structure recording the 'active' range of an integer-valued
5892 /// expression.
5893 struct IntRange {
5894  /// The number of bits active in the int.
5895  unsigned Width;
5896 
5897  /// True if the int is known not to have negative values.
5898  bool NonNegative;
5899 
5900  IntRange(unsigned Width, bool NonNegative)
5901  : Width(Width), NonNegative(NonNegative)
5902  {}
5903 
5904  /// Returns the range of the bool type.
5905  static IntRange forBoolType() {
5906  return IntRange(1, true);
5907  }
5908 
5909  /// Returns the range of an opaque value of the given integral type.
5910  static IntRange forValueOfType(ASTContext &C, QualType T) {
5911  return forValueOfCanonicalType(C,
5913  }
5914 
5915  /// Returns the range of an opaque value of a canonical integral type.
5916  static IntRange forValueOfCanonicalType(ASTContext &C, const Type *T) {
5917  assert(T->isCanonicalUnqualified());
5918 
5919  if (const VectorType *VT = dyn_cast<VectorType>(T))
5920  T = VT->getElementType().getTypePtr();
5921  if (const ComplexType *CT = dyn_cast<ComplexType>(T))
5922  T = CT->getElementType().getTypePtr();
5923  if (const AtomicType *AT = dyn_cast<AtomicType>(T))
5924  T = AT->getValueType().getTypePtr();
5925 
5926  // For enum types, use the known bit width of the enumerators.
5927  if (const EnumType *ET = dyn_cast<EnumType>(T)) {
5928  EnumDecl *Enum = ET->getDecl();
5929  if (!Enum->isCompleteDefinition())
5930  return IntRange(C.getIntWidth(QualType(T, 0)), false);
5931 
5932  unsigned NumPositive = Enum->getNumPositiveBits();
5933  unsigned NumNegative = Enum->getNumNegativeBits();
5934 
5935  if (NumNegative == 0)
5936  return IntRange(NumPositive, true/*NonNegative*/);
5937  else
5938  return IntRange(std::max(NumPositive + 1, NumNegative),
5939  false/*NonNegative*/);
5940  }
5941 
5942  const BuiltinType *BT = cast<BuiltinType>(T);
5943  assert(BT->isInteger());
5944 
5945  return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
5946  }
5947 
5948  /// Returns the "target" range of a canonical integral type, i.e.
5949  /// the range of values expressible in the type.
5950  ///
5951  /// This matches forValueOfCanonicalType except that enums have the
5952  /// full range of their type, not the range of their enumerators.
5953  static IntRange forTargetOfCanonicalType(ASTContext &C, const Type *T) {
5954  assert(T->isCanonicalUnqualified());
5955 
5956  if (const VectorType *VT = dyn_cast<VectorType>(T))
5957  T = VT->getElementType().getTypePtr();
5958  if (const ComplexType *CT = dyn_cast<ComplexType>(T))
5959  T = CT->getElementType().getTypePtr();
5960  if (const AtomicType *AT = dyn_cast<AtomicType>(T))
5961  T = AT->getValueType().getTypePtr();
5962  if (const EnumType *ET = dyn_cast<EnumType>(T))
5963  T = C.getCanonicalType(ET->getDecl()->getIntegerType()).getTypePtr();
5964 
5965  const BuiltinType *BT = cast<BuiltinType>(T);
5966  assert(BT->isInteger());
5967 
5968  return IntRange(C.getIntWidth(QualType(T, 0)), BT->isUnsignedInteger());
5969  }
5970 
5971  /// Returns the supremum of two ranges: i.e. their conservative merge.
5972  static IntRange join(IntRange L, IntRange R) {
5973  return IntRange(std::max(L.Width, R.Width),
5974  L.NonNegative && R.NonNegative);
5975  }
5976 
5977  /// Returns the infinum of two ranges: i.e. their aggressive merge.
5978  static IntRange meet(IntRange L, IntRange R) {
5979  return IntRange(std::min(L.Width, R.Width),
5980  L.NonNegative || R.NonNegative);
5981  }
5982 };
5983 
5984 static IntRange GetValueRange(ASTContext &C, llvm::APSInt &value,
5985  unsigned MaxWidth) {
5986  if (value.isSigned() && value.isNegative())
5987  return IntRange(value.getMinSignedBits(), false);
5988 
5989  if (value.getBitWidth() > MaxWidth)
5990  value = value.trunc(MaxWidth);
5991 
5992  // isNonNegative() just checks the sign bit without considering
5993  // signedness.
5994  return IntRange(value.getActiveBits(), true);
5995 }
5996 
5997 static IntRange GetValueRange(ASTContext &C, APValue &result, QualType Ty,
5998  unsigned MaxWidth) {
5999  if (result.isInt())
6000  return GetValueRange(C, result.getInt(), MaxWidth);
6001 
6002  if (result.isVector()) {
6003  IntRange R = GetValueRange(C, result.getVectorElt(0), Ty, MaxWidth);
6004  for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
6005  IntRange El = GetValueRange(C, result.getVectorElt(i), Ty, MaxWidth);
6006  R = IntRange::join(R, El);
6007  }
6008  return R;
6009  }
6010 
6011  if (result.isComplexInt()) {
6012  IntRange R = GetValueRange(C, result.getComplexIntReal(), MaxWidth);
6013  IntRange I = GetValueRange(C, result.getComplexIntImag(), MaxWidth);
6014  return IntRange::join(R, I);
6015  }
6016 
6017  // This can happen with lossless casts to intptr_t of "based" lvalues.
6018  // Assume it might use arbitrary bits.
6019  // FIXME: The only reason we need to pass the type in here is to get
6020  // the sign right on this one case. It would be nice if APValue
6021  // preserved this.
6022  assert(result.isLValue() || result.isAddrLabelDiff());
6023  return IntRange(MaxWidth, Ty->isUnsignedIntegerOrEnumerationType());
6024 }
6025 
6026 static QualType GetExprType(Expr *E) {
6027  QualType Ty = E->getType();
6028  if (const AtomicType *AtomicRHS = Ty->getAs<AtomicType>())
6029  Ty = AtomicRHS->getValueType();
6030  return Ty;
6031 }
6032 
6033 /// Pseudo-evaluate the given integer expression, estimating the
6034 /// range of values it might take.
6035 ///
6036 /// \param MaxWidth - the width to which the value will be truncated
6037 static IntRange GetExprRange(ASTContext &C, Expr *E, unsigned MaxWidth) {
6038  E = E->IgnoreParens();
6039 
6040  // Try a full evaluation first.
6041  Expr::EvalResult result;
6042  if (E->EvaluateAsRValue(result, C))
6043  return GetValueRange(C, result.Val, GetExprType(E), MaxWidth);
6044 
6045  // I think we only want to look through implicit casts here; if the
6046  // user has an explicit widening cast, we should treat the value as
6047  // being of the new, wider type.
6048  if (ImplicitCastExpr *CE = dyn_cast<ImplicitCastExpr>(E)) {
6049  if (CE->getCastKind() == CK_NoOp || CE->getCastKind() == CK_LValueToRValue)
6050  return GetExprRange(C, CE->getSubExpr(), MaxWidth);
6051 
6052  IntRange OutputTypeRange = IntRange::forValueOfType(C, GetExprType(CE));
6053 
6054  bool isIntegerCast = (CE->getCastKind() == CK_IntegralCast);
6055 
6056  // Assume that non-integer casts can span the full range of the type.
6057  if (!isIntegerCast)
6058  return OutputTypeRange;
6059 
6060  IntRange SubRange
6061  = GetExprRange(C, CE->getSubExpr(),
6062  std::min(MaxWidth, OutputTypeRange.Width));
6063 
6064  // Bail out if the subexpr's range is as wide as the cast type.
6065  if (SubRange.Width >= OutputTypeRange.Width)
6066  return OutputTypeRange;
6067 
6068  // Otherwise, we take the smaller width, and we're non-negative if
6069  // either the output type or the subexpr is.
6070  return IntRange(SubRange.Width,
6071  SubRange.NonNegative || OutputTypeRange.NonNegative);
6072  }
6073 
6074  if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
6075  // If we can fold the condition, just take that operand.
6076  bool CondResult;
6077  if (CO->getCond()->EvaluateAsBooleanCondition(CondResult, C))
6078  return GetExprRange(C, CondResult ? CO->getTrueExpr()
6079  : CO->getFalseExpr(),
6080  MaxWidth);
6081 
6082  // Otherwise, conservatively merge.
6083  IntRange L = GetExprRange(C, CO->getTrueExpr(), MaxWidth);
6084  IntRange R = GetExprRange(C, CO->getFalseExpr(), MaxWidth);
6085  return IntRange::join(L, R);
6086  }
6087 
6088  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
6089  switch (BO->getOpcode()) {
6090 
6091  // Boolean-valued operations are single-bit and positive.
6092  case BO_LAnd:
6093  case BO_LOr:
6094  case BO_LT:
6095  case BO_GT:
6096  case BO_LE:
6097  case BO_GE:
6098  case BO_EQ:
6099  case BO_NE:
6100  return IntRange::forBoolType();
6101 
6102  // The type of the assignments is the type of the LHS, so the RHS
6103  // is not necessarily the same type.
6104  case BO_MulAssign:
6105  case BO_DivAssign:
6106  case BO_RemAssign:
6107  case BO_AddAssign:
6108  case BO_SubAssign:
6109  case BO_XorAssign:
6110  case BO_OrAssign:
6111  // TODO: bitfields?
6112  return IntRange::forValueOfType(C, GetExprType(E));
6113 
6114  // Simple assignments just pass through the RHS, which will have
6115  // been coerced to the LHS type.
6116  case BO_Assign:
6117  // TODO: bitfields?
6118  return GetExprRange(C, BO->getRHS(), MaxWidth);
6119 
6120  // Operations with opaque sources are black-listed.
6121  case BO_PtrMemD:
6122  case BO_PtrMemI:
6123  return IntRange::forValueOfType(C, GetExprType(E));
6124 
6125  // Bitwise-and uses the *infinum* of the two source ranges.
6126  case BO_And:
6127  case BO_AndAssign:
6128  return IntRange::meet(GetExprRange(C, BO->getLHS(), MaxWidth),
6129  GetExprRange(C, BO->getRHS(), MaxWidth));
6130 
6131  // Left shift gets black-listed based on a judgement call.
6132  case BO_Shl:
6133  // ...except that we want to treat '1 << (blah)' as logically
6134  // positive. It's an important idiom.
6135  if (IntegerLiteral *I
6136  = dyn_cast<IntegerLiteral>(BO->getLHS()->IgnoreParenCasts())) {
6137  if (I->getValue() == 1) {
6138  IntRange R = IntRange::forValueOfType(C, GetExprType(E));
6139  return IntRange(R.Width, /*NonNegative*/ true);
6140  }
6141  }
6142  // fallthrough
6143 
6144  case BO_ShlAssign:
6145  return IntRange::forValueOfType(C, GetExprType(E));
6146 
6147  // Right shift by a constant can narrow its left argument.
6148  case BO_Shr:
6149  case BO_ShrAssign: {
6150  IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
6151 
6152  // If the shift amount is a positive constant, drop the width by
6153  // that much.
6154  llvm::APSInt shift;
6155  if (BO->getRHS()->isIntegerConstantExpr(shift, C) &&
6156  shift.isNonNegative()) {
6157  unsigned zext = shift.getZExtValue();
6158  if (zext >= L.Width)
6159  L.Width = (L.NonNegative ? 0 : 1);
6160  else
6161  L.Width -= zext;
6162  }
6163 
6164  return L;
6165  }
6166 
6167  // Comma acts as its right operand.
6168  case BO_Comma:
6169  return GetExprRange(C, BO->getRHS(), MaxWidth);
6170 
6171  // Black-list pointer subtractions.
6172  case BO_Sub:
6173  if (BO->getLHS()->getType()->isPointerType())
6174  return IntRange::forValueOfType(C, GetExprType(E));
6175  break;
6176 
6177  // The width of a division result is mostly determined by the size
6178  // of the LHS.
6179  case BO_Div: {
6180  // Don't 'pre-truncate' the operands.
6181  unsigned opWidth = C.getIntWidth(GetExprType(E));
6182  IntRange L = GetExprRange(C, BO->getLHS(), opWidth);
6183 
6184  // If the divisor is constant, use that.
6185  llvm::APSInt divisor;
6186  if (BO->getRHS()->isIntegerConstantExpr(divisor, C)) {
6187  unsigned log2 = divisor.logBase2(); // floor(log_2(divisor))
6188  if (log2 >= L.Width)
6189  L.Width = (L.NonNegative ? 0 : 1);
6190  else
6191  L.Width = std::min(L.Width - log2, MaxWidth);
6192  return L;
6193  }
6194 
6195  // Otherwise, just use the LHS's width.
6196  IntRange R = GetExprRange(C, BO->getRHS(), opWidth);
6197  return IntRange(L.Width, L.NonNegative && R.NonNegative);
6198  }
6199 
6200  // The result of a remainder can't be larger than the result of
6201  // either side.
6202  case BO_Rem: {
6203  // Don't 'pre-truncate' the operands.
6204  unsigned opWidth = C.getIntWidth(GetExprType(E));
6205  IntRange L = GetExprRange(C, BO->getLHS(), opWidth);
6206  IntRange R = GetExprRange(C, BO->getRHS(), opWidth);
6207 
6208  IntRange meet = IntRange::meet(L, R);
6209  meet.Width = std::min(meet.Width, MaxWidth);
6210  return meet;
6211  }
6212 
6213  // The default behavior is okay for these.
6214  case BO_Mul:
6215  case BO_Add:
6216  case BO_Xor:
6217  case BO_Or:
6218  break;
6219  }
6220 
6221  // The default case is to treat the operation as if it were closed
6222  // on the narrowest type that encompasses both operands.
6223  IntRange L = GetExprRange(C, BO->getLHS(), MaxWidth);
6224  IntRange R = GetExprRange(C, BO->getRHS(), MaxWidth);
6225  return IntRange::join(L, R);
6226  }
6227 
6228  if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
6229  switch (UO->getOpcode()) {
6230  // Boolean-valued operations are white-listed.
6231  case UO_LNot:
6232  return IntRange::forBoolType();
6233 
6234  // Operations with opaque sources are black-listed.
6235  case UO_Deref:
6236  case UO_AddrOf: // should be impossible
6237  return IntRange::forValueOfType(C, GetExprType(E));
6238 
6239  default:
6240  return GetExprRange(C, UO->getSubExpr(), MaxWidth);
6241  }
6242  }
6243 
6244  if (OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E))
6245  return GetExprRange(C, OVE->getSourceExpr(), MaxWidth);
6246 
6247  if (FieldDecl *BitField = E->getSourceBitField())
6248  return IntRange(BitField->getBitWidthValue(C),
6249  BitField->getType()->isUnsignedIntegerOrEnumerationType());
6250 
6251  return IntRange::forValueOfType(C, GetExprType(E));
6252 }
6253 
6254 static IntRange GetExprRange(ASTContext &C, Expr *E) {
6255  return GetExprRange(C, E, C.getIntWidth(GetExprType(E)));
6256 }
6257 
6258 /// Checks whether the given value, which currently has the given
6259 /// source semantics, has the same value when coerced through the
6260 /// target semantics.
6261 static bool IsSameFloatAfterCast(const llvm::APFloat &value,
6262  const llvm::fltSemantics &Src,
6263  const llvm::fltSemantics &Tgt) {
6264  llvm::APFloat truncated = value;
6265 
6266  bool ignored;
6267  truncated.convert(Src, llvm::APFloat::rmNearestTiesToEven, &ignored);
6268  truncated.convert(Tgt, llvm::APFloat::rmNearestTiesToEven, &ignored);
6269 
6270  return truncated.bitwiseIsEqual(value);
6271 }
6272 
6273 /// Checks whether the given value, which currently has the given
6274 /// source semantics, has the same value when coerced through the
6275 /// target semantics.
6276 ///
6277 /// The value might be a vector of floats (or a complex number).
6278 static bool IsSameFloatAfterCast(const APValue &value,
6279  const llvm::fltSemantics &Src,
6280  const llvm::fltSemantics &Tgt) {
6281  if (value.isFloat())
6282  return IsSameFloatAfterCast(value.getFloat(), Src, Tgt);
6283 
6284  if (value.isVector()) {
6285  for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
6286  if (!IsSameFloatAfterCast(value.getVectorElt(i), Src, Tgt))
6287  return false;
6288  return true;
6289  }
6290 
6291  assert(value.isComplexFloat());
6292  return (IsSameFloatAfterCast(value.getComplexFloatReal(), Src, Tgt) &&
6293  IsSameFloatAfterCast(value.getComplexFloatImag(), Src, Tgt));
6294 }
6295 
6296 static void AnalyzeImplicitConversions(Sema &S, Expr *E, SourceLocation CC);
6297 
6298 static bool IsZero(Sema &S, Expr *E) {
6299  // Suppress cases where we are comparing against an enum constant.
6300  if (const DeclRefExpr *DR =
6301  dyn_cast<DeclRefExpr>(E->IgnoreParenImpCasts()))
6302  if (isa<EnumConstantDecl>(DR->getDecl()))
6303  return false;
6304 
6305  // Suppress cases where the '0' value is expanded from a macro.
6306  if (E->getLocStart().isMacroID())
6307  return false;
6308 
6309  llvm::APSInt Value;
6310  return E->isIntegerConstantExpr(Value, S.Context) && Value == 0;
6311 }
6312 
6313 static bool HasEnumType(Expr *E) {
6314  // Strip off implicit integral promotions.
6315  while (ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(E)) {
6316  if (ICE->getCastKind() != CK_IntegralCast &&
6317  ICE->getCastKind() != CK_NoOp)
6318  break;
6319  E = ICE->getSubExpr();
6320  }
6321 
6322  return E->getType()->isEnumeralType();
6323 }
6324 
6325 static void CheckTrivialUnsignedComparison(Sema &S, BinaryOperator *E) {
6326  // Disable warning in template instantiations.
6327  if (!S.ActiveTemplateInstantiations.empty())
6328  return;
6329 
6330  BinaryOperatorKind op = E->getOpcode();
6331  if (E->isValueDependent())
6332  return;
6333 
6334  if (op == BO_LT && IsZero(S, E->getRHS())) {
6335  S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison)
6336  << "< 0" << "false" << HasEnumType(E->getLHS())
6337  << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
6338  } else if (op == BO_GE && IsZero(S, E->getRHS())) {
6339  S.Diag(E->getOperatorLoc(), diag::warn_lunsigned_always_true_comparison)
6340  << ">= 0" << "true" << HasEnumType(E->getLHS())
6341  << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
6342  } else if (op == BO_GT && IsZero(S, E->getLHS())) {
6343  S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison)
6344  << "0 >" << "false" << HasEnumType(E->getRHS())
6345  << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
6346  } else if (op == BO_LE && IsZero(S, E->getLHS())) {
6347  S.Diag(E->getOperatorLoc(), diag::warn_runsigned_always_true_comparison)
6348  << "0 <=" << "true" << HasEnumType(E->getRHS())
6349  << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
6350  }
6351 }
6352 
6353 static void DiagnoseOutOfRangeComparison(Sema &S, BinaryOperator *E,
6354  Expr *Constant, Expr *Other,
6355  llvm::APSInt Value,
6356  bool RhsConstant) {
6357  // Disable warning in template instantiations.
6358  if (!S.ActiveTemplateInstantiations.empty())
6359  return;
6360 
6361  // TODO: Investigate using GetExprRange() to get tighter bounds
6362  // on the bit ranges.
6363  QualType OtherT = Other->getType();
6364  if (const auto *AT = OtherT->getAs<AtomicType>())
6365  OtherT = AT->getValueType();
6366  IntRange OtherRange = IntRange::forValueOfType(S.Context, OtherT);
6367  unsigned OtherWidth = OtherRange.Width;
6368 
6369  bool OtherIsBooleanType = Other->isKnownToHaveBooleanValue();
6370 
6371  // 0 values are handled later by CheckTrivialUnsignedComparison().
6372  if ((Value == 0) && (!OtherIsBooleanType))
6373  return;
6374 
6375  BinaryOperatorKind op = E->getOpcode();
6376  bool IsTrue = true;
6377 
6378  // Used for diagnostic printout.
6379  enum {
6380  LiteralConstant = 0,
6381  CXXBoolLiteralTrue,
6382  CXXBoolLiteralFalse
6383  } LiteralOrBoolConstant = LiteralConstant;
6384 
6385  if (!OtherIsBooleanType) {
6386  QualType ConstantT = Constant->getType();
6387  QualType CommonT = E->getLHS()->getType();
6388 
6389  if (S.Context.hasSameUnqualifiedType(OtherT, ConstantT))
6390  return;
6391  assert((OtherT->isIntegerType() && ConstantT->isIntegerType()) &&
6392  "comparison with non-integer type");
6393 
6394  bool ConstantSigned = ConstantT->isSignedIntegerType();
6395  bool CommonSigned = CommonT->isSignedIntegerType();
6396 
6397  bool EqualityOnly = false;
6398 
6399  if (CommonSigned) {
6400  // The common type is signed, therefore no signed to unsigned conversion.
6401  if (!OtherRange.NonNegative) {
6402  // Check that the constant is representable in type OtherT.
6403  if (ConstantSigned) {
6404  if (OtherWidth >= Value.getMinSignedBits())
6405  return;
6406  } else { // !ConstantSigned
6407  if (OtherWidth >= Value.getActiveBits() + 1)
6408  return;
6409  }
6410  } else { // !OtherSigned
6411  // Check that the constant is representable in type OtherT.
6412  // Negative values are out of range.
6413  if (ConstantSigned) {
6414  if (Value.isNonNegative() && OtherWidth >= Value.getActiveBits())
6415  return;
6416  } else { // !ConstantSigned
6417  if (OtherWidth >= Value.getActiveBits())
6418  return;
6419  }
6420  }
6421  } else { // !CommonSigned
6422  if (OtherRange.NonNegative) {
6423  if (OtherWidth >= Value.getActiveBits())
6424  return;
6425  } else { // OtherSigned
6426  assert(!ConstantSigned &&
6427  "Two signed types converted to unsigned types.");
6428  // Check to see if the constant is representable in OtherT.
6429  if (OtherWidth > Value.getActiveBits())
6430  return;
6431  // Check to see if the constant is equivalent to a negative value
6432  // cast to CommonT.
6433  if (S.Context.getIntWidth(ConstantT) ==
6434  S.Context.getIntWidth(CommonT) &&
6435  Value.isNegative() && Value.getMinSignedBits() <= OtherWidth)
6436  return;
6437  // The constant value rests between values that OtherT can represent
6438  // after conversion. Relational comparison still works, but equality
6439  // comparisons will be tautological.
6440  EqualityOnly = true;
6441  }
6442  }
6443 
6444  bool PositiveConstant = !ConstantSigned || Value.isNonNegative();
6445 
6446  if (op == BO_EQ || op == BO_NE) {
6447  IsTrue = op == BO_NE;
6448  } else if (EqualityOnly) {
6449  return;
6450  } else if (RhsConstant) {
6451  if (op == BO_GT || op == BO_GE)
6452  IsTrue = !PositiveConstant;
6453  else // op == BO_LT || op == BO_LE
6454  IsTrue = PositiveConstant;
6455  } else {
6456  if (op == BO_LT || op == BO_LE)
6457  IsTrue = !PositiveConstant;
6458  else // op == BO_GT || op == BO_GE
6459  IsTrue = PositiveConstant;
6460  }
6461  } else {
6462  // Other isKnownToHaveBooleanValue
6463  enum CompareBoolWithConstantResult { AFals, ATrue, Unkwn };
6464  enum ConstantValue { LT_Zero, Zero, One, GT_One, SizeOfConstVal };
6465  enum ConstantSide { Lhs, Rhs, SizeOfConstSides };
6466 
6467  static const struct LinkedConditions {
6468  CompareBoolWithConstantResult BO_LT_OP[SizeOfConstSides][SizeOfConstVal];
6469  CompareBoolWithConstantResult BO_GT_OP[SizeOfConstSides][SizeOfConstVal];
6470  CompareBoolWithConstantResult BO_LE_OP[SizeOfConstSides][SizeOfConstVal];
6471  CompareBoolWithConstantResult BO_GE_OP[SizeOfConstSides][SizeOfConstVal];
6472  CompareBoolWithConstantResult BO_EQ_OP[SizeOfConstSides][SizeOfConstVal];
6473  CompareBoolWithConstantResult BO_NE_OP[SizeOfConstSides][SizeOfConstVal];
6474 
6475  } TruthTable = {
6476  // Constant on LHS. | Constant on RHS. |
6477  // LT_Zero| Zero | One |GT_One| LT_Zero| Zero | One |GT_One|
6478  { { ATrue, Unkwn, AFals, AFals }, { AFals, AFals, Unkwn, ATrue } },
6479  { { AFals, AFals, Unkwn, ATrue }, { ATrue, Unkwn, AFals, AFals } },
6480  { { ATrue, ATrue, Unkwn, AFals }, { AFals, Unkwn, ATrue, ATrue } },
6481  { { AFals, Unkwn, ATrue, ATrue }, { ATrue, ATrue, Unkwn, AFals } },
6482  { { AFals, Unkwn, Unkwn, AFals }, { AFals, Unkwn, Unkwn, AFals } },
6483  { { ATrue, Unkwn, Unkwn, ATrue }, { ATrue, Unkwn, Unkwn, ATrue } }
6484  };
6485 
6486  bool ConstantIsBoolLiteral = isa<CXXBoolLiteralExpr>(Constant);
6487 
6488  enum ConstantValue ConstVal = Zero;
6489  if (Value.isUnsigned() || Value.isNonNegative()) {
6490  if (Value == 0) {
6491  LiteralOrBoolConstant =
6492  ConstantIsBoolLiteral ? CXXBoolLiteralFalse : LiteralConstant;
6493  ConstVal = Zero;
6494  } else if (Value == 1) {
6495  LiteralOrBoolConstant =
6496  ConstantIsBoolLiteral ? CXXBoolLiteralTrue : LiteralConstant;
6497  ConstVal = One;
6498  } else {
6499  LiteralOrBoolConstant = LiteralConstant;
6500  ConstVal = GT_One;
6501  }
6502  } else {
6503  ConstVal = LT_Zero;
6504  }
6505 
6506  CompareBoolWithConstantResult CmpRes;
6507 
6508  switch (op) {
6509  case BO_LT:
6510  CmpRes = TruthTable.BO_LT_OP[RhsConstant][ConstVal];
6511  break;
6512  case BO_GT:
6513  CmpRes = TruthTable.BO_GT_OP[RhsConstant][ConstVal];
6514  break;
6515  case BO_LE:
6516  CmpRes = TruthTable.BO_LE_OP[RhsConstant][ConstVal];
6517  break;
6518  case BO_GE:
6519  CmpRes = TruthTable.BO_GE_OP[RhsConstant][ConstVal];
6520  break;
6521  case BO_EQ:
6522  CmpRes = TruthTable.BO_EQ_OP[RhsConstant][ConstVal];
6523  break;
6524  case BO_NE:
6525  CmpRes = TruthTable.BO_NE_OP[RhsConstant][ConstVal];
6526  break;
6527  default:
6528  CmpRes = Unkwn;
6529  break;
6530  }
6531 
6532  if (CmpRes == AFals) {
6533  IsTrue = false;
6534  } else if (CmpRes == ATrue) {
6535  IsTrue = true;
6536  } else {
6537  return;
6538  }
6539  }
6540 
6541  // If this is a comparison to an enum constant, include that
6542  // constant in the diagnostic.
