llvm-project/clang/test/Analysis/inlining/false-positive-suppression.cpp
Balazs Benics c8772940ee
[analyzer] Wrap SymbolicRegions by ElementRegions before getting a FieldRegion (#85211)
Inside the ExprEngine when we process the initializers, we create a
PostInitializer program-point, which will refer to the field being
initialized, see `FieldLoc` inside `ExprEngine::ProcessInitializer`.

When a constructor (of which we evaluate the initializer-list) is
analyzed in top-level context, then the `this` pointer will be
represented by a `SymbolicRegion`, (as it should be).

This means that we will form a `FieldRegion{SymbolicRegion{.}}` as the
initialized region.

```c++
class Bear {
public:
  void brum() const;
};
class Door {
public:
  // PostInitializer would refer to "FieldRegion{SymRegion{this}}"
  // whereas in the store and everywhere else it would be:
  // "FieldRegion{ELementRegion{SymRegion{Ty*, this}, 0, Ty}".
  Door() : ptr(nullptr) {
    ptr->brum(); // Bug
  }
private:
  Bear* ptr;
};
```

We (as CSA folks) decided to avoid the creation of FieldRegions directly
of symbolic regions in the past:

f8643a9b31

---

In this patch, I propose to also canonicalize it as in the mentioned
patch, into this: `FieldRegion{ElementRegion{SymbolicRegion{Ty*, .}, 0,
Ty}`

This would mean that FieldRegions will/should never simply wrap a
SymbolicRegion directly, but rather an ElementRegion that is sitting in
between.

This patch should have practically no observable effects, as the store
(due to the mentioned patch) was made resilient to this issue, but we
use `PostInitializer::getLocationValue()` for an alternative reporting,
where we faced this issue.

Note that in really rare cases it suppresses now dereference bugs, as
demonstrated in the test. It is because in the past we failed to follow
the region of the PostInitializer inside the StoreSiteFinder visitor -
because it was using this code:
```c++
// If this is a post initializer expression, initializing the region, we
// should track the initializer expression.
if (std::optional<PostInitializer> PIP =
        Pred->getLocationAs<PostInitializer>()) {
  const MemRegion *FieldReg = (const MemRegion *)PIP->getLocationValue();
  if (FieldReg == R) {
    StoreSite = Pred;
    InitE = PIP->getInitializer()->getInit();
  }
}
```
Notice that the equality check didn't pass for the regions I'm
canonicalizing in this patch.

Given the nature of this change, we would rather upstream this patch.

CPP-4954
2024-03-21 18:22:22 +01:00

230 lines
4.2 KiB
C++

// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-config suppress-null-return-paths=false -verify %s
// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify -DSUPPRESSED=1 %s
namespace rdar12676053 {
// Delta-reduced from a preprocessed file.
template<class T>
class RefCount {
T *ref;
public:
T *operator->() const {
return ref ? ref : 0;
}
};
class string {};
class ParserInputState {
public:
string filename;
};
class Parser {
void setFilename(const string& f) {
inputState->filename = f;
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
protected:
RefCount<ParserInputState> inputState;
};
}
// This is the standard placement new.
inline void* operator new(__typeof__(sizeof(int)), void* __p) throw()
{
return __p;
}
extern bool coin();
class SomeClass {
public:
void doSomething();
};
namespace References {
class Map {
int *&getNewBox();
int *firstBox;
public:
int *&getValue(int key) {
if (coin()) {
return firstBox;
} else {
int *&newBox = getNewBox();
newBox = 0;
return newBox;
}
}
int *&getValueIndirectly(int key) {
int *&valueBox = getValue(key);
return valueBox;
}
};
void testMap(Map &m, int i) {
*m.getValue(i) = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
*m.getValueIndirectly(i) = 1;
#ifndef SUPPRESSED
// expected-warning@-2 {{Dereference of null pointer}}
#endif
int *&box = m.getValue(i);
extern int *getPointer();
box = getPointer();
*box = 1; // no-warning
int *&box2 = m.getValue(i);
box2 = 0;
*box2 = 1; // expected-warning {{Dereference of null pointer}}
}
SomeClass *&getSomeClass() {
if (coin()) {
extern SomeClass *&opaqueClass();
return opaqueClass();
} else {
static SomeClass *sharedClass;
sharedClass = 0;
return sharedClass;
}
}
void testClass() {
getSomeClass()->doSomething();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
// Separate the lvalue-to-rvalue conversion from the subsequent dereference.
SomeClass *object = getSomeClass();
object->doSomething();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
SomeClass *getNull() {
return 0;
}
SomeClass &returnNullReference() {
SomeClass *x = getNull();
return *x;
#ifndef SUPPRESSED
// expected-warning@-2 {{Returning null reference}}
#endif
}
}
class X{
public:
void get();
};
X *getNull() {
return 0;
}
void deref1(X *const &p) {
return p->get();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
void test1() {
return deref1(getNull());
}
void deref2(X *p3) {
p3->get();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
void pass2(X *const &p2) {
deref2(p2);
}
void test2() {
pass2(getNull());
}
void deref3(X *const &p2) {
X *p3 = p2;
p3->get();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
void test3() {
deref3(getNull());
}
namespace Cleanups {
class NonTrivial {
public:
~NonTrivial();
SomeClass *getNull() {
return 0;
}
};
void testImmediate() {
NonTrivial().getNull()->doSomething();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
void testAssignment() {
SomeClass *ptr = NonTrivial().getNull();
ptr->doSomething();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
void testArgumentHelper(SomeClass *arg) {
arg->doSomething();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
void testArgument() {
testArgumentHelper(NonTrivial().getNull());
}
}
class Bear *getNullBear() { return nullptr; }
class Bear {
public:
void brum() const;
};
class Door {
public:
Door() : ptr(getNullBear()) {
ptr->brum();
#ifndef SUPPRESSED
// expected-warning@-2 {{Called C++ object pointer is null}}
#endif
}
private:
Bear* ptr;
};