clang-tools 8.0.0

UseAfterMoveCheck.cpp
Go to the documentation of this file.
1 //===--- UseAfterMoveCheck.cpp - clang-tidy -------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9
10 #include "UseAfterMoveCheck.h"
11
12 #include "clang/Analysis/CFG.h"
13 #include "clang/Lex/Lexer.h"
14
15 #include "../utils/ExprSequence.h"
16
17 using namespace clang::ast_matchers;
18 using namespace clang::tidy::utils;
19
20
21 namespace clang {
22 namespace tidy {
23 namespace bugprone {
24
25 namespace {
26
27 /// Contains information about a use-after-move.
28 struct UseAfterMove {
29 // The DeclRefExpr that constituted the use of the object.
30 const DeclRefExpr *DeclRef;
31
32 // Is the order in which the move and the use are evaluated undefined?
33 bool EvaluationOrderUndefined;
34 };
35
36 /// Finds uses of a variable after a move (and maintains state required by the
37 /// various internal helper functions).
38 class UseAfterMoveFinder {
39 public:
40 UseAfterMoveFinder(ASTContext *TheContext);
41
42 // Within the given function body, finds the first use of 'MovedVariable' that
43 // occurs after 'MovingCall' (the expression that performs the move). If a
44 // use-after-move is found, writes information about it to 'TheUseAfterMove'.
45 // Returns whether a use-after-move was found.
46 bool find(Stmt *FunctionBody, const Expr *MovingCall,
47 const ValueDecl *MovedVariable, UseAfterMove *TheUseAfterMove);
48
49 private:
50 bool findInternal(const CFGBlock *Block, const Expr *MovingCall,
51 const ValueDecl *MovedVariable,
52 UseAfterMove *TheUseAfterMove);
53 void getUsesAndReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
54 llvm::SmallVectorImpl<const DeclRefExpr *> *Uses,
55 llvm::SmallPtrSetImpl<const Stmt *> *Reinits);
56 void getDeclRefs(const CFGBlock *Block, const Decl *MovedVariable,
57 llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
58 void getReinits(const CFGBlock *Block, const ValueDecl *MovedVariable,
59 llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
60 llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs);
61
62 ASTContext *Context;
63 std::unique_ptr<ExprSequence> Sequence;
64 std::unique_ptr<StmtToBlockMap> BlockMap;
65 llvm::SmallPtrSet<const CFGBlock *, 8> Visited;
66 };
67
68 } // namespace
69
70
71 // Matches nodes that are
72 // - Part of a decltype argument or class template argument (we check this by
73 // seeing if they are children of a TypeLoc), or
74 // - Part of a function template argument (we check this by seeing if they are
75 // children of a DeclRefExpr that references a function template).
76 // DeclRefExprs that fulfill these conditions should not be counted as a use or
77 // move.
78 static StatementMatcher inDecltypeOrTemplateArg() {
79 return anyOf(hasAncestor(typeLoc()),
80 hasAncestor(declRefExpr(
81 to(functionDecl(ast_matchers::isTemplateInstantiation())))));
82 }
83
84 UseAfterMoveFinder::UseAfterMoveFinder(ASTContext *TheContext)
85 : Context(TheContext) {}
86
87 bool UseAfterMoveFinder::find(Stmt *FunctionBody, const Expr *MovingCall,
88 const ValueDecl *MovedVariable,
89 UseAfterMove *TheUseAfterMove) {
90 // Generate the CFG manually instead of through an AnalysisDeclContext because
91 // it seems the latter can't be used to generate a CFG for the body of a
92 // labmda.
93 //
94 // We include implicit and temporary destructors in the CFG so that
95 // destructors marked [[noreturn]] are handled correctly in the control flow
96 // analysis. (These are used in some styles of assertion macros.)