6543  const EnumConstantDecl *ED = nullptr;
6544  if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Constant))
6545  ED = dyn_cast<EnumConstantDecl>(DR->getDecl());
6546 
6547  SmallString<64> PrettySourceValue;
6548  llvm::raw_svector_ostream OS(PrettySourceValue);
6549  if (ED)
6550  OS << '\'' << *ED << "' (" << Value << ")";
6551  else
6552  OS << Value;
6553 
6555  E->getOperatorLoc(), E,
6556  S.PDiag(diag::warn_out_of_range_compare)
6557  << OS.str() << LiteralOrBoolConstant
6558  << OtherT << (OtherIsBooleanType && !OtherT->isBooleanType()) << IsTrue
6559  << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange());
6560 }
6561 
6562 /// Analyze the operands of the given comparison. Implements the
6563 /// fallback case from AnalyzeComparison.
6564 static void AnalyzeImpConvsInComparison(Sema &S, BinaryOperator *E) {
6565  AnalyzeImplicitConversions(S, E->getLHS(), E->getOperatorLoc());
6566  AnalyzeImplicitConversions(S, E->getRHS(), E->getOperatorLoc());
6567 }
6568 
6569 /// \brief Implements -Wsign-compare.
6570 ///
6571 /// \param E the binary operator to check for warnings
6572 static void AnalyzeComparison(Sema &S, BinaryOperator *E) {
6573  // The type the comparison is being performed in.
6574  QualType T = E->getLHS()->getType();
6575 
6576  // Only analyze comparison operators where both sides have been converted to
6577  // the same type.
6578  if (!S.Context.hasSameUnqualifiedType(T, E->getRHS()->getType()))
6579  return AnalyzeImpConvsInComparison(S, E);
6580 
6581  // Don't analyze value-dependent comparisons directly.
6582  if (E->isValueDependent())
6583  return AnalyzeImpConvsInComparison(S, E);
6584 
6585  Expr *LHS = E->getLHS()->IgnoreParenImpCasts();
6586  Expr *RHS = E->getRHS()->IgnoreParenImpCasts();
6587 
6588  bool IsComparisonConstant = false;
6589 
6590  // Check whether an integer constant comparison results in a value
6591  // of 'true' or 'false'.
6592  if (T->isIntegralType(S.Context)) {
6593  llvm::APSInt RHSValue;
6594  bool IsRHSIntegralLiteral =
6595  RHS->isIntegerConstantExpr(RHSValue, S.Context);
6596  llvm::APSInt LHSValue;
6597  bool IsLHSIntegralLiteral =
6598  LHS->isIntegerConstantExpr(LHSValue, S.Context);
6599  if (IsRHSIntegralLiteral && !IsLHSIntegralLiteral)
6600  DiagnoseOutOfRangeComparison(S, E, RHS, LHS, RHSValue, true);
6601  else if (!IsRHSIntegralLiteral && IsLHSIntegralLiteral)
6602  DiagnoseOutOfRangeComparison(S, E, LHS, RHS, LHSValue, false);
6603  else
6604  IsComparisonConstant =
6605  (IsRHSIntegralLiteral && IsLHSIntegralLiteral);
6606  } else if (!T->hasUnsignedIntegerRepresentation())
6607  IsComparisonConstant = E->isIntegerConstantExpr(S.Context);
6608 
6609  // We don't do anything special if this isn't an unsigned integral
6610  // comparison: we're only interested in integral comparisons, and
6611  // signed comparisons only happen in cases we don't care to warn about.
6612  //
6613  // We also don't care about value-dependent expressions or expressions
6614  // whose result is a constant.
6615  if (!T->hasUnsignedIntegerRepresentation() || IsComparisonConstant)
6616  return AnalyzeImpConvsInComparison(S, E);
6617 
6618  // Check to see if one of the (unmodified) operands is of different
6619  // signedness.
6620  Expr *signedOperand, *unsignedOperand;
6621  if (LHS->getType()->hasSignedIntegerRepresentation()) {
6622  assert(!RHS->getType()->hasSignedIntegerRepresentation() &&
6623  "unsigned comparison between two signed integer expressions?");
6624  signedOperand = LHS;
6625  unsignedOperand = RHS;
6626  } else if (RHS->getType()->hasSignedIntegerRepresentation()) {
6627  signedOperand = RHS;
6628  unsignedOperand = LHS;
6629  } else {
6630  CheckTrivialUnsignedComparison(S, E);
6631  return AnalyzeImpConvsInComparison(S, E);
6632  }
6633 
6634  // Otherwise, calculate the effective range of the signed operand.
6635  IntRange signedRange = GetExprRange(S.Context, signedOperand);
6636 
6637  // Go ahead and analyze implicit conversions in the operands. Note
6638  // that we skip the implicit conversions on both sides.
6639  AnalyzeImplicitConversions(S, LHS, E->getOperatorLoc());
6640  AnalyzeImplicitConversions(S, RHS, E->getOperatorLoc());
6641 
6642  // If the signed range is non-negative, -Wsign-compare won't fire,
6643  // but we should still check for comparisons which are always true
6644  // or false.
6645  if (signedRange.NonNegative)
6646  return CheckTrivialUnsignedComparison(S, E);
6647 
6648  // For (in)equality comparisons, if the unsigned operand is a
6649  // constant which cannot collide with a overflowed signed operand,
6650  // then reinterpreting the signed operand as unsigned will not
6651  // change the result of the comparison.
6652  if (E->isEqualityOp()) {
6653  unsigned comparisonWidth = S.Context.getIntWidth(T);
6654  IntRange unsignedRange = GetExprRange(S.Context, unsignedOperand);
6655 
6656  // We should never be unable to prove that the unsigned operand is
6657  // non-negative.
6658  assert(unsignedRange.NonNegative && "unsigned range includes negative?");
6659 
6660  if (unsignedRange.Width < comparisonWidth)
6661  return;
6662  }
6663 
6665  S.PDiag(diag::warn_mixed_sign_comparison)
6666  << LHS->getType() << RHS->getType()
6667  << LHS->getSourceRange() << RHS->getSourceRange());
6668 }
6669 
6670 /// Analyzes an attempt to assign the given value to a bitfield.
6671 ///
6672 /// Returns true if there was something fishy about the attempt.
6673 static bool AnalyzeBitFieldAssignment(Sema &S, FieldDecl *Bitfield, Expr *Init,
6674  SourceLocation InitLoc) {
6675  assert(Bitfield->isBitField());
6676  if (Bitfield->isInvalidDecl())
6677  return false;
6678 
6679  // White-list bool bitfields.
6680  if (Bitfield->getType()->isBooleanType())
6681  return false;
6682 
6683  // Ignore value- or type-dependent expressions.
6684  if (Bitfield->getBitWidth()->isValueDependent() ||
6685  Bitfield->getBitWidth()->isTypeDependent() ||
6686  Init->isValueDependent() ||
6687  Init->isTypeDependent())
6688  return false;
6689 
6690  Expr *OriginalInit = Init->IgnoreParenImpCasts();
6691 
6692  llvm::APSInt Value;
6693  if (!OriginalInit->EvaluateAsInt(Value, S.Context, Expr::SE_AllowSideEffects))
6694  return false;
6695 
6696  unsigned OriginalWidth = Value.getBitWidth();
6697  unsigned FieldWidth = Bitfield->getBitWidthValue(S.Context);
6698 
6699  if (OriginalWidth <= FieldWidth)
6700  return false;
6701 
6702  // Compute the value which the bitfield will contain.
6703  llvm::APSInt TruncatedValue = Value.trunc(FieldWidth);
6704  TruncatedValue.setIsSigned(Bitfield->getType()->isSignedIntegerType());
6705 
6706  // Check whether the stored value is equal to the original value.
6707  TruncatedValue = TruncatedValue.extend(OriginalWidth);
6708  if (llvm::APSInt::isSameValue(Value, TruncatedValue))
6709  return false;
6710 
6711  // Special-case bitfields of width 1: booleans are naturally 0/1, and
6712  // therefore don't strictly fit into a signed bitfield of width 1.
6713  if (FieldWidth == 1 && Value == 1)
6714  return false;
6715 
6716  std::string PrettyValue = Value.toString(10);
6717  std::string PrettyTrunc = TruncatedValue.toString(10);
6718 
6719  S.Diag(InitLoc, diag::warn_impcast_bitfield_precision_constant)
6720  << PrettyValue << PrettyTrunc << OriginalInit->getType()
6721  << Init->getSourceRange();
6722 
6723  return true;
6724 }
6725 
6726 /// Analyze the given simple or compound assignment for warning-worthy
6727 /// operations.
6728 static void AnalyzeAssignment(Sema &S, BinaryOperator *E) {
6729  // Just recurse on the LHS.
6730  AnalyzeImplicitConversions(S, E->getLHS(), E->getOperatorLoc());
6731 
6732  // We want to recurse on the RHS as normal unless we're assigning to
6733  // a bitfield.
6734  if (FieldDecl *Bitfield = E->getLHS()->getSourceBitField()) {
6735  if (AnalyzeBitFieldAssignment(S, Bitfield, E->getRHS(),
6736  E->getOperatorLoc())) {
6737  // Recurse, ignoring any implicit conversions on the RHS.
6738  return AnalyzeImplicitConversions(S, E->getRHS()->IgnoreParenImpCasts(),
6739  E->getOperatorLoc());
6740  }
6741  }
6742 
6743  AnalyzeImplicitConversions(S, E->getRHS(), E->getOperatorLoc());
6744 }
6745 
6746 /// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
6747 static void DiagnoseImpCast(Sema &S, Expr *E, QualType SourceType, QualType T,
6748  SourceLocation CContext, unsigned diag,
6749  bool pruneControlFlow = false) {
6750  if (pruneControlFlow) {
6751  S.DiagRuntimeBehavior(E->getExprLoc(), E,
6752  S.PDiag(diag)
6753  << SourceType << T << E->getSourceRange()
6754  << SourceRange(CContext));
6755  return;
6756  }
6757  S.Diag(E->getExprLoc(), diag)
6758  << SourceType << T << E->getSourceRange() << SourceRange(CContext);
6759 }
6760 
6761 /// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
6762 static void DiagnoseImpCast(Sema &S, Expr *E, QualType T,
6763  SourceLocation CContext, unsigned diag,
6764  bool pruneControlFlow = false) {
6765  DiagnoseImpCast(S, E, E->getType(), T, CContext, diag, pruneControlFlow);
6766 }
6767 
6768 /// Diagnose an implicit cast from a literal expression. Does not warn when the
6769 /// cast wouldn't lose information.
6770 void DiagnoseFloatingLiteralImpCast(Sema &S, FloatingLiteral *FL, QualType T,
6771  SourceLocation CContext) {
6772  // Try to convert the literal exactly to an integer. If we can, don't warn.
6773  bool isExact = false;
6774  const llvm::APFloat &Value = FL->getValue();
6775  llvm::APSInt IntegerValue(S.Context.getIntWidth(T),
6777  if (Value.convertToInteger(IntegerValue,
6778  llvm::APFloat::rmTowardZero, &isExact)
6779  == llvm::APFloat::opOK && isExact)
6780  return;
6781 
6782  // FIXME: Force the precision of the source value down so we don't print
6783  // digits which are usually useless (we don't really care here if we
6784  // truncate a digit by accident in edge cases). Ideally, APFloat::toString
6785  // would automatically print the shortest representation, but it's a bit
6786  // tricky to implement.
6787  SmallString<16> PrettySourceValue;
6788  unsigned precision = llvm::APFloat::semanticsPrecision(Value.getSemantics());
6789  precision = (precision * 59 + 195) / 196;
6790  Value.toString(PrettySourceValue, precision);
6791 
6792  SmallString<16> PrettyTargetValue;
6793  if (T->isSpecificBuiltinType(BuiltinType::Bool))
6794  PrettyTargetValue = IntegerValue == 0 ? "false" : "true";
6795  else
6796  IntegerValue.toString(PrettyTargetValue);
6797 
6798  S.Diag(FL->getExprLoc(), diag::warn_impcast_literal_float_to_integer)
6799  << FL->getType() << T.getUnqualifiedType() << PrettySourceValue
6800  << PrettyTargetValue << FL->getSourceRange() << SourceRange(CContext);
6801 }
6802 
6803 std::string PrettyPrintInRange(const llvm::APSInt &Value, IntRange Range) {
6804  if (!Range.Width) return "0";
6805 
6806  llvm::APSInt ValueInRange = Value;
6807  ValueInRange.setIsSigned(!Range.NonNegative);
6808  ValueInRange = ValueInRange.trunc(Range.Width);
6809  return ValueInRange.toString(10);
6810 }
6811 
6812 static bool IsImplicitBoolFloatConversion(Sema &S, Expr *Ex, bool ToBool) {
6813  if (!isa<ImplicitCastExpr>(Ex))
6814  return false;
6815 
6816  Expr *InnerE = Ex->IgnoreParenImpCasts();
6817  const Type *Target = S.Context.getCanonicalType(Ex->getType()).getTypePtr();
6818  const Type *Source =
6819  S.Context.getCanonicalType(InnerE->getType()).getTypePtr();
6820  if (Target->isDependentType())
6821  return false;
6822 
6823  const BuiltinType *FloatCandidateBT =
6824  dyn_cast<BuiltinType>(ToBool ? Source : Target);
6825  const Type *BoolCandidateType = ToBool ? Target : Source;
6826 
6827  return (BoolCandidateType->isSpecificBuiltinType(BuiltinType::Bool) &&
6828  FloatCandidateBT && (FloatCandidateBT->isFloatingPoint()));
6829 }
6830 
6831 void CheckImplicitArgumentConversions(Sema &S, CallExpr *TheCall,
6832  SourceLocation CC) {
6833  unsigned NumArgs = TheCall->getNumArgs();
6834  for (unsigned i = 0; i < NumArgs; ++i) {
6835  Expr *CurrA = TheCall->getArg(i);
6836  if (!IsImplicitBoolFloatConversion(S, CurrA, true))
6837  continue;
6838 
6839  bool IsSwapped = ((i > 0) &&
6840  IsImplicitBoolFloatConversion(S, TheCall->getArg(i - 1), false));
6841  IsSwapped |= ((i < (NumArgs - 1)) &&
6842  IsImplicitBoolFloatConversion(S, TheCall->getArg(i + 1), false));
6843  if (IsSwapped) {
6844  // Warn on this floating-point to bool conversion.
6845  DiagnoseImpCast(S, CurrA->IgnoreParenImpCasts(),
6846  CurrA->getType(), CC,
6847  diag::warn_impcast_floating_point_to_bool);
6848  }
6849  }
6850 }
6851 
6852 static void DiagnoseNullConversion(Sema &S, Expr *E, QualType T,
6853  SourceLocation CC) {
6854  if (S.Diags.isIgnored(diag::warn_impcast_null_pointer_to_integer,
6855  E->getExprLoc()))
6856  return;
6857 
6858  // Check for NULL (GNUNull) or nullptr (CXX11_nullptr).
6859  const Expr::NullPointerConstantKind NullKind =
6861  if (NullKind != Expr::NPCK_GNUNull && NullKind != Expr::NPCK_CXX11_nullptr)
6862  return;
6863 
6864  // Return if target type is a safe conversion.
6865  if (T->isAnyPointerType() || T->isBlockPointerType() ||
6866  T->isMemberPointerType() || !T->isScalarType() || T->isNullPtrType())
6867  return;
6868 
6869  SourceLocation Loc = E->getSourceRange().getBegin();
6870 
6871  // __null is usually wrapped in a macro. Go up a macro if that is the case.
6872  if (NullKind == Expr::NPCK_GNUNull) {
6873  if (Loc.isMacroID())
6874  Loc = S.SourceMgr.getImmediateExpansionRange(Loc).first;
6875  }
6876 
6877  // Only warn if the null and context location are in the same macro expansion.
6878  if (S.SourceMgr.getFileID(Loc) != S.SourceMgr.getFileID(CC))
6879  return;
6880 
6881  S.Diag(Loc, diag::warn_impcast_null_pointer_to_integer)
6882  << (NullKind == Expr::NPCK_CXX11_nullptr) << T << clang::SourceRange(CC)
6884  S.getFixItZeroLiteralForType(T, Loc));
6885 }
6886 
6887 static void checkObjCArrayLiteral(Sema &S, QualType TargetType,
6888  ObjCArrayLiteral *ArrayLiteral);
6889 static void checkObjCDictionaryLiteral(Sema &S, QualType TargetType,
6890  ObjCDictionaryLiteral *DictionaryLiteral);
6891 
6892 /// Check a single element within a collection literal against the
6893 /// target element type.
6894 static void checkObjCCollectionLiteralElement(Sema &S,
6895  QualType TargetElementType,
6896  Expr *Element,
6897  unsigned ElementKind) {
6898  // Skip a bitcast to 'id' or qualified 'id'.
6899  if (auto ICE = dyn_cast<ImplicitCastExpr>(Element)) {
6900  if (ICE->getCastKind() == CK_BitCast &&
6901  ICE->getSubExpr()->getType()->getAs<ObjCObjectPointerType>())
6902  Element = ICE->getSubExpr();
6903  }
6904 
6905  QualType ElementType = Element->getType();
6906  ExprResult ElementResult(Element);
6907  if (ElementType->getAs<ObjCObjectPointerType>() &&
6908  S.CheckSingleAssignmentConstraints(TargetElementType,
6909  ElementResult,
6910  false, false)
6911  != Sema::Compatible) {
6912  S.Diag(Element->getLocStart(),
6913  diag::warn_objc_collection_literal_element)
6914  << ElementType << ElementKind << TargetElementType
6915  << Element->getSourceRange();
6916  }
6917 
6918  if (auto ArrayLiteral = dyn_cast<ObjCArrayLiteral>(Element))
6919  checkObjCArrayLiteral(S, TargetElementType, ArrayLiteral);
6920  else if (auto DictionaryLiteral = dyn_cast<ObjCDictionaryLiteral>(Element))
6921  checkObjCDictionaryLiteral(S, TargetElementType, DictionaryLiteral);
6922 }
6923 
6924 /// Check an Objective-C array literal being converted to the given
6925 /// target type.
6926 static void checkObjCArrayLiteral(Sema &S, QualType TargetType,
6927  ObjCArrayLiteral *ArrayLiteral) {
6928  if (!S.NSArrayDecl)
6929  return;
6930 
6931  const auto *TargetObjCPtr = TargetType->getAs<ObjCObjectPointerType>();
6932  if (!TargetObjCPtr)
6933  return;
6934 
6935  if (TargetObjCPtr->isUnspecialized() ||
6936  TargetObjCPtr->getInterfaceDecl()->getCanonicalDecl()
6937  != S.NSArrayDecl->getCanonicalDecl())
6938  return;
6939 
6940  auto TypeArgs = TargetObjCPtr->getTypeArgs();
6941  if (TypeArgs.size() != 1)
6942  return;
6943 
6944  QualType TargetElementType = TypeArgs[0];
6945  for (unsigned I = 0, N = ArrayLiteral->getNumElements(); I != N; ++I) {
6946  checkObjCCollectionLiteralElement(S, TargetElementType,
6947  ArrayLiteral->getElement(I),
6948  0);
6949  }
6950 }
6951 
6952 /// Check an Objective-C dictionary literal being converted to the given
6953 /// target type.
6954 static void checkObjCDictionaryLiteral(
6955  Sema &S, QualType TargetType,
6956  ObjCDictionaryLiteral *DictionaryLiteral) {
6957  if (!S.NSDictionaryDecl)
6958  return;
6959 
6960  const auto *TargetObjCPtr = TargetType->getAs<ObjCObjectPointerType>();
6961  if (!TargetObjCPtr)
6962  return;
6963 
6964  if (TargetObjCPtr->isUnspecialized() ||
6965  TargetObjCPtr->getInterfaceDecl()->getCanonicalDecl()
6967  return;
6968 
6969  auto TypeArgs = TargetObjCPtr->getTypeArgs();
6970  if (TypeArgs.size() != 2)
6971  return;
6972 
6973  QualType TargetKeyType = TypeArgs[0];
6974  QualType TargetObjectType = TypeArgs[1];
6975  for (unsigned I = 0, N = DictionaryLiteral->getNumElements(); I != N; ++I) {
6976  auto Element = DictionaryLiteral->getKeyValueElement(I);
6977  checkObjCCollectionLiteralElement(S, TargetKeyType, Element.Key, 1);
6978  checkObjCCollectionLiteralElement(S, TargetObjectType, Element.Value, 2);
6979  }
6980 }
6981 
6982 void CheckImplicitConversion(Sema &S, Expr *E, QualType T,
6983  SourceLocation CC, bool *ICContext = nullptr) {
6984  if (E->isTypeDependent() || E->isValueDependent()) return;
6985 
6986  const Type *Source = S.Context.getCanonicalType(E->getType()).getTypePtr();
6987  const Type *Target = S.Context.getCanonicalType(T).getTypePtr();
6988  if (Source == Target) return;
6989  if (Target->isDependentType()) return;
6990 
6991  // If the conversion context location is invalid don't complain. We also
6992  // don't want to emit a warning if the issue occurs from the expansion of
6993  // a system macro. The problem is that 'getSpellingLoc()' is slow, so we
6994  // delay this check as long as possible. Once we detect we are in that
6995  // scenario, we just return.
6996  if (CC.isInvalid())
6997  return;
6998 
6999  // Diagnose implicit casts to bool.
7000  if (Target->isSpecificBuiltinType(BuiltinType::Bool)) {
7001  if (isa<StringLiteral>(E))
7002  // Warn on string literal to bool. Checks for string literals in logical
7003  // and expressions, for instance, assert(0 && "error here"), are
7004  // prevented by a check in AnalyzeImplicitConversions().
7005  return DiagnoseImpCast(S, E, T, CC,
7006  diag::warn_impcast_string_literal_to_bool);
7007  if (isa<ObjCStringLiteral>(E) || isa<ObjCArrayLiteral>(E) ||
7008  isa<ObjCDictionaryLiteral>(E) || isa<ObjCBoxedExpr>(E)) {
7009  // This covers the literal expressions that evaluate to Objective-C
7010  // objects.
7011  return DiagnoseImpCast(S, E, T, CC,
7012  diag::warn_impcast_objective_c_literal_to_bool);
7013  }
7014  if (Source->isPointerType() || Source->canDecayToPointerType()) {
7015  // Warn on pointer to bool conversion that is always true.
7016  S.DiagnoseAlwaysNonNullPointer(E, Expr::NPCK_NotNull, /*IsEqual*/ false,
7017  SourceRange(CC));
7018  }
7019  }
7020 
7021  // Check implicit casts from Objective-C collection literals to specialized
7022  // collection types, e.g., NSArray<NSString *> *.
7023  if (auto *ArrayLiteral = dyn_cast<ObjCArrayLiteral>(E))
7024  checkObjCArrayLiteral(S, QualType(Target, 0), ArrayLiteral);
7025  else if (auto *DictionaryLiteral = dyn_cast<ObjCDictionaryLiteral>(E))
7026  checkObjCDictionaryLiteral(S, QualType(Target, 0), DictionaryLiteral);
7027 
7028  // Strip vector types.
7029  if (isa<VectorType>(Source)) {
7030  if (!isa<VectorType>(Target)) {
7031  if (S.SourceMgr.isInSystemMacro(CC))
7032  return;
7033  return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_vector_scalar);
7034  }
7035 
7036  // If the vector cast is cast between two vectors of the same size, it is
7037  // a bitcast, not a conversion.
7038  if (S.Context.getTypeSize(Source) == S.Context.getTypeSize(Target))
7039  return;
7040 
7041  Source = cast<VectorType>(Source)->getElementType().getTypePtr();
7042  Target = cast<VectorType>(Target)->getElementType().getTypePtr();
7043  }
7044  if (auto VecTy = dyn_cast<VectorType>(Target))
7045  Target = VecTy->getElementType().getTypePtr();
7046 
7047  // Strip complex types.
7048  if (isa<ComplexType>(Source)) {
7049  if (!isa<ComplexType>(Target)) {
7050  if (S.SourceMgr.isInSystemMacro(CC))
7051  return;
7052 
7053  return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_complex_scalar);
7054  }
7055 
7056  Source = cast<ComplexType>(Source)->getElementType().getTypePtr();
7057  Target = cast<ComplexType>(Target)->getElementType().getTypePtr();
7058  }
7059 
7060  const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Source);
7061  const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Target);
7062 
7063  // If the source is floating point...
