<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style id="owaParaStyle" type="text/css">
<!--
p
{margin-top:0;
margin-bottom:0}
p
{margin-top:0;
margin-bottom:0}
-->
P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hi,
<br>
<br>
I was wondering if there is a way to get <font face="Courier New">SVal </font><font face="Courier New"><font face="Tahoma">of a</font> SubExpr</font> with
<br>
the <font face="Courier New">LocationContext <font face="Tahoma">at a function call.</font>
<font face="Tahoma"><br>
</font></font><br>
Here is what I mean:<br>
<br>
A function fun is declared and called like this:<br>
<br>
<font face="Courier New">Type arg; //1.<br>
fun(Type* par){...} //2.<br>
fun(&arg); //3.<br>
</font><font face="Courier New"><br>
<br>
</font>If I wanted to detect if <font face="Courier New">arg</font> was uninitialized when the function fun is called (line 3.), I would use:
<br>
<br>
<font face="Courier New">const CallEvent Call;</font><br>
<font face="Courier New">CheckerContext C;</font><br>
<font face="Courier New">Expr* argExp = Call.getArgExpr(0);</font><br>
<font face="Courier New">ProgramStateRef state = C.getState(); <br>
const LocationContext *LCtx = C.getLocationContext();<br>
SVal LV = state->getSVal(argExp, LCtx);</font><br>
<font face="Courier New">bool FirstArgIsUndef = LV.isUndef();</font><br>
<br>
<font face="Courier New">FirstArgIsUndef</font> will be false, because the address of
<font face="Courier New">arg</font> does exist.<br>
<br>
But now I want to detect if that which arg/par is pointing at is uninitialized, how would I do that?.<br>
<br>
<br>
I started experimenting with this in <font face="Courier New"><font face="Tahoma">CallAndMessageChecker::checkPreCall</font></font>:<br>
<br>
<font face="Courier New">const Expr* argExp = Call.getArgExpr(i);</font><br>
<font face="Courier New">const Expr* argExpPure = argExp->IgnoreImpCasts();<br>
<br>
if(const UnaryOperator* unOp = dyn_cast<UnaryOperator>(argExpPure))<br>
{<br>
UnaryOperator::Opcode opc = unOp->getOpcode();<br>
if(opc == UO_AddrOf)// '&' operator<br>
{<br>
Expr* referencedInputArg = unOp->getSubExpr(); // in a dump() I see that this is really the argument arg (not par)<br>
SVal refVal = state->getSVal(referencedInputArg, LCtx);<br>
bool unknownRefVal = refVal.isUnknown();<br>
bool validRefVal = refVal.isValid();<br>
bool undefRefVal = refVal.isUndef();<br>
}<br>
}<br>
<br>
<font face="Tahoma">it turns out that it will set </font></font><font face="Courier New"><font face="Tahoma"><font face="Courier New">refVal</font> to isUnknown() instead of isUndef(). The context LCtx seems to forget that the SubExpr
</font></font>(that is here <br>
<font face="Courier New"><font face="Tahoma"><font face="Courier New">arg) <font face="Tahoma">
is uninitialized. I put this code in the </font></font>CallAndMessageChecker::checkPreCall, perhaps this is the wrong place? or do I need to use the LCtx in another way so that it remembers the SVal of SubExpr too?.<br>
<br>
</font></font><font face="Courier New"><font face="Tahoma" size="2"></font><br>
</font>/Per<br>
<div><br>
<div style="font-size:13px; font-family:Tahoma">
<p class="MsoNormal"><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US">.......................................................................................................................</span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:black" lang="EN-US"><br>
Per Viberg </span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US">Senior Engineer</span><span style="font-size:8.5pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US"><br>
Evidente ES East</span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US"> AB Warfvinges väg 34 SE-112 51 Stockholm Sweden
</span><span style="font-size:10pt; font-family:'Tahoma','sans-serif'; color:black" lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-GB">Phone: +46 (0)8 402 79 00<br>
Mobile: +46 (0)70 912 42 52<br>
E-mail: <a href="mailto:Per.Viberg@evidente.se" target="_blank"><font color="#0000ff">Per.Viberg@evidente.se</font></a>
</span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:black" lang="EN-GB"><br>