97 CFG::BuildOptions Options;
98 Options.AddImplicitDtors = true;
99 Options.AddTemporaryDtors = true;
100 std::unique_ptr<CFG> TheCFG =
101 CFG::buildCFG(nullptr, FunctionBody, Context, Options);
102 if (!TheCFG)
103 return false;
104
105 Sequence =
106 llvm::make_unique<ExprSequence>(TheCFG.get(), FunctionBody, Context);
107 BlockMap = llvm::make_unique<StmtToBlockMap>(TheCFG.get(), Context);
108 Visited.clear();
109
110 const CFGBlock *Block = BlockMap->blockContainingStmt(MovingCall);
111 if (!Block)
112 return false;
113
114 return findInternal(Block, MovingCall, MovedVariable, TheUseAfterMove);
115 }
116
117 bool UseAfterMoveFinder::findInternal(const CFGBlock *Block,
118 const Expr *MovingCall,
119 const ValueDecl *MovedVariable,
120 UseAfterMove *TheUseAfterMove) {
121 if (Visited.count(Block))
122 return false;
123
124 // Mark the block as visited (except if this is the block containing the
125 // std::move() and it's being visited the first time).
126 if (!MovingCall)
127 Visited.insert(Block);
128
129 // Get all uses and reinits in the block.
130 llvm::SmallVector<const DeclRefExpr *, 1> Uses;
131 llvm::SmallPtrSet<const Stmt *, 1> Reinits;
132 getUsesAndReinits(Block, MovedVariable, &Uses, &Reinits);
133
134 // Ignore all reinitializations where the move potentially comes after the
135 // reinit.
136 llvm::SmallVector<const Stmt *, 1> ReinitsToDelete;
137 for (const Stmt *Reinit : Reinits) {
138 if (MovingCall && Sequence->potentiallyAfter(MovingCall, Reinit))
139 ReinitsToDelete.push_back(Reinit);
140 }
141 for (const Stmt *Reinit : ReinitsToDelete) {
142 Reinits.erase(Reinit);
143 }
144
145 // Find all uses that potentially come after the move.
146 for (const DeclRefExpr *Use : Uses) {
147 if (!MovingCall || Sequence->potentiallyAfter(Use, MovingCall)) {
148 // Does the use have a saving reinit? A reinit is saving if it definitely
149 // comes before the use, i.e. if there's no potential that the reinit is
150 // after the use.
151 bool HaveSavingReinit = false;
152 for (const Stmt *Reinit : Reinits) {
153 if (!Sequence->potentiallyAfter(Reinit, Use))
154 HaveSavingReinit = true;
155 }
156
157 if (!HaveSavingReinit) {
158 TheUseAfterMove->DeclRef = Use;
159
160 // Is this a use-after-move that depends on order of evaluation?
161 // This is the case if the move potentially comes after the use (and we
162 // already know that use potentially comes after the move, which taken
163 // together tells us that the ordering is unclear).
164 TheUseAfterMove->EvaluationOrderUndefined =
165 MovingCall != nullptr &&
166 Sequence->potentiallyAfter(MovingCall, Use);
167
168 return true;
169 }
170 }
171 }
172
173 // If the object wasn't reinitialized, call ourselves recursively on all
174 // successors.
175 if (Reinits.empty()) {
176 for (const auto &Succ : Block->succs()) {
177 if (Succ && findInternal(Succ, nullptr, MovedVariable, TheUseAfterMove))
178 return true;
179 }
180 }
181
182 return false;
183 }
184
185 void UseAfterMoveFinder::getUsesAndReinits(
186 const CFGBlock *Block, const ValueDecl *MovedVariable,
187 llvm::SmallVectorImpl<const DeclRefExpr *> *Uses,
188 llvm::SmallPtrSetImpl<const Stmt *> *Reinits) {
189 llvm::SmallPtrSet<const DeclRefExpr *, 1> DeclRefs;
190 llvm::SmallPtrSet<const DeclRefExpr *, 1> ReinitDeclRefs;
191
192 getDeclRefs(Block, MovedVariable, &DeclRefs);
193 getReinits(Block, MovedVariable, Reinits, &ReinitDeclRefs);
194
195 // All references to the variable that aren't reinitializations are uses.
196 Uses->clear();
197 for (const DeclRefExpr *DeclRef : DeclRefs) {
198 if (!ReinitDeclRefs.count(DeclRef))
199 Uses->push_back(DeclRef);
200 }
201
202 // Sort the uses by their occurrence in the source code.