7064  if (SourceBT && SourceBT->isFloatingPoint()) {
7065  // ...and the target is floating point...
7066  if (TargetBT && TargetBT->isFloatingPoint()) {
7067  // ...then warn if we're dropping FP rank.
7068 
7069  // Builtin FP kinds are ordered by increasing FP rank.
7070  if (SourceBT->getKind() > TargetBT->getKind()) {
7071  // Don't warn about float constants that are precisely
7072  // representable in the target type.
7073  Expr::EvalResult result;
7074  if (E->EvaluateAsRValue(result, S.Context)) {
7075  // Value might be a float, a float vector, or a float complex.
7076  if (IsSameFloatAfterCast(result.Val,
7077  S.Context.getFloatTypeSemantics(QualType(TargetBT, 0)),
7078  S.Context.getFloatTypeSemantics(QualType(SourceBT, 0))))
7079  return;
7080  }
7081 
7082  if (S.SourceMgr.isInSystemMacro(CC))
7083  return;
7084 
7085  DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_float_precision);
7086  }
7087  return;
7088  }
7089 
7090  // If the target is integral, always warn.
7091  if (TargetBT && TargetBT->isInteger()) {
7092  if (S.SourceMgr.isInSystemMacro(CC))
7093  return;
7094 
7095  Expr *InnerE = E->IgnoreParenImpCasts();
7096  // We also want to warn on, e.g., "int i = -1.234"
7097  if (UnaryOperator *UOp = dyn_cast<UnaryOperator>(InnerE))
7098  if (UOp->getOpcode() == UO_Minus || UOp->getOpcode() == UO_Plus)
7099  InnerE = UOp->getSubExpr()->IgnoreParenImpCasts();
7100 
7101  if (FloatingLiteral *FL = dyn_cast<FloatingLiteral>(InnerE)) {
7102  DiagnoseFloatingLiteralImpCast(S, FL, T, CC);
7103  } else {
7104  DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_float_integer);
7105  }
7106  }
7107 
7108  // If the target is bool, warn if expr is a function or method call.
7109  if (Target->isSpecificBuiltinType(BuiltinType::Bool) &&
7110  isa<CallExpr>(E)) {
7111  // Check last argument of function call to see if it is an
7112  // implicit cast from a type matching the type the result
7113  // is being cast to.
7114  CallExpr *CEx = cast<CallExpr>(E);
7115  unsigned NumArgs = CEx->getNumArgs();
7116  if (NumArgs > 0) {
7117  Expr *LastA = CEx->getArg(NumArgs - 1);
7118  Expr *InnerE = LastA->IgnoreParenImpCasts();
7119  const Type *InnerType =
7120  S.Context.getCanonicalType(InnerE->getType()).getTypePtr();
7121  if (isa<ImplicitCastExpr>(LastA) && (InnerType == Target)) {
7122  // Warn on this floating-point to bool conversion
7123  DiagnoseImpCast(S, E, T, CC,
7124  diag::warn_impcast_floating_point_to_bool);
7125  }
7126  }
7127  }
7128  return;
7129  }
7130 
7131  DiagnoseNullConversion(S, E, T, CC);
7132 
7133  if (!Source->isIntegerType() || !Target->isIntegerType())
7134  return;
7135 
7136  // TODO: remove this early return once the false positives for constant->bool
7137  // in templates, macros, etc, are reduced or removed.
7138  if (Target->isSpecificBuiltinType(BuiltinType::Bool))
7139  return;
7140 
7141  IntRange SourceRange = GetExprRange(S.Context, E);
7142  IntRange TargetRange = IntRange::forTargetOfCanonicalType(S.Context, Target);
7143 
7144  if (SourceRange.Width > TargetRange.Width) {
7145  // If the source is a constant, use a default-on diagnostic.
7146  // TODO: this should happen for bitfield stores, too.
7147  llvm::APSInt Value(32);
7148  if (E->isIntegerConstantExpr(Value, S.Context)) {
7149  if (S.SourceMgr.isInSystemMacro(CC))
7150  return;
7151 
7152  std::string PrettySourceValue = Value.toString(10);
7153  std::string PrettyTargetValue = PrettyPrintInRange(Value, TargetRange);
7154 
7155  S.DiagRuntimeBehavior(E->getExprLoc(), E,
7156  S.PDiag(diag::warn_impcast_integer_precision_constant)
7157  << PrettySourceValue << PrettyTargetValue
7158  << E->getType() << T << E->getSourceRange()
7159  << clang::SourceRange(CC));
7160  return;
7161  }
7162 
7163  // People want to build with -Wshorten-64-to-32 and not -Wconversion.
7164  if (S.SourceMgr.isInSystemMacro(CC))
7165  return;
7166 
7167  if (TargetRange.Width == 32 && S.Context.getIntWidth(E->getType()) == 64)
7168  return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_integer_64_32,
7169  /* pruneControlFlow */ true);
7170  return DiagnoseImpCast(S, E, T, CC, diag::warn_impcast_integer_precision);
7171  }
7172 
7173  if ((TargetRange.NonNegative && !SourceRange.NonNegative) ||
7174  (!TargetRange.NonNegative && SourceRange.NonNegative &&
7175  SourceRange.Width == TargetRange.Width)) {
7176 
7177  if (S.SourceMgr.isInSystemMacro(CC))
7178  return;
7179 
7180  unsigned DiagID = diag::warn_impcast_integer_sign;
7181 
7182  // Traditionally, gcc has warned about this under -Wsign-compare.
7183  // We also want to warn about it in -Wconversion.
7184  // So if -Wconversion is off, use a completely identical diagnostic
7185  // in the sign-compare group.
7186  // The conditional-checking code will
7187  if (ICContext) {
7188  DiagID = diag::warn_impcast_integer_sign_conditional;
7189  *ICContext = true;
7190  }
7191 
7192  return DiagnoseImpCast(S, E, T, CC, DiagID);
7193  }
7194 
7195  // Diagnose conversions between different enumeration types.
7196  // In C, we pretend that the type of an EnumConstantDecl is its enumeration
7197  // type, to give us better diagnostics.
7198  QualType SourceType = E->getType();
7199  if (!S.getLangOpts().CPlusPlus) {
7200  if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E))
7201  if (EnumConstantDecl *ECD = dyn_cast<EnumConstantDecl>(DRE->getDecl())) {
7202  EnumDecl *Enum = cast<EnumDecl>(ECD->getDeclContext());
7203  SourceType = S.Context.getTypeDeclType(Enum);
7204  Source = S.Context.getCanonicalType(SourceType).getTypePtr();
7205  }
7206  }
7207 
7208  if (const EnumType *SourceEnum = Source->getAs<EnumType>())
7209  if (const EnumType *TargetEnum = Target->getAs<EnumType>())
7210  if (SourceEnum->getDecl()->hasNameForLinkage() &&
7211  TargetEnum->getDecl()->hasNameForLinkage() &&
7212  SourceEnum != TargetEnum) {
7213  if (S.SourceMgr.isInSystemMacro(CC))
7214  return;
7215 
7216  return DiagnoseImpCast(S, E, SourceType, T, CC,
7217  diag::warn_impcast_different_enum_types);
7218  }
7219 
7220  return;
7221 }
7222 
7223 void CheckConditionalOperator(Sema &S, ConditionalOperator *E,
7224  SourceLocation CC, QualType T);
7225 
7226 void CheckConditionalOperand(Sema &S, Expr *E, QualType T,
7227  SourceLocation CC, bool &ICContext) {
7228  E = E->IgnoreParenImpCasts();
7229 
7230  if (isa<ConditionalOperator>(E))
7231  return CheckConditionalOperator(S, cast<ConditionalOperator>(E), CC, T);
7232 
7233  AnalyzeImplicitConversions(S, E, CC);
7234  if (E->getType() != T)
7235  return CheckImplicitConversion(S, E, T, CC, &ICContext);
7236  return;
7237 }
7238 
7239 void CheckConditionalOperator(Sema &S, ConditionalOperator *E,
7240  SourceLocation CC, QualType T) {
7241  AnalyzeImplicitConversions(S, E->getCond(), E->getQuestionLoc());
7242 
7243  bool Suspicious = false;
7244  CheckConditionalOperand(S, E->getTrueExpr(), T, CC, Suspicious);
7245  CheckConditionalOperand(S, E->getFalseExpr(), T, CC, Suspicious);
7246 
7247  // If -Wconversion would have warned about either of the candidates
7248  // for a signedness conversion to the context type...
7249  if (!Suspicious) return;
7250 
7251  // ...but it's currently ignored...
7252  if (!S.Diags.isIgnored(diag::warn_impcast_integer_sign_conditional, CC))
7253  return;
7254 
7255  // ...then check whether it would have warned about either of the
7256  // candidates for a signedness conversion to the condition type.
7257  if (E->getType() == T) return;
7258 
7259  Suspicious = false;
7260  CheckImplicitConversion(S, E->getTrueExpr()->IgnoreParenImpCasts(),
7261  E->getType(), CC, &Suspicious);
7262  if (!Suspicious)
7263  CheckImplicitConversion(S, E->getFalseExpr()->IgnoreParenImpCasts(),
7264  E->getType(), CC, &Suspicious);
7265 }
7266 
7267 /// CheckBoolLikeConversion - Check conversion of given expression to boolean.
7268 /// Input argument E is a logical expression.
7269 static void CheckBoolLikeConversion(Sema &S, Expr *E, SourceLocation CC) {
7270  if (S.getLangOpts().Bool)
7271  return;
7272  CheckImplicitConversion(S, E->IgnoreParenImpCasts(), S.Context.BoolTy, CC);
7273 }
7274 
7275 /// AnalyzeImplicitConversions - Find and report any interesting
7276 /// implicit conversions in the given expression. There are a couple
7277 /// of competing diagnostics here, -Wconversion and -Wsign-compare.
7278 void AnalyzeImplicitConversions(Sema &S, Expr *OrigE, SourceLocation CC) {
7279  QualType T = OrigE->getType();
7280  Expr *E = OrigE->IgnoreParenImpCasts();
7281 
7282  if (E->isTypeDependent() || E->isValueDependent())
7283  return;
7284 
7285  // For conditional operators, we analyze the arguments as if they
7286  // were being fed directly into the output.
7287  if (isa<ConditionalOperator>(E)) {
7288  ConditionalOperator *CO = cast<ConditionalOperator>(E);
7289  CheckConditionalOperator(S, CO, CC, T);
7290  return;
7291  }
7292 
7293  // Check implicit argument conversions for function calls.
7294  if (CallExpr *Call = dyn_cast<CallExpr>(E))
7295  CheckImplicitArgumentConversions(S, Call, CC);
7296 
7297  // Go ahead and check any implicit conversions we might have skipped.
7298  // The non-canonical typecheck is just an optimization;
7299  // CheckImplicitConversion will filter out dead implicit conversions.
7300  if (E->getType() != T)
7301  CheckImplicitConversion(S, E, T, CC);
7302 
7303  // Now continue drilling into this expression.
7304 
7305  if (PseudoObjectExpr * POE = dyn_cast<PseudoObjectExpr>(E)) {
7306  if (POE->getResultExpr())
7307  E = POE->getResultExpr();
7308  }
7309 
7310  if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) {
7311  if (OVE->getSourceExpr())
7312  AnalyzeImplicitConversions(S, OVE->getSourceExpr(), CC);
7313  return;
7314  }
7315 
7316  // Skip past explicit casts.
7317  if (isa<ExplicitCastExpr>(E)) {
7318  E = cast<ExplicitCastExpr>(E)->getSubExpr()->IgnoreParenImpCasts();
7319  return AnalyzeImplicitConversions(S, E, CC);
7320  }
7321 
7322  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
7323  // Do a somewhat different check with comparison operators.
7324  if (BO->isComparisonOp())
7325  return AnalyzeComparison(S, BO);
7326 
7327  // And with simple assignments.
7328  if (BO->getOpcode() == BO_Assign)
7329  return AnalyzeAssignment(S, BO);
7330  }
7331 
7332  // These break the otherwise-useful invariant below. Fortunately,
7333  // we don't really need to recurse into them, because any internal
7334  // expressions should have been analyzed already when they were
7335  // built into statements.
7336  if (isa<StmtExpr>(E)) return;
7337 
7338  // Don't descend into unevaluated contexts.
7339  if (isa<UnaryExprOrTypeTraitExpr>(E)) return;
7340 
7341  // Now just recurse over the expression's children.
7342  CC = E->getExprLoc();
7343  BinaryOperator *BO = dyn_cast<BinaryOperator>(E);
7344  bool IsLogicalAndOperator = BO && BO->getOpcode() == BO_LAnd;
7345  for (Stmt *SubStmt : E->children()) {
7346  Expr *ChildExpr = dyn_cast_or_null<Expr>(SubStmt);
7347  if (!ChildExpr)
7348  continue;
7349 
7350  if (IsLogicalAndOperator &&
7351  isa<StringLiteral>(ChildExpr->IgnoreParenImpCasts()))
7352  // Ignore checking string literals that are in logical and operators.
7353  // This is a common pattern for asserts.
7354  continue;
7355  AnalyzeImplicitConversions(S, ChildExpr, CC);
7356  }
7357 
7358  if (BO && BO->isLogicalOp()) {
7359  Expr *SubExpr = BO->getLHS()->IgnoreParenImpCasts();
7360  if (!IsLogicalAndOperator || !isa<StringLiteral>(SubExpr))
7361  ::CheckBoolLikeConversion(S, SubExpr, BO->getExprLoc());
7362 
7363  SubExpr = BO->getRHS()->IgnoreParenImpCasts();
7364  if (!IsLogicalAndOperator || !isa<StringLiteral>(SubExpr))
7365  ::CheckBoolLikeConversion(S, SubExpr, BO->getExprLoc());
7366  }
7367 
7368  if (const UnaryOperator *U = dyn_cast<UnaryOperator>(E))
7369  if (U->getOpcode() == UO_LNot)
7370  ::CheckBoolLikeConversion(S, U->getSubExpr(), CC);
7371 }
7372 
7373 } // end anonymous namespace
7374 
7375 enum {
7379 };
7380 
7381 // Helper function for Sema::DiagnoseAlwaysNonNullPointer.
7382 // Returns true when emitting a warning about taking the address of a reference.
7383 static bool CheckForReference(Sema &SemaRef, const Expr *E,
7384  PartialDiagnostic PD) {
7385  E = E->IgnoreParenImpCasts();
7386 
7387  const FunctionDecl *FD = nullptr;
7388 
7389  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) {
7390  if (!DRE->getDecl()->getType()->isReferenceType())
7391  return false;
7392  } else if (const MemberExpr *M = dyn_cast<MemberExpr>(E)) {
7393  if (!M->getMemberDecl()->getType()->isReferenceType())
7394  return false;
7395  } else if (const CallExpr *Call = dyn_cast<CallExpr>(E)) {
7396  if (!Call->getCallReturnType(SemaRef.Context)->isReferenceType())
7397  return false;
7398  FD = Call->getDirectCallee();
7399  } else {
7400  return false;
7401  }
7402 
7403  SemaRef.Diag(E->getExprLoc(), PD);
7404 
7405  // If possible, point to location of function.
7406  if (FD) {
7407  SemaRef.Diag(FD->getLocation(), diag::note_reference_is_return_value) << FD;
7408  }
7409 
7410  return true;
7411 }
7412 
7413 // Returns true if the SourceLocation is expanded from any macro body.
7414 // Returns false if the SourceLocation is invalid, is from not in a macro
7415 // expansion, or is from expanded from a top-level macro argument.
7416 static bool IsInAnyMacroBody(const SourceManager &SM, SourceLocation Loc) {
7417  if (Loc.isInvalid())
7418  return false;
7419 
7420  while (Loc.isMacroID()) {
7421  if (SM.isMacroBodyExpansion(Loc))
7422  return true;
7423  Loc = SM.getImmediateMacroCallerLoc(Loc);
7424  }
7425 
7426  return false;
7427 }
7428 
7429 /// \brief Diagnose pointers that are always non-null.
7430 /// \param E the expression containing the pointer
7431 /// \param NullKind NPCK_NotNull if E is a cast to bool, otherwise, E is
7432 /// compared to a null pointer
7433 /// \param IsEqual True when the comparison is equal to a null pointer
7434 /// \param Range Extra SourceRange to highlight in the diagnostic
7437  bool IsEqual, SourceRange Range) {
7438  if (!E)
7439  return;
7440 
7441  // Don't warn inside macros.
7442  if (E->getExprLoc().isMacroID()) {
7443  const SourceManager &SM = getSourceManager();
7444  if (IsInAnyMacroBody(SM, E->getExprLoc()) ||
7445  IsInAnyMacroBody(SM, Range.getBegin()))
7446  return;
7447  }
7448  E = E->IgnoreImpCasts();
7449 
7450  const bool IsCompare = NullKind != Expr::NPCK_NotNull;
7451 
7452  if (isa<CXXThisExpr>(E)) {
7453  unsigned DiagID = IsCompare ? diag::warn_this_null_compare
7454  : diag::warn_this_bool_conversion;
7455  Diag(E->getExprLoc(), DiagID) << E->getSourceRange() << Range << IsEqual;
7456  return;
7457  }
7458 
7459  bool IsAddressOf = false;
7460 
7461  if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
7462  if (UO->getOpcode() != UO_AddrOf)
7463  return;
7464  IsAddressOf = true;
7465  E = UO->getSubExpr();
7466  }
7467 
7468  if (IsAddressOf) {
7469  unsigned DiagID = IsCompare
7470  ? diag::warn_address_of_reference_null_compare
7471  : diag::warn_address_of_reference_bool_conversion;
7472  PartialDiagnostic PD = PDiag(DiagID) << E->getSourceRange() << Range
7473  << IsEqual;
7474  if (CheckForReference(*this, E, PD)) {
7475  return;
7476  }
7477  }
7478 
7479  // Expect to find a single Decl. Skip anything more complicated.
7480  ValueDecl *D = nullptr;
7481  if (DeclRefExpr *R = dyn_cast<DeclRefExpr>(E)) {
7482  D = R->getDecl();
7483  } else if (MemberExpr *M = dyn_cast<MemberExpr>(E)) {
7484  D = M->getMemberDecl();
7485  }
7486 
7487  // Weak Decls can be null.
7488  if (!D || D->isWeak())
7489  return;
7490 
7491  // Check for parameter decl with nonnull attribute
7492  if (const ParmVarDecl* PV = dyn_cast<ParmVarDecl>(D)) {
7493  if (getCurFunction() && !getCurFunction()->ModifiedNonNullParams.count(PV))
7494  if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(PV->getDeclContext())) {
7495  unsigned NumArgs = FD->getNumParams();
7496  llvm::SmallBitVector AttrNonNull(NumArgs);
7497  for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
7498  if (!NonNull->args_size()) {
7499  AttrNonNull.set(0, NumArgs);
7500  break;
7501  }
7502  for (unsigned Val : NonNull->args()) {
7503  if (Val >= NumArgs)
7504  continue;
7505  AttrNonNull.set(Val);
7506  }
7507  }
7508  if (!AttrNonNull.empty())
7509  for (unsigned i = 0; i < NumArgs; ++i)
7510  if (FD->getParamDecl(i) == PV &&
7511  (AttrNonNull[i] || PV->hasAttr<NonNullAttr>())) {
7512  std::string Str;
7513  llvm::raw_string_ostream S(Str);
7514  E->printPretty(S, nullptr, getPrintingPolicy());
7515  unsigned DiagID = IsCompare ? diag::warn_nonnull_parameter_compare
7516  : diag::warn_cast_nonnull_to_bool;
7517  Diag(E->getExprLoc(), DiagID) << S.str() << E->getSourceRange()
7518  << Range << IsEqual;
7519  return;
7520  }
7521  }
7522  }
7523 
7524  QualType T = D->getType();
7525  const bool IsArray = T->isArrayType();
7526  const bool IsFunction = T->isFunctionType();
7527 
7528  // Address of function is used to silence the function warning.
7529  if (IsAddressOf && IsFunction) {
7530  return;
7531  }
7532 
7533  // Found nothing.
7534  if (!IsAddressOf && !IsFunction && !IsArray)
7535  return;
7536 
7537  // Pretty print the expression for the diagnostic.
7538  std::string Str;
7539  llvm::raw_string_ostream S(Str);
7540  E->printPretty(S, nullptr, getPrintingPolicy());
7541 
7542  unsigned DiagID = IsCompare ? diag::warn_null_pointer_compare
7543  : diag::warn_impcast_pointer_to_bool;
7544  unsigned DiagType;
7545  if (IsAddressOf)
7546  DiagType = AddressOf;
7547  else if (IsFunction)
7548  DiagType = FunctionPointer;
7549  else if (IsArray)
7550  DiagType = ArrayPointer;
7551  else
7552  llvm_unreachable("Could not determine diagnostic.");
7553  Diag(E->getExprLoc(), DiagID) << DiagType << S.str() << E->getSourceRange()
7554  << Range << IsEqual;
7555 
7556  if (!IsFunction)
7557  return;
7558 
7559  // Suggest '&' to silence the function warning.
7560  Diag(E->getExprLoc(), diag::note_function_warning_silence)
7561  << FixItHint::CreateInsertion(E->getLocStart(), "&");
7562 
7563  // Check to see if '()' fixit should be emitted.
7564  QualType ReturnType;
7565  UnresolvedSet<4> NonTemplateOverloads;
7566  tryExprAsCall(*E, ReturnType, NonTemplateOverloads);
7567  if (ReturnType.isNull())
7568  return;
7569 
7570  if (IsCompare) {
7571  // There are two cases here. If there is null constant, the only suggest
7572  // for a pointer return type. If the null is 0, then suggest if the return
7573  // type is a pointer or an integer type.
7574  if (!ReturnType->isPointerType()) {
7575  if (NullKind == Expr::NPCK_ZeroExpression ||
7576  NullKind == Expr::NPCK_ZeroLiteral) {
7577  if (!ReturnType->isIntegerType())
7578  return;
7579  } else {
7580  return;
7581  }
7582  }
7583  } else { // !IsCompare
7584  // For function to bool, only suggest if the function pointer has bool
7585  // return type.
7586  if (!ReturnType->isSpecificBuiltinType(BuiltinType::Bool))
7587  return;
7588  }
7589  Diag(E->getExprLoc(), diag::note_function_to_function_call)
7590  << FixItHint::CreateInsertion(getLocForEndOfToken(E->getLocEnd()), "()");
7591 }
7592 
7593 
7594 /// Diagnoses "dangerous" implicit conversions within the given
7595 /// expression (which is a full expression). Implements -Wconversion
7596 /// and -Wsign-compare.
7597 ///
7598 /// \param CC the "context" location of the implicit conversion, i.e.
7599 /// the most location of the syntactic entity requiring the implicit
7600 /// conversion
7601 void Sema::CheckImplicitConversions(Expr *E, SourceLocation CC) {
7602  // Don't diagnose in unevaluated contexts.
7603  if (isUnevaluatedContext())
7604  return;
7605 
7606  // Don't diagnose for value- or type-dependent expressions.
7607  if (E->isTypeDependent() || E->isValueDependent())
7608  return;
7609 
7610  // Check for array bounds violations in cases where the check isn't triggered
7611  // elsewhere for other Expr types (like BinaryOperators), e.g. when an
7612  // ArraySubscriptExpr is on the RHS of a variable initialization.
7613  CheckArrayAccess(E);
7614 
7615  // This is not the right CC for (e.g.) a variable initialization.
7616  AnalyzeImplicitConversions(*this, E, CC);
7617 }
7618 
7619 /// CheckBoolLikeConversion - Check conversion of given expression to boolean.
7620 /// Input argument E is a logical expression.
7621 void Sema::CheckBoolLikeConversion(Expr *E, SourceLocation CC) {
7622  ::CheckBoolLikeConversion(*this, E, CC);
7623 }
7624 
7625 /// Diagnose when expression is an integer constant expression and its evaluation
7626 /// results in integer overflow
7627 void Sema::CheckForIntOverflow (Expr *E) {
7628  if (isa<BinaryOperator>(E->IgnoreParenCasts()))
7629  E->IgnoreParenCasts()->EvaluateForOverflow(Context);
7630 }
7631 
7632 namespace {
7633 /// \brief Visitor for expressions which looks for unsequenced operations on the
7634 /// same object.
7635 class SequenceChecker : public EvaluatedExprVisitor<SequenceChecker> {
7637 
7638  /// \brief A tree of sequenced regions within an expression. Two regions are
7639  /// unsequenced if one is an ancestor or a descendent of the other. When we
7640  /// finish processing an expression with sequencing, such as a comma
7641  /// expression, we fold its tree nodes into its parent, since they are
7642  /// unsequenced with respect to nodes we will visit later.
7643  class SequenceTree {
7644  struct Value {
7645  explicit Value(unsigned Parent) : Parent(Parent), Merged(false) {}
7646  unsigned Parent : 31;
7647  bool Merged : 1;
7648  };
7649  SmallVector<Value, 8> Values;
7650 
7651  public:
7652  /// \brief A region within an expression which may be sequenced with respect
7653  /// to some other region.
7654  class Seq {
7655  explicit Seq(unsigned N) : Index(N) {}
7656  unsigned Index;
7657  friend class SequenceTree;
7658  public:
7659  Seq() : Index(0) {}
7660  };
7661 
7662  SequenceTree() { Values.push_back(Value(0)); }
7663  Seq root() const { return Seq(0); }
7664 
7665  /// \brief Create a new sequence of operations, which is an unsequenced
7666  /// subset of \p Parent. This sequence of operations is sequenced with
7667  /// respect to other children of \p Parent.
7668  Seq allocate(Seq Parent) {
7669  Values.push_back(Value(Parent.Index));
7670  return Seq(Values.size() - 1);
7671  }
7672 
7673  /// \brief Merge a sequence of operations into its parent.
7674  void merge(Seq S) {
7675  Values[S.Index].Merged = true;
7676  }
7677 
7678  /// \brief Determine whether two operations are unsequenced. This operation
7679  /// is asymmetric: \p Cur should be the more recent sequence, and \p Old
7680  /// should have been merged into its parent as appropriate.
