clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

   1 //===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This defines CallAndMessageChecker, a builtin checker that checks for various
  10 // errors of call and objc message expressions.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "clang/AST/ExprCXX.h"
  15 #include "clang/AST/ParentMap.h"
  16 #include "clang/Basic/TargetInfo.h"
  17 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
  18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  19 #include "clang/StaticAnalyzer/Core/Checker.h"
  20 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
  22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  23 #include "llvm/ADT/SmallString.h"
  24 #include "llvm/ADT/StringExtras.h"
  25 #include "llvm/Support/Casting.h"
  26 #include "llvm/Support/raw_ostream.h"
  27
  28 using namespace clang;
  29 using namespace ento;
  30
  31 namespace {
  32
  33 class CallAndMessageChecker
  34     : public Checker<check::PreObjCMessage, check::ObjCMessageNil,
  35                      check::PreCall> {
  36   mutable std::unique_ptr<BugType> BT_call_null;
  37   mutable std::unique_ptr<BugType> BT_call_undef;
  38   mutable std::unique_ptr<BugType> BT_cxx_call_null;
  39   mutable std::unique_ptr<BugType> BT_cxx_call_undef;
  40   mutable std::unique_ptr<BugType> BT_call_arg;
  41   mutable std::unique_ptr<BugType> BT_cxx_delete_undef;
  42   mutable std::unique_ptr<BugType> BT_msg_undef;
  43   mutable std::unique_ptr<BugType> BT_objc_prop_undef;
  44   mutable std::unique_ptr<BugType> BT_objc_subscript_undef;
  45   mutable std::unique_ptr<BugType> BT_msg_arg;
  46   mutable std::unique_ptr<BugType> BT_msg_ret;
  47   mutable std::unique_ptr<BugType> BT_call_few_args;
  48
  49 public:
  50   // These correspond with the checker options. Looking at other checkers such
  51   // as MallocChecker and CStringChecker, this is similar as to how they pull
  52   // off having a modeling class, but emitting diagnostics under a smaller
  53   // checker's name that can be safely disabled without disturbing the
  54   // underlaying modeling engine.
  55   // The reason behind having *checker options* rather then actual *checkers*
  56   // here is that CallAndMessage is among the oldest checkers out there, and can
  57   // be responsible for the majority of the reports on any given project. This
  58   // is obviously not ideal, but changing checker name has the consequence of
  59   // changing the issue hashes associated with the reports, and databases
  60   // relying on this (CodeChecker, for instance) would suffer greatly.
  61   // If we ever end up making changes to the issue hash generation algorithm, or
  62   // the warning messages here, we should totally jump on the opportunity to
  63   // convert these to actual checkers.
  64   enum CheckKind {
  65     CK_FunctionPointer,
  66     CK_ParameterCount,
  67     CK_CXXThisMethodCall,
  68     CK_CXXDeallocationArg,
  69     CK_ArgInitializedness,
  70     CK_ArgPointeeInitializedness,
  71     CK_NilReceiver,
  72     CK_UndefReceiver,
  73     CK_NumCheckKinds
  74   };
  75
  76   bool ChecksEnabled[CK_NumCheckKinds] = {false};
  77   // The original core.CallAndMessage checker name. This should rather be an
  78   // array, as seen in MallocChecker and CStringChecker.
  79   CheckerNameRef OriginalName;
  80
  81   void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
  82
  83   /// Fill in the return value that results from messaging nil based on the
  84   /// return type and architecture and diagnose if the return value will be
  85   /// garbage.