203 std::sort(Uses->begin(), Uses->end(),
204 [](const DeclRefExpr *D1, const DeclRefExpr *D2) {
205 return D1->getExprLoc() < D2->getExprLoc();
206 });
207 }
208
209 bool isStandardSmartPointer(const ValueDecl *VD) {
210 const Type *TheType = VD->getType().getNonReferenceType().getTypePtrOrNull();
211 if (!TheType)
212 return false;
213
214 const CXXRecordDecl *RecordDecl = TheType->getAsCXXRecordDecl();
215 if (!RecordDecl)
216 return false;
217
218 const IdentifierInfo *ID = RecordDecl->getIdentifier();
219 if (!ID)
220 return false;
221
222 StringRef Name = ID->getName();
223 if (Name != "unique_ptr" && Name != "shared_ptr" && Name != "weak_ptr")
224 return false;
225
226 return RecordDecl->getDeclContext()->isStdNamespace();
227 }
228
229 void UseAfterMoveFinder::getDeclRefs(
230 const CFGBlock *Block, const Decl *MovedVariable,
231 llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
232 DeclRefs->clear();
233 for (const auto &Elem : *Block) {
234 Optional<CFGStmt> S = Elem.getAs<CFGStmt>();
235 if (!S)
236 continue;
237
238 auto addDeclRefs = [this, Block,
239 DeclRefs](const ArrayRef<BoundNodes> Matches) {
240 for (const auto &Match : Matches) {
241 const auto *DeclRef = Match.getNodeAs<DeclRefExpr>("declref");
242 const auto *Operator = Match.getNodeAs<CXXOperatorCallExpr>("operator");
243 if (DeclRef && BlockMap->blockContainingStmt(DeclRef) == Block) {
244 // Ignore uses of a standard smart pointer that don't dereference the
245 // pointer.
246 if (Operator || !isStandardSmartPointer(DeclRef->getDecl())) {
247 DeclRefs->insert(DeclRef);
248 }
249 }
250 }
251 };
252
253 auto DeclRefMatcher = declRefExpr(hasDeclaration(equalsNode(MovedVariable)),
254 unless(inDecltypeOrTemplateArg()))
255 .bind("declref");
256
257 addDeclRefs(match(findAll(DeclRefMatcher), *S->getStmt(), *Context));
258 addDeclRefs(match(
259 findAll(cxxOperatorCallExpr(anyOf(hasOverloadedOperatorName("*"),
260 hasOverloadedOperatorName("->"),
261 hasOverloadedOperatorName("[]")),
262 hasArgument(0, DeclRefMatcher))
263 .bind("operator")),
264 *S->getStmt(), *Context));
265 }
266 }
267
268 void UseAfterMoveFinder::getReinits(
269 const CFGBlock *Block, const ValueDecl *MovedVariable,
270 llvm::SmallPtrSetImpl<const Stmt *> *Stmts,
271 llvm::SmallPtrSetImpl<const DeclRefExpr *> *DeclRefs) {
272 auto DeclRefMatcher =
273 declRefExpr(hasDeclaration(equalsNode(MovedVariable))).bind("declref");
274
275 auto StandardContainerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
276 recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
277 "::std::basic_string", "::std::vector", "::std::deque",
278 "::std::forward_list", "::std::list", "::std::set", "::std::map",
279 "::std::multiset", "::std::multimap", "::std::unordered_set",
280 "::std::unordered_map", "::std::unordered_multiset",
281 "::std::unordered_multimap"))))));
282
283 auto StandardSmartPointerTypeMatcher = hasType(hasUnqualifiedDesugaredType(
284 recordType(hasDeclaration(cxxRecordDecl(hasAnyName(
285 "::std::unique_ptr", "::std::shared_ptr", "::std::weak_ptr"))))));
286
287 // Matches different types of reinitialization.
288 auto ReinitMatcher =
289 stmt(anyOf(
290 // Assignment. In addition to the overloaded assignment operator,
291 // test for built-in assignment as well, since template functions
292 // may be instantiated to use std::move() on built-in types.
293 binaryOperator(hasOperatorName("="), hasLHS(DeclRefMatcher)),
294 cxxOperatorCallExpr(hasOverloadedOperatorName("="),
295 hasArgument(0, DeclRefMatcher)),
296 // Declaration. We treat this as a type of reinitialization too,
297 // so we don't need to treat it separately.
298 declStmt(hasDescendant(equalsNode(MovedVariable))),
299 // clear() and assign() on standard containers.