7681  bool isUnsequenced(Seq Cur, Seq Old) {
7682  unsigned C = representative(Cur.Index);
7683  unsigned Target = representative(Old.Index);
7684  while (C >= Target) {
7685  if (C == Target)
7686  return true;
7687  C = Values[C].Parent;
7688  }
7689  return false;
7690  }
7691 
7692  private:
7693  /// \brief Pick a representative for a sequence.
7694  unsigned representative(unsigned K) {
7695  if (Values[K].Merged)
7696  // Perform path compression as we go.
7697  return Values[K].Parent = representative(Values[K].Parent);
7698  return K;
7699  }
7700  };
7701 
7702  /// An object for which we can track unsequenced uses.
7703  typedef NamedDecl *Object;
7704 
7705  /// Different flavors of object usage which we track. We only track the
7706  /// least-sequenced usage of each kind.
7707  enum UsageKind {
7708  /// A read of an object. Multiple unsequenced reads are OK.
7709  UK_Use,
7710  /// A modification of an object which is sequenced before the value
7711  /// computation of the expression, such as ++n in C++.
7712  UK_ModAsValue,
7713  /// A modification of an object which is not sequenced before the value
7714  /// computation of the expression, such as n++.
7715  UK_ModAsSideEffect,
7716 
7717  UK_Count = UK_ModAsSideEffect + 1
7718  };
7719 
7720  struct Usage {
7721  Usage() : Use(nullptr), Seq() {}
7722  Expr *Use;
7723  SequenceTree::Seq Seq;
7724  };
7725 
7726  struct UsageInfo {
7727  UsageInfo() : Diagnosed(false) {}
7728  Usage Uses[UK_Count];
7729  /// Have we issued a diagnostic for this variable already?
7730  bool Diagnosed;
7731  };
7732  typedef llvm::SmallDenseMap<Object, UsageInfo, 16> UsageInfoMap;
7733 
7734  Sema &SemaRef;
7735  /// Sequenced regions within the expression.
7736  SequenceTree Tree;
7737  /// Declaration modifications and references which we have seen.
7738  UsageInfoMap UsageMap;
7739  /// The region we are currently within.
7740  SequenceTree::Seq Region;
7741  /// Filled in with declarations which were modified as a side-effect
7742  /// (that is, post-increment operations).
7743  SmallVectorImpl<std::pair<Object, Usage> > *ModAsSideEffect;
7744  /// Expressions to check later. We defer checking these to reduce
7745  /// stack usage.
7746  SmallVectorImpl<Expr *> &WorkList;
7747 
7748  /// RAII object wrapping the visitation of a sequenced subexpression of an
7749  /// expression. At the end of this process, the side-effects of the evaluation
7750  /// become sequenced with respect to the value computation of the result, so
7751  /// we downgrade any UK_ModAsSideEffect within the evaluation to
7752  /// UK_ModAsValue.
7753  struct SequencedSubexpression {
7754  SequencedSubexpression(SequenceChecker &Self)
7755  : Self(Self), OldModAsSideEffect(Self.ModAsSideEffect) {
7756  Self.ModAsSideEffect = &ModAsSideEffect;
7757  }
7758  ~SequencedSubexpression() {
7759  for (auto MI = ModAsSideEffect.rbegin(), ME = ModAsSideEffect.rend();
7760  MI != ME; ++MI) {
7761  UsageInfo &U = Self.UsageMap[MI->first];
7762  auto &SideEffectUsage = U.Uses[UK_ModAsSideEffect];
7763  Self.addUsage(U, MI->first, SideEffectUsage.Use, UK_ModAsValue);
7764  SideEffectUsage = MI->second;
7765  }
7766  Self.ModAsSideEffect = OldModAsSideEffect;
7767  }
7768 
7769  SequenceChecker &Self;
7770  SmallVector<std::pair<Object, Usage>, 4> ModAsSideEffect;
7771  SmallVectorImpl<std::pair<Object, Usage> > *OldModAsSideEffect;
7772  };
7773 
7774  /// RAII object wrapping the visitation of a subexpression which we might
7775  /// choose to evaluate as a constant. If any subexpression is evaluated and
7776  /// found to be non-constant, this allows us to suppress the evaluation of
7777  /// the outer expression.
7778  class EvaluationTracker {
7779  public:
7780  EvaluationTracker(SequenceChecker &Self)
7781  : Self(Self), Prev(Self.EvalTracker), EvalOK(true) {
7782  Self.EvalTracker = this;
7783  }
7784  ~EvaluationTracker() {
7785  Self.EvalTracker = Prev;
7786  if (Prev)
7787  Prev->EvalOK &= EvalOK;
7788  }
7789 
7790  bool evaluate(const Expr *E, bool &Result) {
7791  if (!EvalOK || E->isValueDependent())
7792  return false;
7793  EvalOK = E->EvaluateAsBooleanCondition(Result, Self.SemaRef.Context);
7794  return EvalOK;
7795  }
7796 
7797  private:
7798  SequenceChecker &Self;
7799  EvaluationTracker *Prev;
7800  bool EvalOK;
7801  } *EvalTracker;
7802 
7803  /// \brief Find the object which is produced by the specified expression,
7804  /// if any.
7805  Object getObject(Expr *E, bool Mod) const {
7806  E = E->IgnoreParenCasts();
7807  if (UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
7808  if (Mod && (UO->getOpcode() == UO_PreInc || UO->getOpcode() == UO_PreDec))
7809  return getObject(UO->getSubExpr(), Mod);
7810  } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
7811  if (BO->getOpcode() == BO_Comma)
7812  return getObject(BO->getRHS(), Mod);
7813  if (Mod && BO->isAssignmentOp())
7814  return getObject(BO->getLHS(), Mod);
7815  } else if (MemberExpr *ME = dyn_cast<MemberExpr>(E)) {
7816  // FIXME: Check for more interesting cases, like "x.n = ++x.n".
7817  if (isa<CXXThisExpr>(ME->getBase()->IgnoreParenCasts()))
7818  return ME->getMemberDecl();
7819  } else if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E))
7820  // FIXME: If this is a reference, map through to its value.
7821  return DRE->getDecl();
7822  return nullptr;
7823  }
7824 
7825  /// \brief Note that an object was modified or used by an expression.
7826  void addUsage(UsageInfo &UI, Object O, Expr *Ref, UsageKind UK) {
7827  Usage &U = UI.Uses[UK];
7828  if (!U.Use || !Tree.isUnsequenced(Region, U.Seq)) {
7829  if (UK == UK_ModAsSideEffect && ModAsSideEffect)
7830  ModAsSideEffect->push_back(std::make_pair(O, U));
7831  U.Use = Ref;
7832  U.Seq = Region;
7833  }
7834  }
7835  /// \brief Check whether a modification or use conflicts with a prior usage.
7836  void checkUsage(Object O, UsageInfo &UI, Expr *Ref, UsageKind OtherKind,
7837  bool IsModMod) {
7838  if (UI.Diagnosed)
7839  return;
7840 
7841  const Usage &U = UI.Uses[OtherKind];
7842  if (!U.Use || !Tree.isUnsequenced(Region, U.Seq))
7843  return;
7844 
7845  Expr *Mod = U.Use;
7846  Expr *ModOrUse = Ref;
7847  if (OtherKind == UK_Use)
7848  std::swap(Mod, ModOrUse);
7849 
7850  SemaRef.Diag(Mod->getExprLoc(),
7851  IsModMod ? diag::warn_unsequenced_mod_mod
7852  : diag::warn_unsequenced_mod_use)
7853  << O << SourceRange(ModOrUse->getExprLoc());
7854  UI.Diagnosed = true;
7855  }
7856 
7857  void notePreUse(Object O, Expr *Use) {
7858  UsageInfo &U = UsageMap[O];
7859  // Uses conflict with other modifications.
7860  checkUsage(O, U, Use, UK_ModAsValue, false);
7861  }
7862  void notePostUse(Object O, Expr *Use) {
7863  UsageInfo &U = UsageMap[O];
7864  checkUsage(O, U, Use, UK_ModAsSideEffect, false);
7865  addUsage(U, O, Use, UK_Use);
7866  }
7867 
7868  void notePreMod(Object O, Expr *Mod) {
7869  UsageInfo &U = UsageMap[O];
7870  // Modifications conflict with other modifications and with uses.
7871  checkUsage(O, U, Mod, UK_ModAsValue, true);
7872  checkUsage(O, U, Mod, UK_Use, false);
7873  }
7874  void notePostMod(Object O, Expr *Use, UsageKind UK) {
7875  UsageInfo &U = UsageMap[O];
7876  checkUsage(O, U, Use, UK_ModAsSideEffect, true);
7877  addUsage(U, O, Use, UK);
7878  }
7879 
7880 public:
7881  SequenceChecker(Sema &S, Expr *E, SmallVectorImpl<Expr *> &WorkList)
7882  : Base(S.Context), SemaRef(S), Region(Tree.root()),
7883  ModAsSideEffect(nullptr), WorkList(WorkList), EvalTracker(nullptr) {
7884  Visit(E);
7885  }
7886 
7887  void VisitStmt(Stmt *S) {
7888  // Skip all statements which aren't expressions for now.
7889  }
7890 
7891  void VisitExpr(Expr *E) {
7892  // By default, just recurse to evaluated subexpressions.
7893  Base::VisitStmt(E);
7894  }
7895 
7896  void VisitCastExpr(CastExpr *E) {
7897  Object O = Object();
7898  if (E->getCastKind() == CK_LValueToRValue)
7899  O = getObject(E->getSubExpr(), false);
7900 
7901  if (O)
7902  notePreUse(O, E);
7903  VisitExpr(E);
7904  if (O)
7905  notePostUse(O, E);
7906  }
7907 
7908  void VisitBinComma(BinaryOperator *BO) {
7909  // C++11 [expr.comma]p1:
7910  // Every value computation and side effect associated with the left
7911  // expression is sequenced before every value computation and side
7912  // effect associated with the right expression.
7913  SequenceTree::Seq LHS = Tree.allocate(Region);
7914  SequenceTree::Seq RHS = Tree.allocate(Region);
7915  SequenceTree::Seq OldRegion = Region;
7916 
7917  {
7918  SequencedSubexpression SeqLHS(*this);
7919  Region = LHS;
7920  Visit(BO->getLHS());
7921  }
7922 
7923  Region = RHS;
7924  Visit(BO->getRHS());
7925 
7926  Region = OldRegion;
7927 
7928  // Forget that LHS and RHS are sequenced. They are both unsequenced
7929  // with respect to other stuff.
7930  Tree.merge(LHS);
7931  Tree.merge(RHS);
7932  }
7933 
7934  void VisitBinAssign(BinaryOperator *BO) {
7935  // The modification is sequenced after the value computation of the LHS
7936  // and RHS, so check it before inspecting the operands and update the
7937  // map afterwards.
7938  Object O = getObject(BO->getLHS(), true);
7939  if (!O)
7940  return VisitExpr(BO);
7941 
7942  notePreMod(O, BO);
7943 
7944  // C++11 [expr.ass]p7:
7945  // E1 op= E2 is equivalent to E1 = E1 op E2, except that E1 is evaluated
7946  // only once.
7947  //
7948  // Therefore, for a compound assignment operator, O is considered used
7949  // everywhere except within the evaluation of E1 itself.
7950  if (isa<CompoundAssignOperator>(BO))
7951  notePreUse(O, BO);
7952 
7953  Visit(BO->getLHS());
7954 
7955  if (isa<CompoundAssignOperator>(BO))
7956  notePostUse(O, BO);
7957 
7958  Visit(BO->getRHS());
7959 
7960  // C++11 [expr.ass]p1:
7961  // the assignment is sequenced [...] before the value computation of the
7962  // assignment expression.
7963  // C11 6.5.16/3 has no such rule.
7964  notePostMod(O, BO, SemaRef.getLangOpts().CPlusPlus ? UK_ModAsValue
7965  : UK_ModAsSideEffect);
7966  }
7967  void VisitCompoundAssignOperator(CompoundAssignOperator *CAO) {
7968  VisitBinAssign(CAO);
7969  }
7970 
7971  void VisitUnaryPreInc(UnaryOperator *UO) { VisitUnaryPreIncDec(UO); }
7972  void VisitUnaryPreDec(UnaryOperator *UO) { VisitUnaryPreIncDec(UO); }
7973  void VisitUnaryPreIncDec(UnaryOperator *UO) {
7974  Object O = getObject(UO->getSubExpr(), true);
7975  if (!O)
7976  return VisitExpr(UO);
7977 
7978  notePreMod(O, UO);
7979  Visit(UO->getSubExpr());
7980  // C++11 [expr.pre.incr]p1:
7981  // the expression ++x is equivalent to x+=1
7982  notePostMod(O, UO, SemaRef.getLangOpts().CPlusPlus ? UK_ModAsValue
7983  : UK_ModAsSideEffect);
7984  }
7985 
7986  void VisitUnaryPostInc(UnaryOperator *UO) { VisitUnaryPostIncDec(UO); }
7987  void VisitUnaryPostDec(UnaryOperator *UO) { VisitUnaryPostIncDec(UO); }
7988  void VisitUnaryPostIncDec(UnaryOperator *UO) {
7989  Object O = getObject(UO->getSubExpr(), true);
7990  if (!O)
7991  return VisitExpr(UO);
7992 
7993  notePreMod(O, UO);
7994  Visit(UO->getSubExpr());
7995  notePostMod(O, UO, UK_ModAsSideEffect);
7996  }
7997 
7998  /// Don't visit the RHS of '&&' or '||' if it might not be evaluated.
7999  void VisitBinLOr(BinaryOperator *BO) {
8000  // The side-effects of the LHS of an '&&' are sequenced before the
8001  // value computation of the RHS, and hence before the value computation
8002  // of the '&&' itself, unless the LHS evaluates to zero. We treat them
8003  // as if they were unconditionally sequenced.
8004  EvaluationTracker Eval(*this);
8005  {
8006  SequencedSubexpression Sequenced(*this);
8007  Visit(BO->getLHS());
8008  }
8009 
8010  bool Result;
8011  if (Eval.evaluate(BO->getLHS(), Result)) {
8012  if (!Result)
8013  Visit(BO->getRHS());
8014  } else {
8015  // Check for unsequenced operations in the RHS, treating it as an
8016  // entirely separate evaluation.
8017  //
8018  // FIXME: If there are operations in the RHS which are unsequenced
8019  // with respect to operations outside the RHS, and those operations
8020  // are unconditionally evaluated, diagnose them.
8021  WorkList.push_back(BO->getRHS());
8022  }
8023  }
8024  void VisitBinLAnd(BinaryOperator *BO) {
8025  EvaluationTracker Eval(*this);
8026  {
8027  SequencedSubexpression Sequenced(*this);
8028  Visit(BO->getLHS());
8029  }
8030 
8031  bool Result;
8032  if (Eval.evaluate(BO->getLHS(), Result)) {
8033  if (Result)
8034  Visit(BO->getRHS());
8035  } else {
8036  WorkList.push_back(BO->getRHS());
8037  }
8038  }
8039 
8040  // Only visit the condition, unless we can be sure which subexpression will
8041  // be chosen.
8042  void VisitAbstractConditionalOperator(AbstractConditionalOperator *CO) {
8043  EvaluationTracker Eval(*this);
8044  {
8045  SequencedSubexpression Sequenced(*this);
8046  Visit(CO->getCond());
8047  }
8048 
8049  bool Result;
8050  if (Eval.evaluate(CO->getCond(), Result))
8051  Visit(Result ? CO->getTrueExpr() : CO->getFalseExpr());
8052  else {
8053  WorkList.push_back(CO->getTrueExpr());
8054  WorkList.push_back(CO->getFalseExpr());
8055  }
8056  }
8057 
8058  void VisitCallExpr(CallExpr *CE) {
8059  // C++11 [intro.execution]p15:
8060  // When calling a function [...], every value computation and side effect
8061  // associated with any argument expression, or with the postfix expression
8062  // designating the called function, is sequenced before execution of every
8063  // expression or statement in the body of the function [and thus before
8064  // the value computation of its result].
8065  SequencedSubexpression Sequenced(*this);
8066  Base::VisitCallExpr(CE);
8067 
8068  // FIXME: CXXNewExpr and CXXDeleteExpr implicitly call functions.
8069  }
8070 
8071  void VisitCXXConstructExpr(CXXConstructExpr *CCE) {
8072  // This is a call, so all subexpressions are sequenced before the result.
8073  SequencedSubexpression Sequenced(*this);
8074 
8075  if (!CCE->isListInitialization())
8076  return VisitExpr(CCE);
8077 
8078  // In C++11, list initializations are sequenced.
8080  SequenceTree::Seq Parent = Region;
8081  for (CXXConstructExpr::arg_iterator I = CCE->arg_begin(),
8082  E = CCE->arg_end();
8083  I != E; ++I) {
8084  Region = Tree.allocate(Parent);
8085  Elts.push_back(Region);
8086  Visit(*I);
8087  }
8088 
8089  // Forget that the initializers are sequenced.
8090  Region = Parent;
8091  for (unsigned I = 0; I < Elts.size(); ++I)
8092  Tree.merge(Elts[I]);
8093  }
8094 
8095  void VisitInitListExpr(InitListExpr *ILE) {
8096  if (!SemaRef.getLangOpts().CPlusPlus11)
8097  return VisitExpr(ILE);
8098 
8099  // In C++11, list initializations are sequenced.
8101  SequenceTree::Seq Parent = Region;
8102  for (unsigned I = 0; I < ILE->getNumInits(); ++I) {
8103  Expr *E = ILE->getInit(I);
8104  if (!E) continue;
8105  Region = Tree.allocate(Parent);
8106  Elts.push_back(Region);
8107  Visit(E);
8108  }
8109 
8110  // Forget that the initializers are sequenced.
8111  Region = Parent;
8112  for (unsigned I = 0; I < Elts.size(); ++I)
8113  Tree.merge(Elts[I]);
8114  }
8115 };
8116 }
8117 
8118 void Sema::CheckUnsequencedOperations(Expr *E) {
8119  SmallVector<Expr *, 8> WorkList;
8120  WorkList.push_back(E);
8121  while (!WorkList.empty()) {
8122  Expr *Item = WorkList.pop_back_val();
8123  SequenceChecker(*this, Item, WorkList);
8124  }
8125 }
8126 
8127 void Sema::CheckCompletedExpr(Expr *E, SourceLocation CheckLoc,
8128  bool IsConstexpr) {
8129  CheckImplicitConversions(E, CheckLoc);
8130  CheckUnsequencedOperations(E);
8131  if (!IsConstexpr && !E->isValueDependent())
8132  CheckForIntOverflow(E);
8133 }
8134 
8135 void Sema::CheckBitFieldInitialization(SourceLocation InitLoc,
8136  FieldDecl *BitField,
8137  Expr *Init) {
8138  (void) AnalyzeBitFieldAssignment(*this, BitField, Init, InitLoc);
8139 }
8140 
8142  SourceLocation Loc) {
8143  if (!PType->isVariablyModifiedType())
8144  return;
8145  if (const auto *PointerTy = dyn_cast<PointerType>(PType)) {
8146  diagnoseArrayStarInParamType(S, PointerTy->getPointeeType(), Loc);
8147  return;
8148  }
8149  if (const auto *ReferenceTy = dyn_cast<ReferenceType>(PType)) {
8150  diagnoseArrayStarInParamType(S, ReferenceTy->getPointeeType(), Loc);
8151  return;
8152  }
8153  if (const auto *ParenTy = dyn_cast<ParenType>(PType)) {
8154  diagnoseArrayStarInParamType(S, ParenTy->getInnerType(), Loc);
8155  return;
8156  }
8157 
8158  const ArrayType *AT = S.Context.getAsArrayType(PType);
8159  if (!AT)
8160  return;
8161 
8162  if (AT->getSizeModifier() != ArrayType::Star) {
8164  return;
8165  }
8166 
8167  S.Diag(Loc, diag::err_array_star_in_function_definition);
8168 }
8169 
8170 /// CheckParmsForFunctionDef - Check that the parameters of the given
8171 /// function are appropriate for the definition of a function. This
8172 /// takes care of any checks that cannot be performed on the
8173 /// declaration itself, e.g., that the types of each of the function
8174 /// parameters are complete.
8176  ParmVarDecl *const *PEnd,
8177  bool CheckParameterNames) {
8178  bool HasInvalidParm = false;
8179  for (; P != PEnd; ++P) {
8180  ParmVarDecl *Param = *P;
8181 
8182  // C99 6.7.5.3p4: the parameters in a parameter type list in a
8183  // function declarator that is part of a function definition of
8184  // that function shall not have incomplete type.
8185  //
8186  // This is also C++ [dcl.fct]p6.
8187  if (!Param->isInvalidDecl() &&
8188  RequireCompleteType(Param->getLocation(), Param->getType(),
8189  diag::err_typecheck_decl_incomplete_type)) {
8190  Param->setInvalidDecl();
8191  HasInvalidParm = true;
8192  }
8193 
8194  // C99 6.9.1p5: If the declarator includes a parameter type list, the
8195  // declaration of each parameter shall include an identifier.
8196  if (CheckParameterNames &&
8197  Param->getIdentifier() == nullptr &&
8198  !Param->isImplicit() &&
8199  !getLangOpts().CPlusPlus)
8200  Diag(Param->getLocation(), diag::err_parameter_name_omitted);
8201 
8202  // C99 6.7.5.3p12:
8203  // If the function declarator is not part of a definition of that
8204  // function, parameters may have incomplete type and may use the [*]
8205  // notation in their sequences of declarator specifiers to specify
8206  // variable length array types.
8207  QualType PType = Param->getOriginalType();
8208  // FIXME: This diagnostic should point the '[*]' if source-location
8209  // information is added for it.
8210  diagnoseArrayStarInParamType(*this, PType, Param->getLocation());
8211 
8212  // MSVC destroys objects passed by value in the callee. Therefore a
8213  // function definition which takes such a parameter must be able to call the
8214  // object's destructor. However, we don't perform any direct access check
8215  // on the dtor.
8216  if (getLangOpts().CPlusPlus && Context.getTargetInfo()
8217  .getCXXABI()
8219  if (!Param->isInvalidDecl()) {
8220  if (const RecordType *RT = Param->getType()->getAs<RecordType>()) {
8221  CXXRecordDecl *ClassDecl = cast<CXXRecordDecl>(RT->getDecl());
8222  if (!ClassDecl->isInvalidDecl() &&
8223  !ClassDecl->hasIrrelevantDestructor() &&
8224  !ClassDecl->isDependentContext()) {
8225  CXXDestructorDecl *Destructor = LookupDestructor(ClassDecl);
8226  MarkFunctionReferenced(Param->getLocation(), Destructor);
8227  DiagnoseUseOfDecl(Destructor, Param->getLocation());
8228  }
8229  }
8230  }
8231  }
8232  }
8233 
8234  return HasInvalidParm;
8235 }
8236 
8237 /// CheckCastAlign - Implements -Wcast-align, which warns when a
8238 /// pointer cast increases the alignment requirements.
8239 void Sema::CheckCastAlign(Expr *Op, QualType T, SourceRange TRange) {
8240  // This is actually a lot of work to potentially be doing on every
8241  // cast; don't do it if we're ignoring -Wcast_align (as is the default).
8242  if (getDiagnostics().isIgnored(diag::warn_cast_align, TRange.getBegin()))
8243  return;
8244 
8245  // Ignore dependent types.
8246  if (T->isDependentType() || Op->getType()->isDependentType())
8247  return;
8248 
8249  // Require that the destination be a pointer type.
8250  const PointerType *DestPtr = T->getAs<PointerType>();
8251  if (!DestPtr) return;
8252 
8253  // If the destination has alignment 1, we're done.
8254  QualType DestPointee = DestPtr->getPointeeType();
8255  if (DestPointee->isIncompleteType()) return;
8256  CharUnits DestAlign = Context.getTypeAlignInChars(DestPointee);
8257  if (DestAlign.isOne()) return;
8258 
8259  // Require that the source be a pointer type.
8260  const PointerType *SrcPtr = Op->getType()->getAs<PointerType>();
8261  if (!SrcPtr) return;
8262  QualType SrcPointee = SrcPtr->getPointeeType();
8263 
8264  // Whitelist casts from cv void*. We already implicitly
8265  // whitelisted casts to cv void*, since they have alignment 1.
8266  // Also whitelist casts involving incomplete types, which implicitly
8267  // includes 'void'.
8268  if (SrcPointee->isIncompleteType()) return;
8269 
8270  CharUnits SrcAlign = Context.getTypeAlignInChars(SrcPointee);
8271  if (SrcAlign >= DestAlign) return;
8272 
8273  Diag(TRange.getBegin(), diag::warn_cast_align)
8274  << Op->getType() << T
8275  << static_cast<unsigned>(SrcAlign.getQuantity())
8276  << static_cast<unsigned>(DestAlign.getQuantity())
8277  << TRange << Op->getSourceRange();
8278 }
8279 
8280 static const Type* getElementType(const Expr *BaseExpr) {
8281  const Type* EltType = BaseExpr->getType().getTypePtr();
8282  if (EltType->isAnyPointerType())
8283  return EltType->getPointeeType().getTypePtr();
8284  else if (EltType->isArrayType())
8285  return EltType->getBaseElementTypeUnsafe();
8286  return EltType;
8287 }
8288 
8289 /// \brief Check whether this array fits the idiom of a size-one tail padded
8290 /// array member of a struct.
8291 ///
8292 /// We avoid emitting out-of-bounds access warnings for such arrays as they are
8293 /// commonly used to emulate flexible arrays in C89 code.
8294 static bool IsTailPaddedMemberArray(Sema &S, llvm::APInt Size,
8295  const NamedDecl *ND) {
8296  if (Size != 1 || !ND) return false;
8297 
8298  const FieldDecl *FD = dyn_cast<FieldDecl>(ND);
8299  if (!FD) return false;
8300 
8301  // Don't consider sizes resulting from macro expansions or template argument
8302  // substitution to form C89 tail-padded arrays.