  86   void checkObjCMessageNil(const ObjCMethodCall &msg, CheckerContext &C) const;
  87
  88   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
  89
  90   ProgramStateRef checkFunctionPointerCall(const CallExpr *CE,
  91                                            CheckerContext &C,
  92                                            ProgramStateRef State) const;
  93
  94   ProgramStateRef checkCXXMethodCall(const CXXInstanceCall *CC,
  95                                      CheckerContext &C,
  96                                      ProgramStateRef State) const;
  97
  98   ProgramStateRef checkParameterCount(const CallEvent &Call, CheckerContext &C,
  99                                       ProgramStateRef State) const;
 100
 101   ProgramStateRef checkCXXDeallocation(const CXXDeallocatorCall *DC,
 102                                        CheckerContext &C,
 103                                        ProgramStateRef State) const;
 104
 105   ProgramStateRef checkArgInitializedness(const CallEvent &Call,
 106                                           CheckerContext &C,
 107                                           ProgramStateRef State) const;
 108
 109 private:
 110   bool PreVisitProcessArg(CheckerContext &C, SVal V, SourceRange ArgRange,
 111                           const Expr *ArgEx, int ArgumentNumber,
 112                           bool CheckUninitFields, const CallEvent &Call,
 113                           std::unique_ptr<BugType> &BT,
 114                           const ParmVarDecl *ParamDecl) const;
 115
 116   static void emitBadCall(BugType *BT, CheckerContext &C, const Expr *BadE);
 117   void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg,
 118                           ExplodedNode *N) const;
 119
 120   void HandleNilReceiver(CheckerContext &C,
 121                          ProgramStateRef state,
 122                          const ObjCMethodCall &msg) const;
 123
 124   void LazyInit_BT(const char *desc, std::unique_ptr<BugType> &BT) const {
 125     if (!BT)
 126       BT.reset(new BugType(OriginalName, desc));
 127   }
 128   bool uninitRefOrPointer(CheckerContext &C, SVal V, SourceRange ArgRange,
 129                           const Expr *ArgEx, std::unique_ptr<BugType> &BT,
 130                           const ParmVarDecl *ParamDecl, const char *BD,
 131                           int ArgumentNumber) const;
 132 };
 133 } // end anonymous namespace
 134
 135 void CallAndMessageChecker::emitBadCall(BugType *BT, CheckerContext &C,
 136                                         const Expr *BadE) {
 137   ExplodedNode *N = C.generateErrorNode();
 138   if (!N)
 139     return;
 140
 141   auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
 142   if (BadE) {
 143     R->addRange(BadE->getSourceRange());
 144     if (BadE->isGLValue())
 145       BadE = bugreporter::getDerefExpr(BadE);
 146     bugreporter::trackExpressionValue(N, BadE, *R);
 147   }
 148   C.emitReport(std::move(R));
 149 }
 150
 151 static void describeUninitializedArgumentInCall(const CallEvent &Call,
 152                                                 int ArgumentNumber,
 153                                                 llvm::raw_svector_ostream &Os) {
 154   switch (Call.getKind()) {
 155   case CE_ObjCMessage: {
 156     const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
 157     switch (Msg.getMessageKind()) {
 158     case OCM_Message:
 159       Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1)
 160          << " argument in message expression is an uninitialized value";
 161       return;
 162     case OCM_PropertyAccess:
 163       assert(Msg.isSetter() && "Getters have no args");
 164       Os << "Argument for property setter is an uninitialized value";
 165       return;
 166     case OCM_Subscript:
 167       if (Msg.isSetter() && (ArgumentNumber == 0))
 168         Os << "Argument for subscript setter is an uninitialized value";
 169       else
 170         Os << "Subscript index is an uninitialized value";
 171       return;
 172     }
 173     llvm_unreachable("Unknown message kind.");
 174   }
 175   case CE_Block:
 176     Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1)
 177        << " block call argument is an uninitialized value";
 178     return;
 179   default:
 180     Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1)
 181        << " function call argument is an uninitialized value";
 182     return;
 183   }
 184 }
 185
 186 bool CallAndMessageChecker::uninitRefOrPointer(
 187     CheckerContext &C, SVal V, SourceRange ArgRange, const Expr *ArgEx,
 188     std::unique_ptr<BugType> &BT, const ParmVarDecl *ParamDecl, const char *BD,
 189     int ArgumentNumber) const {
 190
 191   // The pointee being uninitialized is a sign of code smell, not a bug, no need
 192   // to sink here.
 193   if (!ChecksEnabled[CK_ArgPointeeInitializedness])
 194     return false;
 195
 196   // No parameter declaration available, i.e. variadic function argument.
 197   if(!ParamDecl)
 198     return false;
 199
 200   // If parameter is declared as pointer to const in function declaration,
 201   // then check if corresponding argument in function call is
 202   // pointing to undefined symbol value (uninitialized memory).