<br>
<a href="http://www.evidente.se" target="_blank"><font color="#0000ff">www.evidente.se</font></a></span></p>
<p class="MsoNormal"><span style="font-size:6pt; font-family:'Arial','sans-serif'" lang="EN-GB">This e-mail, which might contain confidential information, is addressed to the above stated person/company. If you are not the correct addressee, employee or in
any other way the person concerned, please notify the sender immediately. At the same time, please delete this e-mail and destroy any prints. Thank You.</span></p>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF224886"><font color="#000000" face="Tahoma" size="2"><b>Från:</b> Per Viberg<br>
<b>Skickat:</b> den 14 februari 2014 13:41<br>
<b>Till:</b> Clang Dev [cfe-dev@cs.uiuc.edu]<br>
<b>Ämne:</b> improving detection of uninitialized arguments (the CallAndMessageChecker)<br>
</font><br>
</div>
<div></div>
<div>
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt"><br>
<div>Hi,<br>
<br>
I'm looking into extending the check that warns for uninitialized arguments. Below I've described what should be detected. Any opinions on if it's a useful check or potential problems/drawbacks with it?.<br>
<br>
Check: should this be detected as a warning for uninitialized argument?:"<b><font face="Courier New">warning: Function call argument is an uninitialized value"</font></b><br>
<br>
<b><font face="Courier New">void doStuff(const int *p);<br>
void f(void);<br>
<br>
void f(void) {<br>
int x;<br>
doStuff(&x); // ← warning?<br>
}</font></b><br>
<br>
My rationale behind the warning:<br>
1. it's not possible to write to *p, because it's of type const<br>
2. content of *p is uninitialized stack value, and shouldn't be used.<br>
3. the value of p is of no interest, since it's an address of an stack variable.<br>
<br>
if any of the above criteria are not fulfilled, then no warning. Thus the function prototype must state pointer to const for the argument, the variable that the function is called with must be address of local/stack variable.<br>
<br>
currently, only this is detected:<br>
<br>
<b><font face="Courier New">void doStuff2(int p);<br>
void g(void);<br>
<br>
void g(void) {<br>
int y;<br>
doStuff2(y); // </font></b><b><font face="Courier New"><b><font face="Courier New">warning: Function call argument is an uninitialized value</font></b></font></b><br>
<br>
<br>
/Per<br>
<br>
<br>
<br>
<div style="font-size:13px; font-family:Tahoma">
<p class="MsoNormal"><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US">.......................................................................................................................</span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:black" lang="EN-US"><br>
Per Viberg </span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US">Senior Engineer</span><span style="font-size:8.5pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US"><br>
Evidente ES East</span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-US"> AB Warfvinges väg 34 SE-112 51 Stockholm Sweden
</span><span style="font-size:10pt; font-family:'Tahoma','sans-serif'; color:black" lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:gray" lang="EN-GB">Phone: +46 (0)8 402 79 00<br>
Mobile: +46 (0)70 912 42 52<br>
E-mail: <a href="mailto:Per.Viberg@evidente.se" target="_blank"><font color="#0000ff">Per.Viberg@evidente.se</font></a>
</span><span style="font-size:8pt; font-family:'Arial','sans-serif'; color:black" lang="EN-GB"><br>
<br>
<a href="http://www.evidente.se" target="_blank"><font color="#0000ff">www.evidente.se</font></a></span></p>
<p class="MsoNormal"><span style="font-size:6pt; font-family:'Arial','sans-serif'" lang="EN-GB">This e-mail, which might contain confidential information, is addressed to the above stated person/company. If you are not the correct addressee, employee or in
any other way the person concerned, please notify the sender immediately. At the same time, please delete this e-mail and destroy any prints. Thank You.</span></p>
</div>
</div>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr tabindex="-1">
<br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>