300 cxxMemberCallExpr(
301 on(expr(DeclRefMatcher, StandardContainerTypeMatcher)),
302 // To keep the matcher simple, we check for assign() calls
303 // on all standard containers, even though only vector,
304 // deque, forward_list and list have assign(). If assign()
305 // is called on any of the other containers, this will be
306 // flagged by a compile error anyway.
307 callee(cxxMethodDecl(hasAnyName("clear", "assign")))),
308 // reset() on standard smart pointers.
309 cxxMemberCallExpr(
310 on(expr(DeclRefMatcher, StandardSmartPointerTypeMatcher)),
311 callee(cxxMethodDecl(hasName("reset")))),
312 // Methods that have the [[clang::reinitializes]] attribute.
313 cxxMemberCallExpr(
314 on(DeclRefMatcher),
315 callee(cxxMethodDecl(hasAttr(clang::attr::Reinitializes)))),
316 // Passing variable to a function as a non-const pointer.
317 callExpr(forEachArgumentWithParam(
318 unaryOperator(hasOperatorName("&"),
319 hasUnaryOperand(DeclRefMatcher)),
320 unless(parmVarDecl(hasType(pointsTo(isConstQualified())))))),
321 // Passing variable to a function as a non-const lvalue reference
322 // (unless that function is std::move()).
323 callExpr(forEachArgumentWithParam(
324 DeclRefMatcher,
325 unless(parmVarDecl(hasType(
326 references(qualType(isConstQualified())))))),
327 unless(callee(functionDecl(hasName("::std::move")))))))
328 .bind("reinit");
329
330 Stmts->clear();
331 DeclRefs->clear();
332 for (const auto &Elem : *Block) {
333 Optional<CFGStmt> S = Elem.getAs<CFGStmt>();
334 if (!S)
335 continue;
336
337 SmallVector<BoundNodes, 1> Matches =
338 match(findAll(ReinitMatcher), *S->getStmt(), *Context);
339
340 for (const auto &Match : Matches) {
341 const auto *TheStmt = Match.getNodeAs<Stmt>("reinit");
342 const auto *TheDeclRef = Match.getNodeAs<DeclRefExpr>("declref");
343 if (TheStmt && BlockMap->blockContainingStmt(TheStmt) == Block) {
344 Stmts->insert(TheStmt);
345
346 // We count DeclStmts as reinitializations, but they don't have a
347 // DeclRefExpr associated with them -- so we need to check 'TheDeclRef'
348 // before adding it to the set.
349 if (TheDeclRef)
350 DeclRefs->insert(TheDeclRef);
351 }
352 }
353 }
354 }
355
356 static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg,
357 const UseAfterMove &Use, ClangTidyCheck *Check,
358 ASTContext *Context) {
359 SourceLocation UseLoc = Use.DeclRef->getExprLoc();
360 SourceLocation MoveLoc = MovingCall->getExprLoc();
361
362 Check->diag(UseLoc, "'%0' used after it was moved")
363 << MoveArg->getDecl()->getName();
364 Check->diag(MoveLoc, "move occurred here", DiagnosticIDs::Note);
365 if (Use.EvaluationOrderUndefined) {
366 Check->diag(UseLoc,
367 "the use and move are unsequenced, i.e. there is no guarantee "
368 "about the order in which they are evaluated",
369 DiagnosticIDs::Note);
370 } else if (UseLoc < MoveLoc || Use.DeclRef == MoveArg) {
371 Check->diag(UseLoc,
372 "the use happens in a later loop iteration than the move",
373 DiagnosticIDs::Note);
374 }
375 }
376
377 void UseAfterMoveCheck::registerMatchers(MatchFinder *Finder) {
378 if (!getLangOpts().CPlusPlus11)
379 return;
380
381 auto CallMoveMatcher =
382 callExpr(callee(functionDecl(hasName("::std::move"))), argumentCountIs(1),
383 hasArgument(0, declRefExpr().bind("arg")),
384 anyOf(hasAncestor(lambdaExpr().bind("containing-lambda")),
385 hasAncestor(functionDecl().bind("containing-func"))),
386 unless(inDecltypeOrTemplateArg()))
387 .bind("call-move");
388
389 Finder->addMatcher(
390 // To find the Stmt that we assume performs the actual move, we look for
391 // the direct ancestor of the std::move() that isn't one of the node
392 // types ignored by ignoringParenImpCasts().