 203   SmallString<200> Buf;
 204   llvm::raw_svector_ostream Os(Buf);
 205
 206   if (ParamDecl->getType()->isPointerType()) {
 207     Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1)
 208        << " function call argument is a pointer to uninitialized value";
 209   } else if (ParamDecl->getType()->isReferenceType()) {
 210     Os << (ArgumentNumber + 1) << llvm::getOrdinalSuffix(ArgumentNumber + 1)
 211        << " function call argument is an uninitialized value";
 212   } else
 213     return false;
 214
 215   if(!ParamDecl->getType()->getPointeeType().isConstQualified())
 216     return false;
 217
 218   if (const MemRegion *SValMemRegion = V.getAsRegion()) {
 219     const ProgramStateRef State = C.getState();
 220     const SVal PSV = State->getSVal(SValMemRegion, C.getASTContext().CharTy);
 221     if (PSV.isUndef()) {
 222       if (ExplodedNode *N = C.generateErrorNode()) {
 223         LazyInit_BT(BD, BT);
 224         auto R = std::make_unique<PathSensitiveBugReport>(*BT, Os.str(), N);
 225         R->addRange(ArgRange);
 226         if (ArgEx)
 227           bugreporter::trackExpressionValue(N, ArgEx, *R);
 228
 229         C.emitReport(std::move(R));
 230       }
 231       return true;
 232     }
 233   }
 234   return false;
 235 }
 236
 237 namespace {
 238 class FindUninitializedField {
 239 public:
 240   SmallVector<const FieldDecl *, 10> FieldChain;
 241
 242 private:
 243   StoreManager &StoreMgr;
 244   MemRegionManager &MrMgr;
 245   Store store;
 246
 247 public:
 248   FindUninitializedField(StoreManager &storeMgr, MemRegionManager &mrMgr,
 249                          Store s)
 250       : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
 251
 252   bool Find(const TypedValueRegion *R) {
 253     QualType T = R->getValueType();
 254     if (const RecordType *RT = T->getAsStructureType()) {
 255       const RecordDecl *RD = RT->getDecl()->getDefinition();
 256       assert(RD && "Referred record has no definition");
 257       for (const auto *I : RD->fields()) {
 258         const FieldRegion *FR = MrMgr.getFieldRegion(I, R);
 259         FieldChain.push_back(I);
 260         T = I->getType();
 261         if (T->getAsStructureType()) {
 262           if (Find(FR))
 263             return true;
 264         } else {
 265           SVal V = StoreMgr.getBinding(store, loc::MemRegionVal(FR));
 266           if (V.isUndef())
 267             return true;
 268         }
 269         FieldChain.pop_back();
 270       }
 271     }
 272
 273     return false;
 274   }
 275 };
 276 } // namespace
 277
 278 bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
 279                                                SVal V,
 280                                                SourceRange ArgRange,
 281                                                const Expr *ArgEx,
 282                                                int ArgumentNumber,
 283                                                bool CheckUninitFields,
 284                                                const CallEvent &Call,
 285                                                std::unique_ptr<BugType> &BT,
 286                                                const ParmVarDecl *ParamDecl
 287                                                ) const {
 288   const char *BD = "Uninitialized argument value";
 289
 290   if (uninitRefOrPointer(C, V, ArgRange, ArgEx, BT, ParamDecl, BD,
 291                          ArgumentNumber))
 292     return true;
 293
 294   if (V.isUndef()) {
 295     if (!ChecksEnabled[CK_ArgInitializedness]) {
 296       C.addSink();
 297       return true;
 298     }
 299     if (ExplodedNode *N = C.generateErrorNode()) {
 300       LazyInit_BT(BD, BT);
 301       // Generate a report for this bug.
