[cfe-commits] r163750 - in /cfe/trunk: include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp lib/StaticAnalyzer/Core/CallEvent.cpp test/Analysis/uninit-vals-ps.c

[Jordan Rose]

Some comments inline.

On Sep 12, 2012, at 15:57 , Anna Zaks <ganna at apple.com> wrote:

> Author: zaks
> Date: Wed Sep 12 17:57:40 2012
> New Revision: 163750
> 
> URL: http://llvm.org/viewvc/llvm-project?rev=163750&view=rev
> Log:
> [analyzer] Do not report use of undef on "return foo();" when the return type is void.
> 
> Fixes a false positive found by analyzing LLVM code base.
> 
> Modified:
>    cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
>    cfe/trunk/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp
>    cfe/trunk/lib/StaticAnalyzer/Core/CallEvent.cpp
>    cfe/trunk/test/Analysis/uninit-vals-ps.c
> 
> Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
> URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h?rev=163750&r1=163749&r2=163750&view=diff
> ==============================================================================
> --- cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h (original)
> +++ cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h Wed Sep 12 17:57:40 2012
> @@ -293,6 +293,9 @@
>   /// of some kind.
>   static bool isCallStmt(const Stmt *S);
> 
> +  /// \brief Returns the result type of a function, method declaration.
> +  static QualType getDeclaredResultType(const Decl *D);
> +
>   // Iterator access to formal parameters and their types.
> private:
>   typedef std::const_mem_fun_t<QualType, ParmVarDecl> get_type_fun;
> 
> Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp
> URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp?rev=163750&r1=163749&r2=163750&view=diff
> ==============================================================================
> --- cfe/trunk/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp (original)
> +++ cfe/trunk/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp Wed Sep 12 17:57:40 2012
> @@ -16,6 +16,7 @@
> #include "ClangSACheckers.h"
> #include "clang/StaticAnalyzer/Core/Checker.h"
> #include "clang/StaticAnalyzer/Core/CheckerManager.h"
> +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
> #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
> #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
> 
> @@ -41,6 +42,19 @@
>   if (!C.getState()->getSVal(RetE, C.getLocationContext()).isUndef())
>     return;
> 
> +  // "return;" is modeled to evaluate to an UndefinedValue. Allow UndefinedValue
> +  // to be returned in functions returning void to support the following pattern:
> +  // void foo() {
> +  //  return;
> +  // }
> +  // void test() {
> +  //   return foo();
> +  // }
> +  const StackFrameContext *SFC = C.getStackFrame();
> +  QualType RT = CallEvent::getDeclaredResultType(SFC->getDecl());
> +  if (!RT.isNull() && RT->isSpecificBuiltinType(BuiltinType::Void))
> +    return;

The canonical way to write this would be RT->isVoidType(), which will handle typedefs as well.


>   ExplodedNode *N = C.generateSink();
> 
>   if (!N)
> 
> Modified: cfe/trunk/lib/StaticAnalyzer/Core/CallEvent.cpp
> URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/CallEvent.cpp?rev=163750&r1=163749&r2=163750&view=diff
> ==============================================================================
> --- cfe/trunk/lib/StaticAnalyzer/Core/CallEvent.cpp (original)
> +++ cfe/trunk/lib/StaticAnalyzer/Core/CallEvent.cpp Wed Sep 12 17:57:40 2012
> @@ -252,6 +252,16 @@
>                           || isa<CXXNewExpr>(S);
> }
> 
> +/// \brief Returns the result type, adjusted for references.
> +QualType CallEvent::getDeclaredResultType(const Decl *D) {
> +  assert(D);
> +  if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D))
> +    return FD->getResultType();
> +  else if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(D))
> +    return MD->getResultType();
> +  return QualType();
> +}

This should not live on CallEvent since there is no "call" (even in this test case it's used for the top-level function). Also, it is incomplete (no blocks). AnalysisDeclContext may be a more appropriate location for this?