393 stmt(forEach(expr(ignoringParenImpCasts(CallMoveMatcher))),
394 // Don't allow an InitListExpr to be the moving call. An InitListExpr
395 // has both a syntactic and a semantic form, and the parent-child
396 // relationships are different between the two. This could cause an
397 // InitListExpr to be analyzed as the moving call in addition to the
398 // Expr that we actually want, resulting in two diagnostics with
399 // different code locations for the same move.
400 unless(initListExpr()),
401 unless(expr(ignoringParenImpCasts(equalsBoundNode("call-move")))))
402 .bind("moving-call"),
403 this);
404 }
405
406 void UseAfterMoveCheck::check(const MatchFinder::MatchResult &Result) {
407 const auto *ContainingLambda =
408 Result.Nodes.getNodeAs<LambdaExpr>("containing-lambda");
409 const auto *ContainingFunc =
410 Result.Nodes.getNodeAs<FunctionDecl>("containing-func");
411 const auto *CallMove = Result.Nodes.getNodeAs<CallExpr>("call-move");
412 const auto *MovingCall = Result.Nodes.getNodeAs<Expr>("moving-call");
413 const auto *Arg = Result.Nodes.getNodeAs<DeclRefExpr>("arg");
414
415 if (!MovingCall || !MovingCall->getExprLoc().isValid())
416 MovingCall = CallMove;
417
418 Stmt *FunctionBody = nullptr;
419 if (ContainingLambda)
420 FunctionBody = ContainingLambda->getBody();
421 else if (ContainingFunc)
422 FunctionBody = ContainingFunc->getBody();
423 else
424 return;
425
426 // Ignore the std::move if the variable that was passed to it isn't a local
427 // variable.
428 if (!Arg->getDecl()->getDeclContext()->isFunctionOrMethod())
429 return;
430
431 UseAfterMoveFinder finder(Result.Context);
432 UseAfterMove Use;
433 if (finder.find(FunctionBody, MovingCall, Arg->getDecl(), &Use))
434 emitDiagnostic(MovingCall, Arg, Use, this, Result.Context);
435 }
436
437 } // namespace bugprone
438 } // namespace tidy
439 } // namespace clang
clang::ast_matchers
Definition: AbseilMatcher.h:15
clang::tidy::utils
Definition: ASTUtils.cpp:18
clang::tidy::ClangTidyCheck
Base class for all clang-tidy checks.
Definition: ClangTidy.h:127
Name
static constexpr llvm::StringLiteral Name
Definition: UppercaseLiteralSuffixCheck.cpp:28
Result
llvm::Optional< llvm::Expected< tooling::AtomicChanges > > Result
Definition: ClangdServer.cpp:60
clang
===– Representation.cpp - ClangDoc Representation --------—*- C++ -*-===//
Definition: ChangeNamespace.cpp:18
clang::tidy::bugprone::isStandardSmartPointer
bool isStandardSmartPointer(const ValueDecl *VD)
Definition: UseAfterMoveCheck.cpp:209
UseAfterMoveCheck.h
clang::tidy::bugprone::inDecltypeOrTemplateArg
static StatementMatcher inDecltypeOrTemplateArg()
Definition: UseAfterMoveCheck.cpp:78
EvaluationOrderUndefined
bool EvaluationOrderUndefined
Definition: UseAfterMoveCheck.cpp:33
DeclRef
const DeclRefExpr * DeclRef
Definition: UseAfterMoveCheck.cpp:30
clang::tidy::ClangTidyCheck::diag
DiagnosticBuilder diag(SourceLocation Loc, StringRef Description, DiagnosticIDs::Level Level=DiagnosticIDs::Warning)
Add a diagnostic with the check&#39;s name.
Definition: ClangTidy.cpp:438
clang::tidy::bugprone::emitDiagnostic
static void emitDiagnostic(const Expr *MovingCall, const DeclRefExpr *MoveArg, const UseAfterMove &Use, ClangTidyCheck *Check, ASTContext *Context)
Definition: UseAfterMoveCheck.cpp:356