 302       SmallString<200> Buf;
 303       llvm::raw_svector_ostream Os(Buf);
 304       describeUninitializedArgumentInCall(Call, ArgumentNumber, Os);
 305       auto R = std::make_unique<PathSensitiveBugReport>(*BT, Os.str(), N);
 306
 307       R->addRange(ArgRange);
 308       if (ArgEx)
 309         bugreporter::trackExpressionValue(N, ArgEx, *R);
 310       C.emitReport(std::move(R));
 311     }
 312     return true;
 313   }
 314
 315   if (!CheckUninitFields)
 316     return false;
 317
 318   if (auto LV = V.getAs<nonloc::LazyCompoundVal>()) {
 319     const LazyCompoundValData *D = LV->getCVData();
 320     FindUninitializedField F(C.getState()->getStateManager().getStoreManager(),
 321                              C.getSValBuilder().getRegionManager(),
 322                              D->getStore());
 323
 324     if (F.Find(D->getRegion())) {
 325       if (!ChecksEnabled[CK_ArgInitializedness]) {
 326         C.addSink();
 327         return true;
 328       }
 329       if (ExplodedNode *N = C.generateErrorNode()) {
 330         LazyInit_BT(BD, BT);
 331         SmallString<512> Str;
 332         llvm::raw_svector_ostream os(Str);
 333         os << "Passed-by-value struct argument contains uninitialized data";
 334
 335         if (F.FieldChain.size() == 1)
 336           os << " (e.g., field: '" << *F.FieldChain[0] << "')";
 337         else {
 338           os << " (e.g., via the field chain: '";
 339           bool first = true;
 340           for (SmallVectorImpl<const FieldDecl *>::iterator
 341                DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){
 342             if (first)
 343               first = false;
 344             else
 345               os << '.';
 346             os << **DI;
 347           }
 348           os << "')";
 349         }
 350
 351         // Generate a report for this bug.
 352         auto R = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
 353         R->addRange(ArgRange);
 354
 355         if (ArgEx)
 356           bugreporter::trackExpressionValue(N, ArgEx, *R);
 357         // FIXME: enhance track back for uninitialized value for arbitrary
 358         // memregions
 359         C.emitReport(std::move(R));
 360       }
 361       return true;
 362     }
 363   }
 364
 365   return false;
 366 }
 367
 368 ProgramStateRef CallAndMessageChecker::checkFunctionPointerCall(
 369     const CallExpr *CE, CheckerContext &C, ProgramStateRef State) const {
 370
 371   const Expr *Callee = CE->getCallee()->IgnoreParens();
 372   const LocationContext *LCtx = C.getLocationContext();
 373   SVal L = State->getSVal(Callee, LCtx);
 374
 375   if (L.isUndef()) {
 376     if (!ChecksEnabled[CK_FunctionPointer]) {
 377       C.addSink(State);
 378       return nullptr;
 379     }
 380     if (!BT_call_undef)
 381       BT_call_undef.reset(new BugType(
 382           OriginalName,
 383           "Called function pointer is an uninitialized pointer value"));
 384     emitBadCall(BT_call_undef.get(), C, Callee);
 385     return nullptr;
 386   }
 387
 388   ProgramStateRef StNonNull, StNull;
 389   std::tie(StNonNull, StNull) = State->assume(L.castAs<DefinedOrUnknownSVal>());
 390
 391   if (StNull && !StNonNull) {
 392     if (!ChecksEnabled[CK_FunctionPointer]) {
 393       C.addSink(StNull);
 394       return nullptr;
 395     }
 396     if (!BT_call_null)
 397       BT_call_null.reset(new BugType(
 398           OriginalName, "Called function pointer is null (null dereference)"));
 399     emitBadCall(BT_call_null.get(), C, Callee);
 400     return nullptr;
 401   }
 402
 403   return StNonNull;
 404 }
 405
 406 ProgramStateRef CallAndMessageChecker::checkParameterCount(
 407     const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const {
 408
 409   // If we have a function or block declaration, we can make sure we pass
 410   // enough parameters.