8303 
8304  TypeSourceInfo *TInfo = FD->getTypeSourceInfo();
8305  while (TInfo) {
8306  TypeLoc TL = TInfo->getTypeLoc();
8307  // Look through typedefs.
8308  if (TypedefTypeLoc TTL = TL.getAs<TypedefTypeLoc>()) {
8309  const TypedefNameDecl *TDL = TTL.getTypedefNameDecl();
8310  TInfo = TDL->getTypeSourceInfo();
8311  continue;
8312  }
8314  const Expr *SizeExpr = dyn_cast<IntegerLiteral>(CTL.getSizeExpr());
8315  if (!SizeExpr || SizeExpr->getExprLoc().isMacroID())
8316  return false;
8317  }
8318  break;
8319  }
8320 
8321  const RecordDecl *RD = dyn_cast<RecordDecl>(FD->getDeclContext());
8322  if (!RD) return false;
8323  if (RD->isUnion()) return false;
8324  if (const CXXRecordDecl *CRD = dyn_cast<CXXRecordDecl>(RD)) {
8325  if (!CRD->isStandardLayout()) return false;
8326  }
8327 
8328  // See if this is the last field decl in the record.
8329  const Decl *D = FD;
8330  while ((D = D->getNextDeclInContext()))
8331  if (isa<FieldDecl>(D))
8332  return false;
8333  return true;
8334 }
8335 
8336 void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr,
8337  const ArraySubscriptExpr *ASE,
8338  bool AllowOnePastEnd, bool IndexNegated) {
8339  IndexExpr = IndexExpr->IgnoreParenImpCasts();
8340  if (IndexExpr->isValueDependent())
8341  return;
8342 
8343  const Type *EffectiveType = getElementType(BaseExpr);
8344  BaseExpr = BaseExpr->IgnoreParenCasts();
8345  const ConstantArrayType *ArrayTy =
8346  Context.getAsConstantArrayType(BaseExpr->getType());
8347  if (!ArrayTy)
8348  return;
8349 
8350  llvm::APSInt index;
8351  if (!IndexExpr->EvaluateAsInt(index, Context))
8352  return;
8353  if (IndexNegated)
8354  index = -index;
8355 
8356  const NamedDecl *ND = nullptr;
8357  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr))
8358  ND = dyn_cast<NamedDecl>(DRE->getDecl());
8359  if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr))
8360  ND = dyn_cast<NamedDecl>(ME->getMemberDecl());
8361 
8362  if (index.isUnsigned() || !index.isNegative()) {
8363  llvm::APInt size = ArrayTy->getSize();
8364  if (!size.isStrictlyPositive())
8365  return;
8366 
8367  const Type* BaseType = getElementType(BaseExpr);
8368  if (BaseType != EffectiveType) {
8369  // Make sure we're comparing apples to apples when comparing index to size
8370  uint64_t ptrarith_typesize = Context.getTypeSize(EffectiveType);
8371  uint64_t array_typesize = Context.getTypeSize(BaseType);
8372  // Handle ptrarith_typesize being zero, such as when casting to void*
8373  if (!ptrarith_typesize) ptrarith_typesize = 1;
8374  if (ptrarith_typesize != array_typesize) {
8375  // There's a cast to a different size type involved
8376  uint64_t ratio = array_typesize / ptrarith_typesize;
8377  // TODO: Be smarter about handling cases where array_typesize is not a
8378  // multiple of ptrarith_typesize
8379  if (ptrarith_typesize * ratio == array_typesize)
8380  size *= llvm::APInt(size.getBitWidth(), ratio);
8381  }
8382  }
8383 
8384  if (size.getBitWidth() > index.getBitWidth())
8385  index = index.zext(size.getBitWidth());
8386  else if (size.getBitWidth() < index.getBitWidth())
8387  size = size.zext(index.getBitWidth());
8388 
8389  // For array subscripting the index must be less than size, but for pointer
8390  // arithmetic also allow the index (offset) to be equal to size since
8391  // computing the next address after the end of the array is legal and
8392  // commonly done e.g. in C++ iterators and range-based for loops.
8393  if (AllowOnePastEnd ? index.ule(size) : index.ult(size))
8394  return;
8395 
8396  // Also don't warn for arrays of size 1 which are members of some
8397  // structure. These are often used to approximate flexible arrays in C89
8398  // code.
8399  if (IsTailPaddedMemberArray(*this, size, ND))
8400  return;
8401 
8402  // Suppress the warning if the subscript expression (as identified by the
8403  // ']' location) and the index expression are both from macro expansions
8404  // within a system header.
8405  if (ASE) {
8406  SourceLocation RBracketLoc = SourceMgr.getSpellingLoc(
8407  ASE->getRBracketLoc());
8408  if (SourceMgr.isInSystemHeader(RBracketLoc)) {
8410  IndexExpr->getLocStart());
8411  if (SourceMgr.isWrittenInSameFile(RBracketLoc, IndexLoc))
8412  return;
8413  }
8414  }
8415 
8416  unsigned DiagID = diag::warn_ptr_arith_exceeds_bounds;
8417  if (ASE)
8418  DiagID = diag::warn_array_index_exceeds_bounds;
8419 
8420  DiagRuntimeBehavior(BaseExpr->getLocStart(), BaseExpr,
8421  PDiag(DiagID) << index.toString(10, true)
8422  << size.toString(10, true)
8423  << (unsigned)size.getLimitedValue(~0U)
8424  << IndexExpr->getSourceRange());
8425  } else {
8426  unsigned DiagID = diag::warn_array_index_precedes_bounds;
8427  if (!ASE) {
8428  DiagID = diag::warn_ptr_arith_precedes_bounds;
8429  if (index.isNegative()) index = -index;
8430  }
8431 
8432  DiagRuntimeBehavior(BaseExpr->getLocStart(), BaseExpr,
8433  PDiag(DiagID) << index.toString(10, true)
8434  << IndexExpr->getSourceRange());
8435  }
8436 
8437  if (!ND) {
8438  // Try harder to find a NamedDecl to point at in the note.
8439  while (const ArraySubscriptExpr *ASE =
8440  dyn_cast<ArraySubscriptExpr>(BaseExpr))
8441  BaseExpr = ASE->getBase()->IgnoreParenCasts();
8442  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr))
8443  ND = dyn_cast<NamedDecl>(DRE->getDecl());
8444  if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr))
8445  ND = dyn_cast<NamedDecl>(ME->getMemberDecl());
8446  }
8447 
8448  if (ND)
8449  DiagRuntimeBehavior(ND->getLocStart(), BaseExpr,
8450  PDiag(diag::note_array_index_out_of_bounds)
8451  << ND->getDeclName());
8452 }
8453 
8454 void Sema::CheckArrayAccess(const Expr *expr) {
8455  int AllowOnePastEnd = 0;
8456  while (expr) {
8457  expr = expr->IgnoreParenImpCasts();
8458  switch (expr->getStmtClass()) {
8459  case Stmt::ArraySubscriptExprClass: {
8460  const ArraySubscriptExpr *ASE = cast<ArraySubscriptExpr>(expr);
8461  CheckArrayAccess(ASE->getBase(), ASE->getIdx(), ASE,
8462  AllowOnePastEnd > 0);
8463  return;
8464  }
8465  case Stmt::UnaryOperatorClass: {
8466  // Only unwrap the * and & unary operators
8467  const UnaryOperator *UO = cast<UnaryOperator>(expr);
8468  expr = UO->getSubExpr();
8469  switch (UO->getOpcode()) {
8470  case UO_AddrOf:
8471  AllowOnePastEnd++;
8472  break;
8473  case UO_Deref:
8474  AllowOnePastEnd--;
8475  break;
8476  default:
8477  return;
8478  }
8479  break;
8480  }
8481  case Stmt::ConditionalOperatorClass: {
8482  const ConditionalOperator *cond = cast<ConditionalOperator>(expr);
8483  if (const Expr *lhs = cond->getLHS())
8484  CheckArrayAccess(lhs);
8485  if (const Expr *rhs = cond->getRHS())
8486  CheckArrayAccess(rhs);
8487  return;
8488  }
8489  default:
8490  return;
8491  }
8492  }
8493 }
8494 
8495 //===--- CHECK: Objective-C retain cycles ----------------------------------//
8496 
8497 namespace {
8498  struct RetainCycleOwner {
8499  RetainCycleOwner() : Variable(nullptr), Indirect(false) {}
8500  VarDecl *Variable;
8501  SourceRange Range;
8502  SourceLocation Loc;
8503  bool Indirect;
8504 
8505  void setLocsFrom(Expr *e) {
8506  Loc = e->getExprLoc();
8507  Range = e->getSourceRange();
8508  }
8509  };
8510 }
8511 
8512 /// Consider whether capturing the given variable can possibly lead to
8513 /// a retain cycle.
8514 static bool considerVariable(VarDecl *var, Expr *ref, RetainCycleOwner &owner) {
8515  // In ARC, it's captured strongly iff the variable has __strong
8516  // lifetime. In MRR, it's captured strongly if the variable is
8517  // __block and has an appropriate type.
8519  return false;
8520 
8521  owner.Variable = var;
8522  if (ref)
8523  owner.setLocsFrom(ref);
8524  return true;
8525 }
8526 
8527 static bool findRetainCycleOwner(Sema &S, Expr *e, RetainCycleOwner &owner) {
8528  while (true) {
8529  e = e->IgnoreParens();
8530  if (CastExpr *cast = dyn_cast<CastExpr>(e)) {
8531  switch (cast->getCastKind()) {
8532  case CK_BitCast:
8533  case CK_LValueBitCast:
8534  case CK_LValueToRValue:
8536  e = cast->getSubExpr();
8537  continue;
8538 
8539  default:
8540  return false;
8541  }
8542  }
8543 
8544  if (ObjCIvarRefExpr *ref = dyn_cast<ObjCIvarRefExpr>(e)) {
8545  ObjCIvarDecl *ivar = ref->getDecl();
8547  return false;
8548 
8549  // Try to find a retain cycle in the base.
8550  if (!findRetainCycleOwner(S, ref->getBase(), owner))
8551  return false;
8552 
8553  if (ref->isFreeIvar()) owner.setLocsFrom(ref);
8554  owner.Indirect = true;
8555  return true;
8556  }
8557 
8558  if (DeclRefExpr *ref = dyn_cast<DeclRefExpr>(e)) {
8559  VarDecl *var = dyn_cast<VarDecl>(ref->getDecl());
8560  if (!var) return false;
8561  return considerVariable(var, ref, owner);
8562  }
8563 
8564  if (MemberExpr *member = dyn_cast<MemberExpr>(e)) {
8565  if (member->isArrow()) return false;
8566 
8567  // Don't count this as an indirect ownership.
8568  e = member->getBase();
8569  continue;
8570  }
8571 
8572  if (PseudoObjectExpr *pseudo = dyn_cast<PseudoObjectExpr>(e)) {
8573  // Only pay attention to pseudo-objects on property references.
8574  ObjCPropertyRefExpr *pre
8575  = dyn_cast<ObjCPropertyRefExpr>(pseudo->getSyntacticForm()
8576  ->IgnoreParens());
8577  if (!pre) return false;
8578  if (pre->isImplicitProperty()) return false;
8579  ObjCPropertyDecl *property = pre->getExplicitProperty();
8580  if (!property->isRetaining() &&
8581  !(property->getPropertyIvarDecl() &&
8582  property->getPropertyIvarDecl()->getType()
8583  .getObjCLifetime() == Qualifiers::OCL_Strong))
8584  return false;
8585 
8586  owner.Indirect = true;
8587  if (pre->isSuperReceiver()) {
8588  owner.Variable = S.getCurMethodDecl()->getSelfDecl();
8589  if (!owner.Variable)
8590  return false;
8591  owner.Loc = pre->getLocation();
8592  owner.Range = pre->getSourceRange();
8593  return true;
8594  }
8595  e = const_cast<Expr*>(cast<OpaqueValueExpr>(pre->getBase())
8596  ->getSourceExpr());
8597  continue;
8598  }
8599 
8600  // Array ivars?
8601 
8602  return false;
8603  }
8604 }
8605 
8606 namespace {
8607  struct FindCaptureVisitor : EvaluatedExprVisitor<FindCaptureVisitor> {
8608  FindCaptureVisitor(ASTContext &Context, VarDecl *variable)
8609  : EvaluatedExprVisitor<FindCaptureVisitor>(Context),
8610  Context(Context), Variable(variable), Capturer(nullptr),
8611  VarWillBeReased(false) {}
8613  VarDecl *Variable;
8614  Expr *Capturer;
8615  bool VarWillBeReased;
8616 
8617  void VisitDeclRefExpr(DeclRefExpr *ref) {
8618  if (ref->getDecl() == Variable && !Capturer)
8619  Capturer = ref;
8620  }
8621 
8622  void VisitObjCIvarRefExpr(ObjCIvarRefExpr *ref) {
8623  if (Capturer) return;
8624  Visit(ref->getBase());
8625  if (Capturer && ref->isFreeIvar())
8626  Capturer = ref;
8627  }
8628 
8629  void VisitBlockExpr(BlockExpr *block) {
8630  // Look inside nested blocks
8631  if (block->getBlockDecl()->capturesVariable(Variable))
8632  Visit(block->getBlockDecl()->getBody());
8633  }
8634 
8635  void VisitOpaqueValueExpr(OpaqueValueExpr *OVE) {
8636  if (Capturer) return;
8637  if (OVE->getSourceExpr())
8638  Visit(OVE->getSourceExpr());
8639  }
8640  void VisitBinaryOperator(BinaryOperator *BinOp) {
8641  if (!Variable || VarWillBeReased || BinOp->getOpcode() != BO_Assign)
8642  return;
8643  Expr *LHS = BinOp->getLHS();
8644  if (const DeclRefExpr *DRE = dyn_cast_or_null<DeclRefExpr>(LHS)) {
8645  if (DRE->getDecl() != Variable)
8646  return;
8647  if (Expr *RHS = BinOp->getRHS()) {
8648  RHS = RHS->IgnoreParenCasts();
8649  llvm::APSInt Value;
8650  VarWillBeReased =
8651  (RHS && RHS->isIntegerConstantExpr(Value, Context) && Value == 0);
8652  }
8653  }
8654  }
8655  };
8656 }
8657 
8658 /// Check whether the given argument is a block which captures a
8659 /// variable.
8660 static Expr *findCapturingExpr(Sema &S, Expr *e, RetainCycleOwner &owner) {
8661  assert(owner.Variable && owner.Loc.isValid());
8662 
8663  e = e->IgnoreParenCasts();
8664 
8665  // Look through [^{...} copy] and Block_copy(^{...}).
8666  if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(e)) {
8667  Selector Cmd = ME->getSelector();
8668  if (Cmd.isUnarySelector() && Cmd.getNameForSlot(0) == "copy") {
8669  e = ME->getInstanceReceiver();
8670  if (!e)
8671  return nullptr;
8672  e = e->IgnoreParenCasts();
8673  }
8674  } else if (CallExpr *CE = dyn_cast<CallExpr>(e)) {
8675  if (CE->getNumArgs() == 1) {
8676  FunctionDecl *Fn = dyn_cast_or_null<FunctionDecl>(CE->getCalleeDecl());
8677  if (Fn) {
8678  const IdentifierInfo *FnI = Fn->getIdentifier();
8679  if (FnI && FnI->isStr("_Block_copy")) {
8680  e = CE->getArg(0)->IgnoreParenCasts();
8681  }
8682  }
8683  }
8684  }
8685 
8686  BlockExpr *block = dyn_cast<BlockExpr>(e);
8687  if (!block || !block->getBlockDecl()->capturesVariable(owner.Variable))
8688  return nullptr;
8689 
8690  FindCaptureVisitor visitor(S.Context, owner.Variable);
8691  visitor.Visit(block->getBlockDecl()->getBody());
8692  return visitor.VarWillBeReased ? nullptr : visitor.Capturer;
8693 }
8694 
8695 static void diagnoseRetainCycle(Sema &S, Expr *capturer,
8696  RetainCycleOwner &owner) {
8697  assert(capturer);
8698  assert(owner.Variable && owner.Loc.isValid());
8699 
8700  S.Diag(capturer->getExprLoc(), diag::warn_arc_retain_cycle)
8701  << owner.Variable << capturer->getSourceRange();
8702  S.Diag(owner.Loc, diag::note_arc_retain_cycle_owner)
8703  << owner.Indirect << owner.Range;
8704 }
8705 
8706 /// Check for a keyword selector that starts with the word 'add' or
8707 /// 'set'.
8708 static bool isSetterLikeSelector(Selector sel) {
8709  if (sel.isUnarySelector()) return false;
8710 
8711  StringRef str = sel.getNameForSlot(0);
8712  while (!str.empty() && str.front() == '_') str = str.substr(1);
8713  if (str.startswith("set"))
8714  str = str.substr(3);
8715  else if (str.startswith("add")) {
8716  // Specially whitelist 'addOperationWithBlock:'.
8717  if (sel.getNumArgs() == 1 && str.startswith("addOperationWithBlock"))
8718  return false;
8719  str = str.substr(3);
8720  }
8721  else
8722  return false;
8723 
8724  if (str.empty()) return true;
8725  return !isLowercase(str.front());
8726 }
8727 
8729  ObjCMessageExpr *Message) {
8730  bool IsMutableArray = S.NSAPIObj->isSubclassOfNSClass(
8731  Message->getReceiverInterface(),
8733  if (!IsMutableArray) {
8734  return None;
8735  }
8736 
8737  Selector Sel = Message->getSelector();
8738 
8740  S.NSAPIObj->getNSArrayMethodKind(Sel);
8741  if (!MKOpt) {
8742  return None;
8743  }
8744 
8745  NSAPI::NSArrayMethodKind MK = *MKOpt;
8746 
8747  switch (MK) {
8751  return 0;
8753  return 1;
8754 
8755  default:
8756  return None;
8757  }
8758 
8759  return None;
8760 }
8761 
8762 static
8764  ObjCMessageExpr *Message) {
8765  bool IsMutableDictionary = S.NSAPIObj->isSubclassOfNSClass(
8766  Message->getReceiverInterface(),
8768  if (!IsMutableDictionary) {
8769  return None;
8770  }
8771 
8772  Selector Sel = Message->getSelector();
8773 
8775  S.NSAPIObj->getNSDictionaryMethodKind(Sel);
8776  if (!MKOpt) {
8777  return None;
8778  }
8779 
8780  NSAPI::NSDictionaryMethodKind MK = *MKOpt;
8781 
8782  switch (MK) {
8786  return 0;
8787 
8788  default:
8789  return None;
8790  }
8791 
8792  return None;
8793 }
8794 
8796  bool IsMutableSet = S.NSAPIObj->isSubclassOfNSClass(
8797  Message->getReceiverInterface(),
8799 
8800  bool IsMutableOrderedSet = S.NSAPIObj->isSubclassOfNSClass(
8801  Message->getReceiverInterface(),
8803  if (!IsMutableSet && !IsMutableOrderedSet) {
8804  return None;
8805  }
8806 
8807  Selector Sel = Message->getSelector();
8808 
8809  Optional<NSAPI::NSSetMethodKind> MKOpt = S.NSAPIObj->getNSSetMethodKind(Sel);
8810  if (!MKOpt) {
8811  return None;
8812  }
8813 
8814  NSAPI::NSSetMethodKind MK = *MKOpt;
8815 
8816  switch (MK) {
8821  return 0;
8823  return 1;
8824  }
8825 
8826  return None;
8827 }
8828 
8829 void Sema::CheckObjCCircularContainer(ObjCMessageExpr *Message) {
8830  if (!Message->isInstanceMessage()) {
8831  return;
8832  }
8833 
8834  Optional<int> ArgOpt;
8835 
8836  if (!(ArgOpt = GetNSMutableArrayArgumentIndex(*this, Message)) &&
8837  !(ArgOpt = GetNSMutableDictionaryArgumentIndex(*this, Message)) &&
8838  !(ArgOpt = GetNSSetArgumentIndex(*this, Message))) {
8839  return;
8840  }
8841 
8842  int ArgIndex = *ArgOpt;
8843 
8844  Expr *Arg = Message->getArg(ArgIndex)->IgnoreImpCasts();
8845  if (OpaqueValueExpr *OE = dyn_cast<OpaqueValueExpr>(Arg)) {
8846  Arg = OE->getSourceExpr()->IgnoreImpCasts();
8847  }
8848 
8849  if (Message->getReceiverKind() == ObjCMessageExpr::SuperInstance) {
8850  if (DeclRefExpr *ArgRE = dyn_cast<DeclRefExpr>(Arg)) {
8851  if (ArgRE->isObjCSelfExpr()) {
8852  Diag(Message->getSourceRange().getBegin(),
8853  diag::warn_objc_circular_container)
8854  << ArgRE->getDecl()->getName() << StringRef("super");
8855  }
8856  }
8857  } else {
8858  Expr *Receiver = Message->getInstanceReceiver()->IgnoreImpCasts();
8859 
8860  if (OpaqueValueExpr *OE = dyn_cast<OpaqueValueExpr>(Receiver)) {
8861  Receiver = OE->getSourceExpr()->IgnoreImpCasts();
8862  }
8863 
8864  if (DeclRefExpr *ReceiverRE = dyn_cast<DeclRefExpr>(Receiver)) {
8865  if (DeclRefExpr *ArgRE = dyn_cast<DeclRefExpr>(Arg)) {
8866  if (ReceiverRE->getDecl() == ArgRE->getDecl()) {
8867  ValueDecl *Decl = ReceiverRE->getDecl();
8868  Diag(Message->getSourceRange().getBegin(),
8869  diag::warn_objc_circular_container)
8870  << Decl->getName() << Decl->getName();
8871  if (!ArgRE->isObjCSelfExpr()) {
8872  Diag(Decl->getLocation(),
8873  diag::note_objc_circular_container_declared_here)
8874  << Decl->getName();
8875  }
8876  }
8877  }
8878  } else if (ObjCIvarRefExpr *IvarRE = dyn_cast<ObjCIvarRefExpr>(Receiver)) {
8879  if (ObjCIvarRefExpr *IvarArgRE = dyn_cast<ObjCIvarRefExpr>(Arg)) {
8880  if (IvarRE->getDecl() == IvarArgRE->getDecl()) {
8881  ObjCIvarDecl *Decl = IvarRE->getDecl();
8882  Diag(Message->getSourceRange().getBegin(),
8883  diag::warn_objc_circular_container)
8884  << Decl->getName() << Decl->getName();
8885  Diag(Decl->getLocation(),
8886  diag::note_objc_circular_container_declared_here)
8887  << Decl->getName();
8888  }
8889  }
8890  }
8891  }
8892 
8893 }
8894 
8895 /// Check a message send to see if it's likely to cause a retain cycle.
8897  // Only check instance methods whose selector looks like a setter.
8898  if (!msg->isInstanceMessage() || !isSetterLikeSelector(msg->getSelector()))
8899  return;
8900 
8901  // Try to find a variable that the receiver is strongly owned by.
8902  RetainCycleOwner owner;
8904  if (!findRetainCycleOwner(*this, msg->getInstanceReceiver(), owner))
8905  return;
8906  } else {
8908  owner.Variable = getCurMethodDecl()->getSelfDecl();
8909  owner.Loc = msg->getSuperLoc();
8910  owner.Range = msg->getSuperLoc();
8911  }
8912 
8913  // Check whether the receiver is captured by any of the arguments.
8914  for (unsigned i = 0, e = msg->getNumArgs(); i != e; ++i)
8915  if (Expr *capturer = findCapturingExpr(*this, msg->getArg(i), owner))
8916  return diagnoseRetainCycle(*this, capturer, owner);
8917 }
8918 
8919 /// Check a property assign to see if it's likely to cause a retain cycle.
8920 void Sema::checkRetainCycles(Expr *receiver, Expr *argument) {
8921  RetainCycleOwner owner;
8922  if (!findRetainCycleOwner(*this, receiver, owner))
8923  return;
8924 
8925  if (Expr *capturer = findCapturingExpr(*this, argument, owner))
8926  diagnoseRetainCycle(*this, capturer, owner);
8927 }
8928 
8930  RetainCycleOwner Owner;
8931  if (!considerVariable(Var, /*DeclRefExpr=*/nullptr, Owner))
8932  return;
8933 
8934  // Because we don't have an expression for the variable, we have to set the
8935  // location explicitly here.
8936  Owner.Loc = Var->getLocation();
8937  Owner.Range = Var->getSourceRange();
8938 
8939  if (Expr *Capturer = findCapturingExpr(*this, Init, Owner))
8940  diagnoseRetainCycle(*this, Capturer, Owner);
8941 }
8942 
8944  Expr *RHS, bool isProperty) {
8945  // Check if RHS is an Objective-C object literal, which also can get
8946  // immediately zapped in a weak reference. Note that we explicitly
8947  // allow ObjCStringLiterals, since those are designed to never really die.
8948  RHS = RHS->IgnoreParenImpCasts();
8949 
8950  // This enum needs to match with the 'select' in
8951  // warn_objc_arc_literal_assign (off-by-1).
8953  if (Kind == Sema::LK_String || Kind == Sema::LK_None)
8954  return false;
8955 
8956  S.Diag(Loc, diag::warn_arc_literal_assign)
8957  << (unsigned) Kind
8958  << (isProperty ? 0 : 1)
8959  << RHS->getSourceRange();
8960 
8961  return true;
8962 }
8963 
8966  Expr *RHS, bool isProperty) {
8967  // Strip off any implicit cast added to get to the one ARC-specific.