 411   unsigned Params = Call.parameters().size();
 412   if (Call.getNumArgs() >= Params)
 413     return State;
 414
 415   if (!ChecksEnabled[CK_ParameterCount]) {
 416     C.addSink(State);
 417     return nullptr;
 418   }
 419
 420   ExplodedNode *N = C.generateErrorNode();
 421   if (!N)
 422     return nullptr;
 423
 424   LazyInit_BT("Function call with too few arguments", BT_call_few_args);
 425
 426   SmallString<512> Str;
 427   llvm::raw_svector_ostream os(Str);
 428   if (isa<AnyFunctionCall>(Call)) {
 429     os << "Function ";
 430   } else {
 431     assert(isa<BlockCall>(Call));
 432     os << "Block ";
 433   }
 434   os << "taking " << Params << " argument" << (Params == 1 ? "" : "s")
 435      << " is called with fewer (" << Call.getNumArgs() << ")";
 436
 437   C.emitReport(
 438       std::make_unique<PathSensitiveBugReport>(*BT_call_few_args, os.str(), N));
 439   return nullptr;
 440 }
 441
 442 ProgramStateRef CallAndMessageChecker::checkCXXMethodCall(
 443     const CXXInstanceCall *CC, CheckerContext &C, ProgramStateRef State) const {
 444
 445   SVal V = CC->getCXXThisVal();
 446   if (V.isUndef()) {
 447     if (!ChecksEnabled[CK_CXXThisMethodCall]) {
 448       C.addSink(State);
 449       return nullptr;
 450     }
 451     if (!BT_cxx_call_undef)
 452       BT_cxx_call_undef.reset(new BugType(
 453           OriginalName, "Called C++ object pointer is uninitialized"));
 454     emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr());
 455     return nullptr;
 456   }
 457
 458   ProgramStateRef StNonNull, StNull;
 459   std::tie(StNonNull, StNull) = State->assume(V.castAs<DefinedOrUnknownSVal>());
 460
 461   if (StNull && !StNonNull) {
 462     if (!ChecksEnabled[CK_CXXThisMethodCall]) {
 463       C.addSink(StNull);
 464       return nullptr;
 465     }
 466     if (!BT_cxx_call_null)
 467       BT_cxx_call_null.reset(
 468           new BugType(OriginalName, "Called C++ object pointer is null"));
 469     emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr());
 470     return nullptr;
 471   }
 472
 473   return StNonNull;
 474 }
 475
 476 ProgramStateRef
 477 CallAndMessageChecker::checkCXXDeallocation(const CXXDeallocatorCall *DC,
 478                                             CheckerContext &C,
 479                                             ProgramStateRef State) const {
 480   const CXXDeleteExpr *DE = DC->getOriginExpr();
 481   assert(DE);
 482   SVal Arg = C.getSVal(DE->getArgument());
 483   if (!Arg.isUndef())
 484     return State;
 485
 486   if (!ChecksEnabled[CK_CXXDeallocationArg]) {
 487     C.addSink(State);
 488     return nullptr;
 489   }
 490
 491   StringRef Desc;
 492   ExplodedNode *N = C.generateErrorNode();
 493   if (!N)
 494     return nullptr;
 495   if (!BT_cxx_delete_undef)
 496     BT_cxx_delete_undef.reset(
 497         new BugType(OriginalName, "Uninitialized argument value"));
 498   if (DE->isArrayFormAsWritten())
 499     Desc = "Argument to 'delete[]' is uninitialized";
 500   else
 501     Desc = "Argument to 'delete' is uninitialized";
 502   auto R =
 503       std::make_unique<PathSensitiveBugReport>(*BT_cxx_delete_undef, Desc, N);
 504   bugreporter::trackExpressionValue(N, DE, *R);
 505   C.emitReport(std::move(R));
 506   return nullptr;
 507 }
 508
 509 ProgramStateRef CallAndMessageChecker::checkArgInitializedness(
 510     const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const {
 511
 512   const Decl *D = Call.getDecl();
 513
 514   // Don't check for uninitialized field values in arguments if the
 515   // caller has a body that is available and we have the chance to inline it.
 516   // This is a hack, but is a reasonable compromise betweens sometimes warning
 517   // and sometimes not depending on if we decide to inline a function.
 518   const bool checkUninitFields =
 519       !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody()));
 520
 521   std::unique_ptr<BugType> *BT;
 522   if (isa<ObjCMethodCall>(Call))
 523     BT = &BT_msg_arg;
 524   else
 525     BT = &BT_call_arg;
 526
 527   const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D);
 528   for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i) {
 529     const ParmVarDecl *ParamDecl = nullptr;
 530     if (FD && i < FD->getNumParams())
 531       ParamDecl = FD->getParamDecl(i);
 532     if (PreVisitProcessArg(C, Call.getArgSVal(i), Call.getArgSourceRange(i),
 533                            Call.getArgExpr(i), i, checkUninitFields, Call, *BT,
 534                            ParamDecl))
 535       return nullptr;
 536   }
 537   return State;
 538 }
 539
 540 void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
 541                                          CheckerContext &C) const {
 542   ProgramStateRef State = C.getState();
 543
 544   if (const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr()))
 545     State = checkFunctionPointerCall(CE, C, State);
 546
 547   if (!State)
 548     return;
 549
 550   if (Call.getDecl())
 551     State = checkParameterCount(Call, C, State);
 552
 553   if (!State)
 554     return;
 555
 556   if (const auto *CC = dyn_cast<CXXInstanceCall>(&Call))
 557     State = checkCXXMethodCall(CC, C, State);
 558
 559   if (!State)
 560     return;
 561
 562   if (const auto *DC = dyn_cast<CXXDeallocatorCall>(&Call))
 563     State = checkCXXDeallocation(DC, C, State);
 564
 565   if (!State)
 566     return;
 567
 568   State = checkArgInitializedness(Call, C, State);
 569
 570   // If we make it here, record our assumptions about the callee.
 571   C.addTransition(State);
 572 }
 573
 574 void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
 575                                                 CheckerContext &C) const {
 576   SVal recVal = msg.getReceiverSVal();
 577   if (recVal.isUndef()) {
 578     if (!ChecksEnabled[CK_UndefReceiver]) {
 579       C.addSink();
 580       return;
 581     }
 582     if (ExplodedNode *N = C.generateErrorNode()) {
 583       BugType *BT = nullptr;
 584       switch (msg.getMessageKind()) {
 585       case OCM_Message:
 586         if (!BT_msg_undef)
 587           BT_msg_undef.reset(new BugType(OriginalName,
 588                                          "Receiver in message expression "
 589                                          "is an uninitialized value"));
 590         BT = BT_msg_undef.get();
 591         break;
 592       case OCM_PropertyAccess:
 593         if (!BT_objc_prop_undef)
 594           BT_objc_prop_undef.reset(new BugType(
 595               OriginalName,
 596               "Property access on an uninitialized object pointer"));
 597         BT = BT_objc_prop_undef.get();
 598         break;
 599       case OCM_Subscript:
 600         if (!BT_objc_subscript_undef)
 601           BT_objc_subscript_undef.reset(new BugType(
 602               OriginalName,
 603               "Subscript access on an uninitialized object pointer"));
 604         BT = BT_objc_subscript_undef.get();
 605         break;
 606       }
 607       assert(BT && "Unknown message kind.");
 608
 609       auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
 610       const ObjCMessageExpr *ME = msg.getOriginExpr();
 611       R->addRange(ME->getReceiverRange());
 612
 613       // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet.
 614       if (const Expr *ReceiverE = ME->getInstanceReceiver())
 615         bugreporter::trackExpressionValue(N, ReceiverE, *R);
 616       C.emitReport(std::move(R));
 617     }
 618     return;
 619   }
 620 }
 621
 622 void CallAndMessageChecker::checkObjCMessageNil(const ObjCMethodCall &msg,
 623                                                 CheckerContext &C) const {
 624   HandleNilReceiver(C, C.getState(), msg);
 625 }
 626
 627 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
 628                                                const ObjCMethodCall &msg,
 629                                                ExplodedNode *N) const {
 630   if (!ChecksEnabled[CK_NilReceiver]) {
 631     C.addSink();
 632     return;
 633   }
 634
 635   if (!BT_msg_ret)
 636     BT_msg_ret.reset(
 637         new BugType(OriginalName, "Receiver in message expression is 'nil'"));
 638
 639   const ObjCMessageExpr *ME = msg.getOriginExpr();
 640
 641   QualType ResTy = msg.getResultType();
 642
 643   SmallString<200> buf;
 644   llvm::raw_svector_ostream os(buf);
 645   os << "The receiver of message '";
 646   ME->getSelector().print(os);
 647   os << "' is nil";
 648   if (ResTy->isReferenceType()) {
 649     os << ", which results in forming a null reference";
 650   } else {
 651     os << " and returns a value of type '";
 652     msg.getResultType().print(os, C.getLangOpts());
 653     os << "' that will be garbage";
 654   }
 655
 656   auto report =
 657       std::make_unique<PathSensitiveBugReport>(*BT_msg_ret, os.str(), N);
 658   report->addRange(ME->getReceiverRange());
 659   // FIXME: This won't track "self" in messages to super.