8968  while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(RHS)) {
8969  if (cast->getCastKind() == CK_ARCConsumeObject) {
8970  S.Diag(Loc, diag::warn_arc_retained_assign)
8971  << (LT == Qualifiers::OCL_ExplicitNone)
8972  << (isProperty ? 0 : 1)
8973  << RHS->getSourceRange();
8974  return true;
8975  }
8976  RHS = cast->getSubExpr();
8977  }
8978 
8979  if (LT == Qualifiers::OCL_Weak &&
8980  checkUnsafeAssignLiteral(S, Loc, RHS, isProperty))
8981  return true;
8982 
8983  return false;
8984 }
8985 
8987  QualType LHS, Expr *RHS) {
8989 
8991  return false;
8992 
8993  if (checkUnsafeAssignObject(*this, Loc, LT, RHS, false))
8994  return true;
8995 
8996  return false;
8997 }
8998 
9000  Expr *LHS, Expr *RHS) {
9001  QualType LHSType;
9002  // PropertyRef on LHS type need be directly obtained from
9003  // its declaration as it has a PseudoType.
9004  ObjCPropertyRefExpr *PRE
9005  = dyn_cast<ObjCPropertyRefExpr>(LHS->IgnoreParens());
9006  if (PRE && !PRE->isImplicitProperty()) {
9007  const ObjCPropertyDecl *PD = PRE->getExplicitProperty();
9008  if (PD)
9009  LHSType = PD->getType();
9010  }
9011 
9012  if (LHSType.isNull())
9013  LHSType = LHS->getType();
9014 
9016 
9017  if (LT == Qualifiers::OCL_Weak) {
9018  if (!Diags.isIgnored(diag::warn_arc_repeated_use_of_weak, Loc))
9019  getCurFunction()->markSafeWeakUse(LHS);
9020  }
9021 
9022  if (checkUnsafeAssigns(Loc, LHSType, RHS))
9023  return;
9024 
9025  // FIXME. Check for other life times.
9026  if (LT != Qualifiers::OCL_None)
9027  return;
9028 
9029  if (PRE) {
9030  if (PRE->isImplicitProperty())
9031  return;
9032  const ObjCPropertyDecl *PD = PRE->getExplicitProperty();
9033  if (!PD)
9034  return;
9035 
9036  unsigned Attributes = PD->getPropertyAttributes();
9037  if (Attributes & ObjCPropertyDecl::OBJC_PR_assign) {
9038  // when 'assign' attribute was not explicitly specified
9039  // by user, ignore it and rely on property type itself
9040  // for lifetime info.
9041  unsigned AsWrittenAttr = PD->getPropertyAttributesAsWritten();
9042  if (!(AsWrittenAttr & ObjCPropertyDecl::OBJC_PR_assign) &&
9043  LHSType->isObjCRetainableType())
9044  return;
9045 
9046  while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(RHS)) {
9047  if (cast->getCastKind() == CK_ARCConsumeObject) {
9048  Diag(Loc, diag::warn_arc_retained_property_assign)
9049  << RHS->getSourceRange();
9050  return;
9051  }
9052  RHS = cast->getSubExpr();
9053  }
9054  }
9055  else if (Attributes & ObjCPropertyDecl::OBJC_PR_weak) {
9056  if (checkUnsafeAssignObject(*this, Loc, Qualifiers::OCL_Weak, RHS, true))
9057  return;
9058  }
9059  }
9060 }
9061 
9062 //===--- CHECK: Empty statement body (-Wempty-body) ---------------------===//
9063 
9064 namespace {
9065 bool ShouldDiagnoseEmptyStmtBody(const SourceManager &SourceMgr,
9066  SourceLocation StmtLoc,
9067  const NullStmt *Body) {
9068  // Do not warn if the body is a macro that expands to nothing, e.g:
9069  //
9070  // #define CALL(x)
9071  // if (condition)
9072  // CALL(0);
9073  //
9074  if (Body->hasLeadingEmptyMacro())
9075  return false;
9076 
9077  // Get line numbers of statement and body.
9078  bool StmtLineInvalid;
9079  unsigned StmtLine = SourceMgr.getPresumedLineNumber(StmtLoc,
9080  &StmtLineInvalid);
9081  if (StmtLineInvalid)
9082  return false;
9083 
9084  bool BodyLineInvalid;
9085  unsigned BodyLine = SourceMgr.getSpellingLineNumber(Body->getSemiLoc(),
9086  &BodyLineInvalid);
9087  if (BodyLineInvalid)
9088  return false;
9089 
9090  // Warn if null statement and body are on the same line.
9091  if (StmtLine != BodyLine)
9092  return false;
9093 
9094  return true;
9095 }
9096 } // Unnamed namespace
9097 
9099  const Stmt *Body,
9100  unsigned DiagID) {
9101  // Since this is a syntactic check, don't emit diagnostic for template
9102  // instantiations, this just adds noise.
9103  if (CurrentInstantiationScope)
9104  return;
9105 
9106  // The body should be a null statement.
9107  const NullStmt *NBody = dyn_cast<NullStmt>(Body);
9108  if (!NBody)
9109  return;
9110 
9111  // Do the usual checks.
9112  if (!ShouldDiagnoseEmptyStmtBody(SourceMgr, StmtLoc, NBody))
9113  return;
9114 
9115  Diag(NBody->getSemiLoc(), DiagID);
9116  Diag(NBody->getSemiLoc(), diag::note_empty_body_on_separate_line);
9117 }
9118 
9120  const Stmt *PossibleBody) {
9121  assert(!CurrentInstantiationScope); // Ensured by caller
9122 
9123  SourceLocation StmtLoc;
9124  const Stmt *Body;
9125  unsigned DiagID;
9126  if (const ForStmt *FS = dyn_cast<ForStmt>(S)) {
9127  StmtLoc = FS->getRParenLoc();
9128  Body = FS->getBody();
9129  DiagID = diag::warn_empty_for_body;
9130  } else if (const WhileStmt *WS = dyn_cast<WhileStmt>(S)) {
9131  StmtLoc = WS->getCond()->getSourceRange().getEnd();
9132  Body = WS->getBody();
9133  DiagID = diag::warn_empty_while_body;
9134  } else
9135  return; // Neither `for' nor `while'.
9136 
9137  // The body should be a null statement.
9138  const NullStmt *NBody = dyn_cast<NullStmt>(Body);
9139  if (!NBody)
9140  return;
9141 
9142  // Skip expensive checks if diagnostic is disabled.
9143  if (Diags.isIgnored(DiagID, NBody->getSemiLoc()))
9144  return;
9145 
9146  // Do the usual checks.
9147  if (!ShouldDiagnoseEmptyStmtBody(SourceMgr, StmtLoc, NBody))
9148  return;
9149 
9150  // `for(...);' and `while(...);' are popular idioms, so in order to keep
9151  // noise level low, emit diagnostics only if for/while is followed by a
9152  // CompoundStmt, e.g.:
9153  // for (int i = 0; i < n; i++);
9154  // {
9155  // a(i);
9156  // }
9157  // or if for/while is followed by a statement with more indentation
9158  // than for/while itself:
9159  // for (int i = 0; i < n; i++);
9160  // a(i);
9161  bool ProbableTypo = isa<CompoundStmt>(PossibleBody);
9162  if (!ProbableTypo) {
9163  bool BodyColInvalid;
9164  unsigned BodyCol = SourceMgr.getPresumedColumnNumber(
9165  PossibleBody->getLocStart(),
9166  &BodyColInvalid);
9167  if (BodyColInvalid)
9168  return;
9169 
9170  bool StmtColInvalid;
9171  unsigned StmtCol = SourceMgr.getPresumedColumnNumber(
9172  S->getLocStart(),
9173  &StmtColInvalid);
9174  if (StmtColInvalid)
9175  return;
9176 
9177  if (BodyCol > StmtCol)
9178  ProbableTypo = true;
9179  }
9180 
9181  if (ProbableTypo) {
9182  Diag(NBody->getSemiLoc(), DiagID);
9183  Diag(NBody->getSemiLoc(), diag::note_empty_body_on_separate_line);
9184  }
9185 }
9186 
9187 //===--- CHECK: Warn on self move with std::move. -------------------------===//
9188 
9189 /// DiagnoseSelfMove - Emits a warning if a value is moved to itself.
9190 void Sema::DiagnoseSelfMove(const Expr *LHSExpr, const Expr *RHSExpr,
9191  SourceLocation OpLoc) {
9192 
9193  if (Diags.isIgnored(diag::warn_sizeof_pointer_expr_memaccess, OpLoc))
9194  return;
9195 
9196  if (!ActiveTemplateInstantiations.empty())
9197  return;
9198 
9199  // Strip parens and casts away.
9200  LHSExpr = LHSExpr->IgnoreParenImpCasts();
9201  RHSExpr = RHSExpr->IgnoreParenImpCasts();
9202 
9203  // Check for a call expression
9204  const CallExpr *CE = dyn_cast<CallExpr>(RHSExpr);
9205  if (!CE || CE->getNumArgs() != 1)
9206  return;
9207 
9208  // Check for a call to std::move
9209  const FunctionDecl *FD = CE->getDirectCallee();
9210  if (!FD || !FD->isInStdNamespace() || !FD->getIdentifier() ||
9211  !FD->getIdentifier()->isStr("move"))
9212  return;
9213 
9214  // Get argument from std::move
9215  RHSExpr = CE->getArg(0);
9216 
9217  const DeclRefExpr *LHSDeclRef = dyn_cast<DeclRefExpr>(LHSExpr);
9218  const DeclRefExpr *RHSDeclRef = dyn_cast<DeclRefExpr>(RHSExpr);
9219 
9220  // Two DeclRefExpr's, check that the decls are the same.
9221  if (LHSDeclRef && RHSDeclRef) {
9222  if (!LHSDeclRef->getDecl() || !RHSDeclRef->getDecl())
9223  return;
9224  if (LHSDeclRef->getDecl()->getCanonicalDecl() !=
9225  RHSDeclRef->getDecl()->getCanonicalDecl())
9226  return;
9227 
9228  Diag(OpLoc, diag::warn_self_move) << LHSExpr->getType()
9229  << LHSExpr->getSourceRange()
9230  << RHSExpr->getSourceRange();
9231  return;
9232  }
9233 
9234  // Member variables require a different approach to check for self moves.
9235  // MemberExpr's are the same if every nested MemberExpr refers to the same
9236  // Decl and that the base Expr's are DeclRefExpr's with the same Decl or
9237  // the base Expr's are CXXThisExpr's.
9238  const Expr *LHSBase = LHSExpr;
9239  const Expr *RHSBase = RHSExpr;
9240  const MemberExpr *LHSME = dyn_cast<MemberExpr>(LHSExpr);
9241  const MemberExpr *RHSME = dyn_cast<MemberExpr>(RHSExpr);
9242  if (!LHSME || !RHSME)
9243  return;
9244 
9245  while (LHSME && RHSME) {
9246  if (LHSME->getMemberDecl()->getCanonicalDecl() !=
9247  RHSME->getMemberDecl()->getCanonicalDecl())
9248  return;
9249 
9250  LHSBase = LHSME->getBase();
9251  RHSBase = RHSME->getBase();
9252  LHSME = dyn_cast<MemberExpr>(LHSBase);
9253  RHSME = dyn_cast<MemberExpr>(RHSBase);
9254  }
9255 
9256  LHSDeclRef = dyn_cast<DeclRefExpr>(LHSBase);
9257  RHSDeclRef = dyn_cast<DeclRefExpr>(RHSBase);
9258  if (LHSDeclRef && RHSDeclRef) {
9259  if (!LHSDeclRef->getDecl() || !RHSDeclRef->getDecl())
9260  return;
9261  if (LHSDeclRef->getDecl()->getCanonicalDecl() !=
9262  RHSDeclRef->getDecl()->getCanonicalDecl())
9263  return;
9264 
9265  Diag(OpLoc, diag::warn_self_move) << LHSExpr->getType()
9266  << LHSExpr->getSourceRange()
9267  << RHSExpr->getSourceRange();
9268  return;
9269  }
9270 
9271  if (isa<CXXThisExpr>(LHSBase) && isa<CXXThisExpr>(RHSBase))
9272  Diag(OpLoc, diag::warn_self_move) << LHSExpr->getType()
9273  << LHSExpr->getSourceRange()
9274  << RHSExpr->getSourceRange();
9275 }
9276 
9277 //===--- Layout compatibility ----------------------------------------------//
9278 
9279 namespace {
9280 
9281 bool isLayoutCompatible(ASTContext &C, QualType T1, QualType T2);
9282 
9283 /// \brief Check if two enumeration types are layout-compatible.
9284 bool isLayoutCompatible(ASTContext &C, EnumDecl *ED1, EnumDecl *ED2) {
9285  // C++11 [dcl.enum] p8:
9286  // Two enumeration types are layout-compatible if they have the same
9287  // underlying type.
9288  return ED1->isComplete() && ED2->isComplete() &&
9289  C.hasSameType(ED1->getIntegerType(), ED2->getIntegerType());
9290 }
9291 
9292 /// \brief Check if two fields are layout-compatible.
9293 bool isLayoutCompatible(ASTContext &C, FieldDecl *Field1, FieldDecl *Field2) {
9294  if (!isLayoutCompatible(C, Field1->getType(), Field2->getType()))
9295  return false;
9296 
9297  if (Field1->isBitField() != Field2->isBitField())
9298  return false;
9299 
9300  if (Field1->isBitField()) {
9301  // Make sure that the bit-fields are the same length.
9302  unsigned Bits1 = Field1->getBitWidthValue(C);
9303  unsigned Bits2 = Field2->getBitWidthValue(C);
9304 
9305  if (Bits1 != Bits2)
9306  return false;
9307  }
9308 
9309  return true;
9310 }
9311 
9312 /// \brief Check if two standard-layout structs are layout-compatible.
9313 /// (C++11 [class.mem] p17)
9314 bool isLayoutCompatibleStruct(ASTContext &C,
9315  RecordDecl *RD1,
9316  RecordDecl *RD2) {
9317  // If both records are C++ classes, check that base classes match.
9318  if (const CXXRecordDecl *D1CXX = dyn_cast<CXXRecordDecl>(RD1)) {
9319  // If one of records is a CXXRecordDecl we are in C++ mode,
9320  // thus the other one is a CXXRecordDecl, too.
9321  const CXXRecordDecl *D2CXX = cast<CXXRecordDecl>(RD2);
9322  // Check number of base classes.
9323  if (D1CXX->getNumBases() != D2CXX->getNumBases())
9324  return false;
9325 
9326  // Check the base classes.
9328  Base1 = D1CXX->bases_begin(),
9329  BaseEnd1 = D1CXX->bases_end(),
9330  Base2 = D2CXX->bases_begin();
9331  Base1 != BaseEnd1;
9332  ++Base1, ++Base2) {
9333  if (!isLayoutCompatible(C, Base1->getType(), Base2->getType()))
9334  return false;
9335  }
9336  } else if (const CXXRecordDecl *D2CXX = dyn_cast<CXXRecordDecl>(RD2)) {
9337  // If only RD2 is a C++ class, it should have zero base classes.
9338  if (D2CXX->getNumBases() > 0)
9339  return false;
9340  }
9341 
9342  // Check the fields.
9343  RecordDecl::field_iterator Field2 = RD2->field_begin(),
9344  Field2End = RD2->field_end(),
9345  Field1 = RD1->field_begin(),
9346  Field1End = RD1->field_end();
9347  for ( ; Field1 != Field1End && Field2 != Field2End; ++Field1, ++Field2) {
9348  if (!isLayoutCompatible(C, *Field1, *Field2))
9349  return false;
9350  }
9351  if (Field1 != Field1End || Field2 != Field2End)
9352  return false;
9353 
9354  return true;
9355 }
9356 
9357 /// \brief Check if two standard-layout unions are layout-compatible.
9358 /// (C++11 [class.mem] p18)
9359 bool isLayoutCompatibleUnion(ASTContext &C,
9360  RecordDecl *RD1,
9361  RecordDecl *RD2) {
9362  llvm::SmallPtrSet<FieldDecl *, 8> UnmatchedFields;
9363  for (auto *Field2 : RD2->fields())
9364  UnmatchedFields.insert(Field2);
9365 
9366  for (auto *Field1 : RD1->fields()) {
9367  llvm::SmallPtrSet<FieldDecl *, 8>::iterator
9368  I = UnmatchedFields.begin(),
9369  E = UnmatchedFields.end();
9370 
9371  for ( ; I != E; ++I) {
9372  if (isLayoutCompatible(C, Field1, *I)) {
9373  bool Result = UnmatchedFields.erase(*I);
9374  (void) Result;
9375  assert(Result);
9376  break;
9377  }
9378  }
9379  if (I == E)
9380  return false;
9381  }
9382 
9383  return UnmatchedFields.empty();
9384 }
9385 
9386 bool isLayoutCompatible(ASTContext &C, RecordDecl *RD1, RecordDecl *RD2) {
9387  if (RD1->isUnion() != RD2->isUnion())
9388  return false;
9389 
9390  if (RD1->isUnion())
9391  return isLayoutCompatibleUnion(C, RD1, RD2);
9392  else
9393  return isLayoutCompatibleStruct(C, RD1, RD2);
9394 }
9395 
9396 /// \brief Check if two types are layout-compatible in C++11 sense.
9397 bool isLayoutCompatible(ASTContext &C, QualType T1, QualType T2) {
9398  if (T1.isNull() || T2.isNull())
9399  return false;
9400 
9401  // C++11 [basic.types] p11:
9402  // If two types T1 and T2 are the same type, then T1 and T2 are
9403  // layout-compatible types.
9404  if (C.hasSameType(T1, T2))
9405  return true;
9406 
9409 
9410  const Type::TypeClass TC1 = T1->getTypeClass();
9411  const Type::TypeClass TC2 = T2->getTypeClass();
9412 
9413  if (TC1 != TC2)
9414  return false;
9415 
9416  if (TC1 == Type::Enum) {
9417  return isLayoutCompatible(C,
9418  cast<EnumType>(T1)->getDecl(),
9419  cast<EnumType>(T2)->getDecl());
9420  } else if (TC1 == Type::Record) {
9421  if (!T1->isStandardLayoutType() || !T2->isStandardLayoutType())
9422  return false;
9423 
9424  return isLayoutCompatible(C,
9425  cast<RecordType>(T1)->getDecl(),
9426  cast<RecordType>(T2)->getDecl());
9427  }
9428 
9429  return false;
9430 }
9431 }
9432 
9433 //===--- CHECK: pointer_with_type_tag attribute: datatypes should match ----//
9434 
9435 namespace {
9436 /// \brief Given a type tag expression find the type tag itself.
9437 ///
9438 /// \param TypeExpr Type tag expression, as it appears in user's code.
9439 ///
9440 /// \param VD Declaration of an identifier that appears in a type tag.
9441 ///
9442 /// \param MagicValue Type tag magic value.
9443 bool FindTypeTagExpr(const Expr *TypeExpr, const ASTContext &Ctx,
9444  const ValueDecl **VD, uint64_t *MagicValue) {
9445  while(true) {
9446  if (!TypeExpr)
9447  return false;
9448 
9449  TypeExpr = TypeExpr->IgnoreParenImpCasts()->IgnoreParenCasts();
9450 
9451  switch (TypeExpr->getStmtClass()) {
9452  case Stmt::UnaryOperatorClass: {
9453  const UnaryOperator *UO = cast<UnaryOperator>(TypeExpr);
9454  if (UO->getOpcode() == UO_AddrOf || UO->getOpcode() == UO_Deref) {
9455  TypeExpr = UO->getSubExpr();
9456  continue;
9457  }
9458  return false;
9459  }
9460 
9461  case Stmt::DeclRefExprClass: {
9462  const DeclRefExpr *DRE = cast<DeclRefExpr>(TypeExpr);
9463  *VD = DRE->getDecl();
9464  return true;
9465  }
9466 
9467  case Stmt::IntegerLiteralClass: {
9468  const IntegerLiteral *IL = cast<IntegerLiteral>(TypeExpr);
9469  llvm::APInt MagicValueAPInt = IL->getValue();
9470  if (MagicValueAPInt.getActiveBits() <= 64) {
9471  *MagicValue = MagicValueAPInt.getZExtValue();
9472  return true;
9473  } else
9474  return false;
9475  }
9476 
9477  case Stmt::BinaryConditionalOperatorClass:
9478  case Stmt::ConditionalOperatorClass: {
9479  const AbstractConditionalOperator *ACO =
9480  cast<AbstractConditionalOperator>(TypeExpr);
9481  bool Result;
9482  if (ACO->getCond()->EvaluateAsBooleanCondition(Result, Ctx)) {
9483  if (Result)
9484  TypeExpr = ACO->getTrueExpr();
9485  else
9486  TypeExpr = ACO->getFalseExpr();
9487  continue;
9488  }
9489  return false;
9490  }
9491 
9492  case Stmt::BinaryOperatorClass: {
9493  const BinaryOperator *BO = cast<BinaryOperator>(TypeExpr);
9494  if (BO->getOpcode() == BO_Comma) {
9495  TypeExpr = BO->getRHS();
9496  continue;
9497  }
9498  return false;
9499  }
9500 
9501  default:
9502  return false;
9503  }
9504  }
9505 }
9506 
9507 /// \brief Retrieve the C type corresponding to type tag TypeExpr.
9508 ///
9509 /// \param TypeExpr Expression that specifies a type tag.
9510 ///
9511 /// \param MagicValues Registered magic values.
9512 ///
9513 /// \param FoundWrongKind Set to true if a type tag was found, but of a wrong
9514 /// kind.
9515 ///
9516 /// \param TypeInfo Information about the corresponding C type.
9517 ///
9518 /// \returns true if the corresponding C type was found.
9519 bool GetMatchingCType(
9520  const IdentifierInfo *ArgumentKind,
9521  const Expr *TypeExpr, const ASTContext &Ctx,
9522  const llvm::DenseMap<Sema::TypeTagMagicValue,
9523  Sema::TypeTagData> *MagicValues,
9524  bool &FoundWrongKind,
9526  FoundWrongKind = false;
9527 
9528  // Variable declaration that has type_tag_for_datatype attribute.
9529  const ValueDecl *VD = nullptr;
9530 
9531  uint64_t MagicValue;
9532 
9533  if (!FindTypeTagExpr(TypeExpr, Ctx, &VD, &MagicValue))
9534  return false;
9535 
9536  if (VD) {
9537  if (TypeTagForDatatypeAttr *I = VD->getAttr<TypeTagForDatatypeAttr>()) {
9538  if (I->getArgumentKind() != ArgumentKind) {
9539  FoundWrongKind = true;
9540  return false;
9541  }
9542  TypeInfo.Type = I->getMatchingCType();
9543  TypeInfo.LayoutCompatible = I->getLayoutCompatible();
9544  TypeInfo.MustBeNull = I->getMustBeNull();
9545  return true;
9546  }
9547  return false;
9548  }
9549 
9550  if (!MagicValues)
9551  return false;
9552 
9553  llvm::DenseMap<Sema::TypeTagMagicValue,
9554  Sema::TypeTagData>::const_iterator I =
9555  MagicValues->find(std::make_pair(ArgumentKind, MagicValue));
9556  if (I == MagicValues->end())
9557  return false;
9558 
9559  TypeInfo = I->second;
9560  return true;
9561 }
9562 } // unnamed namespace
9563 
9565  uint64_t MagicValue, QualType Type,
9566  bool LayoutCompatible,
9567  bool MustBeNull) {
9568  if (!TypeTagForDatatypeMagicValues)
9569  TypeTagForDatatypeMagicValues.reset(
9570  new llvm::DenseMap<TypeTagMagicValue, TypeTagData>);
9571 
9572  TypeTagMagicValue Magic(ArgumentKind, MagicValue);
9573  (*TypeTagForDatatypeMagicValues)[Magic] =
9574  TypeTagData(Type, LayoutCompatible, MustBeNull);
9575 }
9576 
9577 namespace {
9578 bool IsSameCharType(QualType T1, QualType T2) {
9579  const BuiltinType *BT1 = T1->getAs<BuiltinType>();
9580  if (!BT1)
9581  return false;
9582 
9583  const BuiltinType *BT2 = T2->getAs<BuiltinType>();
9584  if (!BT2)
9585  return false;
9586 
9587  BuiltinType::Kind T1Kind = BT1->getKind();
9588  BuiltinType::Kind T2Kind = BT2->getKind();
9589 
9590  return (T1Kind == BuiltinType::SChar && T2Kind == BuiltinType::Char_S) ||
9591  (T1Kind == BuiltinType::UChar && T2Kind == BuiltinType::Char_U) ||
9592  (T1Kind == BuiltinType::Char_U && T2Kind == BuiltinType::UChar) ||
9593  (T1Kind == BuiltinType::Char_S && T2Kind == BuiltinType::SChar);
9594 }
9595 } // unnamed namespace
9596 
9597 void Sema::CheckArgumentWithTypeTag(const ArgumentWithTypeTagAttr *Attr,
9598  const Expr * const *ExprArgs) {
9599  const IdentifierInfo *ArgumentKind = Attr->getArgumentKind();
9600  bool IsPointerAttr = Attr->getIsPointer();
9601 
9602  const Expr *TypeTagExpr = ExprArgs[Attr->getTypeTagIdx()];
9603  bool FoundWrongKind;
9604  TypeTagData TypeInfo;
9605  if (!GetMatchingCType(ArgumentKind, TypeTagExpr, Context,
9606  TypeTagForDatatypeMagicValues.get(),
9607  FoundWrongKind, TypeInfo)) {
9608  if (FoundWrongKind)
9609  Diag(TypeTagExpr->getExprLoc(),
9610  diag::warn_type_tag_for_datatype_wrong_kind)
9611  << TypeTagExpr->getSourceRange();
9612  return;
9613  }
9614 
9615  const Expr *ArgumentExpr = ExprArgs[Attr->getArgumentIdx()];
9616  if (IsPointerAttr) {
9617  // Skip implicit cast of pointer to `void *' (as a function argument).
9618  if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(ArgumentExpr))
9619  if (ICE->getType()->isVoidPointerType() &&
9620  ICE->getCastKind() == CK_BitCast)
9621  ArgumentExpr = ICE->getSubExpr();
9622  }
9623  QualType ArgumentType = ArgumentExpr->getType();
9624 
9625  // Passing a `void*' pointer shouldn't trigger a warning.
9626  if (IsPointerAttr && ArgumentType->isVoidPointerType())
9627  return;
9628 
9629  if (TypeInfo.MustBeNull) {
9630  // Type tag with matching void type requires a null pointer.