 660   if (const Expr *receiver = ME->getInstanceReceiver()) {
 661     bugreporter::trackExpressionValue(N, receiver, *report);
 662   }
 663   C.emitReport(std::move(report));
 664 }
 665
 666 static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
 667   return (triple.getVendor() == llvm::Triple::Apple &&
 668           (triple.isiOS() || triple.isWatchOS() ||
 669            !triple.isMacOSXVersionLT(10,5)));
 670 }
 671
 672 void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
 673                                               ProgramStateRef state,
 674                                               const ObjCMethodCall &Msg) const {
 675   ASTContext &Ctx = C.getASTContext();
 676   static CheckerProgramPointTag Tag(this, "NilReceiver");
 677
 678   // Check the return type of the message expression.  A message to nil will
 679   // return different values depending on the return type and the architecture.
 680   QualType RetTy = Msg.getResultType();
 681   CanQualType CanRetTy = Ctx.getCanonicalType(RetTy);
 682   const LocationContext *LCtx = C.getLocationContext();
 683
 684   if (CanRetTy->isStructureOrClassType()) {
 685     // Structure returns are safe since the compiler zeroes them out.
 686     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
 687     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
 688     return;
 689   }
 690
 691   // Other cases: check if sizeof(return type) > sizeof(void*)
 692   if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap()
 693                                   .isConsumedExpr(Msg.getOriginExpr())) {
 694     // Compute: sizeof(void *) and sizeof(return type)
 695     const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy);
 696     const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy);
 697
 698     if (CanRetTy.getTypePtr()->isReferenceType()||
 699         (voidPtrSize < returnTypeSize &&
 700          !(supportsNilWithFloatRet(Ctx.getTargetInfo().getTriple()) &&
 701            (Ctx.FloatTy == CanRetTy ||
 702             Ctx.DoubleTy == CanRetTy ||
 703             Ctx.LongDoubleTy == CanRetTy ||
 704             Ctx.LongLongTy == CanRetTy ||
 705             Ctx.UnsignedLongLongTy == CanRetTy)))) {
 706       if (ExplodedNode *N = C.generateErrorNode(state, &Tag))
 707         emitNilReceiverBug(C, Msg, N);
 708       return;
 709     }
 710
 711     // Handle the safe cases where the return value is 0 if the
 712     // receiver is nil.
 713     //
 714     // FIXME: For now take the conservative approach that we only
 715     // return null values if we *know* that the receiver is nil.
 716     // This is because we can have surprises like:
 717     //
 718     //   ... = [[NSScreens screens] objectAtIndex:0];
 719     //
 720     // What can happen is that [... screens] could return nil, but
 721     // it most likely isn't nil.  We should assume the semantics
 722     // of this case unless we have *a lot* more knowledge.
 723     //
 724     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
 725     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
 726     return;
 727   }
 728
 729   C.addTransition(state);
 730 }
 731
 732 void ento::registerCallAndMessageModeling(CheckerManager &mgr) {
 733   mgr.registerChecker<CallAndMessageChecker>();
 734 }
 735
 736 bool ento::shouldRegisterCallAndMessageModeling(const CheckerManager &mgr) {
 737   return true;
 738 }
 739
 740 void ento::registerCallAndMessageChecker(CheckerManager &mgr) {
 741   CallAndMessageChecker *checker = mgr.getChecker<CallAndMessageChecker>();
 742
 743   checker->OriginalName = mgr.getCurrentCheckerName();
 744
 745 #define QUERY_CHECKER_OPTION(OPTION)                                           \
 746   checker->ChecksEnabled[CallAndMessageChecker::CK_##OPTION] =                 \
 747       mgr.getAnalyzerOptions().getCheckerBooleanOption(                        \
 748           mgr.getCurrentCheckerName(), #OPTION);
 749
 750   QUERY_CHECKER_OPTION(FunctionPointer)
 751   QUERY_CHECKER_OPTION(ParameterCount)
 752   QUERY_CHECKER_OPTION(CXXThisMethodCall)
 753   QUERY_CHECKER_OPTION(CXXDeallocationArg)
 754   QUERY_CHECKER_OPTION(ArgInitializedness)
 755   QUERY_CHECKER_OPTION(ArgPointeeInitializedness)
 756   QUERY_CHECKER_OPTION(NilReceiver)
 757   QUERY_CHECKER_OPTION(UndefReceiver)
 758 }
 759
 760 bool ento::shouldRegisterCallAndMessageChecker(const CheckerManager &mgr) {
 761   return true;
 762 }