9631  if (!ArgumentExpr->isNullPointerConstant(Context,
9633  Diag(ArgumentExpr->getExprLoc(),
9634  diag::warn_type_safety_null_pointer_required)
9635  << ArgumentKind->getName()
9636  << ArgumentExpr->getSourceRange()
9637  << TypeTagExpr->getSourceRange();
9638  }
9639  return;
9640  }
9641 
9642  QualType RequiredType = TypeInfo.Type;
9643  if (IsPointerAttr)
9644  RequiredType = Context.getPointerType(RequiredType);
9645 
9646  bool mismatch = false;
9647  if (!TypeInfo.LayoutCompatible) {
9648  mismatch = !Context.hasSameType(ArgumentType, RequiredType);
9649 
9650  // C++11 [basic.fundamental] p1:
9651  // Plain char, signed char, and unsigned char are three distinct types.
9652  //
9653  // But we treat plain `char' as equivalent to `signed char' or `unsigned
9654  // char' depending on the current char signedness mode.
9655  if (mismatch)
9656  if ((IsPointerAttr && IsSameCharType(ArgumentType->getPointeeType(),
9657  RequiredType->getPointeeType())) ||
9658  (!IsPointerAttr && IsSameCharType(ArgumentType, RequiredType)))
9659  mismatch = false;
9660  } else
9661  if (IsPointerAttr)
9662  mismatch = !isLayoutCompatible(Context,
9663  ArgumentType->getPointeeType(),
9664  RequiredType->getPointeeType());
9665  else
9666  mismatch = !isLayoutCompatible(Context, ArgumentType, RequiredType);
9667 
9668  if (mismatch)
9669  Diag(ArgumentExpr->getExprLoc(), diag::warn_type_safety_type_mismatch)
9670  << ArgumentType << ArgumentKind
9671  << TypeInfo.LayoutCompatible << RequiredType
9672  << ArgumentExpr->getSourceRange()
9673  << TypeTagExpr->getSourceRange();
9674 }
9675 
const OptionalFlag & hasSpacePrefix() const
Definition: FormatString.h:510
Kind getKind() const
Definition: Type.h:2006
unsigned getFlags() const
Definition: Scope.h:207
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1006
static void diagnoseArrayStarInParamType(Sema &S, QualType PType, SourceLocation Loc)
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
Definition: Expr.h:2411
static FormatStringType GetFormatStringType(const FormatAttr *Format)
Defines the clang::ASTContext interface.
unsigned getNumInits() const
Definition: Expr.h:3789
VariadicCallType
Definition: Sema.h:8080
SourceLocation getEnd() const
static std::pair< QualType, StringRef > shouldNotPrintDirectly(const ASTContext &Context, QualType IntendedTy, const Expr *E)
const Expr * getBase() const
Definition: ExprObjC.h:504
T getAs() const
Convert to the specified TypeLoc type, returning a null TypeLoc if this TypeLoc is not of the desired...
Definition: TypeLoc.h:64
CastKind getCastKind() const
Definition: Expr.h:2709
ObjCStringFormatFamily
CanQualType LongLongTy
Definition: ASTContext.h:825
bool isVariadic() const
Definition: Type.h:3228
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
Definition: ASTMatchers.h:1110
Expr ** getArgs()
Retrieve the call arguments.
Definition: Expr.h:2208
static DiagnosticBuilder Diag(DiagnosticsEngine *Diags, const LangOptions &Features, FullSourceLoc TokLoc, const char *TokBegin, const char *TokRangeBegin, const char *TokRangeEnd, unsigned DiagID)
Produce a diagnostic highlighting some portion of a literal.
bool isVector() const
Definition: APValue.h:187
The receiver is an object instance.
Definition: ExprObjC.h:1002
Scope * getCurScope() const
Retrieve the parser's current scope.
Definition: Sema.h:8979
bool isNullPtrType() const
Definition: Type.h:5439
StringRef getName() const
Definition: Decl.h:168
static void CheckReturnStackAddr(Sema &S, Expr *RetValExp, QualType lhsType, SourceLocation ReturnLoc)
#define BUILTIN_ROW(x)
Smart pointer class that efficiently represents Objective-C method names.
bool canDecayToPointerType() const
Determines whether this type can decay to a pointer type.
Definition: Type.h:5507
EvaluatedExprVisitor - This class visits 'Expr *'s.
CanQualType VoidPtrTy
Definition: ASTContext.h:831
static llvm::SmallPtrSet< MemberKind *, 1 > CXXRecordMembersNamed(StringRef Name, Sema &S, QualType Ty)
bool isAtLeastAsQualifiedAs(QualType Other) const
Determine whether this type is at least as qualified as the other given type, requiring exact equalit...
Definition: Type.h:5169
bool isInvalid() const
Definition: Ownership.h:159
bool isMacroID() const
bool isCanonicalUnqualified() const
Definition: Type.h:1512
bool isSpecificBuiltinType(unsigned K) const
isSpecificBuiltinType - Test for a particular builtin type.
Definition: Type.h:5393
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2216
bool isVariadic() const
Definition: Decl.h:3499
bool isBitField() const
Determines whether this field is a bitfield.
Definition: Decl.h:2330
ArrayRef< QualType > getTypeArgs() const
Retrieve the type arguments for this type.
Definition: Type.h:4888
bool hasLeadingEmptyMacro() const
Definition: Stmt.h:538
FormatStringType
Definition: Sema.h:8820
bool isMemberPointerType() const
Definition: Type.h:5256
IdentifierInfo * getIdentifier() const
Definition: Decl.h:163
bool isOne() const
isOne - Test whether the quantity equals one.
Definition: CharUnits.h:119
const LangOptions & getLangOpts() const
Definition: Sema.h:1019
bool LookupName(LookupResult &R, Scope *S, bool AllowBuiltinCreation=false)
Perform unqualified name lookup starting from a given scope.
SourceLocation getSpellingLoc(SourceLocation Loc) const
Given a SourceLocation object, return the spelling location referenced by the ID. ...
static bool IsFunctionStdAbs(const FunctionDecl *FDecl)
Optional< LengthModifier > getCorrectedLengthModifier() const
static Optional< int > GetNSMutableArrayArgumentIndex(Sema &S, ObjCMessageExpr *Message)
CanQualType getSizeType() const
Return the unique type for "size_t" (C99 7.17), defined in <stddef.h>.
unsigned getIntWidth(QualType T) const
const ScanfConversionSpecifier & getConversionSpecifier() const
Definition: FormatString.h:580
const Scope * getParent() const
Definition: Scope.h:215
static StringLiteralCheckType checkFormatStringExpr(Sema &S, const Expr *E, ArrayRef< const Expr * > Args, bool HasVAListArg, unsigned format_idx, unsigned firstDataArg, Sema::FormatStringType Type, Sema::VariadicCallType CallType, bool InFunctionCall, llvm::SmallBitVector &CheckedVarArgs)
void addConst()
addConst - add the specified type qualifier to this QualType.
Definition: Type.h:733
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:163
bool hasStandardConversionSpecifier(const LangOptions &LangOpt) const
const LengthModifier & getLengthModifier() const
Definition: FormatString.h:368
bool isRecordType() const
Definition: Type.h:5289
unsigned getSpellingLineNumber(SourceLocation Loc, bool *Invalid=nullptr) const
SemaDiagnosticBuilder Diag(SourceLocation Loc, unsigned DiagID)
Emit a diagnostic.
Definition: Sema.h:1088
bool isInteger() const
Definition: Type.h:2018
arg_iterator arg_begin()
Definition: ExprCXX.h:1189
void setType(QualType t)
Definition: Expr.h:126
param_iterator param_end()
Definition: Decl.h:3525
bool isVoidPointerType() const
Definition: Type.cpp:384
static bool referToTheSameDecl(const Expr *E1, const Expr *E2)
Check if two expressions refer to the same declaration.
const OptionalFlag & hasLeadingZeros() const
Definition: FormatString.h:509
bool isEnumeralType() const
Definition: Type.h:5292
PtrTy get() const
Definition: Ownership.h:163
bool isInStdNamespace() const
Definition: DeclBase.cpp:265
bool isDependentContext() const
Determines whether this context is dependent on a template parameter.
Definition: DeclBase.cpp:851
unsigned getPresumedLineNumber(SourceLocation Loc, bool *Invalid=nullptr) const
#define log2(__x)
Definition: tgmath.h:977
CanQualType LongTy
Definition: ASTContext.h:825
bool capturesVariable(const VarDecl *var) const
Definition: Decl.cpp:3782
NSDictionaryMethodKind
Enumerates the NSDictionary/NSMutableDictionary methods used to generate literals and to apply some c...
Definition: NSAPI.h:100
NamespaceDecl - Represent a C++ namespace.
Definition: Decl.h:400
SourceLocation getLocForEndOfToken(SourceLocation Loc, unsigned Offset=0)
Calls Lexer::getLocForEndOfToken()
Definition: Sema.cpp:47
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1075
Wrapper for source info for typedefs.
Definition: TypeLoc.h:612
static AbsoluteValueKind getAbsoluteValueKind(QualType T)
bool isBooleanType() const
Definition: Type.h:5489
A container of type source information.
Definition: Decl.h:60
SourceLocation getOperatorLoc() const
Definition: Expr.h:2958
SourceLocation getLocStart() const LLVM_READONLY
Definition: Expr.h:1607
bool isBlockPointerType() const
Definition: Type.h:5238
[ARC] Consumes a retainable object pointer that has just been produced, e.g. as the return value of a...
bool isInSystemMacro(SourceLocation loc)
Returns whether Loc is expanded from a macro in a system header.
bool HasSideEffects(const ASTContext &Ctx, bool IncludePossibleEffects=true) const
Definition: Expr.cpp:2912
static bool checkArgCount(Sema &S, CallExpr *call, unsigned desiredArgCount)
bool hasUnsignedIntegerRepresentation() const
Determine whether this type has an unsigned integer representation of some sort, e.g., it is an unsigned integer type or a vector.
Definition: Type.cpp:1753
CanQualType HalfTy
Definition: ASTContext.h:829
const llvm::APInt & getSize() const
Definition: Type.h:2472
static unsigned changeAbsFunction(unsigned AbsKind, AbsoluteValueKind ValueKind)
bool isValidPointerAttrType(QualType T, bool RefOkay=false)
ObjCDictionaryElement getKeyValueElement(unsigned Index) const
Definition: ExprObjC.h:316
PartialDiagnostic PDiag(unsigned DiagID=0)
Build a partial diagnostic.
Definition: SemaInternal.h:25
DiagnosticsEngine & Diags
Definition: Sema.h:297
const Expr * getCallee() const
Definition: Expr.h:2188
bool areArgsDestroyedLeftToRightInCallee() const
Definition: TargetCXXABI.h:163
APFloat & getComplexFloatReal()
Definition: APValue.h:232
ArgType getArgType(ASTContext &Ctx, bool IsObjCLiteral) const
Returns the builtin type that a data argument paired with this format specifier should have...
ExtProtoInfo - Extra information about a function prototype.
Definition: Type.h:3042
field_iterator field_begin() const
Definition: Decl.cpp:3629
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
Definition: ASTContext.h:1701
Expr * IgnoreImplicit() LLVM_READONLY
Definition: Expr.h:694
CK_Dynamic - A C++ dynamic_cast.
Like System, but searched after the system directories.
Defines the Objective-C statement AST node classes.
static bool isAssignmentOp(Opcode Opc)
Definition: Expr.h:3040
AssignConvertType CheckSingleAssignmentConstraints(QualType LHSType, ExprResult &RHS, bool Diagnose=true, bool DiagnoseCFAudited=false)
Definition: SemaExpr.cpp:7114
ParmVarDecl - Represents a parameter to a function.
Definition: Decl.h:1334
bool isObjCRetainableType() const
Definition: Type.cpp:3542
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
Definition: Expr.cpp:3225
Defines the clang::Expr interface and subclasses for C++ expressions.
ObjCInterfaceDecl * NSDictionaryDecl
The declaration of the Objective-C NSDictionary class.
Definition: Sema.h:736
SourceLocation getLocation() const
Definition: Expr.h:1002
static bool CheckMemorySizeofForComparison(Sema &S, const Expr *E, IdentifierInfo *FnName, SourceLocation FnLoc, SourceLocation RParenLoc)
Takes the expression passed to the size_t parameter of functions such as memcmp, strncat, etc and warns if it's a comparison.
Parse and apply any fixits to the source.
bool isVoidType() const
Definition: Type.h:5426
QualType getType() const
Definition: DeclObjC.h:2505
FieldDecl * getSourceBitField()
If this expression refers to a bit-field, retrieve the declaration of that bit-field.
Definition: Expr.cpp:3371
QualType withConst() const
Retrieves a version of this type with const applied. Note that this does not always yield a canonical...
static bool checkUnsafeAssignObject(Sema &S, SourceLocation Loc, Qualifiers::ObjCLifetime LT, Expr *RHS, bool isProperty)
static bool requiresParensToAddCast(const Expr *E)
Base wrapper for a particular "section" of type source info.
Definition: TypeLoc.h:40
Expr * IgnoreImpCasts() LLVM_READONLY
Definition: Expr.h:2803
unsigned getNumParams() const
Definition: Type.h:3133
static bool CheckForReference(Sema &SemaRef, const Expr *E, PartialDiagnostic PD)
ExprResult UsualUnaryConversions(Expr *E)
Definition: SemaExpr.cpp:736
std::unique_ptr< NSAPI > NSAPIObj
Caches identifiers/selectors for NSFoundation APIs.
Definition: Sema.h:700
bool isScalarType() const
Definition: Type.h:5461
bool isComplexInt() const
Definition: APValue.h:184
bool hasAttr() const
Definition: DeclBase.h:487
bool isVariablyModifiedType() const
Whether this type is a variably-modified type (C99 6.7.5).
Definition: Type.h:1742
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:89
ArrayRef< QualType > getParamTypes() const
Definition: Type.h:3138
bool isReferenceType() const
Definition: Type.h:5241
QualType getReturnType() const
Definition: Decl.h:1997
virtual bool validateCpuSupports(StringRef Name) const
bool ParseScanfString(FormatStringHandler &H, const char *beg, const char *end, const LangOptions &LO, const TargetInfo &Target)
bool isCompleteDefinition() const
Definition: Decl.h:2838
bool isAnyPointerType() const
Definition: Type.h:5235
static bool isValidOrderingForOp(int64_t Ordering, AtomicExpr::AtomicOp Op)
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
Definition: ASTMatchers.h:258
CXXRecordDecl * getDefinition() const
Definition: DeclCXX.h:675
void setArg(unsigned Arg, Expr *ArgExpr)
setArg - Set the specified argument.
Definition: Expr.h:2226
bool hasSameType(QualType T1, QualType T2) const
Determine whether the given types T1 and T2 are equivalent.
Definition: ASTContext.h:1871
bool isInlineNamespace() const
Definition: DeclBase.cpp:830
static DeclRefExpr * Create(const ASTContext &Context, NestedNameSpecifierLoc QualifierLoc, SourceLocation TemplateKWLoc, ValueDecl *D, bool RefersToEnclosingVariableOrCapture, SourceLocation NameLoc, QualType T, ExprValueKind VK, NamedDecl *FoundD=nullptr, const TemplateArgumentListInfo *TemplateArgs=nullptr)
Definition: Expr.cpp:367
const RecordType * getAsUnionType() const
NOTE: getAs*ArrayType are methods on ASTContext.
Definition: Type.cpp:449
Stmt * getBody() const override
Definition: Decl.h:3503
Expr * getSubExpr()
Definition: Expr.h:2713
QualType getTypeDeclType(const TypeDecl *Decl, const TypeDecl *PrevDecl=nullptr) const
Return the unique reference to the type for the specified type declaration.
Definition: ASTContext.h:1114
bool hasSameUnqualifiedType(QualType T1, QualType T2) const
Determine whether the given types are equivalent after cvr-qualifiers have been removed.
Definition: ASTContext.h:1896
SourceLocation getRParenLoc() const
Definition: Expr.h:2283
void DiagnoseEmptyLoopBody(const Stmt *S, const Stmt *PossibleBody)
Optional< ConversionSpecifier > getStandardSpecifier() const
IdentifierTable & Idents
Definition: ASTContext.h:439
static Optional< int > GetNSSetArgumentIndex(Sema &S, ObjCMessageExpr *Message)
An r-value expression (a pr-value in the C++11 taxonomy) produces a temporary value.
Definition: Specifiers.h:95
SourceLocation getSuperLoc() const
Retrieve the location of the 'super' keyword for a class or instance message to 'super', otherwise an invalid source location.
Definition: ExprObjC.h:1193
Expr * getLHS() const
Definition: Expr.h:2964
T * getAttr() const
Definition: DeclBase.h:484
Describes an C or C++ initializer list.
Definition: Expr.h:3759
BinaryOperatorKind
static bool isEqualityOp(Opcode Opc)
Definition: Expr.h:3004
Represents the results of name lookup.
Definition: Lookup.h:30
const TargetInfo & getTargetInfo() const
Definition: ASTContext.h:518
SourceLocation getLocWithOffset(int Offset) const
Return a source location with the specified offset from this SourceLocation.
QualType getOriginalType() const
Definition: Decl.cpp:2285
Expr * getTrueExpr() const
Definition: Expr.h:3344
ObjCMethodDecl * getCurMethodDecl()
Definition: Sema.cpp:924
bool isImplicit() const
Definition: DeclBase.h:503
APValue Val
Val - This is the value the expression can be folded to.
Definition: Expr.h:557
SmallVector< CharSourceRange, 8 > Ranges
Definition: Format.cpp:1554
unsigned getMinRequiredArguments() const
Definition: Decl.cpp:2694
void CheckFormatString(const StringLiteral *FExpr, const Expr *OrigFormatExpr, ArrayRef< const Expr * > Args, bool HasVAListArg, unsigned format_idx, unsigned firstDataArg, FormatStringType Type, bool inFunctionCall, VariadicCallType CallType, llvm::SmallBitVector &CheckedVarArgs)
QualType GetBuiltinType(unsigned ID, GetBuiltinTypeError &Error, unsigned *IntegerConstantArgs=nullptr) const
Return the type for the specified builtin.
SourceLocation getImmediateMacroCallerLoc(SourceLocation Loc) const
bool isSuperReceiver() const
Definition: ExprObjC.h:695
bool isQuad() const
static bool isNonNullType(ASTContext &ctx, QualType type)
Determine whether the given type has a non-null nullability annotation.
field_range fields() const
Definition: Decl.h:3349
unsigned LayoutCompatible
Definition: Sema.h:8921
bool isMacroBodyExpansion(SourceLocation Loc) const
Tests whether the given source location represents the expansion of a macro body. ...
const ArrayType * getAsArrayType(QualType T) const
TypeOfExprType (GCC extension).
Definition: Type.h:3357
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2918
bool isUnsigned() const
Selector getSelector() const
Definition: Expr.cpp:3718
bool isValueDependent() const
Definition: Expr.h:146
RecordDecl * getDecl() const
Definition: Type.h:3527
bool isUnsignedIntegerType() const
Definition: Type.cpp:1723
Expr * IgnoreParenCasts() LLVM_READONLY
Definition: Expr.cpp:2439
Values of this type can never be null.
NSSetMethodKind
Enumerates the NSMutableSet/NSOrderedSet methods used to apply some checks.
Definition: NSAPI.h:125
Expr * getLHS() const
Definition: Expr.h:3233
bool isWeak() const
Determine whether this symbol is weakly-imported, or declared with the weak or weak-ref attr...
Definition: Decl.cpp:3840
TypeClass getTypeClass() const
Definition: Type.h:1486
base_class_iterator bases_begin()
Definition: DeclCXX.h:720
bool isIncompleteType(NamedDecl **Def=nullptr) const
Def If non-NULL, and the type refers to some kind of declaration that can be completed (such as a C s...
Definition: Type.cpp:1869
QualType withVolatile() const
Definition: Type.h:744
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
const char * getHeaderName(unsigned ID) const
If this is a library function that comes from a specific header, retrieve that header name...
Definition: Builtins.h:158
An ordinary object is located at an address in memory.
Definition: Specifiers.h:111
SmallVector< BoundNodes, 1 > match(MatcherT Matcher, const NodeT &Node, ASTContext &Context)
Returns the results of matching Matcher on Node.
static const CXXRecordDecl * getContainedDynamicClass(QualType T, bool &IsContained)
Determine whether the given type is or contains a dynamic class type (e.g., whether it has a vtable)...
const Expr * getBase() const
Definition: ExprObjC.h:677
bool fixType(QualType QT, QualType RawQT, const LangOptions &LangOpt, ASTContext &Ctx)
Expression is a GNU-style __null constant.
Definition: Expr.h:651
static void diagnoseRetainCycle(Sema &S, Expr *capturer, RetainCycleOwner &owner)
PropertyAttributeKind getPropertyAttributes() const
Definition: DeclObjC.h:2516
APSInt & getComplexIntReal()
Definition: APValue.h:216
QualType getCanonicalTypeInternal() const
Definition: Type.h:1951
CanQualType UnsignedCharTy
Definition: ASTContext.h:826
QualType getType() const
Definition: Decl.h:538
bool isInvalid() const
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclBase.h:733
arg_iterator arg_end()
Definition: Expr.h:2247
field_iterator field_end() const
Definition: Decl.h:3352
APValue & getVectorElt(unsigned I)
Definition: APValue.h:258
Expr * getRHS() const
Definition: Expr.h:3234
AnnotatingParser & P
bool isAddrLabelDiff() const
Definition: APValue.h:192
bool isUnion() const
Definition: Decl.h:2906
Decl * getNextDeclInContext()
Definition: DeclBase.h:378
Sema - This implements semantic analysis and AST building for C.
Definition: Sema.h:258
Expr * getFalseExpr() const
Definition: Expr.h:3231
llvm::APInt getValue() const
Definition: Expr.h:1262
bool AtomicUsesUnsupportedLibcall(const AtomicExpr *E) const
QualType getParamType(unsigned i) const
Definition: Type.h:3134
bool hasIrrelevantDestructor() const
Determine whether this class has a destructor which has no semantic effect.
Definition: DeclCXX.h:1278
bool isFloatingPoint() const
Definition: Type.h:2030
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1140
FileID getFileID(SourceLocation SpellingLoc) const
Return the FileID for a SourceLocation.
Qualifiers::ObjCLifetime getObjCLifetime() const
getObjCLifetime - Returns lifetime attribute of this type.
Definition: Type.h:976
bool EvaluateAsRValue(EvalResult &Result, const ASTContext &Ctx) const
CastKind
CastKind - The kind of operation required for a conversion.
std::string getFixItZeroLiteralForType(QualType T, SourceLocation Loc) const
AbsoluteValueKind
unsigned getPresumedColumnNumber(SourceLocation Loc, bool *Invalid=nullptr) const
ASTContext * Context
arg_iterator arg_end()
Definition: ExprCXX.h:1190
bool isInstantiationDependent() const
Whether this expression is instantiation-dependent, meaning that it depends in some way on a template...
Definition: Expr.h:192
const SmallVectorImpl< AnnotatedLine * >::const_iterator End
Expr * getCond() const
Definition: Expr.h:3222
QualType getPointeeType() const
Definition: Type.cpp:414
bool isUnarySelector() const
bool isFunctionPointerType() const
Definition: Type.h:5250
SourceManager & SM
bool isRealFloatingType() const
Floating point categories.
Definition: Type.cpp:1776
unsigned getTypeWidth(IntType T) const
Return the width (in bits) of the specified integer type enum.
NSArrayMethodKind
Enumerates the NSArray/NSMutableArray methods used to generate literals and to apply some checks...
Definition: NSAPI.h:76
Retains information about a block that is currently being parsed.
Definition: ScopeInfo.h:552
static void SemaBuiltinMemChkCall(Sema &S, FunctionDecl *FDecl, CallExpr *TheCall, unsigned SizeIdx, unsigned DstSizeIdx)
bool isWrittenInSameFile(SourceLocation Loc1, SourceLocation Loc2) const
Returns true if the spelling locations for both SourceLocations are part of the same file buffer...
static void CheckNonNullArguments(Sema &S, const NamedDecl *FDecl, const FunctionProtoType *Proto, ArrayRef< const Expr * > Args, SourceLocation CallSiteLoc)
bool isKnownToHaveBooleanValue() const
Definition: Expr.cpp:112
StringRef getName() const
Return the actual identifier string.
Represents a character-granular source range.
ExprValueKind
The categorization of expression values, currently following the C++11 scheme.
Definition: Specifiers.h:92
void setCallee(Expr *F)
Definition: Expr.h:2190
unsigned getNumArgs() const
bool isAnyComplexType() const
Definition: Type.h:5295
bool isSEHExceptScope() const
Determine whether this scope is a SEH '__except' block.
Definition: Scope.h:427
bool isListInitialization() const
Whether this constructor call was written as list-initialization.
Definition: ExprCXX.h:1153
SourceManager & SourceMgr
Definition: Format.cpp:1205
Expr * getBitWidth() const
Definition: Decl.h:2344
bool isComplexFloat() const
Definition: APValue.h:185
bool isAtomicType() const
Definition: Type.h:5314
bool isUnsignedInteger() const
Definition: Type.h:2026
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2358
void setInvalidDecl(bool Invalid=true)
Definition: DeclBase.cpp:96
This scope corresponds to an SEH except.
Definition: Scope.h:122
bool isVariableArrayType() const
Definition: Type.h:5280
const ParmVarDecl * getParamDecl(unsigned i) const
Definition: Decl.h:1968
DeclContext * getDeclContext()
Definition: DeclBase.h:381
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: Expr.cpp:3739
void setObjectKind(ExprObjectKind Cat)
setObjectKind - Set the object kind produced by this expression.
Definition: Expr.h:424
bool isFloatingType() const
Definition: Type.cpp:1760
CanQualType ShortTy
Definition: ASTContext.h:825
ImplicitParamDecl * getSelfDecl() const
Definition: DeclObjC.h:411
bool isInSystemHeader(SourceLocation Loc) const
Returns if a SourceLocation is in a system header.
void removeLocalVolatile()
Definition: Type.h:5118
unsigned getNumElements() const
getNumElements - Return number of elements of objective-c array literal.
Definition: ExprObjC.h:180
SourceLocation getQuestionLoc() const
Definition: Expr.h:3177
SourceLocation getLocation() const
Definition: ExprObjC.h:684
Expr * getSubExpr() const
Definition: Expr.h:1699
Expr * getElement(unsigned Index)
getExpr - Return the Expr at the specified index.
Definition: ExprObjC.h:183
bool isDependentType() const
Definition: Type.h:1727
void setValueKind(ExprValueKind Cat)
setValueKind - Set the value kind produced by this expression.
Definition: Expr.h:421
bool fixType(QualType QT, const LangOptions &LangOpt, ASTContext &Ctx, bool IsObjCLiteral)
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
const PrintfConversionSpecifier & getConversionSpecifier() const
Definition: FormatString.h:479
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:858
SmallVector< ActiveTemplateInstantiation, 16 > ActiveTemplateInstantiations
List of active template instantiations.
Definition: Sema.h:6518
DeclarationName getDeclName() const
Definition: Decl.h:189
unsigned getNumBases() const
Retrieves the number of base classes of this class.
Definition: DeclCXX.h:707
ValueDecl * getDecl()
Definition: Expr.h:994
APSInt & getComplexIntImag()
Definition: APValue.h:224
ObjCStringFormatFamily getObjCFStringFormattingFamily() const
Definition: Decl.cpp:1014
The result type of a method or function.
NestedNameSpecifierLoc getQualifierLoc() const
If the name was qualified, retrieves the nested-name-specifier that precedes the name, with source-location information.
Definition: Expr.h:1022
bool isUnsignedIntegerOrEnumerationType() const
Definition: Type.cpp:1739
SourceLocation getSemiLoc() const
Definition: Stmt.h:535
void EvaluateForOverflow(const ASTContext &Ctx) const
TypeSourceInfo * getTypeSourceInfo() const
Definition: Decl.h:611
static QualType getNeonEltType(NeonTypeFlags Flags, ASTContext &Context, bool IsPolyUnsigned, bool IsInt64Long)
Expr * getTrueExpr() const
Definition: Expr.h:3226
SourceLocation getLocationOfByte(unsigned ByteNo, const SourceManager &SM, const LangOptions &Features, const TargetInfo &Target) const
Definition: Expr.cpp:1006
static const Expr * getStrlenExprArg(const Expr *E)
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: ExprObjC.h:1286
CanQualType SignedCharTy
Definition: ASTContext.h:825
static bool isConstantSizeArrayWithMoreThanOneElement(QualType Ty, ASTContext &Context)
static CharSourceRange getCharRange(SourceRange R)
bool isNothrow(const ASTContext &Ctx, bool ResultIfDependent=false) const
Determine whether this function type has a non-throwing exception specification. If this depends on t...
Definition: Type.cpp:2680
std::pair< const IdentifierInfo *, uint64_t > TypeTagMagicValue
Definition: Sema.h:8927
SourceLocation getLocStart() const LLVM_READONLY
Definition: DeclBase.h:365
bool ParseFormatStringHasSArg(const char *beg, const char *end, const LangOptions &LO, const TargetInfo &Target)
There is no lifetime qualification on this type.
Definition: Type.h:130
TypeLoc getTypeLoc() const
Return the TypeLoc wrapper for the type source info.
Definition: TypeLoc.h:208
Enumerates target-specific builtins in their own namespaces within namespace clang.
bool EvaluateAsBooleanCondition(bool &Result, const ASTContext &Ctx) const
#define false
Definition: stdbool.h:33
CharUnits getTypeAlignInChars(QualType T) const
Return the ABI-specified alignment of a (complete) type T, in characters.
CanQualType BuiltinFnTy
Definition: ASTContext.h:833
Kind
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:5476
static bool considerVariable(VarDecl *var, Expr *ref, RetainCycleOwner &owner)
Encodes a location in the source. The SourceManager can decode this to get at the full include stack...
bool hasIntegerRepresentation() const
Determine whether this type has an integer representation of some sort, e.g., it is an integer type o...
Definition: Type.cpp:1576
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
static bool IsTailPaddedMemberArray(Sema &S, llvm::APInt Size, const NamedDecl *ND)
Check whether this array fits the idiom of a size-one tail padded array member of a struct...
unsigned getNumParams() const
Definition: Decl.cpp:2651
static const Expr * getSizeOfExprArg(const Expr *E)
If E is a sizeof expression, returns its argument expression, otherwise returns NULL.
const Type * getTypePtr() const
Definition: Type.h:5016
Expression is not a Null pointer constant.
Definition: Expr.h:635
unsigned getBitWidthValue(const ASTContext &Ctx) const
Definition: Decl.cpp:3344
Expr * getSourceExpr() const
Definition: Expr.h:869
static Expr * EvalAddr(Expr *E, SmallVectorImpl< DeclRefExpr * > &refVars, Decl *ParentDecl)
void checkRetainCycles(ObjCMessageExpr *msg)
Check a message send to see if it's likely to cause a retain cycle.
static const Expr * ignoreLiteralAdditions(const Expr *Ex, ASTContext &Ctx)
bool isConstant(ASTContext &Ctx) const
Definition: Type.h:703
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
bool refersToEnclosingVariableOrCapture() const
Does this DeclRefExpr refer to an enclosing local or a captured variable?
Definition: Expr.h:1158
bool isFreeIvar() const
Definition: ExprObjC.h:509
bool isVariadic() const
Definition: DeclObjC.h:421
APFloat & getFloat()
Definition: APValue.h:208
const char * GetName(unsigned ID) const
Return the identifier name for the specified builtin, e.g. "__builtin_abs".
Definition: Builtins.h:85
QualType withConst() const
Definition: Type.h:736
ExprObjectKind
A further classification of the kind of object referenced by an l-value or x-value.
Definition: Specifiers.h:109
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1717
ExprResult SemaBuiltinShuffleVector(CallExpr *TheCall)
SemaBuiltinShuffleVector - Handle __builtin_shufflevector.
static bool CheckNonNullExpr(Sema &S, const Expr *Expr)
Returns true if the value evaluates to null.
CanQualType FloatTy
Definition: ASTContext.h:828
virtual bool hasSjLjLowering() const
const ConstantArrayType * getAsConstantArrayType(QualType T) const
Definition: ASTContext.h:2003
static void DiagnoseCStringFormatDirectiveInCFAPI(Sema &S, const NamedDecl *FDecl, Expr **Args, unsigned NumArgs)
Diagnose use of s directive in an NSString which is being passed as formatting string to formatting m...
const OptionalFlag & hasPlusPrefix() const
Definition: FormatString.h:507
bool isIntegerConstantExpr(llvm::APSInt &Result, const ASTContext &Ctx, SourceLocation *Loc=nullptr, bool isEvaluated=true) const
Specifies that a value-dependent expression should be considered to never be a null pointer constant...
Definition: Expr.h:666
CanQualType VoidTy
Definition: ASTContext.h:817
unsigned getMemoryFunctionKind() const
Identify a memory copying or setting function. If the given function is a memory copy or setting func...
Definition: Decl.cpp:3226
Look up any declaration with any name.
Definition: Sema.h:2620
const Type * getBaseElementTypeUnsafe() const
Definition: Type.h:5520
EltType getEltType() const
bool FormatStringHasSArg(const StringLiteral *FExpr)
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:2424
bool isRValue() const
Definition: Expr.h:251
bool containsNonAsciiOrNull() const
Definition: Expr.h:1571
SourceLocation getBegin() const
void RegisterTypeTagForDatatype(const IdentifierInfo *ArgumentKind, uint64_t MagicValue, QualType Type, bool LayoutCompatible, bool MustBeNull)
Register a magic integral constant to be used as a type tag.
const T * castAs() const
Definition: Type.h:5586
bool isTypeDependent() const
Definition: Expr.h:166
bool isAscii() const
Definition: Expr.h:1564
bool isVectorType() const
Definition: Type.h:5298
SourceRange getSourceRange() const override LLVM_READONLY
Source range that this declaration covers.
Definition: Decl.cpp:1825
static bool isLogicalOp(Opcode Opc)
Definition: Expr.h:3037
bool hasCStrMethod(const Expr *E)
Check to see if a given expression could have '.c_str()' called on it.
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
Definition: Decl.cpp:2601
Assigning into this object requires a lifetime extension.
Definition: Type.h:147
const OptionalAmount & getFieldWidth() const
Definition: FormatString.h:372
SourceRange getSourceRange() const override LLVM_READONLY
Source range that this declaration covers.
Definition: DeclObjC.h:293
SourceLocation getLocStart() const LLVM_READONLY
Definition: Expr.cpp:430
bool isIgnored(unsigned DiagID, SourceLocation Loc) const
Determine whether the diagnostic is known to be ignored.
Definition: Diagnostic.h:645
const BlockDecl * getBlockDecl() const
Definition: Expr.h:4616
SourceLocation getLocationOfStringLiteralByte(const StringLiteral *SL, unsigned ByteNo) const
We are currently in the filter expression of an SEH except block.
Definition: Scope.h:125
QualType getType() const
Return the type wrapped by this type source info.
Definition: Decl.h:68
static StringRef getImmediateMacroName(SourceLocation Loc, const SourceManager &SM, const LangOptions &LangOpts)
Retrieve the name of the immediate macro expansion.
Definition: Lexer.cpp:956
bool isDynamicClass() const
Definition: DeclCXX.h:693
Opcode getOpcode() const
Definition: Expr.h:1696
SourceLocation getExprLoc() const LLVM_READONLY
Definition: Expr.cpp:193
bool isFunctionProtoType() const
Definition: Type.h:1617
QualType getPointeeType() const
Definition: Type.h:2139
QualType getFunctionType(QualType ResultTy, ArrayRef< QualType > Args, const FunctionProtoType::ExtProtoInfo &EPI) const
Return a normal function type with a typed argument list.
SourceLocation getRBracketLoc() const
Definition: Expr.h:2128
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1152
QualType getCallReturnType(const ASTContext &Ctx) const
Definition: Expr.cpp:1247
CanQualType UnsignedShortTy
Definition: ASTContext.h:826
bool isArrow() const
Definition: Expr.h:2548
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Base class for declarations which introduce a typedef-name.
Definition: Decl.h:2576
QualType getType() const
Definition: Expr.h:125
CanQualType CharTy
Definition: ASTContext.h:819
ExprResult PerformCopyInitialization(const InitializedEntity &Entity, SourceLocation EqualLoc, ExprResult Init, bool TopLevelOfInitList=false, bool AllowExplicit=false)
Definition: SemaInit.cpp:7629
bool isImplicitProperty() const
Definition: ExprObjC.h:625
static const Type * getElementType(const Expr *BaseExpr)
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:555
bool GetFormatNSStringIdx(const FormatAttr *Format, unsigned &Idx)
OverloadedOperatorKind
Enumeration specifying the different kinds of C++ overloaded operators.
Definition: OperatorKinds.h:22
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return 0.
Definition: Expr.cpp:1184
const internal::VariadicAllOfMatcher< Type > type
Matches Types in the clang AST.
Definition: ASTMatchers.h:1639
ExprResult ImpCastExprToType(Expr *E, QualType Type, CastKind CK, ExprValueKind VK=VK_RValue, const CXXCastPath *BasePath=nullptr, CheckedConversionKind CCK=CCK_ImplicitConversion)
Definition: Sema.cpp:340
bool isUTF8() const
Definition: Expr.h:1566
static __inline__ uint32_t volatile uint32_t * p
Definition: arm_acle.h:75
bool isInvalidDecl() const
Definition: DeclBase.h:498
ObjCLiteralKind CheckLiteralKind(Expr *FromE)
Definition: SemaExpr.cpp:8288
const OptionalFlag & hasThousandsGrouping() const
Definition: FormatString.h:503
bool DiagRuntimeBehavior(SourceLocation Loc, const Stmt *Statement, const PartialDiagnostic &PD)
Conditionally issue a diagnostic based on the current evaluation context.
Definition: SemaExpr.cpp:13524
CanQualType UnsignedLongLongTy
Definition: ASTContext.h:827
static FixItHint CreateRemoval(CharSourceRange RemoveRange)
Create a code modification hint that removes the given source range.
Definition: Diagnostic.h:104
std::pair< SourceLocation, SourceLocation > getImmediateExpansionRange(SourceLocation Loc) const
Return the start/end of the expansion information for an expansion location.
static QualType getAbsoluteValueArgumentType(ASTContext &Context, unsigned AbsType)
bool isStandardLayoutType() const
Test if this type is a standard-layout type. (C++0x [basic.type]p9)
Definition: Type.cpp:2176
QualType getExceptionObjectType(QualType T) const
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Expression is a Null pointer constant built from a zero integer expression that is not a simple...
Definition: Expr.h:642
static bool isSetterLikeSelector(Selector sel)
A set of unresolved declarations.
SourceLocation getLocStart() const LLVM_READONLY
Definition: Expr.h:4912
StringRef getString() const
Definition: Expr.h:1521
const llvm::Triple & getTriple() const
Returns the target triple of the primary target.
Expression is a C++11 nullptr.
Definition: Expr.h:648
unsigned getNumArgs() const
Definition: Expr.h:2205
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:1855
Flags to identify the types for overloaded Neon builtins.
void CheckCastAlign(Expr *Op, QualType T, SourceRange TRange)
static bool findRetainCycleOwner(Sema &S, Expr *e, RetainCycleOwner &owner)
bool isFloat() const
Definition: APValue.h:183
ExprResult SemaConvertVectorExpr(Expr *E, TypeSourceInfo *TInfo, SourceLocation BuiltinLoc, SourceLocation RParenLoc)
SemaConvertVectorExpr - Handle __builtin_convertvector.
llvm::APFloat getValue() const
Definition: Expr.h:1377
[ARC] Reclaim a retainable object pointer object that may have been produced and autoreleased as part...
Expr * IgnoreParenImpCasts() LLVM_READONLY
Definition: Expr.cpp:2526
Decl * getCalleeDecl()
Definition: Expr.cpp:1160
static LLVM_READONLY bool isLowercase(unsigned char c)
Return true if this character is a lowercase ASCII letter: [a-z].
Definition: CharInfo.h:100
ArgType getArgType(ASTContext &Ctx) const
static unsigned getBestAbsFunction(ASTContext &Context, QualType ArgType, unsigned AbsFunctionKind)
unsigned getNumNegativeBits() const
Returns the width in bits required to store all the negative enumerators of this enum. These widths include the rightmost leading 1; that is:
Definition: Decl.h:3158
bool isTriviallyCopyableType(ASTContext &Context) const
Definition: Type.cpp:2053
QualType getPointerDiffType() const
Return the unique type for "ptrdiff_t" (C99 7.17) defined in <stddef.h>. Pointer - pointer requires t...
SourceManager & getSourceManager() const
Definition: Sema.h:1024
const T * getAs() const
Definition: Type.h:5555
Expr * getFalseExpr() const
Definition: Expr.h:3350
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2066
StringLiteralCheckType
QualType getCanonicalType() const
Definition: Type.h:5055
ObjCLiteralKind
Definition: Sema.h:2316
CanQualType UnsignedLongTy
Definition: ASTContext.h:826
bool isObjCQualifiedIdType() const
Definition: Type.h:5318
QualType getIntegerType() const
Definition: Decl.h:3115
static unsigned RFT(unsigned t, bool shift=false, bool ForceQuad=false)
SourceLocation getLocStart() const LLVM_READONLY
Definition: Expr.cpp:1266
const OptionalAmount & getPrecision() const
Definition: FormatString.h:488
bool isFunctionType() const
Definition: Type.h:5229
const OptionalFlag & hasAlternativeForm() const
Definition: FormatString.h:508
bool isComplete() const
Returns true if this can be considered a complete type.
Definition: Decl.h:3182
static bool isAdditiveOp(Opcode Opc)
Definition: Expr.h:2993
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1505
ObjCInterfaceDecl * getCanonicalDecl() override
Retrieves the canonical declaration of this Objective-C class.
Definition: DeclObjC.h:1578
uint64_t getCharWidth() const
Return the size of the character type, in bits.
Definition: ASTContext.h:1705
static FixItHint CreateInsertion(SourceLocation InsertionLoc, StringRef Code, bool BeforePreviousInsertions=false)
Create a code modification hint that inserts the given code string at a specific location.
Definition: Diagnostic.h:78
ObjCInterfaceDecl * NSArrayDecl
The declaration of the Objective-C NSArray class.
Definition: Sema.h:730
SourceLocation getLocEnd() const LLVM_READONLY
Definition: Expr.cpp:1275
static Expr * EvalVal(Expr *E, SmallVectorImpl< DeclRefExpr * > &refVars, Decl *ParentDecl)
unsigned getNumArgs() const
Return the number of actual arguments in this message, not counting the receiver. ...
Definition: ExprObjC.h:1274
SourceLocation getExprLoc() const LLVM_READONLY
Definition: Expr.h:2957
static void emitReplacement(Sema &S, SourceLocation Loc, SourceRange Range, unsigned AbsKind, QualType ArgType)
Represents a base class of a C++ class.
Definition: DeclCXX.h:157
ObjCPropertyDecl * getExplicitProperty() const
Definition: ExprObjC.h:628
static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex)
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:474
bool LookupQualifiedName(LookupResult &R, DeclContext *LookupCtx, bool InUnqualifiedLookup=false)
Perform qualified name lookup into a given context.
Expr * getBase() const
Definition: Expr.h:2405
bool hasNonTrivialObjCLifetime() const
Definition: Type.h:980
Reading or writing from this object requires a barrier call.
Definition: Type.h:144
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Expression is a Null pointer constant built from a literal zero.
Definition: Expr.h:645
bool typesAreCompatible(QualType T1, QualType T2, bool CompareUnqualified=false)
Compatibility predicates used to check assignment expressions.
static bool SemaBuiltinSEHScopeCheck(Sema &SemaRef, CallExpr *TheCall, Scope::ScopeFlags NeededScopeFlags, unsigned DiagID)
void DiagnoseEmptyStmtBody(SourceLocation StmtLoc, const Stmt *Body, unsigned DiagID)
const OptionalFlag & isLeftJustified() const
Definition: FormatString.h:506
QualType getUnqualifiedType() const
Retrieve the unqualified variant of the given type, removing as little sugar as possible.
Definition: Type.h:5096
APFloat & getComplexFloatImag()
Definition: APValue.h:240
unsigned getNumPositiveBits() const
Returns the width in bits required to store all the non-negative enumerators of this enum...
Definition: Decl.h:3141
Represents a C++ struct/union/class.
Definition: DeclCXX.h:285
Compatible - the types are compatible according to the standard.
Definition: Sema.h:8142
TargetCXXABI getCXXABI() const
Get the C++ ABI currently in use.
bool isObjCObjectPointerType() const
Definition: Type.h:5304
Opcode getOpcode() const
Definition: Expr.h:2961
static void CheckNonNullArgument(Sema &S, const Expr *ArgExpr, SourceLocation CallSiteLoc)
llvm::iterator_range< specific_attr_iterator< T > > specific_attrs() const
Definition: DeclBase.h:470
ArraySizeModifier getSizeModifier() const
Definition: Type.h:2435
Builtin::Context & BuiltinInfo
Definition: ASTContext.h:441
bool CheckParmsForFunctionDef(ParmVarDecl *const *Param, ParmVarDecl *const *ParamEnd, bool CheckParameterNames)
Helpers for dealing with blocks and functions.
QualType getVectorType(QualType VectorType, unsigned NumElts, VectorType::VectorKind VecKind) const
Return the unique reference to a vector type of the specified element type and size.
static FixItHint CreateReplacement(CharSourceRange RemoveRange, StringRef Code)
Create a code modification hint that replaces the given source range with the given code string...
Definition: Diagnostic.h:115
static QualType getSizeOfArgType(const Expr *E)
If E is a sizeof expression, returns its argument type.
const T * getTypePtr() const
Retrieve the underlying type pointer, which refers to a canonical type.
Definition: CanonicalType.h:70
bool isArrayType() const
Definition: Type.h:5271
Defines the clang::TargetInfo interface.
Expr * getRHS() const
Definition: Expr.h:2966
ExprResult ExprError()
Definition: Ownership.h:267
PropertyAttributeKind getPropertyAttributesAsWritten() const
Definition: DeclObjC.h:2523
bool isInt() const
Definition: APValue.h:182
CanQualType IntTy
Definition: ASTContext.h:825
void DiagnoseSelfMove(const Expr *LHSExpr, const Expr *RHSExpr, SourceLocation OpLoc)
Warn if a value is moved to itself.
A reference to a declared variable, function, enum, etc. [C99 6.5.1p2].
Definition: Expr.h:899
ExprValueKind getValueKind() const
getValueKind - The value kind that this expression produces.
Definition: Expr.h:404
virtual bool hasFeature(StringRef Feature) const
Determine whether the given target has the given feature.
ArgType getArgType(ASTContext &Ctx) const
static unsigned getAbsoluteValueFunctionKind(const FunctionDecl *FDecl)
static bool SemaBuiltinAddressof(Sema &S, CallExpr *TheCall)
bool ParsePrintfString(FormatStringHandler &H, const char *beg, const char *end, const LangOptions &LO, const TargetInfo &Target, bool isFreeBSDKPrintf)
QualType getElementType() const
Definition: Type.h:2434
SourceManager & SourceMgr
Definition: Sema.h:298
const Expr * getInit(unsigned Init) const
Definition: Expr.h:3794
Annotates a diagnostic with some code that should be inserted, removed, or replaced to fix the proble...
Definition: Diagnostic.h:52
void checkUnsafeExprAssigns(SourceLocation Loc, Expr *LHS, Expr *RHS)
bool checkUnsafeAssigns(SourceLocation Loc, QualType LHS, Expr *RHS)
void suppressDiagnostics()
Definition: Lookup.h:522
#define true
Definition: stdbool.h:32
An l-value expression is a reference to an object with independent storage.
Definition: Specifiers.h:99
static bool IsInAnyMacroBody(const SourceManager &SM, SourceLocation Loc)
bool hasValidLengthModifier(const TargetInfo &Target) const
const llvm::fltSemantics & getFloatTypeSemantics(QualType T) const
Return the APFloat 'semantics' for the specified scalar floating point type.
A trivial tuple used to represent a source range.
SourceLocation getLocation() const
Definition: DeclBase.h:372
ASTContext & Context
Definition: Sema.h:295
static unsigned getLargerAbsoluteValueFunction(unsigned AbsFunction)
void DiagnoseAlwaysNonNullPointer(Expr *E, Expr::NullPointerConstantKind NullType, bool IsEqual, SourceRange Range)
Diagnose pointers that are always non-null.
CanQualType BoolTy
Definition: ASTContext.h:818
static bool checkUnsafeAssignLiteral(Sema &S, SourceLocation Loc, Expr *RHS, bool isProperty)
bool isSignedIntegerType() const
Definition: Type.cpp:1683
APSInt & getInt()
Definition: APValue.h:200
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:5075
bool hasSignedIntegerRepresentation() const
Determine whether this type has an signed integer representation of some sort, e.g., it is an signed integer type or a vector.
Definition: Type.cpp:1713
CanQualType DoubleTy
Definition: ASTContext.h:828
bool isNull() const
isNull - Return true if this QualType doesn't point to a type yet.
Definition: Type.h:633
TypeSourceInfo * getTypeSourceInfo() const
Definition: Decl.h:2611
static bool SemaBuiltinAnnotation(Sema &S, CallExpr *TheCall)
Describes an entity that is being initialized.
static InitializedEntity InitializeParameter(ASTContext &Context, ParmVarDecl *Parm)
Create the initialization entity for a parameter.
NamespaceDecl * getStdNamespace() const
static bool isComparisonOp(Opcode Opc)
Definition: Expr.h:3007
Optional< NullabilityKind > getNullability(const ASTContext &context) const
Definition: Type.cpp:3326
static Expr * findCapturingExpr(Sema &S, Expr *e, RetainCycleOwner &owner)
ReceiverKind getReceiverKind() const
Determine the kind of receiver that this message is being sent to.
Definition: ExprObjC.h:1133
static Optional< int > GetNSMutableDictionaryArgumentIndex(Sema &S, ObjCMessageExpr *Message)
static bool SemaBuiltinCallWithStaticChain(Sema &S, CallExpr *BuiltinCall)
bool isIntegralType(ASTContext &Ctx) const
Determine whether this type is an integral type.
Definition: Type.cpp:1602
This class handles loading and caching of source files into memory.
unsigned getVectorLength() const
Definition: APValue.h:266
bool isObjC(ID Id)
isObjC - Is this an "ObjC" input (Obj-C and Obj-C++ sources and headers).
Definition: Types.cpp:104
unsigned getNumElements() const
Definition: ExprObjC.h:314
NullPointerConstantKind
Enumeration used to describe the kind of Null pointer constant returned from isNullPointerConstant()...
Definition: Expr.h:633
Attr - This represents one attribute.
Definition: Attr.h:44
Represents a shadow declaration introduced into a scope by a (resolved) using declaration.
Definition: DeclCXX.h:2779
QualType CheckAddressOfOperand(ExprResult &Operand, SourceLocation OpLoc)
Definition: SemaExpr.cpp:9652
bool isIntegerType() const
Definition: Type.h:5448
Helper class that creates diagnostics with optional template instantiation stacks.
Definition: Sema.h:1049
Expr * IgnoreParens() LLVM_READONLY
Definition: Expr.cpp:2408
CanQualType UnsignedIntTy
Definition: ASTContext.h:826
bool isLValue() const
Definition: APValue.h:186
bool isPointerType() const
Definition: Type.h:5232
bool isMacroArgExpansion(SourceLocation Loc) const
Tests whether the given source location represents a macro argument's expansion into the function-lik...
OverloadedOperatorKind getOverloadedOperator() const
Definition: Decl.cpp:2916